@join-pantheon/cli 0.19.1 → 0.21.0

package/dist/relay.js

@@ -1,6 +1,6 @@
 import { createServer } from "node:http";
 import { createHash, randomBytes, timingSafeEqual as timingSafeEqualBuf } from "node:crypto";
-import { rmSync } from "node:fs";
+import { rmSync, readdirSync, readFileSync, statSync, existsSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { WebSocketServer } from "ws";
@@ -12,6 +12,8 @@ import { Accounts, normalizeUsername, validEmail, validUsername } from "./accoun
 import { emailSenderFromEnv } from "./email.js";
 import { Allowlist } from "./roster-file.js";
 import { StateStore } from "./store.js";
+import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
+import { fmtLimit, parseLimits, PLAN_NAME } from "./plans.js";
 import { routeDecision } from "./profile.js";
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
     let known = false;
@@ -73,6 +75,38 @@ export function isTrustedSource(ip) {
 function fingerprint_(from, act, body, goal, ref) {
     return createHash("sha256").update([from, act, goal ?? "", ref ?? "", body].join("\u0000")).digest("hex").slice(0, 32);
 }
+const ADMIN_CSS = `<style>
+  :root{--bg:#0b0c0e;--card:#15171b;--line:#262a30;--fg:#e7e9ec;--dim:#9aa1a9;--accent:#5b9dff;--warn:#e8b45c;--bad:#ef8b80;--ok:#7bd39a}
+  @media(prefers-color-scheme:light){:root{--bg:#f6f7f9;--card:#fff;--line:#e6e8eb;--fg:#1a1c1f;--dim:#6b7280;--accent:#2563eb;--warn:#b45309;--bad:#b91c1c;--ok:#15803d}}
+  *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:14px/1.5 system-ui,-apple-system,sans-serif}
+  header{padding:20px 24px;border-bottom:1px solid var(--line);display:flex;align-items:baseline;gap:16px;flex-wrap:wrap}
+  h1{font-size:18px;margin:0}.dim{color:var(--dim)}
+  .stats{display:flex;gap:10px;flex-wrap:wrap;padding:16px 24px}
+  .stat{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:10px 16px;min-width:110px}
+  .stat b{font-size:22px;display:block;font-variant-numeric:tabular-nums}.stat span{color:var(--dim);font-size:12px}
+  .stat.warn b{color:var(--warn)}
+  section{padding:8px 24px 28px}h2{font-size:14px;text-transform:uppercase;letter-spacing:.04em;color:var(--dim);margin:22px 0 8px;display:flex;align-items:center;gap:12px}
+  h2 input{margin-left:auto;font:13px system-ui;padding:5px 9px;border:1px solid var(--line);border-radius:7px;background:var(--card);color:var(--fg);width:220px}
+  .wrap{overflow-x:auto;border:1px solid var(--line);border-radius:10px;background:var(--card)}
+  table{border-collapse:collapse;width:100%;font-variant-numeric:tabular-nums}
+  th,td{text-align:left;padding:8px 12px;border-bottom:1px solid var(--line);white-space:nowrap;vertical-align:middle}
+  th{color:var(--dim);font-weight:600;font-size:12px}tr:last-child td{border-bottom:0}
+  code{font-family:ui-monospace,monospace;font-size:12px}a{color:var(--accent)}
+  .pill{font-size:11px;padding:1px 7px;border-radius:999px;border:1px solid var(--line)}.pill.bad{color:var(--bad);border-color:var(--bad)}.pill.ok{color:var(--ok);border-color:var(--ok)}
+  .inl{display:inline}.act{font:12px system-ui;padding:4px 9px;border-radius:6px;border:1px solid var(--line);background:transparent;color:var(--fg);cursor:pointer;margin-left:6px}
+  .act:hover{border-color:var(--accent)}.act.danger{color:var(--bad)}.act.danger:hover{border-color:var(--bad)}
+  .blockform{display:flex;gap:8px;align-items:center;margin:8px 0 0}.blockform input{font:13px ui-monospace,monospace;padding:6px 9px;border:1px solid var(--line);border-radius:7px;background:var(--card);color:var(--fg);width:280px}
+  .done{margin:0 24px;padding:10px 14px;border:1px solid var(--ok);color:var(--ok);border-radius:10px;background:var(--card)}
+  .note{color:var(--dim);font-size:12px;margin:6px 0 0}
+</style>`;
+const escHtml = (v) => String(v ?? "").replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c]));
+const fmtWhen = (t) => t ? new Date(t).toISOString().slice(0, 19).replace("T", " ") : "—";
+const fmtAgo = (t) => {
+    if (!t)
+        return "—";
+    const m = Math.round((Date.now() - t) / 60_000);
+    return m < 1 ? "just now" : m < 60 ? `${m}m ago` : m < 1440 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`;
+};
 export class Relay {
     opts;
     spaces = new Map();
@@ -95,6 +129,9 @@ export class Relay {
     adminHits = new Map();
     emailSends = [];
     adminToken;
+    adminAllow;
+    startedAt = Date.now();
+    deletedSpaces = new Map();
     backupTimer;
     constructor(opts = {}) {
         this.opts = opts;
@@ -105,8 +142,11 @@ export class Relay {
             ? process.env.PANTHEON_TRUST_LOCAL === "1"
             : !this.requireAccounts;
         this.adminToken = process.env.PANTHEON_ADMIN_TOKEN?.trim() || null;
+        this.adminAllow = (process.env.PANTHEON_ADMIN_ALLOW_IPS ?? "").split(",").map((x) => x.trim()).filter(Boolean);
         const wantStore = this.requireAccounts || this.adminToken !== null;
         this.accounts = opts.accounts ?? (wantStore ? new Accounts(join(this.dataDir, "accounts.db")) : null);
+        if (this.accounts)
+            this.backfillSpaceOwners();
         this.email = opts.emailSender ?? emailSenderFromEnv(this.log);
         const envNum = (k) => {
             const v = process.env[k];
@@ -276,10 +316,12 @@ export class Relay {
     onAuthHttp(req, res, url, ip) {
         if (url.pathname === "/")
             return this.landingPage(res);
-        if (url.pathname === "/admin" || url.pathname === "/admin/export" || url.pathname === "/admin/backup" || url.pathname === "/admin/login" || url.pathname === "/admin/logout") {
+        if (url.pathname === "/admin" || url.pathname === "/admin/space" || url.pathname === "/admin/export" || url.pathname === "/admin/backup" || url.pathname === "/admin/action" || url.pathname === "/admin/login" || url.pathname === "/admin/logout") {
             const A0 = this.accounts;
             if (!A0 || !this.adminToken)
                 return this.json(res, 404, { error: "not found" });
+            if (!this.adminIpOk(ip))
+                return this.json(res, 404, { error: "not found" });
             const tokenOk = (t) => { const a = Buffer.from(t), b = Buffer.from(this.adminToken); return a.length === b.length && timingSafeEqualBuf(a, b); };
             const fromCookie = cookieVal(req, "pantheon_admin");
             const fromQuery = url.searchParams.get("token") ?? req.headers["authorization"]?.replace(/^Bearer\s+/i, "") ?? "";
@@ -291,8 +333,10 @@ export class Relay {
                 return this.readForm(req, (body) => {
                     if (!tokenOk(body.token ?? "")) {
                         this.noteAdminFail(ip);
+                        A0.audit({ event: "admin_login_failed", ip });
                         return this.adminLoginPage(res, true);
                     }
+                    A0.audit({ event: "admin_login", ip });
                     const secure = req.headers["x-forwarded-proto"] === "https" ? "; Secure" : "";
                     res.writeHead(302, { "set-cookie": `pantheon_admin=${encodeURIComponent(body.token)}; HttpOnly; SameSite=Strict; Path=/admin; Max-Age=43200${secure}`, location: "/admin" });
                     return void res.end();
@@ -306,16 +350,30 @@ export class Relay {
             if (url.pathname === "/admin/export") {
                 if (!authed)
                     return this.json(res, 403, { error: "sign in at /admin, or append ?token=…" });
+                A0.audit({ event: "admin_export", target: url.searchParams.get("table") ?? "audit", detail: url.searchParams.get("format") ?? "json", ip });
                 return this.adminExport(res, A0, url);
             }
             if (url.pathname === "/admin/backup") {
                 if (!authed)
                     return this.json(res, 403, { error: "sign in at /admin, or append ?token=…" });
+                A0.audit({ event: "admin_backup", ip });
                 return this.adminBackup(res, A0);
             }
+            if (url.pathname === "/admin/action" && req.method === "POST") {
+                if (!authed)
+                    return this.json(res, 403, { error: "sign in at /admin" });
+                return this.readForm(req, (body) => this.adminAction(res, A0, body, ip));
+            }
+            if (url.pathname === "/admin/space") {
+                if (!authed)
+                    return this.adminLoginPage(res, false);
+                const name = url.searchParams.get("name") ?? "";
+                A0.audit({ event: "admin_space_view", space: name, detail: url.search.replace(/^\?/, "").replace(/(^|&)token=[^&]*/g, "$1token=…") || null, ip });
+                return this.adminSpace(res, url, name);
+            }
             if (!authed)
                 return this.adminLoginPage(res, false);
-            return this.adminDashboard(res, A0);
+            return this.adminDashboard(res, A0, url);
         }
         const A = this.accounts;
         if (!A)
@@ -333,6 +391,8 @@ export class Relay {
                     return this.json(res, 400, { error: "username must be 2–32 chars: letters, digits, . _ - (not at the ends)" });
                 const started = A.startVerification(b.email, "signup", { username: b.username, pubkey: b.pubkey, label: String(b.label ?? "a device").slice(0, 60) });
                 if (!started.ok) {
+                    if (started.reason === "blocked")
+                        return this.json(res, 403, { error: "this email cannot sign up on this relay", reason: "blocked" });
                     const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute to resend"
                         : started.reason === "username_taken" ? "that username is taken"
                             : started.reason === "email_taken" ? "that email already has an account — use `pantheon login` from this machine instead"
@@ -355,6 +415,8 @@ export class Relay {
                 if (!b || typeof b.email !== "string" || typeof b.pubkey !== "string")
                     return this.json(res, 400, { error: "email and pubkey are required" });
