@join-pantheon/cli 0.29.1 → 0.31.0

package/dist/relay.js

@@ -1,19 +1,19 @@
 import { createServer } from "node:http";
 import { createHash, randomBytes, timingSafeEqual as timingSafeEqualBuf } from "node:crypto";
-import { rmSync, readdirSync, readFileSync, statSync, existsSync, writeFileSync } from "node:fs";
+import { rmSync, readdirSync, readFileSync, statSync, existsSync, writeFileSync, openSync, readSync, closeSync, fstatSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { WebSocketServer } from "ws";
-import { badRemote, Inbound, isContinuationFor, LIMITS, newId, PROTOCOL_VERSION, SENDABLE, shouldDeferToHuman, } from "./protocol.js";
+import { badRemote, Inbound, isContinuationFor, LIMITS, newId, PROTOCOL_VERSION, RELAY_FEATURES, SENDABLE, shouldDeferToHuman, } from "./protocol.js";
 import { VERSION } from "./version.js";
-import { Ledger } from "./ledger.js";
-import { fingerprint, newNonce, verifyChallenge, verifyActivity, verifyAccount } from "./identity.js";
+import { Ledger, SpaceFull } from "./ledger.js";
+import { fingerprint, newNonce, verifyChallenge, verifyActivity, verifyAccount, verifyRead, actPayload, goalPayload, verifyBytes, verifyDelegate, canonicalJson } from "./identity.js";
 import { Accounts, normalizeUsername, validEmail, validUsername } from "./accounts.js";
 import { emailSenderFromEnv } from "./email.js";
-import { Allowlist } from "./roster-file.js";
-import { StateStore } from "./store.js";
+import { Allowlist, RosterUnreadable } from "./roster-file.js";
+import { StateStore, ensurePrivateDir } from "./store.js";
 import { activity, mergeActivity, feed, noteRefusal, refusalsSince, countActs, spaceHealth, fleetReport, ESCALATIONS, MESSAGE_ACTS, ACT_TONE, DAY } from "./admin-stats.js";
-import { fmtLimit, parseLimits, PLAN_NAME } from "./plans.js";
+import { fmtLimit, parseLimits, planLimits, PLAN_NAME } from "./plans.js";
 import { routeDecision } from "./profile.js";
 function workState(m, now = Date.now(), busyTtlMs = LIMITS.activityBusyTtlMs, pruneMs = LIMITS.activityPruneMs) {
     let known = false;
@@ -81,6 +81,17 @@ export function isTrustedSource(ip) {
 function fingerprint_(from, act, body, goal, ref, extra = null) {
     return createHash("sha256").update([from, act, goal ?? "", ref ?? "", body, stableJson(extra)].join("\u0000")).digest("hex").slice(0, 32);
 }
+function actFingerprint(from, act, body, goal, ref, to, meta) {
+    let m = meta ?? null;
+    if (m && ("authority" in m || "unverified_domains" in m)) {
+        m = { ...m };
+        delete m["authority"];
+        delete m["unverified_domains"];
+    }
+    if (m && Object.keys(m).length === 0)
+        m = null;
+    return fingerprint_(from, act, body, goal, ref, { to: to ?? null, meta: m });
+}
 function stableJson(v) {
     if (v === null || typeof v !== "object")
         return JSON.stringify(v ?? null);
@@ -89,6 +100,8 @@ function stableJson(v) {
     return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${stableJson(v[k])}`).join(",")}}`;
 }
 function clientIp(req) {
+    if (process.env.PANTHEON_TRUSTED_HOPS?.trim() === "0")
+        return req.socket.remoteAddress || "unknown";
     const raw = req.headers["x-forwarded-for"];
     const hops = (Array.isArray(raw) ? raw.join(",") : raw ?? "").split(",").map((x) => x.trim()).filter(Boolean);
     const trusted = Math.max(1, Number(process.env.PANTHEON_TRUSTED_HOPS ?? 1) || 1);
@@ -161,8 +174,195 @@ const fmtAgo = (t) => {
     return m < 1 ? "just now" : m < 60 ? `${m}m ago` : m < 1440 ? `${Math.round(m / 60)}h ago` : `${Math.round(m / 1440)}d ago`;
 };
 const safeName = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
+const spaceKey = (name) => safeName(name).toLowerCase();
+function firstLedgerName(file) {
+    let fd = null;
+    try {
+        fd = openSync(file, "r");
+        const chunks = [];
+        const buf = Buffer.allocUnsafe(64 * 1024);
+        for (let pos = 0, total = 0; total < 1 << 20;) {
+            const n = readSync(fd, buf, 0, buf.length, pos);
+            if (n <= 0)
+                break;
+            const nl = buf.subarray(0, n).indexOf(10);
