@huynle/hub 0.8.6 → 0.9.0

package/src/central/spoke-ws.ts

@@ -51,7 +51,7 @@ import type { CloseNotice, PodRpc, RpcCall } from "./cluster/rpc"
 import type { Auth } from "./auth"
 import type { NodeRegistry } from "./nodes"
 import type { NotificationKind, PushExtra } from "./push"
-import type { Registry } from "./registry"
+import type { FrontAction, Registry } from "./registry"
 import { newID, type Store } from "./store"
 
 /** Push notifications (implemented by Push in push.ts) to `ownerID`'s devices. Returns the number of devices notified. */
@@ -237,6 +237,8 @@ export class SpokeHub {
 
   constructor(private readonly options: SpokeHubOptions) {
     const staleMs = options.staleMs ?? 60_000
+    // (voice front P1) The registry decides about fronts; this sends it (re-link a known front, delete a stale one).
+    options.registry.subscribeFrontActions((action) => this.frontAction(action))
     this.started = this.startCluster()
     this.heartbeat = setInterval(() => {
       const now = Date.now()
@@ -732,10 +734,22 @@ export class SpokeHub {
     }
   }
 
+  /** (voice front P1) Re-links a conversation's front through another process, or deletes a stale front. */
+  private frontAction(action: FrontAction): void {
+    const { registry } = this.options
+    const failed = (cause: unknown) => console.error("[hub] voice front request failed:", cause instanceof Error ? cause.message : cause)
+    if (action.kind === "remove") return void this.request(action.connID, { op: "removeFront", sessionID: action.sessionID }).catch(failed)
+    this.request(action.connID, { op: "conversation", sessionID: action.mainID, on: true, front: true, frontID: action.frontID }).then((result) => registry.frontAnswer(action.mainID, action.connID, result.front?.sessionID), failed)
+  }
+
   /** Tells a (re)connected owner about sessions the phone has in conversation mode. */
   private resendConversations(connID: string): void {
-    for (const sessionID of this.options.registry.conversationResends(connID)) {
-      this.request(connID, { op: "conversation", sessionID, on: true }).catch((cause) => {
+    const { registry } = this.options
+    for (const sessionID of registry.conversationResends(connID)) {
+      // (voice front P1) A front asked for is asked for again (only from a spoke that serves it); the answer names it.
+      const front = registry.resendFront(sessionID, connID)
+      const frontID = front ? registry.resendFrontID(sessionID) : undefined
+      this.request(connID, { op: "conversation", sessionID, on: true, ...(front ? { front: true } : {}), ...(frontID ? { frontID } : {}) }).then((result) => registry.frontAnswer(sessionID, connID, front ? result.front?.sessionID : undefined), (cause) => {
         console.error("[hub] re-sending conversation mode failed:", cause instanceof Error ? cause.message : cause)
       })
     }

package/src/central/store.ts

@@ -37,6 +37,8 @@ export interface UserRecord {
   speech?: StoredSpeech
   /** The phone's session view: hidden and pinned sessions and workspaces (synced across devices). */
   viewPrefs?: ViewPrefs
+  /** (RF2) Hosts and `*.suffix`es whose web images the console loads at once (normalised; absent = none). */
+  mediaAllowlist?: string[]
   /** Session ID → per-session Voice and complex-worker model overrides, oldest first. */
   modelPrefs?: Record<string, SessionModelPrefs>
   /** Session ID → when the user last read it (ms), least recently marked first. */
@@ -903,6 +905,25 @@ export class Store {
     })
   }
 
+  // ---------- per-user media allowlist (RF2) ----------
+
+  /** A copy of the user's media allowlist (empty when unset or unknown). */
+  mediaAllowlist(id: string): string[] {
+    const stored = this.user(id)?.mediaAllowlist
+    return Array.isArray(stored) ? stored.filter((entry): entry is string => typeof entry === "string") : []
+  }
+
+  /** Replaces the allowlist (callers validate and normalise: parseMediaAllowlist); returns the result. */
+  setMediaAllowlist(id: string, allowlist: readonly string[]): Promise<string[]> {
+    return this.mutate((tx) => {
+      const user = this.user(id)
+      if (!user) return []
+      user.mediaAllowlist = [...allowlist]
+      tx.touch("users", id)
+      return this.mediaAllowlist(id)
+    })
+  }
+
   // ---------- per-user view preferences ----------
 
