From d9e24779f0404a4c662ce62b130de368d483ea58 Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 05:16:56 +0100
Subject: [PATCH 1/9] refactor: count who follows a live view in a module of
 its own, for the map and the entities to share

---
 crates/observer-app/src/lib.rs         |  4 ++-
 crates/observer-app/src/map.rs         | 27 +++++------------
 crates/observer-app/src/map/tests.rs   |  4 +--
 crates/observer-app/src/watching.rs    | 41 ++++++++++++++++++++++++++
 crates/observer-web/src/live/topics.rs | 18 +++++------
 5 files changed, 62 insertions(+), 32 deletions(-)
 create mode 100644 crates/observer-app/src/watching.rs

diff --git a/crates/observer-app/src/lib.rs b/crates/observer-app/src/lib.rs
index 6d766a71..7d6c25c7 100644
--- a/crates/observer-app/src/lib.rs
+++ b/crates/observer-app/src/lib.rs
@@ -36,6 +36,7 @@ mod tickets;
 mod tools;
 pub mod updates;
 mod users;
+mod watching;
 
 pub use accounts::Accounts;
 pub use artifacts::{ArtifactTimings, Artifacts, ArtifactsSetup, ArtifactsTask};
@@ -53,7 +54,7 @@ pub use drops::{DayRates, Drops, DropsSetup, DropsTask, LogQuery};
 pub use error::Error;
 pub use features::{Features, FeaturesSetup, Switched};
 pub use files::{CommitGate, Files, Grant, Group, Login, SERVER as FILES_SERVER, file_group};
-pub use map::{ImageKind, LiveMap, MapSetup, MapTask, Watching};
+pub use map::{ImageKind, LiveMap, MapSetup, MapTask};
 pub use metrics::{DatabaseFiles, Metrics, MetricsSetup, Sampling, Sources};
 pub use own_paths::{OwnPaths, paths_inside};
 pub use passwords::PasswordCost;
@@ -66,3 +67,4 @@ pub use statistics::Statistics;
 pub use supervision::{ConsoleLines, LinesMissed, Running, Setup, Supervision};
 pub use tools::{ReportError, RunResult, Target, Tools, ToolsHook, ToolsSetup, outcome_text, report};
 pub use updates::{Takeover, Updates, UpdatesSetup, UpdatesTask};
+pub use watching::Watching;
diff --git a/crates/observer-app/src/map.rs b/crates/observer-app/src/map.rs
index 20020eb2..65c5d5dd 100644
--- a/crates/observer-app/src/map.rs
+++ b/crates/observer-app/src/map.rs
@@ -32,6 +32,7 @@ use self::image::image_size;
 use crate::audit::Record;
 use crate::host_file::{HostFileProblem, open_local};
 use crate::secrets::{hex, random};
+use crate::watching::{Watchers, Watching};
 use crate::{Caller, Clock, Error, Players, Supervision};
 
 /// How long one ask for positions lasts, and how often it is renewed while a panel watches.
@@ -61,19 +62,7 @@ struct Inner {
     players: Players,
     folder: PathBuf,
     live: watch::Sender<MapLive>,
-    watchers: watch::Sender<usize>,
-}
-
-/// Held while a panel follows the map: the server stops sending positions once none does.
-pub struct Watching {
-    watchers: watch::Sender<usize>,
-}
-
-impl Drop for Watching {
-    fn drop(&mut self) {
-        self.watchers
-            .send_modify(|watchers| *watchers = watchers.saturating_sub(1));
-    }
+    watchers: Watchers,
 }
 
 pub struct MapTask {
@@ -115,7 +104,7 @@ impl LiveMap {
                     waiting: 0,
                     onesync: true,
                 }),
-                watchers: watch::Sender::new(0),
+                watchers: Watchers::new(),
             }),
         };
         let stop = CancellationToken::new();
@@ -123,14 +112,12 @@ impl LiveMap {
         (map, MapTask { stop, task })
     }
 
-    /// The map as it stands and its changes, for as long as the guard is held.
+    /// The map as it stands and its changes, for as long as the guard is held: the server sends
+    /// positions only while someone holds one.
     pub fn watch(&self) -> (MapLive, watch::Receiver<MapLive>, Watching) {
-        self.inner.watchers.send_modify(|watchers| *watchers += 1);
+        let guard = self.inner.watchers.join();
         let mut live = self.inner.live.subscribe();
         let snapshot = live.borrow_and_update().clone();
-        let guard = Watching {
-            watchers: self.inner.watchers.clone(),
-        };
         (snapshot, live, guard)
     }
 
@@ -298,7 +285,7 @@ impl LiveMap {
                 Ok(record.write(tx, now)?)
             })
             .await?;
-        if *self.inner.watchers.borrow() > 0 {
+        if self.inner.watchers.any() {
             self.ask(true).await;
         }
         Ok(())
diff --git a/crates/observer-app/src/map/tests.rs b/crates/observer-app/src/map/tests.rs
index 1fe77de4..a4a239e7 100644
--- a/crates/observer-app/src/map/tests.rs
+++ b/crates/observer-app/src/map/tests.rs
@@ -257,11 +257,11 @@ async fn the_map_counts_who_watches_it_until_they_leave() {
 
     let (snapshot, _, first) = map.watch();
     let (_, _, second) = map.watch();
-    assert_eq!(*map.inner.watchers.borrow(), 2);
+    assert_eq!(*map.inner.watchers.subscribe().borrow(), 2);
     drop(first);
     drop(second);
 
-    assert_eq!(*map.inner.watchers.borrow(), 0);
+    assert_eq!(*map.inner.watchers.subscribe().borrow(), 0);
     assert_eq!(snapshot.players, []);
     assert!(snapshot.onesync);
     task.close().await;
diff --git a/crates/observer-app/src/watching.rs b/crates/observer-app/src/watching.rs
new file mode 100644
index 00000000..bdeac0bc
--- /dev/null
+++ b/crates/observer-app/src/watching.rs
@@ -0,0 +1,41 @@
+//! Who follows a live view. The server reads positions and entities only while a panel looks at
+//! them: each view counts its followers here, and each follower holds a guard that leaves with it.
+
+use tokio::sync::watch;
+
+/// The followers of one live view.
+#[derive(Clone)]
+pub(crate) struct Watchers(watch::Sender<usize>);
+
+impl Watchers {
+    pub(crate) fn new() -> Self {
+        Self(watch::Sender::new(0))
+    }
+
+    pub(crate) fn join(&self) -> Watching {
+        self.0.send_modify(|watchers| *watchers += 1);
+        Watching {
+            watchers: self.0.clone(),
+        }
+    }
+
+    pub(crate) fn any(&self) -> bool {
+        *self.0.borrow() > 0
+    }
+
+    pub(crate) fn subscribe(&self) -> watch::Receiver<usize> {
+        self.0.subscribe()
+    }
+}
+
+/// Held while a panel follows a live view: the server stops reading for it once none does.
+pub struct Watching {
+    watchers: watch::Sender<usize>,
+}
+
+impl Drop for Watching {
+    fn drop(&mut self) {
+        self.watchers
+            .send_modify(|watchers| *watchers = watchers.saturating_sub(1));
+    }
+}
diff --git a/crates/observer-web/src/live/topics.rs b/crates/observer-web/src/live/topics.rs
index c0f50700..f0be265d 100644
--- a/crates/observer-web/src/live/topics.rs
+++ b/crates/observer-web/src/live/topics.rs
@@ -144,7 +144,7 @@ pub(super) async fn open(topic: Topic, since: Option<u64>, state: &AppState) ->
             let (snapshot, live, watching) = state.map()?.watch();
             Ok(Feed {
                 snapshot: TopicSnapshot::ServerMap(snapshot),
-                events: Some(map_events(live, watching)),
+                events: Some(watched_events(live, watching, TopicEvent::ServerMap)),
             })
         }
         Topic::ServerChanges => {
@@ -197,18 +197,18 @@ where
     }))
 }
 
-/// The map's changes, holding the guard that keeps the server sending positions: it goes with the
-/// subscription.
-fn map_events(live: watch::Receiver<observer_domain::map::MapLive>, watching: Watching) -> Events {
+/// The changes of a view the server reads for only while someone looks, holding the guard that
+/// keeps it reading: it goes with the subscription.
+fn watched_events<T>(live: watch::Receiver<T>, watching: Watching, event: fn(T) -> TopicEvent) -> Events
+where
+    T: Clone + Send + Sync + 'static,
+{
     Box::pin(stream::unfold(
         (live, watching),
-        |(mut live, watching)| async move {
+        move |(mut live, watching)| async move {
             live.changed().await.ok()?;
             let current = live.borrow_and_update().clone();
-            Some((
-                Delivery::Event(Box::new(TopicEvent::ServerMap(current))),
-                (live, watching),
-            ))
+            Some((Delivery::Event(Box::new(event(current))), (live, watching)))
         },
     ))
 }

From d97f7c87df3f52d4a6b7d4a5b7b1763f0fe79ec6 Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 05:17:02 +0100
Subject: [PATCH 2/9] refactor(web): share the helpers that read a page's
 address, and a settings category's loading card and page link

---
 web/src/drops/search.ts      | 17 +----------------
 web/src/lib/search.ts        | 19 +++++++++++++++++++
 web/src/settings/LiveMap.tsx | 23 ++++-------------------
 web/src/settings/Row.tsx     | 31 +++++++++++++++++++++++++++++--
 web/src/statistics/search.ts |  4 +---
 5 files changed, 54 insertions(+), 40 deletions(-)
 create mode 100644 web/src/lib/search.ts

diff --git a/web/src/drops/search.ts b/web/src/drops/search.ts
index 45301a1f..a774ad7a 100644
--- a/web/src/drops/search.ts
+++ b/web/src/drops/search.ts
@@ -2,6 +2,7 @@ import type { ChartCategory } from '../api/generated/ChartCategory';
 import type { DropCategory } from '../api/generated/DropCategory';
 import type { DropKind } from '../api/generated/DropKind';
 import type { DropsRange } from '../api/generated/DropsRange';
+import { defined, oneOf, text } from '../lib/search';
 
 // The page keeps its range, its chart and the log's filters in the address, so the profile, the
 // Diagnostics page and the cards of the page itself link to a filtered view: `/drops?run=12`.
@@ -71,28 +72,12 @@ export type DropsSearch = Omit<LogFilters, 'range'> & {
 /** The filters of the log the address may hold, in the order the query string writes them. */
 const FILTERS = ['category', 'kind', 'resource', 'signature', 'run', 'player', 'profile', 'group'] as const;
 
-const oneOf = <T extends string>(choices: readonly T[], value: unknown): T | undefined =>
-    choices.find((choice) => choice === value);
-
 /** A positive whole number, as the address or a form gives it; anything else is left out. */
 const id = (value: unknown) => {
     const number = typeof value === 'string' && /^\d+$/.test(value.trim()) ? Number(value) : value;
     return typeof number === 'number' && Number.isSafeInteger(number) && number > 0 ? number : undefined;
 };
 
-/**
- * A text filter, trimmed; an empty one is left out. What the address parsed as a number or a
- * boolean, a licence's digits or a name such as `true`, comes back as the text it was.
- */
-const text = (value: unknown) => {
-    const written = typeof value === 'number' || typeof value === 'boolean' ? String(value) : value;
-    return typeof written === 'string' && written.trim() !== '' ? written.trim() : undefined;
-};
-
-/** Drops the fields that are not set, so that two equal searches read the same. */
-const defined = <T extends object>(object: T): T =>
-    Object.fromEntries(Object.entries(object).filter(([, value]) => value !== undefined)) as T;
-
 /**
  * The page's address as the page reads it, whatever was typed into it: unknown or malformed fields
  * are left out rather than refused, and a kind that is not one of its category's is dropped.
diff --git a/web/src/lib/search.ts b/web/src/lib/search.ts
new file mode 100644
index 00000000..89e656f7
--- /dev/null
+++ b/web/src/lib/search.ts
@@ -0,0 +1,19 @@
+// What the pages that keep their state in the address read it with. The address bar is the user's
+// to edit: what does not read is left out rather than refused.
+
+/** One of `choices`, or nothing. */
+export const oneOf = <T extends string>(choices: readonly T[], value: unknown): T | undefined =>
+    choices.find((choice) => choice === value);
+
+/**
+ * A text filter, trimmed; an empty one is left out. What the address parsed as a number or a
+ * boolean, a licence's digits or a name such as `true`, comes back as the text it was.
+ */
+export const text = (value: unknown) => {
+    const written = typeof value === 'number' || typeof value === 'boolean' ? String(value) : value;
+    return typeof written === 'string' && written.trim() !== '' ? written.trim() : undefined;
+};
+
+/** Drops the fields that are not set, so that two equal searches read the same. */
+export const defined = <T extends object>(object: T): T =>
+    Object.fromEntries(Object.entries(object).filter(([, value]) => value !== undefined)) as T;
diff --git a/web/src/settings/LiveMap.tsx b/web/src/settings/LiveMap.tsx
index 183a7889..39643d6f 100644
--- a/web/src/settings/LiveMap.tsx
+++ b/web/src/settings/LiveMap.tsx
@@ -1,6 +1,5 @@
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { Link } from '@tanstack/react-router';
-import { ArrowRight, Check, ChevronDown, Image as ImageIcon, Trash2 } from 'lucide-react';
+import { Check, ChevronDown, Image as ImageIcon, Trash2 } from 'lucide-react';
 import { useState, type MouseEvent } from 'react';
 
 import type { MapBounds } from '../api/generated/MapBounds';
@@ -25,7 +24,7 @@ import { boundsFrom, type Spot } from '../map/geometry';
 import { useVisit } from '../players/words';
 import { useSchedule } from '../schedule/context';
 import { SettingsForm, useSection } from './Form';
-import { CategoryHead, SettingRow, SettingsGroup } from './Row';
+import { CategoryHead, CategoryLink, CategoryLoading, SettingRow, SettingsGroup } from './Row';
 
 type Outcome = { tone: 'success' | 'danger'; message: string };
 type Way = 'players' | 'edges';
@@ -45,25 +44,11 @@ export function LiveMapSettings() {
                 category="map"
                 aside={
                     allows(me, Permission.PlayersMap) ? (
-                        <Link
-                            to="/map"
-                            className="inline-flex items-center gap-1.5 text-ui font-medium text-ink underline-offset-2 hover:underline max-md:min-h-11"
-                        >
-                            {t.settings.map.openMap}
-                            <ArrowRight size={14} strokeWidth={1.5} aria-hidden="true" />
-                        </Link>
+                        <CategoryLink to="/map">{t.settings.map.openMap}</CategoryLink>
                     ) : undefined
                 }
             />
-            {view.isPending && (
-                <section className="card">
-                    <div className="card-body flex flex-col gap-3" aria-busy="true">
-                        <span className="sr-only">{t.common.loading}</span>
-                        <span className="skeleton w-1/3" />
-                        <span className="skeleton w-1/2" />
-                    </div>
-                </section>
-            )}
+            {view.isPending && <CategoryLoading />}
             {view.isError && (
                 <Notice tone="danger">
                     {t.settings.map.loadFailed} {errorMessage(t, view.error)}
diff --git a/web/src/settings/Row.tsx b/web/src/settings/Row.tsx
index ef7760d9..855857ad 100644
--- a/web/src/settings/Row.tsx
+++ b/web/src/settings/Row.tsx
@@ -1,5 +1,5 @@
-import { useLocation } from '@tanstack/react-router';
-import { Clock } from 'lucide-react';
+import { Link, useLocation, type LinkProps } from '@tanstack/react-router';
+import { ArrowRight, Clock } from 'lucide-react';
 import { useEffect, useId, useRef, type ReactNode } from 'react';
 
 import { Chip } from '../components/Chip';
@@ -129,6 +129,33 @@ export function CategoryHead({ category, aside }: { category: CategoryId; aside?
     );
 }
 
+/** The way from a category to the page that acts on what it sets. */
+export function CategoryLink({ to, children }: { to: LinkProps['to']; children: ReactNode }) {
+    return (
+        <Link
+            to={to}
+            className="inline-flex items-center gap-1.5 text-ui font-medium text-ink underline-offset-2 hover:underline max-md:min-h-11"
+        >
+            {children}
+            <ArrowRight size={14} strokeWidth={1.5} aria-hidden="true" />
+        </Link>
+    );
+}
+
+/** A category whose settings are still being read. */
+export function CategoryLoading() {
+    const { t } = useI18n();
+    return (
+        <section className="card">
+            <div className="card-body flex flex-col gap-3" aria-busy="true">
+                <span className="sr-only">{t.common.loading}</span>
+                <span className="skeleton w-1/3" />
+                <span className="skeleton w-1/2" />
+            </div>
+        </section>
+    );
+}
+
 /** A short exclusive choice drawn as a segmented control, named by its row. */
 export function Segmented<T extends string>({
     ids,
diff --git a/web/src/statistics/search.ts b/web/src/statistics/search.ts
index 18553d02..06e94b4f 100644
--- a/web/src/statistics/search.ts
+++ b/web/src/statistics/search.ts
@@ -1,5 +1,6 @@
 import type { DropsRange } from '../api/generated/DropsRange';
 import type { Range } from '../api/generated/Range';
+import { oneOf } from '../lib/search';
 
 // The page keeps its tab, its ranges, the zoom, the lanes added and the comparison in the address,
 // so that a view is shared by its link. What the address bar holds is the user's to edit: what does
@@ -30,9 +31,6 @@ export type StatisticsSearch = {
 const second = (value: unknown) =>
     typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : undefined;
 
-const oneOf = <T extends string>(choices: readonly T[], value: unknown): T | undefined =>
-    choices.find((choice) => choice === value);
-
 export const parseStatisticsSearch = (search: Record<string, unknown>): StatisticsSearch => {
     const from = second(search.from);
     const to = second(search.to);

From e620e7eef6c412978447dd0e4be9f942488b1bcb Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 05:19:25 +0100
Subject: [PATCH 3/9] feat: list the server's entities through the bridge while
 someone looks at them, and delete them a hundred at a time

---
 crates/fake-fxserver/src/entities.rs         | 712 ++++++++++++++++
 crates/fake-fxserver/src/main.rs             |  96 +++
 crates/fake-fxserver/tests/runtime.rs        | 303 ++++++-
 crates/observer-app/src/entities.rs          | 746 ++++++++++++++++
 crates/observer-app/src/entities/query.rs    | 842 +++++++++++++++++++
 crates/observer-app/src/entities/tests.rs    | 462 ++++++++++
 crates/observer-app/src/lib.rs               |   2 +
 crates/observer-domain/src/audit.rs          |  12 +-
 crates/observer-domain/src/entities.rs       | 714 ++++++++++++++++
 crates/observer-domain/src/error.rs          |  14 +
 crates/observer-domain/src/features.rs       |  26 +-
 crates/observer-domain/src/lib.rs            |   1 +
 crates/observer-domain/src/live.rs           |  13 +-
 crates/observer-domain/src/permissions.rs    |  24 +
 crates/observer-fxserver/src/bridge.rs       |  57 +-
 crates/observer-fxserver/src/entities.rs     | 610 ++++++++++++++
 crates/observer-fxserver/src/lib.rs          |   1 +
 crates/observer-fxserver/src/players.rs      |   2 +-
 crates/observer-fxserver/src/stdin.rs        |   8 +-
 crates/observer-fxserver/src/supervisor.rs   |  21 +
 crates/observer-store/src/entities.rs        |  39 +
 crates/observer-store/src/lib.rs             |   1 +
 crates/observer-web/src/api.rs               |  13 +
 crates/observer-web/src/api/entities.rs      | 130 +++
 crates/observer-web/src/error.rs             |   6 +
 crates/observer-web/src/lib.rs               |  14 +-
 crates/observer-web/src/live/topics.rs       |   8 +
 crates/observer-web/src/tests.rs             |  22 +-
 crates/observer-web/src/tests/entities.rs    | 265 ++++++
 crates/observer/src/run.rs                   |  23 +-
 resource/CONTRACT.md                         |   6 +-
 resource/observer/server.lua                 | 499 +++++++++++
 web/src/api/generated/AuditAction.ts         |   2 +-
 web/src/api/generated/BucketCount.ts         |   3 +
 web/src/api/generated/ClassCount.ts          |   4 +
 web/src/api/generated/EntitiesLive.ts        |  51 ++
 web/src/api/generated/EntitiesSettings.ts    |   7 +
 web/src/api/generated/EntitiesUnavailable.ts |   6 +
 web/src/api/generated/EntityCell.ts          |   7 +
 web/src/api/generated/EntityCounts.ts        |  15 +
 web/src/api/generated/EntityDeleteRequest.ts |  11 +
 web/src/api/generated/EntityDeletion.ts      |   7 +
 web/src/api/generated/EntityFacets.ts        |  21 +
 web/src/api/generated/EntityItem.ts          |  43 +
 web/src/api/generated/EntityKind.ts          |   3 +
 web/src/api/generated/EntityLimits.ts        |  10 +
 web/src/api/generated/EntityMap.ts           |  26 +
 web/src/api/generated/EntityOutcome.ts       |   6 +
 web/src/api/generated/EntityPage.ts          |  18 +
 web/src/api/generated/EntityPoint.ts         |   7 +
 web/src/api/generated/EntityResult.ts        |   4 +
 web/src/api/generated/EntitySort.ts          |   3 +
 web/src/api/generated/EntityTarget.ts        |   6 +
 web/src/api/generated/ErrorCode.ts           |   2 +-
 web/src/api/generated/Feature.ts             |   2 +-
 web/src/api/generated/FeatureTask.ts         |   2 +-
 web/src/api/generated/KindCounts.ts          |   3 +
 web/src/api/generated/ModelCount.ts          |   4 +
 web/src/api/generated/OwnerCount.ts          |   3 +
 web/src/api/generated/Permission.ts          |   2 +
 web/src/api/generated/PermissionArea.ts      |   2 +-
 web/src/api/generated/ResourceCount.ts       |   7 +
 web/src/api/generated/Topic.ts               |   2 +-
 web/src/api/generated/TopicEvent.ts          |   3 +-
 web/src/api/generated/TopicSnapshot.ts       |   3 +-
 web/src/api/generated/VehicleClass.ts        |   6 +
 web/src/audit/details.test.ts                |  21 +
 web/src/audit/details.ts                     |  36 +-
 web/src/i18n/en.ts                           |  61 ++
 web/src/live/messages.ts                     |  34 +
 web/src/settings/catalog.ts                  |   3 +
 71 files changed, 6110 insertions(+), 38 deletions(-)
 create mode 100644 crates/fake-fxserver/src/entities.rs
 create mode 100644 crates/observer-app/src/entities.rs
 create mode 100644 crates/observer-app/src/entities/query.rs
 create mode 100644 crates/observer-app/src/entities/tests.rs
 create mode 100644 crates/observer-domain/src/entities.rs
 create mode 100644 crates/observer-fxserver/src/entities.rs
 create mode 100644 crates/observer-store/src/entities.rs
 create mode 100644 crates/observer-web/src/api/entities.rs
 create mode 100644 crates/observer-web/src/tests/entities.rs
 create mode 100644 web/src/api/generated/BucketCount.ts
 create mode 100644 web/src/api/generated/ClassCount.ts
 create mode 100644 web/src/api/generated/EntitiesLive.ts
 create mode 100644 web/src/api/generated/EntitiesSettings.ts
 create mode 100644 web/src/api/generated/EntitiesUnavailable.ts
 create mode 100644 web/src/api/generated/EntityCell.ts
 create mode 100644 web/src/api/generated/EntityCounts.ts
 create mode 100644 web/src/api/generated/EntityDeleteRequest.ts
 create mode 100644 web/src/api/generated/EntityDeletion.ts
 create mode 100644 web/src/api/generated/EntityFacets.ts
 create mode 100644 web/src/api/generated/EntityItem.ts
 create mode 100644 web/src/api/generated/EntityKind.ts
 create mode 100644 web/src/api/generated/EntityLimits.ts
 create mode 100644 web/src/api/generated/EntityMap.ts
 create mode 100644 web/src/api/generated/EntityOutcome.ts
 create mode 100644 web/src/api/generated/EntityPage.ts
 create mode 100644 web/src/api/generated/EntityPoint.ts
 create mode 100644 web/src/api/generated/EntityResult.ts
 create mode 100644 web/src/api/generated/EntitySort.ts
 create mode 100644 web/src/api/generated/EntityTarget.ts
 create mode 100644 web/src/api/generated/KindCounts.ts
 create mode 100644 web/src/api/generated/ModelCount.ts
 create mode 100644 web/src/api/generated/OwnerCount.ts
 create mode 100644 web/src/api/generated/ResourceCount.ts
 create mode 100644 web/src/api/generated/VehicleClass.ts

diff --git a/crates/fake-fxserver/src/entities.rs b/crates/fake-fxserver/src/entities.rs
new file mode 100644
index 00000000..b497e886
--- /dev/null
+++ b/crates/fake-fxserver/src/entities.rs
@@ -0,0 +1,712 @@
+//! The server's entities as the bridge lists and deletes them: what `fake_entity` and
+//! `fake_entities` put in the world, swept in parts while Observer asks, each entity under the
+//! serial the bridge draws when it first sees it.
+
+use std::collections::{BTreeMap, HashMap};
+use std::fmt::Write as _;
+
+use serde_json::{Value, json};
+
+/// The bridge's own limits, from `server.lua`.
+const PART_ROWS: usize = 500;
+const ROWS_MAX: usize = 20_000;
+const LOOKUPS_MAX: usize = 300;
+const BUDGET_US: u64 = 50_000;
+const COSTLY_US: u64 = 25_000;
+const COSTLY_LIST_US: u64 = 10_000;
+const EVERY_MAX_MS: u64 = 60_000;
+const DELETE_MAX: usize = 100;
+/// The console commands that change the fake's world, which [`World::command`] takes.
+pub const COMMANDS: [&str; 6] = [
+    "fake_entity",
+    "fake_entities",
+    "fake_entity_gone",
+    "fake_entity_stays",
+    "fake_enter",
+    "fake_possess",
+];
+const VEHICLE: u8 = 2;
+const PED: u8 = 1;
+const OBJECT: u8 = 3;
+const TRAIN: u8 = 8;
+const OCCUPIED: u8 = 1;
+const RESOURCE_PENDING: u8 = 2;
+
+#[derive(Debug, Clone)]
+struct Entity {
+    kind: u8,
+    /// Of a vehicle, from 1; 0 otherwise.
+    class: u8,
+    model: u32,
+    position: [f64; 3],
+    owner: Option<u32>,
+    bucket: i32,
+    population: u8,
+    resource: Option<String>,
+    /// The player sitting in it.
+    occupant: Option<u32>,
+    /// The player whose own ped it became.
+    player: Option<u32>,
+    /// `DeleteEntity` leaves it there.
+    stays: bool,
+}
+
+/// What the bridge keeps of an entity it saw.
+struct Seen {
+    serial: u32,
+    kind: u8,
+    model: u32,
+    creator: Creator,
+    sweep: u32,
+}
+
+/// The resource that created an entity, as far as the bridge looked.
+enum Creator {
+    NotLookedUp,
+    None,
+    Resource(String),
+}
+
+#[derive(Default)]
+pub struct World {
+    entities: BTreeMap<u16, Entity>,
+    next_net_id: u16,
+    seen: HashMap<u16, Seen>,
+    next_serial: u32,
+    /// The game timer when the bridge started.
+    epoch: u64,
+    seq: u32,
+    sweeps: u32,
+    spacing: u64,
+}
+
+/// What a sweep is told of the server.
+pub struct Server {
+    pub players: usize,
+    pub onesync: bool,
+    pub gta: bool,
+    /// The cadence Observer asked for.
+    pub every_ms: u64,
+    /// What reading one entity costs, and listing them all, in microseconds.
+    pub row_us: u64,
+    pub list_us: Option<u64>,
+}
+
+impl World {
+    /// The bridge started, or started again: it numbers the entities from 1 again.
+    pub fn bridge_started(&mut self, timer_ms: u64) {
+        self.seen.clear();
+        self.next_serial = 0;
+        self.epoch = timer_ms;
+        self.seq = 0;
+        self.sweeps = 0;
+        self.spacing = 1;
+    }
+
+    /// Observer stopped asking: the next sweeps start at the cadence asked for.
+    pub fn unspaced(&mut self) {
+        self.spacing = 1;
+    }
+
+    pub fn cadence_ms(&self, every_ms: u64) -> u64 {
+        (every_ms * self.spacing.max(1)).min(EVERY_MAX_MS)
+    }
+
+    /// `fake_entity <vehicle|ped|object|train|heli|boat> <x> <y> <z> [resource or -] [owner or -]
+    /// [bucket]`: one entity, under the next net id.
+    pub fn add(&mut self, words: &[String]) -> Option<u16> {
+        let (kind, class) = match words.first()?.as_str() {
+            "vehicle" => (VEHICLE, 1),
+            "bike" => (VEHICLE, 2),
+            "boat" => (VEHICLE, 3),
+            "heli" => (VEHICLE, 4),
+            "train" => (VEHICLE, TRAIN),
+            "ped" => (PED, 0),
+            "object" => (OBJECT, 0),
+            _ => return None,
+        };
+        let coordinate = |index: usize| words.get(index)?.parse::<f64>().ok();
+        let position = [coordinate(1)?, coordinate(2)?, coordinate(3)?];
+        let named = |index: usize| words.get(index).filter(|word| *word != "-");
+        let resource = named(4).cloned();
+        let owner = named(5).and_then(|owner| owner.parse().ok());
+        let bucket = words.get(6).and_then(|bucket| bucket.parse().ok()).unwrap_or(0);
+        Some(self.insert(Entity {
+            kind,
+            class,
+            model: model_of(kind, class, self.next_net_id),
+            position,
+            owner,
+            bucket,
+            population: if resource.is_some() { 7 } else { 5 },
+            resource,
+            occupant: None,
+            player: None,
+            stays: false,
+        }))
+    }
+
+    /// `fake_entities <vehicles> <peds> <objects>`: that many of each, spread over the map, as a
+    /// small busy server holds them: a third of the vehicles from a garage resource and owned by
+    /// the first players, most objects from two resources, the rest the game's own.
+    pub fn fill(&mut self, vehicles: usize, peds: usize, objects: usize) {
+        for (kind, count) in [(VEHICLE, vehicles), (PED, peds), (OBJECT, objects)] {
+            for index in 0..count {
+                #[expect(clippy::cast_precision_loss, reason = "a test entity's place on a spiral")]
+                let turn = index as f64;
+                let angle = turn * 0.61 + f64::from(kind);
+                let radius = 80.0 + 9.0 * turn.sqrt() * (1.0 + f64::from(kind));
+                let position = [
+                    radius * angle.cos() + 200.0,
+                    radius * angle.sin() - 900.0,
+                    30.0 + (turn % 7.0),
+                ];
+                let (class, resource, owner) = match kind {
+                    VEHICLE => (
+                        match index % 11 {
+                            0 => 2,
+                            5 => 4,
+                            7 => 3,
+                            _ => 1,
+                        },
+                        (index % 3 == 0).then(|| "qb-garages".to_owned()),
+                        (index % 3 == 0).then(|| u32::try_from(index % 5 + 1).unwrap_or(1)),
+                    ),
+                    OBJECT => (
+                        0,
+                        match index % 4 {
+                            0 => Some("ox_inventory".to_owned()),
+                            1 => Some("qb-houses".to_owned()),
+                            _ => None,
+                        },
+                        None,
+                    ),
+                    _ => (0, None, (index % 4 == 0).then_some(1)),
+                };
+                self.insert(Entity {
+                    kind,
+                    class,
+                    model: model_of(kind, class, u16::try_from(index % 9).unwrap_or(0)),
+                    position,
+                    owner,
+                    bucket: if index % 17 == 0 { 3 } else { 0 },
+                    population: if resource.is_some() { 7 } else { 5 },
+                    resource,
+                    occupant: None,
+                    player: None,
+                    stays: false,
+                });
+            }
+        }
+    }
+
+    /// One of the console commands that change the world; the others are not this module's.
+    pub fn command(&mut self, name: &str, words: &[String]) {
+        let number = |index: usize| words.get(index).and_then(|word| word.parse::<u32>().ok());
+        let net_id = |index: usize| number(index).and_then(|net_id| u16::try_from(net_id).ok());
+        match name {
+            "fake_entity" => {
+                self.add(words);
+            }
+            "fake_entities" => {
+                let count = |index: usize| {
+                    number(index)
+                        .and_then(|count| usize::try_from(count).ok())
+                        .unwrap_or(0)
+                };
+                self.fill(count(0), count(1), count(2));
+            }
+            "fake_entity_gone" => {
+                if let Some(net_id) = net_id(0) {
+                    self.remove(net_id);
+                }
+            }
+            "fake_entity_stays" => {
+                if let Some(net_id) = net_id(0) {
+                    self.keep(net_id);
+                }
+            }
+            "fake_enter" => {
+                if let Some(player) = number(0) {
+                    self.enter(player, net_id(1));
+                }
+            }
+            "fake_possess" => {
+                if let (Some(player), Some(net_id)) = (number(0), net_id(1)) {
+                    self.possess(player, net_id);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    fn insert(&mut self, entity: Entity) -> u16 {
+        self.next_net_id += 1;
+        self.entities.insert(self.next_net_id, entity);
+        self.next_net_id
+    }
+
+    /// `fake_entity_gone <net id>`: the game removed it by itself.
+    pub fn remove(&mut self, net_id: u16) {
+        self.entities.remove(&net_id);
+    }
+
+    /// `fake_entity_stays <net id>`: asked to delete it, the game keeps it.
+    pub fn keep(&mut self, net_id: u16) {
+        if let Some(entity) = self.entities.get_mut(&net_id) {
+            entity.stays = true;
+        }
+    }
+
+    /// `fake_enter <player> <net id>`: the player sits in the vehicle; without one, steps out.
+    pub fn enter(&mut self, player: u32, net_id: Option<u16>) {
+        for entity in self.entities.values_mut() {
+            if entity.occupant == Some(player) {
+                entity.occupant = None;
+            }
+        }
+        if let Some(entity) = net_id.and_then(|net_id| self.entities.get_mut(&net_id)) {
+            entity.occupant = Some(player);
+        }
+    }
+
+    /// `fake_possess <player> <net id>`: the ped becomes the player's own.
+    pub fn possess(&mut self, player: u32, net_id: u16) {
+        if let Some(entity) = self.entities.get_mut(&net_id).filter(|entity| entity.kind == PED) {
+            entity.player = Some(player);
+        }
+    }
+
+    /// A sweep as the bridge reports it: its parts, in order.
+    pub fn sweep(&mut self, server: &Server) -> Vec<Value> {
+        self.seq += 1;
+        let (epoch, seq) = (self.epoch, self.seq);
+        let head = |part: usize, last: bool, rows: &[String]| {
+            json!({
+                "type": "observer", "kind": "entities", "epoch": epoch, "seq": seq,
+                "part": part, "last": last, "rows": rows.join(";"),
+            })
+        };
+        let unavailable = if !server.gta {
+            Some("game")
+        } else if !server.onesync {
+            Some("onesync")
+        } else {
+            None
+        };
+        if let Some(unavailable) = unavailable {
+            let mut report = head(1, true, &[]);
+            report["unavailable"] = json!(unavailable);
+            return vec![report];
+        }
+        self.sweeps += 1;
+
+        let list_us = server.list_us.unwrap_or(100 + self.entities.len() as u64 / 10);
+        let mut spent = list_us;
+        let mut names: Vec<String> = Vec::new();
+        let mut rows: Vec<String> = Vec::new();
+        let mut parts = Vec::new();
+        let (mut listed, mut lookups, mut truncated) = (0, 0, false);
+        let listable: Vec<u16> = [VEHICLE, OBJECT, PED]
+            .into_iter()
+            .flat_map(|kind| {
+                self.entities
+                    .iter()
+                    .filter(move |(_, entity)| entity.kind == kind && entity.player.is_none())
+                    .map(|(net_id, _)| *net_id)
+            })
+            .collect();
+        for net_id in listable {
+            if listed >= ROWS_MAX || spent >= BUDGET_US {
+                truncated = true;
+                break;
+            }
+            spent += server.row_us;
+            if let Some(row) = self.row(net_id, &mut lookups, &mut names) {
+                rows.push(row);
+                listed += 1;
+            }
+            if rows.len() >= PART_ROWS {
+                parts.push(head(parts.len() + 1, false, &rows));
+                rows.clear();
+            }
+        }
+        if !truncated {
+            let sweep = self.sweeps;
+            self.seen.retain(|_, seen| seen.sweep == sweep);
+        }
+
+        let ceiling = EVERY_MAX_MS.div_ceil(server.every_ms.max(1));
+        if spent > COSTLY_US || list_us > COSTLY_LIST_US {
+            self.spacing = (self.spacing * 2).min(ceiling.max(1));
+        } else if self.spacing > 1 && spent < COSTLY_US / 2 && list_us < COSTLY_LIST_US / 2 {
+            self.spacing = (self.spacing / 2).max(1);
+        }
+
+        let mut last = head(parts.len() + 1, true, &rows);
+        last["counts"] = self.counts(server.players);
+        last["listed"] = json!(listed);
+        last["failed"] = json!(0);
+        last["truncated"] = json!(truncated);
+        last["workUs"] = json!(spent);
+        last["listUs"] = json!(list_us);
+        last["frames"] = json!(1 + spent / 1000);
+        last["everyMs"] = json!(self.cadence_ms(server.every_ms));
+        last["spaced"] = json!(self.spacing > 1);
+        last["resources"] = json!(names);
+        parts.push(last);
+        parts
+    }
+
+    /// What the game counts of each kind, every player's own ped among the peds.
+    fn counts(&self, players: usize) -> Value {
+        let player_peds = u32::try_from(players).unwrap_or(u32::MAX);
+        let mut counts = [0, 0, player_peds];
+        for entity in self.entities.values().filter(|entity| entity.player.is_none()) {
+            let place = match entity.kind {
+                VEHICLE => 0,
+                OBJECT => 1,
+                _ => 2,
+            };
+            counts[place] += 1;
+        }
+        json!({ "vehicles": counts[0], "objects": counts[1], "peds": counts[2], "playerPeds": player_peds })
+    }
+
+    /// One entity's row, under the serial drawn when the bridge first saw it. Its creating
+    /// resource is looked up once, a few hundred entities a sweep.
+    fn row(&mut self, net_id: u16, lookups: &mut usize, names: &mut Vec<String>) -> Option<String> {
+        let entity = self.entities.get(&net_id)?;
+        let known = self
+            .seen
+            .get(&net_id)
+            .is_some_and(|seen| seen.kind == entity.kind && seen.model == entity.model);
+        if !known {
+            self.next_serial += 1;
+            self.seen.insert(
+                net_id,
+                Seen {
+                    serial: self.next_serial,
+                    kind: entity.kind,
+                    model: entity.model,
+                    creator: Creator::NotLookedUp,
+                    sweep: 0,
+                },
+            );
+        }
+        let seen = self.seen.get_mut(&net_id)?;
+        seen.sweep = self.sweeps;
+        if matches!(seen.creator, Creator::NotLookedUp) && *lookups < LOOKUPS_MAX {
+            *lookups += 1;
+            seen.creator = entity.resource.clone().map_or(Creator::None, Creator::Resource);
+        }
+        let mut flags = 0;
+        if entity.kind == VEHICLE && entity.occupant.is_some() {
+            flags |= OCCUPIED;
+        }
+        let resource = match &seen.creator {
+            Creator::NotLookedUp => {
+                flags |= RESOURCE_PENDING;
+                0
+            }
+            Creator::None => 0,
+            Creator::Resource(name) => names.iter().position(|known| known == name).map_or_else(
+                || {
+                    names.push(name.clone());
+                    names.len()
+                },
+                |place| place + 1,
+            ),
+        };
+        let [x, y, z] = entity.position;
+        let mut row = String::new();
+        let _ = write!(
+            row,
+            "{net_id},{},{},{},{},{x:.1},{y:.1},{z:.1},{},{},{},{resource},{flags}",
+            seen.serial,
+            entity.kind,
+            entity.class,
+            entity.model,
+            entity.owner.map_or(-1, i64::from),
+            entity.bucket,
+            entity.population,
+        );
+        Some(row)
+    }
+
+    /// The bridge's answer to `deleteEntities`, at `now` in Unix seconds, or none for a request it
+    /// does not take.
+    pub fn delete(&mut self, payload: &Value, now: i64) -> Option<Value> {
+        let request = payload["request"].as_u64()?;
+        let deadline = payload["deadline"].as_i64()?;
+        let targets: Vec<u64> = payload["targets"]
+            .as_array()?
+            .iter()
+            .map(Value::as_u64)
+            .collect::<Option<_>>()?;
+        if targets.is_empty() || !targets.len().is_multiple_of(2) || targets.len() / 2 > DELETE_MAX {
+            return None;
+        }
+        let epoch = payload["epoch"].as_u64();
+        let outcomes: Vec<Value> = targets
+            .chunks(2)
+            .map(|pair| {
+                let net_id = u16::try_from(pair[0]).unwrap_or(0);
+                let outcome = if epoch != Some(self.epoch) {
+                    "changed"
+                } else if now > deadline {
+                    "late"
+                } else {
+                    self.delete_one(net_id, pair[1])
+                };
+                json!([net_id, outcome])
+            })
+            .collect();
+        Some(
+            json!({ "type": "observer", "kind": "entitiesDeleted", "request": request, "outcomes": outcomes }),
+        )
+    }
+
+    fn delete_one(&mut self, net_id: u16, serial: u64) -> &'static str {
+        let Some(entity) = self.entities.get(&net_id) else {
+            return "gone";
+        };
+        let listed = self.seen.get(&net_id).is_some_and(|seen| {
+            u64::from(seen.serial) == serial && seen.kind == entity.kind && seen.model == entity.model
+        });
+        if !listed {
+            return "changed";
+        }
+        if entity.player.is_some() {
+            return "player";
+        }
+        if entity.kind == VEHICLE && entity.occupant.is_some() {
+            return "occupied";
+        }
+        if entity.class == TRAIN {
+            return "train";
+        }
+        if entity.stays {
+            return "unconfirmed";
+        }
+        self.entities.remove(&net_id);
+        self.seen.remove(&net_id);
+        "deleted"
+    }
+}
+
+/// A model's hash that depends on what the entity is: a few distinct ones of each kind.
+fn model_of(kind: u8, class: u8, variant: u16) -> u32 {
+    const VEHICLES: [u32; 4] = [0xB779_A091, 0x3C4E_2113, 0x9F05_F101, 0x5C23_AF9B];
+    const PEDS: [u32; 3] = [0x705E_61F2, 0x9C9E_FFD8, 0x1DF5_A2C3];
+    const OBJECTS: [u32; 5] = [0x0A1B_2C3D, 0x6B79_5EBC, 0xE0FA_F6D2, 0x4C80_EB0E, 0x3ADB_3357];
+    let variant = usize::from(variant);
+    match kind {
+        VEHICLE if class == TRAIN => 0x3D6A_AA9B,
+        VEHICLE if class == 4 => 0x2C63_4FBD,
+        VEHICLE => VEHICLES[variant % VEHICLES.len()],
+        PED => PEDS[variant % PEDS.len()],
+        _ => OBJECTS[variant % OBJECTS.len()],
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn words(line: &str) -> Vec<String> {
+        line.split(' ').map(str::to_owned).collect()
+    }
+
+    fn server(players: usize) -> Server {
+        Server {
+            players,
+            onesync: true,
+            gta: true,
+            every_ms: 15_000,
+            row_us: 2,
+            list_us: None,
+        }
+    }
+
+    fn rows(parts: &[Value]) -> Vec<String> {
+        parts
+            .iter()
+            .flat_map(|part| part["rows"].as_str().unwrap().split(';'))
+            .filter(|row| !row.is_empty())
+            .map(str::to_owned)
+            .collect()
+    }
+
+    #[test]
+    fn a_sweep_lists_vehicles_objects_then_peds_under_serials_that_last() {
+        let mut world = World::default();
+        world.bridge_started(4210);
+        world.add(&words("ped 10 20 30"));
+        world.add(&words("vehicle 412.64 -1208.31 32.1 qb-garages 4 2"));
+        world.add(&words("object 1 2 3 ox_inventory"));
+
+        let first = world.sweep(&server(2));
+        let again = world.sweep(&server(2));
+
+        assert_eq!(
+            rows(&first),
+            [
+                "2,1,2,1,1011753235,412.6,-1208.3,32.1,4,2,7,1,0",
+                "3,2,3,0,3774543570,1.0,2.0,3.0,-1,0,7,2,0",
+                "1,3,1,0,1885233650,10.0,20.0,30.0,-1,0,5,0,0",
+            ]
+        );
+        assert_eq!(rows(&again), rows(&first));
+        let last = first.last().unwrap();
+        assert_eq!(
+            (last["epoch"].as_u64(), last["seq"].as_u64()),
+            (Some(4210), Some(1))
+        );
+        assert_eq!(again.last().unwrap()["seq"], 2);
+        assert_eq!(
+            last["counts"],
+            json!({ "vehicles": 1, "objects": 1, "peds": 3, "playerPeds": 2 })
+        );
+        assert_eq!(last["resources"], json!(["qb-garages", "ox_inventory"]));
+        assert_eq!(last["everyMs"], 15_000);
+        assert_eq!(last["truncated"], false);
+    }
+
+    #[test]
+    fn a_large_world_comes_in_parts_and_looks_resources_up_a_few_hundred_a_sweep() {
+        let mut world = World::default();
+        world.bridge_started(1);
+        world.fill(0, 0, 1200);
+
+        let first = world.sweep(&server(0));
+        let second = world.sweep(&server(0));
+
+        assert_eq!(first.len(), 3);
+        assert_eq!(first[0]["last"], false);
+        assert_eq!(first[2]["last"], true);
+        assert_eq!(rows(&first).len(), 1200);
+        let pending = |parts: &[Value]| rows(parts).iter().filter(|row| row.ends_with(",2")).count();
+        assert_eq!(pending(&first), 900);
+        assert_eq!(pending(&second), 600);
+    }
+
+    #[test]
+    fn a_costly_sweep_is_cut_short_and_spaces_the_next_ones_out() {
+        let mut world = World::default();
+        world.bridge_started(1);
+        world.fill(0, 0, 4000);
+        let costly = Server {
+            row_us: 20,
+            ..server(0)
+        };
+
+        let sweep = world.sweep(&costly);
+
+        let last = sweep.last().unwrap();
+        assert_eq!(last["truncated"], true);
+        assert_eq!(last["counts"]["objects"], 4000);
+        assert!(rows(&sweep).len() < 4000);
+        assert_eq!(last["spaced"], true);
+        assert_eq!(last["everyMs"], 30_000);
+        world.sweep(&costly);
+        assert_eq!(world.cadence_ms(15_000), 60_000);
+        world.sweep(&costly);
+        assert_eq!(world.cadence_ms(15_000), 60_000, "never past a minute");
+        world.sweep(&server(0));
+        assert_eq!(
+            world.cadence_ms(15_000),
+            30_000,
+            "a cheap sweep brings them closer again"
+        );
+    }
+
+    #[test]
+    fn a_server_without_onesync_or_another_game_lists_nothing_and_says_why() {
+        let mut world = World::default();
+        world.bridge_started(1);
+        world.add(&words("ped 10 20 30"));
+
+        for (server, why) in [
+            (
+                Server {
+                    onesync: false,
+                    ..server(0)
+                },
+                "onesync",
+            ),
+            (
+                Server {
+                    gta: false,
+                    ..server(0)
+                },
+                "game",
+            ),
+        ] {
+            let sweep = world.sweep(&server);
+
+            assert_eq!(sweep.len(), 1);
+            assert_eq!(sweep[0]["unavailable"], why);
+            assert_eq!(sweep[0]["rows"], "");
+        }
+    }
+
+    #[test]
+    fn a_deletion_checks_each_entity_again() {
+        let mut world = World::default();
+        world.bridge_started(4210);
+        for line in [
+            "vehicle 1 1 1",
+            "vehicle 2 2 2",
+            "train 3 3 3",
+            "ped 4 4 4",
+            "object 5 5 5",
+            "object 6 6 6",
+            "object 7 7 7",
+        ] {
+            world.add(&words(line));
+        }
+        world.sweep(&server(1));
+        world.enter(1, Some(2));
+        world.possess(1, 4);
+        world.remove(6);
+        world.keep(7);
+        // Serials follow the sweep's order: vehicles 1 to 3, objects 4 to 6, the ped 7.
+        let ask = |targets: Value, epoch: u64, deadline: i64| json!({ "request": 9, "epoch": epoch, "deadline": deadline, "targets": targets });
+
+        let reply = world
+            .delete(
+                &ask(json!([1, 1, 2, 2, 3, 3, 4, 7, 5, 9, 6, 5, 7, 6]), 4210, 100),
+                100,
+            )
+            .unwrap();
+
+        assert_eq!(reply["request"], 9);
+        assert_eq!(
+            reply["outcomes"],
+            json!([
+                [1, "deleted"],
+                [2, "occupied"],
+                [3, "train"],
+                [4, "player"],
+                [5, "changed"],
+                [6, "gone"],
+                [7, "unconfirmed"],
+            ])
+        );
+        assert_eq!(
+            world.delete(&ask(json!([5, 4]), 4210, 99), 100).unwrap()["outcomes"],
+            json!([[5, "late"]])
+        );
+        assert_eq!(
+            world.delete(&ask(json!([5, 4]), 1, 100), 100).unwrap()["outcomes"],
+            json!([[5, "changed"]])
+        );
+        assert_eq!(
+            world.delete(&ask(json!([5, 4]), 4210, 100), 100).unwrap()["outcomes"],
+            json!([[5, "deleted"]])
+        );
+        assert!(world.delete(&ask(json!([]), 4210, 100), 100).is_none());
+        assert!(world.delete(&ask(json!([5]), 4210, 100), 100).is_none());
+    }
+}
diff --git a/crates/fake-fxserver/src/main.rs b/crates/fake-fxserver/src/main.rs
index f007d8f7..350a9cbd 100644
--- a/crates/fake-fxserver/src/main.rs
+++ b/crates/fake-fxserver/src/main.rs
@@ -60,6 +60,21 @@
 //! - on stdin: `fake_move <id> <x> <y> <z>`, which puts a player at a position the bridge reports
 //!   while Observer asks for positions; the others go round a circle. With `onesync off` the bridge
 //!   reports no position, as it reads them from OneSync;
+//! - on stdin or in the cfg: `fake_entity <vehicle|bike|boat|heli|train|ped|object> <x> <y> <z>
+//!   [resource or -] [owner or -] [bucket]`, an entity of the game under the next net id, from 1,
+//!   and `fake_entities <vehicles> <peds> <objects>`, as many spread over the map as a small busy
+//!   server holds; the bridge lists them while Observer asks, in sweeps of 500 rows a part, with
+//!   every player's own ped counted and left out, and deletes those Observer names. Nothing here
+//!   was measured on a real FXServer: the entities are the fake's own, and the bridge's natives
+//!   are taken to do what their names say. `fake_entity_gone <net id>` removes one as the game
+//!   does by itself, `fake_entity_stays <net id>` has the game keep one it is asked to delete,
+//!   `fake_enter <player> [net id]` seats a player in a vehicle or takes them out, and
+//!   `fake_possess <player> <net id>` makes a ped a player's own;
+//! - `fake_entities_every_ms`: how often the bridge sweeps, whatever Observer asks, for tests that
+//!   cannot wait five seconds; `fake_entities_row_us` (2) and `fake_entities_list_us`: what a
+//!   sweep costs for each entity and for listing them, in microseconds, which cuts a sweep short
+//!   past its budget and spaces the next ones out; `set gamename rdr3` and `onesync off` each
+//!   leave the server without entities to list;
 //! - on stdin: `fake_debug <resource> <list> <fields...>`, one row of a hook's report (`ev`, `np`,
 //!   `un`, `sb`, `sbl` or `http`) printed as that resource;
 //! - on stdin: `fake_crash [code]`, `fake_hang`, `fake_spin` (a busy loop), `fake_print <text>`,
@@ -79,6 +94,7 @@
 
 mod console;
 mod dump;
+mod entities;
 mod http;
 mod players;
 #[allow(unsafe_code)]
@@ -231,6 +247,11 @@ struct Fake {
     server: Arc<Server>,
     waiting: Vec<Waiting>,
     following: Option<Following>,
+    /// While Observer asks for the entities.
+    listing: Option<Following>,
+    world: entities::World,
+    /// The answers to deletions, each sent once the bridge has checked what is left.
+    deleted: Vec<(Instant, serde_json::Value)>,
     placed: HashMap<u32, [f64; 3]>,
     last_request: u32,
     traces: Traces,
@@ -346,6 +367,9 @@ fn main() {
             traces,
             waiting: Vec::new(),
             following: None,
+            listing: None,
+            world: entities::World::default(),
+            deleted: Vec::new(),
             placed: HashMap::new(),
             last_request: 0,
             endpoint: None,
@@ -462,6 +486,7 @@ impl Fake {
                 .retain_mut(|child| matches!(child.try_wait(), Ok(None)));
             self.admit_unanswered(now);
             self.report_positions(now);
+            self.report_entities(now);
             self.beat(now);
             self.count(now);
             self.server.tick();
@@ -495,6 +520,7 @@ impl Fake {
                 self.started.retain(|started| started != resource);
                 if self.bridge.as_ref().is_some_and(|bridge| bridge.name == resource) {
                     self.bridge = None;
+                    self.listing = None;
                 }
                 self.resources_changed(resource, &["stop"]);
             }
@@ -537,6 +563,7 @@ impl Fake {
             ("fake_join", _) => self.join(args.first(), args.get(1), args.get(2)),
             ("fake_connecting", _) => self.connecting(args.first(), args.get(1), args.get(2)),
             ("fake_move", Some(id)) => self.place(id, &args[1..]),
+            (entity, Some(_)) if entities::COMMANDS.contains(&entity) => self.world.command(entity, args),
             ("fake_drop", Some(id)) => {
                 let category = args
                     .get(1)
@@ -655,6 +682,9 @@ impl Fake {
                 second: 0,
                 greeted: 0,
             });
+            self.listing = None;
+            self.deleted.clear();
+            self.world.bridge_started(self.server.uptime_ms());
             self.bridge = Some(Bridge {
                 name: resource.to_owned(),
                 next_heartbeat: Instant::now(),
@@ -824,6 +854,47 @@ impl Fake {
         }
     }
 