                 const started = A.startVerification(b.email, "login", { pubkey: b.pubkey, label: String(b.label ?? "a device").slice(0, 60) });
+                if (!started.ok && started.reason === "blocked")
+                    return this.json(res, 403, { error: "this email cannot sign in on this relay", reason: "blocked" });
                 if (!started.ok) {
                     const code = started.reason === "too_soon" ? 429 : 404;
                     const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute" : "no active account for that email — `pantheon signup` first";
@@ -572,65 +634,546 @@ button{width:100%;margin-top:12px;padding:10px;border:0;border-radius:8px;backgr
   ${wrong ? '<div class=err>That token is not right.</div>' : ''}
 </form>`);
     }
-    adminDashboard(res, A) {
+    adminIpOk(ip) {
+        if (!this.adminAllow.length)
+            return true;
+        const h = ip.replace(/^::ffff:/, "");
+        const toN = (x) => x.split(".").reduce((n, o) => ((n << 8) + Number(o)) >>> 0, 0);
+        if (!/^\d+\.\d+\.\d+\.\d+$/.test(h))
+            return false;
+        return this.adminAllow.some((rule) => {
+            const [net, bits] = rule.split("/");
+            if (!/^\d+\.\d+\.\d+\.\d+$/.test(net ?? ""))
+                return false;
+            if (bits === undefined)
+                return net === h;
+            const n = Number(bits);
+            if (!(n >= 0 && n <= 32))
+                return false;
+            const mask = n === 0 ? 0 : (~0 << (32 - n)) >>> 0;
+            return (toN(h) & mask) === (toN(net) & mask);
+        });
+    }
+    adminCsrf() {
+        return createHash("sha256").update("pantheon-admin-csrf " + (this.adminToken ?? "")).digest("hex").slice(0, 32);
+    }
+    spacesOverview() {
+        const now = Date.now();
+        const out = new Map();
+        const safeOf = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
+        const size = (safe) => [".jsonl", ".state.json", ".members.json"].reduce((n, suf) => { try {
+            return n + statSync(join(this.dataDir, `${safe}${suf}`)).size;
+        }
+        catch {
+            return n;
+        } }, 0);
+        for (const sp of this.spaces.values()) {
+            const name = sp.name;
+            out.set(safeOf(name), {
+                name, live: true, id: sp.allow.peekId(),
+                members: sp.allow.all().filter((e) => e.admitted).length, online: [...sp.members.values()].filter((m) => m.sessions.size > 0).length,
+                acts: sp.ledger.head, goals: sp.goals.size, open_goals: [...sp.goals.values()].filter((g) => g.state !== "CLOSED").length, obligations: sp.obligations.size,
+                last: sp.lastTouch, bytes: size(safeOf(name)),
+                activity: activity(sp.ledger.all(), now, (r) => `${name}/${r.from}`), refusals: sp.store.refusals,
+            });
+        }
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir);
+        }
+        catch { }
+        for (const f of files) {
+            if (!f.endsWith(".members.json"))
+                continue;
+            const safe = f.slice(0, -".members.json".length);
+            if (out.has(safe))
+                continue;
+            let members = 0, last = null, id = null;
+            try {
+                const al = new Allowlist(this.dataDir, safe);
+                members = al.all().filter((e) => e.admitted).length;
+                id = al.peekId();
+            }
+            catch { }
+            try {
+                last = statSync(join(this.dataDir, `${safe}.jsonl`)).mtimeMs;
+            }
+            catch {
+                try {
+                    last = statSync(join(this.dataDir, f)).mtimeMs;
+                }
+                catch { }
+            }
+            const records = this.sleepingRecords(safe);
+            const st = this.sleepingState(safe);
+            out.set(safe, {
+                name: safe, live: false, id, members, online: 0,
+                acts: records.length ? records[records.length - 1].seq : 0,
+                goals: st.goals.size, open_goals: [...st.goals.values()].filter((g) => g.state !== "CLOSED").length, obligations: 0,
+                last, bytes: size(safe),
+                activity: activity(records, now, (r) => `${safe}/${r.from}`), refusals: st.refusals,
+            });
+        }
+        return [...out.values()].sort((a, b) => (b.last ?? 0) - (a.last ?? 0));
+    }
+    sleepingCache = new Map();
+    sleepingRecords(safe) {
+        const file = join(this.dataDir, `${safe}.jsonl`);
+        let st;
+        try {
+            st = statSync(file);
+        }
+        catch {
+            return [];
+        }
+        const key = `${st.size}:${st.mtimeMs}`;
+        const hit = this.sleepingCache.get(safe);
+        if (hit && hit.key === key)
+            return hit.records;
+        const records = [];
+        for (const line of readFileSync(file, "utf8").split("\n")) {
+            if (!line.trim())
+                continue;
+            try {
+                records.push(JSON.parse(line));
+            }
+            catch { }
+        }
+        this.sleepingCache.set(safe, { key, records });
+        if (this.sleepingCache.size > 200)
+            this.sleepingCache.delete(this.sleepingCache.keys().next().value);
+        return records;
+    }
+    sleepingState(safe) {
+        const st = new StateStore(this.dataDir, safe);
+        const { goals } = st.load();
+        return { goals, refusals: st.refusals };
+    }
+    deleteSpace(name) {
+        const sp = this.spaces.get(name);
+        if (sp) {
+            sp.deleted = true;
+            for (const m of sp.members.values())
+                for (const s of m.sessions.values()) {
+                    try {
+                        s.ws.close(1008, "SPACE_DELETED");
+                    }
+                    catch { }
+                }
+            this.spaces.delete(name);
+        }
+        setTimeout(() => this.deleteSpaceFiles(name), 600).unref?.();
+        const safe = name.replace(/[^a-z0-9._-]/gi, "_");
+        const existed = !!sp || [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
+        this.deleteSpaceFiles(name);
+        this.deletedSpaces.set(name, Date.now());
+        if (this.deletedSpaces.size > 1000)
+            for (const [k, t] of this.deletedSpaces)
+                if (Date.now() - t > 3_600_000)
+                    this.deletedSpaces.delete(k);
+        return existed;
+    }
+    adminAction(res, A, body, ip) {
+        if (body.csrf !== this.adminCsrf())
+            return this.json(res, 403, { error: "stale form — reload the dashboard and try again" });
+        const act = body.action ?? "", id = (body.id ?? "").trim();
+        const done = (msg) => { res.writeHead(303, { location: `/admin?done=${encodeURIComponent(msg)}` }); res.end(); };
+        switch (act) {
+            case "suspend":
+            case "reinstate": {
+                const acct = A.accountById(id);
+                if (!acct)
+                    return this.json(res, 404, { error: "no such account" });
+                const live = A.sessionsFor(acct.id).filter((s) => !s.revoked_at);
+                A.setStatus(acct.id, act === "suspend" ? "suspended" : "active", ip);
+                if (act === "suspend")
+                    for (const s of live)
+                        this.dropSessionEverywhere(s.id);
+                this.log(`[admin] ${act} ${acct.username} from ${ip}`);
+                return done(`${acct.username} ${act === "suspend" ? "suspended and signed out everywhere" : "reinstated"}`);
+            }
+            case "revoke_session":
+            case "revoke_device": {
+                const hit = A.adminRevoke(act === "revoke_session" ? "session" : "device", id, ip);
+                for (const sid of hit.sessionIds)
+                    this.dropSessionEverywhere(sid);
+                if (hit.deviceId && hit.accountId)
+                    this.dropDeviceSockets(hit.accountId, hit.deviceId);
+                return done(hit.sessionIds.length || hit.deviceId ? `revoked ${act === "revoke_session" ? "session" : "device"} ${id}` : `nothing to revoke for ${id}`);
+            }
+            case "block": {
+                const pattern = id.toLowerCase().replace(/^@/, "");
+                if (!/^([a-z0-9.-]+\.[a-z]{2,}|[^@\s]+@[a-z0-9.-]+\.[a-z]{2,})$/.test(pattern))
+                    return this.json(res, 400, { error: "block takes an email (a@b.com) or a domain (b.com)" });
+                A.block(pattern, ip);
+                return done(`blocked ${pattern}`);
+            }
+            case "unblock": {
+                A.unblock(id.toLowerCase().replace(/^@/, ""), ip);
+                return done(`unblocked ${id}`);
+            }
+            case "delete_space": {
+                if ((body.confirm ?? "").trim() !== id)
+                    return done(`not deleted: type the space name exactly ("${id}") to confirm`);
+                const existed = this.deleteSpace(id);
+                A.markSpaceDeleted(id);
+                A.audit({ event: "admin_space_deleted", space: id, ip });
+                this.log(`[admin] deleted space "${id}" from ${ip}`);
+                return done(existed ? `space "${id}" deleted — its members were disconnected` : `no space "${id}"`);
+            }
+            case "set_plan": {
+                const target = A.accountById(id);
+                if (!target)
+                    return this.json(res, 404, { error: "no such account" });
+                const plan = (body.plan ?? "").trim();
+                if (!A.plans()[plan])
+                    return this.json(res, 400, { error: `no plan "${plan}"` });
+                A.setPlan(target.id, plan);
+                A.audit({ event: "admin_set_plan", target: target.username, detail: `${target.plan} → ${plan}`, ip });
+                this.log(`[admin] ${target.username}: plan ${target.plan} → ${plan} (${ip})`);