   viewPrefs(id: string): ViewPrefs {

package/src/central/teams/intake-routes.ts

@@ -1,7 +1,8 @@
 // Team intake routes on /api/agent (HWA-36; contract: Teams `POST /teams/:id/intake`, scope teams:submit). The rest
 // of the teams surface (definitions, staffing, roster, teams:read|manage) is HWA-37's.
 //
-//   POST /teams/:id/intake                     {title, brief?, priority?, labels?, due?, criteria?, ref?}  Idempotency-Key
+//   POST /teams/:id/intake                     {title, brief?, priority?, labels?, due?, notAfter?, criteria?, ref?}  Idempotency-Key
+//        (notAfter, epoch ms: 400 invalid, 422 expired when already passed and not a replay; queued past it → cancelled)
 //   GET  /teams/:id/intake?status&limit&cursor → {items, cursor?}
 //   GET  /teams/:id/intake/:intake           → {intake}
 //   POST /teams/:id/intake/:intake/status    {status, expectedRevision, reason?} → {intake, assignment?}

package/src/central/teams/intake.ts

@@ -43,6 +43,16 @@
 // Delivery is at-least-once: a routing claim (claimMs) keeps two drains from delivering the same item; a crash
 // after delivery and before the routed write re-delivers after the claim expires (the assignment is reused).
 // Events (`team.intake`, family manage) carry IDs, enums and revisions only: never title, brief, labels or criteria.
+//
+// notAfter (H4, hl3hd4iw; the generic "not after T" of ../agent/not-after): an optional deadline (epoch ms) checked
+// at submit by parseNotAfter (invalid, or expired when already passed: nothing is stored; an Idempotency-Key replay
+// of the original body still returns the original). An item still `queued` when it passes is `cancelled` with
+// reason "not_after" (its brief dropped, a leftover assignment cancelled; `team.intake` once, reasonCode not_after),
+// never delivered late. The check runs first in every drain (staffing and presence events, submit, reads) and in
+// sweep(): the team-intake leader runs it at start (so a restart re-arms from stored items), at the earliest stored
+// deadline it knows of and at least every sweepMs (deadlines submitted on another pod). An item claimed by a route in
+// flight is left to that route: Delivery refuses a send past notAfter (expired), which cancels the item at once.
+// Once routed, the team owns it: the message inherits notAfter (Delivery ends a pending hold at the deadline).
 import { createHash, randomBytes } from "node:crypto"
 import {
   ID_PREFIXES,
@@ -66,8 +76,10 @@ import { sanitizeLabel } from "../agent/envelope"
 import { AgentError } from "../agent/errors"
 import type { AgentEvents, EventInput } from "../agent/events"
 import { canonicalBody } from "../agent/idempotency"
+import { parseNotAfter } from "../agent/not-after"
 import { updateVersioned } from "../agent/versioned"
-import type { Clock, StateStore } from "../backend/types"
+import { realTimers } from "../backend/memory-bus"
+import type { Clock, StateStore, Timers } from "../backend/types"
 import { assignmentChangedEvent } from "../workspaces/events"
 import type { MembershipStore, SessionPresence, SessionPresenceLookup, StoredAssignment } from "../workspaces/members"
 import type { TeamSeatStore } from "./seats"
@@ -107,6 +119,8 @@ export interface IntakeLimits {
   readonly keysPerTeam: number
   /** How long a routing claim holds before another drain may retry the item. */
   readonly claimMs: number
+  /** The longest the deadline sweep waits between passes (deadlines it has not seen yet: submitted on another pod). */
+  readonly sweepMs: number
 }
 
 export const INTAKE_LIMITS: IntakeLimits = {
@@ -120,6 +134,7 @@ export const INTAKE_LIMITS: IntakeLimits = {
   criterionMax: 200,
   keysPerTeam: 1_000,
   claimMs: 60_000,
+  sweepMs: 60_000,
 }
 