+    /// The entities, swept while Observer asks, and the answers to its deletions once due.
+    fn report_entities(&mut self, now: Instant) {
+        let (due, later): (Vec<_>, Vec<_>) = std::mem::take(&mut self.deleted)
+            .into_iter()
+            .partition(|(at, _)| now >= *at);
+        self.deleted = later;
+        for (_, reply) in due {
+            self.bridge_report(&reply);
+        }
+        let Some(listing) = self.listing.as_mut() else {
+            return;
+        };
+        if now >= listing.until {
+            self.listing = None;
+            self.world.unspaced();
+            return;
+        }
+        if now < listing.next {
+            return;
+        }
+        let every_ms = u64::try_from(listing.every.as_millis()).unwrap_or(u64::MAX);
+        let parts = self.world.sweep(&entities::Server {
+            players: self.server.players().len(),
+            onesync: self.server.convar("onesync").is_some_and(|value| value != "off"),
+            gta: self.server.convar("gamename").is_none_or(|game| game == "gta5"),
+            every_ms,
+            row_us: self.server.number("fake_entities_row_us").unwrap_or(2),
+            list_us: self.server.number("fake_entities_list_us"),
+        });
+        let cadence = self
+            .server
+            .number("fake_entities_every_ms")
+            .unwrap_or_else(|| self.world.cadence_ms(every_ms));
+        if let Some(listing) = self.listing.as_mut() {
+            listing.next = now + Duration::from_millis(cadence);
+        }
+        for part in parts {
+            self.bridge_report(&part);
+        }
+    }
+
     /// Who waited for a verdict longer than the bridge waits gets in.
     fn admit_unanswered(&mut self, now: Instant) {
         let (due, waiting): (Vec<Waiting>, Vec<Waiting>) = std::mem::take(&mut self.waiting)
@@ -1010,6 +1081,31 @@ impl Fake {
                     next: now,
                 });
             }
+            Some("entities") => {
+                let every = payload["everyMs"].as_u64().unwrap_or(15_000).clamp(5000, 60_000);
+                let lasting = payload["forMs"].as_u64().unwrap_or(0).min(60_000);
+                let now = Instant::now();
+                // An ask that renews one keeps the sweeps where they were.
+                let next = self.listing.as_ref().map_or(now, |listing| listing.next);
+                self.listing = (lasting > 0).then(|| Following {
+                    every: Duration::from_millis(every),
+                    until: now + Duration::from_millis(lasting),
+                    next,
+                });
+                if self.listing.is_none() {
+                    self.world.unspaced();
+                }
+            }
+            Some("deleteEntities") => {
+                let now = std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .map_or(0, |since| i64::try_from(since.as_secs()).unwrap_or(i64::MAX));
+                if let Some(reply) = self.world.delete(payload, now) {
+                    // The real bridge looks again a quarter of a second after it asked the game.
+                    self.deleted
+                        .push((Instant::now() + Duration::from_millis(250), reply));
+                }
+            }
             Some("drop") => {
                 let (Some(id), Some(message)) = (
                     payload["player"].as_u64().and_then(|id| u32::try_from(id).ok()),
diff --git a/crates/fake-fxserver/tests/runtime.rs b/crates/fake-fxserver/tests/runtime.rs
index 874cd277..b39275b8 100644
--- a/crates/fake-fxserver/tests/runtime.rs
+++ b/crates/fake-fxserver/tests/runtime.rs
@@ -12,9 +12,9 @@ use std::time::{Duration, Instant};
 use jiff::{SignedDuration, Timestamp, Unit};
 use observer_app::{
     Accounts, AuditLog, Bans, BansSetup, Caller, Client, Clock, DatabaseFiles, Diagnostics, DiagnosticsSetup,
-    DiagnosticsTask, Drops, DropsSetup, Error, LiveMap, LogQuery, MapSetup, Metrics, MetricsSetup,
-    PasswordCost, Players, PlayersSetup, PlayersTask, Running, Sampling, Schedule, ScheduleSetup,
-    ScheduleTask, Servers, Setup, Sources, Supervision,
+    DiagnosticsTask, Drops, DropsSetup, Entities, EntitiesSetup, Error, LiveMap, LogQuery, MapSetup, Metrics,
+    MetricsSetup, PasswordCost, Players, PlayersSetup, PlayersTask, Running, Sampling, Schedule,
+    ScheduleSetup, ScheduleTask, Servers, Setup, Sources, Supervision,
 };
 use observer_domain::audit::{ActorKind, AuditAction, AuditEntry, AuditFilter, Outcome};
 use observer_domain::bans::{BanFilter, BanRequest};
@@ -23,6 +23,10 @@ use observer_domain::diagnostics::{
     Protocol, Scope,
 };
 use observer_domain::drops::{DropCategory, DropsRange, TileKind};
+use observer_domain::entities::{
+    EntitiesLive, EntitiesUnavailable, EntityDeleteRequest, EntityFilters, EntityKind, EntityOutcome,
+    EntityPage, EntitySort, EntityTarget, VehicleClass,
+};
 use observer_domain::error::ErrorCode;
 use observer_domain::launch::{ExtraArgument, LaunchSettings, OneSync};
 use observer_domain::metrics::{LiveSample, MarkerKind, Range, Series, ThreadGroup, ThreadShares};
@@ -1902,3 +1906,296 @@ async fn a_crash_and_a_kick_reach_the_drops_with_their_signature_and_reason_grou
         .unwrap();
     assert_eq!(crashes.drops, 1);
 }
+
+/// The whole list, by net id.
+async fn entities_page(entities: &Entities, observer: &Observer) -> EntityPage {
+    entities
+        .page(
+            &observer.owner,
+            &EntityFilters::default(),
+            EntitySort::NetId,
+            false,
+            0,
+        )
+        .await
+        .unwrap()
+}
+
+/// The list's state once `wanted` holds, which a sweep of the bridge brings.
+async fn entities_live(
+    live: &mut watch::Receiver<EntitiesLive>,
+    wanted: impl FnMut(&EntitiesLive) -> bool,
+) -> EntitiesLive {
+    timeout(WAIT, live.wait_for(wanted))
+        .await
+        .expect("the bridge sent no such sweep while the list was followed")
+        .unwrap()
+        .clone()
+}
+
+fn entity_target(page: &EntityPage, net_id: u16) -> EntityTarget {
+    let item = page
+        .items
+        .iter()
+        .find(|item| item.net_id == net_id)
+        .unwrap_or_else(|| panic!("no entity {net_id} in {:?}", page.items));
+    EntityTarget {
+        net_id,
+        serial: item.serial,
+        model: item.model,
+    }
+}
+
+#[tokio::test]
+#[expect(
+    clippy::too_many_lines,
+    reason = "one run of a server: its list, a deletion and what the audit log keeps of it"
+)]
+async fn the_entities_are_listed_while_someone_looks_and_deleted_one_by_one() {
+    let mut observer = Observer::new(false).await;
+    let (metrics, sampling, players, playing) = follow_players(&observer).await;
+    let (entities, listing) = Entities::start(EntitiesSetup {
+        db: observer.db.clone(),
+        clock: Clock::system(),
+        supervision: observer.supervision.clone(),
+        players: Some(players.clone()),
+    });
+    let send = |line: &'static str| {
+        let observer = &observer;
+        async move {
+            observer
+                .supervision
+                .command(&observer.owner, line, CONSOLE_ROUTE.0, CONSOLE_ROUTE.1)
+                .await
+                .unwrap();
+        }
+    };
+    observer.supervision.start_server(&observer.owner).await.unwrap();
+    observer.state(ServerState::Online).await;
+    // A car from a resource that Ada's game simulates, a train, two objects, and a helicopter
+    // Ada sits in: net ids 1 to 5.
+    send(
+        "fake_join Ada; fake_entity vehicle 412.6 -1208.3 32.1 qb-garages 1 2; fake_entity train 0 0 0; \
+         fake_entity object 1 2 3 ox_inventory; fake_entity object 5 6 7; fake_entity heli 9 9 9; \
+         fake_enter 1 5",
+    )
+    .await;
+    confirmed(&players, 1).await;
+
+    let (before, mut live, watching) = entities.watch();
+    let listed = entities_live(&mut live, |live| live.run.is_some()).await;
+    let page = entities_page(&entities, &observer).await;
+    // Ada steps into the car after the sweep: the list does not know, the bridge does.
+    send("fake_enter 1 1").await;
+    let deletion = entities
+        .delete(
+            &observer.owner,
+            EntityDeleteRequest {
+                run: listed.run.clone().unwrap(),
+                targets: vec![
+                    entity_target(&page, 5),
+                    entity_target(&page, 2),
+                    entity_target(&page, 3),
+                    entity_target(&page, 1),
+                    EntityTarget {
+                        model: 7,
+                        ..entity_target(&page, 4)
+                    },
+                ],
+            },
+        )
+        .await
+        .unwrap();
+    let after = entities_page(&entities, &observer).await;
+    send("fake_entity_gone 4").await;
+    let gone = entities
+        .delete(
+            &observer.owner,
+            EntityDeleteRequest {
+                run: listed.run.clone().unwrap(),
+                targets: vec![entity_target(&page, 4)],
+            },
+        )
+        .await
+        .unwrap();
+    drop(watching);
+    let forgotten = entities_live(&mut live, |live| live.run.is_none()).await;
+    let audited = observer.audited(AuditAction::EntitiesDeleted).await;
+    observer.supervision.stop_server(&observer.owner).await.unwrap();
+    observer.state(ServerState::Stopped).await;
+    listing.close().await;
+    playing.close().await;
+    sampling.close().await;
+    metrics.close().await.unwrap();
+    observer.stop_observer().await;
+
+    assert_eq!(before, EntitiesLive::default());
+    assert_eq!((listed.sweep, listed.listed, listed.every_ms), (1, 5, 15_000));
+    let counts = listed.counts.unwrap();
+    assert_eq!(
+        (counts.vehicles, counts.objects, counts.peds, counts.player_peds),
+        (Some(3), Some(2), Some(1), 1)
+    );
+    assert!(!listed.truncated && !listed.spaced && listed.unavailable.is_none());
+    assert_eq!(page.items.len(), 5);
+    let car = &page.items[0];
+    assert_eq!(
+        (car.net_id, car.kind, car.class),
+        (1, EntityKind::Vehicle, Some(VehicleClass::Car))
+    );
+    assert_eq!((car.x, car.y, car.z, car.bucket), (412.6, -1208.3, 32.1, 2));
+    assert_eq!(car.resource.as_deref(), Some("qb-garages"));
+    assert_eq!(
+        (car.owned, car.owner, car.owner_name.as_deref(), car.occupied),
+        (true, Some(1), Some("Ada"), false)
+    );
+    assert_eq!(page.items[1].class, Some(VehicleClass::Train));
+    assert!(page.items[4].occupied);
+    assert_eq!(page.facets.kinds.vehicles, 3);
+    let outcomes = |deletion: &observer_domain::entities::EntityDeletion| -> Vec<(u16, EntityOutcome)> {
+        deletion
+            .results
+            .iter()
+            .map(|result| (result.net_id, result.outcome))
+            .collect()
+    };
+    assert_eq!(
+        outcomes(&deletion),
+        [
+            (5, EntityOutcome::Occupied),
+            (2, EntityOutcome::Train),
+            (3, EntityOutcome::Deleted),
+            (1, EntityOutcome::Occupied),
+            (4, EntityOutcome::Changed),
+        ]
+    );
+    let left: Vec<u16> = after.items.iter().map(|item| item.net_id).collect();
+    assert_eq!(
+        left,
+        [1, 2, 4, 5],
+        "the list shows the deletion before the next sweep"
+    );
+    assert_eq!((after.live.listed, after.live.sweep), (4, 1));
+    assert_eq!(outcomes(&gone), [(4, EntityOutcome::Gone)]);
+    assert_eq!(forgotten, EntitiesLive::default());
+    assert_eq!(audited.len(), 2);
+    let first = &audited[1];
+    assert_eq!(first.actor_name.as_deref(), Some("ada"));
+    assert_eq!(first.outcome, Outcome::Success);
+    assert_eq!(
+        first.details,
+        json!({
+            "asked": 5,
+            "deleted": 1,
+            "outcomes": { "occupied": 2, "train": 1, "changed": 1 },
+            "entities": [{ "model": "0xE0FAF6D2", "kind": "object", "resource": "ox_inventory", "count": 1 }],
+        })
+    );
+    assert_eq!(audited[0].details["outcomes"], json!({ "gone": 1 }));
+    let console: Vec<String> = observer.console().iter().map(|line| plain(&line.5)).collect();
+    assert!(
+        console
+            .iter()
+            .any(|line| line.contains("observer_cmd deleteEntities")),
+        "a deletion shows in the console"
+    );
+    assert!(
+        !console.iter().any(|line| line.contains("observer_cmd entities")),
+        "the asks for the list fill the console"
+    );
+}
+
+#[tokio::test]
+async fn the_server_lists_its_entities_only_while_someone_looks() {
+    let mut observer = Observer::launched(
+        false,
+        Duration::from_millis(50),
+        &[("fake_heartbeat_ms", "200"), ("fake_entities_every_ms", "100")],
+    )
+    .await;
+    let (entities, listing) = Entities::start(EntitiesSetup {
+        db: observer.db.clone(),
+        clock: Clock::system(),
+        supervision: observer.supervision.clone(),
+        players: None,
+    });
+    observer.supervision.start_server(&observer.owner).await.unwrap();
+    observer.state(ServerState::Online).await;
+    observer
+        .supervision
+        .command(
+            &observer.owner,
+            "fake_entities 4 3 20; fake_entity_stays 1",
+            CONSOLE_ROUTE.0,
+            CONSOLE_ROUTE.1,
+        )
+        .await
+        .unwrap();
+
+    let (_, mut live, watching) = entities.watch();
+    let swept = entities_live(&mut live, |live| live.sweep >= 3).await;
+    let page = entities_page(&entities, &observer).await;
+    let kept = entities
+        .delete(
+            &observer.owner,
+            EntityDeleteRequest {
+                run: swept.run.clone().unwrap(),
+                targets: vec![entity_target(&page, 1)],
+            },
+        )
+        .await
+        .unwrap();
+    drop(watching);
+    entities_live(&mut live, |live| live.run.is_none()).await;
+    // Twenty sweeps' worth of time, had the bridge gone on without anyone looking.
+    tokio::time::sleep(Duration::from_secs(2)).await;
+    let (_, mut live, watching) = entities.watch();
+    let again = entities_live(&mut live, |live| live.run.is_some()).await;
+    drop(watching);
+    observer.supervision.stop_server(&observer.owner).await.unwrap();
+    observer.state(ServerState::Stopped).await;
+    let stopped = entities_page(&entities, &observer).await;
+    listing.close().await;
+    observer.stop_observer().await;
+
+    assert_eq!(swept.listed, 27);
+    assert_eq!(swept.run, again.run, "the same server, the same bridge");
+    assert_eq!(kept.results[0].outcome, EntityOutcome::Unconfirmed);
+    assert!(
+        again.sweep <= swept.sweep + 8,
+        "the bridge went on sweeping with nobody looking: {} then {}",
+        swept.sweep,
+        again.sweep
+    );
+    assert_eq!(stopped.live, EntitiesLive::default());
+}
+
+#[tokio::test]
+async fn a_server_without_onesync_has_no_entities_to_list() {
+    let mut observer = Observer::new(false).await;
+    let cfg = observer.dir.path().join("server-data/server.cfg");
+    let mut text = fs::read_to_string(&cfg).unwrap();
+    text.push_str("set onesync off\nfake_entities 2 2 2\n");
+    fs::write(&cfg, text).unwrap();
+    let (entities, listing) = Entities::start(EntitiesSetup {
+        db: observer.db.clone(),
+        clock: Clock::system(),
+        supervision: observer.supervision.clone(),
+        players: None,
+    });
+    observer.supervision.start_server(&observer.owner).await.unwrap();
+    observer.state(ServerState::Online).await;
+
+    let (_, mut live, watching) = entities.watch();
+    let told = entities_live(&mut live, |live| live.unavailable.is_some()).await;
+    let page = entities_page(&entities, &observer).await;
+    drop(watching);
+    observer.supervision.stop_server(&observer.owner).await.unwrap();
+    observer.state(ServerState::Stopped).await;
+    listing.close().await;
+    observer.stop_observer().await;
+
+    assert_eq!(told.unavailable, Some(EntitiesUnavailable::Onesync));
+    assert_eq!((told.run, told.listed, told.counts), (None, 0, None));
+    assert_eq!(page.items, []);
+}
diff --git a/crates/observer-app/src/entities.rs b/crates/observer-app/src/entities.rs
new file mode 100644
index 00000000..52f5a92b
--- /dev/null
+++ b/crates/observer-app/src/entities.rs
@@ -0,0 +1,746 @@
+//! The server's entities: the list the bridge sweeps while a panel looks at it, what the panel
+//! asks of that list, and the deletions. The list stays in memory and goes once nobody looks;
+//! only a deletion leaves a trace, in the audit log.
+
+mod query;
+
+use std::collections::HashMap;
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::Duration;
+
+use jiff::Timestamp;
+
+use observer_domain::audit::{AuditAction, Outcome};
+use observer_domain::entities::{
+    CELLS, EntitiesLive, EntitiesSettings, EntityDeleteRequest, EntityDeletion, EntityFilters, EntityLimits,
+    EntityMap, EntityOutcome, EntityPage, EntityResult, EntitySort, EntityTarget, MAX_DELETE, MAX_MAP_POINTS,
+    VehicleClass,
+};
+use observer_domain::error::{ApiError, ErrorCode};
+use observer_domain::map::MapBounds;
+use observer_domain::permissions::Permissions;
+use observer_fxserver::bridge::BridgeAction;
+use observer_fxserver::entities::{
+    DeleteReply, EntityReport, EntityReportKind, EntityRow, MAX_PARTS, SweepEnd, SweepPart, read_rows,
+};
+use observer_fxserver::players::{PlayerReport, PlayerReportKind};
+use observer_fxserver::supervisor::{State, Status, Supervisor};
+use observer_store::Database;
+use observer_store::entities as stored;
+use serde_json::json;
+use tokio::sync::broadcast::error::RecvError;
+use tokio::sync::{broadcast, oneshot, watch};
+use tokio::task::JoinHandle;
+use tokio_util::sync::CancellationToken;
+use tracing::warn;
+
+use self::query::Source;
+use crate::audit::Record;
+use crate::watching::{Watchers, Watching};
+use crate::{Caller, Clock, Error, Players, Supervision};
+
+/// How long one ask for the list lasts, and how often it is renewed while a panel looks.
+const LEASE: Duration = Duration::from_secs(30);
+const RENEW_EVERY: Duration = Duration::from_secs(10);
+/// How long the server has to answer a deletion.
+const ANSWER_WITHIN: Duration = Duration::from_secs(10);
+/// More than the bridge sends in a whole sweep.
+const MAX_SWEEP_BYTES: usize = 4 * 1024 * 1024;
+
+pub struct EntitiesSetup {
+    pub db: Database,
+    pub clock: Clock,
+    pub supervision: Supervision,
+    /// Who is connected, for the owners' names; `None` while the players are not followed.
+    pub players: Option<Players>,
+}
+
+/// The entities service. Clones share it.
+#[derive(Clone)]
+pub struct Entities {
+    inner: Arc<Inner>,
+}
+
+struct Inner {
+    db: Database,
+    clock: Clock,
+    supervisor: Supervisor,
+    players: Option<Players>,
+    /// The last whole sweep, while someone looks.
+    list: watch::Sender<Option<Arc<List>>>,
+    live: watch::Sender<EntitiesLive>,
+    watchers: Watchers,
+    /// The cadence last asked of the bridge, in milliseconds.
+    asked_ms: AtomicU32,
+    /// One deletion at a time: a second one is refused, never queued behind a list that the
+    /// first is changing.
+    deleting: tokio::sync::Mutex<()>,
+    awaited: Mutex<Option<Awaited>>,
+    requests: AtomicU32,
+}
+
+/// The deletion the server has yet to answer.
+struct Awaited {
+    request: u32,
+    generation: u32,
+    answer: oneshot::Sender<Vec<(u16, EntityOutcome)>>,
+}
+
+/// A whole sweep, and its state as the panel was told it.
+struct List {
+    live: EntitiesLive,
+    /// The start of FXServer and of its bridge the net ids and serials belong to.
+    generation: u32,
+    epoch: i64,
+    rows: Vec<EntityRow>,
+    /// The names the rows point into, from 1.
+    resources: Vec<String>,
+}
+
+/// The parts of the sweep being received.
+struct Gathering {
+    generation: u32,
+    epoch: i64,
+    seq: u32,
+    next: u32,
+    parts: Vec<String>,
+    bytes: usize,
+}
+
+pub struct EntitiesTask {
+    stop: CancellationToken,
+    task: JoinHandle<()>,
+}
+
+impl EntitiesTask {
+    pub async fn close(self) {
+        self.stop.cancel();
+        if let Err(error) = self.task.await {
+            warn!(%error, "the entities' task failed");
+        }
+    }
+}
+
+impl Entities {
+    pub fn start(setup: EntitiesSetup) -> (Self, EntitiesTask) {
+        let supervisor = setup.supervision.supervisor().clone();
+        let reports = supervisor.entity_reports();
+        let players = supervisor.player_reports();
+        let status = supervisor.status();
+        let entities = Self {
+            inner: Arc::new(Inner {
+                db: setup.db,
+                clock: setup.clock,
+                supervisor,
+                players: setup.players,
+                list: watch::Sender::new(None),
+                live: watch::Sender::new(EntitiesLive::default()),
+                watchers: Watchers::new(),
+                asked_ms: AtomicU32::new(0),
+                deleting: tokio::sync::Mutex::new(()),
+                awaited: Mutex::new(None),
+                requests: AtomicU32::new(0),
+            }),
+        };
+        let stop = CancellationToken::new();
+        let task = tokio::spawn(entities.clone().run(stop.clone(), reports, players, status));
+        (entities, EntitiesTask { stop, task })
+    }
+
+    /// The state of the list and its changes, for as long as the guard is held: the server lists
+    /// its entities only while someone holds one.
+    pub fn watch(&self) -> (EntitiesLive, watch::Receiver<EntitiesLive>, Watching) {
+        let watching = self.inner.watchers.join();
+        let mut live = self.inner.live.subscribe();
+        let snapshot = live.borrow_and_update().clone();
+        (snapshot, live, watching)
+    }
+
+    async fn run(
+        self,
+        stop: CancellationToken,
+        mut reports: broadcast::Receiver<EntityReport>,
+        mut players: broadcast::Receiver<PlayerReport>,
+        mut status: watch::Receiver<Status>,
+    ) {
+        let mut watchers = self.inner.watchers.subscribe();
+        let mut renew = tokio::time::interval(RENEW_EVERY);
+        let mut gathering = None;
+        let mut watched = false;
+        loop {
+            tokio::select! {
+                () = stop.cancelled() => {
+                    // Turned off while a panel looks: the server stops listing at once.
+                    if watched {
+                        self.ask(false).await;
+                    }
+                    self.forget();
+                    self.unanswered();
+                    return;
+                }
+                Ok(()) = watchers.changed() => {
+                    let now_watched = *watchers.borrow_and_update() > 0;
+                    if now_watched != watched {
+                        watched = now_watched;
+                        if !watched {
+                            gathering = None;
+                            self.forget();
+                        }
+                        self.ask(watched).await;
+                    }
+                }
+                _ = renew.tick() => {
+                    if watched {
+                        self.ask(true).await;
+                    }
+                }
+                report = reports.recv() => match report {
+                    Ok(report) => self.on_report(report, &mut gathering, watched),
+                    // Parts of a sweep are gone: the next one starts over.
+                    Err(RecvError::Lagged(_)) => gathering = None,
+                    Err(RecvError::Closed) => return,
+                },
+                report = players.recv() => match report {
+                    // The bridge started again: it forgot what it was asked, and numbers the
+                    // entities from 1 again.
+                    Ok(PlayerReport { kind: PlayerReportKind::Roster(page), .. }) if page.page == 1 => {
+                        gathering = None;
+                        self.forget();
+                        self.unanswered();
+                        if watched {
+                            self.ask(true).await;
+                        }
+                    }
+                    Ok(_) | Err(RecvError::Lagged(_)) => {}
+                    Err(RecvError::Closed) => return,
+                },
+                Ok(()) = status.changed() => {
+                    let running = matches!(
+                        status.borrow_and_update().state,
+                        State::Starting | State::Online | State::Degraded | State::Hung
+                    );
+                    if !running {
+                        gathering = None;
+                        self.forget();
+                        self.unanswered();
+                    }
+                }
+            }
+        }
+    }
+
+    /// Asks the bridge for the list for a while, or to stop.
+    async fn ask(&self, watched: bool) {
+        let every_ms = match self.settings().await {
+            Ok(settings) => u32::from(settings.every_seconds) * 1000,
+            Err(error) => {
+                warn!(%error, "the entities' settings could not be read");
+                return;
+            }
+        };
+        self.inner.asked_ms.store(every_ms, Ordering::Relaxed);
+        let for_ms = if watched {
+            u32::try_from(LEASE.as_millis()).unwrap_or(u32::MAX)
+        } else {
+            0
+        };
+        // A server not running has nothing to list; the next renewal asks again.
+        let _ = self
+            .inner
+            .supervisor
+            .act(BridgeAction::Entities { every_ms, for_ms })
+            .await;
+    }
+
+    /// Drops the list: nobody looks at it any more, or its net ids name nothing now.
+    fn forget(&self) {
+        self.inner.list.send_replace(None);
+        self.inner.live.send_if_modified(|live| {
+            let known = *live != EntitiesLive::default();
+            if known {
+                *live = EntitiesLive::default();
+            }
+            known
+        });
+    }
+
+    /// The server that was to answer a deletion is gone.
+    fn unanswered(&self) {
+        self.awaited().take();
+    }
+
+    fn awaited(&self) -> std::sync::MutexGuard<'_, Option<Awaited>> {
+        self.inner.awaited.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    fn on_report(&self, report: EntityReport, gathering: &mut Option<Gathering>, watched: bool) {
+        match report.kind {
+            EntityReportKind::Deleted(reply) => self.answered(report.generation, reply),
+            // A sweep the bridge was still sending when the last panel left.
+            EntityReportKind::Sweep(_) if !watched => {}
+            EntityReportKind::Sweep(part) => {
+                if let Some((gathered, end)) = gather(gathering, report.generation, part) {
+                    self.publish(&gathered, end);
+                }
+            }
+        }
+    }
+
+    fn answered(&self, generation: u32, reply: DeleteReply) {
+        let mut awaited = self.awaited();
+        if awaited
+            .as_ref()
+            .is_some_and(|awaited| awaited.request == reply.request && awaited.generation == generation)
+            && let Some(awaited) = awaited.take()
+        {
+            let _ = awaited.answer.send(reply.outcomes);
+        }
+    }
+
+    /// A whole sweep becomes the list.
+    fn publish(&self, gathered: &Gathering, end: SweepEnd) {
+        let at = Some(self.inner.clock.now());
+        let asked_ms = self.inner.asked_ms.load(Ordering::Relaxed);
+        if let Some(unavailable) = end.unavailable {
+            self.inner.list.send_replace(None);
+            self.inner.live.send_replace(EntitiesLive {
+                at,
+                unavailable: Some(unavailable),
+                every_ms: asked_ms,
+                ..EntitiesLive::default()
+            });
+            return;
+        }
+        let mut rows = Vec::new();
+        for part in &gathered.parts {
+            read_rows(part, end.resources.len(), &mut rows);
+        }
+        let live = EntitiesLive {
+            run: Some(format!("{}-{}", gathered.generation, gathered.epoch)),
+            sweep: gathered.seq,
+            at,
+            unavailable: None,
+            counts: Some(end.counts),
+            listed: u32::try_from(rows.len()).unwrap_or(u32::MAX),
+            truncated: end.truncated,
+            every_ms: end.every_ms.unwrap_or(asked_ms),
+            spaced: end.spaced,
+            work_us: end.work_us,
+            list_us: end.list_us,
+            frames: end.frames,
+        };
+        // The list first: whoever hears of the sweep reads it.
+        self.inner.list.send_replace(Some(Arc::new(List {
+            live: live.clone(),
+            generation: gathered.generation,
+            epoch: gathered.epoch,
+            rows,
+            resources: end.resources,
+        })));
+        self.inner.live.send_replace(live);
+    }
+
+    /// The list and its state, read together.
+    fn current(&self) -> (Option<Arc<List>>, EntitiesLive) {
+        let list = self.inner.list.borrow().clone();
+        let live = match &list {
+            Some(list) => list.live.clone(),
+            None => self.inner.live.borrow().clone(),
+        };
+        (list, live)
+    }
+
+    /// The connected players' names by net id, as the live map shows them.
+    async fn names(&self, shown: bool) -> HashMap<u16, String> {
+        let Some(players) = self.inner.players.as_ref().filter(|_| shown) else {
+            return HashMap::new();
+        };
+        match players.online().await {
+            Ok(online) => online
+                .players
+                .into_iter()
+                .filter_map(|player| {
+                    let name = player.label.and_then(|label| label.name).or(player.name)?;
+                    Some((u16::try_from(player.net_id).ok()?, name))
+                })
+                .collect(),
+            Err(error) => {
+                warn!(%error, "the connected players could not be read for the entities");
+                HashMap::new()
+            }
+        }
+    }
+
+    /// One page of the entities the filters keep. Who owns an entity, and whether a player sits
+    /// in one, is only told to who may see where players stand.
+    pub async fn page(
+        &self,
+        caller: &Caller,
+        filters: &EntityFilters,
+        sort: EntitySort,
+        descending: bool,
+        page: u32,
+    ) -> Result<EntityPage, Error> {
+        let owners_shown = caller.permissions.contains(Permissions::PLAYERS_MAP);
+        let names = self.names(owners_shown).await;
+        let (list, live) = self.current();
+        let (rows, resources): (&[EntityRow], &[String]) = match &list {
+            Some(list) => (&list.rows, &list.resources),
+            None => (&[], &[]),
+        };
+        let source = Source {
+            rows,
+            resources,
+            names: &names,
+            owners_shown,
+        };
+        let mut kept = source.filtered(filters);
+        source.sort(&mut kept, sort, descending);
+        let (page, items) = source.page(&kept, page);
+        Ok(EntityPage {
+            live,
+            owners_shown,
+            limits: EntityLimits::default(),
+            matching: u32::try_from(kept.len()).unwrap_or(u32::MAX),
+            page,
+            items,
+            facets: source.facets(&kept),
+        })
+    }
+
+    /// The entities the filters keep, for the map, within the part of it the panel shows when it
+    /// gives one: each entity, or cells of `cell` game units once there are too many to draw.
+    pub async fn map(
+        &self,
+        caller: &Caller,
+        filters: &EntityFilters,
+        cell: u32,
+        bounds: Option<MapBounds>,
+    ) -> Result<EntityMap, Error> {
+        if !CELLS.contains(&cell) || bounds.is_some_and(|bounds| !bounds.is_valid()) {
+            return Err(ErrorCode::InvalidRequest.into());
+        }
+        let owners_shown = caller.permissions.contains(Permissions::PLAYERS_MAP);
+        let names = self.names(owners_shown).await;
+        let (list, live) = self.current();
+        let (rows, resources): (&[EntityRow], &[String]) = match &list {
+            Some(list) => (&list.rows, &list.resources),
+            None => (&[], &[]),
+        };
+        let kept = Source {
+            rows,
+            resources,
+            names: &names,
+            owners_shown,
+        }
+        .filtered(filters);
+        let kept = match &bounds {
+            Some(bounds) => query::within(kept, bounds),
+            None => kept,
+        };
+        let dense = kept.len() > MAX_MAP_POINTS;
+        Ok(EntityMap {
+            live,
+            kinds: query::kinds(rows),
+            matching: u32::try_from(kept.len()).unwrap_or(u32::MAX),
+            points: if dense { Vec::new() } else { query::points(&kept) },
+            cell: dense.then_some(cell),
+            cells: if dense {
+                query::cells(&kept, cell)
+            } else {
+                Vec::new()
+            },
+        })
+    }
+
+    /// Deletes entities the caller picked in the list named by the request, and says what became
+    /// of each. Never a vehicle a player sits in, nor a train, and nothing from a list that is
+    /// out of date or that the server's restart voided; the bridge checks each entity again.
+    pub async fn delete(
+        &self,
+        caller: &Caller,
+        request: EntityDeleteRequest,
+    ) -> Result<EntityDeletion, Error> {
+        let (entities, caller) = (self.clone(), caller.clone());
+        // On a task of its own: a deletion sent to the server is recorded even when the panel that
+        // asked for it goes away before the answer.
+        tokio::spawn(async move { entities.delete_now(&caller, request).await })
+            .await
+            .map_err(|_| Error::from(ErrorCode::Internal))?
+    }
+
+    async fn delete_now(
+        &self,
+        caller: &Caller,
+        request: EntityDeleteRequest,
+    ) -> Result<EntityDeletion, Error> {
+        if request.targets.is_empty() {
+            return Err(ErrorCode::InvalidRequest.into());
+        }
+        if request.targets.len() > MAX_DELETE {
+            return Err(ApiError::new(ErrorCode::TooManyEntities)
+                .with("max", MAX_DELETE)
+                .into());
+        }
+        let Ok(_one_at_a_time) = self.inner.deleting.try_lock() else {
+            return Err(ErrorCode::EntitiesDeleting.into());
+        };
+        let list = self
+            .inner
+            .list
+            .borrow()
+            .clone()
+            .ok_or(ErrorCode::EntitiesNotListed)?;
+        if list.live.run.as_deref() != Some(request.run.as_str()) {
+            return Err(ErrorCode::EntitiesChanged.into());
+        }
+        let now = self.inner.clock.now();
+        if list.live.is_stale(now) {
+            return Err(ErrorCode::EntitiesOutOfDate.into());
+        }
+        let (mut results, sent) = ruled_out(&list, &request.targets);
+        if sent.is_empty() {
+            return Ok(EntityDeletion { results });
+        }
+
+        let outcomes = self.ask_to_delete(&list, &sent, now).await?;
+        if let Some(outcomes) = &outcomes {
+            for result in results
+                .iter_mut()
+                .filter(|result| result.outcome == EntityOutcome::Unanswered)
+            {
+                result.outcome = outcomes
+                    .iter()
+                    .find(|(net_id, _)| *net_id == result.net_id)
+                    .map_or(EntityOutcome::Error, |(_, outcome)| *outcome);
+            }
+        }
+        let deleted: Vec<&EntityRow> = sent
+            .iter()
+            .filter(|row| {
+                results
+                    .iter()
+                    .any(|result| result.net_id == row.net_id && result.outcome == EntityOutcome::Deleted)
+            })
+            .copied()
+            .collect();
+        // What an unanswered deletion asked for is told, since some of it may be gone.
+        let told = if outcomes.is_some() { &deleted } else { &sent };
+        let record = Record::by(caller, AuditAction::EntitiesDeleted)
+            .outcome(if outcomes.is_some() {
+                Outcome::Success
+            } else {
+                Outcome::Failure
+            })
+            .details(deletion_details(&results, deleted.len(), told, &list.resources));
+        let net_ids: Vec<u16> = deleted.iter().map(|row| row.net_id).collect();
+        self.without(&list, &net_ids);
+        self.inner
+            .db
+            .write(move |tx| -> Result<(), Error> { Ok(record.write(tx, now)?) })
+            .await?;
+        Ok(EntityDeletion { results })
+    }
+
+    /// Has the bridge delete `sent`, entities of `list`, and waits for what became of each: `None`
+    /// when it does not answer in time.
+    async fn ask_to_delete(
+        &self,
+        list: &List,
+        sent: &[&EntityRow],
+        now: Timestamp,
+    ) -> Result<Option<Vec<(u16, EntityOutcome)>>, Error> {
+        let request = self.inner.requests.fetch_add(1, Ordering::Relaxed) % 0x7fff_ffff + 1;
+        let (answer, answered) = oneshot::channel();
+        *self.awaited() = Some(Awaited {
+            request,
+            generation: list.generation,
+            answer,
+        });
+        let wait_ms = i64::try_from(ANSWER_WITHIN.as_millis()).unwrap_or(i64::MAX);
+        let action = BridgeAction::DeleteEntities {
+            request,
+            epoch: list.epoch,
+            // The bridge refuses from the second that follows: before the wait for its answer
+            // ends, so that a deletion told as unanswered deletes nothing afterwards.
+            deadline: (now.as_millisecond() + wait_ms) / 1000 - 1,
+            targets: sent
+                .iter()
+                .flat_map(|row| [u32::from(row.net_id), row.serial])
+                .collect(),
+        };
+        if self.inner.supervisor.act(action).await.is_err() {
+            self.unanswered();
+            return Err(ErrorCode::ServerNotRunning.into());
+        }
+        let outcomes = tokio::time::timeout(ANSWER_WITHIN, answered)
+            .await
+            .ok()
+            .and_then(Result::ok);
+        self.unanswered();
+        Ok(outcomes)
+    }
+
+    /// Takes deleted entities out of the list they were deleted from, so that it shows the
+    /// deletion before the next sweep confirms it.
+    fn without(&self, list: &Arc<List>, deleted: &[u16]) {
+        if deleted.is_empty() {
+            return;
+        }
+        let mut live = None;
+        self.inner.list.send_if_modified(|current| {
+            let Some(shown) = current.as_ref().filter(|shown| Arc::ptr_eq(shown, list)) else {
+                return false;
+            };
+            let rows: Vec<EntityRow> = shown
+                .rows
+                .iter()
+                .filter(|row| !deleted.contains(&row.net_id))
+                .copied()
+                .collect();
+            let next = List {
+                live: EntitiesLive {
+                    listed: u32::try_from(rows.len()).unwrap_or(u32::MAX),
+                    ..shown.live.clone()
+                },
+                generation: shown.generation,
+                epoch: shown.epoch,
+                rows,
+                resources: shown.resources.clone(),
+            };
+            live = Some(next.live.clone());
+            *current = Some(Arc::new(next));
+            true
+        });
+        if let Some(live) = live {
+            self.inner.live.send_replace(live);
+        }
+    }
+
+    pub async fn settings(&self) -> Result<EntitiesSettings, Error> {
+        Ok(self.inner.db.read(stored::settings).await?)
+    }
+
+    /// Changes how often the server lists its entities, which applies at the next ask.
+    pub async fn change_settings(&self, caller: &Caller, settings: EntitiesSettings) -> Result<(), Error> {
+        if !settings.is_valid() {
+            return Err(ErrorCode::InvalidEntitiesSettings.into());
+        }
+        let before = self.settings().await?;
+        if before == settings {
+            return Ok(());
+        }
+        let record = Record::by(caller, AuditAction::EntitiesSettingsChanged)
+            .details(json!({ "from": before, "to": settings }));
+        let now = self.inner.clock.now();
+        self.inner
+            .db
+            .write(move |tx| -> Result<(), Error> {
+                stored::save_settings(tx, &settings)?;
+                Ok(record.write(tx, now)?)
+            })
+            .await?;
+        if self.inner.watchers.any() {
+            self.ask(true).await;
+        }
+        Ok(())
+    }
+}
+
+/// What the list already says of each entity asked for, once each, and the rows to ask the
+/// server about: those are told as unanswered until it answers.
+fn ruled_out<'a>(list: &'a List, targets: &[EntityTarget]) -> (Vec<EntityResult>, Vec<&'a EntityRow>) {
+    let listed: HashMap<u16, &EntityRow> = list.rows.iter().map(|row| (row.net_id, row)).collect();
+    let mut results: Vec<EntityResult> = Vec::new();
+    let mut sent = Vec::new();
+    for target in targets {
+        if results.iter().any(|result| result.net_id == target.net_id) {
+            continue;
+        }
+        let outcome = match listed.get(&target.net_id) {
+            None => EntityOutcome::Gone,
+            Some(row) if row.serial != target.serial || row.model != target.model => EntityOutcome::Changed,
+            Some(row) if row.occupied => EntityOutcome::Occupied,
+            Some(row) if row.class == Some(VehicleClass::Train) => EntityOutcome::Train,
+            Some(row) => {
+                sent.push(*row);
+                EntityOutcome::Unanswered
+            }
+        };
+        results.push(EntityResult {
+            net_id: target.net_id,
+            outcome,
+        });
+    }
+    (results, sent)
+}
+
+/// What the audit log keeps of a deletion: how many entities were asked for and deleted, the
+/// count of each other outcome, and the largest groups of `told`.
+fn deletion_details(
+    results: &[EntityResult],
+    deleted: usize,
+    told: &[&EntityRow],
+    resources: &[String],
+) -> serde_json::Value {
+    let (groups, more) = query::groups(told, resources);
+    let mut others = serde_json::Map::new();
+    for result in results
+        .iter()
+        .filter(|result| result.outcome != EntityOutcome::Deleted)
+    {
+        let count = others.entry(result.outcome.as_str()).or_insert(json!(0));
+        *count = json!(count.as_u64().unwrap_or(0) + 1);
+    }
+    let mut details = json!({ "asked": results.len(), "deleted": deleted });
+    if !others.is_empty() {
+        details["outcomes"] = others.into();
+    }
+    if !groups.is_empty() {
+        details["entities"] = groups.into();
+    }
+    if more > 0 {
+        details["more"] = more.into();
+    }
+    details
+}
+
+/// Adds a part to the sweep being received, and gives the sweep back once its last part came. A
+/// part lost or repeated spoils its sweep: only the first part of another one starts over.
+fn gather(
+    gathering: &mut Option<Gathering>,
+    generation: u32,
+    part: SweepPart,
+) -> Option<(Gathering, SweepEnd)> {
+    let continues = gathering.as_ref().is_some_and(|gathering| {
+        gathering.generation == generation
+            && gathering.epoch == part.epoch
+            && gathering.seq == part.seq
+            && gathering.next == part.part
+    });
+    if !continues {
+        *gathering = (part.part == 1).then(|| Gathering {
+            generation,
+            epoch: part.epoch,
+            seq: part.seq,
+            next: 1,
+            parts: Vec::new(),
+            bytes: 0,
+        });
+    }
+    let current = gathering.as_mut()?;
+    current.bytes += part.rows.len();
+    current.parts.push(part.rows);
+    current.next += 1;
+    // Past either, no part that could follow would make a sweep the bridge sends.
+    let whole = part.end.filter(|_| current.bytes <= MAX_SWEEP_BYTES);
+    if whole.is_none() && (current.bytes > MAX_SWEEP_BYTES || current.next > MAX_PARTS) {
+        *gathering = None;
+    }
+    let end = whole?;
+    gathering.take().map(|gathered| (gathered, end))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/observer-app/src/entities/query.rs b/crates/observer-app/src/entities/query.rs
new file mode 100644
index 00000000..85f2a12b
--- /dev/null
+++ b/crates/observer-app/src/entities/query.rs
@@ -0,0 +1,842 @@
+//! What the panel asks of a sweep's list: the entities its filters keep, sorted and cut into a
+//! page, what the filters can pick from, the map's points or its cells of density, and the groups
+//! a deletion names in the audit log. Pure functions over the list; owners' names are passed in.
+
+use std::cmp::Ordering;
+use std::collections::HashMap;
+
+use observer_domain::entities::{
+    BucketCount, ClassCount, CreatorFilter, EntityCell, EntityFacets, EntityFilters, EntityItem, EntityKind,
+    EntityPoint, EntitySort, KindCounts, MAX_MAP_POINTS, ModelCount, OwnerCount, OwnerFilter, PAGE_SIZE,
+    ResourceCount, VehicleClass,
+};
+use observer_domain::map::MapBounds;
+use observer_fxserver::entities::EntityRow;
+use serde_json::{Value, json};
+
+const MAX_RESOURCE_FACETS: usize = 100;
+const MAX_BUCKET_FACETS: usize = 50;
+const MAX_OWNER_FACETS: usize = 20;
+const MAX_MODEL_FACETS: usize = 10;
+/// The groups a deletion names in the audit log, past which the rest is only counted.
+const MAX_AUDIT_GROUPS: usize = 5;
+
+/// A sweep's list as one caller may read it.
+#[derive(Clone, Copy)]
+pub(super) struct Source<'a> {
+    pub rows: &'a [EntityRow],
+    /// The names the rows point into, from 1.
+    pub resources: &'a [String],
+    /// The connected players' names, by net id.
+    pub names: &'a HashMap<u16, String>,
+    /// Whether the caller may know who owns an entity and whether a player sits in one: both
+    /// say where a player is.
+    pub owners_shown: bool,
+}
+
+impl<'a> Source<'a> {
+    fn resource(&self, row: &EntityRow) -> Option<&'a str> {
+        let place = usize::from(row.resource).checked_sub(1)?;
+        self.resources.get(place).map(String::as_str)
+    }
+
+    fn owner(&self, row: &EntityRow) -> Option<u16> {
+        row.owner.filter(|_| self.owners_shown)
+    }
+
+    fn owner_name(&self, row: &EntityRow) -> Option<&'a str> {
+        self.names.get(&self.owner(row)?).map(String::as_str)
+    }
+
+    pub(super) fn item(&self, row: &EntityRow) -> EntityItem {
+        EntityItem {
+            net_id: row.net_id,
+            serial: row.serial,
+            kind: row.kind,
+            class: row.class,
+            model: row.model,
+            x: row.x,
+            y: row.y,
+            z: row.z,
+            owned: row.owner.is_some(),
+            owner: self.owner(row),
+            owner_name: self.owner_name(row).map(str::to_owned),
+            bucket: row.bucket,
+            population: row.population,
+            resource: self.resource(row).map(str::to_owned),
+            resource_pending: row.resource_pending,
+            occupied: row.occupied && self.owners_shown,
+        }
+    }
+
+    /// The rows the filters keep, in the list's order.
+    pub(super) fn filtered(&self, filters: &EntityFilters) -> Vec<&'a EntityRow> {
+        let creator = match &filters.creator {
+            CreatorFilter::Any => None,
+            CreatorFilter::None => Some(0),
+            CreatorFilter::Resource(name) => match self.resources.iter().position(|known| known == name) {
+                Some(place) => Some(place + 1),
+                // No entity of the list comes from a resource it does not name.
+                None => return Vec::new(),
+            },
+        };
+        let search = Search::new(&filters.search, self);
+        self.rows
+            .iter()
+            .filter(|row| filters.kinds.is_empty() || filters.kinds.contains(&row.kind))
+            .filter(|row| filters.class.is_none_or(|class| row.class == Some(class)))
+            .filter(|row| {
+                creator.is_none_or(|place| {
+                    // One not looked up yet is not known to have none.
+                    usize::from(row.resource) == place && !(place == 0 && row.resource_pending)
+                })
+            })
+            .filter(|row| match filters.owner {
+                OwnerFilter::Any => true,
+                OwnerFilter::None => row.owner.is_none(),
+                OwnerFilter::Owned => row.owner.is_some(),
+                OwnerFilter::Player(net_id) => self.owner(row) == Some(net_id),
+            })
+            .filter(|row| filters.bucket.is_none_or(|bucket| row.bucket == bucket))
+            .filter(|row| search.as_ref().is_none_or(|search| search.matches(row)))
+            .collect()
+    }
+
+    /// Sorts in place. The net id settles what the key leaves equal, so that a page holds the
+    /// same entities from one sweep to the next.
+    pub(super) fn sort(&self, rows: &mut [&EntityRow], sort: EntitySort, descending: bool) {
+        let directed = |ordering: Ordering| if descending { ordering.reverse() } else { ordering };
+        // What has no name sorts last whichever way the rest goes.
+        let nameless_last =
+            |left: Option<(u8, &str, u16)>, right: Option<(u8, &str, u16)>| match (left, right) {
+                (Some(left), Some(right)) => directed(left.cmp(&right)),
+                (Some(_), None) => Ordering::Less,
+                (None, Some(_)) => Ordering::Greater,
+                (None, None) => Ordering::Equal,
+            };
+        let lower: Vec<String> = self.resources.iter().map(|name| name.to_lowercase()).collect();
+        let owners: HashMap<u16, String> = self
+            .names
+            .iter()
+            .map(|(net_id, name)| (*net_id, name.to_lowercase()))
+            .collect();
+        let creator = |row: &EntityRow| {
+            let place = usize::from(row.resource).checked_sub(1)?;
+            Some((0, lower.get(place)?.as_str(), 0))
+        };
+        // Named owners first, then those without a name by net id.
+        let owner = |row: &EntityRow| {
+            row.owner?;
+            Some(match self.owner(row) {
+                Some(net_id) => match owners.get(&net_id) {
+                    Some(name) => (0, name.as_str(), net_id),
+                    None => (1, "", net_id),
+                },
+                None => (0, "", 0),
+            })
+        };
+        rows.sort_by(|left, right| {
+            let by_key = match sort {
+                EntitySort::Kind => {
+                    directed((kind_order(left.kind), left.class).cmp(&(kind_order(right.kind), right.class)))
+                }
+                EntitySort::Model => directed(left.model.cmp(&right.model)),
+                EntitySort::Resource => nameless_last(creator(left), creator(right)),
+                EntitySort::Owner => nameless_last(owner(left), owner(right)),
+                EntitySort::Bucket => directed(left.bucket.cmp(&right.bucket)),
+                EntitySort::Position => directed(left.x.total_cmp(&right.x).then(left.y.total_cmp(&right.y))),
+                EntitySort::NetId => directed(left.net_id.cmp(&right.net_id)),
+            };
+            by_key.then(left.net_id.cmp(&right.net_id))
+        });
+    }
+
+    /// One page of `rows`, and its number: the last one when `page` is past it.
+    pub(super) fn page(&self, rows: &[&EntityRow], page: u32) -> (u32, Vec<EntityItem>) {
+        let last = rows.len().saturating_sub(1) / PAGE_SIZE;
+        let page = usize::try_from(page).unwrap_or(usize::MAX).min(last);
+        let items = rows
+            .iter()
+            .skip(page * PAGE_SIZE)
+            .take(PAGE_SIZE)
+            .map(|row| self.item(row))
+            .collect();
+        (u32::try_from(page).unwrap_or(u32::MAX), items)
+    }
+
+    /// What the filters can pick from, over the whole list, and the most common models among
+    /// `filtered`.
+    pub(super) fn facets(&self, filtered: &[&EntityRow]) -> EntityFacets {
+        let mut classes: HashMap<VehicleClass, u32> = HashMap::new();
+        let mut resources: HashMap<u16, u32> = HashMap::new();
+        let mut buckets: HashMap<i32, u32> = HashMap::new();
+        let mut owners: HashMap<u16, u32> = HashMap::new();
+        let (mut unowned, mut owned) = (0, 0);
+        for row in self.rows {
+            if let Some(class) = row.class {
+                *classes.entry(class).or_default() += 1;
+            }
+            if !row.resource_pending {
+                *resources.entry(row.resource).or_default() += 1;
+            }
+            *buckets.entry(row.bucket).or_default() += 1;
+            match row.owner {
+                None => unowned += 1,
+                Some(net_id) => {
+                    owned += 1;
+                    if self.owners_shown {
+                        *owners.entry(net_id).or_default() += 1;
+                    }
+                }
+            }
+        }
+        let mut models: HashMap<(u32, EntityKind), u32> = HashMap::new();
+        for row in filtered {
+            *models.entry((row.model, row.kind)).or_default() += 1;
+        }
+        EntityFacets {
+            kinds: kinds(self.rows),
+            classes: VehicleClass::ALL
+                .into_iter()
+                .filter_map(|class| {
+                    Some(ClassCount {
+                        class,
+                        count: *classes.get(&class)?,
+                    })
+                })
+                .collect(),
+            resources: most_common(resources, MAX_RESOURCE_FACETS)
+                .into_iter()
+                .map(|(place, count)| ResourceCount {
+                    resource: usize::from(place)
+                        .checked_sub(1)
+                        .and_then(|place| self.resources.get(place).cloned()),
+                    count,
+                })
+                .collect(),
+            buckets: most_common(buckets, MAX_BUCKET_FACETS)
+                .into_iter()
+                .map(|(bucket, count)| BucketCount { bucket, count })
+                .collect(),
+            unowned,
+            owned,
+            owners: most_common(owners, MAX_OWNER_FACETS)
+                .into_iter()
+                .map(|(net_id, count)| OwnerCount {
+                    net_id,
+                    name: self.names.get(&net_id).cloned(),
+                    count,
+                })
+                .collect(),
+            models: most_common(models, MAX_MODEL_FACETS)
+                .into_iter()
+                .map(|((model, kind), count)| ModelCount { model, kind, count })
+                .collect(),
+        }
+    }
+}
+
+/// The rows that stand within `bounds`, edges included.
+pub(super) fn within<'a>(rows: Vec<&'a EntityRow>, bounds: &MapBounds) -> Vec<&'a EntityRow> {
+    let inside = |value: f32, low: f64, high: f64| (low..=high).contains(&f64::from(value));
+    rows.into_iter()
+        .filter(|row| inside(row.x, bounds.west, bounds.east) && inside(row.y, bounds.south, bounds.north))
+        .collect()
+}
+
+/// How many of each kind `rows` hold.
+pub(super) fn kinds(rows: &[EntityRow]) -> KindCounts {
+    let mut kinds = KindCounts::default();
+    for row in rows {
+        match row.kind {
+            EntityKind::Vehicle => kinds.vehicles += 1,
+            EntityKind::Ped => kinds.peds += 1,
+            EntityKind::Object => kinds.objects += 1,
+        }
+    }
+    kinds
+}
+
+/// Each of `rows` as the map draws it, while they are few enough.
+pub(super) fn points(rows: &[&EntityRow]) -> Vec<EntityPoint> {
+    rows.iter()
+        .take(MAX_MAP_POINTS)
+        .map(|row| EntityPoint(row.net_id, row.serial, row.kind.code(), row.x, row.y))
+        .collect()
+}
+
+/// `rows` counted by squares of `side` game units, each with its most common kind. The counts
+/// add up to the rows.
+pub(super) fn cells(rows: &[&EntityRow], side: u32) -> Vec<EntityCell> {
+    #[expect(clippy::cast_precision_loss, reason = "a cell is 2000 game units at most")]
+    let side = side.max(1) as f32;
+    let mut cells: HashMap<(i32, i32), [u32; 3]> = HashMap::new();
+    for row in rows {
+        #[expect(
+            clippy::cast_possible_truncation,
+            reason = "positions are checked to lie within the game's world"
+        )]
+        let cell = ((row.x / side).floor() as i32, (row.y / side).floor() as i32);
+        cells.entry(cell).or_default()[usize::from(row.kind.code() - 1)] += 1;
+    }
+    let mut cells: Vec<EntityCell> = cells
+        .into_iter()
+        .map(|((column, row), kinds)| {
+            let mut most = 0;
+            for kind in 1..kinds.len() {
+                if kinds[kind] > kinds[most] {
+                    most = kind;
+                }
+            }
+            EntityCell(
+                column,
+                row,
+                kinds.iter().sum(),
+                u8::try_from(most + 1).unwrap_or(1),
+            )
+        })
+        .collect();
+    cells.sort_unstable_by_key(|cell| (cell.0, cell.1));
+    cells
+}
+
+/// What a deletion says of `rows` in the audit log: the largest groups, each a model, a kind and
+/// a creating resource, and how many entities the groups left out hold.
+pub(super) fn groups(rows: &[&EntityRow], resources: &[String]) -> (Vec<Value>, usize) {
+    let mut groups: HashMap<(u32, EntityKind, u16), u32> = HashMap::new();
+    for row in rows {
+        *groups.entry((row.model, row.kind, row.resource)).or_default() += 1;
+    }
+    let mut groups = most_common(groups, usize::MAX);
+    let rest = groups.split_off(groups.len().min(MAX_AUDIT_GROUPS));
+    let named = groups
+        .into_iter()
+        .map(|((model, kind, resource), count)| {
+            json!({
+                "model": format!("0x{model:08X}"),
+                "kind": kind,
+                "resource": usize::from(resource).checked_sub(1).and_then(|place| resources.get(place)),
+                "count": count,
+            })
+        })
+        .collect();
+    (named, rest.iter().map(|(_, count)| *count as usize).sum())
+}
+
+/// The keys counted the most, the most first, a tie by the smaller key.
+fn most_common<K: Ord + Copy>(counts: HashMap<K, u32>, most: usize) -> Vec<(K, u32)> {
+    let mut counts: Vec<(K, u32)> = counts.into_iter().collect();
+    counts.sort_unstable_by(|left, right| right.1.cmp(&left.1).then(left.0.cmp(&right.0)));
+    counts.truncate(most);
+    counts
+}
+
+const fn kind_order(kind: EntityKind) -> u8 {
+    match kind {
+        EntityKind::Vehicle => 0,
+        EntityKind::Ped => 1,
+        EntityKind::Object => 2,
+    }
+}
+
+/// What a search looks for: a net id alone as `#12`, or anything that names an entity.
+enum Search {
+    NetId(u16),
+    Any {
+        number: Option<u64>,
+        hash: Option<u32>,
+        resources: Vec<u16>,
+        owners: Vec<u16>,
+    },
+}
+
+impl Search {
+    fn new(text: &str, source: &Source<'_>) -> Option<Self> {
+        let needle = text.trim().to_lowercase();
+        if needle.is_empty() {
+            return None;
+        }
+        if let Some(digits) = needle.strip_prefix('#')
+            && let Ok(net_id) = digits.parse()
+        {
+            return Some(Self::NetId(net_id));
+        }
+        let digits = needle.len() <= 10 && needle.bytes().all(|byte| byte.is_ascii_digit());
+        let hex = needle.strip_prefix("0x").unwrap_or(&needle);
+        Some(Self::Any {
+            number: if digits { needle.parse().ok() } else { None },
+            hash: if hex.len() <= 8 {
+                u32::from_str_radix(hex, 16).ok()
+            } else {
+                None
+            },
+            resources: (1..)
+                .zip(source.resources)
+                .filter(|(_, name)| name.to_lowercase().contains(&needle))
+                .map(|(place, _)| place)
+                .collect(),
+            owners: if source.owners_shown {
+                source
+                    .names
+                    .iter()
+                    .filter(|(_, name)| name.to_lowercase().contains(&needle))
+                    .map(|(net_id, _)| *net_id)
+                    .collect()
+            } else {
+                Vec::new()
+            },
+        })
+    }
+
+    fn matches(&self, row: &EntityRow) -> bool {
+        match self {
+            Self::NetId(net_id) => row.net_id == *net_id,
+            Self::Any {
+                number,
+                hash,
+                resources,
+                owners,
+            } => {
+                number.is_some_and(|number| u64::from(row.net_id) == number || u64::from(row.model) == number)
+                    || *hash == Some(row.model)
+                    || resources.contains(&row.resource)
+                    || row.owner.is_some_and(|owner| owners.contains(&owner))
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn row(net_id: u16, kind: EntityKind, model: u32) -> EntityRow {
+        EntityRow {
+            net_id,
+            serial: u32::from(net_id) + 100,
+            kind,
+            class: (kind == EntityKind::Vehicle).then_some(VehicleClass::Car),
+            model,
+            x: f32::from(net_id) * 10.0,
+            y: -f32::from(net_id),
+            z: 30.0,
+            owner: None,
+            bucket: 0,
+            population: 5,
+            resource: 0,
+            resource_pending: false,
+            occupied: false,
+        }
+    }
+
+    fn list() -> Vec<EntityRow> {
+        vec![
+            EntityRow {
+                owner: Some(4),
+                resource: 1,
+                occupied: true,
+                ..row(1, EntityKind::Vehicle, 0xB779_A091)
+            },
+            EntityRow {
+                class: Some(VehicleClass::Train),
+                ..row(2, EntityKind::Vehicle, 0x3D6A_AA9B)
+            },
+            EntityRow {
+                owner: Some(9),
+                bucket: 3,
+                ..row(3, EntityKind::Ped, 0x705E_61F2)
+            },
+            EntityRow {
+                resource: 2,
+                ..row(4, EntityKind::Object, 0x0A1B_2C3D)
+            },
+            EntityRow {
+                resource_pending: true,
+                ..row(5, EntityKind::Object, 0x0A1B_2C3D)
+            },
+            EntityRow {
+                owner: Some(4),
+                resource: 1,
+                ..row(6, EntityKind::Vehicle, 0xB779_A091)
+            },
+        ]
+    }
+
+    fn resources() -> Vec<String> {
+        vec!["qb-garages".to_owned(), "Ox_Inventory".to_owned()]
+    }
+
+    fn names() -> HashMap<u16, String> {
+        HashMap::from([(4, "Ada".to_owned())])
+    }
+
+    fn net_ids(rows: &[&EntityRow]) -> Vec<u16> {
+        rows.iter().map(|row| row.net_id).collect()
+    }
+
+    fn kept(filters: &EntityFilters, owners_shown: bool) -> Vec<u16> {
+        let (rows, resources, names) = (list(), resources(), names());
+        let source = Source {
+            rows: &rows,
+            resources: &resources,
+            names: &names,
+            owners_shown,
+        };
+        net_ids(&source.filtered(filters))
+    }
+
+    fn searched(text: &str, owners_shown: bool) -> Vec<u16> {
+        kept(
+            &EntityFilters {
+                search: text.to_owned(),
+                ..EntityFilters::default()
+            },
+            owners_shown,
+        )
+    }
+
+    #[test]
+    fn filters_keep_what_they_name_and_add_up() {
+        let all = EntityFilters::default();
+        assert_eq!(kept(&all, true), [1, 2, 3, 4, 5, 6]);
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    kinds: vec![EntityKind::Object, EntityKind::Ped],
+                    ..all.clone()
+                },
+                true
+            ),
+            [3, 4, 5]
+        );
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    class: Some(VehicleClass::Train),
+                    ..all.clone()
+                },
+                true
+            ),
+            [2]
+        );
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    creator: CreatorFilter::Resource("qb-garages".to_owned()),
+                    owner: OwnerFilter::Owned,
+                    ..all.clone()
+                },
+                true
+            ),
+            [1, 6]
+        );
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    creator: CreatorFilter::Resource("gone".to_owned()),
+                    ..all.clone()
+                },
+                true
+            ),
+            Vec::<u16>::new()
+        );
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    bucket: Some(3),
+                    ..all.clone()
+                },
+                true
+            ),
+            [3]
+        );
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    owner: OwnerFilter::None,
+                    ..all
+                },
+                true
+            ),
+            [2, 4, 5]
+        );
+    }
+
+    #[test]
+    fn an_entity_whose_resource_is_not_looked_up_yet_is_not_one_without_a_resource() {
+        let none = EntityFilters {
+            creator: CreatorFilter::None,
+            ..EntityFilters::default()
+        };
+
+        assert_eq!(kept(&none, true), [2, 3]);
+    }
+
+    #[test]
+    fn a_search_finds_a_net_id_a_model_a_resource_or_an_owner() {
+        assert_eq!(searched("#2", true), [2]);
+        assert_eq!(searched(" 0xB779A091 ", true), [1, 6]);
+        assert_eq!(searched("b779a091", true), [1, 6]);
+        assert_eq!(searched("3078201489", true), [1, 6]);
+        assert_eq!(searched("inventory", true), [4]);
+        assert_eq!(searched("ADA", true), [1, 6]);
+        // Digits are a net id, a model in decimal, or a model in hexadecimal.
+        assert_eq!(searched("3", true), [3]);
+        assert_eq!(searched("nothing like it", true), Vec::<u16>::new());
+        assert_eq!(searched("#70000", true), Vec::<u16>::new());
+    }
+
+    #[test]
+    fn who_does_not_see_where_players_stand_is_not_told_who_owns_an_entity() {
+        let (rows, resources, names) = (list(), resources(), names());
+        let hidden = Source {
+            rows: &rows,
+            resources: &resources,
+            names: &names,
+            owners_shown: false,
+        };
+
+        let item = hidden.item(&rows[0]);
+        let facets = hidden.facets(&[]);
+
+        assert!(item.owned);
+        assert_eq!((item.owner, item.owner_name, item.occupied), (None, None, false));
+        assert_eq!((facets.owned, facets.unowned), (3, 3));
+        assert_eq!(facets.owners, []);
+        assert_eq!(searched("ada", false), Vec::<u16>::new());
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    owner: OwnerFilter::Player(4),
+                    ..EntityFilters::default()
+                },
+                false
+            ),
+            Vec::<u16>::new()
+        );
+        assert_eq!(
+            kept(
+                &EntityFilters {
+                    owner: OwnerFilter::Player(4),
+                    ..EntityFilters::default()
+                },
+                true
+            ),
+            [1, 6]
+        );
+        let shown = Source {
+            owners_shown: true,
+            ..hidden
+        };
+        let item = shown.item(&rows[0]);
+        assert_eq!(
+            (item.owner, item.owner_name.as_deref(), item.occupied),
+            (Some(4), Some("Ada"), true)
+        );
+    }
+
+    #[test]
+    fn sorting_puts_what_has_no_name_last_either_way_and_settles_ties_by_net_id() {
+        let (rows, resources, names) = (list(), resources(), names());
+        let source = Source {
+            rows: &rows,
+            resources: &resources,
+            names: &names,
+            owners_shown: true,
+        };
+        let sorted = |sort: EntitySort, descending: bool| {
+            let mut all = source.filtered(&EntityFilters::default());
+            source.sort(&mut all, sort, descending);
+            net_ids(&all)
+        };
+
+        assert_eq!(sorted(EntitySort::Resource, false), [4, 1, 6, 2, 3, 5]);
+        assert_eq!(sorted(EntitySort::Resource, true), [1, 6, 4, 2, 3, 5]);
+        assert_eq!(sorted(EntitySort::Owner, false), [1, 6, 3, 2, 4, 5]);
+        assert_eq!(sorted(EntitySort::Owner, true), [3, 1, 6, 2, 4, 5]);
+        assert_eq!(sorted(EntitySort::Kind, false), [1, 6, 2, 3, 4, 5]);
+        assert_eq!(sorted(EntitySort::Model, false), [4, 5, 2, 3, 1, 6]);
+        assert_eq!(sorted(EntitySort::Bucket, true), [3, 1, 2, 4, 5, 6]);
+        assert_eq!(sorted(EntitySort::Position, true), [6, 5, 4, 3, 2, 1]);
+        assert_eq!(sorted(EntitySort::NetId, true), [6, 5, 4, 3, 2, 1]);
+    }
+
+    #[test]
+    fn a_page_past_the_last_one_is_the_last_one() {
+        let rows: Vec<EntityRow> = (1..=250)
+            .map(|net_id| row(net_id, EntityKind::Object, 1))
+            .collect();
+        let (resources, names) = (Vec::new(), HashMap::new());
+        let source = Source {
+            rows: &rows,
+            resources: &resources,
+            names: &names,
+            owners_shown: true,
+        };
+        let all = source.filtered(&EntityFilters::default());
+
+        let (first, items) = source.page(&all, 0);
+        let (last, rest) = source.page(&all, 9);
+
+        assert_eq!((first, items.len(), items[0].net_id), (0, 100, 1));
+        assert_eq!((last, rest.len(), rest[0].net_id), (2, 50, 201));
+        assert_eq!(source.page(&[], 3), (0, Vec::new()));
+    }
+
+    #[test]
+    fn facets_count_the_whole_list_and_the_models_the_filters_keep() {
+        let (rows, resources, names) = (list(), resources(), names());
+        let source = Source {
+            rows: &rows,
+            resources: &resources,
+            names: &names,
+            owners_shown: true,
+        };
+        let vehicles = source.filtered(&EntityFilters {
+            kinds: vec![EntityKind::Vehicle],
+            ..EntityFilters::default()
+        });
+
+        let facets = source.facets(&vehicles);
+
+        assert_eq!(
+            facets.kinds,
+            KindCounts {
+                vehicles: 3,
+                peds: 1,
+                objects: 2
+            }
+        );
+        assert_eq!(
+            facets.classes,
+            [
+                ClassCount {
+                    class: VehicleClass::Car,
+                    count: 2
+                },
+                ClassCount {
+                    class: VehicleClass::Train,
+                    count: 1
+                },
+            ]
+        );
+        assert_eq!(
+            facets.resources,
+            [
+                ResourceCount {
+                    resource: None,
+                    count: 2
+                },
+                ResourceCount {
+                    resource: Some("qb-garages".to_owned()),
+                    count: 2
+                },
+                ResourceCount {
+                    resource: Some("Ox_Inventory".to_owned()),
+                    count: 1
+                },
+            ]
+        );
+        assert_eq!(
+            facets.buckets,
+            [
+                BucketCount { bucket: 0, count: 5 },
+                BucketCount { bucket: 3, count: 1 }
+            ]
+        );
+        assert_eq!(
+            facets.owners,
+            [
+                OwnerCount {
+                    net_id: 4,
+                    name: Some("Ada".to_owned()),
+                    count: 2
+                },
+                OwnerCount {
+                    net_id: 9,
+                    name: None,
+                    count: 1
+                },
+            ]
+        );
+        assert_eq!(
+            facets.models,
+            [
+                ModelCount {
+                    model: 0xB779_A091,
+                    kind: EntityKind::Vehicle,
+                    count: 2
+                },
+                ModelCount {
+                    model: 0x3D6A_AA9B,
+                    kind: EntityKind::Vehicle,
+                    count: 1
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn cells_count_every_entity_once_and_name_the_most_common_kind() {
+        let rows = [
+            EntityRow {
+                x: 10.0,
+                y: 10.0,
+                ..row(1, EntityKind::Object, 1)
+            },
+            EntityRow {
+                x: 190.0,
+                y: 199.9,
+                ..row(2, EntityKind::Object, 1)
+            },
+            EntityRow {
+                x: 20.0,
+                y: 20.0,
+                ..row(3, EntityKind::Vehicle, 1)
+            },
+            EntityRow {
+                x: -0.1,
+                y: -200.0,
+                ..row(4, EntityKind::Ped, 1)
+            },
+        ];
+        let all: Vec<&EntityRow> = rows.iter().collect();
+
+        assert_eq!(
+            cells(&all, 200),
+            [EntityCell(-1, -1, 1, 1), EntityCell(0, 0, 3, 3)]
+        );
+        assert_eq!(points(&all)[2], EntityPoint(3, 103, 2, 20.0, 20.0));
+        let corner = MapBounds {
+            west: 10.0,
+            east: 20.0,
+            south: 10.0,
+            north: 199.0,
+        };
+        assert_eq!(net_ids(&within(all, &corner)), [1, 3], "edges included");
+    }
+
+    #[test]
+    fn a_deletion_names_its_largest_groups_and_counts_the_rest() {
+        let rows: Vec<EntityRow> = (1..=9_u16)
+            .map(|net_id| EntityRow {
+                resource: u16::from(net_id <= 4),
+                ..row(
+                    net_id,
+                    EntityKind::Object,
+                    if net_id <= 4 { 7 } else { u32::from(net_id) },
+                )
+            })
+            .collect();
+        let all: Vec<&EntityRow> = rows.iter().collect();
+
+        let (named, rest) = groups(&all, &resources());
+
+        assert_eq!(
+            named[0],
+            json!({ "model": "0x00000007", "kind": "object", "resource": "qb-garages", "count": 4 })
+        );
+        assert_eq!(named[1]["resource"], Value::Null);
+        assert_eq!((named.len(), rest), (5, 1));
+    }
+}
diff --git a/crates/observer-app/src/entities/tests.rs b/crates/observer-app/src/entities/tests.rs
new file mode 100644
index 00000000..2d5a6351
--- /dev/null
+++ b/crates/observer-app/src/entities/tests.rs
@@ -0,0 +1,462 @@
+use std::net::{IpAddr, SocketAddr};
+
+use jiff::SignedDuration;
+use observer_domain::audit::AuditFilter;
+use observer_domain::entities::{EntitiesUnavailable, EntityCounts, EntityKind, EntityTarget};
+use observer_domain::map::MapBounds;
+use tempfile::TempDir;
+
+use super::*;
+use crate::{Accounts, AuditLog, Client, PasswordCost, Running, Servers, Setup};
+
+/// The state database in a temporary folder, with a supervision that runs no server.
+struct Lab {
+    _dir: TempDir,
+    db: Database,
+    clock: Clock,
+    supervision: Supervision,
+    _running: Running,
+}
+
+impl Lab {
+    async fn new() -> Self {
+        let dir = tempfile::tempdir().unwrap();
+        let db = Database::open(dir.path().join("observer.sqlite3"), dir.path().join("backups"))
+            .await
+            .unwrap();
+        let clock = Clock::manual("2026-11-11T20:00:00Z".parse().unwrap());
+        let accounts = Accounts::new(db.clone(), clock.clone(), PasswordCost::TEST)
+            .await
+            .unwrap();
+        let data_dir = dir.path().join("data");
+        let (supervision, running) = Supervision::start(
+            Setup {
+                servers: Servers::new(db.clone(), clock.clone()),
+                db: db.clone(),
+                clock: clock.clone(),
+                accounts,
+                data_dir: data_dir.clone(),
+                panel: SocketAddr::from(([127, 0, 0, 1], 41976)),
+                artifacts: data_dir.join("artifacts"),
+                console_logs: data_dir.join("logs/console"),
+                log: None,
+            },
+            |_| {},
+        )
+        .await
+        .unwrap();
+        Self {
+            _dir: dir,
+            db,
+            clock,
+            supervision,
+            _running: running,
+        }
+    }
+
+    fn entities(&self) -> (Entities, EntitiesTask) {
+        Entities::start(EntitiesSetup {
+            db: self.db.clone(),
+            clock: self.clock.clone(),
+            supervision: self.supervision.clone(),
+            players: None,
+        })
+    }
+}
+
+fn caller(permissions: Permissions) -> Caller {
+    Caller {
+        session_id: 1,
+        user_id: 1,
+        username: "ada".to_owned(),
+        is_owner: false,
+        permissions,
+        must_change_password: false,
+        reauthenticated_at: None,
+        client: Client {
+            ip: IpAddr::from([127, 0, 0, 1]),
+            user_agent: None,
+        },
+    }
+}
+
+fn staff() -> Caller {
+    caller(Permissions::all())
+}
+
+const GENERATION: u32 = 3;
+const EPOCH: i64 = 4210;
+/// A car a player sits in, a train, a ped and two objects, the first from a resource.
+const ROWS: &str = "1,11,2,1,3078201489,10.0,-1.0,30.0,4,0,7,1,1;\
+                    2,12,2,8,1030400667,20.0,-2.0,30.0,-1,0,5,0,0;\
+                    3,13,1,0,1885233650,30.0,-3.0,30.0,9,3,5,0,0;\
+                    4,14,3,0,169553981,40.0,-4.0,30.0,-1,0,7,1,0;\
+                    5,15,3,0,169553981,50.0,-5.0,30.0,-1,0,5,0,0";
+
+fn end() -> SweepEnd {
+    SweepEnd {
+        counts: EntityCounts {
+            vehicles: Some(2),
+            peds: Some(3),
+            objects: Some(2),
+            player_peds: 2,
+        },
+        work_us: Some(1200),
+        list_us: Some(300),
+        frames: Some(2),
+        every_ms: Some(15_000),
+        resources: vec!["qb-garages".to_owned()],
+        ..SweepEnd::default()
+    }
+}
+
+fn part(seq: u32, part: u32, rows: &str, end: Option<SweepEnd>) -> EntityReport {
+    EntityReport {
+        generation: GENERATION,
+        kind: EntityReportKind::Sweep(SweepPart {
+            epoch: EPOCH,
+            seq,
+            part,
+            rows: rows.to_owned(),
+            end,
+        }),
+    }
+}
+
+/// The list as one whole sweep leaves it.
+fn swept(entities: &Entities) {
+    entities.on_report(part(1, 1, ROWS, Some(end())), &mut None, true);
+}
+
+fn target(net_id: u16, serial: u32, model: u32) -> EntityTarget {
+    EntityTarget {
+        net_id,
+        serial,
+        model,
+    }
+}
+
+fn code(result: Result<EntityDeletion, Error>) -> Option<ErrorCode> {
+    result.err().and_then(|error| error.code())
+}
+
+async fn all(entities: &Entities, caller: &Caller) -> EntityPage {
+    entities
+        .page(caller, &EntityFilters::default(), EntitySort::NetId, false, 0)
+        .await
+        .unwrap()
+}
+
+#[tokio::test]
+async fn a_sweep_becomes_the_list_once_its_last_part_came() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+    let (first, second) = ROWS.split_at(ROWS.find(';').unwrap());
+    let mut gathering = None;
+
+    entities.on_report(part(1, 1, first, None), &mut gathering, true);
+    let before = all(&entities, &staff()).await;
+    entities.on_report(part(1, 2, &second[1..], Some(end())), &mut gathering, true);
+    let page = all(&entities, &staff()).await;
+    task.close().await;
+
+    assert_eq!(before.live, EntitiesLive::default());
+    assert_eq!(before.items, []);
+    assert_eq!(page.live.run.as_deref(), Some("3-4210"));
+    assert_eq!((page.live.sweep, page.live.listed), (1, 5));
+    assert_eq!(page.live.at, Some(lab.clock.now()));
+    assert_eq!(page.live.counts.map(|counts| counts.player_peds), Some(2));
+    assert_eq!((page.matching, page.page), (5, 0));
+    let car = &page.items[0];
+    assert_eq!((car.net_id, car.serial, car.kind), (1, 11, EntityKind::Vehicle));
+    assert_eq!(car.resource.as_deref(), Some("qb-garages"));
+    assert_eq!((car.owned, car.owner, car.occupied), (true, Some(4), true));
+    assert_eq!(page.limits, EntityLimits::default());
+}
+
+#[tokio::test]
+async fn a_sweep_is_dropped_while_nobody_looks() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+
+    entities.on_report(part(1, 1, ROWS, Some(end())), &mut None, false);
+    let page = all(&entities, &staff()).await;
+    task.close().await;
+
+    assert_eq!(page.live, EntitiesLive::default());
+}
+
+#[test]
+fn a_part_lost_or_repeated_spoils_its_sweep_and_the_next_whole_one_is_taken() {
+    let sweep = |seq: u32, number: u32, last: bool| SweepPart {
+        epoch: EPOCH,
+        seq,
+        part: number,
+        rows: format!("{seq}.{number}"),
+        end: last.then(end),
+    };
+    let mut gathering = None;
+
+    assert!(gather(&mut gathering, GENERATION, sweep(1, 1, false)).is_none());
+    assert!(
+        gather(&mut gathering, GENERATION, sweep(1, 3, true)).is_none(),
+        "part 2 never came"
+    );
+    assert!(gathering.is_none());
+    assert!(
+        gather(&mut gathering, GENERATION, sweep(2, 2, true)).is_none(),
+        "no first part"
+    );
+    assert!(gather(&mut gathering, GENERATION, sweep(3, 1, false)).is_none());
+    assert!(
+        gather(&mut gathering, GENERATION, sweep(3, 1, false)).is_none(),
+        "starts over"
+    );
+    assert!(
+        gather(&mut gathering, GENERATION + 1, sweep(3, 2, true)).is_none(),
+        "another server"
+    );
+    assert!(gather(&mut gathering, GENERATION, sweep(4, 1, false)).is_none());
+    let whole = gather(&mut gathering, GENERATION, sweep(4, 2, true));
+
+    let (gathered, _) = whole.expect("the sweep is whole");
+    assert_eq!(gathered.parts, ["4.1", "4.2"]);
+    assert_eq!((gathered.seq, gathered.epoch), (4, EPOCH));
+    assert!(gathering.is_none());
+}
+
+#[test]
+fn a_sweep_of_more_parts_than_the_bridge_sends_is_dropped() {
+    let mut gathering = None;
+
+    for number in 1..=MAX_PARTS {
+        let part = SweepPart {
+            epoch: EPOCH,
+            seq: 1,
+            part: number,
+            rows: String::new(),
+            end: None,
+        };
+        assert!(gather(&mut gathering, GENERATION, part).is_none());
+    }
+
+    assert!(gathering.is_none());
+}
+
+#[tokio::test]
+async fn a_server_that_cannot_list_its_entities_has_no_list_and_says_why() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+    swept(&entities);
+
+    let unavailable = SweepEnd {
+        unavailable: Some(EntitiesUnavailable::Onesync),
+        ..SweepEnd::default()
+    };
+    entities.on_report(part(2, 1, "", Some(unavailable)), &mut None, true);
+    let page = all(&entities, &staff()).await;
+    task.close().await;
+
+    assert_eq!(page.live.unavailable, Some(EntitiesUnavailable::Onesync));
+    assert_eq!((page.live.run, page.items.len()), (None, 0));
+}
+
+#[tokio::test]
+async fn who_owns_an_entity_is_told_only_to_who_sees_where_players_stand() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+    swept(&entities);
+
+    let page = all(&entities, &caller(Permissions::ENTITIES_VIEW)).await;
+    task.close().await;
+
+    assert!(!page.owners_shown);
+    let car = &page.items[0];
+    assert_eq!((car.owned, car.owner, car.occupied), (true, None, false));
+    assert_eq!((page.facets.owned, page.facets.owners.len()), (2, 0));
+}
+
+#[tokio::test]
+async fn the_map_gets_each_entity_the_filters_keep() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+    swept(&entities);
+    let objects = EntityFilters {
+        kinds: vec![EntityKind::Object],
+        ..EntityFilters::default()
+    };
+
+    let map = entities.map(&staff(), &objects, 200, None).await.unwrap();
+    let odd = entities.map(&staff(), &objects, 123, None).await;
+    let east = MapBounds {
+        west: 45.0,
+        east: 60.0,
+        south: -10.0,
+        north: 0.0,
+    };
+    let in_view = entities
+        .map(&staff(), &EntityFilters::default(), 200, Some(east))
+        .await
+        .unwrap();
+    let inside_out = entities
+        .map(
+            &staff(),
+            &objects,
+            200,
+            Some(MapBounds {
+                west: 60.0,
+                east: 45.0,
+                ..east
+            }),
+        )
+        .await;
+    task.close().await;
+
+    assert_eq!((map.matching, map.cell, map.cells.len()), (2, None, 0));
+    assert_eq!(
+        (map.kinds.vehicles, map.kinds.peds, map.kinds.objects),
+        (2, 1, 2),
+        "the whole list, whatever the filters"
+    );
+    assert_eq!(map.points.len(), 2);
+    let shown: Vec<u16> = in_view.points.iter().map(|point| point.0).collect();
+    assert_eq!(shown, [5], "only what stands in the part of the map asked for");
+    assert_eq!(
+        inside_out.err().and_then(|error| error.code()),
+        Some(ErrorCode::InvalidRequest)
+    );
+    assert_eq!((map.points[0].0, map.points[0].1, map.points[0].2), (4, 14, 3));
+    assert_eq!(map.live.run.as_deref(), Some("3-4210"));
+    assert_eq!(
+        odd.err().and_then(|error| error.code()),
+        Some(ErrorCode::InvalidRequest)
+    );
+}
+
+#[tokio::test]
+async fn nothing_is_deleted_from_a_list_that_is_missing_changed_or_out_of_date() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+    let ask = |run: &str, targets: Vec<EntityTarget>| EntityDeleteRequest {
+        run: run.to_owned(),
+        targets,
+    };
+    let object = || vec![target(5, 15, 169_553_981)];
+
+    let unlisted = entities.delete(&staff(), ask("3-4210", object())).await;
+    swept(&entities);
+    let none = entities.delete(&staff(), ask("3-4210", Vec::new())).await;
+    let many = entities
+        .delete(
+            &staff(),
+            ask("3-4210", vec![target(5, 15, 169_553_981); MAX_DELETE + 1]),
+        )
+        .await;
+    let restarted = entities.delete(&staff(), ask("2-4210", object())).await;
+    let stopped = entities.delete(&staff(), ask("3-4210", object())).await;
+    lab.clock.advance(SignedDuration::from_secs(46));
+    let old = entities.delete(&staff(), ask("3-4210", object())).await;
+    task.close().await;
+
+    assert_eq!(code(unlisted), Some(ErrorCode::EntitiesNotListed));
+    assert_eq!(code(none), Some(ErrorCode::InvalidRequest));
+    match many {
+        Err(Error::Refused(error)) => {
+            assert_eq!(error.code, ErrorCode::TooManyEntities);
+            assert_eq!(error.params["max"], 100);
+        }
+        other => panic!("not refused: {other:?}"),
+    }
+    assert_eq!(code(restarted), Some(ErrorCode::EntitiesChanged));
+    // No server runs here: what the list allows goes no further.
+    assert_eq!(code(stopped), Some(ErrorCode::ServerNotRunning));
+    assert_eq!(code(old), Some(ErrorCode::EntitiesOutOfDate));
+}
+
+#[tokio::test]
+async fn what_the_list_already_rules_out_is_answered_without_asking_the_server() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+    let audit = AuditLog::new(lab.db.clone(), lab.clock.clone());
+    swept(&entities);
+
+    let deletion = entities
+        .delete(
+            &staff(),
+            EntityDeleteRequest {
+                run: "3-4210".to_owned(),
+                targets: vec![
+                    target(1, 11, 3_078_201_489),
+                    target(2, 12, 1_030_400_667),
+                    target(5, 99, 169_553_981),
+                    target(4, 14, 7),
+                    target(77, 1, 1),
+                    target(1, 11, 3_078_201_489),
+                ],
+            },
+        )
+        .await
+        .unwrap();
+    let page = all(&entities, &staff()).await;
+    let recorded = audit.page(AuditFilter::default()).await.unwrap();
+    task.close().await;
+
+    let outcomes: Vec<(u16, EntityOutcome)> = deletion
+        .results
+        .iter()
+        .map(|result| (result.net_id, result.outcome))
+        .collect();
+    assert_eq!(
+        outcomes,
+        [
+            (1, EntityOutcome::Occupied),
+            (2, EntityOutcome::Train),
+            (5, EntityOutcome::Changed),
+            (4, EntityOutcome::Changed),
+            (77, EntityOutcome::Gone),
+        ]
+    );
+    assert_eq!(page.live.listed, 5);
+    assert!(
+        recorded
+            .entries
+            .iter()
+            .all(|entry| entry.action != AuditAction::EntitiesDeleted),
+        "nothing was asked of the server"
+    );
+}
+
+#[tokio::test]
+async fn the_cadence_changes_within_what_the_panel_offers_and_leaves_a_trace() {
+    let lab = Lab::new().await;
+    let (entities, task) = lab.entities();
+    let audit = AuditLog::new(lab.db.clone(), lab.clock.clone());
+
+    let refused = entities
+        .change_settings(&staff(), EntitiesSettings { every_seconds: 7 })
+        .await;
+    entities
+        .change_settings(&staff(), EntitiesSettings { every_seconds: 30 })
+        .await
+        .unwrap();
+    entities
+        .change_settings(&staff(), EntitiesSettings { every_seconds: 30 })
+        .await
+        .unwrap();
+    let saved = entities.settings().await.unwrap();
+    let recorded = audit.page(AuditFilter::default()).await.unwrap();
+    task.close().await;
+
+    assert_eq!(
+        refused.err().and_then(|error| error.code()),
+        Some(ErrorCode::InvalidEntitiesSettings)
+    );
+    assert_eq!(saved, EntitiesSettings { every_seconds: 30 });
+    let changes: Vec<_> = recorded
+        .entries
+        .iter()
+        .filter(|entry| entry.action == AuditAction::EntitiesSettingsChanged)
+        .collect();
+    assert_eq!(changes.len(), 1, "saving the same settings again changes nothing");
+    assert_eq!(changes[0].details["to"]["everySeconds"], 30);
+}
diff --git a/crates/observer-app/src/lib.rs b/crates/observer-app/src/lib.rs
index 7d6c25c7..658d02b0 100644
--- a/crates/observer-app/src/lib.rs
+++ b/crates/observer-app/src/lib.rs
@@ -13,6 +13,7 @@ mod clock;
 mod debug;
 mod diagnostics;
 mod drops;
+mod entities;
 mod error;
 mod features;
 mod files;
@@ -51,6 +52,7 @@ pub use clock::Clock;
 pub use debug::{DebugCounts, DebugSetup, DebugTask};
 pub use diagnostics::{Diagnostics, DiagnosticsSetup, DiagnosticsTask, MAX_DOWNLOAD};
 pub use drops::{DayRates, Drops, DropsSetup, DropsTask, LogQuery};
+pub use entities::{Entities, EntitiesSetup, EntitiesTask};
 pub use error::Error;
 pub use features::{Features, FeaturesSetup, Switched};
 pub use files::{CommitGate, Files, Grant, Group, Login, SERVER as FILES_SERVER, file_group};
diff --git a/crates/observer-domain/src/audit.rs b/crates/observer-domain/src/audit.rs
index 1dc32d68..20b7d73b 100644
--- a/crates/observer-domain/src/audit.rs
+++ b/crates/observer-domain/src/audit.rs
@@ -160,6 +160,12 @@ pub enum AuditAction {
     MapImageChanged,
     /// `details` hold the live map's settings before and after.
     MapSettingsChanged,
+    /// Someone deleted entities of the game. `details` hold how many were asked for and how many
+    /// were deleted, the count of each other outcome, and the largest groups deleted, each a
+    /// model, a kind and the resource that created them.
+    EntitiesDeleted,
+    /// `details` hold the entities' settings before and after.
+    EntitiesSettingsChanged,
     /// The daily drop rates went out as CSV.
     DropRatesExported,
     /// How long players' sessions and their texts are kept changed.
@@ -241,7 +247,7 @@ pub enum AuditAction {
 }
 