+            chunks.push(Buffer.from(buf.subarray(0, nl === -1 ? n : nl)));
+            if (nl !== -1)
+                break;
+            pos += n;
+            total += n;
+        }
+        const r = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        return typeof r.space === "string" && r.space ? r.space : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== null)
+            try {
+                closeSync(fd);
+            }
+            catch { }
+    }
+}
+const GOAL_OPENED = /^goal opened: ([^\n]*)\nacceptance: ([\s\S]*?)(?:\ndeadline: (\S+))?(?:\nkind: (\w+)[\s\S]*)?$/;
 const LIMITS_GOAL_READ = 1000;
+function repoLabelSafe(v) {
+    if (!v)
+        return null;
+    const s = v.normalize("NFKC").replace(/[^A-Za-z0-9._@:/+~-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 100);
+    return s || null;
+}
 const LIMITS_SPACE = { metaBytes: 8192, openGoals: 500, repos: 100, openInvites: 50 };
+const SPACE_MAX_BYTES_DEFAULT = 50 * 1024 * 1024;
+const SPACE_HARD_SLACK = 1024 * 1024;
+const REFUSAL_BUDGET = 100;
+const REFUSAL_WINDOW_MS = 10_000;
+const RECENT_MAX = 5_000;
+const DEVICE_OTHER_ACCOUNT = [
+    "this machine's key is already signed in to a different account, and one key belongs to one account — nothing was changed and no code was sent.",
+    "To sign back in to that account: pantheon login --email <its email>.",
+    "To switch this machine to the other account, sign it out of the first one (pantheon sessions revoke <this device's id> --device, while signed in to it), then run this again.",
+    "To keep both, give the second account its own identity folder: PANTHEON_HOME=~/.pantheon-<name> pantheon signup … (and use the same PANTHEON_HOME for every command as that account).",
+].join("\n");
+const UPGRADE_NOTE = "This team now needs Pantheon 0.30 or newer to read its history — run: pantheon upgrade";
+const UPGRADE_NOTE_ID = "a_pantheon_upgrade_required";
+const RELAY_MEMBER = "pantheon";
+function ledgerTailSeq(file) {
+    let fd = null;
+    try {
+        fd = openSync(file, "r");
+        const size = fstatSync(fd).size;
+        const len = Math.min(size, 256 * 1024);
+        const buf = Buffer.allocUnsafe(len);
+        readSync(fd, buf, 0, len, size - len);
+        const lines = buf.toString("utf8").split("\n");
+        for (let i = lines.length - 1; i >= 0; i--) {
+            try {
+                const r = JSON.parse(lines[i]);
+                if (typeof r.seq === "number")
+                    return r.seq;
+            }
+            catch { }
+        }
+        return 0;
+    }
+    catch {
+        return 0;
+    }
+    finally {
+        if (fd !== null)
+            try {
+                closeSync(fd);
+            }
+            catch { }
+    }
+}
+function versionBelow(a, b) {
+    if (!a)
+        return true;
+    const pa = a.split(/[.-]/).map((x) => Number.parseInt(x, 10) || 0), pb = b.split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) < (pb[i] ?? 0);
+    }
+    return false;
+}
+const LOCKED_MSG = "too many wrong codes from this device or your network in the last hour — wait an hour, then request a new code";
+const STORAGE_UNHEALTHY_MS = 5 * 60_000;
+function isStorageError(e) {
+    const code = e?.code;
+    return typeof code === "string" && (/^E[A-Z0-9]+$/.test(code) || code.startsWith("ERR_SQLITE"));
+}
+function buildCommit() {
+    const c = process.env.PANTHEON_COMMIT ?? process.env.RAILWAY_GIT_COMMIT_SHA ?? process.env.SOURCE_COMMIT ?? process.env.GIT_COMMIT ?? "";
+    return /^[0-9a-f]{7,40}$/i.test(c.trim()) ? c.trim() : null;
+}
+export function netOf(ip) {
+    const h = ip.replace(/^::ffff:/i, "");
+    const v4 = /^(\d+)\.(\d+)\.(\d+)\.\d+$/.exec(h);
+    if (v4)
+        return `${v4[1]}.${v4[2]}.${v4[3]}.0/24`;
+    if (h.includes(":")) {
+        const [head, tail] = h.split("::");
+        const a = head ? head.split(":") : [];
+        const b = tail !== undefined ? (tail ? tail.split(":") : []) : [];
+        const groups = tail !== undefined ? [...a, ...Array(Math.max(0, 8 - a.length - b.length)).fill("0"), ...b] : a;
+        return `${groups.slice(0, 4).map((g) => (g || "0").toLowerCase().replace(/^0+(?=.)/, "")).join(":")}::/64`;