 /** A TeamIntake as stored and read: the contract record plus additive fields (HWA-36). */
@@ -128,6 +143,8 @@ export interface StoredIntake extends TeamIntake {
   readonly labels?: readonly string[]
   /** Due time (epoch ms). */
   readonly due?: number
+  /** Not delivered after this (epoch ms): still queued then → cancelled, reason "not_after". */
+  readonly notAfter?: number
   readonly criteria?: readonly string[]
   readonly workspaceID?: string
   /** The entry seat's session it was delivered to. */
@@ -166,9 +183,15 @@ interface IntakeDoc {
 
 /**
  * Delivers one task text to a session (production: Delivery.send as intakeActor); `hop`: the chain it continues (a
- * submitting session's depth + 1; production passes it as SendOptions.chainHop).
+ * submitting session's depth + 1; production passes it as SendOptions.chainHop); `notAfter`: the item's deadline
+ * (SendOptions.notAfter: refused as expired once passed, and a pending hold ends then).
  */
-export type IntakeDeliver = (userID: string, sessionID: string, text: string, options?: { readonly hop?: number }) => Promise<{ readonly messageID: string }>
+export type IntakeDeliver = (
+  userID: string,
+  sessionID: string,
+  text: string,
+  options?: { readonly hop?: number; readonly notAfter?: number },
+) => Promise<{ readonly messageID: string }>
 
 /** The hop a message from the session would carry now (production: Delivery.hops.next). */
 export type IntakeHopOf = (userID: string, sessionID: string) => Promise<number>
@@ -188,6 +211,9 @@ export interface TeamIntakeDeps {
   readonly now?: Clock
   readonly newID?: (kind: IdKind) => string
   readonly limits?: Partial<IntakeLimits>
+  /** Every user with intake (the deadline sweep looks at all of them; absent: the sweep does nothing). */
+  readonly users?: () => Iterable<string> | Promise<Iterable<string>>
+  readonly timers?: Timers
 }
 
 export interface IntakeListQuery {
@@ -211,7 +237,9 @@ export interface IntakeSummary {
   readonly oldestQueuedAt?: number
 }
 
-const SUBMIT_FIELDS = new Set(["title", "brief", "priority", "labels", "due", "criteria", "ref"])
+const SUBMIT_FIELDS = new Set(["title", "brief", "priority", "labels", "due", "notAfter", "criteria", "ref"])
+/** reasonCode of the event (and `reason` of the item) when an item's notAfter passed while it was queued. */
+export const NOT_AFTER_REASON = "not_after"
 const STATUS_FIELDS = new Set(["status", "expectedRevision", "reason"])
 const CLOSED: ReadonlySet<IntakeStatus> = new Set(["done", "cancelled", "failed"])
 const OPEN_ASSIGNMENT: ReadonlySet<string> = new Set(["open", "in_progress", "blocked"])
@@ -258,7 +286,13 @@ function view(row: IntakeRow): StoredIntake {
   return rest
 }
 
-const intakeEvent = (row: StoredIntake): EventInput => ({
+/**
+ * The journal (and webhook) event of an intake change. Data: enums, revision and timestamps; `reasonCode` is the last
+ * routing failure's error code, or "not_after" when the item was cancelled because its deadline passed (never the
+ * free-text reason). An app's submission names the app as `audience.by`, so that app token's webhooks get its own
+ * submissions' changes.
+ */
+const intakeEvent = (row: StoredIntake, reasonCode: string | undefined = row.lastError): EventInput => ({
   type: "team.intake",
   family: "manage",
   subject: {
@@ -268,7 +302,19 @@ const intakeEvent = (row: StoredIntake): EventInput => ({
     ...(row.workspaceID !== undefined ? { workspaceID: row.workspaceID } : {}),
     ...(row.sessionID !== undefined ? { sessionID: row.sessionID } : {}),
   },
-  data: { status: row.status, revision: row.revision, source: row.source.kind, priority: row.priority, ...(row.progress !== undefined ? { progress: row.progress } : {}) },
+  data: {
+    status: row.status,
+    revision: row.revision,
+    source: row.source.kind,
+    priority: row.priority,
+    ...(row.progress !== undefined ? { progress: row.progress } : {}),
+    ...(reasonCode !== undefined ? { reasonCode } : {}),
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+    ...(row.routedAt !== undefined ? { routedAt: row.routedAt } : {}),
+    ...(row.closedAt !== undefined ? { closedAt: row.closedAt } : {}),
+  },
+  ...(row.source.kind === "app" ? { audience: { by: `app:${row.source.tokenID}` } } : {}),
 })
 