 impl AuditAction {
-    pub const ALL: [Self; 111] = [
+    pub const ALL: [Self; 113] = [
         Self::SetupCompleted,
         Self::SetupLinkCreated,
         Self::LoginSucceeded,
@@ -324,6 +330,8 @@ impl AuditAction {
         Self::BansSettingsChanged,
         Self::MapImageChanged,
         Self::MapSettingsChanged,
+        Self::EntitiesDeleted,
+        Self::EntitiesSettingsChanged,
         Self::DropRatesExported,
         Self::DropsRetentionChanged,
         Self::ChangeContentsViewed,
@@ -440,6 +448,8 @@ impl AuditAction {
             Self::BansSettingsChanged => "bans_settings_changed",
             Self::MapImageChanged => "map_image_changed",
             Self::MapSettingsChanged => "map_settings_changed",
+            Self::EntitiesDeleted => "entities_deleted",
+            Self::EntitiesSettingsChanged => "entities_settings_changed",
             Self::DropRatesExported => "drop_rates_exported",
             Self::DropsRetentionChanged => "drops_retention_changed",
             Self::ChangeContentsViewed => "change_contents_viewed",
diff --git a/crates/observer-domain/src/entities.rs b/crates/observer-domain/src/entities.rs
new file mode 100644
index 00000000..f5f4536d
--- /dev/null
+++ b/crates/observer-domain/src/entities.rs
@@ -0,0 +1,714 @@
+//! The server's entities: its vehicles, peds and objects as OneSync knows them, listed while a
+//! panel looks at them, found on the live map, and deleted on request. Observer keeps nothing of
+//! them: the list lives in memory, and goes once nobody looks.
+
+use jiff::Timestamp;
+use serde::{Deserialize, Serialize};
+use ts_rs::TS;
+
+pub const PAGE_SIZE: usize = 100;
+/// The most entities one request deletes.
+pub const MAX_DELETE: usize = 100;
+/// From this many, the panel has a word typed before it deletes.
+pub const TYPED_CONFIRMATION_FROM: usize = 20;
+/// Past this many matching entities, the map gets cells of density instead of each one.
+pub const MAX_MAP_POINTS: usize = 5000;
+/// A list this many sweeps old is out of date: shown as such, and nothing is deleted from it.
+pub const STALE_SWEEPS: u32 = 3;
+/// How often the server lists its entities while someone looks, in seconds, as the owner picks.
+pub const CADENCES: [u8; 5] = [5, 10, 15, 30, 60];
+pub const MAX_SEARCH_CHARS: usize = 64;
+pub const MAX_RESOURCE_NAME_BYTES: usize = 64;
+/// The sides a density cell may have, in game units.
+pub const CELLS: [u32; 7] = [25, 50, 100, 200, 500, 1000, 2000];
+pub const DEFAULT_CELL: u32 = 200;
+/// `GetEntityPopulationType` for what a script created.
+pub const POPULATION_SCRIPT: u8 = 7;
+pub const MAX_POPULATION: u8 = 10;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub enum EntityKind {
+    Vehicle,
+    /// Never a player's own: those are counted and left out.
+    Ped,
+    Object,
+}
+
+impl EntityKind {
+    pub const ALL: [Self; 3] = [Self::Vehicle, Self::Ped, Self::Object];
+
+    /// The number `GetEntityType` gives it, which the bridge and the map's points use.
+    pub const fn code(self) -> u8 {
+        match self {
+            Self::Ped => 1,
+            Self::Vehicle => 2,
+            Self::Object => 3,
+        }
+    }
+
+    pub const fn from_code(code: u8) -> Option<Self> {
+        match code {
+            1 => Some(Self::Ped),
+            2 => Some(Self::Vehicle),
+            3 => Some(Self::Object),
+            _ => None,
+        }
+    }
+
+    pub fn from_name(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|kind| kind.as_str() == name)
+    }
+
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Vehicle => "vehicle",
+            Self::Ped => "ped",
+            Self::Object => "object",
+        }
+    }
+}
+
+/// What `GetVehicleType` says of a vehicle.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub enum VehicleClass {
+    Car,
+    Bike,
+    Boat,
+    Helicopter,
+    Plane,
+    Submarine,
+    Trailer,
+    /// Never deleted from the panel.
+    Train,
+    Other,
+}
+
+impl VehicleClass {
+    pub const ALL: [Self; 9] = [
+        Self::Car,
+        Self::Bike,
+        Self::Boat,
+        Self::Helicopter,
+        Self::Plane,
+        Self::Submarine,
+        Self::Trailer,
+        Self::Train,
+        Self::Other,
+    ];
+
+    /// The bridge's number for it, from 1.
+    pub fn from_code(code: u8) -> Option<Self> {
+        Self::ALL.get(usize::from(code).checked_sub(1)?).copied()
+    }
+
+    pub fn from_name(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|class| class.as_str() == name)
+    }
+
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Car => "car",
+            Self::Bike => "bike",
+            Self::Boat => "boat",
+            Self::Helicopter => "helicopter",
+            Self::Plane => "plane",
+            Self::Submarine => "submarine",
+            Self::Trailer => "trailer",
+            Self::Train => "train",
+            Self::Other => "other",
+        }
+    }
+}
+
+/// Why the server has no entity to list.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub enum EntitiesUnavailable {
+    /// Only OneSync knows the server's entities.
+    Onesync,
+    /// Only GTA V's entities are read.
+    Game,
+}
+
+/// What the server counted in a sweep, whole even when the list is cut short. `None` for a kind
+/// whose listing failed.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntityCounts {
+    pub vehicles: Option<u32>,
+    /// With the players' own.
+    pub peds: Option<u32>,
+    pub objects: Option<u32>,
+    /// Counted among the peds, and never listed.
+    pub player_peds: u32,
+}
+
+/// What the entities topic sends at each sweep, and what every answer about the list carries: the
+/// state of the list, never its rows.
+#[derive(Debug, Clone, PartialEq, Eq, Default, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntitiesLive {
+    /// Names the start of the server and of its bridge that the net ids and serials belong to. A
+    /// deletion gives it back, and is refused once it changed. `None` before the first sweep.
+    pub run: Option<String>,
+    /// Counts the sweeps of a run.
+    pub sweep: u32,
+    /// When Observer took the last sweep.
+    pub at: Option<Timestamp>,
+    pub unavailable: Option<EntitiesUnavailable>,
+    pub counts: Option<EntityCounts>,
+    /// Entities in the list, players' peds left out.
+    pub listed: u32,
+    /// The sweep stopped at its budget or its cap: the list is partial, the counts are not.
+    pub truncated: bool,
+    /// How often the server sweeps, in milliseconds: the cadence asked for, or more once a sweep
+    /// cost it too much.
+    pub every_ms: u32,
+    /// The server spaced its sweeps out by itself.
+    pub spaced: bool,
+    /// What the last sweep took of the server's main thread, in microseconds.
+    pub work_us: Option<u32>,
+    /// The part of it spent listing, before reading each entity.
+    pub list_us: Option<u32>,
+    /// The frames the sweep was spread over.
+    pub frames: Option<u32>,
+}
+
+impl EntitiesLive {
+    /// Whether the list is too old to delete from at `now`: the server stopped answering.
+    pub fn is_stale(&self, now: Timestamp) -> bool {
+        self.at.is_some_and(|at| {
+            let limit = i64::from(STALE_SWEEPS) * i64::from(self.every_ms.max(1000));
+            now.as_millisecond().saturating_sub(at.as_millisecond()) > limit
+        })
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[ts(export)]
+pub struct EntitiesSettings {
+    /// How often the server lists its entities while someone looks at them.
+    pub every_seconds: u8,
+}
+
+impl Default for EntitiesSettings {
+    fn default() -> Self {
+        Self { every_seconds: 15 }
+    }
+}
+
+impl EntitiesSettings {
+    pub fn is_valid(&self) -> bool {
+        CADENCES.contains(&self.every_seconds)
+    }
+}
+
+/// Which entities a list or the map shows.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct EntityFilters {
+    /// None for every kind.
+    pub kinds: Vec<EntityKind>,
+    /// Only vehicles of this class.
+    pub class: Option<VehicleClass>,
+    pub creator: CreatorFilter,
+    pub owner: OwnerFilter,
+    pub bucket: Option<i32>,
+    /// A net id, a model's hash in hexadecimal or decimal, or part of a resource's or an owner's
+    /// name; `#12` is the net id 12 and nothing else.
+    pub search: String,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub enum CreatorFilter {
+    #[default]
+    Any,
+    /// No resource of the server created it: the game's own traffic, or a client's script.
+    None,
+    Resource(String),
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum OwnerFilter {
+    #[default]
+    Any,
+    /// No player's game simulates it.
+    None,
+    Owned,
+    /// The net id of the player whose game does. Matches nothing for who does not see the map.
+    Player(u16),
+}
+
+impl EntityFilters {
+    /// Reads the filters of a query string. A value that names nothing is refused rather than
+    /// taken for no filter, which would show more than was asked for.
+    pub fn parse(query: &EntityFilterQuery) -> Option<Self> {
+        let kinds = match query.kinds.as_deref() {
+            None | Some("") => Vec::new(),
+            Some(list) => {
+                let mut kinds = Vec::new();
+                for name in list.split(',') {
+                    let kind = EntityKind::from_name(name)?;
+                    if !kinds.contains(&kind) {
+                        kinds.push(kind);
+                    }
+                }
+                kinds
+            }
+        };
+        let class = match query.class.as_deref() {
+            None => None,
+            Some(name) => Some(VehicleClass::from_name(name)?),
+        };
+        let creator = match query.resource.as_deref() {
+            None => CreatorFilter::Any,
+            Some("") => CreatorFilter::None,
+            Some(name) if name.len() <= MAX_RESOURCE_NAME_BYTES => CreatorFilter::Resource(name.to_owned()),
+            Some(_) => return None,
+        };
+        let owner = match query.owner.as_deref() {
+            None => OwnerFilter::Any,
+            Some("none") => OwnerFilter::None,
+            Some("owned") => OwnerFilter::Owned,
+            Some(id) => OwnerFilter::Player(id.parse().ok().filter(|&id| id > 0)?),
+        };
+        let search = query.search.as_deref().unwrap_or_default().trim();
+        if search.chars().count() > MAX_SEARCH_CHARS {
+            return None;
+        }
+        Some(Self {
+            kinds,
+            class,
+            creator,
+            owner,
+            bucket: query.bucket,
+            search: search.to_owned(),
+        })
+    }
+}
+
+/// The filters as a query string gives them.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EntityFilterQuery {
+    /// `vehicle`, `ped`, `object`, separated by commas.
+    pub kinds: Option<String>,
+    pub class: Option<String>,
+    /// A resource's name, or empty for the entities no resource created.
+    pub resource: Option<String>,
+    /// `none`, `owned`, or a player's net id.
+    pub owner: Option<String>,
+    pub bucket: Option<i32>,
+    pub search: Option<String>,
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub enum EntitySort {
+    Kind,
+    #[default]
+    Model,
+    Resource,
+    Owner,
+    Bucket,
+    /// From west to east.
+    Position,
+    NetId,
+}
+
+/// An entity in the list.
+#[derive(Debug, Clone, PartialEq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntityItem {
+    pub net_id: u16,
+    /// Drawn by the bridge when it first saw the entity. Net ids are used again: only with its
+    /// serial does one name an entity.
+    pub serial: u32,
+    pub kind: EntityKind,
+    pub class: Option<VehicleClass>,
+    /// The model's hash, unsigned.
+    pub model: u32,
+    pub x: f32,
+    pub y: f32,
+    pub z: f32,
+    /// Whether a player's game simulates it.
+    pub owned: bool,
+    /// That player's net id. `None` without one, and for who does not see where players stand:
+    /// the owner of a vehicle is whoever drives it.
+    pub owner: Option<u16>,
+    pub owner_name: Option<String>,
+    pub bucket: i32,
+    /// How the game came to hold it, as `GetEntityPopulationType` says: 7 for a script's.
+    pub population: u8,
+    /// The resource that created it, as the server knew when the entity was first seen. `None`
+    /// for the game's own traffic and for what a client's script created.
+    pub resource: Option<String>,
+    /// Not looked up yet: a sweep looks up a few hundred.
+    pub resource_pending: bool,
+    /// A player sits in it. Never told to who does not see where players stand.
+    pub occupied: bool,
+}
+
+/// The limits the panel holds a selection to, which the server enforces.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntityLimits {
+    pub page_size: u32,
+    pub max_delete: u32,
+    pub typed_confirmation_from: u32,
+    pub max_map_points: u32,
+    /// A list this many sweeps old is out of date.
+    pub stale_sweeps: u32,
+}
+
+impl Default for EntityLimits {
+    fn default() -> Self {
+        let number = |limit: usize| u32::try_from(limit).unwrap_or(u32::MAX);
+        Self {
+            page_size: number(PAGE_SIZE),
+            max_delete: number(MAX_DELETE),
+            typed_confirmation_from: number(TYPED_CONFIRMATION_FROM),
+            max_map_points: number(MAX_MAP_POINTS),
+            stale_sweeps: STALE_SWEEPS,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, TS)]
+#[ts(export)]
+pub struct KindCounts {
+    pub vehicles: u32,
+    pub peds: u32,
+    pub objects: u32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
+#[ts(export)]
+pub struct ClassCount {
+    pub class: VehicleClass,
+    pub count: u32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, TS)]
+#[ts(export)]
+pub struct ResourceCount {
+    /// `None` for the entities no resource created.
+    pub resource: Option<String>,
+    pub count: u32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
+#[ts(export)]
+pub struct BucketCount {
+    pub bucket: i32,
+    pub count: u32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct OwnerCount {
+    pub net_id: u16,
+    pub name: Option<String>,
+    pub count: u32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
+#[ts(export)]
+pub struct ModelCount {
+    pub model: u32,
+    pub kind: EntityKind,
+    pub count: u32,
+}
+
+/// What the filters can pick from, counted over the whole list, and the most common models of the
+/// entities the filters keep.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntityFacets {
+    pub kinds: KindCounts,
+    pub classes: Vec<ClassCount>,
+    /// The most common first.
+    pub resources: Vec<ResourceCount>,
+    pub buckets: Vec<BucketCount>,
+    pub unowned: u32,
+    pub owned: u32,
+    /// Who owns the most. Empty for who does not see where players stand.
+    pub owners: Vec<OwnerCount>,
+    pub models: Vec<ModelCount>,
+}
+
+/// `GET /api/servers/default/entities`.
+#[derive(Debug, Clone, PartialEq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntityPage {
+    pub live: EntitiesLive,
+    /// Whether who asks may see who owns an entity, and whether a player sits in one.
+    pub owners_shown: bool,
+    pub limits: EntityLimits,
+    pub matching: u32,
+    /// From 0, the last one when the page asked for is past it.
+    pub page: u32,
+    pub items: Vec<EntityItem>,
+    pub facets: EntityFacets,
+}
+
+/// An entity on the map: its net id, its serial, the number of its kind (1 for a ped, 2 for a
+/// vehicle, 3 for an object), then x and y in game units.
+#[derive(Debug, Clone, Copy, PartialEq, Serialize, TS)]
+#[ts(export)]
+pub struct EntityPoint(pub u16, pub u32, pub u8, pub f32, pub f32);
+
+/// A square of the map and the entities in it: its column and its row, counted from the game's
+/// origin in cells, how many entities, and the number of the most common kind.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
+#[ts(export)]
+pub struct EntityCell(pub i32, pub i32, pub u32, pub u8);
+
+/// `GET /api/servers/default/entities/map`.
+#[derive(Debug, Clone, PartialEq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntityMap {
+    pub live: EntitiesLive,
+    /// How many of each kind the whole list holds.
+    pub kinds: KindCounts,
+    /// The entities the filters keep within the part of the map asked for.
+    pub matching: u32,
+    /// Each of them, while they are few enough to draw.
+    pub points: Vec<EntityPoint>,
+    /// The side of a cell in game units, when there are too many: `cells` then stands for them.
+    pub cell: Option<u32>,
+    pub cells: Vec<EntityCell>,
+}
+
+/// An entity to delete, as the list showed it: the server deletes it only if it still is.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, TS)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[ts(export)]
+pub struct EntityTarget {
+    pub net_id: u16,
+    pub serial: u32,
+    pub model: u32,
+}
+
+/// `POST /api/servers/default/entities/delete`.
+#[derive(Debug, Clone, PartialEq, Eq, Deserialize, TS)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+#[ts(export)]
+pub struct EntityDeleteRequest {
+    /// The `run` of the list the entities were picked in.
+    pub run: String,
+    pub targets: Vec<EntityTarget>,
+}
+
+/// What became of an entity someone asked to delete.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub enum EntityOutcome {
+    Deleted,
+    /// Asked of the game, and still there a moment later.
+    Unconfirmed,
+    /// Sent to the server, which did not answer in time.
+    Unanswered,
+    /// It was gone already.
+    Gone,
+    /// Another entity holds the net id now.
+    Changed,
+    /// A player's own ped.
+    Player,
+    /// A player sits in it.
+    Occupied,
+    Train,
+    /// The server read the request too late to act on it.
+    Late,
+    Error,
+}
+
+impl EntityOutcome {
+    pub const ALL: [Self; 10] = [
+        Self::Deleted,
+        Self::Unconfirmed,
+        Self::Unanswered,
+        Self::Gone,
+        Self::Changed,
+        Self::Player,
+        Self::Occupied,
+        Self::Train,
+        Self::Late,
+        Self::Error,
+    ];
+
+    /// The word the bridge reports it by, and the audit log keeps.
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Deleted => "deleted",
+            Self::Unconfirmed => "unconfirmed",
+            Self::Unanswered => "unanswered",
+            Self::Gone => "gone",
+            Self::Changed => "changed",
+            Self::Player => "player",
+            Self::Occupied => "occupied",
+            Self::Train => "train",
+            Self::Late => "late",
+            Self::Error => "error",
+        }
+    }
+
+    pub fn from_name(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|outcome| outcome.as_str() == name)
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export)]
+pub struct EntityResult {
+    pub net_id: u16,
+    pub outcome: EntityOutcome,
+}
+
+/// The answer to a deletion: every entity asked for, once each.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, TS)]
+#[ts(export)]
+pub struct EntityDeletion {
+    pub results: Vec<EntityResult>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn query(text: &str) -> EntityFilterQuery {
+        serde_json::from_str(text).unwrap()
+    }
+
+    #[test]
+    fn kinds_and_classes_keep_the_numbers_the_bridge_reports() {
+        for kind in EntityKind::ALL {
+            assert_eq!(EntityKind::from_code(kind.code()), Some(kind));
+            assert_eq!(EntityKind::from_name(kind.as_str()), Some(kind));
+            assert_eq!(serde_json::to_value(kind).unwrap(), kind.as_str());
+        }
+        assert_eq!(EntityKind::from_code(0), None);
+        assert_eq!(EntityKind::from_code(4), None);
+        assert_eq!(VehicleClass::from_code(1), Some(VehicleClass::Car));
+        assert_eq!(VehicleClass::from_code(8), Some(VehicleClass::Train));
+        assert_eq!(VehicleClass::from_code(9), Some(VehicleClass::Other));
+        assert_eq!(VehicleClass::from_code(0), None);
+        assert_eq!(VehicleClass::from_code(10), None);
+        for class in VehicleClass::ALL {
+            assert_eq!(VehicleClass::from_name(class.as_str()), Some(class));
+            assert_eq!(serde_json::to_value(class).unwrap(), class.as_str());
+        }
+        for outcome in EntityOutcome::ALL {
+            assert_eq!(EntityOutcome::from_name(outcome.as_str()), Some(outcome));
+            assert_eq!(serde_json::to_value(outcome).unwrap(), outcome.as_str());
+        }
+    }
+
+    #[test]
+    fn a_query_without_filters_shows_everything() {
+        assert_eq!(
+            EntityFilters::parse(&EntityFilterQuery::default()),
+            Some(EntityFilters::default())
+        );
+    }
+
+    #[test]
+    fn filters_read_what_a_query_names() {
+        let filters = EntityFilters::parse(&query(
+            r#"{"kinds":"vehicle,ped,vehicle","class":"helicopter","resource":"qb-garages",
+                "owner":"12","bucket":-3,"search":"  0xB779A091 "}"#,
+        ))
+        .unwrap();
+
+        assert_eq!(filters.kinds, [EntityKind::Vehicle, EntityKind::Ped]);
+        assert_eq!(filters.class, Some(VehicleClass::Helicopter));
+        assert_eq!(filters.creator, CreatorFilter::Resource("qb-garages".to_owned()));
+        assert_eq!(filters.owner, OwnerFilter::Player(12));
+        assert_eq!(filters.bucket, Some(-3));
+        assert_eq!(filters.search, "0xB779A091");
+        assert_eq!(
+            EntityFilters::parse(&query(r#"{"resource":"","owner":"none"}"#))
+                .map(|filters| (filters.creator, filters.owner)),
+            Some((CreatorFilter::None, OwnerFilter::None))
+        );
+        assert_eq!(
+            EntityFilters::parse(&query(r#"{"owner":"owned"}"#)).map(|filters| filters.owner),
+            Some(OwnerFilter::Owned)
+        );
+    }
+
+    #[test]
+    fn a_filter_that_names_nothing_is_refused() {
+        for invalid in [
+            r#"{"kinds":"vehicle,plane"}"#.to_owned(),
+            r#"{"class":"hovercraft"}"#.to_owned(),
+            r#"{"owner":"0"}"#.to_owned(),
+            r#"{"owner":"70000"}"#.to_owned(),
+            r#"{"owner":"someone"}"#.to_owned(),
+            format!(r#"{{"resource":"{}"}}"#, "r".repeat(MAX_RESOURCE_NAME_BYTES + 1)),
+            format!(r#"{{"search":"{}"}}"#, "s".repeat(MAX_SEARCH_CHARS + 1)),
+        ] {
+            assert_eq!(EntityFilters::parse(&query(&invalid)), None, "{invalid}");
+        }
+    }
+
+    #[test]
+    fn a_list_is_out_of_date_three_sweeps_after_the_last_one() {
+        let at = Timestamp::from_millisecond(1_793_000_000_000).unwrap();
+        let later = |ms: i64| Timestamp::from_millisecond(at.as_millisecond() + ms).unwrap();
+        let live = EntitiesLive {
+            at: Some(at),
+            every_ms: 15_000,
+            ..EntitiesLive::default()
+        };
+
+        assert!(!live.is_stale(later(45_000)));
+        assert!(live.is_stale(later(45_001)));
+        assert!(!EntitiesLive::default().is_stale(later(1_000_000)), "no list yet");
+        // A sweep the server spaced out is given its own cadence.
+        let spaced = EntitiesLive {
+            every_ms: 60_000,
+            ..live
+        };
+        assert!(!spaced.is_stale(later(180_000)));
+        assert!(spaced.is_stale(later(180_001)));
+    }
+
+    #[test]
+    fn settings_take_the_cadences_the_panel_offers() {
+        assert!(EntitiesSettings::default().is_valid());
+        for seconds in CADENCES {
+            assert!(
+                EntitiesSettings {
+                    every_seconds: seconds
+                }
+                .is_valid()
+            );
+        }
+        for seconds in [0, 1, 4, 20, 61] {
+            assert!(
+                !EntitiesSettings {
+                    every_seconds: seconds
+                }
+                .is_valid(),
+                "{seconds}"
+            );
+        }
+    }
+}
diff --git a/crates/observer-domain/src/error.rs b/crates/observer-domain/src/error.rs
index 8d74da76..e16dcb5a 100644
--- a/crates/observer-domain/src/error.rs
+++ b/crates/observer-domain/src/error.rs
@@ -184,6 +184,20 @@ pub enum ErrorCode {
     /// The thresholds are not ordered, the cadence is not 1, 2 or 5 seconds, or the edges enclose
     /// no area.
     InvalidMapSettings,
+    /// The server's entities are not listed yet: the first sweep comes a moment after someone
+    /// starts looking at them.
+    EntitiesNotListed,
+    /// The server or its bridge started again since the list was read: its net ids name other
+    /// entities now.
+    EntitiesChanged,
+    /// The list is too old to delete from: the server stopped answering.
+    EntitiesOutOfDate,
+    /// Another deletion is still under way.
+    EntitiesDeleting,
+    /// Params: `max`, the most entities one deletion takes.
+    TooManyEntities,
+    /// The cadence is not one the panel offers.
+    InvalidEntitiesSettings,
     /// The file changes' database could not be opened: it was set aside, or Observer is stopping.
     ChangesUnavailable,
     /// No start or check of the server has this id.
diff --git a/crates/observer-domain/src/features.rs b/crates/observer-domain/src/features.rs
index ed0de0d5..3a0ca593 100644
--- a/crates/observer-domain/src/features.rs
+++ b/crates/observer-domain/src/features.rs
@@ -33,6 +33,9 @@ pub enum Feature {
     /// state bag writes and outgoing HTTP requests. Off until the owner turns it on, since it adds
     /// two lines to the build's Lua scheduler.
     Debug,
+    /// The server's vehicles, peds and objects, listed while a panel looks at them, found on the
+    /// live map, and deleted on request.
+    Entities,
 }
 
 /// When a change of a switch takes effect.
@@ -109,6 +112,9 @@ pub enum FeatureTask {
     HookLines,
     /// Reads and totals what the resources count.
     HookCounts,
+    /// Has the server list its entities while a panel looks at them, and keeps the list in
+    /// memory until nobody does.
+    EntityList,
 }
 
 /// When a task of a feature runs.
@@ -149,7 +155,7 @@ pub enum ServerFolder {
 }
 
 impl Feature {
-    pub const ALL: [Self; 9] = [
+    pub const ALL: [Self; 10] = [
         Self::Sftp,
         Self::Changes,
         Self::Tools,
@@ -159,6 +165,7 @@ impl Feature {
         Self::Drops,
         Self::Updates,
         Self::Debug,
+        Self::Entities,
     ];
 
     /// The name on the wire, in the store and in `observer.toml`.
@@ -173,6 +180,7 @@ impl Feature {
             Self::Drops => "drops",
             Self::Updates => "updates",
             Self::Debug => "debug",
+            Self::Entities => "entities",
         }
     }
 
@@ -251,6 +259,7 @@ impl Feature {
             run(T::HookLines, C::ServerStart),
             run(T::HookCounts, C::Continuous),
         ];
+        const ENTITIES: &[FeatureTaskRun] = &[run(T::EntityList, C::Continuous)];
         match self {
             Self::Sftp => SFTP,
             Self::Changes => CHANGES,
@@ -261,6 +270,7 @@ impl Feature {
             Self::Drops => DROPS,
             Self::Updates => UPDATES,
             Self::Debug => DEBUG,
+            Self::Entities => ENTITIES,
         }
     }
 
@@ -303,7 +313,7 @@ impl Feature {
     /// The files and folders it keeps, under Observer's data folder.
     pub const fn files(self) -> &'static [&'static str] {
         match self {
-            Self::Sftp | Self::Debug => &[],
+            Self::Sftp | Self::Debug | Self::Entities => &[],
             Self::Changes => &["changes.sqlite3"],
             Self::Tools => &["tools/backups"],
             Self::Diagnostics => &["crashes"],
@@ -316,9 +326,13 @@ impl Feature {
         match self {
             Self::Sftp | Self::Tools => ServerFolder::Writes,
             Self::Changes => ServerFolder::Reads,
-            Self::Diagnostics | Self::Metrics | Self::Players | Self::Drops | Self::Updates | Self::Debug => {
-                ServerFolder::Untouched
-            }
+            Self::Diagnostics
+            | Self::Metrics
+            | Self::Players
+            | Self::Drops
+            | Self::Updates
+            | Self::Debug
+            | Self::Entities => ServerFolder::Untouched,
         }
     }
 
@@ -334,6 +348,7 @@ impl Feature {
             Self::Drops => &["/servers/default/drops"],
             Self::Updates => &["/updates"],
             Self::Debug => &["/debug"],
+            Self::Entities => &["/servers/default/entities"],
         }
     }
 
@@ -343,6 +358,7 @@ impl Feature {
             Self::Diagnostics => &[Topic::ServerDiagnostics, Topic::ServerAlerts],
             Self::Metrics => &[Topic::MetricsLive],
             Self::Players => &[Topic::ServerMap],
+            Self::Entities => &[Topic::ServerEntities],
             Self::Sftp | Self::Tools | Self::Drops | Self::Updates | Self::Debug => &[],
         }
     }
diff --git a/crates/observer-domain/src/lib.rs b/crates/observer-domain/src/lib.rs
index d81de765..35081e58 100644
--- a/crates/observer-domain/src/lib.rs
+++ b/crates/observer-domain/src/lib.rs
@@ -18,6 +18,7 @@ pub mod debug;
 pub mod delegation;
 pub mod diagnostics;
 pub mod drops;
+pub mod entities;
 pub mod error;
 pub mod features;
 pub mod files;
diff --git a/crates/observer-domain/src/live.rs b/crates/observer-domain/src/live.rs
index aa49dfc8..b02cc6e5 100644
--- a/crates/observer-domain/src/live.rs
+++ b/crates/observer-domain/src/live.rs
@@ -10,6 +10,7 @@ use crate::artifacts::ArtifactsStatus;
 use crate::audit::AuditEntry;
 use crate::changes::ChangesLive;
 use crate::diagnostics::{AlertList, DiagnosticsEvent, DiagnosticsSnapshot};
+use crate::entities::EntitiesLive;
 use crate::error::ErrorCode;
 use crate::map::MapLive;
 use crate::metrics::{LiveSample, MetricsSnapshot};
@@ -73,10 +74,14 @@ pub enum Topic {
     /// only then. Needs the live map permission.
     #[serde(rename = "server.map")]
     ServerMap,
+    /// The state of the list of the server's entities, while the topic is followed: the server
+    /// lists them only then. Needs the entities permission.
+    #[serde(rename = "server.entities")]
+    ServerEntities,
 }
 
 impl Topic {
-    pub const ALL: [Self; 11] = [
+    pub const ALL: [Self; 12] = [
         Self::Status,
         Self::Audit,
         Self::ServerStatus,
@@ -88,6 +93,7 @@ impl Topic {
         Self::ServerDiagnostics,
         Self::ServerChanges,
         Self::ServerMap,
+        Self::ServerEntities,
     ];
 }
 
@@ -165,6 +171,8 @@ pub enum TopicSnapshot {
     ServerChanges(ChangesLive),
     #[serde(rename = "server.map")]
     ServerMap(MapLive),
+    #[serde(rename = "server.entities")]
+    ServerEntities(EntitiesLive),
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize, TS)]
@@ -196,6 +204,9 @@ pub enum TopicEvent {
     /// Every placed player again, at each report of the bridge.
     #[serde(rename = "server.map")]
     ServerMap(MapLive),
+    /// The state of the list again, at each sweep of the bridge and after each deletion.
+    #[serde(rename = "server.entities")]
+    ServerEntities(EntitiesLive),
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
diff --git a/crates/observer-domain/src/permissions.rs b/crates/observer-domain/src/permissions.rs
index 8104324e..bf1bcae4 100644
--- a/crates/observer-domain/src/permissions.rs
+++ b/crates/observer-domain/src/permissions.rs
@@ -41,6 +41,8 @@ impl Permissions {
     pub const PLAYERS_BAN: Self = Self(1 << 23);
     pub const BANS_LIFT: Self = Self(1 << 24);
     pub const PLAYERS_MAP: Self = Self(1 << 25);
+    pub const ENTITIES_VIEW: Self = Self(1 << 26);
+    pub const ENTITIES_DELETE: Self = Self(1 << 27);
 
     /// Every permission in the catalog, which is what the owner holds.
     pub fn all() -> Self {
@@ -209,6 +211,7 @@ pub enum PermissionArea {
     Drops,
     Changes,
     Backups,
+    Entities,
 }
 
 /// One permission of the catalog, as `GET /api/permissions` returns it.
@@ -462,6 +465,25 @@ pub const CATALOG: &[PermissionInfo] = &[
         danger: Danger::Sensitive,
         implies: Permissions::PLAYERS_VIEW,
     },
+    PermissionInfo {
+        bit: 26,
+        constant: "ENTITIES_VIEW",
+        key: "entitiesView",
+        area: PermissionArea::Entities,
+        // Models, creating resources and where each entity stands. Who owns one, and whether a
+        // player sits in it, stay behind PLAYERS_MAP: they say where a player is.
+        danger: Danger::Normal,
+        implies: Permissions::NONE,
+    },
+    PermissionInfo {
+        bit: 27,
+        constant: "ENTITIES_DELETE",
+        key: "entitiesDelete",
+        area: PermissionArea::Entities,
+        // Players see the entity vanish, and a script still using it may fail.
+        danger: Danger::Sensitive,
+        implies: Permissions::ENTITIES_VIEW,
+    },
 ];
 
 #[cfg(test)]
@@ -502,6 +524,8 @@ mod tests {
             (23, "PLAYERS_BAN", Permissions::PLAYERS_BAN),
             (24, "BANS_LIFT", Permissions::BANS_LIFT),
             (25, "PLAYERS_MAP", Permissions::PLAYERS_MAP),
+            (26, "ENTITIES_VIEW", Permissions::ENTITIES_VIEW),
+            (27, "ENTITIES_DELETE", Permissions::ENTITIES_DELETE),
         ];
 
         assert_eq!(CATALOG.len(), frozen.len());
diff --git a/crates/observer-fxserver/src/bridge.rs b/crates/observer-fxserver/src/bridge.rs
index 7b3fc8bb..3f7e16c4 100644
--- a/crates/observer-fxserver/src/bridge.rs
+++ b/crates/observer-fxserver/src/bridge.rs
@@ -352,6 +352,18 @@ pub enum BridgeAction {
     },
     /// Has the bridge report where the players stand every `every_ms` for `for_ms`, or stop with 0.
     Positions { every_ms: u32, for_ms: u32 },
+    /// Has the bridge list the server's entities every `every_ms` for `for_ms`, or stop with 0.
+    Entities { every_ms: u32, for_ms: u32 },
+    /// Has the bridge delete entities it listed, and report what became of each. `targets` holds
+    /// a net id then the serial the bridge drew for that entity, one pair after the other. The
+    /// bridge deletes nothing once `deadline`, in Unix seconds, has passed, and nothing of
+    /// another start of itself than `epoch`.
+    DeleteEntities {
+        request: u32,
+        epoch: i64,
+        deadline: i64,
+        targets: Vec<u32>,
+    },
 }
 
 /// What a banned player reads, and the `observer:playerRefused` the bridge raises for it.
@@ -387,6 +399,8 @@ impl BridgeAction {
             Self::Verdict { .. } => "verdict",
             Self::Drop { .. } => "drop",
             Self::Positions { .. } => "positions",
+            Self::Entities { .. } => "entities",
+            Self::DeleteEntities { .. } => "deleteEntities",
         }
     }
 
@@ -400,7 +414,10 @@ impl BridgeAction {
     pub fn fitted(mut self) -> Self {
         while self.encode().len() > 2 * MAX_BRIDGE_JSON {
             let (message, event) = match &mut self {
-                Self::Verdict { refusal: None, .. } | Self::Positions { .. } => return self,
+                Self::Verdict { refusal: None, .. }
+                | Self::Positions { .. }
+                | Self::Entities { .. }
+                | Self::DeleteEntities { .. } => return self,
                 Self::Verdict {
                     refusal: Some(Refusal { message, event }),
                     ..
@@ -842,7 +859,7 @@ mod tests {
         }
     }
 
-    fn every_action() -> [BridgeAction; 3] {
+    fn every_action() -> [BridgeAction; 5] {
         [
             BridgeAction::Verdict {
                 request: 7,
@@ -860,9 +877,45 @@ mod tests {
                 every_ms: 2000,
                 for_ms: 30_000,
             },
+            BridgeAction::Entities {
+                every_ms: 15_000,
+                for_ms: 30_000,
+            },
+            BridgeAction::DeleteEntities {
+                request: 4,
+                epoch: 4210,
+                deadline: 1_793_000_009,
+                targets: vec![12, 3, 13, 8],
+            },
         ]
     }
 
