@join-pantheon/cli 0.28.0 → 0.29.0

package/dist/relay.js

@@ -1,6 +1,6 @@
 import { createServer } from "node:http";
 import { createHash, randomBytes, timingSafeEqual as timingSafeEqualBuf } from "node:crypto";
-import { rmSync, readdirSync, readFileSync, statSync, existsSync } from "node:fs";
+import { rmSync, readdirSync, readFileSync, statSync, existsSync, writeFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { WebSocketServer } from "ws";
@@ -72,8 +72,25 @@ export function isTrustedSource(ip) {
         return true;
     return false;
 }
-function fingerprint_(from, act, body, goal, ref) {
-    return createHash("sha256").update([from, act, goal ?? "", ref ?? "", body].join("\u0000")).digest("hex").slice(0, 32);
+function fingerprint_(from, act, body, goal, ref, extra = null) {
+    return createHash("sha256").update([from, act, goal ?? "", ref ?? "", body, stableJson(extra)].join("\u0000")).digest("hex").slice(0, 32);
+}
+function stableJson(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v ?? null);
+    if (Array.isArray(v))
+        return `[${v.map(stableJson).join(",")}]`;
+    return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${stableJson(v[k])}`).join(",")}}`;
+}
+function clientIp(req) {
+    const raw = req.headers["x-forwarded-for"];
+    const hops = (Array.isArray(raw) ? raw.join(",") : raw ?? "").split(",").map((x) => x.trim()).filter(Boolean);
+    const trusted = Math.max(1, Number(process.env.PANTHEON_TRUSTED_HOPS ?? 1) || 1);
+    return hops.length ? hops[Math.max(0, hops.length - trusted)] : req.socket.remoteAddress || "unknown";
+}
+function secretEq(a, b) {
+    const x = createHash("sha256").update(a).digest(), y = createHash("sha256").update(b).digest();
+    return timingSafeEqualBuf(x, y);
 }
 const ADMIN_CSS = `<style>
   :root{--bg:#0b0c0e;--card:#14161a;--card2:#1b1e24;--line:#262a30;--fg:#e7e9ec;--dim:#9aa1a9;--accent:#5b9dff;--warn:#e8b45c;--bad:#ef8b80;--ok:#7bd39a;color-scheme:dark}
@@ -137,6 +154,9 @@ const fmtAgo = (t) => {
     const m = Math.round((Date.now() - t) / 60_000);
     return m < 1 ? "just now" : m < 60 ? `${m}m ago` : m < 1440 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`;
 };
+const safeName = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
+const LIMITS_GOAL_READ = 1000;
+const LIMITS_SPACE = { metaBytes: 8192, openGoals: 500, repos: 100, openInvites: 50 };
 export class Relay {
     opts;
     spaces = new Map();
@@ -197,8 +217,7 @@ export class Relay {
         this.busyTtlMs = opts.activityBusyTtlMs ?? LIMITS.activityBusyTtlMs;
         this.pruneMs = opts.activityPruneMs ?? LIMITS.activityPruneMs;
         this.http.on("upgrade", (req, socket, head) => {
-            const fwd = req.headers["x-forwarded-for"]?.split(",")[0]?.trim();
-            const ip = fwd || req.socket.remoteAddress || "unknown";
+            const ip = clientIp(req);
             this.wss.handleUpgrade(req, socket, head, (ws) => this.onSocket(ws, ip));
         });
     }
@@ -234,8 +253,7 @@ export class Relay {
     }
     onHttp(req, res) {
         const url = new URL(req.url ?? "/", "http://x");
-        const ip = (req.headers["x-forwarded-for"]?.split(",")[0]?.trim())
-            || req.socket.remoteAddress || "unknown";
+        const ip = clientIp(req);
         if (url.pathname === "/" || url.pathname.startsWith("/auth/") || url.pathname.startsWith("/account/")
             || url.pathname === "/audit" || url.pathname.startsWith("/admin")) {
             return this.onAuthHttp(req, res, url, ip);
@@ -264,6 +282,8 @@ export class Relay {
             });
         }
         if (url.pathname === "/join") {
+            if (!this.authRateOk(ip))
+                return this.json(res, 429, { error: "too many lookups from your network — wait a minute" });
             const token = (url.searchParams.get("token") ?? "").trim();
             if (!/^[A-Za-z0-9_-]{16,64}$/.test(token))
                 return this.json(res, 400, { error: "an invite code is required: /join?token=<code>" });
@@ -273,9 +293,9 @@ export class Relay {
                 : this.json(res, 404, { error: "no open invite matches that code — it may have been used already or expired" });
         }
         if (url.pathname === "/act") {
-            const space = this.spaces.get(url.searchParams.get("space") ?? "");
+            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
             const token = url.searchParams.get("token") ?? "";
-            if (!space || space.token !== token)
+            if (!space || !secretEq(space.token, token))
                 return this.json(res, 404, { error: "no such space" });
             const act = space.ledger.find(url.searchParams.get("id") ?? "");
             if (!act)
@@ -284,19 +304,20 @@ export class Relay {
             return this.json(res, 200, { act, ...(goal ? { goal: { id: goal.id, title: goal.title, state: goal.state } } : {}) });
         }
         if (url.pathname === "/history") {
-            const space = this.spaces.get(url.searchParams.get("space") ?? "");
+            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
             const token = url.searchParams.get("token") ?? "";
-            if (!space || space.token !== token)
+            if (!space || !secretEq(space.token, token))
                 return this.json(res, 404, { error: "no such space" });
             const goal = url.searchParams.get("goal");
-            const since = Number(url.searchParams.get("since") ?? 0);
-            const acts = goal ? space.ledger.byGoal(goal) : since > 0 ? space.ledger.since(since) : space.ledger.latest();
+            const sinceRaw = url.searchParams.get("since");
+            const acts = goal ? space.ledger.byGoal(goal, LIMITS_GOAL_READ)
+                : sinceRaw !== null ? space.ledger.since(Number(sinceRaw) || 0) : space.ledger.latest();
             return this.json(res, 200, { acts, head: space.ledger.head });
         }
         if (url.pathname === "/obligations") {
-            const space = this.spaces.get(url.searchParams.get("space") ?? "");
+            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
             const token = url.searchParams.get("token") ?? "";
-            if (!space || space.token !== token)
+            if (!space || !secretEq(space.token, token))
                 return this.json(res, 404, { error: "no such space" });
             const member = url.searchParams.get("member");
             const now = Date.now();
@@ -312,9 +333,9 @@ export class Relay {
         if (url.pathname === "/activity") {
             if (req.method !== "POST")
                 return this.json(res, 405, { error: "POST only" });
-            const space = this.spaces.get(url.searchParams.get("space") ?? "");
+            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
             const token = url.searchParams.get("token") ?? "";
-            if (!space || space.token !== token)
+            if (!space || !secretEq(space.token, token))
                 return this.json(res, 404, { error: "no such space" });
             const memberId = url.searchParams.get("member") ?? "";
             const member = space.members.get(memberId);
@@ -461,9 +482,10 @@ export class Relay {
                     if (started.reason === "blocked")
                         return this.json(res, 403, { error: "this email cannot sign up on this relay", reason: "blocked" });
                     const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute to resend"
-                        : started.reason === "username_taken" ? "that username is taken"
-                            : started.reason === "email_taken" ? "that email already has an account — use `pantheon login` from this machine instead"
-                                : "check the email and username";
+                        : started.reason === "in_progress_elsewhere" ? "a code for this email is already on its way to another device — use that one, or wait 10 minutes for it to expire"
+                            : started.reason === "username_taken" ? "that username is taken"
+                                : started.reason === "email_taken" ? "that email already has an account — use `pantheon login` from this machine instead"
+                                    : "check the email and username";
                     return this.json(res, 409, { error: msg, reason: started.reason });
                 }
                 A.audit({ event: "signup", target: normalizeUsername(b.username), ip });
@@ -485,8 +507,8 @@ export class Relay {
                 if (!started.ok && started.reason === "blocked")
                     return this.json(res, 403, { error: "this email cannot sign in on this relay", reason: "blocked" });
                 if (!started.ok) {
-                    const code = started.reason === "too_soon" ? 429 : 404;
-                    const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute" : "no active account for that email — `pantheon signup` first";
+                    const code = started.reason === "too_soon" || started.reason === "in_progress_elsewhere" ? 429 : 404;
+                    const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute" : started.reason === "in_progress_elsewhere" ? "a code for this email is already on its way to another device — use that one, or wait 10 minutes for it to expire" : "no active account for that email — `pantheon signup` first";
                     return this.json(res, code, { error: msg, reason: started.reason });
                 }
                 if (!this.emailBudgetOk())
@@ -503,12 +525,14 @@ export class Relay {
             return this.readJson(req, (b) => {
                 if (!b || typeof b.email !== "string" || typeof b.code !== "string")
                     return this.json(res, 400, { error: "email and code are required" });
-                const r = A.verify(b.email, b.code.trim(), ip);
+                const r = A.verify(b.email, b.code.trim(), ip, typeof b.pubkey === "string" ? b.pubkey : undefined);
                 if (!r.ok) {
                     const msg = r.reason === "expired" ? "that code has expired — request a new one"
-                        : r.reason === "too_many_attempts" ? "too many wrong tries — request a new code"
-                            : r.reason === "no_pending" ? "no code is pending for that email — run signup or login first"
-                                : "that code is not right";
+                        : r.reason === "other_device" ? "that code was requested from a different device — request a new one from this one"
+                            : r.reason === "suspended" ? "this account is suspended — contact the relay operator"
+                                : r.reason === "too_many_attempts" ? "too many wrong tries — request a new code"
+                                    : r.reason === "no_pending" ? "no code is pending for that email — run signup or login first"
+                                        : "that code is not right";
                     return this.json(res, 400, { error: msg, reason: r.reason });
                 }
                 return this.json(res, 200, { ok: true, account: { id: r.account.id, username: r.account.username, email: r.account.email }, session: r.session.id, device: r.device.id });
@@ -900,6 +924,11 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         }
         setTimeout(() => this.deleteSpaceFiles(name), 600).unref?.();
         const safe = name.replace(/[^a-z0-9._-]/gi, "_");
+        try {
+            const hash = sp?.allow ? JSON.parse(readFileSync(join(this.dataDir, `${safe}.members.json`), "utf8")).tokenHash ?? null : null;
+            writeFileSync(join(this.dataDir, `${safe}.deleted.json`), JSON.stringify({ name, at: Date.now(), tokenHash: hash }));
+        }
+        catch { }
         const existed = !!sp || [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
