@@ -45,7 +45,7 @@ Artifacts are published to Maven Central under the `farm.query` group.
 
 ```kotlin
 dependencies {
-    implementation("farm.query:vgi:0.46.0")
+    implementation("farm.query:vgi:0.46.1")
 }
 ```
 
@@ -55,7 +55,7 @@ dependencies {
 <dependency>
   <groupId>farm.query</groupId>
   <artifactId>vgi</artifactId>
-  <version>0.46.0</version>
+  <version>0.46.1</version>
 </dependency>
 ```
 
@@ -143,6 +143,16 @@ SELECT demo.multiply(21, 2);  -- 42
 
 The `launch:` location scheme starts the worker once behind a flock-coordinated Unix socket and reuses it across queries and engine processes — essential for JVM workers, which are expensive to cold-start. Plain subprocess (`/path/to/worker`) and `http(s)://` locations also work.
 
+## Running several HTTP replicas
+
+Set the same `VGI_SIGNING_KEY` (or call `Worker.signingKey(byte[])`) on every
+replica. It seals `attach_opaque_data` and, through an HKDF-SHA256 derivation
+(label `vgi.http.state_token_key.v1`, never the raw key), keys the HTTP
+stream-state tokens, so a table-function stream started on one replica resumes
+on any other and survives a restart. Without it each process uses a random key
+and logs a warning at startup. An explicit `HttpServer.Config.Builder.tokenKey`
+still takes precedence.
+
 ## Example worker
 
 For authenticated `iroh://` and HTTP-semantics `httpi://` deployments, see
 
@@ -8,7 +8,7 @@ plugins {
 
 allprojects {
     group = "farm.query"
-    version = "0.46.0"
+    version = "0.46.1"
 
     repositories {
         mavenCentral()
 
@@ -49,5 +49,5 @@ These build against `project(":vgi")` so they track the SDK at HEAD. A reader
 does the same thing with one line:
 
 ```kotlin
-implementation("farm.query:vgi:0.46.0")
+implementation("farm.query:vgi:0.46.1")
 ```
@@ -10,7 +10,7 @@
 // the SDK at HEAD and a breaking change shows up here rather than in a reader's
 // editor. A reader does the same thing with one line instead:
 //
-//     implementation("farm.query:vgi:0.46.0")
+//     implementation("farm.query:vgi:0.46.1")
 //
 // which is what the documentation shows. The toolchain, `-parameters` and the
 // JVM opens all come from the root build, so nothing else is repeated here.
 
@@ -496,7 +496,9 @@ public Worker maxAuthAge(double seconds) {
      *
      * <p>Any length: a 32-byte key is used as-is, any other is replaced by its SHA-256, exactly as
      * {@code VGI_SIGNING_KEY} is normalized in every VGI SDK. A configured key also lets replicas
-     * open each other's opaque data and tickets. Without one each HTTP process seals with a random
+     * open each other's opaque data and tickets, and keys the HTTP stream-state tokens (an
+     * HKDF-SHA256 derivation, never the raw key; see {@link #runHttp}) so table-function streams
+     * resume on any replica and across restarts. Without one each HTTP process seals with a random
      * key of its own, and attach tickets are not hosted: every ticket would die on restart.
      *
      * @param key the key bytes, or {@code null} to defer to {@code VGI_SIGNING_KEY}
@@ -2265,6 +2267,12 @@ public void runFromArgs(String[] args) {
      *  (15 s by default; see {@code HttpServer}'s {@code setStopTimeout}) and
      *  then forcibly closes any stragglers.
      *
+     *  <p>State tokens: when {@code config} sets no {@code tokenKey} and a signing key is
+     *  configured ({@link #signingKey(byte[])} or {@code VGI_SIGNING_KEY}), the stream-state
+     *  token key is derived from it (HKDF-SHA256, label {@value #STATE_TOKEN_KEY_LABEL}), so
+     *  every replica sharing the signing key can resume table-function streams another replica
+     *  started. With neither, the key is random per process and a warning is logged.