+    #[test]
+    fn the_most_entities_one_deletion_takes_fit_the_console_line() {
+        let largest = BridgeAction::DeleteEntities {
+            request: u32::MAX,
+            epoch: i64::from(u32::MAX),
+            deadline: 9_999_999_999,
+            targets: [u32::from(u16::MAX), 0x7fff_ffff].repeat(observer_domain::entities::MAX_DELETE),
+        };
+
+        assert!(crate::stdin::allowed(&format!(
+            "observer_cmd {}",
+            largest.encode()
+        )));
+        assert_eq!(
+            decode(&every_action()[4].encode()),
+            json!({
+                "action": "deleteEntities",
+                "payload": { "request": 4, "epoch": 4210, "deadline": 1_793_000_009, "targets": [12, 3, 13, 8] }
+            })
+        );
+        assert_eq!(
+            decode(&every_action()[3].encode()),
+            json!({ "action": "entities", "payload": { "everyMs": 15_000, "forMs": 30_000 } })
+        );
+    }
+
     #[test]
     fn the_resource_takes_exactly_the_actions_observer_can_send() {
         let lua = FILES[1].1;
diff --git a/crates/observer-fxserver/src/entities.rs b/crates/observer-fxserver/src/entities.rs
new file mode 100644
index 00000000..66f26b8f
--- /dev/null
+++ b/crates/observer-fxserver/src/entities.rs
@@ -0,0 +1,610 @@
+//! What the bridge reports about the server's entities: the parts of a sweep, each a string of
+//! rows, and what became of the entities Observer asked it to delete. Like the players' reports
+//! they go on a bus of their own, and only the bridge of this start may send them.
+//!
+//! A row outside its ranges is left out alone; a report that is not shaped as the bridge shapes
+//! them is dropped whole.
+
+use observer_domain::entities::{
+    EntitiesUnavailable, EntityCounts, EntityKind, EntityOutcome, MAX_DELETE, MAX_POPULATION,
+    MAX_RESOURCE_NAME_BYTES, VehicleClass,
+};
+use serde_json::Value;
+
+use crate::bridge::REPORT_TYPE;
+use crate::players::MAX_COORDINATE;
+use crate::trace::TraceKind;
+
+/// The bridge lists this many entities at most, 500 a part.
+pub const MAX_ROWS: usize = 20_000;
+pub const MAX_PARTS: u32 = 64;
+/// Twice what the bridge puts in a part.
+const MAX_PART_BYTES: usize = 128 * 1024;
+const MAX_RESOURCES: usize = 2048;
+const MAX_COUNT: u64 = 1_000_000;
+const MAX_SERIAL: u64 = 0x7fff_ffff;
+const FIELDS: usize = 13;
+const OCCUPIED: u8 = 1;
+const RESOURCE_PENDING: u8 = 2;
+
+/// A report and the start of FXServer it came from.
+#[derive(Debug, Clone, PartialEq)]
+pub struct EntityReport {
+    pub generation: u32,
+    pub kind: EntityReportKind,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum EntityReportKind {
+    Sweep(SweepPart),
+    Deleted(DeleteReply),
+}
+
+/// One part of a sweep, in the order the bridge sent them.
+#[derive(Debug, Clone, PartialEq)]
+pub struct SweepPart {
+    /// Which start of the bridge numbered the entities: it numbers them again from 1 after each.
+    pub epoch: i64,
+    pub seq: u32,
+    /// From 1.
+    pub part: u32,
+    /// This part's rows as the bridge wrote them. [`read_rows`] reads them once the sweep is
+    /// whole: only its last part says how many resources they may name.
+    pub rows: String,
+    /// On the last part.
+    pub end: Option<SweepEnd>,
+}
+
+/// What the last part of a sweep says of the whole.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct SweepEnd {
+    pub unavailable: Option<EntitiesUnavailable>,
+    pub counts: EntityCounts,
+    pub truncated: bool,
+    /// Microseconds of the server's main thread.
+    pub work_us: Option<u32>,
+    pub list_us: Option<u32>,
+    pub frames: Option<u32>,
+    /// The cadence the bridge sweeps at from now on.
+    pub every_ms: Option<u32>,
+    pub spaced: bool,
+    /// The resources the rows name by their place in this list, from 1.
+    pub resources: Vec<String>,
+}
+
+/// What became of the entities of a deletion, by net id.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DeleteReply {
+    pub request: u32,
+    pub outcomes: Vec<(u16, EntityOutcome)>,
+}
+
+/// An entity as a sweep saw it.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct EntityRow {
+    pub net_id: u16,
+    /// Drawn by the bridge when it first saw the entity: net ids are used again.
+    pub serial: u32,
+    pub kind: EntityKind,
+    pub class: Option<VehicleClass>,
+    pub model: u32,
+    pub x: f32,
+    pub y: f32,
+    pub z: f32,
+    /// The net id of the player whose game simulates it.
+    pub owner: Option<u16>,
+    pub bucket: i32,
+    pub population: u8,
+    /// The place of its creating resource in the sweep's list, from 1; 0 for none.
+    pub resource: u16,
+    /// Not looked up yet, which is not the same as none.
+    pub resource_pending: bool,
+    /// A player sits in it.
+    pub occupied: bool,
+}
+
+impl EntityReportKind {
+    pub fn from_trace(trace: &TraceKind, bridge: &str) -> Option<Self> {
+        let TraceKind::Script { resource, payload } = trace else {
+            return None;
+        };
+        if resource != bridge || payload.get("type").and_then(Value::as_str) != Some(REPORT_TYPE) {
+            return None;
+        }
+        match payload.get("kind").and_then(Value::as_str)? {
+            "entities" => sweep_part(payload).map(Self::Sweep),
+            "entitiesDeleted" => Some(Self::Deleted(DeleteReply {
+                request: number(payload.get("request"), 1, u64::from(u32::MAX))?,
+                outcomes: payload
+                    .get("outcomes")
+                    .and_then(Value::as_array)
+                    .into_iter()
+                    .flatten()
+                    .filter_map(|outcome| {
+                        let net_id = number(outcome.get(0), 1, u64::from(u16::MAX))?;
+                        // A word this Observer does not know is no deletion it can vouch for.
+                        let outcome = outcome
+                            .get(1)
+                            .and_then(Value::as_str)
+                            .and_then(EntityOutcome::from_name)
+                            .filter(|outcome| *outcome != EntityOutcome::Unanswered)
+                            .unwrap_or(EntityOutcome::Error);
+                        Some((net_id, outcome))
+                    })
+                    .take(MAX_DELETE)
+                    .collect(),
+            })),
+            _ => None,
+        }
+    }
+}
+
+fn sweep_part(payload: &Value) -> Option<SweepPart> {
+    let rows = payload.get("rows").and_then(Value::as_str)?;
+    if rows.len() > MAX_PART_BYTES {
+        return None;
+    }
+    let last = payload.get("last").and_then(Value::as_bool).unwrap_or(false);
+    Some(SweepPart {
+        epoch: payload
+            .get("epoch")
+            .and_then(Value::as_i64)
+            .filter(|&epoch| epoch >= 0)?,
+        seq: number(payload.get("seq"), 1, u64::from(u32::MAX))?,
+        part: number(payload.get("part"), 1, u64::from(MAX_PARTS))?,
+        rows: rows.to_owned(),
+        end: if last { Some(sweep_end(payload)?) } else { None },
+    })
+}
+
+fn sweep_end(payload: &Value) -> Option<SweepEnd> {
+    let unavailable = match payload.get("unavailable").and_then(Value::as_str) {
+        None => None,
+        Some("onesync") => Some(EntitiesUnavailable::Onesync),
+        Some("game") => Some(EntitiesUnavailable::Game),
+        Some(_) => return None,
+    };
+    let counts = payload.get("counts");
+    let count = |key| number::<u32>(counts.and_then(|counts| counts.get(key)), 0, MAX_COUNT);
+    let micros = |key| {
+        payload
+            .get(key)
+            .and_then(Value::as_f64)
+            .filter(|value| value.is_finite() && *value >= 0.0)
+            .map(|value| {
+                #[expect(
+                    clippy::cast_possible_truncation,
+                    clippy::cast_sign_loss,
+                    reason = "microseconds, checked to be positive and capped"
+                )]
+                let micros = value.min(f64::from(u32::MAX)) as u32;
+                micros
+            })
+    };
+    Some(SweepEnd {
+        unavailable,
+        counts: EntityCounts {
+            vehicles: count("vehicles"),
+            peds: count("peds"),
+            objects: count("objects"),
+            player_peds: count("playerPeds").unwrap_or(0),
+        },
+        truncated: payload.get("truncated").and_then(Value::as_bool).unwrap_or(false),
+        work_us: micros("workUs"),
+        list_us: micros("listUs"),
+        frames: number(payload.get("frames"), 0, MAX_COUNT),
+        every_ms: number(payload.get("everyMs"), 1, 3_600_000),
+        spaced: payload.get("spaced").and_then(Value::as_bool).unwrap_or(false),
+        resources: resources(payload.get("resources"))?,
+    })
+}
+
+/// The names the rows point into. The bridge's JSON writes a list without any name as `{}` or as
+/// `[]`.
+fn resources(value: Option<&Value>) -> Option<Vec<String>> {
+    let names = match value {
+        None => return Some(Vec::new()),
+        Some(Value::Object(fields)) if fields.is_empty() => return Some(Vec::new()),
+        Some(Value::Array(names)) if names.len() <= MAX_RESOURCES => names,
+        Some(_) => return None,
+    };
+    names
+        .iter()
+        .map(|name| {
+            name.as_str()
+                .filter(|name| !name.is_empty() && name.len() <= MAX_RESOURCE_NAME_BYTES)
+                .map(str::to_owned)
+        })
+        .collect()
+}
+
+fn number<T: TryFrom<u64>>(value: Option<&Value>, min: u64, max: u64) -> Option<T> {
+    value
+        .and_then(Value::as_u64)
+        .filter(|number| (min..=max).contains(number))
+        .and_then(|number| T::try_from(number).ok())
+}
+
+/// Reads `netId,serial,kind,class,model,x,y,z,owner,bucket,population,resource,flags` rows,
+/// separated by `;`, into `out`, which never holds more than [`MAX_ROWS`]. `resources` is how many
+/// names the sweep lists.
+pub fn read_rows(rows: &str, resources: usize, out: &mut Vec<EntityRow>) {
+    for row in rows.split(';') {
+        if out.len() >= MAX_ROWS {
+            return;
+        }
+        if let Some(row) = read_row(row, resources) {
+            out.push(row);
+        }
+    }
+}
+
+fn read_row(row: &str, resources: usize) -> Option<EntityRow> {
+    let mut fields = [""; FIELDS];
+    let mut given = row.split(',');
+    for field in &mut fields {
+        *field = given.next()?;
+    }
+    if given.next().is_some() {
+        return None;
+    }
+    let whole = |index: usize, min: i64, max: i64| {
+        fields[index]
+            .parse::<i64>()
+            .ok()
+            .filter(|number| (min..=max).contains(number))
+    };
+    let coordinate = |index: usize| {
+        fields[index]
+            .parse::<f32>()
+            .ok()
+            .filter(|value| value.is_finite() && f64::from(value.abs()) <= MAX_COORDINATE)
+    };
+    let kind = EntityKind::from_code(u8::try_from(whole(2, 1, 3)?).ok()?)?;
+    let class = u8::try_from(whole(3, 0, 9)?).ok()?;
+    // Only a vehicle has a class, and every vehicle has one.
+    if (kind == EntityKind::Vehicle) != (class != 0) {
+        return None;
+    }
+    let flags = u8::try_from(whole(12, 0, i64::from(OCCUPIED | RESOURCE_PENDING))?).ok()?;
+    Some(EntityRow {
+        net_id: u16::try_from(whole(0, 1, i64::from(u16::MAX))?).ok()?,
+        serial: u32::try_from(whole(1, 1, i64::try_from(MAX_SERIAL).ok()?)?).ok()?,
+        kind,
+        class: VehicleClass::from_code(class),
+        model: u32::try_from(whole(4, 0, i64::from(u32::MAX))?).ok()?,
+        x: coordinate(5)?,
+        y: coordinate(6)?,
+        z: coordinate(7)?,
+        owner: u16::try_from(whole(8, -1, i64::from(u16::MAX))?)
+            .ok()
+            .filter(|&owner| owner > 0),
+        bucket: i32::try_from(whole(9, i64::from(i32::MIN), i64::from(i32::MAX))?).ok()?,
+        population: u8::try_from(whole(10, 0, i64::from(MAX_POPULATION))?).ok()?,
+        resource: u16::try_from(whole(11, 0, i64::try_from(resources).ok()?)?).ok()?,
+        resource_pending: flags & RESOURCE_PENDING != 0,
+        occupied: flags & OCCUPIED != 0,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    const BRIDGE: &str = "sys_k3jx7qmw2pza";
+
+    fn report(resource: &str, payload: Value) -> Option<EntityReportKind> {
+        EntityReportKind::from_trace(
+            &TraceKind::Script {
+                resource: resource.to_owned(),
+                payload,
+            },
+            BRIDGE,
+        )
+    }
+
+    fn rows(text: &str, resources: usize) -> Vec<EntityRow> {
+        let mut out = Vec::new();
+        read_rows(text, resources, &mut out);
+        out
+    }
+
+    #[test]
+    fn a_part_of_a_sweep_keeps_its_rows_for_the_end_of_the_sweep() {
+        let part = report(
+            BRIDGE,
+            json!({
+                "type": "observer", "kind": "entities", "epoch": 4210, "seq": 7, "part": 2,
+                "last": false, "rows": "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,1",
+            }),
+        );
+
+        assert_eq!(
+            part,
+            Some(EntityReportKind::Sweep(SweepPart {
+                epoch: 4210,
+                seq: 7,
+                part: 2,
+                rows: "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,1".to_owned(),
+                end: None,
+            }))
+        );
+    }
+
+    #[test]
+    fn the_last_part_says_what_the_sweep_counted_and_cost() {
+        let part = report(
+            BRIDGE,
+            json!({
+                "type": "observer", "kind": "entities", "epoch": 4210, "seq": 7, "part": 3,
+                "last": true, "rows": "",
+                "counts": { "vehicles": 412, "objects": 9120, "playerPeds": 48 },
+                "listed": 9884, "failed": 0, "truncated": true,
+                "workUs": 12400, "listUs": 2900.5, "frames": 9, "everyMs": 30000, "spaced": true,
+                "resources": ["qb-garages", "ox_inventory"],
+            }),
+        );
+
+        let Some(EntityReportKind::Sweep(part)) = part else {
+            panic!("not a sweep: {part:?}");
+        };
+        assert_eq!(
+            part.end,
+            Some(SweepEnd {
+                unavailable: None,
+                counts: EntityCounts {
+                    vehicles: Some(412),
+                    peds: None,
+                    objects: Some(9120),
+                    player_peds: 48,
+                },
+                truncated: true,
+                work_us: Some(12400),
+                list_us: Some(2900),
+                frames: Some(9),
+                every_ms: Some(30000),
+                spaced: true,
+                resources: vec!["qb-garages".to_owned(), "ox_inventory".to_owned()],
+            })
+        );
+    }
+
+    #[test]
+    fn a_server_that_cannot_list_its_entities_says_why() {
+        for (word, unavailable) in [
+            ("onesync", EntitiesUnavailable::Onesync),
+            ("game", EntitiesUnavailable::Game),
+        ] {
+            let part = report(
+                BRIDGE,
+                json!({
+                    "type": "observer", "kind": "entities", "epoch": 0, "seq": 1, "part": 1,
+                    "last": true, "rows": "", "unavailable": word,
+                }),
+            );
+
+            let Some(EntityReportKind::Sweep(part)) = part else {
+                panic!("not a sweep: {part:?}");
+            };
+            assert_eq!(part.end.and_then(|end| end.unavailable), Some(unavailable));
+        }
+    }
+
+    #[test]
+    fn a_sweep_that_names_no_resource_lists_none_however_the_bridge_wrote_that() {
+        for names in [json!([]), json!({}), Value::Null] {
+            let mut payload = json!({
+                "type": "observer", "kind": "entities", "epoch": 1, "seq": 1, "part": 1,
+                "last": true, "rows": "",
+            });
+            if !names.is_null() {
+                payload["resources"] = names;
+            }
+
+            let Some(EntityReportKind::Sweep(part)) = report(BRIDGE, payload) else {
+                panic!("not a sweep");
+            };
+            assert_eq!(part.end.map(|end| end.resources), Some(Vec::new()));
+        }
+    }
+
+    #[test]
+    fn a_report_that_is_not_shaped_as_the_bridge_shapes_them_is_dropped() {
+        let part = |change: fn(&mut Value)| {
+            let mut payload = json!({
+                "type": "observer", "kind": "entities", "epoch": 1, "seq": 1, "part": 1,
+                "last": true, "rows": "", "resources": ["chat"],
+            });
+            change(&mut payload);
+            report(BRIDGE, payload)
+        };
+
+        assert!(part(|_| {}).is_some());
+        assert_eq!(part(|payload| payload["rows"] = json!(12)), None);
+        assert_eq!(
+            part(|payload| payload["rows"] = json!("x".repeat(MAX_PART_BYTES + 1))),
+            None
+        );
+        assert_eq!(part(|payload| payload["seq"] = json!(0)), None);
+        assert_eq!(part(|payload| payload["part"] = json!(MAX_PARTS + 1)), None);
+        assert_eq!(part(|payload| payload["epoch"] = json!(-1)), None);
+        assert_eq!(part(|payload| payload["unavailable"] = json!("mood")), None);
+        assert_eq!(part(|payload| payload["resources"] = json!(["chat", 4])), None);
+        assert_eq!(part(|payload| payload["resources"] = json!([""])), None);
+        assert_eq!(
+            part(|payload| payload["resources"] = json!(["r".repeat(MAX_RESOURCE_NAME_BYTES + 1)])),
+            None
+        );
+        assert_eq!(
+            part(|payload| payload["resources"] = json!({ "1": "chat" })),
+            None
+        );
+    }
+
+    #[test]
+    fn rows_read_every_field_of_an_entity() {
+        let read = rows(
+            "12,3,2,4,3078201489,412.6,-1208.3,32.1,4,0,7,2,1;\
+             65535,2147483647,1,0,0,-0.0,0.0,-12.5,-1,-7,0,0,2;\
+             7,1,3,0,4294967295,1.0,2.0,3.0,0,5,10,1,0",
+            2,
+        );
+
+        assert_eq!(
+            read,
+            [
+                EntityRow {
+                    net_id: 12,
+                    serial: 3,
+                    kind: EntityKind::Vehicle,
+                    class: Some(VehicleClass::Helicopter),
+                    model: 3_078_201_489,
+                    x: 412.6,
+                    y: -1208.3,
+                    z: 32.1,
+                    owner: Some(4),
+                    bucket: 0,
+                    population: 7,
+                    resource: 2,
+                    resource_pending: false,
+                    occupied: true,
+                },
+                EntityRow {
+                    net_id: 65535,
+                    serial: 2_147_483_647,
+                    kind: EntityKind::Ped,
+                    class: None,
+                    model: 0,
+                    x: -0.0,
+                    y: 0.0,
+                    z: -12.5,
+                    owner: None,
+                    bucket: -7,
+                    population: 0,
+                    resource: 0,
+                    resource_pending: true,
+                    occupied: false,
+                },
+                EntityRow {
+                    net_id: 7,
+                    serial: 1,
+                    kind: EntityKind::Object,
+                    class: None,
+                    model: u32::MAX,
+                    x: 1.0,
+                    y: 2.0,
+                    z: 3.0,
+                    owner: None,
+                    bucket: 5,
+                    population: 10,
+                    resource: 1,
+                    resource_pending: false,
+                    occupied: false,
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn a_row_outside_its_ranges_is_left_out_alone() {
+        let good = "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0";
+        for bad in [
+            "",
+            "12,3,2,1",
+            "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0,9",
+            "0,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+            "65536,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+            "12,0,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+            "12,3,4,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+            // A vehicle without a class, and a ped with one.
+            "12,3,2,0,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+            "12,3,1,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+            "12,3,2,10,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+            "12,3,2,1,4294967296,412.6,-1208.3,32.1,4,0,7,1,0",
+            "12,3,2,1,-1,412.6,-1208.3,32.1,4,0,7,1,0",
+            "12,3,2,1,3078201489,inf,-1208.3,32.1,4,0,7,1,0",
+            "12,3,2,1,3078201489,nan,-1208.3,32.1,4,0,7,1,0",
+            "12,3,2,1,3078201489,412.6,1e9,32.1,4,0,7,1,0",
+            "12,3,2,1,3078201489,412.6,-1208.3,,4,0,7,1,0",
+            "12,3,2,1,3078201489,412.6,-1208.3,32.1,-2,0,7,1,0",
+            "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,2147483648,7,1,0",
+            "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,11,1,0",
+            // A resource the sweep does not list.
+            "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,2,0",
+            "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,4",
+            "12,3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,x",
+            "12, 3,2,1,3078201489,412.6,-1208.3,32.1,4,0,7,1,0",
+        ] {
+            let read = rows(&format!("{bad};{good}"), 1);
+
+            assert_eq!(read.len(), 1, "{bad:?}");
+            assert_eq!(read[0].net_id, 12);
+        }
+    }
+
+    #[test]
+    fn rows_stop_at_what_the_bridge_may_list() {
+        let row = "12,3,3,0,1,1.0,2.0,3.0,-1,0,0,0,0";
+        let part = vec![row; 600].join(";");
+        let mut out = Vec::new();
+
+        for _ in 0..40 {
+            read_rows(&part, 0, &mut out);
+        }
+
+        assert_eq!(out.len(), MAX_ROWS);
+    }
+
+    #[test]
+    fn a_deletion_is_answered_entity_by_entity() {
+        let reply = report(
+            BRIDGE,
+            json!({
+                "type": "observer", "kind": "entitiesDeleted", "request": 9,
+                "outcomes": [
+                    [12, "deleted"], [13, "occupied"], [14, "vanished"], [15, "unanswered"],
+                    [0, "deleted"], ["16", "deleted"], [17],
+                ],
+            }),
+        );
+
+        assert_eq!(
+            reply,
+            Some(EntityReportKind::Deleted(DeleteReply {
+                request: 9,
+                outcomes: vec![
+                    (12, EntityOutcome::Deleted),
+                    (13, EntityOutcome::Occupied),
+                    (14, EntityOutcome::Error),
+                    (15, EntityOutcome::Error),
+                    (17, EntityOutcome::Error),
+                ],
+            }))
+        );
+        assert_eq!(
+            report(
+                BRIDGE,
+                json!({ "type": "observer", "kind": "entitiesDeleted", "outcomes": [[12, "deleted"]] })
+            ),
+            None
+        );
+    }
+
+    #[test]
+    fn only_the_bridge_of_this_start_reports_entities() {
+        let sweep = json!({
+            "type": "observer", "kind": "entities", "epoch": 1, "seq": 1, "part": 1, "last": true, "rows": "",
+        });
+        let deleted = json!({ "type": "observer", "kind": "entitiesDeleted", "request": 1, "outcomes": [] });
+
+        assert!(report(BRIDGE, sweep.clone()).is_some());
+        assert!(report(BRIDGE, deleted.clone()).is_some());
+        for impostor in ["mischief", "observer", "sys_aaaaaaaaaaaa"] {
+            assert_eq!(report(impostor, sweep.clone()), None, "{impostor}");
+            assert_eq!(report(impostor, deleted.clone()), None, "{impostor}");
+        }
+        assert_eq!(report(BRIDGE, json!({ "type": "observer", "kind": "hb" })), None);
+    }
+}
diff --git a/crates/observer-fxserver/src/lib.rs b/crates/observer-fxserver/src/lib.rs
index 599da905..a810033f 100644
--- a/crates/observer-fxserver/src/lib.rs
+++ b/crates/observer-fxserver/src/lib.rs
@@ -7,6 +7,7 @@ pub mod changes;
 pub mod command;
 pub mod console;
 pub mod crashes;
+pub mod entities;
 pub mod exit;
 pub mod folders;
 pub mod health;
diff --git a/crates/observer-fxserver/src/players.rs b/crates/observer-fxserver/src/players.rs
index a2f10bf4..0c74614e 100644
--- a/crates/observer-fxserver/src/players.rs
+++ b/crates/observer-fxserver/src/players.rs
@@ -25,7 +25,7 @@ const MAX_TEXT_BYTES: usize = 4096;
 /// The bridge sends at most 100 players a page.
 const MAX_PAGE: usize = 200;
 /// Past any map: a position beyond is not one the game holds.
-const MAX_COORDINATE: f64 = 100_000.0;
+pub(crate) const MAX_COORDINATE: f64 = 100_000.0;
 
 /// A report and when Observer received it.
 #[derive(Debug, Clone, PartialEq)]
diff --git a/crates/observer-fxserver/src/stdin.rs b/crates/observer-fxserver/src/stdin.rs
index 82b68b1d..48c64828 100644
--- a/crates/observer-fxserver/src/stdin.rs
+++ b/crates/observer-fxserver/src/stdin.rs
@@ -65,12 +65,14 @@ impl SystemLine {
         match self {
             Self::Quit(_) => Some(self.render()),
             Self::Bridge(event) => Some(format!("observer_cmd {}", event.name())),
-            // Verdicts come one per connection and positions every few seconds: the console would
-            // fill with them.
+            // Verdicts come one per connection, and the asks for positions and entities every few
+            // seconds: the console would fill with them.
             Self::SetPerfUser
             | Self::SetPerfPassword(_)
             | Self::SetPlayersToken(_)
-            | Self::Action(BridgeAction::Verdict { .. } | BridgeAction::Positions { .. }) => None,
+            | Self::Action(
+                BridgeAction::Verdict { .. } | BridgeAction::Positions { .. } | BridgeAction::Entities { .. },
+            ) => None,
             Self::Action(action) => Some(format!("observer_cmd {}", action.name())),
         }
     }
diff --git a/crates/observer-fxserver/src/supervisor.rs b/crates/observer-fxserver/src/supervisor.rs
index c8b1982c..58ef461c 100644
--- a/crates/observer-fxserver/src/supervisor.rs
+++ b/crates/observer-fxserver/src/supervisor.rs
@@ -28,6 +28,7 @@ use crate::bridge::{self, BridgeAction, BridgeEvent, Report, StopReason};
 use crate::cfg;
 use crate::console::{ConsoleHub, LineAssembler, LineFlags, LineKind, on_channel, plain, sanitize};
 use crate::crashes::{self, Collected, DumpLimits, HangSnapshotLimits, SnapshotFailure};
+use crate::entities::{EntityReport, EntityReportKind};
 use crate::exit;
 use crate::health::{self, HangCause, Health, HealthLimits, PlayerList, Players, Probe, Problem, Verdict};
 use crate::hook;
@@ -62,6 +63,8 @@ const PROCESS_EVENTS: usize = 1024;
 const PLAYER_REPORTS: usize = 8192;
 /// Every resource of a server that counts reports each second it had something to count.
 const HOOK_REPORTS: usize = 8192;
+/// A sweep of the entities comes in a few dozen parts.
+const ENTITY_REPORTS: usize = 256;
 /// How often the tree's members are compared with what its notifications said.
 const RECONCILE_EVERY: Duration = Duration::from_secs(5);
 /// A member younger than this is the notifications' to report: a fork may not have run its program
@@ -540,6 +543,7 @@ pub struct Supervisor {
     events: broadcast::Sender<Event>,
     processes: broadcast::Sender<TreeEvent>,
     players: broadcast::Sender<PlayerReport>,
+    entities: broadcast::Sender<EntityReport>,
     counts: broadcast::Sender<HookReport>,
     status: watch::Receiver<Status>,
     readings: watch::Receiver<Readings>,
@@ -553,6 +557,7 @@ impl Supervisor {
         let events = broadcast::channel(EVENTS).0;
         let processes = broadcast::channel(PROCESS_EVENTS).0;
         let players = broadcast::channel(PLAYER_REPORTS).0;
+        let entities = broadcast::channel(ENTITY_REPORTS).0;
         let counts = broadcast::channel(HOOK_REPORTS).0;
         let initial = Status {
             state: State::Stopped,
@@ -586,6 +591,7 @@ impl Supervisor {
             events: events.clone(),
             processes: processes.clone(),
             players: players.clone(),
+            entities: entities.clone(),
             status: status_tx,
             readings: readings_tx,
             requests: requests_rx,
@@ -619,6 +625,7 @@ impl Supervisor {
                 events,
                 processes,
                 players,
+                entities,
                 counts,
                 status,
                 readings,
@@ -757,6 +764,12 @@ impl Supervisor {
         self.players.subscribe()
     }
 
+    /// What the bridge reports about the server's entities, while Observer asks for them: the
+    /// parts of each sweep, and the answers to deletions.
+    pub fn entity_reports(&self) -> broadcast::Receiver<EntityReport> {
+        self.entities.subscribe()
+    }
+
     /// What the resources of a start that counts report, each second. Off the event bus too:
     /// there are hundreds a second.
     pub fn hook_reports(&self) -> broadcast::Receiver<HookReport> {
@@ -1018,6 +1031,7 @@ struct Actor {
     events: broadcast::Sender<Event>,
     processes: broadcast::Sender<TreeEvent>,
     players: broadcast::Sender<PlayerReport>,
+    entities: broadcast::Sender<EntityReport>,
     counts: broadcast::Sender<HookReport>,
     status: watch::Sender<Status>,
     readings: watch::Sender<Readings>,
@@ -1776,6 +1790,13 @@ impl Actor {
             });
             return;
         }
+        if let Some(kind) = EntityReportKind::from_trace(&trace.kind, &run.bridge) {
+            let _ = self.entities.send(EntityReport {
+                generation: trace.generation,
+                kind,
+            });
+            return;
+        }
         let event = match Report::from_trace(&trace.kind, &run.bridge) {
             Some(Report::Ready { .. } | Report::Heartbeat) => {
                 run.health.heartbeat(Instant::now());
diff --git a/crates/observer-store/src/entities.rs b/crates/observer-store/src/entities.rs
new file mode 100644
index 00000000..b7cfb524
--- /dev/null
+++ b/crates/observer-store/src/entities.rs
@@ -0,0 +1,39 @@
+//! The entities' settings. The entities themselves are never stored.
+
+use observer_domain::entities::EntitiesSettings;
+use rusqlite::Connection;
+
+use crate::database::StoreError;
+use crate::settings;
+
+const SETTINGS: &str = "entities.settings";
+
+pub fn settings(conn: &Connection) -> Result<EntitiesSettings, StoreError> {
+    Ok(settings::get(conn, SETTINGS)?
+        .and_then(|text| serde_json::from_str::<EntitiesSettings>(&text).ok())
+        // A value edited by hand that the panel could not have saved falls back to the default.
+        .filter(EntitiesSettings::is_valid)
+        .unwrap_or_default())
+}
+
+pub fn save_settings(conn: &Connection, saved: &EntitiesSettings) -> Result<(), StoreError> {
+    let text = serde_json::to_string(saved).expect("numbers always serialise");
+    settings::set(conn, SETTINGS, &text)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::database::memory;
+
+    #[test]
+    fn settings_come_back_as_saved_and_fall_back_to_the_default() {
+        let conn = memory();
+
+        assert_eq!(settings(&conn).unwrap(), EntitiesSettings::default());
+        save_settings(&conn, &EntitiesSettings { every_seconds: 30 }).unwrap();
+        assert_eq!(settings(&conn).unwrap(), EntitiesSettings { every_seconds: 30 });
+        settings::set(&conn, SETTINGS, r#"{"everySeconds":7}"#).unwrap();
+        assert_eq!(settings(&conn).unwrap(), EntitiesSettings::default());
+    }
+}
diff --git a/crates/observer-store/src/lib.rs b/crates/observer-store/src/lib.rs
index 46153aec..8b6ff4f0 100644
--- a/crates/observer-store/src/lib.rs
+++ b/crates/observer-store/src/lib.rs
@@ -12,6 +12,7 @@ pub mod changes;
 mod database;
 pub mod debug;
 pub mod diagnostics;
+pub mod entities;
 pub mod features;
 pub mod files;
 pub mod launch;
diff --git a/crates/observer-web/src/api.rs b/crates/observer-web/src/api.rs
index 290a580f..45c34916 100644
--- a/crates/observer-web/src/api.rs
+++ b/crates/observer-web/src/api.rs
@@ -14,6 +14,7 @@ mod changes;
 mod debug;
 mod diagnostics;
 mod drops;
+mod entities;
 mod features;
 mod files;
 mod map;
@@ -108,6 +109,13 @@ pub(crate) fn routes() -> Vec<Route> {
     let map = Permission(P::PLAYERS_MAP);
     let map_image = ReauthenticatedOwner;
     let change_map = Reauthenticated(P::SETTINGS_MANAGE);
+    // The server's entities are seen under one permission and deleted under another. Who owns
+    // one is told only to who also sees the live map, which the service checks. How often the
+    // server lists them is a setting.
+    let entities = Permission(P::ENTITIES_VIEW);
+    let delete_entities = Permission(P::ENTITIES_DELETE);
+    let read_entities_settings = Permission(P::SETTINGS_VIEW);
+    let change_entities = Reauthenticated(P::SETTINGS_MANAGE);
     // Statistics name nobody; the log, its export and reason groups are `PLAYERS_VIEW`'s.
     let drops = Permission(P::DROPS_VIEW);
     // What changed between starts: the history for its permission, the contents behind the critical
@@ -241,6 +249,11 @@ pub(crate) fn routes() -> Vec<Route> {
         route(M::GET,    "/servers/default/players/map/image",     map,        map::image),
         route(M::PUT,    "/servers/default/players/map/image",     map_image,  map::set_image),
         route(M::DELETE, "/servers/default/players/map/image",     map_image,  map::remove_image),
+        route(M::GET,    "/servers/default/entities",          entities,               entities::page),
+        route(M::GET,    "/servers/default/entities/map",      entities,               entities::map),
+        route(M::POST,   "/servers/default/entities/delete",   delete_entities,        entities::delete),
+        route(M::GET,    "/servers/default/entities/settings", read_entities_settings, entities::settings),
+        route(M::PUT,    "/servers/default/entities/settings", change_entities,        entities::change_settings),
         route(M::GET,    "/servers/default/players/{id}",      players, players::profile),
         route(M::GET,    "/servers/default/players/{id}/bans", bans,    bans::of_player),
         route(M::GET,    "/servers/default/bans",              bans,    bans::page),
diff --git a/crates/observer-web/src/api/entities.rs b/crates/observer-web/src/api/entities.rs
new file mode 100644
index 00000000..e7bd4231
--- /dev/null
+++ b/crates/observer-web/src/api/entities.rs
@@ -0,0 +1,130 @@
+//! The server's entities: a page of the list, the entities the map draws, a deletion, and how
+//! often the server lists them. The state of the list comes over the websocket, and following it
+//! there is what keeps the server listing.
+
+use axum::extract::State;
+use axum::{Extension, Json};
+use observer_app::Caller;
+use observer_domain::entities::{
+    DEFAULT_CELL, EntitiesSettings, EntityDeleteRequest, EntityDeletion, EntityFilterQuery, EntityFilters,
+    EntityMap, EntityPage, EntitySort,
+};
+use observer_domain::error::ErrorCode;
+use observer_domain::map::MapBounds;
+use serde::Deserialize;
+
+use crate::AppState;
+use crate::error::Failure;
+use crate::extract::{JsonBody, QueryParams};
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct PageQuery {
+    kinds: Option<String>,
+    class: Option<String>,
+    resource: Option<String>,
+    owner: Option<String>,
+    bucket: Option<i32>,
+    search: Option<String>,
+    #[serde(default)]
+    sort: EntitySort,
+    #[serde(default)]
+    descending: bool,
+    #[serde(default)]
+    page: u32,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct MapQuery {
+    kinds: Option<String>,
+    class: Option<String>,
+    resource: Option<String>,
+    owner: Option<String>,
+    bucket: Option<i32>,
+    search: Option<String>,
+    /// The side of a density cell, should the entities be too many to draw each.
+    cell: Option<u32>,
+    /// The part of the map the panel shows, in game units: all four, or none for the whole map.
+    west: Option<f64>,
+    east: Option<f64>,
+    south: Option<f64>,
+    north: Option<f64>,
+}
+
+/// The filters a query names; one that names nothing is `invalid_request`.
+fn filters(query: &EntityFilterQuery) -> Result<EntityFilters, Failure> {
+    EntityFilters::parse(query).ok_or_else(|| ErrorCode::InvalidRequest.into())
+}
+
+pub(crate) async fn page(
+    State(state): State<AppState>,
+    Extension(caller): Extension<Caller>,
+    QueryParams(query): QueryParams<PageQuery>,
+) -> Result<Json<EntityPage>, Failure> {
+    let kept = filters(&EntityFilterQuery {
+        kinds: query.kinds,
+        class: query.class,
+        resource: query.resource,
+        owner: query.owner,
+        bucket: query.bucket,
+        search: query.search,
+    })?;
+    let page = state
+        .entities()?
+        .page(&caller, &kept, query.sort, query.descending, query.page)
+        .await?;
+    Ok(Json(page))
+}
+
+pub(crate) async fn map(
+    State(state): State<AppState>,
+    Extension(caller): Extension<Caller>,
+    QueryParams(query): QueryParams<MapQuery>,
+) -> Result<Json<EntityMap>, Failure> {
+    let kept = filters(&EntityFilterQuery {
+        kinds: query.kinds,
+        class: query.class,
+        resource: query.resource,
+        owner: query.owner,
+        bucket: query.bucket,
+        search: query.search,
+    })?;
+    let bounds = match (query.west, query.east, query.south, query.north) {
+        (None, None, None, None) => None,
+        (Some(west), Some(east), Some(south), Some(north)) => Some(MapBounds {
+            west,
+            east,
+            south,
+            north,
+        }),
+        _ => return Err(ErrorCode::InvalidRequest.into()),
+    };
+    let map = state
+        .entities()?
+        .map(&caller, &kept, query.cell.unwrap_or(DEFAULT_CELL), bounds)
+        .await?;
+    Ok(Json(map))
+}
+
+pub(crate) async fn delete(
+    State(state): State<AppState>,
+    Extension(caller): Extension<Caller>,
+    JsonBody(request): JsonBody<EntityDeleteRequest>,
+) -> Result<Json<EntityDeletion>, Failure> {
+    Ok(Json(state.entities()?.delete(&caller, request).await?))
+}
+
+pub(crate) async fn settings(State(state): State<AppState>) -> Result<Json<EntitiesSettings>, Failure> {
+    Ok(Json(state.entities()?.settings().await?))
+}
+
+pub(crate) async fn change_settings(
+    State(state): State<AppState>,
+    Extension(caller): Extension<Caller>,
+    JsonBody(settings): JsonBody<EntitiesSettings>,
+) -> Result<Json<EntitiesSettings>, Failure> {
+    let entities = state.entities()?;
+    entities.change_settings(&caller, settings).await?;
+    Ok(Json(entities.settings().await?))
+}
diff --git a/crates/observer-web/src/error.rs b/crates/observer-web/src/error.rs
index b82d44f5..bd48d15f 100644
--- a/crates/observer-web/src/error.rs
+++ b/crates/observer-web/src/error.rs
@@ -82,6 +82,10 @@ fn status(code: ErrorCode) -> StatusCode {
         | ErrorCode::ServerNotRunning
         | ErrorCode::ServerStopping
         | ErrorCode::ServerNotStarting
+        | ErrorCode::EntitiesNotListed
+        | ErrorCode::EntitiesChanged
+        | ErrorCode::EntitiesOutOfDate
+        | ErrorCode::EntitiesDeleting
         | ErrorCode::CfgNotEditable
         | ErrorCode::CfgChanged
         | ErrorCode::NothingToSkip
@@ -152,6 +156,8 @@ fn status(code: ErrorCode) -> StatusCode {
         | ErrorCode::InvalidBan
         | ErrorCode::InvalidBansSettings
         | ErrorCode::InvalidMapSettings
+        | ErrorCode::TooManyEntities
+        | ErrorCode::InvalidEntitiesSettings
         | ErrorCode::InvalidBackupSettings
         | ErrorCode::InvalidBackupDestination => StatusCode::BAD_REQUEST,
         ErrorCode::TooManyAttempts
diff --git a/crates/observer-web/src/lib.rs b/crates/observer-web/src/lib.rs
index f22a1c0c..ded94f5a 100644
--- a/crates/observer-web/src/lib.rs
+++ b/crates/observer-web/src/lib.rs
@@ -20,8 +20,8 @@ use std::sync::Arc;
 use axum::extract::Request;
 use axum::{Router, middleware};
 use observer_app::{
-    Accounts, Artifacts, AuditLog, Backups, Bans, Changes, DebugCounts, Diagnostics, Drops, Error, Features,
-    Files, LiveMap, Metrics, Players, Schedule, Servers, Statistics, Supervision, Tools, Updates,
+    Accounts, Artifacts, AuditLog, Backups, Bans, Changes, DebugCounts, Diagnostics, Drops, Entities, Error,
+    Features, Files, LiveMap, Metrics, Players, Schedule, Servers, Statistics, Supervision, Tools, Updates,
 };
 use observer_domain::about::Build;
 use observer_domain::features::Feature;
@@ -58,6 +58,7 @@ pub struct AppState {
     metrics: Option<Metrics>,
     players: Option<Players>,
     map: Option<LiveMap>,
+    entities: Option<Entities>,
     drops: Option<Drops>,
     changes: Option<Changes>,
     updates: Option<Updates>,
@@ -98,6 +99,7 @@ pub struct Services {
     pub metrics: Option<Metrics>,
     pub players: Option<Players>,
     pub map: Option<LiveMap>,
+    pub entities: Option<Entities>,
     pub drops: Option<Drops>,
     pub changes: Option<Changes>,
     pub updates: Option<Updates>,
@@ -129,6 +131,7 @@ impl AppState {
             metrics,
             players,
             map,
+            entities,
             drops,
             changes,
             updates,
@@ -152,6 +155,7 @@ impl AppState {
             metrics,
             players,
             map,
+            entities,
             drops,
             changes,
             updates,
@@ -193,6 +197,12 @@ impl AppState {
             .ok_or_else(|| self.features.refusal(Feature::Players))
     }
 
+    pub(crate) fn entities(&self) -> Result<&Entities, Error> {
+        self.entities
+            .as_ref()
+            .ok_or_else(|| self.features.refusal(Feature::Entities))
+    }
+
     pub(crate) fn drops(&self) -> Result<&Drops, Error> {
         self.drops
             .as_ref()
diff --git a/crates/observer-web/src/live/topics.rs b/crates/observer-web/src/live/topics.rs
index f0be265d..25cd2bd3 100644
--- a/crates/observer-web/src/live/topics.rs
+++ b/crates/observer-web/src/live/topics.rs
@@ -58,6 +58,7 @@ pub(super) fn allows(topic: Topic, held: Permissions) -> bool {
         Topic::ServerDiagnostics => any(&[Permissions::DIAGNOSTICS_VIEW]),
         Topic::ServerChanges => any(&[Permissions::CHANGES_VIEW]),
         Topic::ServerMap => any(&[Permissions::PLAYERS_MAP]),
+        Topic::ServerEntities => any(&[Permissions::ENTITIES_VIEW]),
     }
 }
 
@@ -147,6 +148,13 @@ pub(super) async fn open(topic: Topic, since: Option<u64>, state: &AppState) ->
                 events: Some(watched_events(live, watching, TopicEvent::ServerMap)),
             })
         }
+        Topic::ServerEntities => {
+            let (snapshot, live, watching) = state.entities()?.watch();
+            Ok(Feed {
+                snapshot: TopicSnapshot::ServerEntities(snapshot),
+                events: Some(watched_events(live, watching, TopicEvent::ServerEntities)),
+            })
+        }
         Topic::ServerChanges => {
             let mut live = state.changes()?.live();
             let snapshot = live.borrow_and_update().clone();
diff --git a/crates/observer-web/src/tests.rs b/crates/observer-web/src/tests.rs
index ad0b75d0..63be2b7e 100644
--- a/crates/observer-web/src/tests.rs
+++ b/crates/observer-web/src/tests.rs
@@ -9,6 +9,7 @@ mod changes;
 mod debug;
 mod diagnostics;
 mod drops;
+mod entities;
 mod features;
 mod files;
 mod live;
@@ -35,10 +36,10 @@ use jiff::SignedDuration;
 use observer_app::{
     Accounts, Artifacts, ArtifactsSetup, ArtifactsTask, AuditLog, Backups, BackupsSetup, BackupsTask, Bans,
     BansSetup, BansTask, Changes, ChangesSetup, ChangesTask, Clock, Diagnostics, DiagnosticsSetup,
-    DiagnosticsTask, Drops, DropsSetup, DropsTask, Features, FeaturesSetup, LiveMap, MapSetup, MapTask,
-    Metrics, MetricsSetup, OwnPaths, PasswordCost, Players, PlayersSetup, PlayersTask, Running, Schedule,
-    ScheduleSetup, ScheduleTask, Servers, Setup, Statistics, Supervision, Tools, ToolsSetup, Updates,
-    UpdatesSetup, UpdatesTask,
+    DiagnosticsTask, Drops, DropsSetup, DropsTask, Entities, EntitiesSetup, EntitiesTask, Features,
+    FeaturesSetup, LiveMap, MapSetup, MapTask, Metrics, MetricsSetup, OwnPaths, PasswordCost, Players,
+    PlayersSetup, PlayersTask, Running, Schedule, ScheduleSetup, ScheduleTask, Servers, Setup, Statistics,
+    Supervision, Tools, ToolsSetup, Updates, UpdatesSetup, UpdatesTask,
 };
 use observer_artifacts::Http;
 use observer_artifacts::catalog::{Catalog, Listing};
@@ -83,6 +84,7 @@ struct Server {
     _banning: BansTask,
     _debugging: observer_app::DebugTask,
     _mapping: MapTask,
+    _listing: EntitiesTask,
     _following: ChangesTask,
     _backing_up: BackupsTask,
     _updating: UpdatesTask,
@@ -262,6 +264,12 @@ impl Server {
             players: players.clone(),
             data_dir: dir.path().join("data"),
         });
+        let (entities, listing) = Entities::start(EntitiesSetup {
+            db: db.clone(),
+            clock: clock.clone(),
+            supervision: supervision.clone(),
+            players: Some(players.clone()),
+        });
         let (bans, banning) = Bans::start(BansSetup {
             db: db.clone(),
             clock: clock.clone(),
@@ -339,8 +347,9 @@ impl Server {
             debug,
             diagnostics: Some(diagnostics),
             metrics: Some(metrics.clone()),
-            players: Some(players),
+            players: Some(players.clone()),
             map: Some(map),
+            entities: Some(entities),
             drops: Some(drops),
             changes: Some(changes),
             updates: Some(updates),
@@ -381,6 +390,7 @@ impl Server {
             _banning: banning,
             _debugging: debugging,
             _mapping: mapping,
+            _listing: listing,
             _following: following,
             _backing_up: backing_up,
             _updating: updating,
@@ -708,7 +718,7 @@ async fn setup_signs_the_owner_in_with_a_strict_http_only_cookie() {
     assert_eq!(session["sessionKey"].as_str().unwrap().len(), 64);
     assert_eq!(session["me"]["username"], "ada");
     assert_eq!(session["me"]["isOwner"], true);
-    assert_eq!(session["me"]["permissions"], "3ffffff");
+    assert_eq!(session["me"]["permissions"], "fffffff");
 
     let again = server.call(Method::POST, "/api/setup", None, Some(body)).await;
     assert_eq!(again.status, StatusCode::CONFLICT);
diff --git a/crates/observer-web/src/tests/entities.rs b/crates/observer-web/src/tests/entities.rs
new file mode 100644
index 00000000..338192e7
--- /dev/null
+++ b/crates/observer-web/src/tests/entities.rs
@@ -0,0 +1,265 @@
+//! The server's entities over HTTP: who reads the list, who deletes from it, what a filter that
+//! names nothing gets, the cadence as a setting, and the topic that keeps the server listing.
+
+use axum::http::{Method, StatusCode};
+use serde_json::json;
+
+use super::live::{receive, send};
+use super::{OWNER_PASSWORD, Server};
+
+const DASHBOARD_VIEW: &str = "1";
+const ENTITIES_VIEW: &str = "4000000";
+const ENTITIES_DELETE: &str = "8000000";
+const SETTINGS_VIEW: &str = "200";
+const SETTINGS_MANAGE: &str = "600";
+const ENTITIES: &str = "/api/servers/default/entities";
+
+fn deletion() -> serde_json::Value {
+    json!({ "run": "1-4210", "targets": [{ "netId": 12, "serial": 3, "model": 7 }] })
+}
+
+#[tokio::test]
+async fn the_entities_are_read_under_one_permission_and_deleted_under_another() {
+    let server = Server::new().await;
+    let owner = server.owner().await;
+    let nobody = server.member(&owner, "alan", DASHBOARD_VIEW).await;
+    let reader = server.member(&owner, "grace", ENTITIES_VIEW).await;
+    let cleaner = server.member(&owner, "hopper", ENTITIES_DELETE).await;
+    let delete = format!("{ENTITIES}/delete");
+
+    let refused = server.call(Method::GET, ENTITIES, Some(&nobody), None).await;
+    let page = server.call(Method::GET, ENTITIES, Some(&reader), None).await;
+    let map = server
+        .call(
+            Method::GET,
+            &format!("{ENTITIES}/map?kinds=vehicle&cell=500"),
+            Some(&reader),
+            None,
+        )
+        .await;
+    let by_reader = server
+        .call(Method::POST, &delete, Some(&reader), Some(deletion()))
+        .await;
+    let by_cleaner = server
+        .call(Method::POST, &delete, Some(&cleaner), Some(deletion()))
+        .await;
+    let read_by_cleaner = server.call(Method::GET, ENTITIES, Some(&cleaner), None).await;
+
+    assert_eq!(refused.status, StatusCode::FORBIDDEN, "{}", refused.text);
+    assert_eq!(page.status, StatusCode::OK, "{}", page.text);
+    let page = page.json();
+    assert_eq!(page["items"], json!([]));
+    assert_eq!(
+        (&page["live"]["run"], &page["live"]["at"]),
+        (&json!(null), &json!(null))
+    );
+    assert_eq!(page["ownersShown"], false);
+    assert_eq!(
+        page["limits"],
+        json!({
+            "pageSize": 100, "maxDelete": 100, "typedConfirmationFrom": 20, "maxMapPoints": 5000,
+            "staleSweeps": 3,
+        })
+    );
+    assert_eq!(map.status, StatusCode::OK, "{}", map.text);
+    assert_eq!(
+        (&map.json()["points"], &map.json()["cell"]),
+        (&json!([]), &json!(null))
+    );
+    assert_eq!(by_reader.status, StatusCode::FORBIDDEN, "{}", by_reader.text);
+    // Nobody follows the list here, so the server lists nothing to delete from.
+    assert_eq!(by_cleaner.status, StatusCode::CONFLICT, "{}", by_cleaner.text);
+    assert_eq!(by_cleaner.code(), "entities_not_listed");
+    assert_eq!(
+        read_by_cleaner.status,
+        StatusCode::OK,
+        "deleting takes seeing with it"
+    );
+    assert_eq!(server.audited("entities_deleted").await.len(), 0);
+}
+
+#[tokio::test]
+async fn a_filter_that_names_nothing_is_refused_rather_than_ignored() {
+    let server = Server::new().await;
+    let owner = server.owner().await;
+
+    for query in [
+        "kinds=hovercraft",
+        "class=tank",
+        "owner=someone",
+        "sort=colour",
+        "page=-1",
+        "bucket=first",
+        "colour=red",
+    ] {
+        let reply = server
+            .call(Method::GET, &format!("{ENTITIES}?{query}"), Some(&owner), None)
+            .await;
+
+        assert_eq!(reply.status, StatusCode::BAD_REQUEST, "{query}: {}", reply.text);
+        assert_eq!(reply.code(), "invalid_request", "{query}");
+    }
+    let odd_cell = server
+        .call(
+            Method::GET,
+            &format!("{ENTITIES}/map?cell=123"),
+            Some(&owner),
+            None,
+        )
+        .await;
+    let half_a_view = server
+        .call(
+            Method::GET,
+            &format!("{ENTITIES}/map?west=0&east=100"),
+            Some(&owner),
+            None,
+        )
+        .await;
+    let a_view = server
+        .call(
+            Method::GET,
+            &format!("{ENTITIES}/map?west=-200.5&east=100&south=-1300&north=-900&cell=25"),
+            Some(&owner),
+            None,
+        )
+        .await;
+    let named = server
+        .call(
+            Method::GET,
+            &format!(
+                "{ENTITIES}?kinds=vehicle,ped&class=car&resource=&owner=none&bucket=0&search=%2312&sort=netId&descending=true&page=2"
+            ),
+            Some(&owner),
+            None,
+        )
+        .await;
+    let too_many = server
+        .call(
+            Method::POST,
+            &format!("{ENTITIES}/delete"),
+            Some(&owner),
+            Some(json!({
+                "run": "1-4210",
+                "targets": vec![json!({ "netId": 12, "serial": 3, "model": 7 }); 101],
+            })),
+        )
+        .await;
+
+    assert_eq!(odd_cell.code(), "invalid_request");
+    assert_eq!(half_a_view.code(), "invalid_request");
+    assert_eq!(a_view.status, StatusCode::OK, "{}", a_view.text);
+    assert_eq!(
+        a_view.json()["kinds"],
+        json!({ "vehicles": 0, "peds": 0, "objects": 0 })
+    );
+    assert_eq!(named.status, StatusCode::OK, "{}", named.text);
+    assert_eq!(named.json()["ownersShown"], true);
+    assert_eq!(too_many.status, StatusCode::BAD_REQUEST, "{}", too_many.text);
+    assert_eq!(
+        too_many.json(),
+        json!({ "code": "too_many_entities", "params": { "max": 100 } })
+    );
+}
+
+#[tokio::test]
+async fn the_cadence_is_a_setting_with_the_settings_permissions() {
+    let server = Server::new().await;
+    let owner = server.owner().await;
+    let reader = server.member(&owner, "grace", ENTITIES_VIEW).await;
+    let viewer = server.member(&owner, "alan", SETTINGS_VIEW).await;
+    let manager = server.member(&owner, "sarah", SETTINGS_MANAGE).await;
+    let path = format!("{ENTITIES}/settings");
+    let every = |seconds: u8| Some(json!({ "everySeconds": seconds }));
+
+    let hidden = server.call(Method::GET, &path, Some(&reader), None).await;
+    let read = server.call(Method::GET, &path, Some(&viewer), None).await;
+    let by_viewer = server.call(Method::PUT, &path, Some(&viewer), every(30)).await;
+    let wrong = server.call(Method::PUT, &path, Some(&manager), every(7)).await;
+    let changed = server.call(Method::PUT, &path, Some(&manager), every(30)).await;
+
+    assert_eq!(hidden.status, StatusCode::FORBIDDEN);
+    assert_eq!(read.json(), json!({ "everySeconds": 15 }));
+    assert_eq!(by_viewer.status, StatusCode::FORBIDDEN);
+    assert_eq!(wrong.code(), "invalid_entities_settings");
+    assert_eq!(changed.status, StatusCode::OK, "{}", changed.text);
+    assert_eq!(changed.json(), json!({ "everySeconds": 30 }));
+    let audited = server.audited("entities_settings_changed").await;
+    assert_eq!(audited.len(), 1);
+    assert_eq!(audited[0]["details"]["from"]["everySeconds"], 15);
+}
+
+#[tokio::test]
+async fn the_list_is_followed_with_its_permission_and_goes_with_its_feature() {
+    let server = Server::new().await;
+    let owner = server.owner().await;
+    let nobody = server.member(&owner, "alan", DASHBOARD_VIEW).await;
+    let subscribe = json!({ "type": "sub", "topic": "server.entities" });
+    let mut refused = server.socket(&nobody).await;
+    let mut socket = server.socket(&owner).await;
+
+    send(&mut refused, subscribe.clone()).await;
+    let forbidden = receive(&mut refused).await;
+    send(&mut socket, subscribe.clone()).await;
+    let snapshot = receive(&mut socket).await;
+    let reauth = server
+        .call(
+            Method::POST,
+            "/api/auth/reauth",
+            Some(&owner),
+            Some(json!({ "password": OWNER_PASSWORD })),
+        )
+        .await;
+    let switched = server
+        .call(
+            Method::PUT,
+            "/api/features/entities",
+            Some(&owner),
+            Some(json!({ "enabled": false })),
+        )
+        .await;
+    let withdrawn = receive(&mut socket).await;
+    let page = server.call(Method::GET, ENTITIES, Some(&owner), None).await;
+    let players = server
+        .call(
+            Method::GET,
+            "/api/servers/default/players/online",
+            Some(&owner),
+            None,
+        )
+        .await;
+
+    assert_eq!(
+        forbidden,
+        json!({ "type": "unsubscribed", "topic": "server.entities", "reason": "forbidden" })
+    );
+    assert_eq!(
+        (&snapshot["type"], &snapshot["topic"]),
+        (&json!("snapshot"), &json!("server.entities"))
+    );
+    assert_eq!(snapshot["data"]["run"], json!(null));
+    assert_eq!(snapshot["data"]["listed"], 0);
+    assert_eq!(reauth.status, StatusCode::NO_CONTENT, "{}", reauth.text);
+    assert_eq!(switched.status, StatusCode::OK, "{}", switched.text);
+    let entities = &switched.json()["features"][9];
+    assert_eq!(entities["feature"], "entities");
+    assert_eq!(
+        (&entities["enabled"], &entities["running"]),
+        (&json!(false), &json!(false))
+    );
+    assert_eq!(entities["reach"]["routes"], json!(["/servers/default/entities"]));
+    assert_eq!(entities["reach"]["topics"], json!(["server.entities"]));
+    assert_eq!(entities["reach"]["serverFolder"], "untouched");
+    assert_eq!(
+        withdrawn,
+        json!({ "type": "unsubscribed", "topic": "server.entities", "reason": "disabled" })
+    );
+    assert_eq!(
+        page.json(),
+        json!({ "code": "feature_disabled", "params": { "feature": "entities" } })
+    );
+    assert_eq!(
+        players.status,
+        StatusCode::OK,
+        "the players go on without the entities"
+    );
+}
diff --git a/crates/observer/src/run.rs b/crates/observer/src/run.rs
index 01414aa6..7946b0ab 100644
--- a/crates/observer/src/run.rs
+++ b/crates/observer/src/run.rs
@@ -9,10 +9,10 @@ use jiff::tz::TimeZone;
 use observer_app::{
     Accounts, Artifacts, ArtifactsSetup, ArtifactsTask, AuditLog, Backups, BackupsHook, BackupsSetup, Bans,
     BansSetup, BeforeSpawn, Changes, ChangesSetup, Clock, DatabaseFiles, DebugCounts, DebugSetup,
-    Diagnostics, DiagnosticsSetup, Drops, DropsSetup, Features, FeaturesSetup, LiveMap, MapSetup, Metrics,
-    MetricsSetup, OwnPaths, PRE_LAUNCH_LIMIT, PasswordCost, Players, PlayersSetup, Running, Schedule,
-    ScheduleSetup, ScheduleTask, Servers, Setup, Sources, Statistics, Supervision, Switched, Takeover, Tools,
-    ToolsHook, ToolsSetup, Updates, UpdatesSetup,
+    Diagnostics, DiagnosticsSetup, Drops, DropsSetup, Entities, EntitiesSetup, Features, FeaturesSetup,
+    LiveMap, MapSetup, Metrics, MetricsSetup, OwnPaths, PRE_LAUNCH_LIMIT, PasswordCost, Players,
+    PlayersSetup, Running, Schedule, ScheduleSetup, ScheduleTask, Servers, Setup, Sources, Statistics,
+    Supervision, Switched, Takeover, Tools, ToolsHook, ToolsSetup, Updates, UpdatesSetup,
 };
 use observer_artifacts::Http;
 use observer_artifacts::catalog::Catalog;
@@ -297,6 +297,19 @@ async fn run_until_stopped(
         }
         None => (None, None),
     };
+    // Nothing of it runs before a panel looks: the bridge lists the entities only then.
+    let (entities, listing) = if features.runs(Feature::Entities) {
+        let (entities, task) = Entities::start(EntitiesSetup {
+            db: db.clone(),
+            clock: clock.clone(),
+            supervision: supervision.clone(),
+            players: players.clone(),
+        });
+        let switched = features.switched(Feature::Entities, move || task.close());
+        (Some(entities), Some(switched))
+    } else {
+        (None, None)
+    };
     // After the players, whose start closes what an earlier Observer left open.
     let (drops, dropping) = match (&metrics, &players) {
         (Some(metrics), Some(players)) if features.runs(Feature::Drops) => {
@@ -399,6 +412,7 @@ async fn run_until_stopped(
         metrics: metrics.clone(),
         players,
         map,
+        entities,
         drops,
         changes,
         updates: updates.clone(),
@@ -512,6 +526,7 @@ async fn run_until_stopped(
     close(diagnosing).await;
     // After the supervision, so that FXServer's stop closes the sessions.
     close(mapping).await;
+    close(listing).await;
     close(playing).await;
     close(dropping).await;
     // After the supervision: the bridge answers no one once FXServer is down.
diff --git a/resource/CONTRACT.md b/resource/CONTRACT.md
index 838679d2..784fdc26 100644
--- a/resource/CONTRACT.md
+++ b/resource/CONTRACT.md
@@ -13,7 +13,11 @@ before every start of FXServer, and ensures before your cfg runs. Observer overw
 to it. It reports the server's health to Observer, turns Observer's commands into server events, and refuses
 banned players. While someone has the panel's live map open, it also reads where each player stands,
 from OneSync, every 1 to 5 seconds, and reports it to Observer; it raises no event for it and stops
-within 30 seconds after the last one closes the map. It has no client script and no UI.
+within 30 seconds after the last one closes the map. In the same way, while someone looks at the
+server's entities in the panel, it lists the vehicles, peds and objects OneSync knows, every 5 to 60
+seconds, a millisecond of the main thread at a time, and deletes the ones the staff picks there: never
+a player's own ped, a vehicle a player sits in or a train. It raises no event for either. It has no
+client script and no UI.
 
 Its name changes with every start of FXServer: Observer draws it at random, so that no script can
 target the bridge by a name known in advance. Read it from the `observer_bridge` convar, which
diff --git a/resource/observer/server.lua b/resource/observer/server.lua
index f355072d..6df03ea4 100644
--- a/resource/observer/server.lua
+++ b/resource/observer/server.lua
@@ -275,6 +275,499 @@ local function followPositions()
     end)
 end
 
+-- The server's vehicles, peds and objects, read from OneSync's entities while someone looks at
+-- them. A sweep hands the frame back as it goes and stops past its budget, and the next ones space
+-- out when one costs too much. Every entity native raises on a handle that names no entity any
+-- more (FiveM's ServerGameState_Scripting.cpp): each is called under pcall, and a sweep that fails
+-- never ends the thread.
+local ENTITIES_EVERY_MIN_MS = 5000
+local ENTITIES_EVERY_MAX_MS = 60000
+local ENTITIES_FOR_MAX_MS = 60000
+-- In microseconds: what a sweep works in one frame before it yields, and in all before it stops.
+local ENTITIES_SLICE_US = 1000
+local ENTITIES_BUDGET_US = 50000
+-- Past either, in all or in the listing natives alone, the next sweeps come twice as far apart.
+local ENTITIES_COSTLY_US = 25000
+local ENTITIES_COSTLY_LIST_US = 10000
+local ENTITIES_ROWS_MAX = 20000
+local ENTITIES_PART_ROWS = 500
+local ENTITIES_PART_BYTES = 65536
+-- GetEntityScript walks every resource: this many lookups a sweep at most, once per entity.
+local ENTITIES_LOOKUPS_MAX = 300
+local ENTITIES_RESOURCES_MAX = 2048
+local ENTITIES_RESOURCE_NAME_MAX = 64
+local ENTITIES_DELETE_MAX = 100
+-- DeleteEntity only queues the removal, on the server's sync thread (ServerGameState.h): what is
+-- still there this much later was not deleted.
+local ENTITIES_DELETE_CHECK_MS = 250
+-- The numbers GetEntityType gives.
+local ENTITY_PED = 1
+local ENTITY_VEHICLE = 2
+local ENTITY_OBJECT = 3
+-- By what GetVehicleType answers; any other vehicle is 9.
+local VEHICLE_CLASSES = {
+    automobile = 1,
+    bike = 2,
+    boat = 3,
+    heli = 4,
+    plane = 5,
+    submarine = 6,
+    trailer = 7,
+    train = 8,
+}
+local VEHICLE_OTHER = 9
+local VEHICLE_TRAIN = 8
+local ENTITY_OCCUPIED = 1
+local ENTITY_RESOURCE_PENDING = 2
+
+-- Which start of the bridge listed an entity: a bridge started again numbers them from 1 again.
+local ENTITIES_EPOCH = GetGameTimer()
+local entitiesEvery = 15000
+local entitiesUntil = 0
+local entitiesFollowing = false
+-- How many times the cadence asked for the sweeps come apart, after costly ones.
+local entitiesSpacing = 1
+local entitiesSeq = 0
+local entitiesSweep = 0
+-- By net id, what never changes of an entity, read when it is first seen, and the serial drawn
+-- for it then: net ids are used again, under another handle (Pool.h numbers each use of a slot).
+local entities = {}
+local entitySerial = 0
+
+-- A clock in microseconds, which the game timer cannot give.
+local entitiesClock = function()
+    return GetGameTimer() * 1000
+end
+if type(os.nanotime) == 'function' then
+    local ok, value = pcall(os.nanotime)
+    if ok and type(value) == 'number' then
+        entitiesClock = function()
+            return os.nanotime() / 1000
+        end
+    end
+end
+
+local function finite(value)
+    return type(value) == 'number' and value == value and value ~= math.huge and value ~= -math.huge
+end
+
+-- A model hash as an unsigned number: the natives give it signed.
+local function unsignedHash(value)
+    if type(value) ~= 'number' then
+        return nil
+    end
+    value = math.floor(value)
+    if value < 0 then
+        value = value + 4294967296
+    end
+    if value < 0 or value > 4294967295 then
+        return nil
+    end
+    return value
+end
+
+-- The players' own peds, never listed nor deleted, and the vehicles a player sits in.
+local function playerEntities()
+    local peds, occupied = {}, {}
+    local ok, players = pcall(GetPlayers)
+    if not ok or type(players) ~= 'table' then
+        return peds, occupied
+    end
+    for index = 1, #players do
+        local okPed, ped = pcall(GetPlayerPed, players[index])
+        if okPed and type(ped) == 'number' and ped ~= 0 then
+            peds[ped] = true
+            local okVehicle, vehicle = pcall(GetVehiclePedIsIn, ped, false)
+            if okVehicle and type(vehicle) == 'number' and vehicle ~= 0 then
+                occupied[vehicle] = true
+            end
+        end
+    end
+    return peds, occupied
+end
+
+local function entityFirstSeen(netId, handle, kind)
+    local model = unsignedHash(GetEntityModel(handle))
+    if not model then
+        return nil
+    end
+    local class = 0
+    if kind == ENTITY_VEHICLE then
+        class = VEHICLE_CLASSES[GetVehicleType(handle)] or VEHICLE_OTHER
+    end
+    local population = GetEntityPopulationType(handle)
+    if type(population) ~= 'number' or population < 0 or population > 10 then
+        population = 0
+    end
+    entitySerial = entitySerial + 1
+    local entity = {
+        handle = handle,
+        serial = entitySerial,
+        kind = kind,
+        class = class,
+        model = model,
+        population = math.floor(population),
+        -- A name, false for none, nil until it is looked up.
+        resource = nil,
+        seen = 0,
+    }
+    entities[netId] = entity
+    return entity
+end
+
+-- One entity as `netId,serial,kind,class,model,x,y,z,owner,bucket,population,resource,flags`, the
+-- resource as its place in the sweep's list of names, 0 for none.
+local function entityRow(handle, kind, sweep)
+    local netId = NetworkGetNetworkIdFromEntity(handle)
+    if type(netId) ~= 'number' or netId <= 0 or netId > 65535 then
+        return nil
+    end
+    local entity = entities[netId]
+    if not entity or entity.handle ~= handle or entity.kind ~= kind then
+        entity = entityFirstSeen(netId, handle, kind)
+        if not entity then
+            return nil
+        end
+    end
+    entity.seen = entitiesSweep
+
+    local coords = GetEntityCoords(handle)
+    local x, y, z = coords.x, coords.y, coords.z
+    if not finite(x) or not finite(y) or not finite(z) then
+        return nil
+    end
+    local owner = NetworkGetEntityOwner(handle)
+    if type(owner) ~= 'number' or owner < 0 then
+        owner = -1
+    end
+    local bucket = GetEntityRoutingBucket(handle)
+    if type(bucket) ~= 'number' then
+        bucket = 0
+    end
+    local flags = 0
+    if kind == ENTITY_VEHICLE and sweep.occupied[handle] then
+        flags = flags + ENTITY_OCCUPIED
+    end
+
+    -- The resource that created it, as the server knew it the first time the entity was seen.
+    if entity.resource == nil and sweep.lookups < ENTITIES_LOOKUPS_MAX then
+        sweep.lookups = sweep.lookups + 1
+        local ok, name = pcall(GetEntityScript, handle)
+        if ok and type(name) == 'string' and #name > 0 and #name <= ENTITIES_RESOURCE_NAME_MAX then
+            entity.resource = name
+        else
+            entity.resource = false
+        end
+    end
+    local resource = 0
+    if entity.resource == nil then
+        flags = flags + ENTITY_RESOURCE_PENDING
+    elseif entity.resource then
+        resource = sweep.places[entity.resource]
+        if not resource then
+            if #sweep.names < ENTITIES_RESOURCES_MAX then
+                sweep.names[#sweep.names + 1] = entity.resource
+                resource = #sweep.names
+                sweep.places[entity.resource] = resource
+            else
+                resource = 0
+            end
+        end
+    end
+
+    return string.format(
+        '%d,%d,%d,%d,%d,%.1f,%.1f,%.1f,%d,%d,%d,%d,%d',
+        netId,
+        entity.serial,
+        kind,
+        entity.class,
+        entity.model,
+        x,
+        y,
+        z,
+        math.floor(owner),
+        math.floor(bucket),
+        entity.population,
+        resource,
+        flags
+    )
+end
+
+-- Why the server has no entity to list: only GTA V's are read, and only OneSync knows them.
+local function entitiesUnavailable()
+    if GetConvar('gamename', 'gta5') ~= 'gta5' then
+        return 'game'
+    end
+    if GetConvar('onesync', 'off') == 'off' or type(GetAllVehicles) ~= 'function' then
+        return 'onesync'
+    end
+end
+
+local function entitiesCadence()
+    return math.min(ENTITIES_EVERY_MAX_MS, entitiesEvery * entitiesSpacing)
+end
+
+local function sweepEntities()
+    entitiesSeq = entitiesSeq % 2147483647 + 1
+    local seq = entitiesSeq
+    local unavailable = entitiesUnavailable()
+    if unavailable then
+        report('entities', {
+            epoch = ENTITIES_EPOCH,
+            seq = seq,
+            -- Never alone on its line: the lines ending in `= true,` are the events of the contract.
+            last = true, part = 1,
+            rows = '',
+            unavailable = unavailable,
+        })
+        return
+    end
+    entitiesSweep = entitiesSweep + 1
+    local worked, frames = 0, 1
+    local slice = entitiesClock()
+    local function yield()
+        worked = worked + (entitiesClock() - slice)
+        frames = frames + 1
+        Wait(0)
+        slice = entitiesClock()
+    end
+    local function spent()
+        return worked + (entitiesClock() - slice)
+    end
+
+    local playerPeds, occupied = playerEntities()
+    local players = 0
+    for _ in pairs(playerPeds) do
+        players = players + 1
+    end
+
+    -- Each of the three takes the lock on the server's entities and makes the handles it lacks:
+    -- one a frame.
+    local lists, counts, listing = {}, {}, 0
+    for _, source in ipairs({
+        { 'vehicles', GetAllVehicles, ENTITY_VEHICLE },
+        { 'objects', GetAllObjects, ENTITY_OBJECT },
+        { 'peds', GetAllPeds, ENTITY_PED },
+    }) do
+        local started = entitiesClock()
+        local ok, list = pcall(source[2])
+        listing = listing + (entitiesClock() - started)
+        if ok and type(list) == 'table' then
+            counts[source[1]] = #list
+            lists[#lists + 1] = { source[3], list }
+        end
+        yield()
+    end
+
+    local sweep = { occupied = occupied, lookups = 0, places = {}, names = {} }
+    local rows, part, bytes, listed, failed = {}, 0, 0, 0, 0
+    local truncated = false
+    for _, each in ipairs(lists) do
+        local kind, list = each[1], each[2]
+        for index = 1, #list do
+            if listed >= ENTITIES_ROWS_MAX or spent() >= ENTITIES_BUDGET_US then
+                truncated = true
+                break
+            end
+            local handle = list[index]
+            if not (kind == ENTITY_PED and playerPeds[handle]) then
+                local ok, row = pcall(entityRow, handle, kind, sweep)
+                if not ok then
+                    failed = failed + 1
+                elseif row then
+                    rows[#rows + 1] = row
+                    listed = listed + 1
+                    bytes = bytes + #row + 1
+                    if #rows >= ENTITIES_PART_ROWS or bytes >= ENTITIES_PART_BYTES then
+                        part = part + 1
+                        report('entities', {
+                            epoch = ENTITIES_EPOCH,
+                            seq = seq,
+                            part = part,
+                            last = false,
+                            rows = table.concat(rows, ';'),
+                        })
+                        rows, bytes = {}, 0
+                    end
+                end
+            end
+            if entitiesClock() - slice >= ENTITIES_SLICE_US then
+                yield()
+            end
+        end
+        if truncated then
+            break
+        end
+    end
+
+    -- A sweep cut short did not see every entity: those it missed keep their serial.
+    if not truncated then
+        for netId, entity in pairs(entities) do
+            if entity.seen ~= entitiesSweep then
+                entities[netId] = nil
+            end
+        end
+    end
+    worked = spent()
+
+    if worked > ENTITIES_COSTLY_US or listing > ENTITIES_COSTLY_LIST_US then
+        entitiesSpacing = math.min(entitiesSpacing * 2, math.ceil(ENTITIES_EVERY_MAX_MS / entitiesEvery))
+    elseif entitiesSpacing > 1 and worked < ENTITIES_COSTLY_US / 2 and listing < ENTITIES_COSTLY_LIST_US / 2 then
+        entitiesSpacing = math.max(1, entitiesSpacing // 2)
+    end
+
+    counts.playerPeds = players
+    report('entities', {
+        epoch = ENTITIES_EPOCH,
+        seq = seq,
+        last = true, part = part + 1,
+        rows = table.concat(rows, ';'),
+        counts = counts,
+        listed = listed,
+        failed = failed,
+        truncated = truncated,
+        workUs = math.floor(worked),
+        listUs = math.floor(listing),
+        frames = frames,
+        everyMs = entitiesCadence(),
+        spaced = entitiesSpacing > 1,
+        resources = sweep.names,
+    })
+end
+
+-- One thread at most, which ends once Observer stopped asking.
+local function followEntities()
+    if entitiesFollowing then
+        return
+    end
+    entitiesFollowing = true
+    CreateThread(function()
+        while GetGameTimer() < entitiesUntil do
+            local started = GetGameTimer()
+            pcall(sweepEntities)
+            -- In steps, so that the thread ends within a second of Observer's last ask running out.
+            local nextAt = started + entitiesCadence()
+            while GetGameTimer() < entitiesUntil and GetGameTimer() < nextAt do
+                Wait(math.max(0, math.min(1000, nextAt - GetGameTimer())))
+            end
+        end
+        entitiesSpacing = 1
+        entitiesFollowing = false
+    end)
+end
+
+local function listEntities(payload)
+    if type(payload.everyMs) ~= 'number' or type(payload.forMs) ~= 'number' then
+        return
+    end
+    entitiesEvery = math.max(ENTITIES_EVERY_MIN_MS, math.min(ENTITIES_EVERY_MAX_MS, math.floor(payload.everyMs)))
+    entitiesUntil = GetGameTimer() + math.max(0, math.min(ENTITIES_FOR_MAX_MS, math.floor(payload.forMs)))
+    followEntities()
+end
+
+-- What becomes of one entity Observer asks to delete, and its handle once the engine was asked.
+-- Never a player's ped, a vehicle a player sits in or a train, and only the entity the last sweep
+-- listed under this net id.
+local function deleteEntity(netId, serial, playerPeds, occupied)
+    local okHandle, handle = pcall(NetworkGetEntityFromNetworkId, netId)
+    if not okHandle or type(handle) ~= 'number' or handle == 0 then
+        return 'gone'
+    end
+    local entity = entities[netId]
+    if not entity or entity.serial ~= serial or entity.handle ~= handle then
+        return 'changed'
+    end
+    local okModel, model = pcall(GetEntityModel, handle)
+    if not okModel then
+        return 'gone'
+    end
+    if unsignedHash(model) ~= entity.model then
+        return 'changed'
+    end
+    if entity.kind == ENTITY_PED then
+        if playerPeds[handle] then
+            return 'player'
+        end
+        local ok, player = pcall(IsPedAPlayer, handle)
+        if not ok then
+            return 'error'
+        end
+        if player then
+            return 'player'
+        end
+    elseif entity.kind == ENTITY_VEHICLE then
+        if occupied[handle] then
+            return 'occupied'
+        end
+        local ok, vehicleType = pcall(GetVehicleType, handle)
+        if not ok then
+            return 'error'
+        end
+        if vehicleType == 'train' or entity.class == VEHICLE_TRAIN then
+            return 'train'
+        end
+    end
+    if not pcall(DeleteEntity, handle) then
+        return 'error'
+    end
+    return 'deleted', handle
+end
+
+local function deleteListed(payload)
+    local request, targets = payload.request, payload.targets
+    if type(request) ~= 'number' or type(payload.deadline) ~= 'number' or type(targets) ~= 'table' then
+        return
+    end
+    -- Net ids and serials, one after the other.
+    local count = #targets // 2
+    if count == 0 or count > ENTITIES_DELETE_MAX or #targets % 2 ~= 0 then
+        return
+    end
+    for index = 1, #targets do
+        if type(targets[index]) ~= 'number' then
+            return
+        end
+    end
+    CreateThread(function()
+        local outcomes, deleted = {}, {}
+        local playerPeds, occupied = playerEntities()
+        local slice = entitiesClock()
+        for index = 1, count do
+            local netId, serial = math.floor(targets[index * 2 - 1]), math.floor(targets[index * 2])
+            local outcome
+            if payload.epoch ~= ENTITIES_EPOCH then
+                outcome = 'changed'
+            elseif os.time() > payload.deadline then
+                -- A server that hitched ran the command late: what is not done yet is not done.
+                outcome = 'late'
+            else
+                local ok, became, handle = pcall(deleteEntity, netId, serial, playerPeds, occupied)
+                outcome = ok and became or 'error'
+                if ok and handle then
+                    deleted[#deleted + 1] = { index, handle, netId }
+                end
+            end
+            outcomes[index] = { netId, outcome }
+            if entitiesClock() - slice >= ENTITIES_SLICE_US then
+                Wait(0)
+                slice = entitiesClock()
+            end
+        end
+        if #deleted > 0 then
+            Wait(ENTITIES_DELETE_CHECK_MS)
+            for _, each in ipairs(deleted) do
+                local ok, exists = pcall(DoesEntityExist, each[2])
+                if ok and exists then
+                    outcomes[each[1]][2] = 'unconfirmed'
+                else
+                    entities[each[3]] = nil
+                end
+            end
+        end
+        report('entitiesDeleted', { request = request, outcomes = outcomes })
+    end)
+end
+
 -- What Observer has the bridge do itself, and nothing else.
 local ACTIONS = {
     verdict = function(payload)
@@ -300,6 +793,12 @@ local ACTIONS = {
         positionsUntil = GetGameTimer() + math.max(0, math.min(POSITIONS_FOR_MAX_MS, math.floor(payload.forMs)))
         followPositions()
     end,
+    entities = function(payload)
+        listEntities(payload)
+    end,
+    deleteEntities = function(payload)
+        deleteListed(payload)
+    end,
 }
 