 interface Body {
@@ -277,6 +323,7 @@ interface Body {
   readonly priority: IntakePriority
   readonly labels?: readonly string[]
   readonly due?: number
+  readonly notAfter?: number
   readonly criteria?: readonly string[]
   readonly ref?: string
 }
@@ -296,6 +343,12 @@ export class TeamIntakeService {
   private readonly owner = `intake-${process.pid}-${randomBytes(4).toString("hex")}`
   /** Per user and team: the drain in progress (one at a time in this process). */
   private readonly draining = new Map<string, Promise<number>>()
+  private readonly timers: Timers
+  private sweeping: Promise<number> | undefined
+  private started = false
+  private timer: unknown
+  /** When the armed sweep fires (epoch ms). */
+  private armedAt: number | undefined
 
   constructor(private readonly deps: TeamIntakeDeps) {
     this.state = deps.state
@@ -303,6 +356,7 @@ export class TeamIntakeService {
     this.newID = deps.newID ?? ((kind) => `${ID_PREFIXES[kind]}_${randomBytes(12).toString("hex")}`)
     this.report = deps.report ?? ((cause) => console.error(`[hub] team intake: ${message(cause)}`))
     this.limits = { ...INTAKE_LIMITS, ...deps.limits }
+    this.timers = deps.timers ?? realTimers
   }
 
   // ---------- submit ----------
@@ -310,7 +364,7 @@ export class TeamIntakeService {
   /** Submits work to a team; routes it at once when an entry seat is staffed, else it waits queued. */
   async submit(userID: string, actor: AgentActor, teamID: string, input: unknown, options: { readonly idempotencyKey?: string } = {}): Promise<{ intake: StoredIntake; created: boolean }> {
     if (actor.kind === "app" && !actor.scopes.includes("teams:submit")) throw new AgentError("forbidden", "Submitting to a team needs scope teams:submit")
-    const body = this.body(input)
+    const { body, expired } = this.body(input)
     const key = options.idempotencyKey
     if (key !== undefined && !IDEMPOTENCY_KEY.test(key)) throw new AgentError("invalid", "Idempotency-Key must be 1–200 of A-Z a-z 0-9 _ . : -")
     const team = await this.deps.teams.require(userID, teamID)
@@ -322,7 +376,7 @@ export class TeamIntakeService {
     const slot = key === undefined ? undefined : `${partyOf(actor)}|${key}`
     const id = this.newID("intake")
     const hop = actor.kind === "session" && this.deps.hopOf ? await this.deps.hopOf(userID, actor.sessionID) : undefined
-    if (body.brief !== undefined) await this.state.put(userID, TEAM_INTAKE_BRIEFS, id, { v: 1, teamID, brief: body.brief })
+    if (body.brief !== undefined && !expired) await this.state.put(userID, TEAM_INTAKE_BRIEFS, id, { v: 1, teamID, brief: body.brief })
     let result: { row: IntakeRow; created: boolean } | undefined
     try {
       await this.writeDoc(userID, teamID, (doc) => {
@@ -337,6 +391,8 @@ export class TeamIntakeService {
             return undefined
           }
         }
+        // A deadline already passed: refused (nothing stored), unless it is a replay of the original (above).
+        if (expired) throw expired
         const recent = doc.items.filter((i) => at - i.createdAt < 60_000)
         if (recent.length >= this.limits.submitsPerMinute) {
           const oldest = Math.min(...recent.map((i) => i.createdAt))
@@ -355,10 +411,12 @@ export class TeamIntakeService {
       throw cause
     }
     if (!result!.created) {
-      if (body.brief !== undefined) await this.state.delete(userID, TEAM_INTAKE_BRIEFS, id).catch(this.report)
-      return { intake: view(await this.reconciled(userID, result!.row)), created: false }
+      if (body.brief !== undefined && !expired) await this.state.delete(userID, TEAM_INTAKE_BRIEFS, id).catch(this.report)
+      await this.serialized(userID, teamID, () => this.expireDue(userID, teamID)).catch(this.report)
+      return { intake: view(await this.reconciled(userID, (await this.row(userID, teamID, result!.row.id)) ?? result!.row)), created: false }
     }
     await this.emit(userID, intakeEvent(result!.row))
+    if (result!.row.notAfter !== undefined) this.arm(result!.row.notAfter)
     await this.drainSafely(userID, teamID)
     return { intake: view((await this.row(userID, teamID, id)) ?? result!.row), created: true }
   }
@@ -470,9 +528,14 @@ export class TeamIntakeService {
 