+    }
+    return h;
+}
+function idIsFresh(id) {
+    const body = /^a_([a-z0-9]+)[0-9a-f]{18}$/.exec(id)?.[1];
+    const t = body ? parseInt(body, 36) : NaN;
+    return Number.isFinite(t) && Math.abs(Date.now() - t) < DAY;
+}
+function actSigProblem(m, member, memberPub, teams, delegated) {
+    const sig = m.sig;
+    if (!sig)
+        return "a woken run's session must sign every act";
+    if (canonicalJson(sig.meta ?? {}) !== canonicalJson(m.meta ?? {}))
+        return "the signed meta is not the meta sent";
+    if ((sig.repo ?? null) !== (m.repo ?? null))
+        return "the signed repo is not the repo sent";
+    const keyOk = sigKeyProblem(sig, member, memberPub, teams, delegated);
+    if (keyOk)
+        return keyOk;
+    if (!m.id)
+        return "a signed act names its own id";
+    if (Math.abs(Date.now() - sig.ts) > DAY)
+        return "signed at a time more than a day from now — check this machine's clock";
+    const ok = teams.filter((t) => !!t).some((team) => verifyBytes(sig.pub, actPayload({
+        id: m.id, team, member, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        act: m.act, goal: m.goal ?? null, ref: m.ref ?? null, to: m.to ?? null,
+        defers_to: m.defers_to ?? null, affects: m.affects ?? null, repo: m.repo ?? null,
+        summary: m.summary ?? null, body: m.body, meta: m.meta ?? {},
+    }), sig.s));
+    return ok ? null : "the signature does not match this act";
+}
+function goalSigProblem(m, member, memberPub, teams, delegated) {
+    const sig = m.sig;
+    if (!sig)
+        return "a woken run's session must sign the goals it opens";
+    const inviteSent = m.invite ? [...new Set(m.invite)].sort().join(",") : null;
+    const inviteSigned = sig.invite === null ? null : [...new Set(sig.invite)].sort().join(",");
+    if (inviteSent !== inviteSigned)
+        return "the signed invitations are not the ones sent";
+    if ((sig.budget ?? null) !== (m.budget ?? null) || (sig.deadline ?? null) !== (m.deadline ?? null) || (sig.kind ?? null) !== (m.kind ?? null))
+        return "the signed budget, deadline or kind is not what was sent";
+    const keyOk = sigKeyProblem(sig, member, memberPub, teams, delegated);
+    if (keyOk)
+        return keyOk;
+    if (!m.id)
+        return "a signed goal names its own id";
+    if (Math.abs(Date.now() - sig.ts) > DAY)
+        return "signed at a time more than a day from now — check this machine's clock";
+    const ok = teams.filter((t) => !!t).some((team) => verifyBytes(sig.pub, goalPayload({
+        id: m.id, team, member, keyRole: sig.role, nonce: sig.nonce, ts: sig.ts,
+        title: m.title, acceptance: m.acceptance ?? "", invite: sig.invite,
+        budget: sig.budget ?? null, deadline: sig.deadline ?? null, kind: sig.kind ?? null,
+    }), sig.s));
+    return ok ? null : "the signature does not match this goal";
+}
+function sigKeyProblem(sig, member, memberPub, teams, delegated) {
+    if (delegated) {
+        if (sig.role !== "run" || sig.pub !== delegated.pub || sig.cert?.pub !== delegated.pub)
+            return "a woken run signs with the key its session was opened with";
+    }
+    if (sig.role === "member")
+        return sig.pub === memberPub ? null : `signed with a key that is not ${member}'s`;
+    if (!sig.cert || sig.cert.pub !== sig.pub)
+        return "a run's signature needs its certificate";
+    const c = sig.cert;
+    return teams.filter((t) => !!t).some((t) => verifyDelegate(memberPub, t, member, c)) ? null : `that run key is not vouched for by ${member}, or it has expired`;
+}
+function withoutFromRepo(meta) {
+    if (!meta || typeof meta !== "object")
+        return {};
+    const { from_repo: _f, ...rest } = meta;
+    return rest;
+}
 export class Relay {
     opts;
     spaces = new Map();
@@ -170,9 +370,22 @@ export class Relay {
     log;
     http = createServer((req, res) => {
         const fail = (e) => {
+            if (e instanceof RosterUnreadable) {
+                this.log(`!! ${e.message} — reads of this space are refused until it is repaired (it was left in place)`);
+                try {