 AddEventHandler('playerDropped', function(reason, resource, category)
diff --git a/web/src/api/generated/AuditAction.ts b/web/src/api/generated/AuditAction.ts
index 6aaf945a..d93a65b8 100644
--- a/web/src/api/generated/AuditAction.ts
+++ b/web/src/api/generated/AuditAction.ts
@@ -3,4 +3,4 @@
 /**
  * Every action the audit log records. Stored by name, so a variant is never renamed.
  */
-export type AuditAction = "setup_completed" | "setup_link_created" | "login_succeeded" | "login_failed" | "logout" | "session_revoked" | "password_changed" | "user_created" | "user_deleted" | "user_permissions_changed" | "user_password_reset" | "user_unlocked" | "permission_denied" | "audit_exported" | "reauthenticated" | "launch_settings_changed" | "server_started" | "server_stopped" | "server_restarted" | "server_start_extended" | "server_cfg_changed" | "server_cfg_restored" | "console_command_sent" | "console_log_downloaded" | "server_crash_loop" | "schedule_changed" | "scheduled_restart_skipped" | "scheduled_restart_restored" | "scheduled_restart_delayed" | "scheduled_restart_missed" | "one_off_restart_planned" | "one_off_restart_cancelled" | "build_install_started" | "build_install_cancelled" | "build_install_finished" | "build_selected" | "pending_build_set" | "pending_build_cancelled" | "pending_build_applied" | "pending_build_dropped" | "probation_passed" | "probation_failed" | "build_rolled_back" | "build_deleted" | "artifact_settings_changed" | "observer_stopped" | "tree_process_started" | "hang_snapshot_taken" | "crash_file_downloaded" | "crash_files_deleted" | "tree_records_full" | "file_session_opened" | "file_session_closed" | "file_login_failed" | "file_written" | "file_deleted" | "folder_created" | "folder_removed" | "file_renamed" | "file_refused" | "file_records_full" | "file_group_created" | "file_group_changed" | "file_group_deleted" | "file_access_changed" | "service_access_created" | "service_access_changed" | "service_access_deleted" | "file_key_added" | "file_key_removed" | "file_session_disconnected" | "file_settings_changed" | "file_host_key_created" | "player_forgotten" | "players_imported" | "players_retention_changed" | "player_drops_exported" | "player_banned" | "ban_lifted" | "bans_settings_changed" | "map_image_changed" | "map_settings_changed" | "drop_rates_exported" | "drops_retention_changed" | "change_contents_viewed" | "change_settings_changed" | "change_contents_purged" | "change_verify_requested" | "change_check_requested" | "tool_settings_changed" | "tool_files_changed" | "tool_files_restored" | "tool_fix_staged" | "tool_fix_unstaged" | "feature_changed" | "sftp_listen_changed" | "debug_host_known" | "backup_settings_changed" | "backup_destination_created" | "backup_destination_changed" | "backup_destination_deleted" | "backup_finished" | "backup_cancelled" | "backup_downloaded" | "backup_deleted" | "backups_expired" | "statistics_link_dismissed" | "statistics_link_restored" | "observer_update_started" | "observer_update_cancelled" | "observer_update_finished";
+export type AuditAction = "setup_completed" | "setup_link_created" | "login_succeeded" | "login_failed" | "logout" | "session_revoked" | "password_changed" | "user_created" | "user_deleted" | "user_permissions_changed" | "user_password_reset" | "user_unlocked" | "permission_denied" | "audit_exported" | "reauthenticated" | "launch_settings_changed" | "server_started" | "server_stopped" | "server_restarted" | "server_start_extended" | "server_cfg_changed" | "server_cfg_restored" | "console_command_sent" | "console_log_downloaded" | "server_crash_loop" | "schedule_changed" | "scheduled_restart_skipped" | "scheduled_restart_restored" | "scheduled_restart_delayed" | "scheduled_restart_missed" | "one_off_restart_planned" | "one_off_restart_cancelled" | "build_install_started" | "build_install_cancelled" | "build_install_finished" | "build_selected" | "pending_build_set" | "pending_build_cancelled" | "pending_build_applied" | "pending_build_dropped" | "probation_passed" | "probation_failed" | "build_rolled_back" | "build_deleted" | "artifact_settings_changed" | "observer_stopped" | "tree_process_started" | "hang_snapshot_taken" | "crash_file_downloaded" | "crash_files_deleted" | "tree_records_full" | "file_session_opened" | "file_session_closed" | "file_login_failed" | "file_written" | "file_deleted" | "folder_created" | "folder_removed" | "file_renamed" | "file_refused" | "file_records_full" | "file_group_created" | "file_group_changed" | "file_group_deleted" | "file_access_changed" | "service_access_created" | "service_access_changed" | "service_access_deleted" | "file_key_added" | "file_key_removed" | "file_session_disconnected" | "file_settings_changed" | "file_host_key_created" | "player_forgotten" | "players_imported" | "players_retention_changed" | "player_drops_exported" | "player_banned" | "ban_lifted" | "bans_settings_changed" | "map_image_changed" | "map_settings_changed" | "entities_deleted" | "entities_settings_changed" | "drop_rates_exported" | "drops_retention_changed" | "change_contents_viewed" | "change_settings_changed" | "change_contents_purged" | "change_verify_requested" | "change_check_requested" | "tool_settings_changed" | "tool_files_changed" | "tool_files_restored" | "tool_fix_staged" | "tool_fix_unstaged" | "feature_changed" | "sftp_listen_changed" | "debug_host_known" | "backup_settings_changed" | "backup_destination_created" | "backup_destination_changed" | "backup_destination_deleted" | "backup_finished" | "backup_cancelled" | "backup_downloaded" | "backup_deleted" | "backups_expired" | "statistics_link_dismissed" | "statistics_link_restored" | "observer_update_started" | "observer_update_cancelled" | "observer_update_finished";
diff --git a/web/src/api/generated/BucketCount.ts b/web/src/api/generated/BucketCount.ts
new file mode 100644
index 00000000..e3de779c
--- /dev/null
+++ b/web/src/api/generated/BucketCount.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type BucketCount = { bucket: number, count: number, };
diff --git a/web/src/api/generated/ClassCount.ts b/web/src/api/generated/ClassCount.ts
new file mode 100644
index 00000000..a3c92f23
--- /dev/null
+++ b/web/src/api/generated/ClassCount.ts
@@ -0,0 +1,4 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { VehicleClass } from "./VehicleClass";
+
+export type ClassCount = { class: VehicleClass, count: number, };
diff --git a/web/src/api/generated/EntitiesLive.ts b/web/src/api/generated/EntitiesLive.ts
new file mode 100644
index 00000000..12df09cf
--- /dev/null
+++ b/web/src/api/generated/EntitiesLive.ts
@@ -0,0 +1,51 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntitiesUnavailable } from "./EntitiesUnavailable";
+import type { EntityCounts } from "./EntityCounts";
+
+/**
+ * What the entities topic sends at each sweep, and what every answer about the list carries: the
+ * state of the list, never its rows.
+ */
+export type EntitiesLive = { 
+/**
+ * Names the start of the server and of its bridge that the net ids and serials belong to. A
+ * deletion gives it back, and is refused once it changed. `None` before the first sweep.
+ */
+run: string | null, 
+/**
+ * Counts the sweeps of a run.
+ */
+sweep: number, 
+/**
+ * When Observer took the last sweep.
+ */
+at: string | null, unavailable: EntitiesUnavailable | null, counts: EntityCounts | null, 
+/**
+ * Entities in the list, players' peds left out.
+ */
+listed: number, 
+/**
+ * The sweep stopped at its budget or its cap: the list is partial, the counts are not.
+ */
+truncated: boolean, 
+/**
+ * How often the server sweeps, in milliseconds: the cadence asked for, or more once a sweep
+ * cost it too much.
+ */
+everyMs: number, 
+/**
+ * The server spaced its sweeps out by itself.
+ */
+spaced: boolean, 
+/**
+ * What the last sweep took of the server's main thread, in microseconds.
+ */
+workUs: number | null, 
+/**
+ * The part of it spent listing, before reading each entity.
+ */
+listUs: number | null, 
+/**
+ * The frames the sweep was spread over.
+ */
+frames: number | null, };
diff --git a/web/src/api/generated/EntitiesSettings.ts b/web/src/api/generated/EntitiesSettings.ts
new file mode 100644
index 00000000..65f1f78f
--- /dev/null
+++ b/web/src/api/generated/EntitiesSettings.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type EntitiesSettings = { 
+/**
+ * How often the server lists its entities while someone looks at them.
+ */
+everySeconds: number, };
diff --git a/web/src/api/generated/EntitiesUnavailable.ts b/web/src/api/generated/EntitiesUnavailable.ts
new file mode 100644
index 00000000..e685e1fa
--- /dev/null
+++ b/web/src/api/generated/EntitiesUnavailable.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Why the server has no entity to list.
+ */
+export type EntitiesUnavailable = "onesync" | "game";
diff --git a/web/src/api/generated/EntityCell.ts b/web/src/api/generated/EntityCell.ts
new file mode 100644
index 00000000..efe4c8c2
--- /dev/null
+++ b/web/src/api/generated/EntityCell.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * A square of the map and the entities in it: its column and its row, counted from the game's
+ * origin in cells, how many entities, and the number of the most common kind.
+ */
+export type EntityCell = [number, number, number, number];
diff --git a/web/src/api/generated/EntityCounts.ts b/web/src/api/generated/EntityCounts.ts
new file mode 100644
index 00000000..3d891e18
--- /dev/null
+++ b/web/src/api/generated/EntityCounts.ts
@@ -0,0 +1,15 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * What the server counted in a sweep, whole even when the list is cut short. `None` for a kind
+ * whose listing failed.
+ */
+export type EntityCounts = { vehicles: number | null, 
+/**
+ * With the players' own.
+ */
+peds: number | null, objects: number | null, 
+/**
+ * Counted among the peds, and never listed.
+ */
+playerPeds: number, };
diff --git a/web/src/api/generated/EntityDeleteRequest.ts b/web/src/api/generated/EntityDeleteRequest.ts
new file mode 100644
index 00000000..9a31595f
--- /dev/null
+++ b/web/src/api/generated/EntityDeleteRequest.ts
@@ -0,0 +1,11 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntityTarget } from "./EntityTarget";
+
+/**
+ * `POST /api/servers/default/entities/delete`.
+ */
+export type EntityDeleteRequest = { 
+/**
+ * The `run` of the list the entities were picked in.
+ */
+run: string, targets: Array<EntityTarget>, };
diff --git a/web/src/api/generated/EntityDeletion.ts b/web/src/api/generated/EntityDeletion.ts
new file mode 100644
index 00000000..47393285
--- /dev/null
+++ b/web/src/api/generated/EntityDeletion.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntityResult } from "./EntityResult";
+
+/**
+ * The answer to a deletion: every entity asked for, once each.
+ */
+export type EntityDeletion = { results: Array<EntityResult>, };
diff --git a/web/src/api/generated/EntityFacets.ts b/web/src/api/generated/EntityFacets.ts
new file mode 100644
index 00000000..7a67b85a
--- /dev/null
+++ b/web/src/api/generated/EntityFacets.ts
@@ -0,0 +1,21 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { BucketCount } from "./BucketCount";
+import type { ClassCount } from "./ClassCount";
+import type { KindCounts } from "./KindCounts";
+import type { ModelCount } from "./ModelCount";
+import type { OwnerCount } from "./OwnerCount";
+import type { ResourceCount } from "./ResourceCount";
+
+/**
+ * What the filters can pick from, counted over the whole list, and the most common models of the
+ * entities the filters keep.
+ */
+export type EntityFacets = { kinds: KindCounts, classes: Array<ClassCount>, 
+/**
+ * The most common first.
+ */
+resources: Array<ResourceCount>, buckets: Array<BucketCount>, unowned: number, owned: number, 
+/**
+ * Who owns the most. Empty for who does not see where players stand.
+ */
+owners: Array<OwnerCount>, models: Array<ModelCount>, };
diff --git a/web/src/api/generated/EntityItem.ts b/web/src/api/generated/EntityItem.ts
new file mode 100644
index 00000000..9fed9425
--- /dev/null
+++ b/web/src/api/generated/EntityItem.ts
@@ -0,0 +1,43 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntityKind } from "./EntityKind";
+import type { VehicleClass } from "./VehicleClass";
+
+/**
+ * An entity in the list.
+ */
+export type EntityItem = { netId: number, 
+/**
+ * Drawn by the bridge when it first saw the entity. Net ids are used again: only with its
+ * serial does one name an entity.
+ */
+serial: number, kind: EntityKind, class: VehicleClass | null, 
+/**
+ * The model's hash, unsigned.
+ */
+model: number, x: number, y: number, z: number, 
+/**
+ * Whether a player's game simulates it.
+ */
+owned: boolean, 
+/**
+ * That player's net id. `None` without one, and for who does not see where players stand:
+ * the owner of a vehicle is whoever drives it.
+ */
+owner: number | null, ownerName: string | null, bucket: number, 
+/**
+ * How the game came to hold it, as `GetEntityPopulationType` says: 7 for a script's.
+ */
+population: number, 
+/**
+ * The resource that created it, as the server knew when the entity was first seen. `None`
+ * for the game's own traffic and for what a client's script created.
+ */
+resource: string | null, 
+/**
+ * Not looked up yet: a sweep looks up a few hundred.
+ */
+resourcePending: boolean, 
+/**
+ * A player sits in it. Never told to who does not see where players stand.
+ */
+occupied: boolean, };
diff --git a/web/src/api/generated/EntityKind.ts b/web/src/api/generated/EntityKind.ts
new file mode 100644
index 00000000..d37052b8
--- /dev/null
+++ b/web/src/api/generated/EntityKind.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type EntityKind = "vehicle" | "ped" | "object";
diff --git a/web/src/api/generated/EntityLimits.ts b/web/src/api/generated/EntityLimits.ts
new file mode 100644
index 00000000..67fb70cb
--- /dev/null
+++ b/web/src/api/generated/EntityLimits.ts
@@ -0,0 +1,10 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * The limits the panel holds a selection to, which the server enforces.
+ */
+export type EntityLimits = { pageSize: number, maxDelete: number, typedConfirmationFrom: number, maxMapPoints: number, 
+/**
+ * A list this many sweeps old is out of date.
+ */
+staleSweeps: number, };
diff --git a/web/src/api/generated/EntityMap.ts b/web/src/api/generated/EntityMap.ts
new file mode 100644
index 00000000..a4da960e
--- /dev/null
+++ b/web/src/api/generated/EntityMap.ts
@@ -0,0 +1,26 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntitiesLive } from "./EntitiesLive";
+import type { EntityCell } from "./EntityCell";
+import type { EntityPoint } from "./EntityPoint";
+import type { KindCounts } from "./KindCounts";
+
+/**
+ * `GET /api/servers/default/entities/map`.
+ */
+export type EntityMap = { live: EntitiesLive, 
+/**
+ * How many of each kind the whole list holds.
+ */
+kinds: KindCounts, 
+/**
+ * The entities the filters keep within the part of the map asked for.
+ */
+matching: number, 
+/**
+ * Each of them, while they are few enough to draw.
+ */
+points: Array<EntityPoint>, 
+/**
+ * The side of a cell in game units, when there are too many: `cells` then stands for them.
+ */
+cell: number | null, cells: Array<EntityCell>, };
diff --git a/web/src/api/generated/EntityOutcome.ts b/web/src/api/generated/EntityOutcome.ts
new file mode 100644
index 00000000..ba87829a
--- /dev/null
+++ b/web/src/api/generated/EntityOutcome.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * What became of an entity someone asked to delete.
+ */
+export type EntityOutcome = "deleted" | "unconfirmed" | "unanswered" | "gone" | "changed" | "player" | "occupied" | "train" | "late" | "error";
diff --git a/web/src/api/generated/EntityPage.ts b/web/src/api/generated/EntityPage.ts
new file mode 100644
index 00000000..77347d6a
--- /dev/null
+++ b/web/src/api/generated/EntityPage.ts
@@ -0,0 +1,18 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntitiesLive } from "./EntitiesLive";
+import type { EntityFacets } from "./EntityFacets";
+import type { EntityItem } from "./EntityItem";
+import type { EntityLimits } from "./EntityLimits";
+
+/**
+ * `GET /api/servers/default/entities`.
+ */
+export type EntityPage = { live: EntitiesLive, 
+/**
+ * Whether who asks may see who owns an entity, and whether a player sits in one.
+ */
+ownersShown: boolean, limits: EntityLimits, matching: number, 
+/**
+ * From 0, the last one when the page asked for is past it.
+ */
+page: number, items: Array<EntityItem>, facets: EntityFacets, };
diff --git a/web/src/api/generated/EntityPoint.ts b/web/src/api/generated/EntityPoint.ts
new file mode 100644
index 00000000..041db627
--- /dev/null
+++ b/web/src/api/generated/EntityPoint.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * An entity on the map: its net id, its serial, the number of its kind (1 for a ped, 2 for a
+ * vehicle, 3 for an object), then x and y in game units.
+ */
+export type EntityPoint = [number, number, number, number, number];
diff --git a/web/src/api/generated/EntityResult.ts b/web/src/api/generated/EntityResult.ts
new file mode 100644
index 00000000..1a0fb11b
--- /dev/null
+++ b/web/src/api/generated/EntityResult.ts
@@ -0,0 +1,4 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntityOutcome } from "./EntityOutcome";
+
+export type EntityResult = { netId: number, outcome: EntityOutcome, };
diff --git a/web/src/api/generated/EntitySort.ts b/web/src/api/generated/EntitySort.ts
new file mode 100644
index 00000000..17196e00
--- /dev/null
+++ b/web/src/api/generated/EntitySort.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type EntitySort = "kind" | "model" | "resource" | "owner" | "bucket" | "position" | "netId";
diff --git a/web/src/api/generated/EntityTarget.ts b/web/src/api/generated/EntityTarget.ts
new file mode 100644
index 00000000..5c5f50b8
--- /dev/null
+++ b/web/src/api/generated/EntityTarget.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * An entity to delete, as the list showed it: the server deletes it only if it still is.
+ */
+export type EntityTarget = { netId: number, serial: number, model: number, };
diff --git a/web/src/api/generated/ErrorCode.ts b/web/src/api/generated/ErrorCode.ts
index 8c321803..e95d0a60 100644
--- a/web/src/api/generated/ErrorCode.ts
+++ b/web/src/api/generated/ErrorCode.ts
@@ -4,4 +4,4 @@
  * Why the API refused a request. The panel turns the code into a message; the API never sends
  * sentences.
  */
-export type ErrorCode = "unauthenticated" | "invalid_credentials" | "temporary_password_expired" | "too_many_attempts" | "busy" | "too_many_sockets" | "password_change_required" | "reauth_required" | "wrong_password" | "forbidden" | "owner_only" | "self_edit" | "owner_protected" | "escalation" | "hierarchy" | "conflict" | "not_found" | "name_taken" | "invalid_username" | "password_too_short" | "password_too_long" | "password_unchanged" | "unknown_permissions" | "invalid_launch_settings" | "launch_not_configured" | "launch_failed" | "server_running" | "server_not_running" | "server_stopping" | "server_not_starting" | "cfg_not_editable" | "cfg_changed" | "invalid_cfg_text" | "cfg_version_not_found" | "shutting_down" | "command_refused" | "too_many_commands" | "already_set_up" | "invalid_setup_token" | "origin_mismatch" | "unknown_host" | "json_required" | "invalid_request" | "internal" | "invalid_schedule" | "nothing_to_skip" | "already_skipped" | "nothing_to_restore" | "nothing_to_delay" | "delay_too_long" | "no_one_off" | "job_running" | "no_job" | "job_committing" | "catalog_unavailable" | "build_not_listed" | "not_downloadable" | "already_installed" | "end_of_life" | "build_not_installed" | "build_broken" | "kvp_rollback" | "no_scheduled_restart" | "already_selected" | "no_pending" | "build_protected" | "build_in_use" | "invalid_artifact_settings" | "no_build_selected" | "invalid_import_folder" | "crash_not_found" | "crash_file_not_found" | "crash_file_too_large" | "setup_blocked" | "invalid_rule" | "invalid_public_key" | "key_in_use" | "too_many_keys" | "invalid_access" | "player_not_found" | "address_search" | "invalid_search" | "invalid_players_settings" | "invalid_players_file" | "invalid_drops_settings" | "ban_not_found" | "ban_not_active" | "invalid_ban" | "invalid_bans_settings" | "invalid_map_image" | "no_map_image" | "invalid_map_settings" | "changes_unavailable" | "start_not_found" | "content_hidden" | "content_not_kept" | "diff_too_large" | "check_running" | "check_too_soon" | "invalid_glob" | "plan_changed" | "server_not_stopped" | "tool_not_available" | "feature_disabled" | "feature_locked" | "sftp_listen_pinned" | "invalid_sftp_listen" | "backup_running" | "invalid_backup_settings" | "invalid_backup_destination" | "backup_not_configured" | "backup_copy_unavailable" | "update_not_available" | "update_running" | "no_update" | "update_restarting" | "update_blocked";
+export type ErrorCode = "unauthenticated" | "invalid_credentials" | "temporary_password_expired" | "too_many_attempts" | "busy" | "too_many_sockets" | "password_change_required" | "reauth_required" | "wrong_password" | "forbidden" | "owner_only" | "self_edit" | "owner_protected" | "escalation" | "hierarchy" | "conflict" | "not_found" | "name_taken" | "invalid_username" | "password_too_short" | "password_too_long" | "password_unchanged" | "unknown_permissions" | "invalid_launch_settings" | "launch_not_configured" | "launch_failed" | "server_running" | "server_not_running" | "server_stopping" | "server_not_starting" | "cfg_not_editable" | "cfg_changed" | "invalid_cfg_text" | "cfg_version_not_found" | "shutting_down" | "command_refused" | "too_many_commands" | "already_set_up" | "invalid_setup_token" | "origin_mismatch" | "unknown_host" | "json_required" | "invalid_request" | "internal" | "invalid_schedule" | "nothing_to_skip" | "already_skipped" | "nothing_to_restore" | "nothing_to_delay" | "delay_too_long" | "no_one_off" | "job_running" | "no_job" | "job_committing" | "catalog_unavailable" | "build_not_listed" | "not_downloadable" | "already_installed" | "end_of_life" | "build_not_installed" | "build_broken" | "kvp_rollback" | "no_scheduled_restart" | "already_selected" | "no_pending" | "build_protected" | "build_in_use" | "invalid_artifact_settings" | "no_build_selected" | "invalid_import_folder" | "crash_not_found" | "crash_file_not_found" | "crash_file_too_large" | "setup_blocked" | "invalid_rule" | "invalid_public_key" | "key_in_use" | "too_many_keys" | "invalid_access" | "player_not_found" | "address_search" | "invalid_search" | "invalid_players_settings" | "invalid_players_file" | "invalid_drops_settings" | "ban_not_found" | "ban_not_active" | "invalid_ban" | "invalid_bans_settings" | "invalid_map_image" | "no_map_image" | "invalid_map_settings" | "entities_not_listed" | "entities_changed" | "entities_out_of_date" | "entities_deleting" | "too_many_entities" | "invalid_entities_settings" | "changes_unavailable" | "start_not_found" | "content_hidden" | "content_not_kept" | "diff_too_large" | "check_running" | "check_too_soon" | "invalid_glob" | "plan_changed" | "server_not_stopped" | "tool_not_available" | "feature_disabled" | "feature_locked" | "sftp_listen_pinned" | "invalid_sftp_listen" | "backup_running" | "invalid_backup_settings" | "invalid_backup_destination" | "backup_not_configured" | "backup_copy_unavailable" | "update_not_available" | "update_running" | "no_update" | "update_restarting" | "update_blocked";
diff --git a/web/src/api/generated/Feature.ts b/web/src/api/generated/Feature.ts
index b5d909af..c862bfda 100644
--- a/web/src/api/generated/Feature.ts
+++ b/web/src/api/generated/Feature.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type Feature = "sftp" | "changes" | "tools" | "diagnostics" | "metrics" | "players" | "drops" | "updates" | "debug";
+export type Feature = "sftp" | "changes" | "tools" | "diagnostics" | "metrics" | "players" | "drops" | "updates" | "debug" | "entities";
diff --git a/web/src/api/generated/FeatureTask.ts b/web/src/api/generated/FeatureTask.ts
index f7af4c5f..23ad5814 100644
--- a/web/src/api/generated/FeatureTask.ts
+++ b/web/src/api/generated/FeatureTask.ts
@@ -3,4 +3,4 @@
 /**
  * What a feature does in the background, for the panel to name.
  */
-export type FeatureTask = "sftpServer" | "sftpUpkeep" | "uploadsSweep" | "snapshots" | "changesUpkeep" | "toolsAtStart" | "toolsHeal" | "processRecords" | "connections" | "crashAnalysis" | "hangSnapshot" | "diagnosticsUpkeep" | "sampler" | "metricsUpkeep" | "playersFollower" | "dropsWorker" | "updateCheck" | "updateProbation" | "hookLines" | "hookCounts";
+export type FeatureTask = "sftpServer" | "sftpUpkeep" | "uploadsSweep" | "snapshots" | "changesUpkeep" | "toolsAtStart" | "toolsHeal" | "processRecords" | "connections" | "crashAnalysis" | "hangSnapshot" | "diagnosticsUpkeep" | "sampler" | "metricsUpkeep" | "playersFollower" | "dropsWorker" | "updateCheck" | "updateProbation" | "hookLines" | "hookCounts" | "entityList";
diff --git a/web/src/api/generated/KindCounts.ts b/web/src/api/generated/KindCounts.ts
new file mode 100644
index 00000000..987c608c
--- /dev/null
+++ b/web/src/api/generated/KindCounts.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type KindCounts = { vehicles: number, peds: number, objects: number, };
diff --git a/web/src/api/generated/ModelCount.ts b/web/src/api/generated/ModelCount.ts
new file mode 100644
index 00000000..e8d80044
--- /dev/null
+++ b/web/src/api/generated/ModelCount.ts
@@ -0,0 +1,4 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { EntityKind } from "./EntityKind";
+
+export type ModelCount = { model: number, kind: EntityKind, count: number, };
diff --git a/web/src/api/generated/OwnerCount.ts b/web/src/api/generated/OwnerCount.ts
new file mode 100644
index 00000000..d1c9a704
--- /dev/null
+++ b/web/src/api/generated/OwnerCount.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type OwnerCount = { netId: number, name: string | null, count: number, };
diff --git a/web/src/api/generated/Permission.ts b/web/src/api/generated/Permission.ts
index 93d337e5..28bf6e16 100644
--- a/web/src/api/generated/Permission.ts
+++ b/web/src/api/generated/Permission.ts
@@ -27,4 +27,6 @@ export const Permission = {
     PlayersBan: 1n << 23n,
     BansLift: 1n << 24n,
     PlayersMap: 1n << 25n,
+    EntitiesView: 1n << 26n,
+    EntitiesDelete: 1n << 27n,
 } as const;
diff --git a/web/src/api/generated/PermissionArea.ts b/web/src/api/generated/PermissionArea.ts
index 6cc5e7c4..1e8b0111 100644
--- a/web/src/api/generated/PermissionArea.ts
+++ b/web/src/api/generated/PermissionArea.ts
@@ -3,4 +3,4 @@
 /**
  * The group a permission belongs to in the permission editor.
  */
-export type PermissionArea = "dashboard" | "console" | "server" | "schedule" | "artifacts" | "users" | "audit" | "settings" | "logs" | "diagnostics" | "files" | "players" | "drops" | "changes" | "backups";
+export type PermissionArea = "dashboard" | "console" | "server" | "schedule" | "artifacts" | "users" | "audit" | "settings" | "logs" | "diagnostics" | "files" | "players" | "drops" | "changes" | "backups" | "entities";
diff --git a/web/src/api/generated/ResourceCount.ts b/web/src/api/generated/ResourceCount.ts
new file mode 100644
index 00000000..7c928e3f
--- /dev/null
+++ b/web/src/api/generated/ResourceCount.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ResourceCount = { 
+/**
+ * `None` for the entities no resource created.
+ */
+resource: string | null, count: number, };
diff --git a/web/src/api/generated/Topic.ts b/web/src/api/generated/Topic.ts
index 937b1b07..052d74c4 100644
--- a/web/src/api/generated/Topic.ts
+++ b/web/src/api/generated/Topic.ts
@@ -3,4 +3,4 @@
 /**
  * What the panel can follow.
  */
-export type Topic = "status" | "audit" | "server.status" | "console" | "metrics.live" | "server.schedule" | "server.artifacts" | "server.alerts" | "server.diagnostics" | "server.changes" | "server.map";
+export type Topic = "status" | "audit" | "server.status" | "console" | "metrics.live" | "server.schedule" | "server.artifacts" | "server.alerts" | "server.diagnostics" | "server.changes" | "server.map" | "server.entities";
diff --git a/web/src/api/generated/TopicEvent.ts b/web/src/api/generated/TopicEvent.ts
index 11fc201a..50b0cbeb 100644
--- a/web/src/api/generated/TopicEvent.ts
+++ b/web/src/api/generated/TopicEvent.ts
@@ -5,9 +5,10 @@ import type { AuditEntry } from "./AuditEntry";
 import type { ChangesLive } from "./ChangesLive";
 import type { ConsoleBatch } from "./ConsoleBatch";
 import type { DiagnosticsEvent } from "./DiagnosticsEvent";
+import type { EntitiesLive } from "./EntitiesLive";
 import type { LiveSample } from "./LiveSample";
 import type { MapLive } from "./MapLive";
 import type { ScheduleStatus } from "./ScheduleStatus";
 import type { ServerStatus } from "./ServerStatus";
 
-export type TopicEvent = { "topic": "audit", "data": AuditEntry } | { "topic": "server.status", "data": ServerStatus } | { "topic": "console", "data": ConsoleBatch } | { "topic": "metrics.live", "data": LiveSample } | { "topic": "server.schedule", "data": ScheduleStatus } | { "topic": "server.artifacts", "data": ArtifactsStatus } | { "topic": "server.alerts", "data": AlertList } | { "topic": "server.diagnostics", "data": DiagnosticsEvent } | { "topic": "server.changes", "data": ChangesLive } | { "topic": "server.map", "data": MapLive };
+export type TopicEvent = { "topic": "audit", "data": AuditEntry } | { "topic": "server.status", "data": ServerStatus } | { "topic": "console", "data": ConsoleBatch } | { "topic": "metrics.live", "data": LiveSample } | { "topic": "server.schedule", "data": ScheduleStatus } | { "topic": "server.artifacts", "data": ArtifactsStatus } | { "topic": "server.alerts", "data": AlertList } | { "topic": "server.diagnostics", "data": DiagnosticsEvent } | { "topic": "server.changes", "data": ChangesLive } | { "topic": "server.map", "data": MapLive } | { "topic": "server.entities", "data": EntitiesLive };
diff --git a/web/src/api/generated/TopicSnapshot.ts b/web/src/api/generated/TopicSnapshot.ts
index cd3b9de4..87cff272 100644
--- a/web/src/api/generated/TopicSnapshot.ts
+++ b/web/src/api/generated/TopicSnapshot.ts
@@ -5,10 +5,11 @@ import type { AuditSnapshot } from "./AuditSnapshot";
 import type { ChangesLive } from "./ChangesLive";
 import type { ConsoleSnapshot } from "./ConsoleSnapshot";
 import type { DiagnosticsSnapshot } from "./DiagnosticsSnapshot";
+import type { EntitiesLive } from "./EntitiesLive";
 import type { MapLive } from "./MapLive";
 import type { MetricsSnapshot } from "./MetricsSnapshot";
 import type { ObserverStatus } from "./ObserverStatus";
 import type { ScheduleStatus } from "./ScheduleStatus";
 import type { ServerStatus } from "./ServerStatus";
 
-export type TopicSnapshot = { "topic": "status", "data": ObserverStatus } | { "topic": "audit", "data": AuditSnapshot } | { "topic": "server.status", "data": ServerStatus } | { "topic": "console", "data": ConsoleSnapshot } | { "topic": "metrics.live", "data": MetricsSnapshot } | { "topic": "server.schedule", "data": ScheduleStatus } | { "topic": "server.artifacts", "data": ArtifactsStatus } | { "topic": "server.alerts", "data": AlertList } | { "topic": "server.diagnostics", "data": DiagnosticsSnapshot } | { "topic": "server.changes", "data": ChangesLive } | { "topic": "server.map", "data": MapLive };
+export type TopicSnapshot = { "topic": "status", "data": ObserverStatus } | { "topic": "audit", "data": AuditSnapshot } | { "topic": "server.status", "data": ServerStatus } | { "topic": "console", "data": ConsoleSnapshot } | { "topic": "metrics.live", "data": MetricsSnapshot } | { "topic": "server.schedule", "data": ScheduleStatus } | { "topic": "server.artifacts", "data": ArtifactsStatus } | { "topic": "server.alerts", "data": AlertList } | { "topic": "server.diagnostics", "data": DiagnosticsSnapshot } | { "topic": "server.changes", "data": ChangesLive } | { "topic": "server.map", "data": MapLive } | { "topic": "server.entities", "data": EntitiesLive };
diff --git a/web/src/api/generated/VehicleClass.ts b/web/src/api/generated/VehicleClass.ts
new file mode 100644
index 00000000..f732b33f
--- /dev/null
+++ b/web/src/api/generated/VehicleClass.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * What `GetVehicleType` says of a vehicle.
+ */
+export type VehicleClass = "car" | "bike" | "boat" | "helicopter" | "plane" | "submarine" | "trailer" | "train" | "other";
diff --git a/web/src/audit/details.test.ts b/web/src/audit/details.test.ts
index be071da7..cfb73317 100644
--- a/web/src/audit/details.test.ts
+++ b/web/src/audit/details.test.ts
@@ -214,6 +214,27 @@ describe('auditDetails', () => {
         );
     });
 
+    it('should word what a deletion of entities took and left, and how often they are listed', () => {
+        expect(
+            auditDetails(en, format, {
+                asked: 15,
+                deleted: 12,
+                outcomes: { occupied: 2, gone: 1 },
+                entities: [
+                    { model: '0xB779A091', kind: 'vehicle', resource: 'qb-garages', count: 8 },
+                    { model: '0x705E61F2', kind: 'ped', resource: null, count: 1 },
+                ],
+                more: 3,
+            }),
+        ).toBe(
+            'Asked for: 15 · Deleted: 12 · Not deleted: 2 had a player inside, 1 was already gone · ' +
+                'Entities: 8 × 0xB779A091 vehicle (qb-garages), 1 × 0x705E61F2 ped · In smaller groups: 3',
+        );
+        expect(auditDetails(en, format, { from: { everySeconds: 15 }, to: { everySeconds: 30 } })).toBe(
+            'Before: (Every: 15 s) · After: (Every: 30 s)',
+        );
+    });
+
     it('should name the two snapshots a read of changed contents compared, either one a check of the disk, and how it showed them', () => {
         expect(
             auditDetails(
diff --git a/web/src/audit/details.ts b/web/src/audit/details.ts
index ad62b10a..00b2b5c6 100644
--- a/web/src/audit/details.ts
+++ b/web/src/audit/details.ts
@@ -74,6 +74,16 @@ const isArgumentChange = (value: unknown): value is { set: string[]; removed: st
 const isRecord = (value: unknown): value is Record<string, unknown> =>
     typeof value === 'object' && value !== null && !Array.isArray(value);
 
+/** Entities a deletion took together: one model, one kind, one creating resource. */
+const isEntityGroup = (
+    value: unknown,
+): value is { model: string; kind: string; resource: string | null; count: number } =>
+    isRecord(value) &&
+    typeof value.model === 'string' &&
+    typeof value.kind === 'string' &&
+    (value.resource === null || typeof value.resource === 'string') &&
+    typeof value.count === 'number';
+
 /** Settings the log records whole, before and after: change tracking's. */
 const isWholeChange = (
     details: Record<string, unknown>,
@@ -176,7 +186,7 @@ const word = (t: Messages, format: Format, key: string, value: unknown): string
         if (key === 'generation') {
             return t.diagnostics.processes.generation(value);
         }
-        if (key === 'lateBySeconds') {
+        if (key === 'lateBySeconds' || key === 'everySeconds') {
             return t.audit.seconds(format.number(value));
         }
         // Kept in seconds, in the minutes the launch settings take it in.
@@ -213,6 +223,30 @@ const word = (t: Messages, format: Format, key: string, value: unknown): string
     if ((NESTED.has(key) || key === 'from' || key === 'to') && isRecord(value)) {
         return `(${pairs(t, format, value).join(', ')})`;
     }
+    // What a deletion of entities left, by what became of each, then what it took.
+    if (key === 'outcomes' && isRecord(value)) {
+        return Object.entries(value)
+            .map(([outcome, left]) =>
+                has(t.entities.notDeleted, outcome) && typeof left === 'number'
+                    ? t.entities.notDeleted[outcome](left)
+                    : `${outcome}: ${JSON.stringify(left)}`,
+            )
+            .join(', ');
+    }
+    if (key === 'entities' && Array.isArray(value)) {
+        return value
+            .map((group) =>
+                isEntityGroup(group)
+                    ? t.entities.group(
+                          group.count,
+                          group.model,
+                          has(t.entities.kinds, group.kind) ? t.entities.kinds[group.kind] : group.kind,
+                          group.resource,
+                      )
+                    : JSON.stringify(group),
+            )
+            .join(', ');
+    }
     if (typeof value !== 'string') {
         return JSON.stringify(value);
     }
diff --git a/web/src/i18n/en.ts b/web/src/i18n/en.ts
index bf30a1bd..813c74a0 100644
--- a/web/src/i18n/en.ts
+++ b/web/src/i18n/en.ts
@@ -35,6 +35,8 @@ import type { DropCategory } from '../api/generated/DropCategory';
 import type { DropKind } from '../api/generated/DropKind';
 import type { DropsRange } from '../api/generated/DropsRange';
 import type { EndpointProtocol } from '../api/generated/EndpointProtocol';
+import type { EntityKind } from '../api/generated/EntityKind';
+import type { EntityOutcome } from '../api/generated/EntityOutcome';
 import type { EnvironmentFact } from '../api/generated/EnvironmentFact';
 import type { ErrorCode } from '../api/generated/ErrorCode';
 import type { EscrowPolicy } from '../api/generated/EscrowPolicy';
@@ -218,6 +220,16 @@ const permissions = {
         name: 'See the live map',
         description: 'Where every connected player stands, as the server sees it, a few times a minute.',
     },
+    entitiesView: {
+        name: 'See the entities',
+        description:
+            "The server's vehicles, peds and objects: their model, the resource that created them and where they stand. Who owns one also takes See the live map.",
+    },
+    entitiesDelete: {
+        name: 'Delete entities',
+        description:
+            'Delete vehicles, peds and objects from the game, up to a hundred at a time. Players near them see them vanish.',
+    },
 } satisfies Record<PermissionKey, { name: string; description: string }>;
 
 const permissionNames = (hex: string) =>
@@ -235,6 +247,7 @@ const features = {
     drops: 'Player drops',
     updates: 'Updates',
     debug: 'Debug',
+    entities: 'Entities',
 } satisfies Record<Feature, string>;
 
 const isFeature = (key: string): key is Feature => Object.hasOwn(features, key);
@@ -2522,6 +2535,29 @@ export const en = {
         scale: (metres: string) => `${metres} m`,
         unknownPing: 'unknown',
     },
+    entities: {
+        kinds: { vehicle: 'vehicle', ped: 'ped', object: 'object' } satisfies Record<EntityKind, string>,
+        /** A group of entities of one model: `8 × 0xB779A091 vehicle (qb-garages)`. */
+        group: (value: number, model: string, kind: string, resource: string | null) =>
+            `${formatNumber('en', value)} × ${model} ${kind}${resource === null ? '' : ` (${resource})`}`,
+        // What became of the entities a deletion did not delete, each said of how many.
+        notDeleted: {
+            unconfirmed: (value: number) =>
+                `${formatNumber('en', value)} ${plural('en', value, { one: 'is still there', other: 'are still there' })}`,
+            unanswered: (value: number) => `the server did not answer for ${formatNumber('en', value)}`,
+            gone: (value: number) =>
+                `${formatNumber('en', value)} ${plural('en', value, { one: 'was already gone', other: 'were already gone' })}`,
+            changed: (value: number) =>
+                `${formatNumber('en', value)} ${plural('en', value, { one: 'was no longer the entity listed', other: 'were no longer the entities listed' })}`,
+            player: (value: number) =>
+                `${formatNumber('en', value)} ${plural('en', value, { one: "is a player's own ped", other: "are players' own peds" })}`,
+            occupied: (value: number) => `${formatNumber('en', value)} had a player inside`,
+            train: (value: number) =>
+                `${formatNumber('en', value)} ${plural('en', value, { one: 'is a train', other: 'are trains' })}`,
+            late: (value: number) => `the server read the request too late for ${formatNumber('en', value)}`,
+            error: (value: number) => `${formatNumber('en', value)} failed`,
+        } satisfies Record<Exclude<EntityOutcome, 'deleted'>, (value: number) => string>,
+    },
     bans: {
         title: 'Bans',
         gloss: 'Who the server refuses, and why.',
@@ -5094,6 +5130,10 @@ export const en = {
                 label: 'Debug',
                 about: "Counts the events, state bag writes and HTTP requests of every Lua resource, for the Debug pages. It adds two lines to the build's Lua scheduler at each start while it is on, and takes them out when it is off.",
             },
+            switchEntities: {
+                label: 'Entities',
+                about: "The server's vehicles, peds and objects, listed while someone looks at them, found on the Live map and deleted on request. Nothing of them is kept. Off, the server is never asked for them.",
+            },
             switchUpdates: {
                 label: 'Updates',
                 about: 'Every 6 hours, Observer asks GitHub for a newer release, which the owner installs from the About page. Off, Observer never contacts GitHub.',
@@ -5516,6 +5556,7 @@ export const en = {
                 updateProbation: 'settling an update once Observer restarted',
                 hookLines: "the two lines in the build's Lua scheduler",
                 hookCounts: 'reading what the resources count',
+                entityList: 'listing the entities while someone looks at them',
             } satisfies Record<FeatureTask, string>,
             turnedOn: (name: string) => `${name} is on.`,
             turnedOnLater: (name: string, state: string) => `${name}: ${state}.`,
@@ -5678,6 +5719,8 @@ export const en = {
             bans_settings_changed: 'Ban settings changed',
             map_image_changed: 'Map image changed',
             map_settings_changed: 'Live map settings changed',
+            entities_deleted: 'Entities deleted',
+            entities_settings_changed: 'Entities settings changed',
             drop_rates_exported: 'Drop rates exported',
             drops_retention_changed: 'Drop retention changed',
             change_contents_viewed: 'Changed file read',
@@ -5895,6 +5938,12 @@ export const en = {
             updated: 'Updated',
             forgotten: 'Skipped as forgotten',
             invalid: 'Invalid',
+            asked: 'Asked for',
+            deleted: 'Deleted',
+            outcomes: 'Not deleted',
+            entities: 'Entities',
+            more: 'In smaller groups',
+            everySeconds: 'Every',
         },
         days: (value: number) => count(value, { one: 'day', other: 'days' }),
         // A profile whose retention is unset is never deleted.
@@ -6099,6 +6148,7 @@ export const en = {
         drops: 'Player drops',
         changes: 'Changes',
         backups: 'Backups',
+        entities: 'Entities',
     } satisfies Record<PermissionArea, string>,
     danger: {
         sensitive: 'Sensitive',
@@ -6293,6 +6343,17 @@ export const en = {
         no_map_image: 'No map image is set.',
         invalid_map_settings:
             'Some settings are out of range: the thresholds must be ordered, the cadence 1, 2 or 5 seconds, and the edges must enclose an area.',
+        entities_not_listed:
+            'The server has not listed its entities yet: wait for the list, then try again. Nothing was deleted.',
+        entities_changed:
+            'The server restarted since this list was read: its net IDs name other entities now. Nothing was deleted.',
+        entities_out_of_date: 'This list is out of date: the server stopped answering. Nothing was deleted.',
+        entities_deleting: 'Another deletion is still under way: try again in a few seconds.',
+        too_many_entities: (params) =>
+            typeof params.max === 'number'
+                ? `One deletion takes ${formatNumber('en', params.max)} entities at most.`
+                : 'One deletion cannot take that many entities.',
+        invalid_entities_settings: 'The server lists its entities every 5, 10, 15, 30 or 60 seconds.',
         invalid_bans_settings: (params) =>
             typeof params.maxMessage === 'number' && typeof params.maxTokens === 'number'
                 ? `Write a refusal message of ${formatNumber('en', params.maxMessage)} characters at most, and ask for 0 to ${formatNumber('en', params.maxTokens)} tokens.`
diff --git a/web/src/live/messages.ts b/web/src/live/messages.ts
index d767e794..a183315d 100644
--- a/web/src/live/messages.ts
+++ b/web/src/live/messages.ts
@@ -52,6 +52,9 @@ import type { SpawnFailure } from '../api/generated/SpawnFailure';
 import type { StateCause } from '../api/generated/StateCause';
 import type { SyscallGroup } from '../api/generated/SyscallGroup';
 import type { ThreadRun } from '../api/generated/ThreadRun';
+import type { EntitiesLive } from '../api/generated/EntitiesLive';
+import type { EntitiesUnavailable } from '../api/generated/EntitiesUnavailable';
+import type { EntityCounts } from '../api/generated/EntityCounts';
 import type { Topic } from '../api/generated/Topic';
 import type { TreeProcess } from '../api/generated/TreeProcess';
 import type { UnsubscribeReason } from '../api/generated/UnsubscribeReason';
@@ -72,6 +75,7 @@ const TOPICS = {
     'server.diagnostics': true,
     'server.changes': true,
     'server.map': true,
+    'server.entities': true,
 } satisfies Record<Topic, true>;
 
 const UNSUBSCRIBE_REASONS = { forbidden: true, disabled: true } satisfies Record<UnsubscribeReason, true>;
@@ -240,6 +244,8 @@ const AUDIT_ACTIONS = {
     bans_settings_changed: true,
     map_image_changed: true,
     map_settings_changed: true,
+    entities_deleted: true,
+    entities_settings_changed: true,
     player_drops_exported: true,
     drop_rates_exported: true,
     drops_retention_changed: true,
@@ -961,6 +967,30 @@ export const isMapLive = (value: unknown): value is MapLive =>
     orNull(isTimestamp)(value.at) &&
     isCount(value.waiting) &&
     isFlag(value.onesync);
+const UNAVAILABLE = { onesync: true, game: true } satisfies Record<EntitiesUnavailable, true>;
+
+const isEntityCounts = (value: unknown): value is EntityCounts =>
+    isRecord(value) &&
+    orNull(isCount)(value.vehicles) &&
+    orNull(isCount)(value.peds) &&
+    orNull(isCount)(value.objects) &&
+    isCount(value.playerPeds);
+
+export const isEntitiesLive = (value: unknown): value is EntitiesLive =>
+    isRecord(value) &&
+    orNull(isText)(value.run) &&
+    isCount(value.sweep) &&
+    orNull(isTimestamp)(value.at) &&
+    orNull(oneOf<EntitiesUnavailable>(UNAVAILABLE))(value.unavailable) &&
+    orNull(isEntityCounts)(value.counts) &&
+    isCount(value.listed) &&
+    isFlag(value.truncated) &&
+    isCount(value.everyMs) &&
+    isFlag(value.spaced) &&
+    orNull(isCount)(value.workUs) &&
+    orNull(isCount)(value.listUs) &&
+    orNull(isCount)(value.frames);
+
 const isSnapshotData = (topic: Topic, data: unknown) => {
     if (!isRecord(data)) {
         return false;
@@ -993,6 +1023,8 @@ const isSnapshotData = (topic: Topic, data: unknown) => {
             return isChangesLive(data);
         case 'server.map':
             return isMapLive(data);
+        case 'server.entities':
+            return isEntitiesLive(data);
     }
 };
 
@@ -1020,6 +1052,8 @@ const isEventData = (topic: Topic, data: unknown) => {
             return isChangesLive(data);
         case 'server.map':
             return isMapLive(data);
+        case 'server.entities':
+            return isEntitiesLive(data);
     }
 };
 
diff --git a/web/src/settings/catalog.ts b/web/src/settings/catalog.ts
index 797a08ba..50d0d8ab 100644
--- a/web/src/settings/catalog.ts
+++ b/web/src/settings/catalog.ts
@@ -48,6 +48,7 @@ export type SettingId =
     | 'switchDrops'
     | 'switchUpdates'
     | 'switchDebug'
+    | 'switchEntities'
     | 'changesEnabled'
     | 'startEvent'
     | 'extensions'
@@ -196,6 +197,7 @@ export const CATEGORIES: readonly Category[] = [
             { id: 'switchDrops' },
             { id: 'switchUpdates' },
             { id: 'switchDebug' },
+            { id: 'switchEntities' },
         ],
     },
     {
@@ -281,6 +283,7 @@ export const SWITCH_OF = {
     drops: 'switchDrops',
     updates: 'switchUpdates',
     debug: 'switchDebug',
+    entities: 'switchEntities',
 } satisfies Record<Feature, SettingId>;
 
 /** When each setting applies, found by its id. */

From 7416271eca9c59e2b448a3ac206d55e56499f3fa Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 05:20:16 +0100
Subject: [PATCH 4/9] feat(web): list, filter and sort the server's entities on
 a page of their own, and delete a selection of them

---
 web/src/api/entities.ts                | 128 ++++
 web/src/components/Checkbox.tsx        |  27 +-
 web/src/components/SelectField.tsx     |  57 ++
 web/src/entities/DeleteDialog.test.tsx | 125 ++++
 web/src/entities/DeleteDialog.tsx      | 194 ++++++
 web/src/entities/live.test.tsx         |  96 +++
 web/src/entities/live.ts               |  28 +
 web/src/entities/marks.tsx             |  26 +
 web/src/entities/model.test.ts         | 119 ++++
 web/src/entities/model.ts              |  70 +++
 web/src/entities/search.test.ts        | 103 ++++
 web/src/entities/search.ts             | 126 ++++
 web/src/entities/selection.test.ts     |  99 +++
 web/src/entities/selection.ts          |  76 +++
 web/src/entities/words.ts              |  18 +
 web/src/i18n/en.ts                     | 134 +++++
 web/src/pages/EntitiesPage.test.tsx    | 358 +++++++++++
 web/src/pages/EntitiesPage.tsx         | 798 +++++++++++++++++++++++++
 web/src/router.tsx                     |  17 +
 web/src/shell/AppShell.test.tsx        |   1 +
 web/src/shell/nav.ts                   |   9 +
 21 files changed, 2604 insertions(+), 5 deletions(-)
 create mode 100644 web/src/api/entities.ts
 create mode 100644 web/src/components/SelectField.tsx
 create mode 100644 web/src/entities/DeleteDialog.test.tsx
 create mode 100644 web/src/entities/DeleteDialog.tsx
 create mode 100644 web/src/entities/live.test.tsx
 create mode 100644 web/src/entities/live.ts
 create mode 100644 web/src/entities/marks.tsx
 create mode 100644 web/src/entities/model.test.ts
 create mode 100644 web/src/entities/model.ts
 create mode 100644 web/src/entities/search.test.ts
 create mode 100644 web/src/entities/search.ts
 create mode 100644 web/src/entities/selection.test.ts
 create mode 100644 web/src/entities/selection.ts
 create mode 100644 web/src/entities/words.ts
 create mode 100644 web/src/pages/EntitiesPage.test.tsx
 create mode 100644 web/src/pages/EntitiesPage.tsx

diff --git a/web/src/api/entities.ts b/web/src/api/entities.ts
new file mode 100644
index 00000000..daa66cf2
--- /dev/null
+++ b/web/src/api/entities.ts
@@ -0,0 +1,128 @@
+import { queryOptions } from '@tanstack/react-query';
+
+import { getJson, send } from './client';
+import type { EntitiesSettings } from './generated/EntitiesSettings';
+import type { EntityDeleteRequest } from './generated/EntityDeleteRequest';
+import type { EntityDeletion } from './generated/EntityDeletion';
+import type { EntityKind } from './generated/EntityKind';
+import type { EntityMap } from './generated/EntityMap';
+import type { EntityPage } from './generated/EntityPage';
+import type { EntitySort } from './generated/EntitySort';
+import type { MapBounds } from './generated/MapBounds';
+import type { VehicleClass } from './generated/VehicleClass';
+
+const PATH = '/servers/default/entities';
+
+/** Every query about the list: what a sweep or a deletion changes. */
+export const allEntities = { queryKey: ['entities', 'list'] };
+
+/** Which entities a list or the map shows. */
+export type EntityFilters = {
+    /** None for every kind. */
+    kinds: EntityKind[];
+    class: VehicleClass | null;
+    /** A resource's name, '' for the entities no resource created, null for any. */
+    resource: string | null;
+    /** A number is the net id of the player whose game simulates the entity. */
+    owner: 'any' | 'none' | 'owned' | number;
+    bucket: number | null;
+    search: string;
+};
+
+export const NO_FILTERS: EntityFilters = {
+    kinds: [],
+    class: null,
+    resource: null,
+    owner: 'any',
+    bucket: null,
+    search: '',
+};
+
+export type EntityListing = EntityFilters & { sort: EntitySort; descending: boolean; page: number };
+
+export const FIRST_PAGE: EntityListing = { ...NO_FILTERS, sort: 'model', descending: false, page: 0 };
+
+/** The filters as the API reads them, each left out while it filters nothing. */
+const filterParams = (filters: EntityFilters) => {
+    const query = new URLSearchParams();
+    if (filters.kinds.length > 0) {
+        query.set('kinds', filters.kinds.join(','));
+    }
+    if (filters.class !== null) {
+        query.set('class', filters.class);
+    }
+    if (filters.resource !== null) {
+        query.set('resource', filters.resource);
+    }
+    if (filters.owner !== 'any') {
+        query.set('owner', String(filters.owner));
+    }
+    if (filters.bucket !== null) {
+        query.set('bucket', String(filters.bucket));
+    }
+    if (filters.search.trim() !== '') {
+        query.set('search', filters.search.trim());
+    }
+    return query;
+};
+
+const asSearch = (query: URLSearchParams) => {
+    const text = query.toString();
+    return text === '' ? '' : `?${text}`;
+};
+
+export const entitiesSearch = (listing: EntityListing) => {
+    const query = filterParams(listing);
+    if (listing.sort !== FIRST_PAGE.sort) {
+        query.set('sort', listing.sort);
+    }
+    if (listing.descending) {
+        query.set('descending', 'true');
+    }
+    if (listing.page > 0) {
+        query.set('page', String(listing.page));
+    }
+    return asSearch(query);
+};
+
+export const entitiesQuery = (listing: EntityListing) =>
+    queryOptions({
+        queryKey: ['entities', 'list', 'page', listing],
+        queryFn: ({ signal }) => getJson<EntityPage>(`${PATH}${entitiesSearch(listing)}`, signal),
+    });
+
+/** One entity as the last sweep saw it, by its net id alone. */
+export const entityQuery = (netId: number) =>
+    entitiesQuery({ ...FIRST_PAGE, sort: 'netId', search: `#${netId}` });
+
+export const entitiesMapSearch = (filters: EntityFilters, cell: number, bounds: MapBounds | null) => {
+    const query = filterParams(filters);
+    query.set('cell', String(cell));
+    if (bounds !== null) {
+        for (const edge of ['west', 'east', 'south', 'north'] as const) {
+            query.set(edge, String(bounds[edge]));
+        }
+    }
+    return asSearch(query);
+};
+
+export const entitiesMapQuery = (filters: EntityFilters, cell: number, bounds: MapBounds | null) =>
+    queryOptions({
+        queryKey: ['entities', 'list', 'map', filters, cell, bounds],
+        queryFn: ({ signal }) =>
+            getJson<EntityMap>(`${PATH}/map${entitiesMapSearch(filters, cell, bounds)}`, signal),
+    });
+
+export const deleteEntities = (request: EntityDeleteRequest) =>
+    send<EntityDeletion>('POST', `${PATH}/delete`, request);
+
+export const entitiesSettingsQuery = queryOptions({
+    queryKey: ['entities', 'settings'],
+    queryFn: ({ signal }) => getJson<EntitiesSettings>(`${PATH}/settings`, signal),
+});
+
+export const saveEntitiesSettings = (settings: EntitiesSettings) =>
+    send<EntitiesSettings>('PUT', `${PATH}/settings`, settings);
+
+/** How often the server may list its entities, in seconds, as the API takes it. */
+export const CADENCES = [5, 10, 15, 30, 60] as const;
diff --git a/web/src/components/Checkbox.tsx b/web/src/components/Checkbox.tsx
index 6f6b9bbb..c850cab5 100644
--- a/web/src/components/Checkbox.tsx
+++ b/web/src/components/Checkbox.tsx
@@ -3,20 +3,37 @@ import type { ComponentProps } from 'react';
 
 import { cn } from '../lib/cn';
 