   /** Routes the team's queued intake, oldest first, while an entry seat is reachable. Returns how many it routed. */
   drain(userID: string, teamID: string): Promise<number> {
+    return this.serialized(userID, teamID, () => this.drainNow(userID, teamID))
+  }
+
+  /** Runs `work` after the team's drain or expiry in progress in this process (one at a time per team). */
+  private serialized(userID: string, teamID: string, work: () => Promise<number>): Promise<number> {
     const key = `${userID}\u0000${teamID}`
     const previous = this.draining.get(key) ?? Promise.resolve(0)
-    const run = previous.catch(() => 0).then(() => this.drainNow(userID, teamID))
+    const run = previous.catch(() => 0).then(work)
     this.draining.set(key, run)
     void run.finally(() => {
       if (this.draining.get(key) === run) this.draining.delete(key)
@@ -497,11 +560,113 @@ export class TeamIntakeService {
     }
   }
 
+  // ---------- deadlines (notAfter) ----------
+
+  /** Runs the deadline sweep now, then at the earliest deadline it finds and at least every sweepMs, until stop(). */
+  start(): void {
+    if (this.started) return
+    this.started = true
+    void this.sweep().catch(this.report)
+  }
+
+  stop(): void {
+    this.started = false
+    if (this.timer !== undefined) this.timers.clear(this.timer)
+    this.timer = undefined
+    this.armedAt = undefined
+  }
+
+  /**
+   * Cancels every user's queued intake whose notAfter has passed (one pass at a time; a call during a pass joins it)
+   * and re-arms for the earliest deadline still ahead. Resolves with how many it cancelled.
+   */
+  sweep(): Promise<number> {
+    this.sweeping ??= this.sweepNow().finally(() => {
+      this.sweeping = undefined
+    })
+    return this.sweeping
+  }
+
+  private async sweepNow(): Promise<number> {
+    let cancelled = 0
+    let next = Number.POSITIVE_INFINITY
+    try {
+      for (const userID of this.deps.users ? await this.deps.users() : []) {
+        for (const { key: teamID, value } of await this.state.list(userID, TEAM_INTAKE)) {
+          try {
+            const at = this.now()
+            const deadlines = readDoc(value, teamID).items.flatMap((i) => (i.status === "queued" && i.notAfter !== undefined ? [i.notAfter] : []))
+            if (deadlines.some((d) => d <= at)) cancelled += await this.serialized(userID, teamID, () => this.expireDue(userID, teamID))
+            for (const d of deadlines) if (d > at) next = Math.min(next, d)
+          } catch (cause) {
+            this.report(cause)
+          }
+        }
+      }
+    } finally {
+      this.arm(next)
+    }
+    return cancelled
+  }
+
+  /** Arms the sweep for `at` (capped at sweepMs from now) unless it is already armed no later. */
+  private arm(at: number): void {
+    if (!this.started) return
+    const t = this.now()
+    const when = Math.min(at, t + this.limits.sweepMs)
+    if (this.timer !== undefined && this.armedAt !== undefined && this.armedAt <= when) return
+    if (this.timer !== undefined) this.timers.clear(this.timer)
+    this.armedAt = when
+    this.timer = this.timers.set(() => {
+      this.timer = undefined
+      this.armedAt = undefined
+      void this.sweep().catch(this.report)
+    }, Math.max(0, when - t))
+  }
+
+  /**
+   * Cancels the team's queued items whose notAfter has passed (reason not_after): one version-checked write, then per
+   * item the brief dropped, a leftover assignment (a failed route) cancelled and one `team.intake` event. Items a live
+   * routing claim holds are left to that route; `only` (the route itself, refused by Delivery as expired) expires that
+   * one item, claim and all.
+   */
+  private async expireDue(userID: string, teamID: string, only?: string): Promise<number> {
+    const at = this.now()
+    let expired: IntakeRow[] = []
+    await this.writeDoc(userID, teamID, (doc) => {
+      expired = []
+      const items = doc.items.map((row) => {
+        if (row.status !== "queued" || row.notAfter === undefined) return row
+        // The route refused by Delivery (its clock says the deadline passed) expires its own item, claim and all.
+        if (only !== undefined ? row.id !== only : row.notAfter > at || (row.claim !== undefined && at - row.claim.at < this.limits.claimMs)) return row
+        const { claim: _c, progress: _p, ...rest } = row
+        const next: IntakeRow = { ...rest, status: "cancelled", reason: NOT_AFTER_REASON, closedAt: at, revision: row.revision + 1, updatedAt: at }
+        expired.push(next)
+        return next
+      })
+      return expired.length === 0 ? undefined : { ...doc, items: this.retained(items) }
+    })
+    for (const row of expired) {
+      await this.state.delete(userID, TEAM_INTAKE_BRIEFS, row.id).catch(this.report)
+      if (row.assignmentID !== undefined && row.workspaceID !== undefined) {
+        const assignment = await this.deps.members.assignment(userID, row.workspaceID, row.assignmentID).catch(() => undefined)
+        if (assignment && OPEN_ASSIGNMENT.has(assignment.status)) {
+          const closed = await this.deps.members.setStatus(userID, row.workspaceID, row.assignmentID, "cancelled").catch((cause) => void this.report(cause))
+          if (closed) await this.emit(userID, assignmentChangedEvent(closed, "status"))
+        }
+      }
+      await this.emit(userID, intakeEvent(row, NOT_AFTER_REASON))
+    }
+    return expired.length
+  }
+
   private async drainSafely(userID: string, teamID: string): Promise<void> {
     await this.drain(userID, teamID).catch(this.report)
   }
 