+                return done(`${target.username} is now on the ${plan} plan — in effect for their next space, invite or admit`);
+            }
+            case "set_limits": {
+                const target = A.accountById(id);
+                if (!target)
+                    return this.json(res, 404, { error: "no such account" });
+                const raw = (body.json ?? "").trim();
+                if (!A.setLimits(target.id, raw || null))
+                    return this.json(res, 400, { error: 'custom limits must look like {"spaces":3,"members":5,"wake":true}' });
+                A.audit({ event: "admin_set_limits", target: target.username, detail: raw || "(cleared)", ip });
+                return done(raw ? `${target.username} now has custom limits ${raw}` : `${target.username} is back on plain ${target.plan} limits`);
+            }
+            case "set_plan_limits": {
+                if (!PLAN_NAME.test(id))
+                    return this.json(res, 400, { error: "plan names are lowercase letters, digits, - and _" });
+                const lim = parseLimits({ spaces: body.spaces, members: body.members, wake: body.wake ?? "off" });
+                if (!lim)
+                    return this.json(res, 400, { error: "spaces must be 0 or more and members 1 or more" });
+                const plans = A.plans();
+                const prev = plans[id];
+                plans[id] = lim;
+                A.setPlans(plans);
+                A.audit({ event: "admin_set_plan_limits", target: id, detail: `${prev ? JSON.stringify(prev) : "(new plan)"} → ${JSON.stringify(lim)}`, ip });
+                return done(`${id} plan: ${fmtLimit(lim.spaces)} spaces · ${fmtLimit(lim.members)} people · unattended workers ${lim.wake ? "on" : "off"} — applies to the next create, invite or admit`);
+            }
+            case "delete_plan": {
+                if (id === "free")
+                    return this.json(res, 400, { error: "the free plan is every account's default and cannot be removed" });
+                const plans = A.plans();
+                if (!plans[id])
+                    return this.json(res, 404, { error: `no plan "${id}"` });
+                const onIt = A.planCounts()[id] ?? 0;
+                if (onIt)
+                    return this.json(res, 400, { error: `${onIt} account${onIt === 1 ? " is" : "s are"} on "${id}" — move them to another plan first` });
+                delete plans[id];
+                A.setPlans(plans);
+                A.audit({ event: "admin_delete_plan", target: id, ip });
+                return done(`plan "${id}" removed`);
+            }
+            default: return this.json(res, 400, { error: `unknown action "${act}"` });
+        }
+    }
+    spaceOnDisk(name) {
+        return existsSync(join(this.dataDir, `${name.replace(/[^a-z0-9._-]/gi, "_")}.members.json`));
+    }
+    spacePlan(name) {
+        if (!this.accounts)
+            return null;
+        const owner = this.accounts.spaceOwner(name);
+        if (!owner)
+            return null;
+        return { name: owner.plan, limits: this.accounts.limitsFor(owner), owner };
+    }
+    planView(acct, sp) {
+        const fresh = this.accounts?.accountById(acct.id) ?? acct;
+        return { name: fresh.plan, limits: this.accounts.limitsFor(fresh), usage: { spaces: this.accounts.spacesOwned(fresh.id).length, members: sp.allow.admittedCount() } };
+    }
+    planRefusal(space, plan, target, msg, cid, fail, actor, ip) {
+        this.accounts?.audit({ event: "plan_limit", actor_account: actor ?? plan.owner.id, space: space.name, target, detail: `${plan.name}: ${msg.slice(0, 160)}`, ip });
+        this.log(`[${space.name}] ! PLAN_LIMIT (${target}, ${plan.name} plan)`);
+        fail("PLAN_LIMIT", msg, cid);
+    }
+    backfillSpaceOwners() {
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir);
+        }
+        catch {
+            return;
+        }
+        for (const f of files) {
+            if (!f.endsWith(".members.json"))
+                continue;
+            const name = f.slice(0, -".members.json".length);
+            if (this.accounts.hasSpaceRecord(name))
+                continue;
+            try {
+                const founder = new Allowlist(this.dataDir, name).founder();
+                const owner = founder ? this.accounts.accountByUsername(founder) : null;
+                this.accounts.recordSpace(name, owner?.id ?? null);
+                this.log(`[${name}] owner recorded: ${owner ? owner.username : "unknown (no plan limits apply)"}`);
+            }
+            catch { }
+        }
+    }
+    adminDashboard(res, A, url) {
         const c = A.counts();
         const esc = (s) => String(s ?? "").replace(/[&<>"]/g, (m) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[m]));
-        const when = (t) => new Date(t).toISOString().slice(0, 19).replace("T", " ");
+        const when = (t) => t ? new Date(t).toISOString().slice(0, 19).replace("T", " ") : "—";
+        const ago = (t) => { if (!t)
+            return "—"; const m = Math.round((Date.now() - t) / 60_000); return m < 1 ? "just now" : m < 60 ? `${m}m ago` : m < 1440 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`; };
+        const kb = (n) => n < 1024 ? `${n} B` : n < 1048576 ? `${(n / 1024).toFixed(1)} KB` : `${(n / 1048576).toFixed(1)} MB`;
         const accounts = A.allAccounts();
         const devices = A.allDevices();
         const sessions = A.allSessions(200);
         const audit = A.auditLog({ limit: 300 });
+        const blocks = A.allBlocks();
+        const verifs = A.recentVerifications(50);
+        const spaces = this.spacesOverview();
+        const act = mergeActivity(spaces.map((x) => x.activity));
+        const dayAgo = Date.now() - DAY;
+        const refused24 = spaces.reduce((n, x) => n + refusalsSince(x.refusals, dayAgo), 0);
+        const refusedAll = spaces.reduce((n, x) => n + (x.refusals?.total ?? 0), 0);
+        const plans = A.plans();
+        const planCounts = A.planCounts();
+        const owners = A.spaceOwners();
+        const ownedCounts = A.ownedCounts();
+        const limitHits = A.planLimitHits();
+        const acctById = new Map(accounts.map((a) => [a.id, a]));
+        const planOptions = (sel) => Object.keys(plans).map((n) => `<option value="${esc(n)}"${n === sel ? " selected" : ""}>${esc(n)}</option>`).join("");
         const devByAcct = new Map();
         for (const d of devices)
             devByAcct.set(d.account_id, (devByAcct.get(d.account_id) ?? 0) + 1);
+        const emailCap = Number(process.env.PANTHEON_EMAIL_MAX_PER_HOUR) || 200;
+        const emailsHour = this.emailSends.filter((t) => Date.now() - t < 3_600_000).length;
+        let snapshots = [];
+        try {
+            snapshots = readdirSync(join(this.dataDir, "backups")).filter((f) => f.startsWith("accounts-") && f.endsWith(".db")).sort();
+        }
+        catch { }
+        const lastBackupPull = audit.find((e) => e.event === "admin_backup");
+        const upMin = Math.round((Date.now() - this.startedAt) / 60_000);
+        const csrf = this.adminCsrf();
+        const done = url?.searchParams.get("done");
         const rows = (arr) => arr.join("");
+        const form = (action, id, label, extra = "", cls = "") => `<form method=POST action="/admin/action" class=inl onsubmit="return confirmAct(this)"><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value="${action}"><input type=hidden name=id value="${esc(id)}">${extra}<button class="act ${cls}">${label}</button></form>`;
         const html = `<!doctype html><meta charset=utf-8><title>pantheon · admin</title>
 <meta name=viewport content="width=device-width,initial-scale=1">
-<style>
-  :root{--bg:#0b0c0e;--card:#15171b;--line:#262a30;--fg:#e7e9ec;--dim:#9aa1a9;--accent:#5b9dff}
-  @media(prefers-color-scheme:light){:root{--bg:#f6f7f9;--card:#fff;--line:#e6e8eb;--fg:#1a1c1f;--dim:#6b7280;--accent:#2563eb}}
-  *{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:14px/1.5 system-ui,-apple-system,sans-serif}
-  header{padding:20px 24px;border-bottom:1px solid var(--line);display:flex;align-items:baseline;gap:16px;flex-wrap:wrap}
-  h1{font-size:18px;margin:0}.dim{color:var(--dim)}
-  .stats{display:flex;gap:10px;flex-wrap:wrap;padding:16px 24px}
-  .stat{background:var(--card);border:1px solid var(--line);border-radius:10px;padding:10px 16px;min-width:96px}
-  .stat b{font-size:22px;display:block}.stat span{color:var(--dim);font-size:12px}
-  section{padding:8px 24px 28px}h2{font-size:14px;text-transform:uppercase;letter-spacing:.04em;color:var(--dim);margin:22px 0 8px}
-  .wrap{overflow-x:auto;border:1px solid var(--line);border-radius:10px;background:var(--card)}
-  table{border-collapse:collapse;width:100%;font-variant-numeric:tabular-nums}
-  th,td{text-align:left;padding:8px 12px;border-bottom:1px solid var(--line);white-space:nowrap}
-  th{color:var(--dim);font-weight:600;font-size:12px}tr:last-child td{border-bottom:0}
-  code{font-family:ui-monospace,monospace;font-size:12px}a{color:var(--accent)}
-  .pill{font-size:11px;padding:1px 7px;border-radius:999px;border:1px solid var(--line)}
-</style>
+${ADMIN_CSS}
 <header>
   <h1>pantheon · admin</h1>
-  <span class=dim>${esc(this.opts.host ?? "relay")} · pkg ${VERSION}</span>
-  <span style="margin-left:auto"><a href="/admin/export?table=audit&format=csv">export audit CSV</a> · <a href="/admin/export?table=accounts&format=json">accounts JSON</a> · <a href="/admin/logout">sign out</a></span>
+  <span class=dim>${esc(this.opts.host ?? "relay")} · pkg ${VERSION} · up ${upMin < 60 ? upMin + "m" : Math.round(upMin / 60) + "h"}</span>
+  <span style="margin-left:auto"><a href="/admin/export?table=audit&format=csv">export audit CSV</a> · <a href="/admin/export?table=accounts&format=json">accounts JSON</a> · <a href="/admin/backup">download backup</a> · <a href="/admin/logout">sign out</a></span>
 </header>
+${done ? `<div class=done>${esc(done)}</div>` : ""}
 <div class=stats>