+     *
      * @param config fully-built HTTP server configuration
      * @throws Exception if the server fails to start or serve
      */
@@ -2276,6 +2284,7 @@ public void runHttp(HttpServer.Config config) throws Exception {
         HttpServer.Config effective = config.landingInfo() != null
                 ? config
                 : config.withLandingInfo(farm.query.vgi.http.WorkerLandingInfo.of(this));
+        effective = withStateTokenKey(effective, configuredSigningKey(), log);
         HttpServer http = new HttpServer(buildServer(Transport.HTTP), effective);
         http.start();
         System.out.println("PORT:" + http.port());
@@ -2294,6 +2303,86 @@ public void runHttp(HttpServer.Config config) throws Exception {
         http.join();
     }
 
+    /** HKDF {@code info} label for the HTTP stream-state token key derived from the signing key. */
+    static final String STATE_TOKEN_KEY_LABEL = "vgi.http.state_token_key.v1";
+
+    /**
+     * Give an HTTP config a stable stream-state token key when it has none.
+     *
+     * <p>Table-function state (cursors, the per-turn producer state) travels between HTTP
+     * requests in AEAD-sealed state tokens. With no token key vgi-rpc seals them with a random
+     * per-process key, so a token minted by one replica (or before a restart) cannot be opened by
+     * another. When a signing key is configured ({@link #signingKey(byte[])} or
+     * {@code VGI_SIGNING_KEY}) the token key is derived from it with HKDF-SHA256 under the label
+     * {@value #STATE_TOKEN_KEY_LABEL} (never the raw signing key), so every replica sharing the
+     * signing key can resume every other replica's streams. An explicit
+     * {@code HttpServer.Config.Builder#tokenKey} always wins. Without either, the per-process key
+     * is kept and a one-line warning is logged.
+     *
+     * @param config     the HTTP config
+     * @param signingKey the normalized configured signing key, or {@code null}
+     * @param log        where to log the single-replica warning, or {@code null}
+     * @return {@code config}, or a copy carrying the derived token key
+     */
+    static HttpServer.Config withStateTokenKey(HttpServer.Config config, byte[] signingKey,
+                                               org.slf4j.Logger log) {
+        if (config.tokenKey() != null) return config;
+        if (signingKey == null) {
+            if (log != null) {
+                log.warn("HTTP state tokens are sealed with a random per-process key: table-function "
+                        + "streams cannot resume on another replica or after a restart; set "
+                        + SIGNING_KEY_ENV + " (or Worker.signingKey) for multi-replica deployments");
+            }
+            return config;
+        }
+        return copyConfigWithTokenKey(config, deriveStateTokenKey(signingKey));
+    }
+
+    /**
+     * Derive the 32-byte HTTP state-token key from a signing key: HKDF-SHA256 (RFC 5869) with an
+     * all-zero salt and {@code info} = {@value #STATE_TOKEN_KEY_LABEL}.
+     *
+     * @param signingKey the signing key (input keying material)
+     * @return the derived 32-byte key
+     */
+    static byte[] deriveStateTokenKey(byte[] signingKey) {
+        try {
+            javax.crypto.Mac mac = javax.crypto.Mac.getInstance("HmacSHA256");
+            mac.init(new javax.crypto.spec.SecretKeySpec(new byte[32], "HmacSHA256"));
+            byte[] prk = mac.doFinal(signingKey);
+            mac.init(new javax.crypto.spec.SecretKeySpec(prk, "HmacSHA256"));
+            mac.update(STATE_TOKEN_KEY_LABEL.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+            mac.update((byte) 1);
+            return mac.doFinal(); // L = 32 = HashLen: one expand block
+        } catch (java.security.GeneralSecurityException e) {
+            throw new IllegalStateException("HmacSHA256 unavailable", e);
+        }
+    }
+
+    /** Copy the {@code HttpServer.Config} record with {@code tokenKey} replaced, via its canonical
+     *  constructor, so this keeps working as vgi-rpc adds config components. */
+    private static HttpServer.Config copyConfigWithTokenKey(HttpServer.Config config, byte[] tokenKey) {
+        try {