         this.deleteSpaceFiles(name);
         this.deletedSpaces.set(name, Date.now());
@@ -1033,6 +1062,42 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
             default: return this.json(res, 400, { error: `unknown action "${act}"` });
         }
     }
+    spaceForRead(name, token) {
+        const live = this.spaces.get(name);
+        if (live)
+            return secretEq(live.token, token) ? live : null;
+        if (!name || !token || !this.spaceOnDisk(name))
+            return null;
+        if (new Allowlist(this.dataDir, safeName(name)).tokenMatches(token) !== true)
+            return null;
+        return this.getOrCreateSpace(name, token);
+    }
+    tombstone(name, _token) {
+        try {
+            return JSON.parse(readFileSync(join(this.dataDir, `${safeName(name)}.deleted.json`), "utf8")).at;
+        }
+        catch {
+            return null;
+        }
+    }
+    tombstoneMatches(name, token) {
+        try {
+            const t = JSON.parse(readFileSync(join(this.dataDir, `${safeName(name)}.deleted.json`), "utf8"));
+            return !!t.tokenHash && !!token && createHash("sha256").update(token).digest("hex") === t.tokenHash;
+        }
+        catch {
+            return false;
+        }
+    }
+    nameCollides(name) {
+        const stem = safeName(name).toLowerCase();
+        try {
+            return readdirSync(this.dataDir).some((f) => f.endsWith(".members.json") && f.slice(0, -".members.json".length).toLowerCase() === stem);
+        }
+        catch {
+            return false;
+        }
+    }
     spaceOnDisk(name) {
         return existsSync(join(this.dataDir, `${name.replace(/[^a-z0-9._-]/gi, "_")}.members.json`));
     }
@@ -1549,7 +1614,7 @@ pantheon signup --email you@work.com --username you</code></pre>
         const fail = (code, message, cid) => {
             if (cid && space && me && !space.deleted) {
                 noteRefusal(space.store.refusals, { ts: Date.now(), member: me.id, act: lastMsg || "?", code });
-                space.store.save(space.goals, space.obligations, space.profiles);
+                space.store.flush(space.goals, space.obligations, space.profiles);
             }
             this.send(ws, { t: "error", code, message, ...(cid ? { cid } : {}) });
         };
@@ -1575,453 +1640,546 @@ pantheon signup --email you@work.com --username you</code></pre>
         ws.on("close", clearHelloTimer);
         this.send(ws, { t: "challenge", nonce, v: PROTOCOL_VERSION });
         ws.on("message", (raw) => {
-            let msg;
             try {
-                msg = JSON.parse(String(raw));
-            }
-            catch {
-                return fail("BAD_JSON", "message was not JSON");
-            }
-            const parsed = Inbound.safeParse(msg);
-            if (!parsed.success) {
-                const cid = typeof msg?.cid === "string"
-                    ? msg.cid : undefined;
-                return fail("BAD_MESSAGE", parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "), cid);
-            }
-            const m = parsed.data;
-            lastMsg = m.t === "act" ? m.act : m.t;
-            touch();
-            if (m.t === "ping")
-                return this.send(ws, { t: "pong" });
-            if (m.t === "hello") {
-                if (space)
-                    return reject("ALREADY_JOINED", "this socket already said hello");
-                if (m.nonce !== nonce)
-                    return reject("BAD_NONCE", "challenge mismatch — reconnect");
-                if (!m.token && !m.enroll)
-                    return reject("NO_CREDENTIAL", "present either a space token or an invite");
-                if (!verifyChallenge(m.pubkey, m.space, m.member, m.nonce, m.sig)) {
-                    return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
+                let msg;
+                try {
+                    msg = JSON.parse(String(raw));
                 }
-                const gated = this.requireAccounts && !!this.accounts && !this.localTrusted(ip);
-                const pre = gated ? this.accounts.authorize(m.pubkey, m.member) : null;
-                let sp;
-                if (m.enroll) {
-                    sp = this.spaces.get(m.space) ?? null;
-                    if (!sp)
-                        return reject("NO_SUCH_SPACE", `no space "${m.space}" on this relay`);
+                catch {
+                    return fail("BAD_JSON", "message was not JSON");
                 }
-                else {
-                    const tomb = this.deletedSpaces.get(m.space);
-                    if (tomb && Date.now() - tomb < 3_600_000) {
-                        return reject("SPACE_DELETED", `the space "${m.space}" was removed by the relay operator. Start a new one with a different name, or contact them.`);
+                const parsed = Inbound.safeParse(msg);
+                if (!parsed.success) {
+                    const cid = typeof msg?.cid === "string"
+                        ? msg.cid : undefined;
+                    return fail("BAD_MESSAGE", parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "), cid);
+                }
+                const m = parsed.data;
+                lastMsg = m.t === "act" ? m.act : m.t;
+                touch();
+                if (m.t === "ping")
+                    return this.send(ws, { t: "pong" });
+                if (m.t === "hello") {
+                    if (space)
+                        return reject("ALREADY_JOINED", "this socket already said hello");
+                    if (m.nonce !== nonce)
+                        return reject("BAD_NONCE", "challenge mismatch — reconnect");
+                    if (!m.token && !m.enroll)
+                        return reject("NO_CREDENTIAL", "present either a space token or an invite");
+                    if (!verifyChallenge(m.pubkey, m.space, m.member, m.nonce, m.sig)) {
+                        return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
                     }
-                    const isNew = !this.spaces.has(m.space) && !this.spaceOnDisk(m.space);
-                    if (!this.spaces.has(m.space)) {
-                        const denied = this.mayCreateSpace(ip);
-                        if (denied)
-                            return reject(denied.code, denied.message);
+                    const gated = this.requireAccounts && !!this.accounts && !this.localTrusted(ip);
+                    const pre = gated ? this.accounts.authorize(m.pubkey, m.member) : null;
+                    let sp;
+                    if (m.enroll) {
+                        sp = this.spaces.get(m.space) ?? null;
+                        if (!sp && this.spaceOnDisk(m.space)) {
+                            const inv = new Allowlist(this.dataDir, safeName(m.space)).findInvite(m.enroll);
+                            if (inv?.token === m.enroll && inv.space_token)
+                                sp = this.getOrCreateSpace(m.space, inv.space_token);
+                        }
+                        if (!sp)
+                            return reject("NO_SUCH_SPACE", `no space "${m.space}" on this relay`);
                     }
-                    if (isNew && gated && !pre?.ok) {
-                        this.log(`! REFUSED ${m.member}: cannot create "${m.space}" without a signed-in account (${pre?.ok === false ? pre.reason : "no account"})`);
-                        return reject("NOT_SIGNED_IN", "sign in first: run `pantheon signup` (new) or `pantheon login` (existing account) on this machine, then try again.");
+                    else {
+                        const tomb = this.deletedSpaces.get(m.space) ?? this.tombstone(m.space, m.token ?? "");
+                        if (tomb && Date.now() - tomb < 3_600_000 || (tomb && this.tombstoneMatches(m.space, m.token ?? ""))) {
+                            return reject("SPACE_DELETED", `the space "${m.space}" was removed by the relay operator. Start a new one with a different name, or contact them.`);
+                        }
+                        const isNew = !this.spaces.has(m.space) && !this.spaceOnDisk(m.space);
+                        if (isNew && this.nameCollides(m.space)) {
+                            return reject("NAME_TAKEN", `a team with a name too close to "${m.space}" already exists here — pick another name`);
+                        }
+                        if (!this.spaces.has(m.space)) {
+                            const denied = this.mayCreateSpace(ip);
+                            if (denied)
+                                return reject(denied.code, denied.message);
+                        }
+                        if (isNew && gated && !pre?.ok) {
+                            this.log(`! REFUSED ${m.member}: cannot create "${m.space}" without a signed-in account (${pre?.ok === false ? pre.reason : "no account"})`);
+                            return reject("NOT_SIGNED_IN", "sign in first: run `pantheon signup` (new) or `pantheon login` (existing account) on this machine, then try again.");
+                        }
+                        if (isNew && pre?.ok) {
+                            const lim = this.accounts.limitsFor(pre.account);
+                            const owned = this.accounts.spacesOwned(pre.account.id);
+                            if (owned.length >= lim.spaces) {
+                                const msg = `your ${pre.account.plan} plan allows ${fmtLimit(lim.spaces)} space${lim.spaces === 1 ? "" : "s"} you create${owned.length ? ` (you own ${owned.map((n) => `"${n}"`).join(", ")})` : ""}. Upgrade at https://www.joinpantheon.network, or free a slot: pantheon space delete <team> --yes`;
+                                this.accounts.audit({ event: "plan_limit", actor_account: pre.account.id, space: m.space, target: "create_space", detail: `${pre.account.plan}: ${owned.length}/${lim.spaces} spaces`, ip });
+                                this.log(`! PLAN_LIMIT ${m.member}: cannot create "${m.space}" (${owned.length}/${fmtLimit(lim.spaces)} spaces on ${pre.account.plan})`);
+                                return reject("PLAN_LIMIT", msg);
+                            }
+                        }
+                        sp = this.getOrCreateSpace(m.space, m.token);
+                        if (!sp)
+                            return reject("BAD_TOKEN", "wrong token for this space");
+                        if (isNew) {
+                            this.noteSpaceCreate(ip);
+                            this.accounts?.recordSpace(sp.name, pre?.ok ? pre.account.id : null);
+                        }
                     }
-                    if (isNew && pre?.ok) {
-                        const lim = this.accounts.limitsFor(pre.account);
-                        const owned = this.accounts.spacesOwned(pre.account.id);
-                        if (owned.length >= lim.spaces) {
-                            const msg = `your ${pre.account.plan} plan allows ${fmtLimit(lim.spaces)} space${lim.spaces === 1 ? "" : "s"} you create${owned.length ? ` (you own ${owned.map((n) => `"${n}"`).join(", ")})` : ""}. Upgrade at https://www.joinpantheon.network, or free a slot: pantheon space delete <team> --yes`;
-                            this.accounts.audit({ event: "plan_limit", actor_account: pre.account.id, space: m.space, target: "create_space", detail: `${pre.account.plan}: ${owned.length}/${lim.spaces} spaces`, ip });
-                            this.log(`! PLAN_LIMIT ${m.member}: cannot create "${m.space}" (${owned.length}/${fmtLimit(lim.spaces)} spaces on ${pre.account.plan})`);
-                            return reject("PLAN_LIMIT", msg);
+                    let acctSession = null;
+                    if (this.requireAccounts && this.accounts && !this.localTrusted(ip)) {
+                        const auth = this.accounts.authorize(m.pubkey, m.member);
+                        if (!auth.ok) {