   <div class=stat><b>${c.accounts}</b><span>accounts</span></div>
   <div class=stat><b>${c.devices}</b><span>devices</span></div>
-  <div class=stat><b>${c.live_sessions}</b><span>live sessions</span></div>
-  <div class=stat><b>${c.sessions}</b><span>sessions total</span></div>
+  <div class=stat><b>${Object.entries(planCounts).filter(([n]) => n !== "free").reduce((s, [, v]) => s + v, 0)}<span class=dim style="font-size:14px"> / ${c.accounts}</span></b><span>paid plans / accounts</span></div>
+  <div class=stat><b>${sessions.filter((s) => !s.revoked_at && Date.now() - s.last_seen <= 15 * 60_000).length}<span class=dim style="font-size:14px"> / ${c.live_sessions}</span></b><span>sessions active / open</span></div>
+  <div class=stat><b>${spaces.filter((s) => s.live).length}<span class=dim style="font-size:14px"> / ${spaces.length}</span></b><span>spaces live / total · cap ${this.limits.maxSpaces}</span></div>
+  <div class="stat ${emailsHour > emailCap * 0.8 ? "warn" : ""}"><b>${emailsHour}<span class=dim style="font-size:14px"> / ${emailCap}</span></b><span>emails this hour</span></div>
+  <div class=stat><b>${snapshots.length}</b><span>snapshots · latest ${snapshots.length ? esc(snapshots[snapshots.length - 1].replace(/^accounts-|\\.db$/g, "").replace(/T/, " ").slice(0, 16)) : "—"}</span></div>
+  <div class="stat ${!lastBackupPull || Date.now() - lastBackupPull.ts > 36 * 3_600_000 ? "warn" : ""}"><b>${lastBackupPull ? ago(lastBackupPull.ts) : "never"}</b><span>last off-host backup pull</span></div>
   <div class=stat><b>${c.audit}</b><span>audit events</span></div>
+  <div class=stat><b>${act.messages_24h}<span class=dim style="font-size:14px"> / ${act.messages}</span></b><span>messages today / retained</span></div>
+  <div class=stat><b>${act.senders_24h.length}<span class=dim style="font-size:14px"> · ${act.sessions_24h} sessions</span></b><span>delegates active today</span></div>
+  <div class="stat ${countActs(act.by_act_24h, ["OBJECT"]) ? "warn" : ""}"><b>${countActs(act.by_act_24h, ["OBJECT"])}<span class=dim style="font-size:14px"> / ${countActs(act.by_act, ["OBJECT"])}</span></b><span>objections today / retained</span></div>
+  <div class="stat ${countActs(act.by_act_24h, ESCALATIONS) ? "warn" : ""}"><b>${countActs(act.by_act_24h, ESCALATIONS)}<span class=dim style="font-size:14px"> / ${countActs(act.by_act, ESCALATIONS)}</span></b><span>escalations today / retained</span></div>
+  <div class=stat><b>${countActs(act.by_act_24h, ["DELIVERED"])}<span class=dim style="font-size:14px"> / ${countActs(act.by_act, ["DELIVERED"])}</span></b><span>deliveries today / retained</span></div>
+  <div class="stat ${refused24 ? "warn" : ""}"><b data-refused="${refusedAll}">${refused24}<span class=dim style="font-size:14px"> / ${refusedAll}</span></b><span>refused by the relay today / total</span></div>
 </div>
 <section>
-  <h2>Accounts</h2><div class=wrap><table>
-    <tr><th>username</th><th>email</th><th>status</th><th>devices</th><th>created</th></tr>
-    ${rows(accounts.map((a) => `<tr><td><code>${esc(a.username)}</code></td><td>${esc(a.email)}</td><td><span class=pill>${esc(a.status)}</span></td><td>${devByAcct.get(a.id) ?? 0}</td><td class=dim>${when(a.created_at)}</td></tr>`))}
-    ${accounts.length ? "" : "<tr><td colspan=5 class=dim>no accounts yet</td></tr>"}
+  <h2>Activity <span class=dim>(every space · today and retained history)</span></h2><div class=wrap><table id=t-activity>
+    <tr><th></th>${MESSAGE_ACTS.map((x) => `<th>${x}</th>`).join("")}<th>refused</th></tr>
+    <tr><td class=dim>today</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="24h">${act.by_act_24h[x] ?? 0}</td>`).join("")}<td>${refused24}</td></tr>
+    <tr><td class=dim>retained</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="all">${act.by_act[x] ?? 0}</td>`).join("")}<td>${refusedAll}</td></tr>
+  </table></div>
+  <p class=note>Messages are acts delegates sent; JOIN/LEAVE presence is not counted. Retained is what each space's ledger still holds — the most recent ${LIMITS.ledgerKeepRecent.toLocaleString()} acts plus everything in an open goal. Refused is what the relay handed back: wrong turn, missing reference, foreign repo, rate limit. Click a space for its conversation.</p>
+
+  <h2>Spaces <input placeholder="filter" data-filter="t-spaces"></h2><div class=wrap><table id=t-spaces>
+    <tr><th>space</th><th>state</th><th>owner</th><th>members</th><th>online</th><th>acts</th><th>msgs today</th><th>delegates today</th><th>objections</th><th>refused</th><th>goals</th><th>owed</th><th>last activity</th><th>on disk</th><th></th></tr>
+    ${rows(spaces.map((s) => `<tr><td><a href="/admin/space?name=${encodeURIComponent(s.name)}" title="members, refusals and the conversation"><code>${esc(s.name)}</code></a></td><td><span class="pill ${s.live ? "ok" : ""}">${s.live ? "live" : "sleeping"}</span></td><td>${(() => { const o = owners.get(s.name) ? acctById.get(owners.get(s.name)) : undefined; return o ? `<code>${esc(o.username)}</code> <span class=pill data-plan="${esc(o.plan)}">${esc(o.plan)}</span>` : "<span class=dim title=\"no owner on record — no plan limits apply\">—</span>"; })()}</td><td>${s.members}</td><td>${s.online}</td><td>${s.acts}</td><td>${s.activity.messages_24h}</td><td>${s.activity.senders_24h.length}</td><td>${s.activity.by_act_24h.OBJECT ?? 0}<span class=dim> / ${s.activity.by_act.OBJECT ?? 0}</span></td><td>${refusalsSince(s.refusals, dayAgo)}<span class=dim> / ${s.refusals?.total ?? 0}</span></td><td>${s.open_goals} open / ${s.goals}</td><td>${s.live ? s.obligations : "<span class=dim>—</span>"}</td><td class=dim title="${when(s.last)}">${ago(s.last)}</td><td class=dim>${kb(s.bytes)}</td><td>${form("delete_space", s.name, "delete", `<input type=hidden name=confirm value="">`, "danger")}</td></tr>`))}
+    ${spaces.length ? "" : "<tr><td colspan=15 class=dim>no spaces yet</td></tr>"}
+  </table></div>
+  <p class=note>Sleeping spaces are on disk but idle; they reload on the next connect. Delete is irreversible and disconnects every member of that space.</p>
+
+  <h2>Accounts <input placeholder="filter" data-filter="t-accounts"></h2><div class=wrap><table id=t-accounts>
+    <tr><th>username</th><th>email</th><th>status</th><th>plan</th><th>spaces</th><th>limit hits</th><th>devices</th><th>created</th><th></th></tr>
+    ${rows(accounts.map((a) => `<tr><td><code>${esc(a.username)}</code></td><td>${esc(a.email)}</td><td><span class="pill ${a.status === "suspended" ? "bad" : ""}">${esc(a.status)}</span></td><td><span class="pill ${a.plan === "free" ? "" : "ok"}" data-plan="${esc(a.plan)}">${esc(a.plan)}</span>${a.limits_json ? ' <span class="pill warn" title="custom limits">custom</span>' : ""} <form method=POST action="/admin/action" class=inl onsubmit="return confirmAct(this)"><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan><input type=hidden name=id value="${esc(a.id)}"><select name=plan class=act style="margin-left:4px">${planOptions(a.plan)}</select><button class=act>set</button></form><details class=inl style="margin-left:6px"><summary class="act dim" style="display:inline;list-style:none;cursor:pointer">custom…</summary><form method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_limits><input type=hidden name=id value="${esc(a.id)}"><input name=json placeholder='{"spaces":3,"members":5,"wake":true}' value="${esc(a.limits_json ?? "")}" size=34 style="font:12px ui-monospace,monospace;padding:3px 6px;border:1px solid var(--line);border-radius:6px;background:var(--card);color:var(--fg)"><button class=act>save</button></form></details></td><td>${ownedCounts.get(a.id) ?? 0}<span class=dim> / ${fmtLimit(A.limitsFor(a).spaces)}</span></td><td>${limitHits.get(a.id) ? `<span class="pill warn">${limitHits.get(a.id)}</span>` : "<span class=dim>0</span>"}</td><td>${devByAcct.get(a.id) ?? 0}</td><td class=dim>${when(a.created_at)}</td><td>${a.status === "suspended" ? form("reinstate", a.id, "reinstate") : form("suspend", a.id, "suspend", "", "danger")} ${form("block", a.email, "block email", "", "danger")}</td></tr>`))}
+    ${accounts.length ? "" : "<tr><td colspan=9 class=dim>no accounts yet</td></tr>"}
   </table></div>
+  <p class=note>Suspending signs the account out everywhere and refuses its handshakes until reinstated. Its messages stay in the ledgers. A plan change takes effect at the account's next space, invite or admit; nothing they already have is removed. "Limit hits" counts the times the relay refused them for a plan limit — the people to talk to about upgrading.</p>
 
-  <h2>Live sessions</h2><div class=wrap><table>
-    <tr><th>session</th><th>space</th><th>ip</th><th>started</th><th>last seen</th></tr>
-    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${when(s.last_seen)}</td></tr>`))}
+  <h2>Plans <span class=dim>(limits the relay enforces; the owner's plan governs a space)</span></h2><div class=wrap><table id=t-plans>
+    <tr><th>plan</th><th>accounts</th><th>spaces created</th><th>people per space</th><th>unattended workers</th><th></th></tr>
+    ${rows(Object.entries(plans).map(([n, l]) => { const fid = `plan-${esc(n)}`; return `<tr><td><form id="${fid}" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits><input type=hidden name=id value="${esc(n)}"></form><code>${esc(n)}</code></td><td>${planCounts[n] ?? 0}</td><td><input form="${fid}" name=spaces type=number min=0 value="${l.spaces}" class=act style="width:90px"></td><td><input form="${fid}" name=members type=number min=1 value="${l.members}" class=act style="width:90px"></td><td><label><input form="${fid}" type=checkbox name=wake value=on${l.wake ? " checked" : ""}> allowed</label></td><td><button form="${fid}" class=act>save</button> ${n === "free" ? "" : form("delete_plan", n, "remove", "", "danger")}</td></tr>`; }))}