+            java.lang.reflect.RecordComponent[] comps = HttpServer.Config.class.getRecordComponents();
+            Object[] values = new Object[comps.length];
+            Class<?>[] types = new Class<?>[comps.length];
+            boolean found = false;
+            for (int i = 0; i < comps.length; i++) {
+                types[i] = comps[i].getType();
+                if ("tokenKey".equals(comps[i].getName())) {
+                    values[i] = tokenKey;
+                    found = true;
+                } else {
+                    values[i] = comps[i].getAccessor().invoke(config);
+                }
+            }
+            if (!found) throw new IllegalStateException("HttpServer.Config has no tokenKey component");
+            return HttpServer.Config.class.getDeclaredConstructor(types).newInstance(values);
+        } catch (ReflectiveOperationException e) {
+            throw new IllegalStateException("cannot set the HTTP state-token key", e);
+        }
+    }
+
     private static void requireLoopback(String host, String label) {
         if (!("127.0.0.1".equals(host) || "::1".equals(host) || "localhost".equals(host))) {
             throw new IllegalArgumentException(label + " must bind loopback, got " + host);
 
@@ -78,7 +78,7 @@ public record ArgSpec(
      * @param le      inclusive upper bound ({@code value <= le}), or {@code null}.
      * @param gt      exclusive lower bound ({@code value > gt}), or {@code null}.
      * @param lt      exclusive upper bound ({@code value < lt}), or {@code null}.
-     * @param pattern regex the value must match, or {@code null}.
+     * @param pattern regex the value must contain a match for (unanchored search; anchor with {@code ^}/{@code $} for a full match), or {@code null}.
      */
     public record Constraints(
             List<Object> choices,
@@ -132,7 +132,7 @@ public static Constraints choices(List<Object> choices) {
         /**
          * Regex constraint only.
          *
-         * @param pattern the regex the value must match.
+         * @param pattern the regex searched for in the value (unanchored; anchor with {@code ^}/{@code $} for a full match).
          * @return a pattern-only {@link Constraints}.
          */
         public static Constraints pattern(String pattern) {
 
@@ -24,24 +24,56 @@ private ConstraintEnforcer() {}
     /**
      * Validate a function's const arguments against their declared constraints.
      *
-     * <p>Const arguments are numbered sequentially (the i-th const spec reads the
-     * i-th positional value); a value that violates a declared choices /
-     * ge/le/gt/lt / pattern constraint throws {@link IllegalArgumentException}. A
-     * null (absent) value is skipped, matching the other SDKs.
+     * <p>Where each const argument's value is read from:
+     * <ul>
+     *   <li>a <b>named-only</b> spec ({@code position() < 0}, e.g.
+     *       {@link ArgSpec#named}) reads {@code args.named().get(name)} and does
+     *       <em>not</em> consume a positional slot;</li>
+     *   <li>a <b>positional</b> const spec reads the next value of
+     *       {@code args.positional()}: the wire carries only the const values
+     *       there, densely, in declaration order (column, TABLE and named
+     *       arguments are not in it), so the i-th positional const spec reads
+     *       the i-th positional value;</li>
+     *   <li>a <b>varargs</b> const spec checks every remaining positional value.</li>
+     * </ul>
+     * A value that violates a declared choices / ge/le/gt/lt / pattern constraint
+     * throws {@link IllegalArgumentException}. A null (absent) value is skipped,
+     * matching the other SDKs, so a catalog-listing bind with empty arguments
+     * never trips a constraint.
+     *
+     * <p>{@code pattern} is an <b>unanchored search</b> (like JSON Schema / ECMA
+     * {@code pattern}, and the Rust and Go SDKs): {@code "https?://"} accepts
+     * {@code "see http://x"}. Anchor explicitly with {@code ^} / {@code $} to
+     * require a full match.
      *
      * @param args the bound call arguments (may be {@code null}).
      * @param specs the function's argument specs in declaration order (may be {@code null}).