+                    if (!res.headersSent)
+                        this.json(res, 503, { code: "SPACE_UNREADABLE", error: "the relay cannot read this team's member list, so it cannot say who may read it. Nothing was changed; tell the relay operator." });
+                    else
+                        res.end();
+                }
+                catch { }
+                return;
+            }
             const bad = e instanceof TypeError || e instanceof URIError;
             if (!bad)
                 this.log(`! http ${req.method} ${String(req.url ?? "").slice(0, 120)} failed: ${e?.message ?? e}`);
+            if (isStorageError(e))
+                this.noteStorageFailure(`http ${String(req.url ?? "").split("?")[0].slice(0, 60)}`, e);
             try {
                 if (!res.headersSent)
                     this.json(res, bad ? 400 : 500, { error: bad ? "bad request" : "the relay could not handle that request" });
@@ -202,20 +415,33 @@ export class Relay {
     pruneMs;
     accounts;
     requireAccounts;
+    readsMode;
     trustLocal;
     email;
     authHits = new Map();
     adminHits = new Map();
     emailSends = [];
+    emailSendsTo = new Map();
+    emailSendsFrom = new Map();
+    storageFailure = null;
+    unbound = new Set();
+    maxLedgerBytes;
     adminToken;
     adminAllow;
     startedAt = Date.now();
     deletedSpaces = new Map();
+    authEpoch = 0;
+    rotateOnRemove;
     backupTimer;
+    get features() { return this.opts.features ?? RELAY_FEATURES; }
     constructor(opts = {}) {
         this.opts = opts;
         this.dataDir = opts.dataDir ?? "./pantheon-data";
         this.log = opts.log ?? ((l) => console.error(l));
+        ensurePrivateDir(this.dataDir);
+        this.maxLedgerBytes = opts.spaceMaxBytes
+            ?? (Number(process.env.PANTHEON_SPACE_MAX_BYTES) > 0 ? Number(process.env.PANTHEON_SPACE_MAX_BYTES) : SPACE_MAX_BYTES_DEFAULT);
+        this.scanUnbound();
         this.requireAccounts = opts.requireAccounts ?? process.env.PANTHEON_REQUIRE_ACCOUNTS === "1";
         this.trustLocal = process.env.PANTHEON_TRUST_LOCAL !== undefined
             ? process.env.PANTHEON_TRUST_LOCAL === "1"
@@ -243,8 +469,14 @@ export class Relay {
             spaceJunkDeleteMs: opts.spaceLimits?.spaceJunkDeleteMs ?? LIMITS.spaceJunkDeleteMs,
             spaceMinAgeMs: opts.spaceLimits?.spaceMinAgeMs ?? LIMITS.spaceMinAgeMs,
         };
+        this.rotateOnRemove = opts.rotateOnRemove ?? process.env.PANTHEON_ROTATE_ON_REMOVE === "1";
         this.busyTtlMs = opts.activityBusyTtlMs ?? LIMITS.activityBusyTtlMs;
         this.pruneMs = opts.activityPruneMs ?? LIMITS.activityPruneMs;
+        const readsEnv = (process.env.PANTHEON_READS ?? "").trim().toLowerCase();
+        this.readsMode = opts.reads ?? (readsEnv === "" || readsEnv === "transition" ? "transition" : "signed");
+        if (!opts.reads && readsEnv && readsEnv !== "transition" && readsEnv !== "signed") {
+            this.log(`! PANTHEON_READS="${process.env.PANTHEON_READS}" is not "signed" or "transition" — using "signed"`);
+        }
         this.http.on("upgrade", (req, socket, head) => {
             const ip = clientIp(req);
             this.wss.handleUpgrade(req, socket, head, (ws) => this.onSocket(ws, ip));
@@ -267,8 +499,14 @@ export class Relay {
         });
     }
     async close() {
-        for (const sp of this.spaces.values())
-            sp.store.close(sp.goals, sp.obligations, sp.profiles);
+        for (const sp of this.spaces.values()) {
+            try {
+                sp.store.close(sp.goals, sp.obligations, sp.profiles);
+            }
+            catch (e) {
+                this.noteStorageFailure(`[${sp.name}] final flush`, e);
+            }
+        }
         if (this.backupTimer)
             clearInterval(this.backupTimer);
         if (this.accounts && !this.opts.accounts)
@@ -280,6 +518,48 @@ export class Relay {
         await new Promise((r) => this.wss.close(() => r()));
         await new Promise((r) => this.http.close(() => r()));
     }
+    noteStorageFailure(where, e) {
+        const message = e?.message ?? String(e);