+                            const msg = auth.reason === "username_mismatch"
+                                ? `this device is signed in as a different username than "${m.member}". Use your own username, or \`pantheon login\` on this machine.`
+                                : auth.reason === "suspended"
+                                    ? `this account has been suspended by the relay operator. Contact them to have it reinstated.`
+                                    : `sign in first: run \`pantheon signup\` (new) or \`pantheon login\` (existing account) on this machine, then try again.`;
+                            this.log(`[${sp.name}] ! REFUSED ${m.member}: ${auth.reason}`);
+                            return reject("NOT_SIGNED_IN", msg);
                         }
+                        m.member = auth.account.username;
+                        acct = auth.account;
+                        acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip, m.role ?? "interactive").id;
+                        dbSession = acctSession;
+                        lastTouch = Date.now();
                     }
-                    sp = this.getOrCreateSpace(m.space, m.token);
-                    if (!sp)
-                        return reject("BAD_TOKEN", "wrong token for this space");
-                    if (isNew) {
-                        this.noteSpaceCreate(ip);
-                        this.accounts?.recordSpace(sp.name, pre?.ok ? pre.account.id : null);
+                    let enrolled = null;
+                    if (m.enroll) {
+                        const plan = this.spacePlan(sp.name);
+                        if (plan && !sp.allow.get(m.member)?.admitted && sp.allow.admittedCount() >= plan.limits.members) {
+                            this.accounts?.audit({ event: "plan_limit", actor_account: acct?.id ?? null, space: sp.name, target: "join", detail: `${plan.name}: ${sp.allow.admittedCount()}/${plan.limits.members} people`, ip });
+                            return reject("PLAN_LIMIT", `"${sp.name}" is full: its owner's ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. Ask ${plan.owner.username} to upgrade at https://www.joinpantheon.network`);
+                        }
+                        const r = sp.allow.redeem(m.enroll, m.member, m.pubkey);
+                        if (!r.ok) {
+                            this.log(`[${sp.name}] ! invite refused for ${m.member}: ${r.why}`);
+                            return reject("BAD_INVITE", r.fix ? `${r.why}\n${r.fix}` : r.why);
+                        }
+                        enrolled = sp.token;
+                        this.log(`[${sp.name}] * ENROLLED ${m.member} via invite from ${r.entry.admitted_by}${r.entry.may_wake ? " (may wake)" : ""}`);
                     }
-                }
-                let acctSession = null;
-                if (this.requireAccounts && this.accounts && !this.localTrusted(ip)) {
-                    const auth = this.accounts.authorize(m.pubkey, m.member);
-                    if (!auth.ok) {
-                        const msg = auth.reason === "username_mismatch"
-                            ? `this device is signed in as a different username than "${m.member}". Use your own username, or \`pantheon login\` on this machine.`
-                            : auth.reason === "suspended"
-                                ? `this account has been suspended by the relay operator. Contact them to have it reinstated.`
-                                : `sign in first: run \`pantheon signup\` (new) or \`pantheon login\` (existing account) on this machine, then try again.`;
-                        this.log(`[${sp.name}] ! REFUSED ${m.member}: ${auth.reason}`);
-                        return reject("NOT_SIGNED_IN", msg);
+                    const verdict = enrolled ? "ok" : sp.allow.present(m.member, m.pubkey);
+                    if (verdict === "key-mismatch") {
+                        this.log(`[${sp.name}] ! REFUSED ${m.member}: key mismatch (${fingerprint(m.pubkey)})`);
+                        return reject("KEY_MISMATCH", `"${m.member}" is already registered here with a different key — another machine, or this one before its key was replaced. If this is really you, an admitted member runs  pantheon admit ${m.member} --forget  and sends you a new invite.`);
                     }
-                    m.member = auth.account.username;
-                    acct = auth.account;
-                    acctSession = this.accounts.openSession(auth.account.id, auth.device.id, sp.name, ip, m.role ?? "interactive").id;
-                    dbSession = acctSession;
-                    lastTouch = Date.now();
-                }
-                let enrolled = null;
-                if (m.enroll) {
-                    const plan = this.spacePlan(sp.name);
-                    if (plan && !sp.allow.get(m.member)?.admitted && sp.allow.admittedCount() >= plan.limits.members) {
-                        this.accounts?.audit({ event: "plan_limit", actor_account: acct?.id ?? null, space: sp.name, target: "join", detail: `${plan.name}: ${sp.allow.admittedCount()}/${plan.limits.members} people`, ip });
-                        return reject("PLAN_LIMIT", `"${sp.name}" is full: its owner's ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. Ask ${plan.owner.username} to upgrade at https://www.joinpantheon.network`);
+                    if (verdict === "revoked") {
+                        const e = sp.allow.get(m.member);
+                        this.log(`[${sp.name}] ! REFUSED ${m.member}: removed${e?.revoked_by ? ` by ${e.revoked_by}` : ""}`);
+                        return reject("REVOKED", `"${m.member}" was removed from "${sp.name}"${e?.revoked_by ? ` by ${e.revoked_by}` : ""}. Only a member of the team can let you back in (pantheon admit ${m.member}); until then this machine cannot read or send in it.`);
                     }
-                    const r = sp.allow.redeem(m.enroll, m.member, m.pubkey);
-                    if (!r.ok) {
-                        this.log(`[${sp.name}] ! invite refused for ${m.member}: ${r.why}`);
-                        return reject("BAD_INVITE", r.fix ? `${r.why}\n${r.fix}` : r.why);
+                    if (verdict === "new" || verdict === "pending") {
+                        this.log(`[${sp.name}] ? PENDING ${m.member} ${fingerprint(m.pubkey)}`);
+                        this.send(ws, {
+                            t: "pending", member: m.member, fingerprint: fingerprint(m.pubkey),
+                            message: `Not admitted yet. Ask an existing member to run:  pantheon admit ${m.member}\nHave them check this fingerprint over a channel you both trust: ${fingerprint(m.pubkey)}`,
+                        });
+                        setTimeout(() => { try {
+                            ws.close(1008, "PENDING");
+                        }
+                        catch { } }, 20);
+                        return;
+                    }
+                    let newRepo = null;
+                    if (m.repo) {
+                        if (sp.allow.hasRepo(m.repo)) { }
+                        else if (sp.allow.repoCount() === 0 || enrolled || verdict === "founder")
+                            newRepo = m.repo;
+                        else {
+                            const known = sp.allow.repoList().map((r) => r.origin ?? r.fingerprint).join(", ");
+                            this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${m.repo_origin ?? m.repo} not bound to this space`);
+                            return reject("REPO_MISMATCH", `this checkout (${m.repo_origin ?? "no origin"}) is not one of the repos "${sp.name}" works from (${known || "none yet"}). ` +
+                                `Open your agent in the team's repo, or if this repo really belongs to the team: pantheon repo add`);
+                        }
+                    }
+                    space = sp;
+                    clearHelloTimer();
+                    sessionId = acctSession ?? this.mintSession();
+                    role = m.role;
+                    me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, m.role, ws, m.pkg);
+                    const firstSession = me.sessions.size === 1;
+                    const prior = typeof m.session === "string" ? m.session : "";
+                    const stale = prior && prior !== sessionId ? me.sessions.get(prior) : undefined;
+                    if (stale && stale.role === m.role) {
+                        me.sessions.delete(prior);
+                        try {
+                            stale.ws.terminate();
+                        }
+                        catch { }
+                    }
+                    if (prior && prior !== sessionId && !me.sessions.has(prior)) {
+                        let moved = 0;
+                        for (const o of sp.obligations.values()) {
+                            if (o.claimed_by?.session === prior && o.owner === me.id && o.claimed_by.role === m.role) {
+                                o.claimed_by = { ...o.claimed_by, session: sessionId, at: Date.now() };
+                                moved++;
+                            }
+                        }
+                        for (const v of sp.contLocks.values())
+                            if (v.session === prior && v.member === me.id) {
+                                v.session = sessionId;
+                                v.at = Date.now();
+                            }
+                        if (moved)
+                            this.pushObligations(sp);
+                    }
+                    sp.lastTouch = Date.now();
+                    if (newRepo && sp.allow.addRepo(newRepo, m.repo_origin ?? null, me.id)) {
+                        this.log(`[${sp.name}] + repo ${m.repo_origin ?? newRepo} registered by ${me.id}`);
+                        this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.repo_origin ?? newRepo}`, meta: { repo: newRepo, repo_origin: m.repo_origin ?? null } });
+                        this.broadcast(sp, { t: "repos", repos: sp.allow.repoList() });
                     }
-                    enrolled = sp.token;
-                    this.log(`[${sp.name}] * ENROLLED ${m.member} via invite from ${r.entry.admitted_by}${r.entry.may_wake ? " (may wake)" : ""}`);
-                }
-                const verdict = enrolled ? "ok" : sp.allow.present(m.member, m.pubkey);
-                if (verdict === "key-mismatch") {
-                    this.log(`[${sp.name}] ! REFUSED ${m.member}: key mismatch (${fingerprint(m.pubkey)})`);
-                    return reject("KEY_MISMATCH", `"${m.member}" is already registered with a different key. If this is really you, an admitted member must revoke and re-admit you.`);
-                }
-                if (verdict === "new" || verdict === "pending") {
-                    this.log(`[${sp.name}] ? PENDING ${m.member} ${fingerprint(m.pubkey)}`);
                     this.send(ws, {
-                        t: "pending", member: m.member, fingerprint: fingerprint(m.pubkey),
-                        message: `Not admitted yet. Ask an existing member to run:  pantheon admit ${m.member}\nHave them check this fingerprint over a channel you both trust: ${fingerprint(m.pubkey)}`,
+                        t: "welcome", member: me.id, session: sessionId, space: sp.name, seq: sp.ledger.head,
+                        roster: this.roster(sp), goals: [...sp.goals.values()],
+                        obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
+                        space_id: sp.allow.spaceId(), repos: sp.allow.repoList(),
+                        ...(acct ? { plan: this.planView(acct, sp) } : {}),
+                        ...(enrolled ? { token: enrolled } : {}),
                     });
-                    setTimeout(() => { try {