+    <tr><td><form id="plan-new" method=POST action="/admin/action" class=inl><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=set_plan_limits></form><input form="plan-new" name=id placeholder="new plan name" pattern="[a-z][a-z0-9_-]{0,23}" required class=act style="width:130px"></td><td class=dim>—</td><td><input form="plan-new" name=spaces type=number min=0 value=3 class=act style="width:90px"></td><td><input form="plan-new" name=members type=number min=1 value=5 class=act style="width:90px"></td><td><label><input form="plan-new" type=checkbox name=wake value=on checked> allowed</label></td><td><button form="plan-new" class=act>add plan</button></td></tr>
   </table></div>
+  <p class=note>Edits apply immediately to the next create, invite or admit of every account on that plan. Unused invites count toward "people per space" so nobody mints five at once. Personas are files on the user's machine and cannot be limited here. Every change is audited.</p>
 
-  <h2>Audit log <span class=dim>(latest 300)</span></h2><div class=wrap><table>
-    <tr><th>time</th><th>event</th><th>space</th><th>target</th><th>ip</th></tr>
-    ${rows(audit.map((e) => `<tr><td class=dim>${when(e.ts)}</td><td>${esc(e.event)}</td><td>${esc(e.space) || ""}</td><td><code>${esc(e.target) || ""}</code></td><td class=dim>${esc(e.ip) || ""}</td></tr>`))}
+  <h2>Live sessions <input placeholder="filter" data-filter="t-sessions"></h2><div class=wrap><table id=t-sessions>
+    <tr><th>session</th><th>account</th><th>space</th><th>ip</th><th>started</th><th>last seen</th><th></th></tr>
+    ${rows(sessions.filter((s) => !s.revoked_at).map((s) => `<tr><td><code>${esc(s.id)}</code></td><td><code>${esc(accounts.find((a) => a.id === s.account_id)?.username ?? s.account_id)}</code></td><td>${esc(s.space) || "<span class=dim>—</span>"}</td><td class=dim>${esc(s.ip)}</td><td class=dim>${when(s.created_at)}</td><td class=dim>${ago(s.last_seen)}${Date.now() - s.last_seen > 15 * 60_000 ? ' <span class="pill" title="no heartbeat for 15+ minutes — usually a socket that died with a restart; pruned after 30 days">stale</span>' : ""}</td><td>${form("revoke_session", s.id, "sign out", "", "danger")} ${form("revoke_device", s.device_id, "remove device", "", "danger")}</td></tr>`))}
+    ${sessions.some((s) => !s.revoked_at) ? "" : "<tr><td colspan=7 class=dim>no live sessions</td></tr>"}
   </table></div>
+
+  <h2>Blocked emails and domains</h2><div class=wrap><table id=t-blocks>
+    <tr><th>pattern</th><th>kind</th><th>since</th><th></th></tr>
+    ${rows(blocks.map((b) => `<tr><td><code>${esc(b.pattern)}</code></td><td>${esc(b.kind)}</td><td class=dim>${when(b.created_at)}</td><td>${form("unblock", b.pattern, "unblock")}</td></tr>`))}
+    ${blocks.length ? "" : "<tr><td colspan=4 class=dim>nothing blocked</td></tr>"}
+  </table></div>
+  <form method=POST action="/admin/action" class=blockform><input type=hidden name=csrf value="${csrf}"><input type=hidden name=action value=block><input name=id placeholder="someone@spam.example  or  spam.example" required><button class=act>block</button></form>
+  <p class=note>A blocked email or domain cannot sign up or sign in. Existing accounts are not touched; suspend those separately.</p>
+
+  <h2>Recent verification codes <span class=dim>(support: "I never got my code")</span></h2><div class=wrap><table id=t-verifs>
+    <tr><th>email</th><th>purpose</th><th>requested</th><th>expires</th><th>wrong tries</th><th>state</th></tr>
+    ${rows(verifs.map((v) => `<tr><td>${esc(v.email)}</td><td>${esc(v.purpose)}</td><td class=dim>${when(v.created_at)}</td><td class=dim>${when(v.expires_at)}</td><td>${v.attempts}</td><td><span class="pill ${v.expires_at < Date.now() ? "bad" : "ok"}">${v.expires_at < Date.now() ? "expired" : "pending"}</span></td></tr>`))}
+    ${verifs.length ? "" : "<tr><td colspan=6 class=dim>no pending codes</td></tr>"}
+  </table></div>
+  <p class=note>A row here means the relay generated a code and handed it to the email provider. No row means the request never reached the relay. Codes themselves are never stored.</p>
+
+  <h2>Audit log <span class=dim>(latest 300)</span> <input placeholder="filter" data-filter="t-audit"></h2><div class=wrap><table id=t-audit>
+    <tr><th>time</th><th>event</th><th>space</th><th>target</th><th>detail</th><th>ip</th></tr>
+    ${rows(audit.map((e) => `<tr><td class=dim>${when(e.ts)}</td><td>${e.event.startsWith("admin_") ? `<span class=pill>${esc(e.event)}</span>` : esc(e.event)}</td><td>${esc(e.space) || ""}</td><td><code>${esc(e.target) || ""}</code></td><td class=dim>${esc(e.detail) || ""}</td><td class=dim>${esc(e.ip) || ""}</td></tr>`))}
+  </table></div>
+</section>
+<script>
+  document.querySelectorAll("input[data-filter]").forEach(function (inp) {
+    inp.addEventListener("input", function () {
+      var q = inp.value.toLowerCase(), rowsEl = document.getElementById(inp.dataset.filter).querySelectorAll("tr");
+      for (var i = 1; i < rowsEl.length; i++) rowsEl[i].style.display = !q || rowsEl[i].textContent.toLowerCase().indexOf(q) > -1 ? "" : "none";
+    });
+  });
+  function confirmAct(f) {
+    var a = f.querySelector("[name=action]").value, id = f.querySelector("[name=id]").value;
+    if (a === "set_plan") return confirm("Move " + f.closest("tr").querySelector("code").textContent + " to the " + f.querySelector("[name=plan]").value + " plan? Takes effect on their next space, invite or admit.");
+    if (a === "delete_plan") return confirm('Remove the plan "' + id + '"?');
+    if (a === "delete_space") { var typed = prompt("Delete space \\"" + id + "\\" and disconnect its members? Type the name to confirm."); if (typed !== id) return false; f.querySelector("[name=confirm]").value = typed; return true; }
+    if (a === "suspend" || a === "revoke_session" || a === "revoke_device" || a === "block") return confirm(a.replace("_", " ") + " " + id + "?");
+    return true;
+  }
+</script>`;
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
+        res.end(html);
+    }
+    adminSpace(res, url, name) {
+        const safe = name.replace(/[^a-z0-9._-]/gi, "_");
+        const sp = this.spaces.get(name) ?? null;
+        const tomb = this.deletedSpaces.get(name);
+        const onDisk = [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
+        if (!name || (!sp && (!onDisk || (tomb && Date.now() - tomb < 3_600_000))))
+            return this.json(res, 404, { error: `no space "${name}" on this relay` });
+        const records = sp ? sp.ledger.all() : this.sleepingRecords(safe);
+        const state = sp ? { goals: sp.goals, refusals: sp.store.refusals } : this.sleepingState(safe);
+        const allow = sp ? sp.allow : new Allowlist(this.dataDir, safe);
+        const now = Date.now(), dayAgo = now - DAY;
+        const a = activity(records, now);
+        const esc = escHtml, when = fmtWhen, ago = fmtAgo;
+        const q = {
+            act: url.searchParams.get("act") ?? "", member: url.searchParams.get("member") ?? "", goal: url.searchParams.get("goal") ?? "",
+            q: url.searchParams.get("q") ?? "", presence: url.searchParams.get("presence") === "1", before: Number(url.searchParams.get("before")) || undefined,
+        };
+        const { rows: feedRows, next } = feed(records, { ...q, limit: 100 });
+        const filtered = !!(q.act || q.member || q.goal || q.q || q.presence);
+        const link = (extra) => {
+            const p = new URLSearchParams({ name });
+            for (const [k, v] of Object.entries({ act: q.act, member: q.member, goal: q.goal, q: q.q, presence: q.presence ? "1" : "", ...extra }))
+                if (v !== undefined && String(v) !== "")
+                    p.set(k, String(v));
+            return `/admin/space?${p.toString()}`;
+        };
+        const pill = (x) => `<span class="pill ${ACT_TONE[x]}">${x}</span>`;
+        const goalTitle = (id) => id ? `<a href="${link({ goal: id, before: undefined })}" title="${esc(id)}">${esc(state.goals.get(id)?.title ?? id)}</a>` : "<span class=dim>—</span>";
+        const metaLine = (r) => {
+            const bits = [];
+            if (r.summary)
+                bits.push(`summary: ${esc(r.summary)}`);
+            const meta = (r.meta ?? {});
+            for (const k of ["branch", "commit", "repo_origin", "decision_domains", "defers_to", "affects"])
+                if (meta[k] !== undefined)
+                    bits.push(`${k}: ${esc(typeof meta[k] === "string" ? meta[k] : JSON.stringify(meta[k]))}`);
+            if (r.ref)
+                bits.push(`re <code>${esc(r.ref)}</code>`);
+            return bits.length ? `<div class=note>${bits.join(" · ")}</div>` : "";
+        };
+        const said = (r) => r.body.length > 400
+            ? `<details><summary>${esc(r.body.slice(0, 400))}…</summary>${esc(r.body)}</details>`
+            : (esc(r.body) || "<span class=dim>(empty)</span>");
+        const rowsHtml = feedRows.map((r) => `<tr><td class=dim><span title="${when(r.ts)}">${ago(r.ts)}</span><div>#${r.seq}</div></td><td><a href="${link({ member: r.from, before: undefined })}"><code>${esc(r.from)}</code></a><div class=dim>${esc(sp?.members.get(r.from)?.agent ?? "")}${r.role ? ` · ${esc(r.role)}` : ""}</div></td><td>${pill(r.act)}</td><td>${r.to && r.to.length ? r.to.map((t) => `<code>${esc(t)}</code>`).join(", ") : "<span class=dim>everyone</span>"}</td><td>${goalTitle(r.goal)}</td><td class=body>${said(r)}${metaLine(r)}</td></tr>`).join("");
+        const entries = allow.all();
+        const memberRows = entries.map((e) => {
+            const m = sp?.members.get(e.member);
+            const online = m ? m.sessions.size : 0;
+            return `<tr><td><a href="${link({ member: e.member, before: undefined })}"><code>${esc(e.member)}</code></a></td><td>${e.admitted ? '<span class="pill ok">admitted</span>' : '<span class="pill">pending</span>'}</td><td>${e.may_wake ? "yes" : "no"}</td><td>${online ? `<span class="pill ok">${online} session${online === 1 ? "" : "s"}</span> ${esc(m.agent)}` : "<span class=dim>offline</span>"}</td><td class=dim>${m ? ago(m.last_seen) : when(e.first_seen)}</td></tr>`;
+        }).join("");
+        const repos = allow.repoList();
+        const refusals = state.refusals;