+        this.log(`! storage: ${where} failed: ${message}`);
+        if (isStorageError(e))
+            this.storageFailure = { at: Date.now(), where, message };
+    }
+    scanUnbound() {
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir);
+        }
+        catch {
+            return;
+        }
+        for (const f of files) {
+            const safe = f.endsWith(".members.json") ? f.slice(0, -".members.json".length) : f.endsWith(".jsonl") ? f.slice(0, -".jsonl".length) : null;
+            if (safe === null || this.unbound.has(safe))
+                continue;
+            try {
+                if (this.unboundOnDisk(safe))
+                    this.unbound.add(safe);
+            }
+            catch { }
+        }
+        if (this.unbound.size) {
+            this.log(`! ${this.unbound.size} space(s) on disk have no bound token: ${[...this.unbound].sort().join(", ")}. ` +
+                `Each is re-bound only by a reconnect from a member already admitted in it, with that member's key; anyone else is refused (UNBOUND_SPACE).`);
+        }
+    }
+    unboundOnDisk(safe) {
+        const size = (suf) => { try {
+            return statSync(join(this.dataDir, `${safe}${suf}`)).size;
+        }
+        catch {
+            return -1;
+        } };
+        const ledger = size(".jsonl");
+        if (size(".members.json") < 0)
+            return ledger > 0;
+        const al = new Allowlist(this.dataDir, safe);
+        return !al.hasToken && (!al.empty || ledger > 0);
+    }
     onHttp(req, res) {
         const url = new URL(req.url ?? "/", "http://x");
         const ip = clientIp(req);
@@ -298,11 +578,16 @@ export class Relay {
                 seq: s.ledger.head,
             });
             const asked = url.searchParams.get("space");
-            const one = asked ? this.spaces.get(asked) : undefined;
+            const one = asked ? this.live(asked) : undefined;
+            const sf = this.storageFailure && Date.now() - this.storageFailure.at < STORAGE_UNHEALTHY_MS ? this.storageFailure : null;
+            const commit = buildCommit();
             return this.json(res, 200, {
-                ok: true,
+                ok: !sf,
+                ...(sf ? { storage: { error: sf.message, where: sf.where, at: new Date(sf.at).toISOString() } } : {}),
                 v: PROTOCOL_VERSION,
                 pkg: VERSION,
+                ...(commit ? { commit } : {}),
+                ...(adminView && this.unbound.size ? { unbound_spaces: [...this.unbound].sort() } : {}),
                 space_count: this.spaces.size,
                 space_capacity: this.limits.maxSpaces,
                 ...(adminView ? { spaces: [...this.spaces.values()].map(detail) }
@@ -322,10 +607,12 @@ export class Relay {
                 : this.json(res, 404, { error: "no open invite matches that code — it may have been used already or expired" });
         }
         if (url.pathname === "/act") {
-            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
-            const token = url.searchParams.get("token") ?? "";
-            if (!space || !secretEq(space.token, token))
-                return this.json(res, 404, { error: "no such space" });
+            const gate = this.readGate(req, url, ip);
+            if (!gate.ok && gate.notice)
+                return this.upgradeAnswer(res, url.pathname, url, gate.notice, gate.error);
+            if (!gate.ok)
+                return this.json(res, gate.status, { error: gate.error, ...(gate.code ? { code: gate.code } : {}) });
+            const space = gate.space;
             const act = space.ledger.find(url.searchParams.get("id") ?? "");
             if (!act)
                 return this.json(res, 404, { error: "no such act" });
@@ -333,10 +620,12 @@ export class Relay {
             return this.json(res, 200, { act, ...(goal ? { goal: { id: goal.id, title: goal.title, state: goal.state } } : {}) });
         }
         if (url.pathname === "/history") {
-            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
-            const token = url.searchParams.get("token") ?? "";
-            if (!space || !secretEq(space.token, token))