-                        ws.close(1008, "PENDING");
+                    let from = m.from_seq && m.from_seq > 0 ? m.from_seq : sp.ledger.head;
+                    for (let page = sp.ledger.since(from); page.length; page = sp.ledger.since(from)) {
+                        for (const r of page) {
+                            this.send(ws, { t: "act", act: r });
+                            if (r.seq > me.delivered_seq)
+                                me.delivered_seq = r.seq;
+                        }
+                        from = page[page.length - 1].seq;
                     }
-                    catch { } }, 20);
+                    if (firstSession && m.role !== "cli") {
+                        this.commit(sp, { from: me.id, act: "JOIN", body: `${me.display} online (${me.agent})`, to: null, goal: null, ref: null });
+                    }
+                    this.broadcast(sp, { t: "roster", roster: this.roster(sp) });
+                    this.log(`[${sp.name}] + ${me.id}/${sessionId} (${m.role}, ${me.agent})${verdict === "founder" ? " [founder, auto-admitted]" : ""}`);
                     return;
                 }
-                let newRepo = null;
-                if (m.repo) {
-                    if (sp.allow.hasRepo(m.repo)) { }
-                    else if (sp.allow.repoCount() === 0 || enrolled || verdict === "founder")
-                        newRepo = m.repo;
-                    else {
-                        const known = sp.allow.repoList().map((r) => r.origin ?? r.fingerprint).join(", ");
-                        this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${m.repo_origin ?? m.repo} not bound to this space`);
-                        return reject("REPO_MISMATCH", `this checkout (${m.repo_origin ?? "no origin"}) is not one of the repos "${sp.name}" works from (${known || "none yet"}). ` +
-                            `Open your agent in the team's repo, or if this repo really belongs to the team: pantheon repo add`);
+                if (!space || !me)
+                    return reject("NOT_JOINED", "say hello first");
+                if (m.t === "publish_profile") {
+                    if (m.profile.member !== me.id) {
+                        return fail("PROFILE_NOT_YOURS", `you may publish only the profile for ${me.id}`, m.cid);
                     }
+                    if (!this.writeOk(me))
+                        return fail("RATE_LIMIT", "too many changes too fast — wait a few seconds", m.cid);
+                    const wild = Object.keys(m.profile.authority ?? {}).filter((k) => /[*?]/.test(k) || k.trim() === "");
+                    if (wild.length)
+                        return fail("BAD_AUTHORITY", `authority is claimed per named domain, not with "${wild[0]}"`, m.cid);
+                    const current = space.profiles.get(me.id);
+                    if (!current || m.profile.updated_at > current.updated_at) {
+                        space.profiles.set(me.id, m.profile);
+                        space.store.flush(space.goals, space.obligations, space.profiles);
+                        this.broadcast(space, { t: "profiles", profiles: [...space.profiles.values()] });
+                        this.commit(space, {
+                            from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null,
+                            body: `organization profile updated: ${m.profile.display_name} — ${m.profile.title || "no title"}; human authority: ${Object.entries(m.profile.authority).filter(([, v]) => v === "human_required").map(([k]) => k).join(", ") || "none"}`,
+                            meta: { organization_profile: m.profile },
+                        });
+                    }
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: me.id, seq: space.ledger.head });
+                    return;
                 }
-                space = sp;
-                clearHelloTimer();
-                sessionId = acctSession ?? this.mintSession();
-                role = m.role;
-                me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, m.role, ws, m.pkg);
-                const firstSession = me.sessions.size === 1;
-                sp.lastTouch = Date.now();
-                if (newRepo && sp.allow.addRepo(newRepo, m.repo_origin ?? null, me.id)) {
-                    this.log(`[${sp.name}] + repo ${m.repo_origin ?? newRepo} registered by ${me.id}`);
-                    this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.repo_origin ?? newRepo}`, meta: { repo: newRepo, repo_origin: m.repo_origin ?? null } });
-                    this.broadcast(sp, { t: "repos", repos: sp.allow.repoList() });
-                }
-                this.send(ws, {
-                    t: "welcome", member: me.id, session: sessionId, space: sp.name, seq: sp.ledger.head,
-                    roster: this.roster(sp), goals: [...sp.goals.values()],
-                    obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
-                    space_id: sp.allow.spaceId(), repos: sp.allow.repoList(),
-                    ...(acct ? { plan: this.planView(acct, sp) } : {}),
-                    ...(enrolled ? { token: enrolled } : {}),
-                });
-                for (const r of sp.ledger.since(m.from_seq ?? sp.ledger.head)) {
-                    this.send(ws, { t: "act", act: r });
-                    if (r.seq > me.delivered_seq)
-                        me.delivered_seq = r.seq;
-                }
-                if (firstSession && m.role !== "cli") {
-                    this.commit(sp, { from: me.id, act: "JOIN", body: `${me.display} online (${me.agent})`, to: null, goal: null, ref: null });
+                if (m.t === "admit") {
+                    const self = space.allow.get(me.id);
+                    if (!self?.admitted)
+                        return fail("NOT_ADMITTED", "only an admitted member can vouch for another", m.cid);
+                    if (m.member === me.id)
+                        return fail("NO_SELF_ADMIT", "you cannot admit yourself", m.cid);
+                    const target = space.allow.get(m.member);
+                    if (!target)
+                        return fail("NO_SUCH_MEMBER", `"${m.member}" has never connected, so there is no key to admit`, m.cid);
+                    if (!m.revoke && !m.forget) {
+                        const plan = this.spacePlan(space.name);
+                        if (plan && m.may_wake && !plan.limits.wake)
+                            return this.planRefusal(space, plan, "admit", `the ${plan.name} plan does not include unattended workers — admit without --may-wake`, m.cid, fail, acct?.id ?? null, ip);
+                        if (plan && !target.admitted && space.allow.admittedCount() >= plan.limits.members)
+                            return this.planRefusal(space, plan, "admit", `"${space.name}" is full for the ${plan.name} plan (${fmtLimit(plan.limits.members)} people). Upgrade at https://www.joinpantheon.network to admit more.`, m.cid, fail, acct?.id ?? null, ip);
+                    }
+                    if (m.revoke || m.forget) {
+                        const founder = space.allow.founder();
+                        if (founder && me.id !== founder)
+                            return fail("FOUNDER_ONLY", `only ${founder}, who founded "${space.name}", can remove a member`, m.cid);
+                        if (m.member === founder)
+                            return fail("FOUNDER_STAYS", "the founder cannot be removed from their own team", m.cid);
+                        if (m.forget)
+                            space.allow.forget(m.member);
+                        else
+                            space.allow.revoke(m.member, me.id);
+                        if (space.profiles.delete(m.member))
+                            this.broadcast(space, { t: "profiles", profiles: [...space.profiles.values()] });
+                        for (const s of space.members.get(m.member)?.sessions.values() ?? []) {
+                            try {
+                                s.ws.close(1008, "REVOKED");
+                            }
+                            catch { }
+                        }
+                        space.members.delete(m.member);
+                        this.log(`[${space.name}] - ${m.forget ? "FORGOT" : "REVOKED"} ${m.member} by ${me.id}`);
+                    }
+                    else {
+                        space.allow.admit(m.member, me.id, m.may_wake);
+                        this.log(`[${space.name}] * ADMITTED ${m.member} by ${me.id}${m.may_wake ? " (may wake workers)" : ""}`);
+                    }
+                    this.broadcast(space, { t: "members", members: this.members(space) });
+                    this.broadcast(space, { t: "roster", roster: this.roster(space) });
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: m.member, seq: space.ledger.head });
+                    return;
                 }
-                this.broadcast(sp, { t: "roster", roster: this.roster(sp) });
-                this.log(`[${sp.name}] + ${me.id}/${sessionId} (${m.role}, ${me.agent})${verdict === "founder" ? " [founder, auto-admitted]" : ""}`);
-                return;
-            }
-            if (!space || !me)
-                return reject("NOT_JOINED", "say hello first");
-            if (m.t === "publish_profile") {
-                if (m.profile.member !== me.id) {
-                    return fail("PROFILE_NOT_YOURS", `you may publish only the profile for ${me.id}`, m.cid);
+                if (m.t === "worker_state") {
+                    if (role !== "worker")
+                        return;
+                    me.worker = { state: m.state, ...(m.detail ? { detail: m.detail } : {}), ...(m.until ? { until: m.until } : {}), at: Date.now() };
+                    this.broadcast(space, { t: "roster", roster: this.roster(space) });
+                    return;
                 }
-                const current = space.profiles.get(me.id);
-                if (!current || m.profile.updated_at > current.updated_at) {
-                    space.profiles.set(me.id, m.profile);
-                    space.store.save(space.goals, space.obligations, space.profiles);
-                    this.broadcast(space, { t: "profiles", profiles: [...space.profiles.values()] });
-                    this.commit(space, {
-                        from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null,
-                        body: `organization profile updated: ${m.profile.display_name} — ${m.profile.title || "no title"}; human authority: ${Object.entries(m.profile.authority).filter(([, v]) => v === "human_required").map(([k]) => k).join(", ") || "none"}`,
-                        meta: { organization_profile: m.profile },
-                    });
+                if (m.t === "delete_space") {
+                    if (m.confirm !== space.name)
+                        return fail("CONFIRM_MISMATCH", `type the space name ("${space.name}") to confirm`, m.cid);
+                    const owner = this.accounts?.spaceOwner(space.name) ?? null;
+                    const isOwner = owner ? owner.id === acct?.id : space.allow.founder() === me.id;
+                    if (!isOwner)
+                        return fail("NOT_OWNER", `only the founder of "${space.name}" can delete it${owner ? ` (that is ${owner.username})` : ""}`, m.cid);
+                    const name = space.name;
+                    this.accounts?.audit({ event: "space_deleted", actor_account: acct?.id ?? null, space: name, detail: `by its founder ${me.id}`, ip });
+                    this.log(`[${name}] * DELETED by its founder ${me.id}`);
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: name, seq: space.ledger.head });
+                    setTimeout(() => { this.deleteSpace(name); this.accounts?.markSpaceDeleted(name); }, 50).unref?.();
+                    return;
                 }