   private async drainNow(userID: string, teamID: string): Promise<number> {
+    // Past their notAfter: cancelled before anything is routed (also while the team is paused or archived).
+    await this.expireDue(userID, teamID)
     const team = await this.deps.teams.get(userID, teamID)
     if (!team || team.state !== "active" || team.paused) return 0
     const queued = readDoc((await this.state.get(userID, TEAM_INTAKE, teamID))?.value, teamID)
@@ -543,6 +708,7 @@ export class TeamIntakeService {
     await this.writeDoc(userID, team.id, (doc) => {
       const row = doc.items.find((i) => i.id === intakeID)
       if (!row || row.status !== "queued") return undefined
+      if (row.notAfter !== undefined && row.notAfter <= at) return undefined
       if (row.claim && row.claim.owner !== this.owner && at - row.claim.at < this.limits.claimMs) return undefined
       claimed = { ...row, claim: { owner: this.owner, at } }
       return { ...doc, items: doc.items.map((i) => (i.id === intakeID ? claimed! : i)) }
@@ -554,7 +720,10 @@ export class TeamIntakeService {
         await this.mutate(userID, team.id, intakeID, (row) => ({ ...row, assignmentID: assignment.id, workspaceID: target.workspaceID }), false)
       const brief = (await this.state.get<{ brief?: unknown }>(userID, TEAM_INTAKE_BRIEFS, intakeID))?.value?.brief
       const text = this.text(team, claimed, assignment.id, target, typeof brief === "string" ? brief : undefined)
-      const sent = await this.deps.deliver(userID, target.sessionID, text, claimed.hop === undefined ? {} : { hop: claimed.hop })
+      const sent = await this.deps.deliver(userID, target.sessionID, text, {
+        ...(claimed.hop === undefined ? {} : { hop: claimed.hop }),
+        ...(claimed.notAfter === undefined ? {} : { notAfter: claimed.notAfter }),
+      })
       let cancelled = false
       let routed: IntakeRow | undefined
       await this.writeDoc(userID, team.id, (doc) => {
@@ -581,6 +750,11 @@ export class TeamIntakeService {
       return "routed"
     } catch (cause) {
       const code = cause instanceof AgentError ? cause.code : "internal"
+      // Delivery refused it: the deadline passed while it was being routed. Cancelled now, never retried.
+      if (code === "expired" && claimed.notAfter !== undefined) {
+        await this.expireDue(userID, team.id, intakeID).catch(this.report)
+        return "skipped"
+      }
       this.report(cause)
       await this.mutate(userID, team.id, intakeID, (row) => {
         const { claim: _c, ...rest } = row
@@ -616,6 +790,7 @@ export class TeamIntakeService {
     const from = row.source.kind === "user" ? "the user" : row.source.kind === "app" ? `app ${row.source.tokenID}` : `session ${row.source.sessionID}`
     const facts = [`intake ${row.id}`, `revision ${row.revision + 1}`, `assignment ${assignmentID}`, `workspace ${target.workspaceID}`, `priority ${row.priority}`]
     if (row.due !== undefined) facts.push(`due ${new Date(row.due).toISOString()}`)
+    if (row.notAfter !== undefined) facts.push(`not after ${new Date(row.notAfter).toISOString()}`)
     if (row.ref !== undefined) facts.push(`ref ${sanitizeLabel(row.ref, this.limits.refMax)}`)
     const lines = [
       `[hub] team intake for #${team.name} (team ${team.id}, entry role ${team.entryRole}), submitted by ${from}`,
@@ -665,10 +840,11 @@ export class TeamIntakeService {
 