+        const refusalRows = [...refusals.recent].reverse().map((r) => `<tr><td class=dim>${when(r.ts)}</td><td><code>${esc(r.member)}</code></td><td>${esc(r.act)}</td><td><span class="pill bad">${esc(r.code)}</span></td></tr>`).join("");
+        const byCode = Object.entries(refusals.by_code).sort((x, y) => y[1] - x[1]).map(([c, n]) => `<code>${esc(c)}</code> ${n}`).join(" · ");
+        const open = [...state.goals.values()].filter((g) => g.state !== "CLOSED").length;
+        const options = MESSAGE_ACTS.map((x) => `<option value="${x}"${q.act === x ? " selected" : ""}>${x}</option>`).join("");
+        const html = `<!doctype html><meta charset=utf-8><title>pantheon · admin · ${esc(name)}</title>
+<meta name=viewport content="width=device-width,initial-scale=1">
+${ADMIN_CSS}
+<style>
+  .feed td{white-space:normal;vertical-align:top}.feed .body{min-width:320px;max-width:720px;overflow-wrap:anywhere}
+  .feed details summary{cursor:pointer;color:var(--accent)}.feed details[open] summary{display:none}
+  .pill.warn{color:var(--warn);border-color:var(--warn)}.pill.info{color:var(--accent);border-color:var(--accent)}.pill.dim{color:var(--dim)}
+  .filters{display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin:8px 0 10px}
+  .filters input,.filters select{font:13px system-ui;padding:5px 9px;border:1px solid var(--line);border-radius:7px;background:var(--card);color:var(--fg)}
+  .crumbs a{color:var(--dim);text-decoration:none}.crumbs a:hover{color:var(--accent)}
+  td a{text-decoration:none}td a:hover{text-decoration:underline}
+</style>
+<header>
+  <h1><span class=crumbs><a href="/admin">admin</a> › </span>${esc(name)} <span class="pill ${sp ? "ok" : ""}">${sp ? "live" : "sleeping"}</span></h1>
+  <span class=dim>${esc(allow.peekId() ?? "no id yet")} · ${records.length} acts retained${a.first ? ` since ${when(a.first)}` : ""}</span>
+  <span style="margin-left:auto"><a href="/admin">← dashboard</a> · <a href="/admin/logout">sign out</a></span>
+</header>
+<div class=stats>
+  <div class=stat><b>${a.messages_24h}<span class=dim style="font-size:14px"> / ${a.messages}</span></b><span>messages today / retained</span></div>
+  <div class=stat><b>${a.senders_24h.length}<span class=dim style="font-size:14px"> · ${a.sessions_24h} sessions</span></b><span>delegates active today</span></div>
+  <div class="stat ${a.by_act_24h.OBJECT ? "warn" : ""}"><b>${a.by_act_24h.OBJECT ?? 0}<span class=dim style="font-size:14px"> / ${a.by_act.OBJECT ?? 0}</span></b><span>objections today / retained</span></div>
+  <div class="stat ${countActs(a.by_act_24h, ESCALATIONS) ? "warn" : ""}"><b>${countActs(a.by_act_24h, ESCALATIONS)}<span class=dim style="font-size:14px"> / ${countActs(a.by_act, ESCALATIONS)}</span></b><span>escalations today / retained</span></div>
+  <div class=stat><b>${a.by_act_24h.DELIVERED ?? 0}<span class=dim style="font-size:14px"> / ${a.by_act.DELIVERED ?? 0}</span></b><span>deliveries today / retained</span></div>
+  <div class="stat ${refusalsSince(refusals, dayAgo) ? "warn" : ""}"><b>${refusalsSince(refusals, dayAgo)}<span class=dim style="font-size:14px"> / ${refusals.total}</span></b><span>refused today / total</span></div>
+  <div class=stat><b>${open}<span class=dim style="font-size:14px"> / ${state.goals.size}</span></b><span>goals open / total</span></div>
+  ${sp ? `<div class=stat><b>${sp.obligations.size}</b><span>obligations owed</span></div>` : ""}
+</div>
+<section>
+  <h2>Members <span class=dim>(${entries.filter((e) => e.admitted).length} admitted)</span></h2><div class=wrap><table>
+    <tr><th>member</th><th>state</th><th>may wake</th><th>online</th><th>last seen</th></tr>
+    ${memberRows || "<tr><td colspan=5 class=dim>nobody yet</td></tr>"}
+  </table></div>
+  ${repos.length ? `<h2>Repos this team works from</h2><div class=wrap><table><tr><th>origin</th><th>fingerprint</th><th>added by</th><th>when</th></tr>${repos.map((r) => `<tr><td>${esc(r.origin ?? "(no origin)")}</td><td><code>${esc(r.fingerprint)}</code></td><td><code>${esc(r.added_by)}</code></td><td class=dim>${when(r.at)}</td></tr>`).join("")}</table></div>` : ""}
+
+  <h2>Acts <span class=dim>(today · retained)</span></h2><div class=wrap><table id=t-acts>
+    <tr><th></th>${MESSAGE_ACTS.map((x) => `<th>${x}</th>`).join("")}</tr>
+    <tr><td class=dim>today</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="24h">${a.by_act_24h[x] ?? 0}</td>`).join("")}</tr>
+    <tr><td class=dim>retained</td>${MESSAGE_ACTS.map((x) => `<td data-act="${x}" data-window="all">${a.by_act[x] ?? 0}</td>`).join("")}</tr>
+  </table></div>
+
+  <h2>Refused by the relay <span class=dim>(latest ${refusals.recent.length} of ${refusals.total})</span></h2><div class=wrap><table>
+    <tr><th>when</th><th>member</th><th>request</th><th>reason</th></tr>
+    ${refusalRows || "<tr><td colspan=4 class=dim>nothing refused</td></tr>"}
+  </table></div>
+  ${byCode ? `<p class=note>All time: ${byCode}</p>` : ""}
+
+  <h2>Conversation <span class=dim>(newest first${filtered ? ", filtered" : ""})</span></h2>
+  <form class=filters method=GET action="/admin/space"><input type=hidden name=name value="${esc(name)}">
+    <select name=act><option value="">every act</option>${options}</select>
+    <input name=member placeholder="member" value="${esc(q.member)}" size=12>
+    <input name=goal placeholder="goal id" value="${esc(q.goal)}" size=16>
+    <input name=q placeholder="search what was said" value="${esc(q.q)}" size=24>
+    <label class=dim><input type=checkbox name=presence value=1${q.presence ? " checked" : ""}> show JOIN/LEAVE</label>
+    <button class=act>filter</button>${filtered ? `<a href="/admin/space?name=${encodeURIComponent(name)}">clear</a>` : ""}
+  </form>
+  <div class=wrap><table class=feed>
+    <tr><th>when</th><th>from</th><th>act</th><th>to</th><th>goal</th><th>said</th></tr>
+    ${rowsHtml || `<tr><td colspan=6 class=dim>${filtered ? "nothing matches" : "no messages yet"}</td></tr>`}
+  </table></div>
+  ${next !== null ? `<p><a href="${link({ before: next })}">older ›</a></p>` : ""}
+  <p class=note>Retained history only: the relay keeps the most recent ${LIMITS.ledgerKeepRecent.toLocaleString()} acts of a space plus everything in an open goal. Bodies are shown as sent; nothing here is edited or summarised.</p>
 </section>`;
         res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
         res.end(html);
@@ -706,8 +1249,10 @@ pantheon signup --email you@work.com --username you</code></pre>
     onSocket(ws, ip = "unknown") {
         let space = null;
         let me = null;
+        let acct = null;
         let sessionId = "";
         let role = "interactive";
+        let lastMsg = "";
         let alive = true;
         const nonce = newNonce();
         ws.on("pong", () => { alive = true; });
@@ -715,6 +1260,10 @@ pantheon signup --email you@work.com --username you</code></pre>
         probe._alive = () => alive;
         probe._clear = () => { alive = false; };
         const fail = (code, message, cid) => {
+            if (cid && space && me && !space.deleted) {
+                noteRefusal(space.store.refusals, { ts: Date.now(), member: me.id, act: lastMsg || "?", code });
+                space.store.save(space.goals, space.obligations, space.profiles);
+            }
             this.send(ws, { t: "error", code, message, ...(cid ? { cid } : {}) });
         };
         const reject = (code, message) => {
@@ -753,6 +1302,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 return fail("BAD_MESSAGE", parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "), cid);
             }
             const m = parsed.data;
+            lastMsg = m.t === "act" ? m.act : m.t;
             if (m.t === "ping")
                 return this.send(ws, { t: "pong" });
             if (m.t === "hello") {
@@ -765,6 +1315,8 @@ pantheon signup --email you@work.com --username you</code></pre>
                 if (!verifyChallenge(m.pubkey, m.space, m.member, m.nonce, m.sig)) {
                     return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
                 }
+                const gated = this.requireAccounts && !!this.accounts && !this.localTrusted(ip);
+                const pre = gated ? this.accounts.authorize(m.pubkey, m.member) : null;
                 let sp;
                 if (m.enroll) {
                     sp = this.spaces.get(m.space) ?? null;
@@ -772,16 +1324,37 @@ pantheon signup --email you@work.com --username you</code></pre>
                         return reject("NO_SUCH_SPACE", `no space "${m.space}" on this relay`);
                 }
                 else {
+                    const tomb = this.deletedSpaces.get(m.space);
+                    if (tomb && Date.now() - tomb < 3_600_000) {
+                        return reject("SPACE_DELETED", `the space "${m.space}" was removed by the relay operator. Start a new one with a different name, or contact them.`);
+                    }
+                    const isNew = !this.spaces.has(m.space) && !this.spaceOnDisk(m.space);
                     if (!this.spaces.has(m.space)) {
                         const denied = this.mayCreateSpace(ip);
                         if (denied)
                             return reject(denied.code, denied.message);
                     }
+                    if (isNew && gated && !pre?.ok) {
+                        this.log(`! REFUSED ${m.member}: cannot create "${m.space}" without a signed-in account (${pre?.ok === false ? pre.reason : "no account"})`);
+                        return reject("NOT_SIGNED_IN", "sign in first: run `pantheon signup` (new) or `pantheon login` (existing account) on this machine, then try again.");
+                    }
+                    if (isNew && pre?.ok) {
+                        const lim = this.accounts.limitsFor(pre.account);
+                        const owned = this.accounts.spacesOwned(pre.account.id);
+                        if (owned.length >= lim.spaces) {