-                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: me.id, seq: space.ledger.head });
-                return;
-            }
-            if (m.t === "admit") {
-                const self = space.allow.get(me.id);
-                if (!self?.admitted)
-                    return fail("NOT_ADMITTED", "only an admitted member can vouch for another", m.cid);
-                if (m.member === me.id)
-                    return fail("NO_SELF_ADMIT", "you cannot admit yourself", m.cid);
-                const target = space.allow.get(m.member);
-                if (!target)
-                    return fail("NO_SUCH_MEMBER", `"${m.member}" has never connected, so there is no key to admit`, m.cid);
-                if (!m.revoke && !m.forget) {
+                if (m.t === "invite") {
+                    const self = space.allow.get(me.id);
+                    if (!self?.admitted)
+                        return fail("NOT_ADMITTED", "only an admitted member can invite", m.cid);
                     const plan = this.spacePlan(space.name);
-                    if (plan && m.may_wake && !plan.limits.wake)
-                        return this.planRefusal(space, plan, "admit", `the ${plan.name} plan does not include unattended workers — admit without --may-wake`, m.cid, fail, acct?.id ?? null, ip);
-                    if (plan && !target.admitted && space.allow.admittedCount() >= plan.limits.members)
-                        return this.planRefusal(space, plan, "admit", `"${space.name}" is full for the ${plan.name} plan (${fmtLimit(plan.limits.members)} people). Upgrade at https://www.joinpantheon.network to admit more.`, m.cid, fail, acct?.id ?? null, ip);
-                }
-                if (m.revoke || m.forget) {
-                    if (m.forget)
-                        space.allow.forget(m.member);
-                    else
-                        space.allow.revoke(m.member);
-                    for (const s of space.members.get(m.member)?.sessions.values() ?? []) {
-                        try {
-                            s.ws.close(1008, "REVOKED");
+                    if (plan) {
+                        if (m.may_wake && !plan.limits.wake)
+                            return this.planRefusal(space, plan, "invite", `the ${plan.name} plan does not include unattended workers — invite without wake: pantheon invite --no-wake`, m.cid, fail, acct?.id ?? null, ip);
+                        const open = space.allow.openInvites().length;
+                        if (space.allow.admittedCount() + open >= plan.limits.members) {
+                            return this.planRefusal(space, plan, "invite", `"${space.name}" is full for the ${plan.name} plan: ${fmtLimit(plan.limits.members)} people${open ? `, counting ${open} unused invite${open === 1 ? "" : "s"}` : ""}.${open ? ` An unused invite holds a seat until it expires — free them: pantheon invite --revoke all.` : ""} Upgrade at https://www.joinpantheon.network to invite more.`, m.cid, fail, acct?.id ?? null, ip);
                         }
-                        catch { }
                     }
-                    space.members.delete(m.member);
-                    this.log(`[${space.name}] - ${m.forget ? "FORGOT" : "REVOKED"} ${m.member} by ${me.id}`);
-                }
-                else {
-                    space.allow.admit(m.member, me.id, m.may_wake);
-                    this.log(`[${space.name}] * ADMITTED ${m.member} by ${me.id}${m.may_wake ? " (may wake workers)" : ""}`);
-                }
-                this.broadcast(space, { t: "members", members: this.members(space) });
-                this.broadcast(space, { t: "roster", roster: this.roster(space) });
-                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: m.member, seq: space.ledger.head });
-                return;
-            }
-            if (m.t === "worker_state") {
-                if (role !== "worker")
+                    if (!this.writeOk(me))
+                        return fail("RATE_LIMIT", "too many invites too fast — wait a few seconds", m.cid);
+                    if (space.allow.openInvites().length >= LIMITS_SPACE.openInvites)
+                        return fail("TOO_MANY_INVITES", `this team already has ${LIMITS_SPACE.openInvites} unused invites — revoke some: pantheon invite --revoke all`, m.cid);
+                    const token = randomBytes(18).toString("base64url");
+                    const inv = space.allow.mintInvite(me.id, m.may_wake, m.ttl_minutes, token, space.token);
+                    this.log(`[${space.name}] * invite minted by ${me.id}, valid ${m.ttl_minutes}m, single use`);
+                    this.send(ws, { t: "invite", url: token, expires_at: inv.expires_at });
                     return;
-                me.worker = { state: m.state, ...(m.detail ? { detail: m.detail } : {}), ...(m.until ? { until: m.until } : {}), at: Date.now() };
-                this.broadcast(space, { t: "roster", roster: this.roster(space) });
-                return;
-            }
-            if (m.t === "delete_space") {
-                if (m.confirm !== space.name)
-                    return fail("CONFIRM_MISMATCH", `type the space name ("${space.name}") to confirm`, m.cid);
-                const owner = this.accounts?.spaceOwner(space.name) ?? null;
-                const isOwner = owner ? owner.id === acct?.id : space.allow.founder() === me.id;
-                if (!isOwner)
-                    return fail("NOT_OWNER", `only the founder of "${space.name}" can delete it${owner ? ` (that is ${owner.username})` : ""}`, m.cid);
-                const name = space.name;
-                this.accounts?.audit({ event: "space_deleted", actor_account: acct?.id ?? null, space: name, detail: `by its founder ${me.id}`, ip });
-                this.log(`[${name}] * DELETED by its founder ${me.id}`);
-                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: name, seq: space.ledger.head });
-                setTimeout(() => { this.deleteSpace(name); this.accounts?.markSpaceDeleted(name); }, 50).unref?.();
-                return;
-            }
-            if (m.t === "invite") {
-                const self = space.allow.get(me.id);
-                if (!self?.admitted)
-                    return fail("NOT_ADMITTED", "only an admitted member can invite", m.cid);
-                const plan = this.spacePlan(space.name);
-                if (plan) {
-                    if (m.may_wake && !plan.limits.wake)
-                        return this.planRefusal(space, plan, "invite", `the ${plan.name} plan does not include unattended workers — invite without wake: pantheon invite --no-wake`, m.cid, fail, acct?.id ?? null, ip);
-                    const open = space.allow.openInvites().length;
-                    if (space.allow.admittedCount() + open >= plan.limits.members) {
-                        return this.planRefusal(space, plan, "invite", `"${space.name}" is full for the ${plan.name} plan: ${fmtLimit(plan.limits.members)} people${open ? `, counting ${open} unused invite${open === 1 ? "" : "s"}` : ""}. Upgrade at https://www.joinpantheon.network to invite more.`, m.cid, fail, acct?.id ?? null, ip);
-                    }
                 }
-                const token = randomBytes(18).toString("base64url");
-                const inv = space.allow.mintInvite(me.id, m.may_wake, m.ttl_minutes, token);
-                this.log(`[${space.name}] * invite minted by ${me.id}, valid ${m.ttl_minutes}m, single use`);
-                this.send(ws, { t: "invite", url: token, expires_at: inv.expires_at });
-                return;
-            }
-            if (m.t === "invites") {
-                const self = space.allow.get(me.id);
-                if (!self?.admitted)
-                    return fail("NOT_ADMITTED", "only an admitted member can see the open invites", m.cid);
-                const founder = space.allow.founder();
-                const viewer = me.id;
-                const invites = space.allow.openInvites().map((i) => {
-                    const mine = i.created_by === viewer;
-                    return { token: mine || viewer === founder ? i.token : `…${i.token.slice(-6)}`, created_by: i.created_by, created_at: i.created_at, expires_at: i.expires_at, may_wake: i.may_wake, mine };
-                });
-                this.send(ws, { t: "invites", invites, ...(m.cid ? { cid: m.cid } : {}) });
-                return;
-            }
-            if (m.t === "revoke_invite") {
-                const self = space.allow.get(me.id);
-                if (!self?.admitted)
-                    return fail("NOT_ADMITTED", "only an admitted member can revoke an invite", m.cid);
-                const inv = space.allow.findInvite(m.token.replace(/^…/, ""));
-                if (!inv)
-                    return fail("NO_SUCH_INVITE", "no open invite matches that token — it may already be used, expired or revoked (pantheon invite --list)", m.cid);
-                if (inv.created_by !== me.id && me.id !== space.allow.founder())
-                    return fail("NOT_YOURS", `that invite was minted by ${inv.created_by}; only they or the founder can revoke it`, m.cid);
-                space.allow.revokeInvite(inv.token);
-                this.log(`[${space.name}] * invite …${inv.token.slice(-6)} (minted by ${inv.created_by}) revoked by ${me.id}`);
-                this.accounts?.audit({ event: "invite_revoked", space: space.name, target: me.id, detail: `minted by ${inv.created_by}, …${inv.token.slice(-6)}`, ip });
-                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: inv.token.slice(-6), seq: space.ledger.head });
-                return;
-            }
-            if (m.t === "bind_repo") {
-                const self = space.allow.get(me.id);
-                if (!self?.admitted)
-                    return fail("NOT_ADMITTED", "only an admitted member can register a repo", m.cid);
-                const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id, m.base ?? null);
-                if (!added && m.base && space.allow.setRepoBase(m.repo, m.base)) {
-                    this.log(`[${space.name}] ~ repo ${m.origin ?? m.repo} base branch → ${m.base} (by ${me.id})`);
-                    this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                if (m.t === "invites") {
+                    const self = space.allow.get(me.id);
+                    if (!self?.admitted)
+                        return fail("NOT_ADMITTED", "only an admitted member can see the open invites", m.cid);
+                    const founder = space.allow.founder();
+                    const viewer = me.id;
+                    const invites = space.allow.openInvites().map((i) => {
+                        const mine = i.created_by === viewer;
+                        return { token: mine || viewer === founder ? i.token : `…${i.token.slice(-6)}`, created_by: i.created_by, created_at: i.created_at, expires_at: i.expires_at, may_wake: i.may_wake, mine };
+                    });
+                    this.send(ws, { t: "invites", invites, ...(m.cid ? { cid: m.cid } : {}) });
+                    return;
                 }
-                if (added) {
-                    this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
-                    this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.origin ?? m.repo}`, meta: { repo: m.repo, repo_origin: m.origin ?? null } });
-                    this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                if (m.t === "revoke_invite") {
+                    const self = space.allow.get(me.id);
+                    if (!self?.admitted)
+                        return fail("NOT_ADMITTED", "only an admitted member can revoke an invite", m.cid);
+                    const inv = space.allow.findInvite(m.token.replace(/^…/, ""));
+                    if (!inv)