-/** The native checkbox, kept for keyboard and forms, drawn as the design's 18px box. */
-export function Checkbox({ className, ...props }: Omit<ComponentProps<'input'>, 'type'>) {
+/**
+ * The native checkbox, kept for keyboard and forms, drawn as the design's 18px box. `indeterminate`
+ * draws a dash: some of what it stands for is checked.
+ */
+export function Checkbox({
+    className,
+    indeterminate = false,
+    ...props
+}: Omit<ComponentProps<'input'>, 'type' | 'ref'> & { indeterminate?: boolean }) {
     return (
         <span className={cn('relative mt-px inline-grid size-4.5 flex-none place-items-center', className)}>
             <input
                 type="checkbox"
-                className="peer absolute inset-0 m-0 cursor-pointer opacity-0"
+                ref={(input) => {
+                    if (input !== null) {
+                        input.indeterminate = indeterminate;
+                    }
+                }}
+                className="peer absolute inset-0 m-0 cursor-pointer opacity-0 disabled:cursor-not-allowed"
                 {...props}
             />
             <span
                 aria-hidden="true"
-                className="pointer-events-none grid size-4.5 place-items-center rounded-[5px] border border-line-strong bg-surface text-btn-ink transition-[background-color,border-color] peer-checked:border-btn peer-checked:bg-btn peer-focus-visible:outline-2 peer-focus-visible:outline-offset-2 peer-focus-visible:outline-accent peer-disabled:opacity-45 peer-checked:[&>svg]:opacity-100"
+                className="pointer-events-none grid size-4.5 place-items-center rounded-[5px] border border-line-strong bg-surface text-btn-ink transition-[background-color,border-color] peer-checked:border-btn peer-checked:bg-btn peer-indeterminate:border-btn peer-indeterminate:bg-btn peer-focus-visible:outline-2 peer-focus-visible:outline-offset-2 peer-focus-visible:outline-accent peer-disabled:opacity-45 peer-checked:[&>svg]:opacity-100 peer-indeterminate:[&>i]:opacity-100"
             >
-                <Check size={12} strokeWidth={2.5} className="opacity-0 transition-opacity" />
+                <Check
+                    size={12}
+                    strokeWidth={2.5}
+                    className="col-start-1 row-start-1 opacity-0 transition-opacity"
+                />
+                <i className="col-start-1 row-start-1 h-0.5 w-2 rounded-full bg-btn-ink opacity-0" />
             </span>
         </span>
     );
diff --git a/web/src/components/SelectField.tsx b/web/src/components/SelectField.tsx
new file mode 100644
index 00000000..88d91f32
--- /dev/null
+++ b/web/src/components/SelectField.tsx
@@ -0,0 +1,57 @@
+import { ChevronDown } from 'lucide-react';
+import { useId } from 'react';
+
+import { cn } from '../lib/cn';
+import { inputClass } from './Field';
+
+/** A labelled choice among a few, on the native select drawn as the panel's fields. */
+export function SelectField<Value extends string>({
+    label,
+    value,
+    choices,
+    onChange,
+    narrowed = false,
+    className,
+}: {
+    label: string;
+    value: Value;
+    choices: readonly { value: Value; label: string }[];
+    onChange: (value: Value) => void;
+    /** The choice narrows what the page shows: its border says so. */
+    narrowed?: boolean;
+    className?: string;
+}) {
+    const id = useId();
+    return (
+        <div className={cn('flex min-w-0 flex-col gap-1.5', className)}>
+            <label htmlFor={id} className="text-ui font-medium text-ink">
+                {label}
+            </label>
+            <div className="relative">
+                <select
+                    id={id}
+                    className={cn(inputClass, 'appearance-none truncate pr-9', narrowed && 'border-ink-3')}
+                    value={value}
+                    onChange={(event) => {
+                        const picked = choices.find((choice) => choice.value === event.target.value);
+                        if (picked !== undefined) {
+                            onChange(picked.value);
+                        }
+                    }}
+                >
+                    {choices.map((choice) => (
+                        <option key={choice.value} value={choice.value}>
+                            {choice.label}
+                        </option>
+                    ))}
+                </select>
+                <ChevronDown
+                    size={16}
+                    strokeWidth={1.5}
+                    className="pointer-events-none absolute top-1/2 right-3 -translate-y-1/2 text-ink-3"
+                    aria-hidden="true"
+                />
+            </div>
+        </div>
+    );
+}
diff --git a/web/src/entities/DeleteDialog.test.tsx b/web/src/entities/DeleteDialog.test.tsx
new file mode 100644
index 00000000..27929a2b
--- /dev/null
+++ b/web/src/entities/DeleteDialog.test.tsx
@@ -0,0 +1,125 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
+
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityResult } from '../api/generated/EntityResult';
+import { en } from '../i18n/en';
+import { I18nProvider } from '../i18n/I18nProvider';
+import { DeleteDialog } from './DeleteDialog';
+
+const words = en.entities.dialog;
+
+const item = (netId: number, changes: Partial<EntityItem> = {}): EntityItem => ({
+    netId,
+    serial: netId * 10,
+    kind: 'vehicle',
+    class: 'car',
+    model: 0x3c4e2113,
+    x: 0,
+    y: 0,
+    z: 0,
+    owned: false,
+    owner: null,
+    ownerName: null,
+    bucket: 0,
+    population: 5,
+    resource: null,
+    resourcePending: false,
+    occupied: false,
+    ...changes,
+});
+
+/** The dialog over `items`, the server answering a deletion with `reply`. */
+const open = (items: EntityItem[], reply: () => Response = () => Response.json({ results: [] })) => {
+    const fetch = vi.fn(async () => reply());
+    vi.stubGlobal('fetch', fetch);
+    const done: EntityResult[][] = [];
+    render(
+        <I18nProvider>
+            <QueryClientProvider client={new QueryClient()}>
+                <DeleteDialog
+                    items={items}
+                    run="3-52100"
+                    limits={{ typedConfirmationFrom: 20 }}
+                    onClose={() => {}}
+                    onDone={(results) => done.push(results)}
+                />
+            </QueryClientProvider>
+        </I18nProvider>,
+    );
+    return { fetch, done };
+};
+
+describe('DeleteDialog', () => {
+    beforeAll(() => {
+        HTMLDialogElement.prototype.showModal ??= function (this: HTMLDialogElement) {
+            this.open = true;
+        };
+        HTMLDialogElement.prototype.close ??= function (this: HTMLDialogElement) {
+            this.open = false;
+        };
+    });
+
+    afterEach(() => {
+        cleanup();
+        vi.unstubAllGlobals();
+    });
+
+    it('should say what a selection is made of and what may still expect it', () => {
+        open([
+            ...Array.from({ length: 3 }, (_, index) =>
+                item(index + 1, { resource: 'qb-garages', population: 7, owned: true }),
+            ),
+            item(9, { kind: 'object', class: null, model: 0xe0faf6d2 }),
+        ]);
+
+        expect(screen.getByText(words.title(4))).toBeTruthy();
+        expect(screen.getByText('0x3C4E2113')).toBeTruthy();
+        expect(screen.getByText(words.times(3))).toBeTruthy();
+        expect(screen.getByText(words.scripted(3))).toBeTruthy();
+        expect(screen.getByText(words.owned(3))).toBeTruthy();
+        // Under twenty, no word to type.
+        expect(screen.queryByRole('textbox')).toBeNull();
+        expect(screen.getByRole<HTMLButtonElement>('button', { name: words.confirm(4) }).disabled).toBe(
+            false,
+        );
+    });
+
+    it('should name the one entity and the resource that created it', () => {
+        open([item(1042, { resource: 'qb-garages', population: 7 })]);
+
+        expect(screen.getByText(words.titleOne('Car'))).toBeTruthy();
+        expect(screen.getByText(words.createdBy('qb-garages'))).toBeTruthy();
+        expect(screen.getByRole('button', { name: words.confirmOne })).toBeTruthy();
+    });
+
+    it('should ask for the word before deleting twenty entities or more', async () => {
+        const { fetch, done } = open(
+            Array.from({ length: 20 }, (_, index) => item(index + 1)),
+            () => Response.json({ results: [{ netId: 1, outcome: 'deleted' }] }),
+        );
+        const confirm = screen.getByRole<HTMLButtonElement>('button', { name: words.confirm(20) });
+
+        expect(confirm.disabled).toBe(true);
+        fireEvent.change(screen.getByLabelText(words.type(words.word, 20)), { target: { value: 'delete' } });
+        expect(confirm.disabled).toBe(true);
+        fireEvent.change(screen.getByLabelText(words.type(words.word, 20)), { target: { value: 'DELETE' } });
+        expect(confirm.disabled).toBe(false);
+
+        fireEvent.click(confirm);
+        await waitFor(() => expect(done).toEqual([[{ netId: 1, outcome: 'deleted' }]]));
+        expect(fetch).toHaveBeenCalledTimes(1);
+    });
+
+    it('should stay open and say why when the server refuses the deletion', async () => {
+        const { done } = open([item(1)], () =>
+            Response.json({ code: 'entities_out_of_date', params: {} }, { status: 409 }),
+        );
+
+        fireEvent.click(screen.getByRole('button', { name: words.confirmOne }));
+
+        await waitFor(() => expect(screen.getByText(en.errors.entities_out_of_date)).toBeTruthy());
+        expect(done).toEqual([]);
+    });
+});
diff --git a/web/src/entities/DeleteDialog.tsx b/web/src/entities/DeleteDialog.tsx
new file mode 100644
index 00000000..8620dbdf
--- /dev/null
+++ b/web/src/entities/DeleteDialog.tsx
@@ -0,0 +1,194 @@
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { Trash2, TriangleAlert } from 'lucide-react';
+import { useState, type ReactNode } from 'react';
+
+import { allEntities, deleteEntities } from '../api/entities';
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityLimits } from '../api/generated/EntityLimits';
+import type { EntityResult } from '../api/generated/EntityResult';
+import { Button } from '../components/Button';
+import { Dialog } from '../components/Dialog';
+import { TextField } from '../components/Field';
+import { Notice } from '../components/Notice';
+import { errorMessage } from '../i18n/errors';
+import { useI18n } from '../i18n/I18nProvider';
+import { EntityMark, kindWord } from './marks';
+import { breakdown, modelHash, scripted } from './model';
+
+/**
+ * Asks before deleting: what the selection is made of, what may go wrong, and from the number the
+ * server sets, a word to type. The server checks each entity again; `onDone` gets what became of each.
+ */
+export function DeleteDialog({
+    items,
+    run,
+    limits,
+    onClose,
+    onDone,
+}: {
+    items: readonly EntityItem[];
+    /** The `run` of the list the entities were picked in. */
+    run: string;
+    limits: Pick<EntityLimits, 'typedConfirmationFrom'>;
+    onClose: () => void;
+    onDone: (results: EntityResult[]) => void;
+}) {
+    const { t } = useI18n();
+    const words = t.entities.dialog;
+    const client = useQueryClient();
+    const [typed, setTyped] = useState('');
+    const [only] = items;
+    const single = items.length === 1 && only !== undefined ? only : null;
+    const made = breakdown(items);
+    const mustType = items.length >= limits.typedConfirmationFrom;
+    const confirmed = !mustType || typed.trim() === words.word;
+    const remove = useMutation({
+        mutationFn: () =>
+            deleteEntities({
+                run,
+                targets: items.map(({ netId, serial, model }) => ({ netId, serial, model })),
+            }),
+        onSuccess: async ({ results }) => {
+            await client.invalidateQueries(allEntities);
+            onDone(results);
+        },
+    });
+
+    return (
+        <Dialog
+            role="alertdialog"
+            title={single === null ? words.title(items.length) : words.titleOne(kindWord(t, single))}
+            onClose={onClose}
+            closeOnBackdrop={typed === ''}
+            onSubmit={() => {
+                if (confirmed && !remove.isPending) {
+                    remove.mutate();
+                }
+            }}
+            footer={
+                <>
+                    <Button tone="ghost" onClick={onClose}>
+                        {t.common.cancel}
+                    </Button>
+                    <Button
+                        type="submit"
+                        tone="danger"
+                        icon={Trash2}
+                        disabled={!confirmed}
+                        pending={remove.isPending}
+                    >
+                        {single === null ? words.confirm(items.length) : words.confirmOne}
+                    </Button>
+                </>
+            }
+        >
+            <p>{single === null ? words.body : words.bodyOne}</p>
+            <ul className="flex flex-col overflow-hidden rounded-box border border-line bg-bg-subtle text-ui">
+                {single === null ? (
+                    <>
+                        {made.groups.map((group) => (
+                            <li
+                                key={`${group.model}:${group.kind}:${group.resource ?? ''}`}
+                                className="flex items-center gap-2.5 border-t border-line px-3 py-2 first:border-t-0"
+                            >
+                                <EntityMark kind={group.kind} />
+                                <span className="font-mono text-small text-ink">
+                                    {modelHash(group.model)}
+                                </span>
+                                <span className="min-w-0 flex-1 truncate text-ink-3">
+                                    {group.resource ?? t.entities.noResource}
+                                </span>
+                                <span className="font-mono text-small text-ink-2">
+                                    {words.times(group.count)}
+                                </span>
+                            </li>
+                        ))}
+                        {made.more > 0 && (
+                            <li className="border-t border-line px-3 py-2 text-ink-3">
+                                {words.more(made.more)}
+                            </li>
+                        )}
+                    </>
+                ) : (
+                    <li className="flex items-center gap-2.5 px-3 py-2">
+                        <EntityMark kind={single.kind} />
+                        <span className="font-mono text-small text-ink">{modelHash(single.model)}</span>
+                        <span className="min-w-0 flex-1 truncate text-ink-3">
+                            {[
+                                single.resource ?? t.entities.noResource,
+                                t.entities.netId(single.netId),
+                                t.entities.bucketOf(single.bucket),
+                            ].join(' · ')}
+                        </span>
+                    </li>
+                )}
+            </ul>
+            <Warnings>
+                {single === null ? (
+                    <>
+                        {made.scripted > 0 && (
+                            <Warning>
+                                <b className="font-semibold">{words.scripted(made.scripted)}</b>{' '}
+                                {words.scriptedWhy}
+                            </Warning>
+                        )}
+                        {made.owned > 0 && (
+                            <Warning>
+                                <b className="font-semibold">{words.owned(made.owned)}</b>
+                            </Warning>
+                        )}
+                    </>
+                ) : (
+                    <>
+                        {single.resource !== null && (
+                            <Warning>
+                                <b className="font-semibold">{words.createdBy(single.resource)}</b>
+                                {words.createdByWhy}
+                            </Warning>
+                        )}
+                        {single.resource === null && scripted(single) && (
+                            <Warning>
+                                <b className="font-semibold">{words.scripted(1)}</b> {words.scriptedWhy}
+                            </Warning>
+                        )}
+                        {single.owned && (
+                            <Warning>
+                                <b className="font-semibold">{words.ownedOne}</b>
+                            </Warning>
+                        )}
+                    </>
+                )}
+            </Warnings>
+            {mustType && (
+                <TextField
+                    label={words.type(words.word, items.length)}
+                    value={typed}
+                    spellCheck={false}
+                    autoCapitalize="characters"
+                    autoComplete="off"
+                    inputClassName="font-mono text-ui"
+                    onChange={(event) => setTyped(event.target.value)}
+                />
+            )}
+            {remove.isError && <Notice tone="danger">{errorMessage(t, remove.error)}</Notice>}
+        </Dialog>
+    );
+}
+
+/** What may go wrong, gathered in one box; nothing when nothing may. */
+function Warnings({ children }: { children: ReactNode }) {
+    return (
+        <div className="flex flex-col gap-1.5 rounded-box bg-warning-soft px-3.5 py-3 text-small text-warning empty:hidden">
+            {children}
+        </div>
+    );
+}
+
+function Warning({ children }: { children: ReactNode }) {
+    return (
+        <p className="flex items-start gap-2.5">
+            <TriangleAlert size={16} strokeWidth={1.5} className="mt-px flex-none" aria-hidden="true" />
+            <span>{children}</span>
+        </p>
+    );
+}
diff --git a/web/src/entities/live.test.tsx b/web/src/entities/live.test.tsx
new file mode 100644
index 00000000..f8b6ddc8
--- /dev/null
+++ b/web/src/entities/live.test.tsx
@@ -0,0 +1,96 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { act, cleanup, render } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { allEntities } from '../api/entities';
+import type { EntitiesLive } from '../api/generated/EntitiesLive';
+import { LiveContext } from '../live/context';
+import { Realtime, type SocketEvents } from '../live/realtime';
+import { useEntitiesLive } from './live';
+
+const settle = () => act(() => new Promise((resolve) => setTimeout(resolve, 0)));
+
+const SWEPT: EntitiesLive = {
+    run: '3-52100',
+    sweep: 1,
+    at: '2026-11-11T20:00:00Z',
+    unavailable: null,
+    counts: { vehicles: 2, peds: 1, objects: 4, playerPeds: 1 },
+    listed: 6,
+    truncated: false,
+    everyMs: 15_000,
+    spaced: false,
+    workUs: 900,
+    listUs: 120,
+    frames: 1,
+};
+
+/** `server.entities` as the test says it, and what the hook makes of it. */
+const follow = async () => {
+    let socket: SocketEvents | undefined;
+    const sent: string[] = [];
+    const live = new Realtime({
+        ticket: async () => 'ticket',
+        connect: (_, events) => {
+            socket = events;
+            return { send: (message) => sent.push(message), close: () => {} };
+        },
+        refetch: () => {},
+    });
+    const client = new QueryClient();
+    const asked = vi.spyOn(client, 'invalidateQueries');
+    const states: (EntitiesLive | null)[] = [];
+    function Follower() {
+        states.push(useEntitiesLive());
+        return null;
+    }
+    render(
+        <QueryClientProvider client={client}>
+            <LiveContext value={live}>
+                <Follower />
+            </LiveContext>
+        </QueryClientProvider>,
+    );
+    live.start();
+    await settle();
+    act(() => socket?.message(JSON.stringify({ type: 'hello', connectionId: 1, contract: 1 })));
+    const say = (type: 'snapshot' | 'event', data: EntitiesLive) =>
+        act(() => socket?.message(JSON.stringify({ type, topic: 'server.entities', data })));
+    return { say, sent, asked, last: () => states.at(-1) };
+};
+
+describe('useEntitiesLive', () => {
+    afterEach(cleanup);
+
+    it('should follow the topic, which is what keeps the server listing', async () => {
+        const { sent, last } = await follow();
+
+        expect(sent.some((message) => message.includes('server.entities'))).toBe(true);
+        expect(last()).toBeNull();
+    });
+
+    it('should ask the list again at each new sweep, and not for the state it opens on', async () => {
+        const { say, asked, last } = await follow();
+
+        say('snapshot', SWEPT);
+        expect(last()).toEqual(SWEPT);
+        expect(asked).not.toHaveBeenCalled();
+
+        say('event', { ...SWEPT, sweep: 2 });
+        expect(last()?.sweep).toBe(2);
+        expect(asked).toHaveBeenCalledExactlyOnceWith(allEntities);
+
+        // The same sweep said twice changes nothing of the list.
+        say('event', { ...SWEPT, sweep: 2 });
+        expect(asked).toHaveBeenCalledTimes(1);
+    });
+
+    it('should ask the list again once the server restarted, whose sweeps count from 1 again', async () => {
+        const { say, asked } = await follow();
+
+        say('snapshot', SWEPT);
+        say('event', { ...SWEPT, run: '4-900' });
+
+        expect(asked).toHaveBeenCalledExactlyOnceWith(allEntities);
+    });
+});
diff --git a/web/src/entities/live.ts b/web/src/entities/live.ts
new file mode 100644
index 00000000..a4bb9c94
--- /dev/null
+++ b/web/src/entities/live.ts
@@ -0,0 +1,28 @@
+import { useQueryClient } from '@tanstack/react-query';
+import { useRef, useState } from 'react';
+
+import { allEntities } from '../api/entities';
+import type { EntitiesLive } from '../api/generated/EntitiesLive';
+import { useTopic } from '../live/context';
+
+/**
+ * The state of the list while the component is mounted, or null while the link is down. Following
+ * it is what keeps the server listing its entities; each new sweep asks the list again.
+ */
+export const useEntitiesLive = () => {
+    const client = useQueryClient();
+    const [live, setLive] = useState<EntitiesLive | null>(null);
+    const seen = useRef<string | null>(null);
+    const took = (next: EntitiesLive) => {
+        setLive(next);
+        const sweep = `${next.run ?? ''}:${next.sweep}`;
+        // The first state is no newer than the list the page asks for as it opens.
+        if (seen.current !== null && seen.current !== sweep) {
+            void client.invalidateQueries(allEntities);
+        }
+        seen.current = sweep;
+    };
+    const lost = () => setLive(null);
+    useTopic('server.entities', { snapshot: took, event: took, refused: lost, cleared: lost });
+    return live;
+};
diff --git a/web/src/entities/marks.tsx b/web/src/entities/marks.tsx
new file mode 100644
index 00000000..13ea2dea
--- /dev/null
+++ b/web/src/entities/marks.tsx
@@ -0,0 +1,26 @@
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityKind } from '../api/generated/EntityKind';
+import type { Messages } from '../i18n/en';
+import { cn } from '../lib/cn';
+import { modelHash } from './model';
+
+/** The mark of each kind, in the list as on the map: a shape each, since a colour never says it alone. */
+const MARKS: Record<EntityKind, string> = {
+    vehicle: 'size-2.5 rounded-full bg-term-cyan',
+    ped: 'size-[9px] rotate-45 bg-term-magenta',
+    object: 'size-2 rounded-[1.5px] bg-ink-3',
+};
+
+export function EntityMark({ kind, className }: { kind: EntityKind; className?: string }) {
+    return <span aria-hidden="true" className={cn('inline-block flex-none', MARKS[kind], className)} />;
+}
+
+/** What an entity is called: a vehicle by its class, the others by their kind. */
+export const kindWord = (t: Messages, item: Pick<EntityItem, 'kind' | 'class'>) =>
+    item.kind === 'vehicle' && item.class !== null
+        ? t.entities.classes[item.class]
+        : t.entities.kindNames[item.kind];
+
+/** An entity said whole, for the controls that act on it. */
+export const entityName = (t: Messages, item: Pick<EntityItem, 'kind' | 'class' | 'model' | 'netId'>) =>
+    t.entities.named(kindWord(t, item), modelHash(item.model), item.netId);
diff --git a/web/src/entities/model.test.ts b/web/src/entities/model.test.ts
new file mode 100644
index 00000000..4c54c790
--- /dev/null
+++ b/web/src/entities/model.test.ts
@@ -0,0 +1,119 @@
+import { describe, expect, it } from 'vitest';
+
+import type { EntityItem } from '../api/generated/EntityItem';
+import { blocker, breakdown, isStale, keyOf, modelHash, outcomes, scripted } from './model';
+
+const item = (changes: Partial<EntityItem>): EntityItem => ({
+    netId: 1,
+    serial: 11,
+    kind: 'vehicle',
+    class: 'car',
+    model: 0xb779a091,
+    x: 0,
+    y: 0,
+    z: 0,
+    owned: false,
+    owner: null,
+    ownerName: null,
+    bucket: 0,
+    population: 5,
+    resource: null,
+    resourcePending: false,
+    occupied: false,
+    ...changes,
+});
+
+describe('modelHash', () => {
+    it("should write a hash as the game's tools do", () => {
+        expect(modelHash(0xb779a091)).toBe('0xB779A091');
+        expect(modelHash(7)).toBe('0x00000007');
+        expect(modelHash(0)).toBe('0x00000000');
+    });
+});
+
+describe('keyOf', () => {
+    it('should tell two entities that took the same net id apart', () => {
+        expect(keyOf(item({ netId: 12, serial: 3 }))).not.toBe(keyOf(item({ netId: 12, serial: 4 })));
+    });
+});
+
+describe('blocker', () => {
+    it('should never offer a vehicle a player sits in, nor a train', () => {
+        expect(blocker(item({ occupied: true }))).toBe('occupied');
+        expect(blocker(item({ class: 'train' }))).toBe('train');
+        expect(blocker(item({}))).toBeNull();
+        expect(blocker(item({ kind: 'object', class: null }))).toBeNull();
+    });
+});
+
+describe('scripted', () => {
+    it("should take a resource's entity and a client script's for a script's", () => {
+        expect(scripted(item({ resource: 'qb-garages' }))).toBe(true);
+        expect(scripted(item({ population: 7 }))).toBe(true);
+        expect(scripted(item({}))).toBe(false);
+    });
+});
+
+describe('isStale', () => {
+    const at = '2026-11-11T20:00:00Z';
+    const after = (ms: number) => Date.parse(at) + ms;
+
+    it("should call a list out of date three sweeps after the last one, on the server's cadence", () => {
+        expect(isStale({ at, everyMs: 15_000 }, after(45_000), 3)).toBe(false);
+        expect(isStale({ at, everyMs: 15_000 }, after(45_001), 3)).toBe(true);
+        expect(isStale({ at, everyMs: 60_000 }, after(120_000), 3)).toBe(false);
+    });
+
+    it('should not call out of date a list that never came', () => {
+        expect(isStale({ at: null, everyMs: 15_000 }, after(1_000_000), 3)).toBe(false);
+    });
+});
+
+describe('breakdown', () => {
+    it('should name the largest groups and count the rest', () => {
+        const items = [
+            ...Array.from({ length: 4 }, (_, index) =>
+                item({ netId: index, resource: 'qb-garages', owned: true }),
+            ),
+            item({ netId: 10, model: 1 }),
+            item({ netId: 11, model: 2 }),
+            item({ netId: 12, model: 3, population: 7 }),
+            item({ netId: 13, model: 4, kind: 'object', class: null }),
+            item({ netId: 14, model: 5 }),
+        ];
+
+        const made = breakdown(items);
+
+        expect(made.groups[0]).toEqual({
+            model: 0xb779a091,
+            kind: 'vehicle',
+            resource: 'qb-garages',
+            count: 4,
+        });
+        expect(made.groups.map((group) => group.model)).toEqual([0xb779a091, 1, 2, 3, 4]);
+        expect(made.more).toBe(1);
+        expect(made.scripted).toBe(5);
+        expect(made.owned).toBe(4);
+    });
+});
+
+describe('outcomes', () => {
+    it('should count what was deleted and what was not, by what became of it', () => {
+        const summary = outcomes([
+            { netId: 1, outcome: 'deleted' },
+            { netId: 2, outcome: 'occupied' },
+            { netId: 3, outcome: 'gone' },
+            { netId: 4, outcome: 'occupied' },
+            { netId: 5, outcome: 'deleted' },
+        ]);
+
+        expect(summary).toEqual({
+            asked: 5,
+            deleted: 2,
+            others: [
+                ['occupied', 2],
+                ['gone', 1],
+            ],
+        });
+    });
+});
diff --git a/web/src/entities/model.ts b/web/src/entities/model.ts
new file mode 100644
index 00000000..7206faa6
--- /dev/null
+++ b/web/src/entities/model.ts
@@ -0,0 +1,70 @@
+import type { EntitiesLive } from '../api/generated/EntitiesLive';
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityKind } from '../api/generated/EntityKind';
+import type { EntityOutcome } from '../api/generated/EntityOutcome';
+import type { EntityResult } from '../api/generated/EntityResult';
+
+/** `GetEntityPopulationType` for what a script created. */
+const POPULATION_SCRIPT = 7;
+/** The groups a deletion's dialog names, past which the rest is only counted. */
+const MOST_GROUPS = 5;
+
+/** A model's hash as the game's tools write it: `0xB779A091`. The server knows no other name for it. */
+export const modelHash = (model: number) => `0x${(model >>> 0).toString(16).toUpperCase().padStart(8, '0')}`;
+
+/** A net id and the serial the bridge drew for the entity: net ids are used again. */
+export const keyOf = (item: Pick<EntityItem, 'netId' | 'serial'>) => `${item.netId}:${item.serial}`;
+
+/** Why the panel never offers to delete an entity, or null when it does. */
+export const blocker = (item: Pick<EntityItem, 'occupied' | 'class'>): 'occupied' | 'train' | null =>
+    item.occupied ? 'occupied' : item.class === 'train' ? 'train' : null;
+
+/** Whether a script created the entity, a resource of the server's or a client's. */
+export const scripted = (item: Pick<EntityItem, 'resource' | 'population'>) =>
+    item.resource !== null || item.population === POPULATION_SCRIPT;
+
+/**
+ * Whether the list is too old to delete from: the server stopped sweeping. The same rule as the
+ * server's, on its own cadence, so that the panel does not offer what the API would refuse.
+ */
+export const isStale = (live: Pick<EntitiesLive, 'at' | 'everyMs'>, now: number, sweeps: number) =>
+    live.at !== null && now - Date.parse(live.at) > sweeps * Math.max(live.everyMs, 1000);
+
+export type Group = { model: number; kind: EntityKind; resource: string | null; count: number };
+
+/** What a selection is made of: its largest groups, and what a deletion should warn about. */
+export const breakdown = (items: readonly EntityItem[]) => {
+    const groups = new Map<string, Group>();
+    for (const item of items) {
+        const key = `${item.model}:${item.kind}:${item.resource ?? ''}`;
+        const group = groups.get(key);
+        if (group === undefined) {
+            groups.set(key, { model: item.model, kind: item.kind, resource: item.resource, count: 1 });
+        } else {
+            group.count += 1;
+        }
+    }
+    const sorted = [...groups.values()].toSorted(
+        (left, right) => right.count - left.count || left.model - right.model,
+    );
+    return {
+        groups: sorted.slice(0, MOST_GROUPS),
+        more: sorted.slice(MOST_GROUPS).reduce((sum, group) => sum + group.count, 0),
+        scripted: items.filter(scripted).length,
+        owned: items.filter((item) => item.owned).length,
+    };
+};
+
+/** What became of the entities of a deletion: how many were deleted, and the others by outcome. */
+export const outcomes = (results: readonly EntityResult[]) => {
+    const others = new Map<Exclude<EntityOutcome, 'deleted'>, number>();
+    let deleted = 0;
+    for (const { outcome } of results) {
+        if (outcome === 'deleted') {
+            deleted += 1;
+        } else {
+            others.set(outcome, (others.get(outcome) ?? 0) + 1);
+        }
+    }
+    return { asked: results.length, deleted, others: [...others] };
+};
diff --git a/web/src/entities/search.test.ts b/web/src/entities/search.test.ts
new file mode 100644
index 00000000..cd71e04a
--- /dev/null
+++ b/web/src/entities/search.test.ts
@@ -0,0 +1,103 @@
+import { defaultParseSearch, defaultStringifySearch } from '@tanstack/react-router';
+import { describe, expect, it } from 'vitest';
+
+import { FIRST_PAGE } from '../api/entities';
+import { filtered, listingOf, parseEntitiesSearch, withFilters, withPage, withSort } from './search';
+
+/** The address as the router reads it, then as the page reads that. */
+const read = (address: string) => parseEntitiesSearch(defaultParseSearch(address));
+
+describe('parseEntitiesSearch', () => {
+    it('should read every filter the address holds, the sort and the page', () => {
+        expect(
+            read(
+                '?kind=vehicle&class=car&resource=qb-garages&owner=12&bucket=0&search=adder&sort=owner&descending=true&page=3',
+            ),
+        ).toEqual({
+            kind: 'vehicle',
+            class: 'car',
+            resource: 'qb-garages',
+            owner: 12,
+            bucket: 0,
+            search: 'adder',
+            sort: 'owner',
+            descending: true,
+            page: 3,
+        });
+    });
+
+    it('should leave out what it does not know and what the list opens on', () => {
+        expect(
+            read('?kind=plane&class=tank&owner=0&bucket=-1&search=%20%20&sort=model&descending=no&page=1'),
+        ).toEqual({});
+        expect(read('?owner=nobody&page=two&sort=size')).toEqual({});
+    });
+
+    it('should drop a class under a kind that has none', () => {
+        expect(read('?kind=ped&class=car')).toEqual({ kind: 'ped' });
+        expect(read('?class=train')).toEqual({ class: 'train' });
+    });
+
+    it('should keep an empty resource, which asks for the entities no resource created', () => {
+        expect(read('?resource=')).toEqual({ resource: '' });
+        expect(read(defaultStringifySearch({ resource: '' }))).toEqual({ resource: '' });
+        expect(listingOf(read('?resource=')).resource).toBe('');
+    });
+
+    it('should keep a resource or a search made of digits as text', () => {
+        expect(read('?resource=911&search=1885233650')).toEqual({ resource: '911', search: '1885233650' });
+    });
+
+    it('should cut a search at what the API takes', () => {
+        expect(read(`?search=${'a'.repeat(80)}`).search).toHaveLength(64);
+    });
+});
+
+describe('listingOf', () => {
+    it('should ask for the list as it opens when the address says nothing', () => {
+        expect(listingOf({})).toEqual(FIRST_PAGE);
+    });
+
+    it('should count pages from 0, as the API does', () => {
+        expect(listingOf({ kind: 'object', owner: 'none', page: 3 })).toEqual({
+            ...FIRST_PAGE,
+            kinds: ['object'],
+            owner: 'none',
+            page: 2,
+        });
+    });
+});
+
+describe('filtered', () => {
+    it('should not take a sort or a page for a filter', () => {
+        expect(filtered({ sort: 'owner', descending: true, page: 2 })).toBe(false);
+        expect(filtered({ resource: '' })).toBe(true);
+        expect(filtered({ bucket: 0 })).toBe(true);
+    });
+});
+
+describe('withFilters', () => {
+    it('should start the list over and keep its sort', () => {
+        expect(
+            withFilters({ kind: 'ped', sort: 'bucket', descending: true, page: 4 }, { kind: 'vehicle' }),
+        ).toEqual({ kind: 'vehicle', sort: 'bucket', descending: true });
+    });
+});
+
+describe('withSort', () => {
+    it('should turn the sort round on its own column, and start from the smallest on another', () => {
+        expect(withSort({ page: 2 }, 'model')).toEqual({ descending: true });
+        expect(withSort({ descending: true }, 'model')).toEqual({});
+        expect(withSort({ sort: 'owner', descending: true, kind: 'ped' }, 'bucket')).toEqual({
+            kind: 'ped',
+            sort: 'bucket',
+        });
+    });
+});
+
+describe('withPage', () => {
+    it('should leave the first page out of the address', () => {
+        expect(withPage({ kind: 'ped', page: 3 }, 1)).toEqual({ kind: 'ped' });
+        expect(withPage({ kind: 'ped' }, 2)).toEqual({ kind: 'ped', page: 2 });
+    });
+});
diff --git a/web/src/entities/search.ts b/web/src/entities/search.ts
new file mode 100644
index 00000000..da48f52c
--- /dev/null
+++ b/web/src/entities/search.ts
@@ -0,0 +1,126 @@
+import { FIRST_PAGE, type EntityFilters, type EntityListing } from '../api/entities';
+import type { EntityKind } from '../api/generated/EntityKind';
+import type { EntitySort } from '../api/generated/EntitySort';
+import type { VehicleClass } from '../api/generated/VehicleClass';
+import { defined, oneOf, text } from '../lib/search';
+
+// The page keeps its filters, its sort and its page in the address, so that the map and the audit
+// log can link to a filtered list: `/entities?resource=qb-garages`.
+
+export const KINDS: EntityKind[] = ['vehicle', 'ped', 'object'];
+
+export const CLASSES: VehicleClass[] = [
+    'car',
+    'bike',
+    'boat',
+    'helicopter',
+    'plane',
+    'submarine',
+    'trailer',
+    'train',
+    'other',
+];
+
+export const SORTS: EntitySort[] = ['kind', 'model', 'resource', 'owner', 'bucket', 'position', 'netId'];
+
+/** The longest search the API takes, in characters. */
+export const MAX_SEARCH = 64;
+const MAX_NET_ID = 65_535;
+const MAX_BUCKET = 2_147_483_647;
+
+/** The page's address; a field left out is the list as it opens. */
+export type EntitiesSearch = {
+    kind?: EntityKind;
+    class?: VehicleClass;
+    /** A resource's name, or an empty one for the entities no resource created. */
+    resource?: string;
+    /** A number is the net id of the player whose game simulates the entities. */
+    owner?: 'none' | 'owned' | number;
+    bucket?: number;
+    search?: string;
+    sort?: EntitySort;
+    descending?: true;
+    /** Counted from 1, as the page writes it. */
+    page?: number;
+};
+
+const FILTERS = ['kind', 'class', 'resource', 'owner', 'bucket', 'search'] as const;
+
+/** A whole number from `least` to `most`, as the address or a field gives it; anything else is left out. */
+const whole = (value: unknown, least: number, most: number) => {
+    const number = typeof value === 'string' && /^\d+$/.test(value.trim()) ? Number(value) : value;
+    return typeof number === 'number' && Number.isSafeInteger(number) && number >= least && number <= most
+        ? number
+        : undefined;
+};
+
+const ownerOf = (value: unknown) =>
+    value === 'none' || value === 'owned' ? value : whole(value, 1, MAX_NET_ID);
+
+/**
+ * The page's address as the page reads it, whatever was typed into it: unknown or malformed fields
+ * are left out rather than refused, and a class is dropped under a kind that has none.
+ */
+export const parseEntitiesSearch = (raw: Record<string, unknown>): EntitiesSearch => {
+    const kind = oneOf(KINDS, raw.kind);
+    const sort = oneOf(SORTS, raw.sort);
+    const search = text(raw.search);
+    return defined({
+        kind,
+        class: kind === undefined || kind === 'vehicle' ? oneOf(CLASSES, raw.class) : undefined,
+        // An empty name is a filter of its own, which a text filter would leave out.
+        resource: raw.resource === '' ? '' : text(raw.resource),
+        owner: ownerOf(raw.owner),
+        bucket: whole(raw.bucket, 0, MAX_BUCKET),
+        search: search === undefined ? undefined : [...search].slice(0, MAX_SEARCH).join(''),
+        sort: sort === FIRST_PAGE.sort ? undefined : sort,
+        descending: raw.descending === true || raw.descending === 'true' ? true : undefined,
+        page: whole(raw.page, 2, Number.MAX_SAFE_INTEGER),
+    });
+};
+
+/** What the address asks the API for. */
+export const listingOf = (search: EntitiesSearch): EntityListing => ({
+    kinds: search.kind === undefined ? [] : [search.kind],
+    class: search.class ?? null,
+    resource: search.resource ?? null,
+    owner: search.owner ?? 'any',
+    bucket: search.bucket ?? null,
+    search: search.search ?? '',
+    sort: search.sort ?? FIRST_PAGE.sort,
+    descending: search.descending === true,
+    page: (search.page ?? 1) - 1,
+});
+
+/** Whether the list is narrowed by anything. */
+export const filtered = (search: EntitiesSearch) => FILTERS.some((name) => search[name] !== undefined);
+
+/** The address with its filters replaced by `next`: the sort is kept, the list starts over. */
+export const withFilters = (
+    search: EntitiesSearch,
+    next: Pick<EntitiesSearch, (typeof FILTERS)[number]>,
+): EntitiesSearch => parseEntitiesSearch({ ...next, sort: search.sort, descending: search.descending });
+
+/**
+ * The address once a column's heading is pressed: the other way round for the column the list is
+ * sorted by, from its smallest for another one. The list starts over.
+ */
+export const withSort = (search: EntitiesSearch, sort: EntitySort): EntitiesSearch => {
+    const current = search.sort ?? FIRST_PAGE.sort;
+    const { page: _page, ...kept } = search;
+    return parseEntitiesSearch({
+        ...kept,
+        sort,
+        descending: current === sort && search.descending !== true ? true : undefined,
+    });
+};
+
+/** The address of a page of the same list, counted from 1. */
+export const withPage = (search: EntitiesSearch, page: number): EntitiesSearch =>
+    parseEntitiesSearch({ ...search, page });
+
+/** The filters alone, as the map's layer takes them. */
+export const filtersOf = (search: EntitiesSearch): EntityFilters => {
+    const { sort: _sort, descending: _descending, page: _page, ...filters } = listingOf(search);
+    return filters;
+};
diff --git a/web/src/entities/selection.test.ts b/web/src/entities/selection.test.ts
new file mode 100644
index 00000000..fbb51a29
--- /dev/null
+++ b/web/src/entities/selection.test.ts
@@ -0,0 +1,99 @@
+import { describe, expect, it } from 'vitest';
+
+import type { EntityItem } from '../api/generated/EntityItem';
+import { NOTHING, pageState, pageToggled, refreshed, targetsOf, toggled } from './selection';
+
+const item = (netId: number, changes: Partial<EntityItem> = {}): EntityItem => ({
+    netId,
+    serial: netId * 10,
+    kind: 'vehicle',
+    class: 'car',
+    model: 0xb779a091,
+    x: 0,
+    y: 0,
+    z: 0,
+    owned: false,
+    owner: null,
+    ownerName: null,
+    bucket: 0,
+    population: 5,
+    resource: null,
+    resourcePending: false,
+    occupied: false,
+    ...changes,
+});
+
+const page = [item(1), item(2, { occupied: true }), item(3, { class: 'train' }), item(4)];
+
+describe('toggled', () => {
+    it('should pick an entity, and let it go when asked again', () => {
+        const picked = toggled(NOTHING, item(1), 100);
+
+        expect([...picked.keys()]).toEqual(['1:10']);
+        expect(toggled(picked, item(1), 100).size).toBe(0);
+    });
+
+    it('should never pick a vehicle a player sits in, nor a train', () => {
+        expect(toggled(NOTHING, item(2, { occupied: true }), 100)).toBe(NOTHING);
+        expect(toggled(NOTHING, item(3, { class: 'train' }), 100)).toBe(NOTHING);
+    });
+
+    it('should stop at the most a deletion takes, and still let go', () => {
+        const full = toggled(toggled(NOTHING, item(1), 2), item(4), 2);
+
+        expect(toggled(full, item(5), 2)).toBe(full);
+        expect(toggled(full, item(4), 2).size).toBe(1);
+    });
+
+    it('should tell two entities that took the same net id apart', () => {
+        const picked = toggled(NOTHING, item(1), 100);
+
+        expect(toggled(picked, item(1, { serial: 77 }), 100).size).toBe(2);
+    });
+});
+
+describe('pageToggled', () => {
+    it('should pick what the page offers, and let the page go when it all was picked', () => {
+        const picked = pageToggled(NOTHING, page, 100);
+
+        expect([...picked.keys()]).toEqual(['1:10', '4:40']);
+        expect(pageState(picked, page)).toBe('all');
+        expect(pageToggled(picked, page, 100).size).toBe(0);
+    });
+
+    it('should keep what other pages picked, and fill up to the most a deletion takes', () => {
+        const elsewhere = toggled(NOTHING, item(9), 2);
+        const picked = pageToggled(elsewhere, page, 2);
+
+        expect([...picked.keys()]).toEqual(['9:90', '1:10']);
+        expect(pageState(picked, page)).toBe('some');
+        expect(pageState(elsewhere, page)).toBe('none');
+    });
+});
+
+describe('refreshed', () => {
+    it('should let go an entity a player got into, and keep the others as they now are', () => {
+        const picked = pageToggled(NOTHING, page, 100);
+        const moved = item(4, { x: 12 });
+
+        const now = refreshed(picked, [item(1, { occupied: true }), moved]);
+
+        expect([...now.values()]).toEqual([moved]);
+    });
+
+    it('should give the same selection back when nothing of it changed', () => {
+        const picked = pageToggled(NOTHING, page, 100);
+
+        expect(refreshed(picked, page)).toBe(picked);
+        expect(refreshed(picked, [item(7)])).toBe(picked);
+    });
+});
+
+describe('targetsOf', () => {
+    it('should name each entity by its net id, its serial and its model', () => {
+        expect(targetsOf(pageToggled(NOTHING, page, 100))).toEqual([
+            { netId: 1, serial: 10, model: 0xb779a091 },
+            { netId: 4, serial: 40, model: 0xb779a091 },
+        ]);
+    });
+});
diff --git a/web/src/entities/selection.ts b/web/src/entities/selection.ts
new file mode 100644
index 00000000..0c9bd9b0
--- /dev/null
+++ b/web/src/entities/selection.ts
@@ -0,0 +1,76 @@
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityTarget } from '../api/generated/EntityTarget';
+import { blocker, keyOf } from './model';
+
+/** The entities picked for a deletion, as the list last showed each, across its pages. */
+export type Selection = ReadonlyMap<string, EntityItem>;
+
+export const NOTHING: Selection = new Map();
+
+/** Whether the panel offers to pick the entity. */
+export const pickable = (item: EntityItem) => blocker(item) === null;
+
+/** The selection with `item` picked or let go. Picking past `most`, or what is never deleted, changes nothing. */
+export const toggled = (selection: Selection, item: EntityItem, most: number): Selection => {
+    const key = keyOf(item);
+    if (selection.has(key)) {
+        const next = new Map(selection);
+        next.delete(key);
+        return next;
+    }
+    return pickable(item) && selection.size < most ? new Map(selection).set(key, item) : selection;
+};
+
+/** How much of what a page offers is picked. */
+export const pageState = (selection: Selection, items: readonly EntityItem[]): 'all' | 'some' | 'none' => {
+    const offered = items.filter(pickable);
+    const picked = offered.filter((item) => selection.has(keyOf(item))).length;
+    if (picked === 0) {
+        return 'none';
+    }
+    return picked === offered.length ? 'all' : 'some';
+};
+
+/** The selection with a whole page let go when it all was picked, picked as far as `most` goes otherwise. */
+export const pageToggled = (selection: Selection, items: readonly EntityItem[], most: number): Selection => {
+    const next = new Map(selection);
+    if (pageState(selection, items) === 'all') {
+        for (const item of items) {
+            next.delete(keyOf(item));
+        }
+        return next;
+    }
+    for (const item of items.filter(pickable)) {
+        if (next.size >= most) {
+            break;
+        }
+        next.set(keyOf(item), item);
+    }
+    return next;
+};
+
+/**
+ * The selection once the list answered again: an entity seen again is kept as it now is, and let
+ * go once a player sits in it. The same selection is given back when nothing of it changed.
+ */
+export const refreshed = (selection: Selection, items: readonly EntityItem[]): Selection => {
+    let next: Map<string, EntityItem> | null = null;
+    for (const item of items) {
+        const key = keyOf(item);
+        const picked = selection.get(key);
+        if (picked === undefined || JSON.stringify(picked) === JSON.stringify(item)) {
+            continue;
+        }
+        next ??= new Map(selection);
+        if (pickable(item)) {
+            next.set(key, item);
+        } else {
+            next.delete(key);
+        }
+    }
+    return next ?? selection;
+};
+
+/** What a deletion of the selection asks the server for. */
+export const targetsOf = (selection: Selection): EntityTarget[] =>
+    [...selection.values()].map(({ netId, serial, model }) => ({ netId, serial, model }));
diff --git a/web/src/entities/words.ts b/web/src/entities/words.ts
new file mode 100644
index 00000000..b8ba7195
--- /dev/null
+++ b/web/src/entities/words.ts
@@ -0,0 +1,18 @@
+import type { EntityResult } from '../api/generated/EntityResult';
+import type { Messages } from '../i18n/en';
+import { outcomes } from './model';
+
+/**
+ * What a deletion did, in one sentence or two: how many entities it deleted, then what became of
+ * the others. A warning as soon as one stayed.
+ */
+export const deletionNotice = (t: Messages, results: readonly EntityResult[]) => {
+    const words = t.entities;
+    const summary = outcomes(results);
+    const left = summary.others.map(([outcome, value]) => words.notDeleted[outcome](value)).join(', ');
+    const deleted = words.deleted(summary.deleted, summary.asked);
+    return {
+        tone: summary.deleted === summary.asked ? ('success' as const) : ('warning' as const),
+        message: left === '' ? deleted : `${deleted} ${left.charAt(0).toUpperCase()}${left.slice(1)}.`,
+    };
+};
diff --git a/web/src/i18n/en.ts b/web/src/i18n/en.ts
index 813c74a0..1a6aa173 100644
--- a/web/src/i18n/en.ts
+++ b/web/src/i18n/en.ts
@@ -100,6 +100,7 @@ import type { RollbackReason } from '../api/generated/RollbackReason';
 import type { UpdateBlock } from '../api/generated/UpdateBlock';
 import type { UpdateStep } from '../api/generated/UpdateStep';
 import type { UpdateWhen } from '../api/generated/UpdateWhen';
+import type { VehicleClass } from '../api/generated/VehicleClass';
 import type { DestinationKind } from '../api/backups';
 import { parsePermissions, permissionKeys, type PermissionKey } from '../auth/permissions';
 import type { InvisibleKind } from '../changes/invisible';
@@ -492,6 +493,7 @@ export const en = {
         players: 'Players',
         map: 'Live map',
         bans: 'Bans',
+        entities: 'Entities',
         drops: 'Drops',
         changes: 'File changes',
         tools: 'Tools',
@@ -2536,6 +2538,138 @@ export const en = {
         unknownPing: 'unknown',
     },
     entities: {
+        title: 'Entities',
+        gloss: 'The vehicles, peds and objects the server holds.',
+        list: 'Entities',
+        count: (value: number) => count(value, { one: 'entity', other: 'entities' }),
+        playerPeds: (value: number) =>
+            `and ${count(value, { one: "player's own ped", other: "players' own peds" })}, never listed`,
+        filter: 'Type',
+        filters: { all: 'All', vehicle: 'Vehicles', ped: 'Peds', object: 'Objects' } satisfies Record<
+            EntityKind | 'all',
+            string
+        >,
+        search: 'Search',
+        searchHint: 'Net id, model, resource or owner',
+        searchHintNoOwner: 'Net id, model or resource',
+        submit: 'Search',
+        class: 'Class',
+        createdBy: 'Created by',
+        owner: 'Owner',
+        bucket: 'Bucket',
+        any: 'Any',
+        anyResource: 'Any resource',
+        noResource: 'No resource',
+        anyone: 'Anyone',
+        noOwner: 'No owner',
+        someOwner: 'A player',
+        player: (netId: number, name: string | null) => (name === null ? `#${netId}` : `#${netId} ${name}`),
+        mostCommon: 'Most common',
+        modelCount: (model: string, value: number) => `${model} ×${formatNumber('en', value)}`,
+        showModel: (model: string) => `Show the entities of model ${model}`,
+        clear: 'Clear the filters',
+        caption: 'The entities the filters keep',
+        columns: {
+            kind: 'Type',
+            model: 'Model',
+            resource: 'Created by',
+            owner: 'Owner',
+            position: 'Position',
+        },
+        actions: 'Actions',
+        // A vehicle reads as its class, as `GetVehicleType` tells them apart.
+        classes: {
+            car: 'Car',
+            bike: 'Bike',
+            boat: 'Boat',
+            helicopter: 'Helicopter',
+            plane: 'Plane',
+            submarine: 'Submarine',
+            trailer: 'Trailer',
+            train: 'Train',
+            other: 'Vehicle',
+        } satisfies Record<VehicleClass, string>,
+        kindNames: { vehicle: 'Vehicle', ped: 'Ped', object: 'Object' } satisfies Record<EntityKind, string>,
+        netId: (value: number) => `#${value}`,
+        lookingUp: 'Looking it up',
+        playerInside: 'Player inside',
+        bucketOf: (value: number) => `bucket ${formatNumber('en', value)}`,
+        /** An entity said whole, for what acts on it: `Car 0x3C4E2113, #1042`. */
+        named: (kind: string, model: string, netId: number) => `${kind} ${model}, #${netId}`,
+        select: (entity: string) => `Select ${entity}`,
+        selectPage: 'Select the entities of this page',
+        never: {
+            occupied: 'A player sits inside: it is never deleted',
+            train: 'A train is never deleted',
+        },
+        showOnMap: (entity: string) => `Show ${entity} on the map`,
+        deleteOne: (entity: string) => `Delete ${entity}`,
+        selected: (value: number) => `${formatNumber('en', value)} selected`,
+        atMost: (value: number) => `${formatNumber('en', value)} at most`,
+        clearSelection: 'Clear',
+        deleteSelected: (value: number) => `Delete ${formatNumber('en', value)}`,
+        listed: (ago: string, seconds: number) =>
+            `Listed ${ago} ago, every ${count(seconds, { one: 'second', other: 'seconds' })} while this page is open`,
+        waiting: 'Waiting for the server to list its entities…',
+        cost: 'What the last sweep cost',
+        costOf: (work: string, frames: number) =>
+            `The last sweep took ${work} of the server's main thread, over ${count(frames, { one: 'frame', other: 'frames' })}.`,
+        range: (from: number, to: number, of: number) =>
+            `${formatNumber('en', from)}–${formatNumber('en', to)} of ${formatNumber('en', of)}`,
+        previous: 'Previous',
+        next: 'Next',
+        loading: 'Loading the entities…',
+        failed: 'The entities could not be read.',
+        noMatch: 'No entity matches these filters.',
+        none: 'The server holds no entity right now.',
+        stale: (age: string) =>
+            `This list is ${age} old: the server stopped answering. Nothing can be deleted from it until a new one comes.`,
+        spaced: (seconds: number) =>
+            `Listing its entities costs this server more than it should: it now lists them every ${count(seconds, { one: 'second', other: 'seconds' })}.`,
+        truncated: (value: number) =>
+            `The last sweep stopped after ${count(value, { one: 'entity', other: 'entities' })} to spare the server. The list is partial; the counts are whole.`,
+        unavailable: {
+            onesync: {
+                title: 'Entities need OneSync',
+                body: "Without OneSync the server does not know its entities, so there is nothing to list. It is one of the server's",
+                link: 'launch settings',
+            },
+            game: {
+                title: 'Only GTA V servers are read',
+                body: 'This server runs another game, whose entities Observer does not list.',
+            },
+        },
+        stopped: {
+            title: 'The server is not running',
+            body: 'Its entities are listed while FXServer runs and this page is open.',
+        },
+        deleted: (deleted: number, asked: number) =>
+            deleted === asked
+                ? `Deleted ${count(asked, { one: 'entity', other: 'entities' })}.`
+                : `Deleted ${formatNumber('en', deleted)} of ${count(asked, { one: 'entity', other: 'entities' })}.`,
+        dialog: {
+            title: (value: number) => `Delete ${count(value, { one: 'entity', other: 'entities' })}?`,
+            titleOne: (kind: string) => `Delete this ${kind.toLowerCase()}?`,
+            body: 'This cannot be undone. Players near them see them vanish, and a script that still uses one may fail.',
+            bodyOne:
+                'This cannot be undone. Players near it see it vanish, and a script that still uses it may fail.',
+            times: (value: number) => `×${formatNumber('en', value)}`,
+            more: (value: number) =>
+                `and ${count(value, { one: 'other', other: 'others' })}, in smaller groups`,
+            scripted: (value: number) =>
+                `${formatNumber('en', value)} ${plural('en', value, { one: 'was', other: 'were' })} created by a script.`,
+            scriptedWhy: 'A garage, a job or a persistence resource may still expect them.',
+            owned: (value: number) =>
+                `${formatNumber('en', value)} ${plural('en', value, { one: 'is', other: 'are' })} simulated by a connected player's game.`,
+            createdBy: (resource: string) => `It was created by ${resource}`,
+            createdByWhy: ', which may still expect it.',
+            ownedOne: "A connected player's game simulates it.",
+            word: 'DELETE',
+            type: (word: string, value: number) =>
+                `Type ${word} to delete ${count(value, { one: 'entity', other: 'entities' })}`,
+            confirm: (value: number) => `Delete ${formatNumber('en', value)}`,
+            confirmOne: 'Delete',
+        },
         kinds: { vehicle: 'vehicle', ped: 'ped', object: 'object' } satisfies Record<EntityKind, string>,
         /** A group of entities of one model: `8 × 0xB779A091 vehicle (qb-garages)`. */
         group: (value: number, model: string, kind: string, resource: string | null) =>
diff --git a/web/src/pages/EntitiesPage.test.tsx b/web/src/pages/EntitiesPage.test.tsx
new file mode 100644
index 00000000..aa12a873
--- /dev/null
+++ b/web/src/pages/EntitiesPage.test.tsx
@@ -0,0 +1,358 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import {
+    createMemoryHistory,
+    createRootRoute,
+    createRoute,
+    createRouter,
+    Outlet,
+    RouterProvider,
+} from '@tanstack/react-router';
+import { act, cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react';
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import type { EntitiesLive } from '../api/generated/EntitiesLive';
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityPage } from '../api/generated/EntityPage';
+import type { Me } from '../api/generated/Me';
+import { Permission } from '../api/generated/Permission';
+import { MeContext } from '../auth/me';
+import { parseEntitiesSearch } from '../entities/search';
+import { en } from '../i18n/en';
+import { I18nProvider } from '../i18n/I18nProvider';
+import { LiveContext } from '../live/context';
+import { Realtime, type SocketEvents } from '../live/realtime';
+import { EntitiesPage } from './EntitiesPage';
+
+const PATH = '/api/servers/default/entities';
+const words = en.entities;
+
+const me = (permissions: bigint): Me => ({
+    id: 2,
+    username: 'maxime',
+    isOwner: false,
+    permissions: permissions.toString(16),
+    mustChangePassword: false,
+});
+const VIEWER = me(Permission.EntitiesView);
+const MODERATOR = me(Permission.EntitiesView | Permission.EntitiesDelete | Permission.PlayersMap);
+
+const live = (changes: Partial<EntitiesLive> = {}): EntitiesLive => ({
+    run: '3-52100',
+    sweep: 4,
+    at: new Date().toISOString(),
+    unavailable: null,
+    counts: { vehicles: 3, peds: 2, objects: 1, playerPeds: 1 },
+    listed: 5,
+    truncated: false,
+    everyMs: 15_000,
+    spaced: false,
+    workUs: 12_000,
+    listUs: 900,
+    frames: 9,
+    ...changes,
+});
+
+const item = (netId: number, changes: Partial<EntityItem> = {}): EntityItem => ({
+    netId,
+    serial: netId * 10,
+    kind: 'vehicle',
+    class: 'car',
+    model: 0x3c4e2113,
+    x: 412.6,
+    y: -1208.3,
+    z: 32.1,
+    owned: false,
+    owner: null,
+    ownerName: null,
+    bucket: 0,
+    population: 5,
+    resource: null,
+    resourcePending: false,
+    occupied: false,
+    ...changes,
+});
+
+const CAR = item(1042, { resource: 'qb-garages', population: 7, owned: true, owner: 12, ownerName: 'Ada' });
+const OCCUPIED = item(771, { model: 0x9f05f101, occupied: true, owned: true, owner: 4, ownerName: 'kaito' });
+const TRAIN = item(18, { class: 'train', model: 0x3d6aaa9b });
+const PED = item(3304, { kind: 'ped', class: null, model: 0x705e61f2, resourcePending: true, bucket: 3 });
+const CRATE = item(5120, { kind: 'object', class: null, model: 0xe0faf6d2, resource: 'ox_inventory' });
+
+const page = (changes: Partial<EntityPage> = {}): EntityPage => ({
+    live: live(),
+    ownersShown: true,
+    limits: { pageSize: 100, maxDelete: 100, typedConfirmationFrom: 20, maxMapPoints: 5000, staleSweeps: 3 },
+    matching: 5,
+    page: 0,
+    items: [CAR, OCCUPIED, TRAIN, PED, CRATE],
+    facets: {
+        kinds: { vehicles: 3, peds: 1, objects: 1 },
+        classes: [
+            { class: 'car', count: 2 },
+            { class: 'train', count: 1 },
+        ],
+        resources: [
+            { resource: null, count: 3 },
+            { resource: 'qb-garages', count: 1 },
+            { resource: 'ox_inventory', count: 1 },
+        ],
+        buckets: [
+            { bucket: 0, count: 4 },
+            { bucket: 3, count: 1 },
+        ],
+        unowned: 3,
+        owned: 2,
+        owners: [
+            { netId: 12, name: 'Ada', count: 1 },
+            { netId: 4, name: 'kaito', count: 1 },
+        ],
+        models: [{ model: 0x3c4e2113, kind: 'vehicle', count: 2 }],
+    },
+    ...changes,
+});
+
+const json = (body: unknown, status = 200) => Response.json(body, { status });
+
+const api = (listed: EntityPage = page()) =>
+    vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+        const url = new URL(String(input), 'http://localhost');
+        if (url.pathname === `${PATH}/delete` && init?.method === 'POST') {
+            return json({
+                results: [
+                    { netId: 1042, outcome: 'deleted' },
+                    { netId: 5120, outcome: 'occupied' },
+                ],
+            });
+        }
+        if (url.pathname === PATH) {
+            return json(listed);
+        }
+        return json({ code: 'not_found', params: {} }, 404);
+    });
+
+const settle = () => act(() => new Promise((resolve) => setTimeout(resolve, 0)));
+
+/** The page at `address`, for `who`, over a server whose list is `fetch`'s; `say` speaks as the topic. */
+const open = async (who: Me, fetch = api(), address = '/entities') => {
+    vi.stubGlobal('fetch', fetch);
+    let socket: SocketEvents | undefined;
+    const realtime = new Realtime({
+        ticket: async () => 'ticket',
+        connect: (_, events) => {
+            socket = events;
+            return { send: () => {}, close: () => {} };
+        },
+        refetch: () => {},
+    });
+    const root = createRootRoute({ component: Outlet });
+    const router = createRouter({
+        routeTree: root.addChildren([
+            createRoute({
+                getParentRoute: () => root,
+                path: '/entities',
+                validateSearch: parseEntitiesSearch,
+                component: EntitiesPage,
+            }),
+        ]),
+        history: createMemoryHistory({ initialEntries: [address] }),
+    });
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    render(
+        <I18nProvider>
+            <QueryClientProvider client={client}>
+                <LiveContext value={realtime}>
+                    <MeContext value={who}>
+                        <RouterProvider router={router} />
+                    </MeContext>
+                </LiveContext>
+            </QueryClientProvider>
+        </I18nProvider>,
+    );
+    realtime.start();
+    await settle();
+    act(() => socket?.message(JSON.stringify({ type: 'hello', connectionId: 1, contract: 1 })));
+    await settle();
+    const say = (data: EntitiesLive) =>
+        act(() => socket?.message(JSON.stringify({ type: 'event', topic: 'server.entities', data })));
+    return { fetch, router, say };
+};
+
+/** The table's rows: the phone list is in the document too, CSS alone tells them apart. */
+const rows = () => within(screen.getByRole('table')).getAllByRole('row').slice(1);
+const asked = (fetch: ReturnType<typeof api>) =>
+    fetch.mock.calls.map(([input]) => new URL(String(input), 'http://localhost').search);
+const boxOf = (row: HTMLElement) => within(row).getByRole<HTMLInputElement>('checkbox');
+
+describe('EntitiesPage', () => {
+    beforeAll(() => {
+        HTMLDialogElement.prototype.showModal ??= function (this: HTMLDialogElement) {
+            this.open = true;
+        };
+        HTMLDialogElement.prototype.close ??= function (this: HTMLDialogElement) {
+            this.open = false;
+        };
+    });
+
+    beforeEach(() => {
+        vi.stubGlobal('scrollTo', () => {});
+    });
+
+    afterEach(() => {
+        cleanup();
+        vi.unstubAllGlobals();
+    });
+
+    it('should list each entity with what it is, what made it and whose game holds it', async () => {
+        await open(MODERATOR);
+
+        expect(screen.getByRole('heading', { name: words.count(5) })).toBeTruthy();
+        expect(screen.getByText(words.playerPeds(1))).toBeTruthy();
+        const [car, occupied, train, ped, crate] = rows();
+        expect(car?.textContent).toContain('Car');
+        expect(car?.textContent).toContain('0x3C4E2113');
+        expect(car?.textContent).toContain('#1042');
+        expect(car?.textContent).toContain('qb-garages');
+        expect(car?.textContent).toContain('#12');
+        expect(car?.textContent).toContain('Ada');
+        expect(car?.textContent).toContain('412.6, -1208.3');
+        expect(occupied?.textContent).toContain(words.playerInside);
+        expect(train?.textContent).toContain('Train');
+        expect(train?.textContent).toContain(words.noResource);
+        expect(train?.textContent).toContain(words.noOwner);
+        expect(ped?.textContent).toContain('Ped');
+        expect(ped?.textContent).toContain(words.lookingUp);
+        expect(ped?.textContent).toContain(words.bucketOf(3));
+        expect(crate?.textContent).toContain('Object');
+        expect(crate?.textContent).toContain('ox_inventory');
+    });
+
+    it('should tell only that a player owns an entity to who does not see the map, and offer no deletion', async () => {
+        await open(
+            VIEWER,
+            api(
+                page({
+                    ownersShown: false,
+                    items: [{ ...CAR, owner: null, ownerName: null }, TRAIN],
+                }),
+            ),
+        );
+
+        const [car] = rows();
+        expect(car?.textContent).toContain(words.someOwner);
+        expect(car?.textContent).not.toContain('Ada');
+        expect(screen.queryAllByRole('checkbox')).toEqual([]);
+        expect(screen.queryByRole('link', { name: /on the map/ })).toBeNull();
+        expect(screen.queryByRole('button', { name: /^Delete/ })).toBeNull();
+    });
+
+    it('should read its filters in the address and write a new one back to it', async () => {
+        const { fetch, router } = await open(MODERATOR, api(), '/entities?kind=vehicle&resource=qb-garages');
+
+        expect(asked(fetch)).toContain('?kinds=vehicle&resource=qb-garages');
+
+        fireEvent.change(screen.getByLabelText(words.class), { target: { value: 'car' } });
+        await settle();
+
+        expect(router.state.location.search).toEqual({
+            kind: 'vehicle',
+            class: 'car',
+            resource: 'qb-garages',
+        });
+        expect(asked(fetch)).toContain('?kinds=vehicle&class=car&resource=qb-garages');
+    });
+
+    it('should sort by the column pressed, the other way round when pressed again', async () => {
+        const { fetch, router } = await open(MODERATOR);
+
+        fireEvent.click(screen.getByRole('button', { name: words.columns.owner }));
+        await settle();
+        expect(router.state.location.search).toEqual({ sort: 'owner' });
+        expect(asked(fetch)).toContain('?sort=owner');
+
+        fireEvent.click(screen.getByRole('button', { name: words.columns.owner }));
+        await settle();
+        expect(router.state.location.search).toEqual({ sort: 'owner', descending: true });
+        expect(
+            screen.getByRole('columnheader', { name: words.columns.owner }).getAttribute('aria-sort'),
+        ).toBe('descending');
+    });
+
+    it('should never offer a vehicle a player sits in, nor a train', async () => {
+        await open(MODERATOR);
+
+        const [car, occupied, train] = rows();
+        expect(boxOf(car!).disabled).toBe(false);
+        expect(boxOf(occupied!).disabled).toBe(true);
+        expect(boxOf(train!).disabled).toBe(true);
+        expect(within(occupied!).getByRole<HTMLButtonElement>('button', { name: /^Delete/ }).disabled).toBe(
+            true,
+        );
+    });
+
+    it('should delete what is selected once confirmed, and say what became of each entity', async () => {
+        const { fetch } = await open(MODERATOR);
+        const [car, , , , crate] = rows();
+
+        fireEvent.click(boxOf(car!));
+        fireEvent.click(boxOf(crate!));
+        expect(screen.getByText(words.selected(2))).toBeTruthy();
+        fireEvent.click(screen.getByRole('button', { name: words.deleteSelected(2) }));
+
+        const dialog = screen.getByRole('alertdialog');
+        expect(within(dialog).getByText(words.dialog.title(2))).toBeTruthy();
+        expect(within(dialog).getByText(words.dialog.scripted(2))).toBeTruthy();
+        fireEvent.click(within(dialog).getByRole('button', { name: words.dialog.confirm(2) }));
+
+        await waitFor(() =>
+            expect(screen.getByRole('alert').textContent).toBe(
+                'Deleted 1 of 2 entities. 1 had a player inside.',
+            ),
+        );
+        const sent = fetch.mock.calls.find(([, init]) => init?.method === 'POST');
+        expect(JSON.parse(String(sent?.[1]?.body))).toEqual({
+            run: '3-52100',
+            targets: [
+                { netId: 1042, serial: 10420, model: 0x3c4e2113 },
+                { netId: 5120, serial: 51200, model: 0xe0faf6d2 },
+            ],
+        });
+        expect(screen.queryByText(words.selected(2))).toBeNull();
+    });
+
+    it('should empty the selection once the server started again: its net ids name other entities', async () => {
+        const { say } = await open(MODERATOR);
+        const [car] = rows();
+
+        fireEvent.click(boxOf(car!));
+        expect(screen.getByText(words.selected(1))).toBeTruthy();
+        say(live({ run: '4-900', sweep: 1 }));
+        await settle();
+
+        expect(screen.queryByText(words.selected(1))).toBeNull();
+    });
+
+    it('should offer no deletion from a list the server stopped refreshing', async () => {
+        const old = live({ at: new Date(Date.now() - 120_000).toISOString() });
+        await open(MODERATOR, api(page({ live: old })));
+
+        expect(screen.getByText(/the server stopped answering/)).toBeTruthy();
+        const [car] = rows();
+        expect(boxOf(car!).disabled).toBe(true);
+    });
+
+    it('should say that entities need OneSync when the server runs without it', async () => {
+        await open(
+            MODERATOR,
+            api(
+                page({
+                    live: live({ unavailable: 'onesync', counts: null, listed: 0 }),
+                    items: [],
+                    matching: 0,
+                }),
+            ),
+        );
+
+        expect(screen.getByText(words.unavailable.onesync.title)).toBeTruthy();
+        expect(screen.queryByRole('table')).toBeNull();
+    });
+});
diff --git a/web/src/pages/EntitiesPage.tsx b/web/src/pages/EntitiesPage.tsx
new file mode 100644
index 00000000..cb01b874
--- /dev/null
+++ b/web/src/pages/EntitiesPage.tsx
@@ -0,0 +1,798 @@
+import { keepPreviousData, useQuery } from '@tanstack/react-query';
+import { Link, useNavigate, useSearch } from '@tanstack/react-router';
+import {
+    ArrowDown,
+    ArrowUp,
+    Boxes,
+    ChevronLeft,
+    ChevronRight,
+    Info,
+    Search,
+    Trash2,
+    User,
+} from 'lucide-react';
+import { useMemo, useState, type ReactNode } from 'react';
+
+import { entitiesQuery } from '../api/entities';
+import type { EntitiesLive } from '../api/generated/EntitiesLive';
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityKind } from '../api/generated/EntityKind';
+import type { EntityPage } from '../api/generated/EntityPage';
+import type { EntityResult } from '../api/generated/EntityResult';
+import type { EntitySort } from '../api/generated/EntitySort';
+import { Permission } from '../api/generated/Permission';
+import { allows, useMe } from '../auth/me';
+import { Button } from '../components/Button';
+import { Card } from '../components/Card';
+import { Checkbox } from '../components/Checkbox';
+import { Chip } from '../components/Chip';
+import { TextField } from '../components/Field';
+import { Notice } from '../components/Notice';
+import { Segmented } from '../components/Segmented';
+import { SelectField } from '../components/SelectField';
+import { table } from '../components/table';
+import { Toggletip } from '../components/Toggletip';
+import { DeleteDialog } from '../entities/DeleteDialog';
+import { useEntitiesLive } from '../entities/live';
+import { EntityMark, entityName, kindWord } from '../entities/marks';
+import { blocker, isStale, keyOf, modelHash } from '../entities/model';
+import {
+    CLASSES,
+    filtered,
+    KINDS,
+    listingOf,
+    MAX_SEARCH,
+    parseEntitiesSearch,
+    withFilters,
+    withPage,
+    withSort,
+    type EntitiesSearch,
+} from '../entities/search';
+import { NOTHING, pageState, pageToggled, refreshed, toggled, type Selection } from '../entities/selection';
+import { deletionNotice } from '../entities/words';
+import { errorMessage } from '../i18n/errors';
+import { useI18n } from '../i18n/I18nProvider';
+import { cn } from '../lib/cn';
+import { useNow } from '../lib/useNow';
+import { useServerStatus } from '../server/context';
+
+type KindChoice = EntityKind | 'all';
+const KIND_CHOICES: KindChoice[] = ['all', ...KINDS];
+const RUNNING = new Set(['starting', 'online', 'degraded', 'hung']);
+const COLUMNS: { sort: EntitySort; key: 'kind' | 'model' | 'resource' | 'owner' | 'position' }[] = [
+    { sort: 'kind', key: 'kind' },
+    { sort: 'model', key: 'model' },
+    { sort: 'resource', key: 'resource' },
+    { sort: 'owner', key: 'owner' },
+    { sort: 'position', key: 'position' },
+];
+/** How many of the most common models the filters offer. */
+const MODELS_SHOWN = 3;
+
+type Done = { tone: 'success' | 'warning'; message: string };
+
+/** The server's vehicles, peds and objects: found by what they are, and deleted a few at a time. */
+export function EntitiesPage() {
+    const { t, format } = useI18n();
+    const words = t.entities;
+    const me = useMe();
+    const navigate = useNavigate();
+    const raw = useSearch({ strict: false });
+    const search = useMemo(() => parseEntitiesSearch(raw as Record<string, unknown>), [raw]);
+    const list = useQuery({ ...entitiesQuery(listingOf(search)), placeholderData: keepPreviousData });
+    // Following the topic is what has the server list its entities while the page is open.
+    const followed = useEntitiesLive();
+    const status = useServerStatus().status;
+    const now = useNow(1_000);
+    const [selection, setSelection] = useState<Selection>(NOTHING);
+    const [deleting, setDeleting] = useState<EntityItem[] | null>(null);
+    const [done, setDone] = useState<Done | null>(null);
+    const [draft, setDraft] = useState(search.search ?? '');
+    const [typedFor, setTypedFor] = useState(search.search);
+    if (typedFor !== search.search) {
+        setTypedFor(search.search);
+        setDraft(search.search ?? '');
+    }
+
+    const page = list.data;
+    const live: EntitiesLive | null = followed ?? page?.live ?? null;
+    const run = live?.run ?? null;
+    // A list read again keeps the selection as it now is; another start of the server empties it.
+    const [seen, setSeen] = useState<{ page: EntityPage | undefined; run: string | null }>({ page, run });
+    if (seen.page !== page || seen.run !== run) {
+        setSeen({ page, run });
+        setSelection(seen.run !== run ? NOTHING : refreshed(selection, page?.items ?? []));
+    }
+
+    const items = page?.items ?? [];
+    const limits = page?.limits;
+    const facets = page?.facets;
+    const ownersShown = page?.ownersShown ?? false;
+    const canDelete = allows(me, Permission.EntitiesDelete);
+    const stale = live !== null && limits !== undefined && isStale(live, now, limits.staleSweeps);
+    const running = status === null || RUNNING.has(status.state);
+    const deletable = canDelete && !stale && run !== null && limits !== undefined;
+    const most = limits?.maxDelete ?? 0;
+    const total =
+        facets === undefined ? null : facets.kinds.vehicles + facets.kinds.peds + facets.kinds.objects;
+    const countOf = (kind: KindChoice) =>
+        facets === undefined
+            ? undefined
+            : kind === 'all'
+              ? (total ?? undefined)
+              : facets.kinds[kind === 'vehicle' ? 'vehicles' : kind === 'ped' ? 'peds' : 'objects'];
+    const kindWords = Object.fromEntries(
+        KIND_CHOICES.map((kind) => {
+            const value = countOf(kind);
+            return [
+                kind,
+                value === undefined ? words.filters[kind] : `${words.filters[kind]} ${format.number(value)}`,
+            ];
+        }),
+    ) as Record<KindChoice, string>;
+
+    const go = (next: EntitiesSearch, replace = false) =>
+        void navigate({ to: '/entities', search: next, replace, resetScroll: false });
+    const narrow = (change: Partial<EntitiesSearch>) => go(withFilters(search, { ...search, ...change }));
+    const finished = (results: EntityResult[]) => {
+        setDone(deletionNotice(t, results));
+        setDeleting(null);
+        setSelection(NOTHING);
+    };
+
+    const unavailable = live?.unavailable ?? null;
+    const empty: ReactNode = !running ? (
+        <Empty title={words.stopped.title}>{words.stopped.body}</Empty>
+    ) : unavailable === 'onesync' ? (
+        <Empty title={words.unavailable.onesync.title}>
+            {words.unavailable.onesync.body}{' '}
+            {me.isOwner ? (
+                <Link
+                    to="/settings/$category"
+                    params={{ category: 'launch' }}
+                    className="font-medium text-ink underline underline-offset-2"
+                >
+                    {words.unavailable.onesync.link}
+                </Link>
+            ) : (
+                words.unavailable.onesync.link
+            )}
+            .
+        </Empty>
+    ) : unavailable === 'game' ? (
+        <Empty title={words.unavailable.game.title}>{words.unavailable.game.body}</Empty>
+    ) : null;
+
+    const first = page === undefined ? 0 : page.page * page.limits.pageSize;
+    const state = pageState(selection, items);
+
+    return (
+        <div className="flex flex-col gap-5 max-md:gap-4">
+            <div className="page-head">
+                <h1 className="page-title">
+                    {words.title} <span className="gloss">{words.gloss}</span>
+                </h1>
+            </div>
+            {stale && live?.at != null && (
+                <Notice tone="warning" live={false}>
+                    {words.stale(format.duration(Math.max(0, now - Date.parse(live.at)) / 1000))}
+                </Notice>
+            )}
+            {live !== null && live.spaced && empty === null && (
+                <Notice tone="warning" live={false}>
+                    {words.spaced(Math.round(live.everyMs / 1000))}
+                </Notice>
+            )}
+            {live !== null && live.truncated && empty === null && (
+                <Notice live={false}>{words.truncated(live.listed)}</Notice>
+            )}
+            {done !== null && <Notice tone={done.tone}>{done.message}</Notice>}
+            <Card
+                id="entities-list"
+                icon={Boxes}
+                title={total === null || empty !== null ? words.list : words.count(total)}
+                meta={
+                    empty === null && live?.counts != null && live.counts.playerPeds > 0
+                        ? words.playerPeds(live.counts.playerPeds)
+                        : undefined
+                }
+                flush
+            >
+                {empty ?? (
+                    <>
+                        <form
+                            className="flex flex-wrap items-start gap-3 border-b border-line p-5 max-md:p-4"
+                            onSubmit={(event) => {
+                                event.preventDefault();
+                                narrow({ search: draft });
+                            }}
+                        >
+                            <div className="flex w-full">
+                                <Segmented
+                                    label={words.filter}
+                                    choices={KIND_CHOICES}
+                                    value={search.kind ?? 'all'}
+                                    words={kindWords}
+                                    onChange={(kind) =>
+                                        narrow({
+                                            kind: kind === 'all' ? undefined : kind,
+                                            class: kind === 'vehicle' ? search.class : undefined,
+                                        })
+                                    }
+                                />
+                            </div>
+                            <TextField
+                                label={words.search}
+                                type="search"
+                                value={draft}
+                                maxLength={MAX_SEARCH}
+                                placeholder={ownersShown ? words.searchHint : words.searchHintNoOwner}
+                                spellCheck={false}
+                                autoCapitalize="none"
+                                autoComplete="off"
+                                className="min-w-0 flex-1 basis-56"
+                                inputClassName="pl-8.5"
+                                after={
+                                    <Search
+                                        size={16}
+                                        strokeWidth={1.5}
+                                        className="pointer-events-none absolute top-1/2 left-2.75 -translate-y-1/2 text-ink-3"
+                                        aria-hidden="true"
+                                    />
+                                }
+                                onChange={(event) => setDraft(event.target.value)}
+                            />
+                            <button type="submit" className="sr-only">
+                                {words.submit}
+                            </button>
+                            {search.kind === 'vehicle' && (
+                                <SelectField
+                                    label={words.class}
+                                    className="basis-30 max-md:flex-1 max-md:basis-[45%]"
+                                    narrowed={search.class !== undefined}
+                                    value={search.class ?? ''}
+                                    choices={[
+                                        { value: '', label: words.any },
+                                        ...CLASSES.filter(
+                                            (each) =>
+                                                each === search.class ||
+                                                facets?.classes.some((counted) => counted.class === each),
+                                        ).map((each) => ({ value: each, label: words.classes[each] })),
+                                    ]}
+                                    onChange={(value) => narrow({ class: value === '' ? undefined : value })}
+                                />
+                            )}
+                            <SelectField
+                                label={words.createdBy}
+                                className="basis-40 max-md:flex-1 max-md:basis-[45%]"
+                                narrowed={search.resource !== undefined}
+                                value={
+                                    search.resource === undefined
+                                        ? 'any'
+                                        : search.resource === ''
+                                          ? 'none'
+                                          : `name:${search.resource}`
+                                }
+                                choices={[
+                                    { value: 'any', label: words.anyResource },
+                                    { value: 'none', label: words.noResource },
+                                    ...resourceNames(facets, search.resource).map((name) => ({
+                                        value: `name:${name}`,
+                                        label: name,
+                                    })),
+                                ]}
+                                onChange={(value) =>
+                                    narrow({
+                                        resource:
+                                            value === 'any'
+                                                ? undefined
+                                                : value === 'none'
+                                                  ? ''
+                                                  : value.slice('name:'.length),
+                                    })
+                                }
+                            />
+                            <SelectField
+                                label={words.owner}
+                                className="basis-30 max-md:flex-1 max-md:basis-[45%]"
+                                narrowed={search.owner !== undefined}
+                                value={String(search.owner ?? 'any')}
+                                choices={[
+                                    { value: 'any', label: words.anyone },
+                                    { value: 'none', label: words.noOwner },
+                                    { value: 'owned', label: words.someOwner },
+                                    ...ownerIds(facets, search.owner).map(({ netId, name }) => ({
+                                        value: String(netId),
+                                        label: words.player(netId, name),
+                                    })),
+                                ]}
+                                onChange={(value) =>
+                                    narrow({
+                                        owner:
+                                            value === 'any'
+                                                ? undefined
+                                                : value === 'none' || value === 'owned'
+                                                  ? value
+                                                  : Number(value),
+                                    })
+                                }
+                            />
+                            <SelectField
+                                label={words.bucket}
+                                className="basis-22 max-md:flex-1 max-md:basis-[45%]"
+                                narrowed={search.bucket !== undefined}
+                                value={String(search.bucket ?? 'any')}
+                                choices={[
+                                    { value: 'any', label: words.any },
+                                    ...bucketIds(facets, search.bucket).map((bucket) => ({
+                                        value: String(bucket),
+                                        label: String(bucket),
+                                    })),
+                                ]}
+                                onChange={(value) =>
+                                    narrow({ bucket: value === 'any' ? undefined : Number(value) })
+                                }
+                            />
+                            {((facets?.models.length ?? 0) > 0 || filtered(search)) && (
+                                <div className="flex w-full flex-wrap items-center gap-2 text-meta text-ink-3">
+                                    {(facets?.models.length ?? 0) > 0 && (
+                                        <span className="max-md:hidden">{words.mostCommon}</span>
+                                    )}
+                                    {facets?.models.slice(0, MODELS_SHOWN).map((counted) => (
+                                        <button
+                                            key={`${counted.kind}:${counted.model}`}
+                                            type="button"
+                                            aria-label={words.showModel(modelHash(counted.model))}
+                                            className="inline-flex h-5.5 items-center rounded-pill border border-line bg-surface-2 px-2 font-mono text-meta leading-none font-medium text-ink-2 [font-variant-ligatures:none] hover:border-line-strong hover:text-ink max-md:hidden"
+                                            onClick={() => narrow({ search: modelHash(counted.model) })}
+                                        >
+                                            {words.modelCount(modelHash(counted.model), counted.count)}
+                                        </button>
+                                    ))}
+                                    {filtered(search) && (
+                                        <Button
+                                            tone="ghost"
+                                            size="sm"
+                                            className="ml-auto"
+                                            onClick={() => go(withFilters(search, {}))}
+                                        >
+                                            {words.clear}
+                                        </Button>
+                                    )}
+                                </div>
+                            )}
+                        </form>
+                        <div
+                            aria-busy={list.isFetching}
+                            className={cn(list.isPlaceholderData && 'opacity-50')}
+                        >
+                            {list.isPending && (
+                                <div className="flex flex-col gap-3 p-5">
+                                    <span className="sr-only">{words.loading}</span>
+                                    <span className="skeleton w-3/4" />
+                                    <span className="skeleton w-2/3" />
+                                    <span className="skeleton w-1/2" />
+                                </div>
+                            )}
+                            {list.isError && (
+                                <div className="p-5 max-md:p-4">
+                                    <Notice tone="danger">
+                                        {words.failed} {errorMessage(t, list.error)}
+                                    </Notice>
+                                </div>
+                            )}
+                            {list.isSuccess && items.length === 0 && (
+                                <p className="mx-auto max-w-empty px-6 py-6 text-center text-ui text-ink-3">
+                                    {live?.at == null
+                                        ? words.waiting
+                                        : filtered(search)
+                                          ? words.noMatch
+                                          : words.none}
+                                </p>
+                            )}
+                            {items.length > 0 && (
+                                <>
+                                    <div className={cn(table.scroll, 'rounded-none max-md:hidden')}>
+                                        <table className={table.table}>
+                                            <caption className="sr-only">{words.caption}</caption>
+                                            <thead>
+                                                <tr>
+                                                    {canDelete && (
+                                                        <th scope="col" className={cn(table.th, 'w-11')}>
+                                                            <Checkbox
+                                                                aria-label={words.selectPage}
+                                                                checked={state === 'all'}
+                                                                indeterminate={state === 'some'}
+                                                                disabled={!deletable}
+                                                                onChange={() =>
+                                                                    setSelection(
+                                                                        pageToggled(selection, items, most),
+                                                                    )
+                                                                }
+                                                            />
+                                                        </th>
+                                                    )}
+                                                    {COLUMNS.map(({ sort, key }) => {
+                                                        const current = (search.sort ?? 'model') === sort;
+                                                        const descending =
+                                                            current && search.descending === true;
+                                                        const Arrow = descending ? ArrowDown : ArrowUp;
+                                                        return (
+                                                            <th
+                                                                key={sort}
+                                                                scope="col"
+                                                                className={table.th}
+                                                                aria-sort={
+                                                                    current
+                                                                        ? descending
+                                                                            ? 'descending'
+                                                                            : 'ascending'
+                                                                        : undefined
+                                                                }
+                                                            >
+                                                                <button
+                                                                    type="button"
+                                                                    className={cn(
+                                                                        'inline-flex items-center gap-1 rounded-xs font-medium hover:text-ink',
+                                                                        current && 'text-ink',
+                                                                    )}
+                                                                    onClick={() => go(withSort(search, sort))}
+                                                                >
+                                                                    {words.columns[key]}
+                                                                    {current && (
+                                                                        <Arrow
+                                                                            size={12}
+                                                                            strokeWidth={2}
+                                                                            aria-hidden="true"
+                                                                        />
+                                                                    )}
+                                                                </button>
+                                                            </th>
+                                                        );
+                                                    })}
+                                                    <th scope="col" className={table.th}>
+                                                        <span className="sr-only">{words.actions}</span>
+                                                    </th>
+                                                </tr>
+                                            </thead>
+                                            <tbody>
+                                                {items.map((item) => {
+                                                    const picked = selection.has(keyOf(item));
+                                                    const never = blocker(item);
+                                                    return (
+                                                        <tr
+                                                            key={keyOf(item)}
+                                                            className={cn(
+                                                                table.row,
+                                                                picked &&
+                                                                    'bg-accent-soft hover:bg-accent-soft',
+                                                            )}
+                                                        >
+                                                            {canDelete && (
+                                                                <td className={table.td}>
+                                                                    <Checkbox
+                                                                        aria-label={words.select(
+                                                                            entityName(t, item),
+                                                                        )}
+                                                                        title={
+                                                                            never === null
+                                                                                ? undefined
+                                                                                : words.never[never]
+                                                                        }
+                                                                        checked={picked}
+                                                                        disabled={
+                                                                            !deletable ||
+                                                                            never !== null ||
+                                                                            (!picked &&
+                                                                                selection.size >= most)
+                                                                        }
+                                                                        onChange={() =>
+                                                                            setSelection(
+                                                                                toggled(
+                                                                                    selection,
+                                                                                    item,
+                                                                                    most,
+                                                                                ),
+                                                                            )
+                                                                        }
+                                                                    />
+                                                                </td>
+                                                            )}
+                                                            <td className={table.td}>
+                                                                <Kind item={item} />
+                                                            </td>
+                                                            <td className={table.td}>
+                                                                <Model item={item} />
+                                                            </td>
+                                                            <td className={table.td}>
+                                                                <Creator item={item} />
+                                                            </td>
+                                                            <td className={table.td}>
+                                                                <Owner item={item} shown={ownersShown} />
+                                                            </td>
+                                                            <td className={table.td}>
+                                                                <span className={table.mono}>
+                                                                    {place(item)}
+                                                                </span>
+                                                                {item.bucket !== 0 && (
+                                                                    <div className={table.sub}>
+                                                                        {words.bucketOf(item.bucket)}
+                                                                    </div>
+                                                                )}
+                                                            </td>
+                                                            <td className={cn(table.td, 'text-right')}>
+                                                                <div className="flex justify-end gap-0.5">
+                                                                    {canDelete && (
+                                                                        <Button
+                                                                            tone="ghost"
+                                                                            size="icon-sm"
+                                                                            aria-label={words.deleteOne(
+                                                                                entityName(t, item),
+                                                                            )}
+                                                                            title={
+                                                                                never === null
+                                                                                    ? undefined
+                                                                                    : words.never[never]
+                                                                            }
+                                                                            disabled={
+                                                                                !deletable || never !== null
+                                                                            }
+                                                                            onClick={() =>
+                                                                                setDeleting([item])
+                                                                            }
+                                                                        >
+                                                                            <Trash2
+                                                                                size={16}
+                                                                                strokeWidth={1.5}
+                                                                                aria-hidden="true"
+                                                                            />
+                                                                        </Button>
+                                                                    )}
+                                                                </div>
+                                                            </td>
+                                                        </tr>
+                                                    );
+                                                })}
+                                            </tbody>
+                                        </table>
+                                    </div>
+                                    <ul className="flex flex-col md:hidden">
+                                        {items.map((item) => {
+                                            const picked = selection.has(keyOf(item));
+                                            const never = blocker(item);
+                                            return (
+                                                <li
+                                                    key={keyOf(item)}
+                                                    className={cn(
+                                                        'flex items-start gap-3 border-b border-line px-4 py-3 last:border-b-0',
+                                                        picked && 'bg-accent-soft',
+                                                    )}
+                                                >
+                                                    {canDelete && (
+                                                        <Checkbox
+                                                            aria-label={words.select(entityName(t, item))}
+                                                            className="mt-0.5"
+                                                            checked={picked}
+                                                            disabled={
+                                                                !deletable ||
+                                                                never !== null ||
+                                                                (!picked && selection.size >= most)
+                                                            }
+                                                            onChange={() =>
+                                                                setSelection(toggled(selection, item, most))
+                                                            }
+                                                        />
+                                                    )}
+                                                    <div className="flex min-w-0 flex-1 flex-col gap-0.75">
+                                                        <span className="flex items-center gap-2 text-nav font-medium text-ink">
+                                                            <EntityMark kind={item.kind} />
+                                                            {kindWord(t, item)}
+                                                            <span className="font-mono text-small font-normal [font-variant-ligatures:none]">
+                                                                {modelHash(item.model)}
+                                                            </span>
+                                                        </span>
+                                                        <span className="flex flex-wrap items-center gap-x-1.5 text-small text-ink-3">
+                                                            <Creator item={item} plain />
+                                                            <span aria-hidden="true">·</span>
+                                                            <Owner item={item} shown={ownersShown} plain />
+                                                        </span>
+                                                        <span className="flex flex-wrap items-center gap-x-1.5 gap-y-1 font-mono text-meta text-ink-3">
+                                                            {[
+                                                                place(item),
+                                                                words.netId(item.netId),
+                                                                ...(item.bucket === 0
+                                                                    ? []
+                                                                    : [words.bucketOf(item.bucket)]),
+                                                            ].join(' · ')}
+                                                            {item.occupied && (
+                                                                <Chip tone="accent" className="font-sans">
+                                                                    {words.playerInside}
+                                                                </Chip>
+                                                            )}
+                                                        </span>
+                                                    </div>
+                                                </li>
+                                            );
+                                        })}
+                                    </ul>
+                                </>
+                            )}
+                        </div>
+                        {selection.size > 0 && (
+                            <div className="pointer-events-none sticky bottom-3 z-(--z-dock) flex justify-center px-3 py-3 max-md:bottom-0 max-md:p-0">
+                                <div className="pointer-events-auto flex max-w-full flex-wrap items-center gap-3 rounded-box border border-line-strong bg-raise py-1.5 pr-1.5 pl-4 text-ui text-ink shadow-pop max-md:w-full max-md:rounded-none max-md:border-x-0 max-md:border-b-0 max-md:py-2 max-md:pr-2">
+                                    <output className="mr-auto">
+                                        <span className="font-semibold">
+                                            {words.selected(selection.size)}
+                                        </span>{' '}
+                                        <span className="text-meta text-ink-3">· {words.atMost(most)}</span>
+                                    </output>
+                                    <Button tone="ghost" size="sm" onClick={() => setSelection(NOTHING)}>
+                                        {words.clearSelection}
+                                    </Button>
+                                    <Button
+                                        tone="danger"
+                                        size="sm"
+                                        icon={Trash2}
+                                        disabled={!deletable}
+                                        onClick={() => setDeleting([...selection.values()])}
+                                    >
+                                        {words.deleteSelected(selection.size)}
+                                    </Button>
+                                </div>
+                            </div>
+                        )}
+                        <div className="flex flex-wrap items-center gap-2 rounded-b-card border-t border-line bg-bg-subtle py-2 pr-3 pl-5 text-meta text-ink-3 max-md:pl-4">
+                            <span className="mr-auto flex items-center gap-1">
+                                {live?.at == null
+                                    ? words.waiting
+                                    : words.listed(
+                                          format.duration(Math.max(0, now - Date.parse(live.at)) / 1000),
+                                          Math.round(live.everyMs / 1000),
+                                      )}
+                                {live?.workUs != null && live.frames !== null && (
+                                    <Toggletip
+                                        tip={words.costOf(
+                                            format.milliseconds(live.workUs / 1000),
+                                            live.frames,
+                                        )}
+                                        className="inline-grid size-5 place-items-center rounded-full text-ink-3 hover:text-ink"
+                                    >
+                                        <Info size={14} strokeWidth={1.5} aria-hidden="true" />
+                                        <span className="sr-only">{words.cost}</span>
+                                    </Toggletip>
+                                )}
+                            </span>
+                            {page !== undefined && items.length > 0 && (
+                                <>
+                                    <output>
+                                        {words.range(first + 1, first + items.length, page.matching)}
+                                    </output>
+                                    <span className="inline-flex items-center gap-1">
+                                        <Button
+                                            tone="ghost"
+                                            size="sm"
+                                            icon={ChevronLeft}
+                                            disabled={page.page === 0}
+                                            onClick={() => go(withPage(search, page.page))}
+                                        >
+                                            {words.previous}
+                                        </Button>
+                                        <Button
+                                            tone="ghost"
+                                            size="sm"
+                                            disabled={first + items.length >= page.matching}
+                                            onClick={() => go(withPage(search, page.page + 2))}
+                                        >
+                                            {words.next}
+                                            <ChevronRight size={14} strokeWidth={1.5} aria-hidden="true" />
+                                        </Button>
+                                    </span>
+                                </>
+                            )}
+                        </div>
+                    </>
+                )}
+            </Card>
+            {deleting !== null && run !== null && limits !== undefined && (
+                <DeleteDialog
+                    items={deleting}
+                    run={run}
+                    limits={limits}
+                    onClose={() => setDeleting(null)}
+                    onDone={finished}
+                />
+            )}
+        </div>
+    );
+}
+
+/** The resources the filter offers: those the list counts, and the one the address names. */
+const resourceNames = (facets: EntityPage['facets'] | undefined, chosen: string | undefined) => {
+    const names = (facets?.resources ?? []).flatMap(({ resource }) => (resource === null ? [] : [resource]));
+    return chosen === undefined || chosen === '' || names.includes(chosen) ? names : [chosen, ...names];
+};
+
+const ownerIds = (facets: EntityPage['facets'] | undefined, chosen: EntitiesSearch['owner']) => {
+    const owners = (facets?.owners ?? []).map(({ netId, name }) => ({ netId, name }));
+    return typeof chosen !== 'number' || owners.some((owner) => owner.netId === chosen)
+        ? owners
+        : [{ netId: chosen, name: null }, ...owners];
+};
+
+const bucketIds = (facets: EntityPage['facets'] | undefined, chosen: number | undefined) => {
+    const buckets = (facets?.buckets ?? []).map(({ bucket }) => bucket);
+    return chosen === undefined || buckets.includes(chosen) ? buckets : [chosen, ...buckets];
+};
+
+const place = (item: Pick<EntityItem, 'x' | 'y'>) => `${item.x.toFixed(1)}, ${item.y.toFixed(1)}`;
+
+function Empty({ title, children }: { title: string; children: ReactNode }) {
+    return (
+        <div className="mx-auto flex max-w-[26rem] flex-col items-center gap-1.5 px-6 py-7 text-center text-ui text-ink-3">
+            <b className="text-card text-ink">{title}</b>
+            <p>{children}</p>
+        </div>
+    );
+}
+
+function Kind({ item }: { item: EntityItem }) {
+    const { t } = useI18n();
+    return (
+        <span className="inline-flex items-center gap-2.25 whitespace-nowrap text-ink">
+            <EntityMark kind={item.kind} />
+            {kindWord(t, item)}
+        </span>
+    );
+}
+
+function Model({ item }: { item: EntityItem }) {
+    const { t } = useI18n();
+    return (
+        <>
+            <span className={table.mono}>{modelHash(item.model)}</span>
+            <div className={table.sub}>
+                <span className="font-mono">{t.entities.netId(item.netId)}</span>
+                {item.occupied && <Chip tone="accent">{t.entities.playerInside}</Chip>}
+            </div>
+        </>
+    );
+}
+
+/** The resource that created the entity, none, or a lookup the server has not made yet. */
+function Creator({ item, plain = false }: { item: EntityItem; plain?: boolean }) {
+    const { t } = useI18n();
+    if (item.resource !== null) {
+        return <span className={cn('[overflow-wrap:anywhere]', !plain && 'text-ink')}>{item.resource}</span>;
+    }
+    return (
+        <span className="text-ink-3">
+            {item.resourcePending ? t.entities.lookingUp : t.entities.noResource}
+        </span>
+    );
+}
+
+/** Whose game simulates the entity; only that there is one, for who does not see where players stand. */
+function Owner({ item, shown, plain = false }: { item: EntityItem; shown: boolean; plain?: boolean }) {
+    const { t } = useI18n();
+    if (!item.owned) {
+        return <span className="text-ink-3">{t.entities.noOwner}</span>;
+    }
+    return (
+        <span className={cn('inline-flex min-w-0 items-center gap-1.5', !plain && 'text-ink')}>
+            {!plain && (
+                <User size={14} strokeWidth={1.5} className="flex-none text-ink-3" aria-hidden="true" />
+            )}
+            {shown && item.owner !== null ? (
+                <>
+                    <span className="font-mono text-meta text-ink-3">{t.entities.netId(item.owner)}</span>
+                    {item.ownerName !== null && (
+                        <span className="[overflow-wrap:anywhere]">{item.ownerName}</span>
+                    )}
+                </>
+            ) : (
+                t.entities.someOwner
+            )}
+        </span>
+    );
+}
diff --git a/web/src/router.tsx b/web/src/router.tsx
index 98bcc87b..833c882f 100644
--- a/web/src/router.tsx
+++ b/web/src/router.tsx
@@ -15,6 +15,7 @@ import { ReauthDialog } from './auth/ReauthDialog';
 import { RequireOwner, RequirePermission } from './auth/RequirePermission';
 import { changesSearch, resourceSearch } from './changes/search';
 import { parseDropsSearch, type DropsSearch } from './drops/search';
+import { parseEntitiesSearch, type EntitiesSearch } from './entities/search';
 import { parseStatisticsSearch, type StatisticsSearch } from './statistics/search';
 import { lazyCode } from './lib/lazyCode';
 import { LoginPage } from './pages/LoginPage';
@@ -90,6 +91,9 @@ const ChangesResourcePage = lazyCode(() =>
     import('./pages/ChangesResourcePage').then((page) => ({ default: page.ChangesResourcePage })),
 );
 const DropsPage = lazyCode(() => import('./pages/DropsPage').then((page) => ({ default: page.DropsPage })));
+const EntitiesPage = lazyCode(() =>
+    import('./pages/EntitiesPage').then((page) => ({ default: page.EntitiesPage })),
+);
 const StatisticsPage = lazyCode(() =>
     import('./pages/StatisticsPage').then((page) => ({ default: page.StatisticsPage })),
 );
@@ -336,6 +340,18 @@ const dropsRoute = createRoute({
     ),
 });
 