+                            const msg = `your ${pre.account.plan} plan allows ${fmtLimit(lim.spaces)} space${lim.spaces === 1 ? "" : "s"} you create${owned.length ? ` (you own ${owned.map((n) => `"${n}"`).join(", ")})` : ""}. Upgrade at https://www.joinpantheon.network, or free a slot: pantheon space delete <team> --yes`;
+                            this.accounts.audit({ event: "plan_limit", actor_account: pre.account.id, space: m.space, target: "create_space", detail: `${pre.account.plan}: ${owned.length}/${lim.spaces} spaces`, ip });
+                            this.log(`! PLAN_LIMIT ${m.member}: cannot create "${m.space}" (${owned.length}/${fmtLimit(lim.spaces)} spaces on ${pre.account.plan})`);
+                            return reject("PLAN_LIMIT", msg);
+                        }
+                    }
                     sp = this.getOrCreateSpace(m.space, m.token);
                     if (!sp)
                         return reject("BAD_TOKEN", "wrong token for this space");
-                    if (sp.createdAt >= Date.now() - 1_000)
+                    if (isNew) {
                         this.noteSpaceCreate(ip);
+                        this.accounts?.recordSpace(sp.name, pre?.ok ? pre.account.id : null);
+                    }
                 }
                 let acctSession = null;
                 if (this.requireAccounts && this.accounts && !this.localTrusted(ip)) {
@@ -789,15 +1362,23 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (!auth.ok) {
                         const msg = auth.reason === "username_mismatch"
                             ? `this device is signed in as a different username than "${m.member}". Use your own username, or \`pantheon login\` on this machine.`
-                            : `sign in first: run \`pantheon signup\` (new) or \`pantheon login\` (existing account) on this machine, then try again.`;
+                            : auth.reason === "suspended"
+                                ? `this account has been suspended by the relay operator. Contact them to have it reinstated.`
+                                : `sign in first: run \`pantheon signup\` (new) or \`pantheon login\` (existing account) on this machine, then try again.`;
                         this.log(`[${sp.name}] ! REFUSED ${m.member}: ${auth.reason}`);
                         return reject("NOT_SIGNED_IN", msg);
                     }
                     m.member = auth.account.username;
+                    acct = auth.account;
                     acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip).id;
                 }
                 let enrolled = null;
                 if (m.enroll) {
+                    const plan = this.spacePlan(sp.name);
+                    if (plan && !sp.allow.get(m.member)?.admitted && sp.allow.admittedCount() >= plan.limits.members) {
+                        this.accounts?.audit({ event: "plan_limit", actor_account: acct?.id ?? null, space: sp.name, target: "join", detail: `${plan.name}: ${sp.allow.admittedCount()}/${plan.limits.members} people`, ip });
+                        return reject("PLAN_LIMIT", `"${sp.name}" is full: its owner's ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. Ask ${plan.owner.username} to upgrade at https://www.joinpantheon.network`);
+                    }
                     const r = sp.allow.redeem(m.enroll, m.member, m.pubkey);
                     if (!r.ok) {
                         this.log(`[${sp.name}] ! invite refused for ${m.member}: ${r.why}`);
@@ -823,6 +1404,18 @@ pantheon signup --email you@work.com --username you</code></pre>
                     catch { } }, 20);
                     return;
                 }
+                let newRepo = null;
+                if (m.repo) {
+                    if (sp.allow.hasRepo(m.repo)) { }
+                    else if (sp.allow.repoCount() === 0 || enrolled || verdict === "founder")
+                        newRepo = m.repo;
+                    else {
+                        const known = sp.allow.repoList().map((r) => r.origin ?? r.fingerprint).join(", ");
+                        this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${m.repo_origin ?? m.repo} not bound to this space`);
+                        return reject("REPO_MISMATCH", `this checkout (${m.repo_origin ?? "no origin"}) is not one of the repos "${sp.name}" works from (${known || "none yet"}). ` +
+                            `Open your agent in the team's repo, or if this repo really belongs to the team: pantheon repo add`);
+                    }
+                }
                 space = sp;
                 clearHelloTimer();
                 sessionId = acctSession ?? this.mintSession();
@@ -830,10 +1423,17 @@ pantheon signup --email you@work.com --username you</code></pre>
                 me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, m.role, ws, m.pkg);
                 const firstSession = me.sessions.size === 1;
                 sp.lastTouch = Date.now();
+                if (newRepo && sp.allow.addRepo(newRepo, m.repo_origin ?? null, me.id)) {
+                    this.log(`[${sp.name}] + repo ${m.repo_origin ?? newRepo} registered by ${me.id}`);
+                    this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.repo_origin ?? newRepo}`, meta: { repo: newRepo, repo_origin: m.repo_origin ?? null } });
+                    this.broadcast(sp, { t: "repos", repos: sp.allow.repoList() });
+                }
                 this.send(ws, {
                     t: "welcome", member: me.id, session: sessionId, space: sp.name, seq: sp.ledger.head,
                     roster: this.roster(sp), goals: [...sp.goals.values()],
                     obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
+                    space_id: sp.allow.spaceId(), repos: sp.allow.repoList(),
+                    ...(acct ? { plan: this.planView(acct, sp) } : {}),
                     ...(enrolled ? { token: enrolled } : {}),
                 });
                 for (const r of sp.ledger.since(m.from_seq ?? sp.ledger.head)) {
@@ -877,6 +1477,13 @@ pantheon signup --email you@work.com --username you</code></pre>
                 const target = space.allow.get(m.member);
                 if (!target)
                     return fail("NO_SUCH_MEMBER", `"${m.member}" has never connected, so there is no key to admit`, m.cid);
+                if (!m.revoke && !m.forget) {
+                    const plan = this.spacePlan(space.name);
+                    if (plan && m.may_wake && !plan.limits.wake)
+                        return this.planRefusal(space, plan, "admit", `the ${plan.name} plan does not include unattended workers — admit without --may-wake`, m.cid, fail, acct?.id ?? null, ip);
+                    if (plan && !target.admitted && space.allow.admittedCount() >= plan.limits.members)
+                        return this.planRefusal(space, plan, "admit", `"${space.name}" is full for the ${plan.name} plan (${fmtLimit(plan.limits.members)} people). Upgrade at https://www.joinpantheon.network to admit more.`, m.cid, fail, acct?.id ?? null, ip);
+                }
                 if (m.revoke || m.forget) {
                     if (m.forget)
                         space.allow.forget(m.member);
@@ -900,17 +1507,69 @@ pantheon signup --email you@work.com --username you</code></pre>
                 this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: m.member, seq: space.ledger.head });
                 return;
             }
+            if (m.t === "worker_state") {
+                if (role !== "worker")
+                    return;
+                me.worker = { state: m.state, ...(m.detail ? { detail: m.detail } : {}), ...(m.until ? { until: m.until } : {}), at: Date.now() };
+                this.broadcast(space, { t: "roster", roster: this.roster(space) });
+                return;
+            }
+            if (m.t === "delete_space") {
+                if (m.confirm !== space.name)
+                    return fail("CONFIRM_MISMATCH", `type the space name ("${space.name}") to confirm`, m.cid);
+                const owner = this.accounts?.spaceOwner(space.name) ?? null;
+                const isOwner = owner ? owner.id === acct?.id : space.allow.founder() === me.id;
+                if (!isOwner)
+                    return fail("NOT_OWNER", `only the founder of "${space.name}" can delete it${owner ? ` (that is ${owner.username})` : ""}`, m.cid);
+                const name = space.name;
+                this.accounts?.audit({ event: "space_deleted", actor_account: acct?.id ?? null, space: name, detail: `by its founder ${me.id}`, ip });
+                this.log(`[${name}] * DELETED by its founder ${me.id}`);
+                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: name, seq: space.ledger.head });
+                setTimeout(() => { this.deleteSpace(name); this.accounts?.markSpaceDeleted(name); }, 50).unref?.();
+                return;
+            }
             if (m.t === "invite") {
                 const self = space.allow.get(me.id);
                 if (!self?.admitted)
                     return fail("NOT_ADMITTED", "only an admitted member can invite", m.cid);
+                const plan = this.spacePlan(space.name);
+                if (plan) {
+                    if (m.may_wake && !plan.limits.wake)
+                        return this.planRefusal(space, plan, "invite", `the ${plan.name} plan does not include unattended workers — invite without wake: pantheon invite --no-wake`, m.cid, fail, acct?.id ?? null, ip);
+                    const open = space.allow.openInvites().length;
+                    if (space.allow.admittedCount() + open >= plan.limits.members) {
+                        return this.planRefusal(space, plan, "invite", `"${space.name}" is full for the ${plan.name} plan: ${fmtLimit(plan.limits.members)} people${open ? `, counting ${open} unused invite${open === 1 ? "" : "s"}` : ""}. Upgrade at https://www.joinpantheon.network to invite more.`, m.cid, fail, acct?.id ?? null, ip);
+                    }
+                }
                 const token = randomBytes(18).toString("base64url");