+                        return fail("NO_SUCH_INVITE", "no open invite matches that token — it may already be used, expired or revoked (pantheon invite --list)", m.cid);
+                    if (inv.created_by !== me.id && me.id !== space.allow.founder())
+                        return fail("NOT_YOURS", `that invite was minted by ${inv.created_by}; only they or the founder can revoke it`, m.cid);
+                    space.allow.revokeInvite(inv.token);
+                    this.log(`[${space.name}] * invite …${inv.token.slice(-6)} (minted by ${inv.created_by}) revoked by ${me.id}`);
+                    this.accounts?.audit({ event: "invite_revoked", space: space.name, target: me.id, detail: `minted by ${inv.created_by}, …${inv.token.slice(-6)}`, ip });
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: inv.token.slice(-6), seq: space.ledger.head });
+                    return;
                 }
-                this.send(ws, { t: "ack", cid: m.cid, id: m.repo, seq: space.ledger.head });
-                return;
-            }
-            if (m.t === "claim") {
-                if (role === "worker") {
-                    const plan = this.spacePlan(space.name);
-                    if (plan && !plan.limits.wake)
-                        return this.planRefusal(space, plan, "wake", `unattended workers are not included in this space's ${plan.name} plan`, m.cid, fail, acct?.id ?? null, ip);
+                if (m.t === "bind_repo") {
+                    const self = space.allow.get(me.id);
+                    if (!self?.admitted)
+                        return fail("NOT_ADMITTED", "only an admitted member can register a repo", m.cid);
+                    if (!this.writeOk(me))
+                        return fail("RATE_LIMIT", "too many repo changes too fast — wait a few seconds", m.cid);
+                    if (!space.allow.repoList().some((r) => r.fingerprint === m.repo) && space.allow.repoCount() >= LIMITS_SPACE.repos) {
+                        return fail("TOO_MANY_REPOS", `this team already works from ${LIMITS_SPACE.repos} repos`, m.cid);
+                    }
+                    if (m.base !== undefined && !/^[A-Za-z0-9._][A-Za-z0-9._\/-]{0,99}$/.test(m.base)) {
+                        return fail("BAD_BASE", `"${m.base}" is not a branch name`, m.cid);
+                    }
+                    const existing = space.allow.repoList().find((r) => r.fingerprint === m.repo);
+                    if (existing && m.base && existing.added_by !== me.id && space.allow.founder() !== me.id) {
+                        return fail("NOT_YOURS", `only ${existing.added_by} (who registered this repo) or the team's founder can change which branch its runs start from`, m.cid);
+                    }
+                    const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id, m.base ?? null);
+                    if (!added && m.base && space.allow.setRepoBase(m.repo, m.base)) {
+                        this.log(`[${space.name}] ~ repo ${m.origin ?? m.repo} base branch → ${m.base} (by ${me.id})`);
+                        this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                    }
+                    if (added) {
+                        this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
+                        this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.origin ?? m.repo}`, meta: { repo: m.repo, repo_origin: m.origin ?? null } });
+                        this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
+                    }
+                    this.send(ws, { t: "ack", cid: m.cid, id: m.repo, seq: space.ledger.head });
+                    return;
                 }
-                if (m.obligation.startsWith("cont:")) {
-                    const act = space.ledger.find(m.obligation.slice(5));
-                    if (!act)
-                        return fail("NO_SUCH_ACT", `no act ${m.obligation.slice(5)} to continue from`, m.cid);
-                    const refFrom = act.ref ? space.ledger.find(act.ref)?.from : undefined;
-                    const goal = act.goal ? space.goals.get(act.goal) : undefined;
-                    if (!isContinuationFor(act, me.id, {
-                        ...(refFrom !== undefined ? { refFrom } : {}),
-                        ...(goal ? { goalMembers: goal.members, goalState: goal.state } : {}),
-                    })) {
-                        return fail("NOT_YOURS", `that ${act.act} is not ${me.id}'s to continue`, m.cid);
+                if (m.t === "claim") {
+                    if (role === "worker") {
+                        const plan = this.spacePlan(space.name);
+                        if (plan && !plan.limits.wake)
+                            return this.planRefusal(space, plan, "wake", `unattended workers are not included in this space's ${plan.name} plan`, m.cid, fail, acct?.id ?? null, ip);
+                    }
+                    if (m.obligation.startsWith("cont:")) {
+                        const act = space.ledger.find(m.obligation.slice(5));
+                        if (!act)
+                            return fail("NO_SUCH_ACT", `no act ${m.obligation.slice(5)} to continue from`, m.cid);
+                        const refFrom = act.ref ? space.ledger.find(act.ref)?.from : undefined;
+                        const goal = act.goal ? space.goals.get(act.goal) : undefined;
+                        if (!isContinuationFor(act, me.id, {
+                            ...(refFrom !== undefined ? { refFrom } : {}),
+                            ...(goal ? { goalMembers: goal.members, goalState: goal.state } : {}),
+                        })) {
+                            return fail("NOT_YOURS", `that ${act.act} is not ${me.id}'s to continue`, m.cid);
+                        }
+                        if (role === "worker") {
+                            const defer = shouldDeferToHuman([...me.sessions.values()], this.work(me));
+                            const age = Date.now() - act.ts;
+                            if (defer && age < LIMITS.workerGraceMs) {
+                                return fail("DEFER", `you have a live interactive session; waiting ${Math.ceil((LIMITS.workerGraceMs - age) / 1000)}s before a worker may take this`, m.cid);
+                            }
+                            const sender = space.allow.get(act.from);
+                            if (act.from !== me.id && !sender?.may_wake) {
+                                return fail("NOT_ALLOWED_TO_WAKE", `"${act.from}" is not permitted to wake a worker on this machine`, m.cid);
+                            }
+                        }
+                        const held = space.contLocks.get(m.obligation);
+                        if (held && held.session !== sessionId && Date.now() - held.at < LIMITS.claimTtlMs) {
+                            return fail("CLAIMED", `another of your sessions (${held.session}) is handling this`, m.cid);
+                        }
+                        for (const [k, v] of space.contLocks) {
+                            if (Date.now() - v.at > LIMITS.claimTtlMs)
+                                space.contLocks.delete(k);
+                        }
+                        space.contLocks.set(m.obligation, { session: sessionId, member: me.id, at: Date.now() });
+                        this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: m.obligation, seq: space.ledger.head });
+                        return;
+                    }
+                    const o = space.obligations.get(m.obligation);
+                    if (!o)
+                        return fail("NO_SUCH_OBLIGATION", `no obligation ${m.obligation} — it may already be discharged`, m.cid);
+                    if (o.owner !== me.id)
+                        return fail("NOT_YOURS", `${o.owner} owes that, not you`, m.cid);
+                    if (o.claimed_by && o.claimed_by.session !== sessionId) {
+                        if (Date.now() - o.claimed_by.at < LIMITS.claimTtlMs) {
+                            const holder = o.claimed_by;
+                            const live = [...me.sessions.keys()].includes(holder.session);
+                            const left = Math.ceil((LIMITS.claimTtlMs - (Date.now() - holder.at)) / 60_000);
+                            return fail("CLAIMED", live
+                                ? `another of your sessions (${holder.session}, ${holder.role}) is handling this`
+                                : `a session of yours (${holder.role}) was working on this when its connection dropped; it is held for it for up to ${left} more minute${left === 1 ? "" : "s"} in case it comes back`, m.cid);
+                        }
                     }
                     if (role === "worker") {
+                        const age = Date.now() - o.created_at;
                         const defer = shouldDeferToHuman([...me.sessions.values()], this.work(me));
-                        const age = Date.now() - act.ts;
                         if (defer && age < LIMITS.workerGraceMs) {
                             return fail("DEFER", `you have a live interactive session; waiting ${Math.ceil((LIMITS.workerGraceMs - age) / 1000)}s before a worker may take this`, m.cid);
                         }
-                        const sender = space.allow.get(act.from);
-                        if (act.from !== me.id && !sender?.may_wake) {
-                            return fail("NOT_ALLOWED_TO_WAKE", `"${act.from}" is not permitted to wake a worker on this machine`, m.cid);
+                        const origin = space.ledger.find(o.ref);
+                        const asker = origin ? space.allow.get(origin.from) : undefined;
+                        if (origin && origin.from !== me.id && !asker?.may_wake) {
+                            return fail("NOT_ALLOWED_TO_WAKE", `"${origin.from}" is not permitted to wake a worker on this machine`, m.cid);
                         }
                     }
-                    const held = space.contLocks.get(m.obligation);
-                    if (held && held.session !== sessionId && Date.now() - held.at < LIMITS.claimTtlMs) {
-                        return fail("CLAIMED", `another of your sessions (${held.session}) is handling this`, m.cid);
+                    o.claimed_by = { session: sessionId, role, at: Date.now() };
+                    this.broadcast(space, { t: "claimed", obligation: o.id, session: sessionId, member: me.id });
+                    this.pushObligations(space);
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: o.id, seq: space.ledger.head });
+                    return;
+                }
+                if (m.t === "open_goal") {
+                    if (!this.writeOk(me))
+                        return fail("RATE_LIMIT", "too many goals opened too fast — wait a few seconds", m.cid);
+                    const openCount = [...space.goals.values()].filter((g) => g.state !== "CLOSED").length;
+                    if (openCount >= LIMITS_SPACE.openGoals)
+                        return fail("TOO_MANY_GOALS", `this team has ${openCount} goals still open — close some first`, m.cid);
+                    for (const id of m.invite ?? []) {
+                        if (!space.members.has(id) && !space.allow.get(id)?.admitted)
+                            return fail("NO_SUCH_MEMBER", `nobody here is called "${id}"`, m.cid);
                     }
-                    for (const [k, v] of space.contLocks) {
-                        if (Date.now() - v.at > LIMITS.claimTtlMs)
-                            space.contLocks.delete(k);
+                    const invited = (m.invite ?? [...space.members.keys()]).filter((x) => x !== me.id);
+                    if (m.deadline !== undefined && m.deadline <= Date.now()) {
+                        return fail("DEADLINE_PAST", `deadline ${new Date(m.deadline).toISOString()} is already in the past`, m.cid);
                     }