+// The filters, the sort and the page are in the address, so that a link opens the list as it was.
+const entitiesRoute = createRoute({
+    getParentRoute: () => panelRoute,
+    path: '/entities',
+    validateSearch: (search: Record<string, unknown>): EntitiesSearch => parseEntitiesSearch(search),
+    component: () => (
+        <RequirePermission name="EntitiesView">
+            <EntitiesPage />
+        </RequirePermission>
+    ),
+});
+
 const changesRoute = createRoute({
     getParentRoute: () => panelRoute,
     path: '/changes',
@@ -517,6 +533,7 @@ const routeTree = rootRoute.addChildren([
         changesRoute,
         changesResourceRoute,
         dropsRoute,
+        entitiesRoute,
         serverRoute,
         toolsRoute,
         archetypesRoute,
diff --git a/web/src/shell/AppShell.test.tsx b/web/src/shell/AppShell.test.tsx
index 2eb2291d..7ef81680 100644
--- a/web/src/shell/AppShell.test.tsx
+++ b/web/src/shell/AppShell.test.tsx
@@ -115,6 +115,7 @@ describe('AppShell', () => {
             en.nav.changes,
             en.nav.statistics,
             en.nav.drops,
+            en.nav.entities,
             en.nav.diagnostics,
             en.nav.tools,
             en.nav.audit,
diff --git a/web/src/shell/nav.ts b/web/src/shell/nav.ts
index 3c60840d..45b9fcaf 100644
--- a/web/src/shell/nav.ts
+++ b/web/src/shell/nav.ts
@@ -1,5 +1,6 @@
 import {
     Ban,
+    Boxes,
     CalendarClock,
     ChartLine,
     Contact,
@@ -42,6 +43,7 @@ export type NavEntry = {
         | '/bans'
         | '/changes'
         | '/drops'
+        | '/entities'
         | '/settings'
         | '/tools'
         | '/cfg'
@@ -106,6 +108,13 @@ export const navSections = (t: Messages) => ({
     insights: [
         { to: '/statistics', label: t.nav.statistics, icon: ChartLine, access: Permission.DashboardView },
         { to: '/drops', label: t.nav.drops, icon: Unplug, access: Permission.DropsView, nested: true },
+        {
+            to: '/entities',
+            label: t.nav.entities,
+            icon: Boxes,
+            access: Permission.EntitiesView,
+            nested: true,
+        },
         {
             to: '/diagnostics',
             label: t.nav.diagnostics,

From d3dd8ad041fcd51dec76d5f73a6aa41d15b1b177 Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 05:22:04 +0100
Subject: [PATCH 5/9] feat(web): draw the entities on the live map, counted by
 square when too many, and open the map on one from the list

---
 web/src/entities/MapLayer.test.tsx | 175 ++++++++++++
 web/src/entities/MapLayer.tsx      | 429 +++++++++++++++++++++++++++++
 web/src/entities/layer.test.ts     | 106 +++++++
 web/src/entities/layer.ts          |  90 ++++++
 web/src/entities/live.ts           |  10 +-
 web/src/i18n/en.ts                 |  19 ++
 web/src/live/context.ts            |  30 +-
 web/src/map/MapCanvas.tsx          |  94 ++++++-
 web/src/map/search.test.ts         |  21 ++
 web/src/map/search.ts              |  18 ++
 web/src/pages/EntitiesPage.tsx     |  20 +-
 web/src/pages/MapPage.tsx          | 131 +++++++--
 web/src/router.tsx                 |   3 +
 13 files changed, 1099 insertions(+), 47 deletions(-)
 create mode 100644 web/src/entities/MapLayer.test.tsx
 create mode 100644 web/src/entities/MapLayer.tsx
 create mode 100644 web/src/entities/layer.test.ts
 create mode 100644 web/src/entities/layer.ts
 create mode 100644 web/src/map/search.test.ts
 create mode 100644 web/src/map/search.ts

diff --git a/web/src/entities/MapLayer.test.tsx b/web/src/entities/MapLayer.test.tsx
new file mode 100644
index 00000000..17d7571a
--- /dev/null
+++ b/web/src/entities/MapLayer.test.tsx
@@ -0,0 +1,175 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { act, cleanup, render, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import type { EntityMap } from '../api/generated/EntityMap';
+import type { MapBounds } from '../api/generated/MapBounds';
+import { LiveContext } from '../live/context';
+import { Realtime, type SocketEvents } from '../live/realtime';
+import { useEntityLayer, type EntityLayer } from './MapLayer';
+
+const settle = () => act(() => new Promise((resolve) => setTimeout(resolve, 0)));
+
+const MAP: EntityMap = {
+    live: {
+        run: '3-52100',
+        sweep: 2,
+        at: '2026-11-11T20:00:00Z',
+        unavailable: null,
+        counts: { vehicles: 1, peds: 1, objects: 0, playerPeds: 0 },
+        listed: 2,
+        truncated: false,
+        everyMs: 15_000,
+        spaced: false,
+        workUs: 900,
+        listUs: 100,
+        frames: 1,
+    },
+    kinds: { vehicles: 1, peds: 1, objects: 0 },
+    matching: 2,
+    points: [
+        [12, 120, 2, 100, 100],
+        [13, 130, 1, 140, 100],
+    ],
+    cell: null,
+    cells: [],
+};
+
+const VIEW = { bounds: { west: 0, east: 900, south: -300, north: 300 }, unitsPerPixel: 1 };
+
+/** The layer's hook over a server that answers `map`, and what it sent over the live link. */
+const mount = async (wanted: number | undefined, map: EntityMap = MAP) => {
+    const fetch = vi.fn(async (input: RequestInfo | URL) => {
+        const url = new URL(String(input), 'http://localhost');
+        return url.pathname.endsWith('/map')
+            ? Response.json(map)
+            : Response.json({ items: [], limits: null, ownersShown: true });
+    });
+    vi.stubGlobal('fetch', fetch);
+    let socket: SocketEvents | undefined;
+    const said: { type: string; topic?: string }[] = [];
+    const realtime = new Realtime({
+        ticket: async () => 'ticket',
+        connect: (_, events) => {
+            socket = events;
+            return { send: (message) => said.push(JSON.parse(message)), close: () => {} };
+        },
+        refetch: () => {},
+    });
+    const held: { layer: EntityLayer | null } = { layer: null };
+    function Holder() {
+        held.layer = useEntityLayer(true, wanted);
+        return null;
+    }
+    render(
+        <QueryClientProvider client={new QueryClient({ defaultOptions: { queries: { retry: false } } })}>
+            <LiveContext value={realtime}>
+                <Holder />
+            </LiveContext>
+        </QueryClientProvider>,
+    );
+    realtime.start();
+    await settle();
+    act(() => socket?.message(JSON.stringify({ type: 'hello', connectionId: 1, contract: 1 })));
+    await settle();
+    const layer = () => held.layer as EntityLayer;
+    const asked = () => fetch.mock.calls.map(([input]) => String(input));
+    const follows = () =>
+        said.filter((message) => message.topic === 'server.entities').map((message) => message.type);
+    return { layer, asked, follows };
+};
+
+describe('useEntityLayer', () => {
+    afterEach(() => {
+        cleanup();
+        vi.unstubAllGlobals();
+    });
+
+    it('should ask the server for nothing while the layer is off', async () => {
+        const { layer, asked, follows } = await mount(undefined);
+        act(() => layer().watch(VIEW));
+        await settle();
+
+        expect(layer().on).toBe(false);
+        expect(follows()).toEqual([]);
+        expect(asked()).toEqual([]);
+    });
+
+    it('should follow the topic and ask for the part of the map in view once turned on, and stop when off', async () => {
+        const { layer, asked, follows } = await mount(undefined);
+        act(() => layer().watch(VIEW));
+        act(() => layer().turn(true));
+        await settle();
+
+        expect(follows()).toEqual(['sub']);
+        expect(asked()).toEqual([
+            '/api/servers/default/entities/map?cell=50&west=0&east=1024&south=-512&north=512',
+        ]);
+        await waitFor(() => expect(layer().shown?.points).toHaveLength(2));
+
+        act(() => layer().turn(false));
+        await settle();
+        expect(follows()).toEqual(['sub', 'unsub']);
+        expect(layer().shown).toBeNull();
+    });
+
+    it('should ask for the kinds left on only, and draw nothing once none is', async () => {
+        const { layer, asked } = await mount(undefined);
+        act(() => layer().watch(VIEW));
+        act(() => layer().turn(true));
+        await settle();
+
+        act(() => layer().toggle('object'));
+        await settle();
+        expect(asked().at(-1)).toContain('?kinds=vehicle%2Cped&cell=50');
+
+        act(() => layer().toggle('vehicle'));
+        act(() => layer().toggle('ped'));
+        await settle();
+        expect(layer().shown).toBeNull();
+    });
+
+    it('should come on for the entity the address names, and read it from the list', async () => {
+        const { layer, asked, follows } = await mount(1042);
+
+        expect(layer().on).toBe(true);
+        expect(layer().picked).toBe(1042);
+        expect(follows()).toEqual(['sub']);
+        expect(asked()).toContain('/api/servers/default/entities?search=%231042&sort=netId');
+    });
+
+    it('should pick the entity under a press, and let go on a press that reaches none', async () => {
+        const { layer } = await mount(undefined);
+        act(() => layer().watch(VIEW));
+        act(() => layer().turn(true));
+        // A press reaches only what the map already drew.
+        await waitFor(() => expect(layer().shown).not.toBeNull());
+
+        let zoom: MapBounds | null = null;
+        act(() => {
+            zoom = layer().press({ x: 138, y: 101, reach: 10 });
+        });
+        expect(layer().picked).toBe(13);
+        expect(zoom).toBeNull();
+
+        act(() => {
+            zoom = layer().press({ x: 500, y: 0, reach: 10 });
+        });
+        expect(layer().picked).toBeNull();
+        expect(zoom).toBeNull();
+    });
+
+    it('should give the cell under a press to zoom into, when the map counts by square', async () => {
+        const { layer } = await mount(undefined, { ...MAP, points: [], cell: 200, cells: [[0, 0, 840, 3]] });
+        act(() => layer().watch(VIEW));
+        act(() => layer().turn(true));
+        await waitFor(() => expect(layer().shown).not.toBeNull());
+
+        let zoom: MapBounds | null = null;
+        act(() => {
+            zoom = layer().press({ x: 150, y: 20, reach: 10 });
+        });
+
+        expect(zoom).toEqual({ west: 0, east: 200, south: 0, north: 200 });
+    });
+});
diff --git a/web/src/entities/MapLayer.tsx b/web/src/entities/MapLayer.tsx
new file mode 100644
index 00000000..4202bf93
--- /dev/null
+++ b/web/src/entities/MapLayer.tsx
@@ -0,0 +1,429 @@
+import { keepPreviousData, useQuery } from '@tanstack/react-query';
+import { Link } from '@tanstack/react-router';
+import { List, Trash2, X } from 'lucide-react';
+import { useCallback, useLayoutEffect, useRef, useState, type ReactNode } from 'react';
+
+import { entitiesMapQuery, entityQuery, NO_FILTERS } from '../api/entities';
+import type { EntityCell } from '../api/generated/EntityCell';
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { EntityKind } from '../api/generated/EntityKind';
+import type { EntityPoint } from '../api/generated/EntityPoint';
+import type { KindCounts } from '../api/generated/KindCounts';
+import type { MapBounds } from '../api/generated/MapBounds';
+import { Button, buttonVariants } from '../components/Button';
+import { Chip } from '../components/Chip';
+import { CopyValue } from '../components/CopyValue';
+import { useI18n } from '../i18n/I18nProvider';
+import { cn } from '../lib/cn';
+import type { Press, Projection, Viewport } from '../map/MapCanvas';
+import { boundsFor, cellAt, cellBounds, cellFor, nearest, shortCount, strength } from './layer';
+import { useEntitiesLive } from './live';
+import { EntityMark, entityName, kindWord } from './marks';
+import { blocker, modelHash, scripted } from './model';
+import { KINDS } from './search';
+
+/** The side of the cells asked for until the map said how far it is zoomed. */
+const FIRST_CELL = 200;
+/** A cell this wide on screen has room for its count. */
+const COUNTED_FROM = 30;
+/** The numbers of the kinds on the wire, in the order the map draws them: what matters most last. */
+const DRAWN: readonly [number, EntityKind][] = [
+    [3, 'object'],
+    [1, 'ped'],
+    [2, 'vehicle'],
+];
+const COLOURS: Record<EntityKind, string> = {
+    vehicle: '--term-cyan',
+    ped: '--term-magenta',
+    object: '--ink-3',
+};
+const COUNT_KEYS: Record<EntityKind, keyof KindCounts> = {
+    vehicle: 'vehicles',
+    ped: 'peds',
+    object: 'objects',
+};
+
+const sameBounds = (left: MapBounds, right: MapBounds) =>
+    left.west === right.west &&
+    left.east === right.east &&
+    left.south === right.south &&
+    left.north === right.north;
+
+/**
+ * The entities' layer of the live map: on or off, the kinds shown, the entities of the part of the
+ * map in view, and the one picked. The server lists its entities only while the layer is on.
+ */
+export const useEntityLayer = (allowed: boolean, wanted: number | undefined) => {
+    const [on, setOn] = useState(allowed && wanted !== undefined);
+    const [kinds, setKinds] = useState<readonly EntityKind[]>(KINDS);
+    const [asked, setAsked] = useState<{ bounds: MapBounds; cell: number } | null>(null);
+    const [picked, setPicked] = useState<number | null>(wanted ?? null);
+    const active = allowed && on;
+    const live = useEntitiesLive(active);
+    const map = useQuery({
+        ...entitiesMapQuery(
+            { ...NO_FILTERS, kinds: kinds.length === KINDS.length ? [] : [...kinds] },
+            asked?.cell ?? FIRST_CELL,
+            asked?.bounds ?? null,
+        ),
+        enabled: active && asked !== null && kinds.length > 0,
+        placeholderData: keepPreviousData,
+    });
+    const detail = useQuery({ ...entityQuery(picked ?? 0), enabled: active && picked !== null });
+    const shown = active && kinds.length > 0 ? (map.data ?? null) : null;
+    const item = picked === null ? null : (detail.data?.items.find((each) => each.netId === picked) ?? null);
+
+    const watch = useCallback((viewport: Viewport) => {
+        const bounds = boundsFor(viewport.bounds);
+        const cell = cellFor(viewport.unitsPerPixel);
+        setAsked((current) =>
+            current !== null && current.cell === cell && sameBounds(current.bounds, bounds)
+                ? current
+                : { bounds, cell },
+        );
+    }, []);
+
+    /** A press on the map: picks the entity under it, or gives the cell under it to zoom into. */
+    const press = (at: Press): MapBounds | null => {
+        if (shown === null) {
+            return null;
+        }
+        const point = nearest(shown.points, at);
+        setPicked(point === null ? null : point[0]);
+        if (point !== null || shown.cell === null) {
+            return null;
+        }
+        const cell = cellAt(shown.cells, shown.cell, at.x, at.y);
+        return cell === null ? null : cellBounds(cell, shown.cell);
+    };
+
+    return {
+        allowed,
+        on: active,
+        turn: (next: boolean) => {
+            setOn(next);
+            if (!next) {
+                setPicked(null);
+            }
+        },
+        kinds,
+        toggle: (kind: EntityKind) =>
+            setKinds(kinds.includes(kind) ? kinds.filter((each) => each !== kind) : [...kinds, kind]),
+        live,
+        /** The entities to draw, or null while the layer is off or shows no kind. */
+        shown,
+        failed: active && map.isError ? map.error : null,
+        picked: active ? picked : null,
+        pick: setPicked,
+        /** The picked entity as the list has it; null while it is read, and once it is gone. */
+        item,
+        itemRead: detail.isSuccess,
+        limits: detail.data?.limits ?? null,
+        ownersShown: detail.data?.ownersShown ?? false,
+        watch,
+        press,
+    };
+};
+
+export type EntityLayer = ReturnType<typeof useEntityLayer>;
+
+/**
+ * The entities, drawn on one canvas under the players: thousands of marks move with the map at each
+ * frame. The list page is where a keyboard and a screen reader reach them.
+ */
+export function EntityCanvas({
+    projection,
+    points,
+    cells,
+    cell,
+    picked,
+}: {
+    projection: Projection;
+    points: readonly EntityPoint[];
+    cells: readonly EntityCell[];
+    /** The side of a cell in game units, when the map counts instead of drawing each entity. */
+    cell: number | null;
+    picked: number | null;
+}) {
+    const canvas = useRef<HTMLCanvasElement>(null);
+    useLayoutEffect(() => {
+        const element = canvas.current;
+        const context = element?.getContext('2d') ?? null;
+        if (element === null || context === null) {
+            return;
+        }
+        const ratio = window.devicePixelRatio || 1;
+        const width = Math.round(projection.width * ratio);
+        const height = Math.round(projection.height * ratio);
+        if (element.width !== width || element.height !== height) {
+            element.width = width;
+            element.height = height;
+        }
+        const style = getComputedStyle(element);
+        const token = (name: string) => style.getPropertyValue(name).trim();
+        const colours = Object.fromEntries(KINDS.map((kind) => [kind, token(COLOURS[kind])])) as Record<
+            EntityKind,
+            string
+        >;
+        const ground = token('--bg-subtle');
+        const ink = token('--ink');
+        context.setTransform(ratio, 0, 0, ratio, 0, 0);
+        context.clearRect(0, 0, projection.width, projection.height);
+
+        if (cell !== null) {
+            const most = cells.reduce((highest, each) => Math.max(highest, each[2]), 0);
+            context.font = `600 11px ${token('--font-mono') || 'monospace'}`;
+            context.textAlign = 'center';
+            context.textBaseline = 'middle';
+            for (const [column, row, count, kind] of cells) {
+                const corner = projection.place(column * cell, (row + 1) * cell);
+                const opposite = projection.place((column + 1) * cell, row * cell);
+                const side = opposite.left - corner.left;
+                if (
+                    opposite.left < 0 ||
+                    opposite.top < 0 ||
+                    corner.left > projection.width ||
+                    corner.top > projection.height
+                ) {
+                    continue;
+                }
+                const name = DRAWN.find(([code]) => code === kind)?.[1] ?? 'object';
+                // Never so strong that the map under a cell stops showing.
+                context.globalAlpha = 0.16 + 0.44 * strength(count, most);
+                context.fillStyle = colours[name];
+                context.fillRect(
+                    corner.left + 0.5,
+                    corner.top + 0.5,
+                    side - 1,
+                    opposite.top - corner.top - 1,
+                );
+                if (side >= COUNTED_FROM) {
+                    context.globalAlpha = 1;
+                    context.lineWidth = 3;
+                    context.strokeStyle = ground;
+                    context.fillStyle = ink;
+                    const centre = [corner.left + side / 2, (corner.top + opposite.top) / 2] as const;
+                    context.strokeText(shortCount(count), ...centre);
+                    context.fillText(shortCount(count), ...centre);
+                }
+            }
+            context.globalAlpha = 1;
+        }
+
+        for (const [code, kind] of DRAWN) {
+            for (const point of points) {
+                if (point[2] !== code) {
+                    continue;
+                }
+                const { left, top } = projection.place(point[3], point[4]);
+                if (left < -8 || top < -8 || left > projection.width + 8 || top > projection.height + 8) {
+                    continue;
+                }
+                // Each mark over a ring of the ground's colour, so that two that touch stay two.
+                for (const [grown, fill] of [
+                    [1.5, ground],
+                    [0, colours[kind]],
+                ] as const) {
+                    context.fillStyle = fill;
+                    context.beginPath();
+                    if (kind === 'vehicle') {
+                        context.arc(left, top, 5 + grown, 0, 2 * Math.PI);
+                    } else if (kind === 'ped') {
+                        const reach = 6 + grown * 1.4;
+                        context.moveTo(left, top - reach);
+                        context.lineTo(left + reach, top);
+                        context.lineTo(left, top + reach);
+                        context.lineTo(left - reach, top);
+                        context.closePath();
+                    } else {
+                        const half = 4 + grown;
+                        context.rect(left - half, top - half, 2 * half, 2 * half);
+                    }
+                    context.fill();
+                }
+                if (point[0] === picked) {
+                    context.strokeStyle = ink;
+                    context.lineWidth = 2;
+                    context.beginPath();
+                    context.arc(left, top, 11, 0, 2 * Math.PI);
+                    context.stroke();
+                }
+            }
+        }
+    });
+    return (
+        <canvas ref={canvas} aria-hidden="true" className="pointer-events-none absolute inset-0 size-full" />
+    );
+}
+
+/** Over the map while the layer is on: the kinds to show with their counts, and the way to the list. */
+export function LayerBar({ layer, className }: { layer: EntityLayer; className?: string }) {
+    const { t, format } = useI18n();
+    const words = t.map.entities;
+    const counts = layer.shown?.kinds ?? null;
+    const unavailable = layer.live?.unavailable ?? null;
+    const note: ReactNode =
+        layer.failed !== null
+            ? words.failed
+            : unavailable === 'onesync'
+              ? words.noOneSync
+              : unavailable === 'game'
+                ? words.otherGame
+                : layer.live === null || layer.live.at === null
+                  ? words.waiting
+                  : layer.shown !== null && layer.shown.cell !== null
+                    ? words.cells
+                    : null;
+    return (
+        <div className={cn('flex min-w-0 flex-col items-end gap-2', className)}>
+            <fieldset
+                data-overlay
+                className="m-0 flex max-w-full flex-wrap items-center gap-0.5 rounded-box border border-line bg-surface p-0.75 shadow-pop"
+            >
+                <legend className="sr-only">{words.shown}</legend>
+                {KINDS.map((kind) => (
+                    <button
+                        key={kind}
+                        type="button"
+                        aria-pressed={layer.kinds.includes(kind)}
+                        className="inline-flex h-6.5 items-center gap-1.75 rounded-[7px] px-2.25 text-small font-medium text-ink-3 transition-colors hover:text-ink aria-pressed:bg-raise aria-pressed:text-ink aria-pressed:shadow-[var(--elev-sm),0_0_0_1px_var(--line)] max-md:h-11"
+                        onClick={() => layer.toggle(kind)}
+                    >
+                        <EntityMark kind={kind} />
+                        {t.entities.filters[kind]}
+                        {counts !== null && (
+                            <span className="font-normal text-ink-3 max-md:hidden">
+                                {format.number(counts[COUNT_KEYS[kind]])}
+                            </span>
+                        )}
+                    </button>
+                ))}
+                <Link to="/entities" className={cn(buttonVariants({ size: 'sm', tone: 'ghost' }), 'h-6.5')}>
+                    <List size={14} strokeWidth={1.5} aria-hidden="true" />
+                    {words.list}
+                </Link>
+            </fieldset>
+            {note !== null && (
+                <output
+                    data-overlay
+                    className="max-w-88 rounded-box border border-line bg-surface px-3 py-1.5 text-meta text-ink-2 shadow-pop"
+                >
+                    {note}
+                </output>
+            )}
+        </div>
+    );
+}
+
+/** The picked entity: what the list says of it, and the same ways to act on it. */
+export function EntityCard({
+    layer,
+    beside,
+    canDelete,
+    onDelete,
+}: {
+    layer: EntityLayer;
+    /** Beside the map rather than over it. */
+    beside: boolean;
+    canDelete: boolean;
+    onDelete: (item: EntityItem) => void;
+}) {
+    const { t } = useI18n();
+    const words = t.map.entities;
+    const item = layer.item;
+    const never = item === null ? null : blocker(item);
+    return (
+        <section
+            data-overlay={beside ? undefined : true}
+            aria-label={words.selected}
+            className={
+                beside
+                    ? 'flex flex-col gap-3 border-b border-line p-4'
+                    : 'absolute top-14 right-3 flex w-72 flex-col gap-3 rounded-box border border-line-strong bg-surface p-3.5 shadow-pop max-md:inset-x-2 max-md:top-auto max-md:bottom-2 max-md:w-auto'
+            }
+        >
+            <div className="flex items-start gap-2.5">
+                {item !== null && <EntityMark kind={item.kind} className="mt-1.75" />}
+                <div className="flex min-w-0 flex-1 flex-col">
+                    {item === null ? (
+                        <span className="text-ui text-ink-2">
+                            {layer.itemRead ? words.gone : t.common.loading}
+                        </span>
+                    ) : (
+                        <>
+                            <span className="text-card text-ink">{kindWord(t, item)}</span>
+                            <span className="font-mono text-meta text-ink-3 [font-variant-ligatures:none]">
+                                {modelHash(item.model)}
+                            </span>
+                        </>
+                    )}
+                </div>
+                <Button tone="ghost" size="icon-sm" aria-label={t.map.close} onClick={() => layer.pick(null)}>
+                    <X size={14} strokeWidth={1.5} aria-hidden="true" />
+                </Button>
+            </div>
+            {item !== null && (
+                <>
+                    <div className="flex flex-wrap gap-1.5">
+                        <Chip className="font-mono">{t.entities.netId(item.netId)}</Chip>
+                        <Chip>{words.bucket(item.bucket)}</Chip>
+                        {scripted(item) && <Chip>{words.script}</Chip>}
+                        {item.occupied && <Chip tone="accent">{t.entities.playerInside}</Chip>}
+                    </div>
+                    <dl className="grid grid-cols-2 gap-x-3 gap-y-2">
+                        <Fact term={t.entities.createdBy}>
+                            {item.resource ??
+                                (item.resourcePending ? t.entities.lookingUp : t.entities.noResource)}
+                        </Fact>
+                        <Fact term={t.entities.owner}>
+                            {!item.owned
+                                ? t.entities.noOwner
+                                : layer.ownersShown && item.owner !== null
+                                  ? t.entities.player(item.owner, item.ownerName)
+                                  : t.entities.someOwner}
+                        </Fact>
+                        <Fact term={t.map.position} wide>
+                            <CopyValue
+                                value={`${item.x.toFixed(1)}, ${item.y.toFixed(1)}, ${item.z.toFixed(1)}`}
+                                shown={`${item.x.toFixed(1)}, ${item.y.toFixed(1)}, ${item.z.toFixed(1)}`}
+                                label={words.copyPosition}
+                            />
+                        </Fact>
+                    </dl>
+                    <div className="flex flex-wrap gap-2 [&>*]:flex-1">
+                        <Link
+                            to="/entities"
+                            search={{ search: t.entities.netId(item.netId) }}
+                            className={buttonVariants({ size: 'sm' })}
+                        >
+                            <List size={14} strokeWidth={1.5} aria-hidden="true" />
+                            {words.inList}
+                        </Link>
+                        {canDelete && (
+                            <Button
+                                size="sm"
+                                icon={Trash2}
+                                className="text-danger-ink"
+                                aria-label={t.entities.deleteOne(entityName(t, item))}
+                                title={never === null ? undefined : t.entities.never[never]}
+                                disabled={never !== null}
+                                onClick={() => onDelete(item)}
+                            >
+                                {words.delete}
+                            </Button>
+                        )}
+                    </div>
+                </>
+            )}
+        </section>
+    );
+}
+
+function Fact({ term, wide = false, children }: { term: string; wide?: boolean; children: ReactNode }) {
+    return (
+        <div className={cn('flex min-w-0 flex-col', wide && 'col-span-2')}>
+            <dt className="text-meta text-ink-3">{term}</dt>
+            <dd className="text-small text-ink [overflow-wrap:anywhere]">{children}</dd>
+        </div>
+    );
+}
diff --git a/web/src/entities/layer.test.ts b/web/src/entities/layer.test.ts
new file mode 100644
index 00000000..4d6b433b
--- /dev/null
+++ b/web/src/entities/layer.test.ts
@@ -0,0 +1,106 @@
+import { describe, expect, it } from 'vitest';
+
+import type { EntityCell } from '../api/generated/EntityCell';
+import type { EntityPoint } from '../api/generated/EntityPoint';
+import { around, boundsFor, cellAt, cellBounds, cellFor, nearest, shortCount, strength } from './layer';
+
+describe('cellFor', () => {
+    it('should pick the side that is about 36 px on screen, among those the API takes', () => {
+        expect(cellFor(0.1)).toBe(25);
+        expect(cellFor(1)).toBe(50);
+        expect(cellFor(5)).toBe(200);
+        expect(cellFor(5.6)).toBe(500);
+        expect(cellFor(40)).toBe(2000);
+        expect(cellFor(500)).toBe(2000);
+    });
+});
+
+describe('boundsFor', () => {
+    const view = { west: 100, east: 1100, south: -1400, north: -800 };
+
+    it('should hold the whole view, and no more than three times its span', () => {
+        const asked = boundsFor(view);
+
+        expect(asked).toEqual({ west: 0, east: 1536, south: -1536, north: -512 });
+        expect(asked.east - asked.west).toBeLessThanOrEqual(3 * (view.east - view.west));
+    });
+
+    it('should stay the same while the map is dragged within a square', () => {
+        const dragged = { west: 140, east: 1140, south: -1430, north: -830 };
+
+        expect(boundsFor(dragged)).toEqual(boundsFor(view));
+    });
+
+    it('should ask for less once the map is zoomed in', () => {
+        const closer = { west: 500, east: 700, south: -1200, north: -1080 };
+
+        expect(boundsFor(closer)).toEqual({ west: 384, east: 768, south: -1280, north: -1024 });
+    });
+
+    it('should ask for a part with a width even of a view without any', () => {
+        const point = { west: 10, east: 10, south: 20, north: 20 };
+
+        expect(boundsFor(point)).toEqual({ west: 10, east: 11, south: 20, north: 21 });
+    });
+});
+
+describe('nearest', () => {
+    const points: EntityPoint[] = [
+        [12, 120, 2, 100, 100],
+        [13, 130, 1, 104, 100],
+        [14, 140, 3, 300, 300],
+    ];
+
+    it('should pick the entity closest to the press, within its reach', () => {
+        expect(nearest(points, { x: 103, y: 100, reach: 5 })?.[0]).toBe(13);
+        expect(nearest(points, { x: 99, y: 101, reach: 5 })?.[0]).toBe(12);
+    });
+
+    it('should pick nothing when the press reaches no entity', () => {
+        expect(nearest(points, { x: 200, y: 200, reach: 5 })).toBeNull();
+        expect(nearest([], { x: 0, y: 0, reach: 50 })).toBeNull();
+    });
+});
+
+describe('cells', () => {
+    const cells: EntityCell[] = [
+        [0, -5, 84, 3],
+        [-1, -5, 12, 2],
+    ];
+
+    it('should find the cell a place falls in, west of the origin too', () => {
+        expect(cellAt(cells, 200, 150, -850)).toEqual([0, -5, 84, 3]);
+        expect(cellAt(cells, 200, -1, -801)).toEqual([-1, -5, 12, 2]);
+        expect(cellAt(cells, 200, 450, -850)).toBeNull();
+    });
+
+    it('should give the part of the game a cell covers', () => {
+        expect(cellBounds([-1, -5, 12, 2], 200)).toEqual({ west: -200, east: 0, south: -1000, north: -800 });
+    });
+
+    it('should draw the fullest cell the strongest, and a nearly empty one still visibly', () => {
+        expect(strength(2100, 2100)).toBe(1);
+        expect(strength(1, 2100)).toBeGreaterThan(0.05);
+        expect(strength(84, 2100)).toBeLessThan(strength(310, 2100));
+        expect(strength(1, 1)).toBe(1);
+    });
+
+    it('should write a count as a cell has room for', () => {
+        expect(shortCount(84)).toBe('84');
+        expect(shortCount(999)).toBe('999');
+        expect(shortCount(1000)).toBe('1k');
+        expect(shortCount(1240)).toBe('1.2k');
+        expect(shortCount(12_400)).toBe('12k');
+    });
+});
+
+describe('around', () => {
+    it('should frame a place with some of the map around it', () => {
+        expect(around(412.6, -1208.3, 60)).toEqual({
+            west: 352.6,
+            east: 472.6,
+            south: -1268.3,
+            north: -1148.3,
+        });
+    });
+});
diff --git a/web/src/entities/layer.ts b/web/src/entities/layer.ts
new file mode 100644
index 00000000..655b1ea4
--- /dev/null
+++ b/web/src/entities/layer.ts
@@ -0,0 +1,90 @@
+import type { EntityCell } from '../api/generated/EntityCell';
+import type { EntityPoint } from '../api/generated/EntityPoint';
+import type { MapBounds } from '../api/generated/MapBounds';
+
+/** The sides a density cell may have, in game units, as the API takes them. */
+export const CELLS = [25, 50, 100, 200, 500, 1000, 2000] as const;
+/** About how wide a density cell is on screen. */
+const CELL_PIXELS = 36;
+
+/**
+ * The side of a density cell for a zoom, in game units: about 36 px on screen, among the sides the
+ * API takes, so that zooming does not ask for new cells at every step.
+ */
+export const cellFor = (unitsPerPixel: number) =>
+    CELLS.find((cell) => cell >= unitsPerPixel * CELL_PIXELS) ?? 2000;
+
+/**
+ * The part of the map to ask the entities of, for a view: the squares of a grid the view touches,
+ * the grid as coarse as the view is wide. The same answer serves while the map is dragged within a
+ * square, and zooming in asks for less, down to where each entity can be drawn.
+ */
+export const boundsFor = (view: MapBounds): MapBounds => {
+    const span = Math.max(view.east - view.west, view.north - view.south, 1);
+    const square = 2 ** Math.floor(Math.log2(span));
+    const west = Math.floor(view.west / square) * square;
+    const south = Math.floor(view.south / square) * square;
+    return {
+        west,
+        // Never a part without any width, which the API refuses.
+        east: Math.max(Math.ceil(view.east / square) * square, west + square),
+        south,
+        north: Math.max(Math.ceil(view.north / square) * square, south + square),
+    };
+};
+
+/** What a press on the map tells of itself: a place of the game and how far around it it reaches. */
+type Reach = { x: number; y: number; reach: number };
+
+/** The entity nearest to a press, within its reach. */
+export const nearest = (points: readonly EntityPoint[], press: Reach): EntityPoint | null => {
+    let found: EntityPoint | null = null;
+    let least = press.reach * press.reach;
+    for (const point of points) {
+        const distance = (point[3] - press.x) ** 2 + (point[4] - press.y) ** 2;
+        if (distance <= least) {
+            least = distance;
+            found = point;
+        }
+    }
+    return found;
+};
+
+/** The cell a place of the game falls in, if the map counted any entity there. */
+export const cellAt = (cells: readonly EntityCell[], side: number, x: number, y: number) => {
+    const column = Math.floor(x / side);
+    const row = Math.floor(y / side);
+    return cells.find((cell) => cell[0] === column && cell[1] === row) ?? null;
+};
+
+/** The part of the game a cell covers. */
+export const cellBounds = (cell: EntityCell, side: number): MapBounds => ({
+    west: cell[0] * side,
+    east: (cell[0] + 1) * side,
+    south: cell[1] * side,
+    north: (cell[1] + 1) * side,
+});
+
+/**
+ * How strongly a cell is drawn, from 0 to 1: the fullest cell in view the strongest, on a
+ * logarithmic scale so that a cell of a few entities still shows beside one of thousands.
+ */
+export const strength = (count: number, most: number) =>
+    most <= 1 ? 1 : Math.min(1, Math.log(count + 1) / Math.log(most + 1));
+
+/** A count as a cell has room for: `84`, `1.2k`, `12k`. */
+export const shortCount = (count: number) => {
+    if (count < 1000) {
+        return String(count);
+    }
+    const thousands = count / 1000;
+    return `${thousands < 10 ? thousands.toFixed(1).replace(/\.0$/, '') : Math.round(thousands)}k`;
+};
+
+/** A square around a place, to bring an entity into view with some of the map around it. */
+export const around = (x: number, y: number, margin = 60): MapBounds => ({
+    west: x - margin,
+    east: x + margin,
+    south: y - margin,
+    north: y + margin,
+});
diff --git a/web/src/entities/live.ts b/web/src/entities/live.ts
index a4bb9c94..e49b649d 100644
--- a/web/src/entities/live.ts
+++ b/web/src/entities/live.ts
@@ -6,10 +6,10 @@ import type { EntitiesLive } from '../api/generated/EntitiesLive';
 import { useTopic } from '../live/context';
 