                 const inv = space.allow.mintInvite(me.id, m.may_wake, m.ttl_minutes, token);
                 this.log(`[${space.name}] * invite minted by ${me.id}, valid ${m.ttl_minutes}m, single use`);
                 this.send(ws, { t: "invite", url: token, expires_at: inv.expires_at });
                 return;
             }
+            if (m.t === "bind_repo") {
+                const self = space.allow.get(me.id);
+                if (!self?.admitted)
+                    return fail("NOT_ADMITTED", "only an admitted member can register a repo", m.cid);
+                const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id, m.base ?? null);
+                if (!added && m.base && space.allow.setRepoBase(m.repo, m.base)) {
+                    this.log(`[${space.name}] ~ repo ${m.origin ?? m.repo} base branch → ${m.base} (by ${me.id})`);
+                    this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                }
+                if (added) {
+                    this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
+                    this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.origin ?? m.repo}`, meta: { repo: m.repo, repo_origin: m.origin ?? null } });
+                    this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                }
+                this.send(ws, { t: "ack", cid: m.cid, id: m.repo, seq: space.ledger.head });
+                return;
+            }
             if (m.t === "claim") {
+                if (role === "worker") {
+                    const plan = this.spacePlan(space.name);
+                    if (plan && !plan.limits.wake)
+                        return this.planRefusal(space, plan, "wake", `unattended workers are not included in this space's ${plan.name} plan`, m.cid, fail, acct?.id ?? null, ip);
+                }
                 if (m.obligation.startsWith("cont:")) {
                     const act = space.ledger.find(m.obligation.slice(5));
                     if (!act)
@@ -1011,7 +1670,11 @@ pantheon signup --email you@work.com --username you</code></pre>
             if (m.after_seq !== undefined) {
                 const mine = me.id;
                 const missed = space.ledger.since(m.after_seq)
-                    .filter((r) => r.from !== mine && r.act !== "JOIN" && r.act !== "LEAVE");
+                    .filter((r) => r.from !== mine && r.act !== "JOIN" && r.act !== "LEAVE")
+                    .filter((r) => (m.goal ? r.goal === m.goal : !r.goal)
+                    || (r.to?.includes(mine) ?? false)
+                    || (m.to?.includes(r.from) ?? false)
+                    || (!!m.ref && r.ref === m.ref));
                 if (missed.length) {
                     return fail("STALE_VIEW", `${missed.length} act(s) arrived while you were composing — read them before you answer:\n` +
                         missed.slice(0, 8).map((r) => `  [${r.seq}] ${r.act} from ${r.from}: ${first(r.body)}`).join("\n") +
@@ -1019,7 +1682,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                         `\nCall pantheon_wait, then send again.`, m.cid);
                 }
             }
-            const err = this.validateAct(space, me, m.act, m.goal ?? null, m.ref ?? null, m.to ?? null, m.meta, m.defers_to, m.body.length, m.summary);
+            const err = this.validateAct(space, me, m.act, m.goal ?? null, m.ref ?? null, m.to ?? null, m.meta, m.defers_to, m.body.length, m.summary, m.repo);
             if (err)
                 return fail(err.code, err.message, m.cid);
             const rec = this.commit(space, {
@@ -1080,7 +1743,7 @@ pantheon signup --email you@work.com --username you</code></pre>
         }
         this.evictSpaces();
     }
-    validateAct(sp, me, act, goalId, ref, to, meta, deferTo, bodyLen = 0, summary) {
+    validateAct(sp, me, act, goalId, ref, to, meta, deferTo, bodyLen = 0, summary, repo) {
         if (!SENDABLE.includes(act))
             return { code: "RESERVED_ACT", message: `${act} is emitted by the relay, not by a delegate` };
         const now = Date.now();
@@ -1119,19 +1782,22 @@ pantheon signup --email you@work.com --username you</code></pre>
                     message: "HUMAN_REQUIRED must name decision_domains so the relay can verify the human owner. Call pantheon_route_decision first." };
             }
             const target = sp.profiles.get(to[0]);
-            if (!target) {
-                return { code: "NO_AUTHORITY_PROFILE",
-                    message: `${to[0]} has not published an organization profile, so their decision authority cannot be verified.` };
-            }
             const route = routeDecision(sp.profiles.values(), { domains });
             if (route.conflicts.length) {
                 return { code: "AMBIGUOUS_DECISION_AUTHORITY",
                     message: `authority conflicts for ${route.conflicts.map((c) => `${c.domain} (${c.reason}: ${c.members.join(", ")})`).join("; ")}. Fix the profiles or ESCALATE instead of guessing.` };
             }
-            const owner = route.required_humans.find((x) => x.member === to[0]);
-            if (!owner || domains.some((d) => !owner.domains.includes(d)) || route.unmatched_domains.length) {
+            const others = route.required_humans.filter((h) => h.member !== to[0] && h.domains.some((d) => domains.includes(d)));
+            if (others.length) {
+                const theirs = [...new Set(others.flatMap((h) => h.domains.filter((d) => domains.includes(d))))];
                 return { code: "WRONG_DECISION_OWNER",
-                    message: `${to[0]} is not the human-required owner for: ${domains.join(", ")}. Call pantheon_route_decision and route each domain to its published owner.` };
+                    message: `${to[0]} is not the human-required owner for: ${theirs.join(", ")} — ${others.map((h) => h.member).join(", ")} ${others.length === 1 ? "is" : "are"}. Call pantheon_route_decision and route each domain to its published owner.` };
+            }
+            const owner = route.required_humans.find((x) => x.member === to[0]);
+            const uncovered = domains.filter((d) => !owner?.domains.includes(d));
+            if (uncovered.length && meta) {
+                meta["authority"] = target ? "partly_unverified" : "unverified";
+                meta["unverified_domains"] = uncovered;
             }
             const openDup = [...sp.obligations.values()].find((o) => {
                 if (o.kind !== "HUMAN" || o.owner !== `human:${to[0]}` || (o.goal ?? null) !== (goalId ?? null))
@@ -1197,9 +1863,19 @@ pantheon signup --email you@work.com --username you</code></pre>
                 return { code: "ALREADY_RETRACTED", message: "a retraction cannot itself be retracted — send a new act saying what is true" };
             }
         }
+        if (repo && sp.allow.repoCount() > 0 && !sp.allow.hasRepo(repo)) {
+            return { code: "REPO_MISMATCH", message: `this act was composed in a repo that "${sp.name}" does not work from. Open your agent in the team's repo, or register this one: pantheon repo add` };
+        }
         if (act === "DELIVERED") {
             const branch = typeof meta?.["branch"] === "string" ? meta["branch"] : "";
             const commit = typeof meta?.["commit"] === "string" ? meta["commit"] : "";
+            if (sp.allow.repoCount() > 0) {
+                const r = typeof meta?.["repo"] === "string" ? meta["repo"] : repo ?? "";
+                if (!r)
+                    return { code: "REPO_REQUIRED", message: "DELIVERED must say which of the team's repos the commit is in (meta.repo). Send it from a session open in that repo — if this session already is, the checkout is not one the team knows yet: from it, run `pantheon use <team> --here`." };
+                if (!sp.allow.hasRepo(r))
+                    return { code: "REPO_MISMATCH", message: `the commit is in a repo "${sp.name}" does not work from; a peer could not fetch it. Register the repo first: pantheon repo add` };
+            }
             if (!branch || !commit) {
                 return {
                     code: "UNVERIFIABLE_DELIVERY",
@@ -1247,11 +1923,16 @@ pantheon signup --email you@work.com --username you</code></pre>
         return null;
     }
     commit(sp, partial) {
+        if (sp.deleted)
+            return { ...partial, id: newId("a"), seq: sp.ledger.head, ts: Date.now(), space: sp.name };
         const rec = sp.ledger.append({ ...partial, id: newId("a"), ts: Date.now(), space: sp.name });
         sp.lastTouch = rec.ts;
         const m = sp.members.get(rec.from);
-        if (m)
+        if (m) {
             m.stamps.push(rec.ts);
+            if (rec.act !== "JOIN" && rec.act !== "LEAVE" && (m.seen_seq ?? 0) < rec.seq - 1)
+                m.seen_seq = rec.seq - 1;
+        }
         if (rec.goal) {
             const goal = sp.goals.get(rec.goal);
             if (goal) {
@@ -1259,6 +1940,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 const run = sp.lastActor.get(rec.goal);
                 sp.lastActor.set(rec.goal, run && run.member === rec.from ? { member: rec.from, run: run.run + 1 } : { member: rec.from, run: 1 });
                 this.applyObligations(sp, rec, goal);
+                this.broadcast(sp, { t: "goal", goal });
                 if (goal.acts >= goal.budget && goal.state === "OPEN") {
                     goal.state = "STALLED";
                     this.oblige(sp, { kind: "HUMAN", owner: `human:${goal.opened_by}`, ref: rec.id, goal: goal.id,
@@ -1548,6 +2230,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                 id: s.id, role: s.role, agent: s.agent, ...(s.pkg ? { pkg: s.pkg } : {}),
             })),
             ...(this.work(m) ? { work: this.work(m) } : {}),
+            ...(m.worker && Date.now() - m.worker.at < 15 * 60_000 ? { worker: m.worker } : {}),
             delivered_seq: m.delivered_seq,
             ...(m.seen_seq !== undefined ? { seen_seq: m.seen_seq } : {}),
         }));