      */
     public static void enforce(Arguments args, List<ArgSpec> specs) {
         if (args == null || specs == null) return;
+        List<Object> positional = args.positional() == null ? List.of() : args.positional();
+        java.util.Map<String, Object> named = args.named() == null ? java.util.Map.of() : args.named();
         int constIdx = 0;
         for (ArgSpec spec : specs) {
             if (!spec.isConst()) continue;
             ArgSpec.Constraints c = spec.constraints();
-            if (c != null && !c.isEmpty()) {
-                Object value = constIdx < args.positional().size()
-                        ? args.positional().get(constIdx)
-                        : null;
+            boolean constrained = c != null && !c.isEmpty();
+            if (spec.position() < 0) {
+                // Named-only: looked up by name, consumes no positional slot.
+                if (constrained) validateConstValue(spec.name(), c, named.get(spec.name()));
+                continue;
+            }
+            if (spec.varargs()) {
+                if (constrained) {
+                    for (int i = constIdx; i < positional.size(); i++) {
+                        validateConstValue(spec.name(), c, positional.get(i));
+                    }
+                }
+                constIdx = Math.max(constIdx, positional.size());
+                continue;
+            }
+            if (constrained) {
+                Object value = constIdx < positional.size() ? positional.get(constIdx) : null;
                 validateConstValue(spec.name(), c, value);
             }
             constIdx++;
@@ -70,7 +102,7 @@ private static void validateConstValue(String name, ArgSpec.Constraints c, Objec
         }
         if (c.pattern() != null && !c.pattern().isEmpty() && value instanceof String s) {
             try {
-                if (!Pattern.matches(c.pattern(), s)) {
+                if (!Pattern.compile(c.pattern()).matcher(s).find()) {
                     throw constraintError(name, "must match pattern " + c.pattern());
                 }
             } catch (PatternSyntaxException ignored) {
 
@@ -38,7 +38,7 @@
  *   <li>{@code vgi_choices} — JSON array of the closed set of allowed values.</li>
  *   <li>{@code vgi_range} — interval notation built from {@code ge}/{@code le}/
  *       {@code gt}/{@code lt} (e.g. {@code "[0, 10]"}, {@code "(0, +inf)"}).</li>
- *   <li>{@code vgi_pattern} — the raw regex the value must match.</li>
+ *   <li>{@code vgi_pattern} — the raw regex, an unanchored search over the value.</li>
  * </ul>
  */
 public final class ArgumentSpecSerializer {
 
@@ -3224,8 +3224,9 @@ private FunctionInfo toScalarFunctionInfo(ScalarFunction fn, String schemaName)
      * @return the wire {@link FunctionInfo}.
      */
     static FunctionInfo scalarFunctionInfo(ScalarFunction fn, String schemaName) {
-        BindResponse r = fn.onBind(new ScalarBindParams(fn.name(), Arguments.empty(), null, Map.of()));
-        return baseFunctionInfo(fn, schemaName, "SCALAR", bindOutput(r), false);
+        byte[] out = catalogBindOutput(fn.name(),
+                () -> fn.onBind(new ScalarBindParams(fn.name(), Arguments.empty(), null, Map.of())));
+        return baseFunctionInfo(fn, schemaName, "SCALAR", out, false);
     }
 
     private FunctionInfo toTableFunctionInfo(TableFunction fn, String schemaName) {
@@ -3251,20 +3252,22 @@ static FunctionInfo tableFunctionInfo(TableFunction fn, String schemaName) {
             return withRequiredSecrets(baseFunctionInfo(fn, schemaName, "TABLE",
                     SchemaUtil.serializeSchema(new Schema(List.of())), false), fn.requiredSecrets());
         }
-        BindResponse r = fn.onBind(new TableBindParams(fn.name(), Arguments.empty(), null, Map.of()));
-        return withRequiredSecrets(baseFunctionInfo(fn, schemaName, "TABLE", bindOutput(r), false),
+        byte[] out = catalogBindOutput(fn.name(),
+                () -> fn.onBind(new TableBindParams(fn.name(), Arguments.empty(), null, Map.of())));
+        return withRequiredSecrets(baseFunctionInfo(fn, schemaName, "TABLE", out, false),
                 fn.requiredSecrets());
     }
 
     private FunctionInfo toTableInOutFunctionInfo(TableInOutFunction fn, String schemaName) {
-        BindResponse r = fn.onBind(new TableInOutBindParams(fn.name(), Arguments.empty(), null, Map.of()));
+        byte[] out = catalogBindOutput(fn.name(),
+                () -> fn.onBind(new TableInOutBindParams(fn.name(), Arguments.empty(), null, Map.of())));
         // has_finalize drives the C++ per-substream FINALIZE-phase init after
         // input EOS (parallel streaming finalize). Blended (RowTransformFunction)
         // registrations additionally advertise input_from_args, entering the
         // C++ in-out registration branch with real-typed positional args; the
         // C++ rejects input_from_args && has_finalize, and RowTransformFunction
         // pins hasFinalize() to false, so the pair stays consistent.