   // ---------- internals ----------
 
-  private body(input: unknown): Body {
+  /** The checked submission; `expired`: its notAfter has already passed (refused unless it replays the original). */
+  private body(input: unknown): { body: Body; expired?: AgentError } {
     if (!isObj(input)) throw new AgentError("invalid", "body must be an object")
     unknownField(input, SUBMIT_FIELDS)
-    const { title, brief, priority, labels, due, criteria, ref } = input
+    const { title, brief, priority, labels, due, notAfter, criteria, ref } = input
     const l = this.limits
     if (!isLabel(title)) throw new AgentError("invalid", "title must be 1–120 characters of text")
     if (brief !== undefined && !isText(brief, l.briefMax)) throw new AgentError("invalid", `brief must be at most ${l.briefMax} characters of text`)
@@ -679,15 +855,24 @@ export class TeamIntakeService {
     if (criteria !== undefined && (!Array.isArray(criteria) || criteria.length > l.criteriaPerIntake || !criteria.every((c) => isLabel(c, l.criterionMax))))
       throw new AgentError("invalid", `criteria must be a list of at most ${l.criteriaPerIntake} lines of 1–${l.criterionMax} characters`)
     if (ref !== undefined && !isLabel(ref, l.refMax)) throw new AgentError("invalid", `ref must be 1–${l.refMax} characters of text`)
-    return {
+    let expired: AgentError | undefined
+    try {
+      parseNotAfter(notAfter, this.now())
+    } catch (cause) {
+      if (!(cause instanceof AgentError) || cause.code !== "expired") throw cause
+      expired = new AgentError("expired", "notAfter has already passed: nothing was submitted")
+    }
+    const body: Body = {
       title: title as string,
       ...(brief !== undefined ? { brief: brief as string } : {}),
       priority: (priority as IntakePriority | undefined) ?? "normal",
       ...(labels !== undefined ? { labels: [...(labels as string[])] } : {}),
       ...(due !== undefined ? { due: due as number } : {}),
+      ...(notAfter !== undefined ? { notAfter: notAfter as number } : {}),
       ...(criteria !== undefined ? { criteria: [...(criteria as string[])] } : {}),
       ...(ref !== undefined ? { ref: ref as string } : {}),
     }
+    return expired ? { body, expired } : { body }
   }
 
   /** Reflects an assignment changed through the workspace routes (closed, or another progress) on a routed item. */