 /**
- * The state of the list while the component is mounted, or null while the link is down. Following
- * it is what keeps the server listing its entities; each new sweep asks the list again.
+ * The state of the list while the component is mounted and `enabled`, or null while the link is
+ * down. Following it is what keeps the server listing its entities; each new sweep asks the list again.
  */
-export const useEntitiesLive = () => {
+export const useEntitiesLive = (enabled = true) => {
     const client = useQueryClient();
     const [live, setLive] = useState<EntitiesLive | null>(null);
     const seen = useRef<string | null>(null);
@@ -23,6 +23,6 @@ export const useEntitiesLive = () => {
         seen.current = sweep;
     };
     const lost = () => setLive(null);
-    useTopic('server.entities', { snapshot: took, event: took, refused: lost, cleared: lost });
-    return live;
+    useTopic('server.entities', { snapshot: took, event: took, refused: lost, cleared: lost }, enabled);
+    return enabled ? live : null;
 };
diff --git a/web/src/i18n/en.ts b/web/src/i18n/en.ts
index 1a6aa173..6c61b770 100644
--- a/web/src/i18n/en.ts
+++ b/web/src/i18n/en.ts
@@ -2536,6 +2536,25 @@ export const en = {
         stopped: 'The server is not running: no one is on the map.',
         scale: (metres: string) => `${metres} m`,
         unknownPing: 'unknown',
+        entities: {
+            layer: 'Entities',
+            shown: 'Entities shown',
+            list: 'List',
+            every: (seconds: number) =>
+                `Entities every ${count(seconds, { one: 'second', other: 'seconds' })}`,
+            waiting: 'Waiting for the server to list its entities…',
+            cells: 'Too many entities here to draw each one: the map counts them by square. Zoom in to see them.',
+            noOneSync: 'Entities need OneSync, which this server does not run.',
+            otherGame: 'Only GTA V servers list their entities.',
+            failed: 'The entities could not be read.',
+            selected: 'Selected entity',
+            script: 'Script',
+            bucket: (value: number) => `Bucket ${formatNumber('en', value)}`,
+            inList: 'In the list',
+            copyPosition: 'Copy the position',
+            gone: 'This entity is no longer on the server.',
+            delete: 'Delete',
+        },
     },
     entities: {
         title: 'Entities',
diff --git a/web/src/live/context.ts b/web/src/live/context.ts
index 71b46e9e..677ceb16 100644
--- a/web/src/live/context.ts
+++ b/web/src/live/context.ts
@@ -18,24 +18,28 @@ export const useLinkState = () => {
     return useSyncExternalStore(live.subscribe, live.getState);
 };
 
-/** Follows a topic while the component is mounted. The handlers may change on every render. */
-export const useTopic = <T extends Topic>(topic: T, handlers: TopicHandlers<T>) => {
+/**
+ * Follows a topic while the component is mounted, and while `enabled`: a topic that costs the server
+ * to feed is followed only while what shows it is on. The handlers may change on every render.
+ */
+export const useTopic = <T extends Topic>(topic: T, handlers: TopicHandlers<T>, enabled = true) => {
     const live = useRealtime();
     const latest = useRef(handlers);
     useEffect(() => {
         latest.current = handlers;
     });
-    useEffect(
-        () =>
-            live.watch<T>(topic, {
-                snapshot: (data) => latest.current.snapshot?.(data),
-                event: (data) => latest.current.event?.(data),
-                refused: () => latest.current.refused?.(),
-                cleared: () => latest.current.cleared?.(),
-                since: () => latest.current.since?.() ?? null,
-            }),
-        [live, topic],
-    );
+    useEffect(() => {
+        if (!enabled) {
+            return;
+        }
+        return live.watch<T>(topic, {
+            snapshot: (data) => latest.current.snapshot?.(data),
+            event: (data) => latest.current.event?.(data),
+            refused: () => latest.current.refused?.(),
+            cleared: () => latest.current.cleared?.(),
+            since: () => latest.current.since?.() ?? null,
+        });
+    }, [live, topic, enabled]);
 };
 
 /** A topic's latest snapshot, or null while none holds: until one arrives, and while the link is down. */
diff --git a/web/src/map/MapCanvas.tsx b/web/src/map/MapCanvas.tsx
index a6435eb2..4f718d36 100644
--- a/web/src/map/MapCanvas.tsx
+++ b/web/src/map/MapCanvas.tsx
@@ -16,6 +16,25 @@ export type Trail = { id: number; points: readonly { x: number; y: number }[] };
 
 const NO_TRAILS: readonly Trail[] = [];
 
+/** How the map places the game on the screen right now, for a layer drawn over it. */
+export type Projection = {
+    width: number;
+    height: number;
+    /** A place of the game, in pixels from the map's top left corner. */
+    place: (x: number, y: number) => { left: number; top: number };
+    /** The game units a pixel covers. */
+    unitsPerPixel: number;
+};
+
+/** The part of the game in view, and its scale. */
+export type Viewport = { bounds: MapBounds; unitsPerPixel: number };
+
+/** A press on the map that hit no player: where in the game, and how far around it a finger reaches. */
+export type Press = { x: number; y: number; reach: number };
+
+/** How far around a press something still counts as pressed, in pixels. */
+const REACH = 10;
+
 /** The marks of each colour, which also differ in shape: a colour never says it alone. */
 export const TIER_MARK: Record<Tier, string> = {
     new: 'size-3 rounded-full border-[2.5px] border-warning bg-surface',
@@ -48,6 +67,10 @@ export function MapCanvas({
     selected,
     names,
     focus,
+    frame = null,
+    renderLayer,
+    onViewport,
+    onPress,
     onSelect,
     children,
     className,
@@ -67,6 +90,14 @@ export function MapCanvas({
     names: boolean;
     /** A player to bring into view, and a count that changes each time it is asked. */
     focus: { id: number; at: number } | null;
+    /** A part of the game to bring into view, and a count that changes each time it is asked. */
+    frame?: (MapBounds & { at: number }) | null;
+    /** Drawn over the map and under the players, by what the map tells of its placing. */
+    renderLayer?: (projection: Projection) => ReactNode;
+    /** Told the part of the game in view, each time it changes. */
+    onViewport?: (viewport: Viewport) => void;
+    /** A press that hit no player, before the selection is cleared. */
+    onPress?: (press: Press) => void;
     onSelect: (id: number | null) => void;
     /** Drawn over the map: notices and the selected player's card. */
     children?: ReactNode;
@@ -169,23 +200,33 @@ export function MapCanvas({
 
     // Only a new ask moves the map, not each new position: what it reads stays out of the effect's
     // dependencies.
-    const latest = useRef({ dots, worldOf, size });
+    const latest = useRef({ dots, worldOf, size, framing });
     useLayoutEffect(() => {
-        latest.current = { dots, worldOf, size };
+        latest.current = { dots, worldOf, size, framing };
     });
     useEffect(() => {
-        const { dots: now, worldOf: place, size: frame } = latest.current;
+        const { dots: now, worldOf: place, size: sized } = latest.current;
         const dot = focus === null ? undefined : now.find((each) => each.id === focus.id);
-        if (dot === undefined || frame.width === 0) {
+        if (dot === undefined || sized.width === 0) {
             return;
         }
         const point = place(dot);
         setView((current) => {
             const scale = Math.max(current?.scale ?? 1, 1);
-            return { scale, x: frame.width / 2 - point.x * scale, y: frame.height / 2 - point.y * scale };
+            return { scale, x: sized.width / 2 - point.x * scale, y: sized.height / 2 - point.y * scale };
         });
     }, [focus]);
 
+    useEffect(() => {
+        const { worldOf: place, size: sized, framing: fitting } = latest.current;
+        if (frame === null || sized.width === 0) {
+            return;
+        }
+        const corner = place({ x: frame.west, y: frame.north });
+        const opposite = place({ x: frame.east, y: frame.south });
+        setView(fitting(corner.x, corner.y, opposite.x, opposite.y));
+    }, [frame]);
+
     const zoom = (factor: number, at = { x: size.width / 2, y: size.height / 2 }) =>
         setView((current) => {
             if (current === null) {
@@ -217,8 +258,21 @@ export function MapCanvas({
     // Dragging moves the map; a press that does not move clears the selection. On the element itself,
     // so that a drag that leaves it carries on.
     const select = useRef(onSelect);
+    const press = useRef(onPress);
+    const gameAt = useRef<(left: number, top: number) => Press | null>(() => null);
     useLayoutEffect(() => {
         select.current = onSelect;
+        press.current = onPress;
+        gameAt.current = (left, top) =>
+            view === null
+                ? null
+                : {
+                      x: area.west + ((left - view.x) / view.scale / world.width) * (area.east - area.west),
+                      y:
+                          area.north -
+                          ((top - view.y) / view.scale / world.height) * (area.north - area.south),
+                      reach: (REACH * (area.east - area.west)) / (world.width * view.scale),
+                  };
     });
     useEffect(() => {
         const element = box.current;
@@ -254,6 +308,11 @@ export function MapCanvas({
             const current = drag.current;
             drag.current = null;
             if (current !== null && !current.moved) {
+                const rect = element.getBoundingClientRect();
+                const at = gameAt.current(event.clientX - rect.left, event.clientY - rect.top);
+                if (at !== null) {
+                    press.current?.(at);
+                }
                 select.current(null);
             }
             if (element.hasPointerCapture(event.pointerId)) {
@@ -278,6 +337,24 @@ export function MapCanvas({
         return { left: shown.x + point.x * shown.scale, top: shown.y + point.y * shown.scale };
     };
 
+    const viewport = useRef(onViewport);
+    useLayoutEffect(() => {
+        viewport.current = onViewport;
+    });
+    useEffect(() => {
+        if (view === null || size.width === 0) {
+            return;
+        }
+        const across = (area.east - area.west) / (world.width * view.scale);
+        const down = (area.north - area.south) / (world.height * view.scale);
+        const west = area.west - view.x * across;
+        const north = area.north + view.y * down;
+        viewport.current?.({
+            bounds: { west, east: west + size.width * across, south: north - size.height * down, north },
+            unitsPerPixel: across,
+        });
+    }, [view, size.width, size.height, area, world.width, world.height]);
+
     return (
         <div
             ref={box}
@@ -341,6 +418,13 @@ export function MapCanvas({
                         ))}
                 </svg>
             )}
+            {view !== null &&
+                renderLayer?.({
+                    width: size.width,
+                    height: size.height,
+                    place: (x, y) => screen({ x, y }),
+                    unitsPerPixel: (area.east - area.west) / (world.width * view.scale),
+                })}
             {view !== null &&
                 dots.map((dot) => {
                     const { left, top } = screen(dot);
diff --git a/web/src/map/search.test.ts b/web/src/map/search.test.ts
new file mode 100644
index 00000000..a7c68b18
--- /dev/null
+++ b/web/src/map/search.test.ts
@@ -0,0 +1,21 @@
+import { defaultParseSearch } from '@tanstack/react-router';
+import { describe, expect, it } from 'vitest';
+
+import { parseMapSearch } from './search';
+
+/** The address as the router reads it, then as the map reads that. */
+const read = (address: string) => parseMapSearch(defaultParseSearch(address));
+
+describe('parseMapSearch', () => {
+    it('should read the entity the list sends the map to', () => {
+        expect(read('?entity=1042')).toEqual({ entity: 1042 });
+    });
+
+    it('should leave out what is not a net id', () => {
+        expect(read('')).toEqual({});
+        expect(read('?entity=0')).toEqual({});
+        expect(read('?entity=70000')).toEqual({});
+        expect(read('?entity=car')).toEqual({});
+        expect(read('?entity=1.5')).toEqual({});
+    });
+});
diff --git a/web/src/map/search.ts b/web/src/map/search.ts
new file mode 100644
index 00000000..de4dff18
--- /dev/null
+++ b/web/src/map/search.ts
@@ -0,0 +1,18 @@
+// What the map's address may hold: the net id of an entity the list sends the map to.
+
+/** The map's address; a field left out is the map as it opens. */
+export type MapSearch = {
+    /** An entity to show: its layer comes on and the map goes to it. */
+    entity?: number;
+};
+
+const MAX_NET_ID = 65_535;
+
+/** The address as the map reads it: what is not a net id is left out rather than refused. */
+export const parseMapSearch = (raw: Record<string, unknown>): MapSearch => {
+    const entity =
+        typeof raw.entity === 'string' && /^\d+$/.test(raw.entity) ? Number(raw.entity) : raw.entity;
+    return typeof entity === 'number' && Number.isSafeInteger(entity) && entity >= 1 && entity <= MAX_NET_ID
+        ? { entity }
+        : {};
+};
diff --git a/web/src/pages/EntitiesPage.tsx b/web/src/pages/EntitiesPage.tsx
index cb01b874..d47aa258 100644
--- a/web/src/pages/EntitiesPage.tsx
+++ b/web/src/pages/EntitiesPage.tsx
@@ -7,6 +7,7 @@ import {
     ChevronLeft,
     ChevronRight,
     Info,
+    MapPin,
     Search,
     Trash2,
     User,
@@ -22,7 +23,7 @@ import type { EntityResult } from '../api/generated/EntityResult';
 import type { EntitySort } from '../api/generated/EntitySort';
 import { Permission } from '../api/generated/Permission';
 import { allows, useMe } from '../auth/me';
-import { Button } from '../components/Button';
+import { Button, buttonVariants } from '../components/Button';
 import { Card } from '../components/Card';
 import { Checkbox } from '../components/Checkbox';
 import { Chip } from '../components/Chip';
@@ -109,6 +110,7 @@ export function EntitiesPage() {
     const facets = page?.facets;
     const ownersShown = page?.ownersShown ?? false;
     const canDelete = allows(me, Permission.EntitiesDelete);
+    const canMap = allows(me, Permission.PlayersMap);
     const stale = live !== null && limits !== undefined && isStale(live, now, limits.staleSweeps);
     const running = status === null || RUNNING.has(status.state);
     const deletable = canDelete && !stale && run !== null && limits !== undefined;
@@ -522,6 +524,7 @@ export function EntitiesPage() {
                                                             </td>
                                                             <td className={cn(table.td, 'text-right')}>
                                                                 <div className="flex justify-end gap-0.5">
+                                                                    {canMap && <OnMap item={item} />}
                                                                     {canDelete && (
                                                                         <Button
                                                                             tone="ghost"
@@ -611,6 +614,7 @@ export function EntitiesPage() {
                                                             )}
                                                         </span>
                                                     </div>
+                                                    {canMap && <OnMap item={item} />}
                                                 </li>
                                             );
                                         })}
@@ -796,3 +800,17 @@ function Owner({ item, shown, plain = false }: { item: EntityItem; shown: boolea
         </span>
     );
 }
+
+function OnMap({ item }: { item: EntityItem }) {
+    const { t } = useI18n();
+    return (
+        <Link
+            to="/map"
+            search={{ entity: item.netId }}
+            aria-label={t.entities.showOnMap(entityName(t, item))}
+            className={cn(buttonVariants({ size: 'icon-sm', tone: 'ghost' }), 'flex-none')}
+        >
+            <MapPin size={16} strokeWidth={1.5} aria-hidden="true" />
+        </Link>
+    );
+}
diff --git a/web/src/pages/MapPage.tsx b/web/src/pages/MapPage.tsx
index 643b49fa..39678b87 100644
--- a/web/src/pages/MapPage.tsx
+++ b/web/src/pages/MapPage.tsx
@@ -1,5 +1,5 @@
 import { useQuery } from '@tanstack/react-query';
-import { Link } from '@tanstack/react-router';
+import { Link, useSearch } from '@tanstack/react-router';
 import {
     Ban as BanIcon,
     ExternalLink,
@@ -12,6 +12,8 @@ import {
 } from 'lucide-react';
 import { useId, useMemo, useState, type ReactNode } from 'react';
 
+import type { EntityItem } from '../api/generated/EntityItem';
+import type { MapBounds } from '../api/generated/MapBounds';
 import type { MapLive } from '../api/generated/MapLive';
 import type { MapPlayer } from '../api/generated/MapPlayer';
 import type { MapSettings } from '../api/generated/MapSettings';
@@ -26,6 +28,10 @@ import { FieldError, inputClass } from '../components/Field';
 import { Notice } from '../components/Notice';
 import { Segmented } from '../components/Segmented';
 import { Switch } from '../components/Switch';
+import { DeleteDialog } from '../entities/DeleteDialog';
+import { around } from '../entities/layer';
+import { EntityCanvas, EntityCard, LayerBar, useEntityLayer } from '../entities/MapLayer';
+import { deletionNotice } from '../entities/words';
 import { useI18n } from '../i18n/I18nProvider';
 import { cn } from '../lib/cn';
 import { WIDE, useMedia } from '../lib/useMedia';
@@ -33,6 +39,7 @@ import { useNow } from '../lib/useNow';
 import { useTopic } from '../live/context';
 import { tierOf, type Tier } from '../map/geometry';
 import { MapCanvas, TIER_MARK, type Dot } from '../map/MapCanvas';
+import type { MapSearch } from '../map/search';
 import { TILE_STYLES, isTileStyle, type TileStyle } from '../map/tiles';
 import { extend, type Trails } from '../map/trails';
 import { useServerStatus } from '../server/context';
@@ -64,6 +71,21 @@ export function MapPage() {
     const me = useMe();
     const view = useQuery(mapQuery);
     const online = useQuery(onlineQuery);
+    const address: MapSearch = useSearch({ strict: false });
+    const layer = useEntityLayer(allows(me, Permission.EntitiesView), address.entity);
+    const [frame, setFrame] = useState<(MapBounds & { at: number }) | null>(null);
+    const [deleting, setDeleting] = useState<EntityItem | null>(null);
+    const [deleted, setDeleted] = useState<ReturnType<typeof deletionNotice> | null>(null);
+    // The entity the address names is brought into view once the list has it.
+    const [broughtFor, setBroughtFor] = useState<number | null>(null);
+    if (
+        address.entity !== undefined &&
+        layer.item?.netId === address.entity &&
+        broughtFor !== address.entity
+    ) {
+        setBroughtFor(address.entity);
+        setFrame({ ...around(layer.item.x, layer.item.y), at: address.entity });
+    }
     const status = useServerStatus().status;
     const [live, setLive] = useState<MapLive | null>(null);
     const [trails, setTrails] = useState<Trails>(new Map());
@@ -140,6 +162,7 @@ export function MapPage() {
 
     const show = (netId: number) => {
         setSelected(netId);
+        layer.pick(null);
         setFocus({ id: netId, at: Date.now() });
     };
     /** Enter in the search goes to the first player it leaves. */
@@ -151,9 +174,18 @@ export function MapPage() {
         }
     };
 
-    // Beside the map when the list is, so that it never covers the player it is about.
+    // Beside the map when the list is, so that it never covers what it is about.
     const card =
-        chosen === null ? null : (
+        chosen === null ? (
+            layer.picked === null ? null : (
+                <EntityCard
+                    layer={layer}
+                    beside={beside}
+                    canDelete={allows(me, Permission.EntitiesDelete)}
+                    onDelete={setDeleting}
+                />
+            )
+        ) : (
             <section
                 data-overlay={beside ? undefined : true}
                 aria-label={words.selected}
@@ -261,9 +293,19 @@ export function MapPage() {
                         <Switch checked={trailing} onChange={(event) => setTrailing(event.target.checked)} />
                         {words.trails}
                     </label>
+                    {layer.allowed && (
+                        <label className="flex h-9.5 items-center gap-2.5 text-ui font-medium text-ink max-md:h-11">
+                            <Switch
+                                checked={layer.on}
+                                onChange={(event) => layer.turn(event.target.checked)}
+                            />
+                            {words.entities.layer}
+                        </label>
+                    )}
                 </div>
             </div>
             {live !== null && !live.onesync && <Notice tone="warning">{words.noOneSync}</Notice>}
+            {deleted !== null && <Notice tone={deleted.tone}>{deleted.message}</Notice>}
             <div className="grid grid-cols-1 items-start gap-3 2xl:grid-cols-[minmax(0,1fr)_19rem]">
                 <section className="card flex min-w-0 flex-col" aria-labelledby="map-title">
                     <div className="card-head">
@@ -313,34 +355,61 @@ export function MapPage() {
                         selected={selected}
                         names={names}
                         focus={followFocus ?? focus}
+                        frame={frame}
+                        renderLayer={
+                            layer.shown === null
+                                ? undefined
+                                : (projection) => (
+                                      <EntityCanvas
+                                          projection={projection}
+                                          points={layer.shown?.points ?? []}
+                                          cells={layer.shown?.cells ?? []}
+                                          cell={layer.shown?.cell ?? null}
+                                          picked={layer.picked}
+                                      />
+                                  )
+                        }
+                        onViewport={layer.allowed ? layer.watch : undefined}
+                        onPress={(at) => {
+                            const cell = layer.press(at);
+                            if (cell !== null) {
+                                setFrame({ ...cell, at: Date.now() });
+                            }
+                        }}
                         onSelect={(id) => {
                             setSelected(id);
                             if (id === null) {
                                 setFollowing(false);
+                            } else {
+                                layer.pick(null);
                             }
                         }}
                         className="h-[calc(100dvh-17rem)] min-h-96 max-md:h-[62dvh] max-md:min-h-80"
                     >
-                        {isTileStyle(settings.imagery) && isTileStyle(imagery) && (
-                            <div data-overlay className="absolute top-3 left-3">
-                                <Segmented
-                                    label={words.style}
-                                    choices={TILE_STYLES}
-                                    value={imagery}
-                                    words={words.styles}
-                                    className="bg-surface shadow-pop"
-                                    onChange={(next) => {
-                                        setStyle(next);
-                                        setUnsent(null);
-                                        try {
-                                            localStorage.setItem(STYLE_KEY, next);
-                                        } catch {
-                                            // Private browsing: the choice lasts for this page only.
-                                        }
-                                    }}
-                                />
-                            </div>
-                        )}
+                        {/* One row that wraps: the layer's bar goes under the styles where both do not fit. */}
+                        <div className="pointer-events-none absolute inset-x-3 top-3 flex flex-wrap items-start gap-2 [&>*]:pointer-events-auto">
+                            {isTileStyle(settings.imagery) && isTileStyle(imagery) && (
+                                <div data-overlay>
+                                    <Segmented
+                                        label={words.style}
+                                        choices={TILE_STYLES}
+                                        value={imagery}
+                                        words={words.styles}
+                                        className="bg-surface shadow-pop"
+                                        onChange={(next) => {
+                                            setStyle(next);
+                                            setUnsent(null);
+                                            try {
+                                                localStorage.setItem(STYLE_KEY, next);
+                                            } catch {
+                                                // Private browsing: the choice lasts for this page only.
+                                            }
+                                        }}
+                                    />
+                                </div>
+                            )}
+                            {layer.on && <LayerBar layer={layer} className="ml-auto" />}
+                        </div>
                         {isTileStyle(imagery) && tiles === null && (
                             <output
                                 data-overlay
@@ -395,6 +464,9 @@ export function MapPage() {
                     </MapCanvas>
                     <div className="flex flex-wrap items-center gap-x-4 gap-y-1 rounded-b-card border-t border-line bg-bg-subtle py-2 pr-3 pl-5 text-meta text-ink-3 max-md:pl-4">
                         <span className="mr-auto">{words.every(settings.everySeconds)}</span>
+                        {layer.live !== null && layer.live.everyMs > 0 && (
+                            <span>{words.entities.every(Math.round(layer.live.everyMs / 1000))}</span>
+                        )}
                         {tiles !== null && <span>{words.credit}</span>}
                         {live?.at != null && (
                             <span>
@@ -480,6 +552,19 @@ export function MapPage() {
                     <p className="border-t border-line p-4 text-small text-ink-3">{words.listHint}</p>
                 </aside>
             </div>
+            {deleting !== null && layer.live?.run != null && layer.limits !== null && (
+                <DeleteDialog
+                    items={[deleting]}
+                    run={layer.live.run}
+                    limits={layer.limits}
+                    onClose={() => setDeleting(null)}
+                    onDone={(results) => {
+                        setDeleted(deletionNotice(t, results));
+                        setDeleting(null);
+                        layer.pick(null);
+                    }}
+                />
+            )}
             {banning !== null && banning.player !== null && (
                 <BanDialog
                     target={{
diff --git a/web/src/router.tsx b/web/src/router.tsx
index 833c882f..eed63c8a 100644
--- a/web/src/router.tsx
+++ b/web/src/router.tsx
@@ -16,6 +16,7 @@ import { RequireOwner, RequirePermission } from './auth/RequirePermission';
 import { changesSearch, resourceSearch } from './changes/search';
 import { parseDropsSearch, type DropsSearch } from './drops/search';
 import { parseEntitiesSearch, type EntitiesSearch } from './entities/search';
+import { parseMapSearch, type MapSearch } from './map/search';
 import { parseStatisticsSearch, type StatisticsSearch } from './statistics/search';
 import { lazyCode } from './lib/lazyCode';
 import { LoginPage } from './pages/LoginPage';
@@ -299,9 +300,11 @@ const playersRoute = createRoute({
     ),
 });
 
+// An entity the list sends here is in the address: the map opens on it, its layer on.
 const mapRoute = createRoute({
     getParentRoute: () => panelRoute,
     path: '/map',
+    validateSearch: (search: Record<string, unknown>): MapSearch => parseMapSearch(search),
     component: () => (
         <RequirePermission name="PlayersMap">
             <MapPage />

From 1784f0583669b097f35c80c00f0b80546160b8d4 Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 05:22:46 +0100
Subject: [PATCH 6/9] feat(web): set how often the server lists its entities,
 in a settings category of their own

---
 web/src/i18n/en.ts                 | 16 +++++
 web/src/settings/Category.tsx      |  2 +
 web/src/settings/Entities.test.tsx | 86 ++++++++++++++++++++++++++
 web/src/settings/Entities.tsx      | 97 ++++++++++++++++++++++++++++++
 web/src/settings/catalog.test.ts   |  6 +-
 web/src/settings/catalog.ts        |  8 +++
 6 files changed, 212 insertions(+), 3 deletions(-)
 create mode 100644 web/src/settings/Entities.test.tsx
 create mode 100644 web/src/settings/Entities.tsx

diff --git a/web/src/i18n/en.ts b/web/src/i18n/en.ts
index 6c61b770..158fc284 100644
--- a/web/src/i18n/en.ts
+++ b/web/src/i18n/en.ts
@@ -5117,6 +5117,10 @@ export const en = {
                 name: 'Live map',
                 about: 'What the Live map draws under the players, your own image and where it sits in the game, and the colours of the players on it.',
             },
+            entities: {
+                name: 'Entities',
+                about: 'How often the server lists its vehicles, peds and objects while someone looks at them. Finding and deleting them is on the Entities page and the Live map.',
+            },
             restarts: {
                 name: 'Restarts',
                 about: 'When FXServer restarts by itself, and how long before your resources hear of it. Skipping or delaying one restart is on the Schedule page.',
@@ -5443,6 +5447,10 @@ export const en = {
                 label: 'Positions sent every',
                 about: 'The server reads positions only while someone has the map open, and stops within 30 seconds after the last one leaves. They need OneSync.',
             },
+            entitiesCadence: {
+                label: 'Entities listed every',
+                about: 'Only while someone has the Entities page or the map layer open. Shorter is fresher and costs the server more; it spaces its sweeps out by itself when one costs it too much. They need OneSync.',
+            },
             tokenMatches: {
                 label: 'Hardware tokens to match',
                 about: "How many of a ban's hardware tokens a player must show to be refused by them alone. Any identifier the ban holds refuses at once; 0 never refuses on tokens alone.",
@@ -5601,6 +5609,14 @@ export const en = {
                 'Your account can read these; changing them takes the permission to change settings, and the image the owner.',
             loadFailed: 'These settings could not be read.',
         },
+        entities: {
+            openEntities: 'Open the Entities page',
+            seconds: (value: number) => `${formatNumber('en', value)} s`,
+            saved: 'Saved. The server follows from its next sweep.',
+            discarded: 'Changes discarded.',
+            readOnly: 'Your account can read these; changing them takes the permission to change settings.',
+            loadFailed: 'These settings could not be read.',
+        },
         bans: {
             openBans: 'Open the Bans page',
             insert: 'Insert',
diff --git a/web/src/settings/Category.tsx b/web/src/settings/Category.tsx
index 9bafaf46..ee357f93 100644
--- a/web/src/settings/Category.tsx
+++ b/web/src/settings/Category.tsx
@@ -12,6 +12,7 @@ import { BansSettings } from './Bans';
 import { BuildSettings } from './Builds';
 import { CATEGORIES, opens, type Category, type CategoryId } from './catalog';
 import { DataSettings } from './Data';
+import { EntitiesSettings } from './Entities';
 import { LiveMapSettings } from './LiveMap';
 import { FeatureSettings } from './Features';
 import { FilesSettings } from './Files';
@@ -29,6 +30,7 @@ const CONTENT = {
     backups: BackupsSettings,
     bans: BansSettings,
     map: LiveMapSettings,
+    entities: EntitiesSettings,
     features: FeatureSettings,
     data: DataSettings,
     tools: ToolSettings,
diff --git a/web/src/settings/Entities.test.tsx b/web/src/settings/Entities.test.tsx
new file mode 100644
index 00000000..5ac431a1
--- /dev/null
+++ b/web/src/settings/Entities.test.tsx
@@ -0,0 +1,86 @@
+import { cleanup, fireEvent, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import type { EntitiesSettings } from '../api/generated/EntitiesSettings';
+import type { Me } from '../api/generated/Me';
+import { Permission } from '../api/generated/Permission';
+import { en } from '../i18n/en';
+import { openSettings } from './fixtures';
+
+const words = en.settings.entities;
+
+/** Reads the settings without the permission to change them. */
+const READER: Me = {
+    id: 2,
+    username: 'grace',
+    isOwner: false,
+    permissions: Permission.SettingsView.toString(16),
+    mustChangePassword: false,
+};
+
+/** The Entities category over a server that lists every `now.everySeconds`, each save kept in the list returned. */
+const serve = (now: EntitiesSettings) => {
+    const sent: unknown[] = [];
+    vi.stubGlobal(
+        'fetch',
+        vi.fn(async (input: string, init: RequestInit) => {
+            const route = `${init.method ?? 'GET'} ${String(input).replace(/^\/api/, '')}`;
+            if (route === 'GET /servers/default/entities/settings') {
+                return Response.json(now);
+            }
+            if (route === 'PUT /servers/default/entities/settings') {
+                const body = JSON.parse(String(init.body)) as EntitiesSettings;
+                sent.push(body);
+                return Response.json(body);
+            }
+            return Response.json({ code: 'not_found', params: {} }, { status: 404 });
+        }),
+    );
+    return sent;
+};
+
+const cadence = (seconds: number) =>
+    screen.getByRole<HTMLInputElement>('radio', { name: words.seconds(seconds) });
+
+describe('Entities settings', () => {
+    afterEach(() => {
+        cleanup();
+        vi.unstubAllGlobals();
+    });
+
+    it('should show how often the server lists its entities, and save another cadence', async () => {
+        const sent = serve({ everySeconds: 15 });
+        await openSettings('/settings/entities');
+
+        expect(cadence(15).checked).toBe(true);
+        expect(screen.queryByRole('button', { name: en.settings.bar.save })).toBeNull();
+
+        fireEvent.click(cadence(30));
+        fireEvent.click(screen.getByRole('button', { name: en.settings.bar.save }));
+
+        await waitFor(() => expect(screen.getByText(words.saved)).toBeTruthy());
+        expect(sent).toEqual([{ everySeconds: 30 }]);
+        expect(cadence(30).checked).toBe(true);
+        expect(screen.queryByRole('button', { name: en.settings.bar.save })).toBeNull();
+    });
+
+    it('should go back to the cadence kept when the change is discarded', async () => {
+        const sent = serve({ everySeconds: 15 });
+        await openSettings('/settings/entities');
+
+        fireEvent.click(cadence(60));
+        fireEvent.click(screen.getByRole('button', { name: en.settings.bar.discard }));
+
+        expect(cadence(15).checked).toBe(true);
+        expect(sent).toEqual([]);
+    });
+
+    it('should let an account without the permission to change settings read the cadence only', async () => {
+        serve({ everySeconds: 10 });
+        await openSettings('/settings/entities', { me: READER });
+
+        expect(screen.getByText(words.readOnly)).toBeTruthy();
+        expect(cadence(10).checked).toBe(true);
+        expect(cadence(30).matches(':disabled')).toBe(true);
+    });
+});
diff --git a/web/src/settings/Entities.tsx b/web/src/settings/Entities.tsx
new file mode 100644
index 00000000..b8b8b2f3
--- /dev/null
+++ b/web/src/settings/Entities.tsx
@@ -0,0 +1,97 @@
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useState } from 'react';
+
+import { CADENCES, entitiesSettingsQuery, saveEntitiesSettings } from '../api/entities';
+import type { EntitiesSettings as Settings } from '../api/generated/EntitiesSettings';
+import { Permission } from '../api/generated/Permission';
+import { allows, useMe } from '../auth/me';
+import { Notice } from '../components/Notice';
+import { errorMessage } from '../i18n/errors';
+import { useI18n } from '../i18n/I18nProvider';
+import { SettingsForm, useSection } from './Form';
+import { CategoryHead, CategoryLink, CategoryLoading, Segmented, SettingRow, SettingsGroup } from './Row';
+
+type Outcome = { tone: 'success' | 'danger'; message: string };
+
+/** How often the server lists its entities while someone looks at them. */
+export function EntitiesSettings() {
+    const { t } = useI18n();
+    const me = useMe();
+    const settings = useQuery(entitiesSettingsQuery);
+    return (
+        <>
+            <CategoryHead
+                category="entities"
+                aside={
+                    allows(me, Permission.EntitiesView) ? (
+                        <CategoryLink to="/entities">{t.settings.entities.openEntities}</CategoryLink>
+                    ) : undefined
+                }
+            />
+            {settings.isPending && <CategoryLoading />}
+            {settings.isError && (
+                <Notice tone="danger">
+                    {t.settings.entities.loadFailed} {errorMessage(t, settings.error)}
+                </Notice>
+            )}
+            {settings.isSuccess && (
+                <SettingsForm>
+                    <EntitiesForm stored={settings.data} />
+                </SettingsForm>
+            )}
+        </>
+    );
+}
+
+function EntitiesForm({ stored }: { stored: Settings }) {
+    const { t } = useI18n();
+    const words = t.settings.entities;
+    const me = useMe();
+    const client = useQueryClient();
+    const canManage = allows(me, Permission.SettingsManage);
+    const [every, setEvery] = useState(stored.everySeconds);
+    const [outcome, setOutcome] = useState<Outcome | null>(null);
+    const save = useMutation({
+        mutationFn: () => saveEntitiesSettings({ everySeconds: every }),
+        onMutate: () => setOutcome(null),
+        onSuccess: (saved) => {
+            client.setQueryData(entitiesSettingsQuery.queryKey, saved);
+            setEvery(saved.everySeconds);
+            setOutcome({ tone: 'success', message: words.saved });
+        },
+        onError: (error) => setOutcome({ tone: 'danger', message: errorMessage(t, error) }),
+    });
+    const changed = every !== stored.everySeconds;
+    useSection({
+        changed: canManage && changed ? ['entitiesCadence'] : [],
+        pending: save.isPending,
+        save: () => save.mutate(),
+        discard: () => {
+            setEvery(stored.everySeconds);
+            setOutcome({ tone: 'success', message: words.discarded });
+        },
+    });
+
+    return (
+        <fieldset disabled={!canManage} className="flex min-w-0 flex-col gap-4">
+            {!canManage && <Notice>{words.readOnly}</Notice>}
+            {outcome !== null && <Notice tone={outcome.tone}>{outcome.message}</Notice>}
+            <SettingsGroup title={t.settings.categories.entities.name}>
+                <SettingRow id="entitiesCadence" changed={canManage && changed}>
+                    {(ids) => (
+                        <Segmented
+                            ids={ids}
+                            name="entitiesCadence"
+                            choices={CADENCES.map(String)}
+                            words={Object.fromEntries(
+                                CADENCES.map((value) => [String(value), words.seconds(value)]),
+                            )}
+                            value={String(every)}
+                            onChange={(value) => setEvery(Number(value))}
+                        />
+                    )}
+                </SettingRow>
+            </SettingsGroup>
+        </fieldset>
+    );
+}
diff --git a/web/src/settings/catalog.test.ts b/web/src/settings/catalog.test.ts
index 9a27576c..c43e58d1 100644
--- a/web/src/settings/catalog.test.ts
+++ b/web/src/settings/catalog.test.ts
@@ -47,8 +47,8 @@ describe('the settings catalog', () => {
 
 describe('search', () => {
     it('should find a setting by its name or by what its explanation says, whatever the case', () => {
-        // The live map's cadence says positions need it.
-        expect(found(OWNER, 'OneSync')).toEqual(['onesync', 'mapCadence']);
+        // The cadences of the live map and of the entities say that both need it.
+        expect(found(OWNER, 'OneSync')).toEqual(['onesync', 'mapCadence', 'entitiesCadence']);
         expect(found(OWNER, 'fingerprint')).toEqual(['hashRate', 'addressDays']);
         expect(found(OWNER, 'HASH')).toContain('hashRate');
     });
@@ -77,7 +77,7 @@ describe('search', () => {
     });
 
     it('should ignore accents typed or written', () => {
-        expect(found(OWNER, 'ÖneSync')).toEqual(['onesync', 'mapCadence']);
+        expect(found(OWNER, 'ÖneSync')).toEqual(['onesync', 'mapCadence', 'entitiesCadence']);
     });
 });
 
diff --git a/web/src/settings/catalog.ts b/web/src/settings/catalog.ts
index 50d0d8ab..d1fff393 100644
--- a/web/src/settings/catalog.ts
+++ b/web/src/settings/catalog.ts
@@ -39,6 +39,7 @@ export type SettingId =
     | 'mapBounds'
     | 'mapTiers'
     | 'mapCadence'
+    | 'entitiesCadence'
     | 'switchSftp'
     | 'switchChanges'
     | 'switchTools'
@@ -89,6 +90,7 @@ export type CategoryId =
     | 'backups'
     | 'bans'
     | 'map'
+    | 'entities'
     | 'features'
     | 'data'
     | 'tools'
@@ -183,6 +185,12 @@ export const CATEGORIES: readonly Category[] = [
             { id: 'mapCadence', applies: 'now' },
         ],
     },
+    {
+        id: 'entities',
+        group: 'server',
+        access: ['SettingsView'],
+        settings: [{ id: 'entitiesCadence', applies: 'now' }],
+    },
     {
         id: 'features',
         group: 'observer',

From 594471a39978861219e5e6cf64fd761e0dbaa1e7 Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 05:22:47 +0100
Subject: [PATCH 7/9] docs: describe the Entities page, its layer on the live
 map, deletion and the sweeps in the README

---
 README.md | 52 ++++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 44 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 356c2471..8421e2af 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,8 @@ what to do with them.
   FXServer's threads and connections, crash dumps and hangs.
 - **Live map.** Where the connected players stand, over Rockstar's map of GTA V or an image you add,
   coloured by play time, a click away from their profile and a ban.
+- **Entities.** The server's vehicles, peds and objects, each with the resource that created it and
+  the player whose game simulates it, found on the live map and deleted one at a time or a hundred.
 - **Debug.** What each resource sends and receives, writes into state bags and calls over HTTP,
   counted inside the resources: the event that floods the clients, the client that sends far more
   than the others, the resource that calls a host it never called. Off until the owner turns it on.
@@ -115,9 +117,9 @@ page, each with a temporary password that works for 72 hours and is changed at t
 
 The panel's pages are grouped by what one comes for: **Players** (the players, the live map, the
 bans), **Server** (restarts, the cfg, builds, backups, file changes), **Insights** (statistics, drops,
-diagnostics) and **Maintenance** (tools, the audit log). The search button beside the logo, or Ctrl K
-(⌘ K on a Mac) from any page, opens a search of the pages, of the settings by their name, and of the
-connected players by name or ID. Each account finds only what it may open.
+entities, diagnostics) and **Maintenance** (tools, the audit log). The search button beside the logo,
+or Ctrl K (⌘ K on a Mac) from any page, opens a search of the pages, of the settings by their name,
+and of the connected players by name or ID. Each account finds only what it may open.
 
 From the host, even while Observer runs:
 
@@ -867,11 +869,11 @@ are the owner's.
 
 File access over SFTP (`sftp`), file changes (`changes`), the server tools (`tools`), the diagnostics
 (`diagnostics`), the statistics (`metrics`), the players (`players`), the player drops (`drops`), the
-update checks (`updates`) and Debug (`debug`) can each be turned off; Debug alone starts off. A
-feature that is off runs none of its code: Observer does not open its port, start its tasks or open
-its database, and its API routes answer `feature_disabled`. What it recorded stays on disk, and its
-retention waits until it runs again. Supervision, the console, accounts, the audit log, the restart
-schedule and FXServer's builds are always on.
+update checks (`updates`), Debug (`debug`) and the entities (`entities`) can each be turned off; Debug
+alone starts off. A feature that is off runs none of its code: Observer does not open its port, start
+its tasks or open its database, and its API routes answer `feature_disabled`. What it recorded stays
+on disk, and its retention waits until it runs again. Supervision, the console, accounts, the audit
+log, the restart schedule and FXServer's builds are always on.
 
 `GET /api/features` (**View settings**) says for each feature whether it runs, what holds it off, and
 what it opens: its port, its tasks, its files, its routes. Only the owner turns one on or off, with
@@ -1013,6 +1015,40 @@ Positions come from the bridge, which reads them from OneSync: without OneSync t
 server sends them every 1, 2 or 5 seconds, only while someone has the page open, and stops within 30
 seconds after the last one leaves. Observer keeps them in memory only: nothing of them is written.
 
+## Entities
+
+The Entities page lists what the game holds on the server: its vehicles, its peds and its objects, as
+OneSync knows them. Each has its type, its model, the resource that created it, the player whose game
+simulates it, its routing bucket and its position. The players' own peds are counted and never listed.
+The list is filtered by type, vehicle class, creating resource, owner and bucket, searched by net ID,
+model, resource or owner's name, sorted by any column, and read a hundred at a time. Seeing it takes
+**See the entities**.
+
+A model shows as its hash, which is all the server knows of it: Observer ships no table of GTA V's
+names. The creating resource is the one the server knew when the entity was first seen: none for the
+game's own traffic, and for what a client's script created. Who owns an entity, and whether a player
+sits in a vehicle, is told only to accounts that also hold **See the live map**: both say where a
+player is.
+
+On the [live map](#live-map), **Entities** draws them under the players, a shape for each type. Past
+5,000 in the part of the map in view, the map counts them by square instead, and zooming in shows each
+one again. A click on an entity gives what the list says of it.
+
+**Delete entities** is a permission of its own. A deletion takes up to 100 entities, asks for a word
+typed from 20, and never takes a player's own ped, a vehicle a player sits in or a train. The server
+checks each entity again before it deletes it, so one that changed since the list was read stays, and
+the panel says what became of each. Nothing is deleted from a list more than three sweeps old, nor from
+one read before the server or its bridge restarted. Every deletion is in the audit log, with what was
+deleted and by whom.
+
+The entities come from the bridge, which reads them from OneSync: without OneSync there are none, and
+only GTA V servers are read. The server lists them every 15 seconds, or as often as the settings'
+Entities category says, only while someone has the page or the map's layer open, and stops within 30
+seconds after the last one leaves. A sweep works a millisecond at a time and gives the server its frame
+back in between, and stops at 50 ms of work, its list then partial. When a sweep costs more than half
+of that, the server spaces the next ones out by itself, up to once a minute, and comes back to its
+cadence once they are cheap again. Observer keeps the list in memory only: nothing of it is written.
+
 ## Updates
 
 Every 6 hours, Observer asks GitHub for the newest stable release. When it is newer, the owner sees

From 7a0cfbd571a267141c4e46dea5bb9b53de91ac63 Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 15:55:24 +0100
Subject: [PATCH 8/9] refactor(web): open every topic that follows a whole
 status the same way, for the topics to stay within clippy's length

---
 crates/observer-web/src/live/topics.rs | 96 ++++++++++++--------------
 1 file changed, 46 insertions(+), 50 deletions(-)

diff --git a/crates/observer-web/src/live/topics.rs b/crates/observer-web/src/live/topics.rs
index 9a0b682b..e3a8e7af 100644
--- a/crates/observer-web/src/live/topics.rs
+++ b/crates/observer-web/src/live/topics.rs
@@ -88,32 +88,21 @@ pub(super) async fn open(topic: Topic, since: Option<u64>, state: &AppState) ->
                 events: Some(audit_events(entries, latest_id)),
             })
         }
-        Topic::ServerStatus => {
-            let mut status = state.supervision.status();
-            let snapshot = status.borrow_and_update().clone();
-            Ok(Feed {
-                snapshot: TopicSnapshot::ServerStatus(snapshot),
-                events: Some(status_events(status, TopicEvent::ServerStatus)),
-            })
-        }
-        Topic::ServerSchedule => {
-            let mut status = state.schedule.status();
-            let snapshot = status.borrow_and_update().clone();
-            Ok(Feed {
-                snapshot: TopicSnapshot::ServerSchedule(snapshot),
-                events: Some(status_events(status, TopicEvent::ServerSchedule)),
-            })
-        }
-        Topic::ServerArtifacts => {
-            let mut status = state.artifacts.status();
-            let snapshot = status.borrow_and_update().clone();
-            Ok(Feed {
-                snapshot: TopicSnapshot::ServerArtifacts(Box::new(snapshot)),
-                events: Some(status_events(status, |status| {
-                    TopicEvent::ServerArtifacts(Box::new(status))
-                })),
-            })
-        }
+        Topic::ServerStatus => Ok(followed(
+            state.supervision.status(),
+            TopicSnapshot::ServerStatus,
+            TopicEvent::ServerStatus,
+        )),
+        Topic::ServerSchedule => Ok(followed(
+            state.schedule.status(),
+            TopicSnapshot::ServerSchedule,
+            TopicEvent::ServerSchedule,
+        )),
+        Topic::ServerArtifacts => Ok(followed(
+            state.artifacts.status(),
+            |status| TopicSnapshot::ServerArtifacts(Box::new(status)),
+            |status| TopicEvent::ServerArtifacts(Box::new(status)),
+        )),
         Topic::Console => {
             let (snapshot, lines) = state.supervision.console(since);
             Ok(Feed {
@@ -128,14 +117,11 @@ pub(super) async fn open(topic: Topic, since: Option<u64>, state: &AppState) ->
                 events: Some(metrics_events(samples)),
             })
         }
-        Topic::ServerAlerts => {
-            let mut alerts = state.diagnostics()?.alerts();
-            let snapshot = alerts.borrow_and_update().clone();
-            Ok(Feed {
-                snapshot: TopicSnapshot::ServerAlerts(snapshot),
-                events: Some(status_events(alerts, TopicEvent::ServerAlerts)),
-            })
-        }
+        Topic::ServerAlerts => Ok(followed(
+            state.diagnostics()?.alerts(),
+            TopicSnapshot::ServerAlerts,
+            TopicEvent::ServerAlerts,
+        )),
         Topic::ServerDiagnostics => {
             let (snapshot, events) = state.diagnostics()?.follow().await?;
             Ok(Feed {
@@ -157,22 +143,16 @@ pub(super) async fn open(topic: Topic, since: Option<u64>, state: &AppState) ->
                 events: Some(watched_events(live, watching, TopicEvent::ServerEntities)),
             })
         }
-        Topic::ServerChanges => {
-            let mut live = state.changes()?.live();
-            let snapshot = live.borrow_and_update().clone();
-            Ok(Feed {
-                snapshot: TopicSnapshot::ServerChanges(snapshot),
-                events: Some(status_events(live, TopicEvent::ServerChanges)),
-            })
-        }
-        Topic::ServerResources => {
-            let mut resources = state.supervision.resources();
-            let snapshot = resources.borrow_and_update().clone();
-            Ok(Feed {
-                snapshot: TopicSnapshot::ServerResources(snapshot),
-                events: Some(status_events(resources, TopicEvent::ServerResources)),
-            })
-        }
+        Topic::ServerChanges => Ok(followed(
+            state.changes()?.live(),
+            TopicSnapshot::ServerChanges,
+            TopicEvent::ServerChanges,
+        )),
+        Topic::ServerResources => Ok(followed(
+            state.supervision.resources(),
+            TopicSnapshot::ServerResources,
+            TopicEvent::ServerResources,
+        )),
     }
 }
 
@@ -202,6 +182,22 @@ fn metrics_events(samples: broadcast::Receiver<LiveSample>) -> Events {
     }))
 }
 
+/// A status as it stands, then the whole of it each time it changes.
+fn followed<T>(
+    mut status: watch::Receiver<T>,
+    snapshot: fn(T) -> TopicSnapshot,
+    event: fn(T) -> TopicEvent,
+) -> Feed
+where
+    T: Clone + Send + Sync + 'static,
+{
+    let current = status.borrow_and_update().clone();
+    Feed {
+        snapshot: snapshot(current),
+        events: Some(status_events(status, event)),
+    }
+}
+
 /// The whole status each time it changes. A client too slow to see every change only misses the
 /// ones a newer status already replaced.
 fn status_events<T>(status: watch::Receiver<T>, event: fn(T) -> TopicEvent) -> Events

From 98f3eee210f53c4adc3fc96bd02d3b9690c63960 Mon Sep 17 00:00:00 2001
From: ImBaphomet <lucenzo.76@gmail.com>
Date: Wed, 11 Nov 2026 16:08:28 +0100
Subject: [PATCH 9/9] test(web): give the entities tests their permissions' new
 bits, 27 and 28

---
 crates/observer-web/src/tests/entities.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/observer-web/src/tests/entities.rs b/crates/observer-web/src/tests/entities.rs
index 338192e7..68b18c5a 100644
--- a/crates/observer-web/src/tests/entities.rs
+++ b/crates/observer-web/src/tests/entities.rs
@@ -8,8 +8,8 @@ use super::live::{receive, send};
 use super::{OWNER_PASSWORD, Server};
 
 const DASHBOARD_VIEW: &str = "1";
-const ENTITIES_VIEW: &str = "4000000";
-const ENTITIES_DELETE: &str = "8000000";
+const ENTITIES_VIEW: &str = "8000000";
+const ENTITIES_DELETE: &str = "10000000";
 const SETTINGS_VIEW: &str = "200";
 const SETTINGS_MANAGE: &str = "600";
 const ENTITIES: &str = "/api/servers/default/entities";