-        FunctionInfo base = baseFunctionInfo(fn, schemaName, "TABLE", bindOutput(r), fn.hasFinalize());
+        FunctionInfo base = baseFunctionInfo(fn, schemaName, "TABLE", out, fn.hasFinalize());
         // Re-stamp the TIO-specific fields baseFunctionInfo hardcodes:
         // max_workers (0 = the C++ parallel-by-default per-substream fan-out;
         // 1 would be the A3 serial opt-out AND disqualify the exchange-mode
@@ -3325,9 +3328,10 @@ private static FunctionInfo withRequiredSecrets(
 
     private FunctionInfo toBufferingFunctionInfo(
             farm.query.vgi.buffering.TableBufferingFunction fn, String schemaName) {
-        BindResponse r = fn.onBind(new TableInOutBindParams(fn.name(), Arguments.empty(), null, Map.of()));
+        byte[] out = catalogBindOutput(fn.name(),
+                () -> fn.onBind(new TableInOutBindParams(fn.name(), Arguments.empty(), null, Map.of())));
         FunctionInfo base = baseFunctionInfo(fn.name(), fn.metadata(), schemaName, "TABLE_BUFFERING",
-                ArgumentSpecSerializer.toIpcBytes(fn.argumentSpecs()), bindOutput(r),
+                ArgumentSpecSerializer.toIpcBytes(fn.argumentSpecs()), out,
                 encodeParameterDefaults(fn), /*hasFinalize=*/true, 1, null);
         // Re-stamp the buffering-specific ordering flags (baseFunctionInfo
         // hardcodes them false; they're only meaningful for TableBuffering).
@@ -3353,6 +3357,29 @@ private static byte[] bindOutput(BindResponse r) {
         return r.output_schema() != null ? r.output_schema() : new byte[0];
     }
 
+    private static final org.slf4j.Logger CATALOG_LOG =
+            org.slf4j.LoggerFactory.getLogger(VgiServiceImpl.class);
+
+    /**
+     * Run a catalog-listing bind (empty arguments, no input schema) and return its
+     * output schema bytes. A function whose {@code onBind} rejects the empty-argument
+     * probe (validating required arguments, needing an attach, ...) must not break
+     * ATTACH for the whole catalog: the failure is swallowed and an empty output
+     * schema is advertised instead, which is what vgi-python always advertises for
+     * table functions. The real bind at call time still runs {@code onBind} with the
+     * caller's arguments. Constraint enforcement is a no-op here: every declared
+     * argument is absent, and absent values skip their constraints.
+     */
+    private static byte[] catalogBindOutput(String name, java.util.function.Supplier<BindResponse> bind) {
+        try {
+            return bindOutput(bind.get());
+        } catch (RuntimeException e) {
+            CATALOG_LOG.debug("catalog listing: onBind of '{}' with empty arguments threw ({}); "
+                    + "advertising an empty output schema", name, e.toString());
+            return SchemaUtil.serializeSchema(new Schema(List.of()));
+        }
+    }
+
     private static farm.query.vgi.pushdown.PushdownFiltersDecoder.Capabilities filterCapabilities(
             FunctionMetadata metadata) {
         Set<farm.query.vgi.pushdown.FilterIdentity> functions = new java.util.LinkedHashSet<>();