-                    space.contLocks.set(m.obligation, { session: sessionId, member: me.id, at: Date.now() });
-                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: m.obligation, seq: space.ledger.head });
+                    const goal = {
+                        id: newId("g"),
+                        title: m.title,
+                        acceptance: m.acceptance,
+                        members: [me.id, ...new Set(invited)],
+                        state: "OPEN",
+                        acts: 0,
+                        budget: m.budget ?? LIMITS.goalBudget,
+                        opened_by: me.id,
+                        opened_at: Date.now(),
+                        ...(m.deadline !== undefined ? { deadline: m.deadline } : {}),
+                        ...(m.kind !== undefined ? { kind: m.kind } : {}),
+                    };
+                    space.goals.set(goal.id, goal);
+                    space.store.flush(space.goals, space.obligations, space.profiles);
+                    this.broadcast(space, { t: "goal", goal });
+                    const rec = this.commit(space, {
+                        from: me.id, act: "NOTE", to: null, goal: goal.id, ref: null,
+                        body: `goal opened: ${goal.title}\nacceptance: ${goal.acceptance || "(none stated)"}` +
+                            (goal.deadline ? `\ndeadline: ${new Date(goal.deadline).toISOString()}` : "") +
+                            (goal.kind === "worklist" ? `\nkind: worklist — ${me.id}'s own list; peers may read it, nobody owes anything in it` : ""),
+                    });
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: goal.id, seq: rec.seq });
                     return;
                 }
-                const o = space.obligations.get(m.obligation);
-                if (!o)
-                    return fail("NO_SUCH_OBLIGATION", `no obligation ${m.obligation} — it may already be discharged`, m.cid);
-                if (o.owner !== me.id)
-                    return fail("NOT_YOURS", `${o.owner} owes that, not you`, m.cid);
-                if (o.claimed_by && o.claimed_by.session !== sessionId) {
-                    if (Date.now() - o.claimed_by.at < LIMITS.claimTtlMs) {
-                        return fail("CLAIMED", `another of your sessions (${o.claimed_by.session}, ${o.claimed_by.role}) is handling this`, m.cid);
-                    }
+                const fp = fingerprint_(me.id, m.act, m.body, m.goal ?? null, m.ref ?? null, { to: m.to ?? null, meta: m.meta ?? null, defers_to: m.defers_to ?? null });
+                const prior = space.recent.get(fp);
+                if (prior && Date.now() - prior.at < LIMITS.dedupeWindowMs) {
+                    this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: prior.id, seq: prior.seq });
+                    return;
                 }
-                if (role === "worker") {
-                    const age = Date.now() - o.created_at;
-                    const defer = shouldDeferToHuman([...me.sessions.values()], this.work(me));
-                    if (defer && age < LIMITS.workerGraceMs) {
-                        return fail("DEFER", `you have a live interactive session; waiting ${Math.ceil((LIMITS.workerGraceMs - age) / 1000)}s before a worker may take this`, m.cid);
-                    }
-                    const origin = space.ledger.find(o.ref);
-                    const asker = origin ? space.allow.get(origin.from) : undefined;
-                    if (origin && origin.from !== me.id && !asker?.may_wake) {
-                        return fail("NOT_ALLOWED_TO_WAKE", `"${origin.from}" is not permitted to wake a worker on this machine`, m.cid);
+                if (m.after_seq !== undefined) {
+                    const mine = me.id;
+                    const missed = space.ledger.since(m.after_seq)
+                        .filter((r) => r.from !== mine && r.act !== "JOIN" && r.act !== "LEAVE")
+                        .filter((r) => (m.goal ? r.goal === m.goal : !r.goal)
+                        || (r.to?.includes(mine) ?? false)
+                        || (m.to?.includes(r.from) ?? false)
+                        || (!!m.ref && r.ref === m.ref));
+                    if (missed.length) {
+                        return fail("STALE_VIEW", `${missed.length} act(s) arrived while you were composing — read them before you answer:\n` +
+                            missed.slice(0, 8).map((r) => `  [${r.seq}] ${r.act} from ${r.from}: ${first(r.body)}`).join("\n") +
+                            (missed.length > 8 ? `\n  ...and ${missed.length - 8} more` : "") +
+                            `\nCall pantheon_wait, then send again.`, m.cid);
                     }
                 }
-                o.claimed_by = { session: sessionId, role, at: Date.now() };
-                this.broadcast(space, { t: "claimed", obligation: o.id, session: sessionId, member: me.id });
-                this.pushObligations(space);
-                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: o.id, seq: space.ledger.head });
-                return;
-            }
-            if (m.t === "open_goal") {
-                const invited = (m.invite ?? [...space.members.keys()]).filter((x) => x !== me.id);
-                if (m.deadline !== undefined && m.deadline <= Date.now()) {
-                    return fail("DEADLINE_PAST", `deadline ${new Date(m.deadline).toISOString()} is already in the past`, m.cid);
-                }
-                const goal = {
-                    id: newId("g"),
-                    title: m.title,
-                    acceptance: m.acceptance,
-                    members: [me.id, ...new Set(invited)],
-                    state: "OPEN",
-                    acts: 0,
-                    budget: m.budget ?? LIMITS.goalBudget,
-                    opened_by: me.id,
-                    opened_at: Date.now(),
-                    ...(m.deadline !== undefined ? { deadline: m.deadline } : {}),
-                    ...(m.kind !== undefined ? { kind: m.kind } : {}),
-                };
-                space.goals.set(goal.id, goal);
-                space.store.save(space.goals, space.obligations, space.profiles);
-                this.broadcast(space, { t: "goal", goal });
+                const err = this.validateAct(space, me, m.act, m.goal ?? null, m.ref ?? null, m.to ?? null, m.meta, m.defers_to, m.body.length, m.summary, m.repo, role);
+                if (err)
+                    return fail(err.code, err.message, m.cid);
                 const rec = this.commit(space, {
-                    from: me.id, act: "NOTE", to: null, goal: goal.id, ref: null,
-                    body: `goal opened: ${goal.title}\nacceptance: ${goal.acceptance || "(none stated)"}` +
-                        (goal.deadline ? `\ndeadline: ${new Date(goal.deadline).toISOString()}` : "") +
-                        (goal.kind === "worklist" ? `\nkind: worklist — ${me.id}'s own list; peers may read it, nobody owes anything in it` : ""),
+                    from: me.id, session: sessionId, role, act: m.act, body: m.body,
+                    ...(m.summary ? { summary: m.summary } : {}),
+                    to: m.to ?? null, goal: m.goal ?? null, ref: m.ref ?? null,
+                    ...(m.meta || m.defers_to || m.affects
+                        ? { meta: { ...(m.meta ?? {}),
+                                ...(m.defers_to ? { defers_to: m.defers_to } : {}),
+                                ...(m.affects ? { affects: m.affects } : {}) } }
+                        : {}),
                 });
-                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: goal.id, seq: rec.seq });
-                return;
-            }
-            const fp = fingerprint_(me.id, m.act, m.body, m.goal ?? null, m.ref ?? null);
-            const prior = space.recent.get(fp);
-            if (prior && Date.now() - prior.at < LIMITS.dedupeWindowMs) {
-                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: prior.id, seq: prior.seq });
-                return;
+                space.recent.set(fp, { id: rec.id, seq: rec.seq, at: Date.now() });
+                for (const [k, v] of space.recent)
+                    if (Date.now() - v.at > LIMITS.dedupeWindowMs)
+                        space.recent.delete(k);
+                this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
             }
-            if (m.after_seq !== undefined) {
-                const mine = me.id;
-                const missed = space.ledger.since(m.after_seq)
-                    .filter((r) => r.from !== mine && r.act !== "JOIN" && r.act !== "LEAVE")
-                    .filter((r) => (m.goal ? r.goal === m.goal : !r.goal)
-                    || (r.to?.includes(mine) ?? false)
-                    || (m.to?.includes(r.from) ?? false)
-                    || (!!m.ref && r.ref === m.ref));
-                if (missed.length) {
-                    return fail("STALE_VIEW", `${missed.length} act(s) arrived while you were composing — read them before you answer:\n` +
-                        missed.slice(0, 8).map((r) => `  [${r.seq}] ${r.act} from ${r.from}: ${first(r.body)}`).join("\n") +
-                        (missed.length > 8 ? `\n  ...and ${missed.length - 8} more` : "") +
-                        `\nCall pantheon_wait, then send again.`, m.cid);
+            catch (e) {
+                this.log(`! message handling failed: ${e.message}`);
+                try {
+                    ws.send(JSON.stringify({ t: "error", code: "STORAGE", message: "the relay could not save that — try again in a moment" }));
                 }
+                catch { }
             }
-            const err = this.validateAct(space, me, m.act, m.goal ?? null, m.ref ?? null, m.to ?? null, m.meta, m.defers_to, m.body.length, m.summary, m.repo);
-            if (err)
-                return fail(err.code, err.message, m.cid);
-            const rec = this.commit(space, {
-                from: me.id, session: sessionId, role, act: m.act, body: m.body,
-                ...(m.summary ? { summary: m.summary } : {}),
-                to: m.to ?? null, goal: m.goal ?? null, ref: m.ref ?? null,
-                ...(m.meta || m.defers_to || m.affects
-                    ? { meta: { ...(m.meta ?? {}),
-                            ...(m.defers_to ? { defers_to: m.defers_to } : {}),
-                            ...(m.affects ? { affects: m.affects } : {}) } }
-                    : {}),
-            });
-            space.recent.set(fp, { id: rec.id, seq: rec.seq, at: Date.now() });
-            for (const [k, v] of space.recent)
-                if (Date.now() - v.at > LIMITS.dedupeWindowMs)
-                    space.recent.delete(k);
-            this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
         });
-        ws.on("close", () => {
+        ws.on("close", (code) => {
             if (dbSession) {
                 this.accounts?.endSession(dbSession);
                 dbSession = null;
@@ -2029,13 +2187,22 @@ pantheon signup --email you@work.com --username you</code></pre>
             if (!space || !me)
                 return;
             me.sessions.delete(sessionId);
+            const deliberate = code === 1000 || code === 1001 || code === 1005;
             for (const o of space.obligations.values()) {
-                if (o.claimed_by?.session === sessionId)
+                if (o.claimed_by?.session !== sessionId)
+                    continue;
+                if (deliberate)
                     delete o.claimed_by;
+                else
+                    o.claimed_by = { ...o.claimed_by, at: Date.now() };
             }
             for (const [k, v] of space.contLocks) {
-                if (v.session === sessionId)
+                if (v.session !== sessionId)
+                    continue;
+                if (deliberate)
                     space.contLocks.delete(k);
+                else
+                    v.at = Date.now();
             }
             if (me.sessions.size === 0 && role !== "cli") {
                 me.last_seen = Date.now();
@@ -2064,10 +2231,29 @@ pantheon signup --email you@work.com --username you</code></pre>
         for (const sp of this.spaces.values()) {
             if (now - (this.compactedAt.get(sp.name) ?? 0) > LIMITS.ledgerCompactEveryMs)
                 this.compactSpace(sp);
+            this.lapseClaims(sp, now);
         }
         this.evictSpaces();
     }
-    validateAct(sp, me, act, goalId, ref, to, meta, deferTo, bodyLen = 0, summary, repo) {
+    lapseClaims(sp, now) {
+        const live = new Set();
+        for (const m of sp.members.values())
+            for (const id of m.sessions.keys())
+                live.add(id);
+        let lapsed = 0;
+        for (const o of sp.obligations.values()) {
+            if (o.claimed_by && !live.has(o.claimed_by.session) && now - o.claimed_by.at >= LIMITS.claimTtlMs) {
+                delete o.claimed_by;
+                lapsed++;
+            }
+        }
+        for (const [k, v] of sp.contLocks)
+            if (!live.has(v.session) && now - v.at >= LIMITS.claimTtlMs)
+                sp.contLocks.delete(k);
+        if (lapsed)
+            this.pushObligations(sp);
+    }
+    validateAct(sp, me, act, goalId, ref, to, meta, deferTo, bodyLen = 0, summary, repo, role) {
         if (!SENDABLE.includes(act))
             return { code: "RESERVED_ACT", message: `${act} is emitted by the relay, not by a delegate` };
         const now = Date.now();
@@ -2083,6 +2269,9 @@ pantheon signup --email you@work.com --username you</code></pre>
         }
         if (ref && !sp.ledger.find(ref))
             return { code: "BAD_REF", message: `no act with id ${ref}` };
+        if (meta && JSON.stringify(meta).length > LIMITS_SPACE.metaBytes) {
+            return { code: "META_TOO_LARGE", message: `act metadata is limited to ${LIMITS_SPACE.metaBytes} bytes` };
+        }
         if ((act === "ANSWER" || act === "ACCEPT" || act === "OBJECT") && !ref) {
             return { code: "REF_REQUIRED", message: `${act} must reference the act it responds to` };
         }
@@ -2219,6 +2408,15 @@ pantheon signup --email you@work.com --username you</code></pre>
                     return { code: "BAD_REMOTE", message: `${why}. Your peer fetches this from another machine.` };
             }
         }
+        if (act === "ANSWER" && ref) {
+            const asked = sp.ledger.find(ref);
+            if (asked?.act === "ESCALATE" && asked.from !== me.id) {
+                return { code: "NOT_YOUR_DECISION", message: `that ESCALATE is for ${asked.from}'s own human to settle — add to it with a NOTE instead` };
+            }
+            if (asked?.act === "HUMAN_REQUIRED" && asked.to?.[0] && asked.to[0] !== me.id) {
+                return { code: "NOT_YOUR_DECISION", message: `that decision is ${asked.to[0]}'s to make — add to it with a NOTE instead` };
+            }
+        }
         if (!goalId) {
             const target = ref ? sp.ledger.find(ref) : undefined;
             const settlesHuman = act === "ANSWER" && (target?.act === "ESCALATE" || target?.act === "HUMAN_REQUIRED");
@@ -2230,12 +2428,24 @@ pantheon signup --email you@work.com --username you</code></pre>
         const goal = sp.goals.get(goalId);
         if (!goal)
             return { code: "NO_SUCH_GOAL", message: `no goal ${goalId}` };
+        if (ref && act !== "RETRACT") {
+            const target = sp.ledger.find(ref);
+            if (target && target.goal !== goalId) {
+                return { code: "REF_OTHER_GOAL", message: `that act belongs to ${target.goal ? `goal ${target.goal}` : "no goal"}, not this one — reply in its own goal${target.goal ? "" : " (send it without a goal)"}` };
+            }
+        }
+        for (const id of to ?? []) {
+            if (!goal.members.includes(id)) {
+                return { code: "NOT_IN_GOAL", message: `${id} is not in "${goal.title}", so they could never answer it here — open a goal with them, or send it without a goal` };
+            }
+        }
         if (goal.state === "CLOSED")
             return { code: "GOAL_CLOSED", message: `goal "${goal.title}" is closed` };
         if (!goal.members.includes(me.id))
             return { code: "NOT_IN_GOAL", message: `you are not a member of "${goal.title}"` };
-        const settlesOwnHuman = act === "ANSWER" && !!ref
-            && [...sp.obligations.values()].some((o) => o.kind === "HUMAN" && o.ref === ref && o.owner === `human:${me.id}`);
+        const decision = act === "ANSWER" && ref ? sp.ledger.find(ref) : undefined;
+        const settlesOwnHuman = !!decision && decision.goal === goalId && role === "cli"
+            && [...sp.obligations.values()].some((o) => o.kind === "HUMAN" && o.ref === ref && o.goal === goalId && o.owner === `human:${me.id}`);
         if (goal.acts >= goal.budget && !settlesOwnHuman) {
             return { code: "BUDGET_SPENT", message: `goal "${goal.title}" spent its ${goal.budget}-act budget and needs a human` };
         }
@@ -2298,6 +2508,15 @@ pantheon signup --email you@work.com --username you</code></pre>
                 break;
             case "ANSWER":
                 if (rec.ref) {
+                    for (const o of sp.obligations.values()) {
+                        const g = o.goal ? sp.goals.get(o.goal) : undefined;
+                        if (o.kind === "HUMAN" && o.ref === rec.ref && o.owner === `human:${rec.from}` && g?.state === "STALLED"
+                            && !["ESCALATE", "HUMAN_REQUIRED"].includes(sp.ledger.find(o.ref)?.act ?? "")) {
+                            g.budget = Math.max(g.budget, g.acts) + Math.ceil(LIMITS.goalBudget / 2);
+                            g.state = "OPEN";
+                            this.broadcast(sp, { t: "goal", goal: g });
+                        }
+                    }
                     closeFor(rec.from, rec.ref);
                     closeFor(`human:${rec.from}`, rec.ref);
                 }
@@ -2320,9 +2539,10 @@ pantheon signup --email you@work.com --username you</code></pre>
                 if (rec.ref)
                     closeFor(rec.from, rec.ref);
                 const accepted = rec.ref ? sp.ledger.find(rec.ref) : undefined;
-                if (accepted?.act === "WITHDRAW" && accepted.ref) {
+                if (accepted?.act === "WITHDRAW" && accepted.ref && accepted.from !== rec.from) {
+                    const owedTo = sp.ledger.find(accepted.ref)?.from;
                     for (const [id, o] of sp.obligations) {
-                        if (o.ref === accepted.ref && o.owner === accepted.from)
+                        if (o.ref === accepted.ref && o.owner === accepted.from && owedTo === rec.from)
                             sp.obligations.delete(id);
                     }
                 }
@@ -2339,16 +2559,12 @@ pantheon signup --email you@work.com --username you</code></pre>
                 }
                 break;
             case "CONTRACT":
-                if (rec.ref)
-                    for (const [id, o] of sp.obligations)
-                        if (o.ref === rec.ref)
-                            sp.obligations.delete(id);
-                break;
             case "DELIVERED":
                 if (rec.ref)
-                    for (const [id, o] of sp.obligations)
-                        if (o.ref === rec.ref)
+                    for (const [id, o] of sp.obligations) {
+                        if (o.ref === rec.ref && o.goal === rec.goal && o.kind !== "HUMAN")
                             sp.obligations.delete(id);
+                    }
                 break;
             case "ESCALATE":
                 this.oblige(sp, { kind: "HUMAN", owner: `human:${rec.from}`, ref: rec.id, goal: rec.goal,
@@ -2373,6 +2589,27 @@ pantheon signup --email you@work.com --username you</code></pre>
                     for (const [id, o] of sp.obligations)
                         if (o.ref === rec.ref)
                             sp.obligations.delete(id);
+                if (rec.ref)
+                    for (const [k, v] of sp.recent)
+                        if (v.id === rec.ref)
+                            sp.recent.delete(k);
+                if (rec.ref) {
+                    const answer = sp.ledger.find(rec.ref);
+                    const asked = answer?.act === "ANSWER" && answer.from === rec.from && answer.ref ? sp.ledger.find(answer.ref) : undefined;
+                    const decider = asked?.act === "ESCALATE" ? asked.from : asked?.act === "HUMAN_REQUIRED" ? asked.to?.[0] : undefined;
+                    const retracted = new Set(sp.ledger.all().filter((r) => r.act === "RETRACT" && r.ref).map((r) => r.ref));
+                    const stillAnswered = asked && sp.ledger.all().some((r) => r.act === "ANSWER" && r.ref === asked.id && r.from === rec.from && r.id !== answer.id && !retracted.has(r.id));
+                    const alreadyLive = asked && [...sp.obligations.values()].some((o) => o.kind === "HUMAN" && o.ref === asked.id);
+                    if (asked && decider === rec.from && !stillAnswered && !alreadyLive && !retracted.has(asked.id)) {
+                        this.oblige(sp, { kind: "HUMAN", owner: `human:${decider}`, ref: asked.id, goal: asked.goal,
+                            body: asked.act === "ESCALATE" ? `${asked.from} escalated: ${first(asked.body)}` : `${asked.from} needs a decision: ${first(asked.body)}` });
+                        const g = asked.goal ? sp.goals.get(asked.goal) : undefined;
+                        if (g && g.state === "OPEN") {
+                            g.state = "BLOCKED";
+                            this.broadcast(sp, { t: "goal", goal: g });
+                        }
+                    }
+                }
                 break;
             case "CLOSE":
                 if (goal) {
@@ -2400,9 +2637,17 @@ pantheon signup --email you@work.com --username you</code></pre>
         sp.obligations.set(id, { ...o, id, created_at: Date.now() });
     }
     pushObligations(sp) {
-        sp.store.save(sp.goals, sp.obligations, sp.profiles);
+        sp.store.flush(sp.goals, sp.obligations, sp.profiles);
         this.broadcast(sp, { t: "obligations", list: [...sp.obligations.values()] });
     }
+    writeOk(me) {
+        const now = Date.now();
+        me.stamps = me.stamps.filter((t) => now - t < LIMITS.rateWindowMs);
+        if (me.stamps.length >= LIMITS.rateActs)
+            return false;
+        me.stamps.push(now);
+        return true;
+    }
     mayCreateSpace(ip) {
         const now = Date.now();
         if (!this.localTrusted(ip)) {
@@ -2490,7 +2735,7 @@ pantheon signup --email you@work.com --username you</code></pre>
     getOrCreateSpace(name, token) {
         const existing = this.spaces.get(name);
         if (existing)
-            return existing.token === token ? existing : null;
+            return secretEq(existing.token, token) ? existing : null;
         const safe = name.replace(/[^a-z0-9._-]/gi, "_");
         const allow = new Allowlist(this.dataDir, safe);
         const match = allow.tokenMatches(token);
@@ -2533,7 +2778,8 @@ pantheon signup --email you@work.com --username you</code></pre>
             const g = sp.goals.get(goal);
             return !!g && g.state !== "CLOSED";
         };
-        const { dropped, kept } = sp.ledger.compact({ keepRecent: LIMITS.ledgerKeepRecent, isLive });
+        const referenced = new Set([...sp.obligations.values()].map((o) => o.ref));
+        const { dropped, kept } = sp.ledger.compact({ keepRecent: LIMITS.ledgerKeepRecent, isLive, keep: (id) => referenced.has(id) });
         this.compactedAt.set(sp.name, Date.now());
         if (dropped)
             this.log(`[${sp.name}] compacted ledger — dropped ${dropped} old act(s) from closed goals, ${kept} kept`);