-                return this.json(res, 404, { error: "no such space" });
+            const gate = this.readGate(req, url, ip);
+            if (!gate.ok && gate.notice)
+                return this.upgradeAnswer(res, url.pathname, url, gate.notice, gate.error);
+            if (!gate.ok)
+                return this.json(res, gate.status, { error: gate.error, ...(gate.code ? { code: gate.code } : {}) });
+            const space = gate.space;
             const goal = url.searchParams.get("goal");
             const sinceRaw = url.searchParams.get("since");
             const acts = goal ? space.ledger.byGoal(goal, LIMITS_GOAL_READ)
@@ -344,49 +633,67 @@ export class Relay {
             return this.json(res, 200, { acts, head: space.ledger.head });
         }
         if (url.pathname === "/obligations") {
-            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
-            const token = url.searchParams.get("token") ?? "";
-            if (!space || !secretEq(space.token, token))
-                return this.json(res, 404, { error: "no such space" });
+            const gate = this.readGate(req, url, ip);
+            if (!gate.ok && gate.notice)
+                return this.upgradeAnswer(res, url.pathname, url, gate.notice, gate.error);
+            if (!gate.ok)
+                return this.json(res, gate.status, { error: gate.error, ...(gate.code ? { code: gate.code } : {}) });
+            const space = gate.space;
             const member = url.searchParams.get("member");
             const now = Date.now();
             const owed = [...space.obligations.values()]
                 .filter((o) => (member ? o.owner === member : true))
-                .map((o) => ({ ...o, claimed: !!o.claimed_by && now - o.claimed_by.at < LIMITS.claimTtlMs }));
+                .map((o) => ({ ...o, claimed: !!o.claimed_by && this.claimHolds(space, o.claimed_by, now) }));
             const closed = [...space.goals.values()].filter((g) => g.state === "CLOSED").map((g) => g.id);
             const worker_online = member
                 ? [...(space.members.get(member)?.sessions.values() ?? [])].some((s) => s.role === "worker")
                 : false;
-            return this.json(res, 200, { obligations: owed, closed_goals: closed, seq: space.ledger.head, worker_online });
+            return this.json(res, 200, { obligations: owed, closed_goals: closed, seq: space.ledger.head, worker_online, space_id: space.allow.spaceId(), members: this.members(space) });
         }
         if (url.pathname === "/activity") {
             if (req.method !== "POST")
                 return this.json(res, 405, { error: "POST only" });
-            const space = this.spaceForRead(url.searchParams.get("space") ?? "", url.searchParams.get("token") ?? "");
-            const token = url.searchParams.get("token") ?? "";
-            if (!space || !secretEq(space.token, token))
+            const spaceName = url.searchParams.get("space") ?? "", spaceToken = url.searchParams.get("token") ?? "";
+            const target = this.readTarget(spaceName, spaceToken);
+            if (!target)
                 return this.json(res, 404, { error: "no such space" });
             const memberId = url.searchParams.get("member") ?? "";
-            const member = space.members.get(memberId);
             const session = (url.searchParams.get("session") ?? "").slice(0, 64);
             const state = url.searchParams.get("state");
-            if (!member || !session || (state !== "busy" && state !== "idle")) {
+            if (!memberId || !session || (state !== "busy" && state !== "idle")) {
                 return this.json(res, 400, { error: "member, session and state=busy|idle are required" });
             }
             const ts = Number(url.searchParams.get("ts"));
             const sig = url.searchParams.get("sig") ?? "";
             const seenParam = url.searchParams.get("seen") ?? "";
-            const pub = space.allow.pubkeyOf(memberId);
+            const pub = target.allow.pubkeyOf(memberId);
             const fresh = Number.isFinite(ts) && Math.abs(Date.now() - ts) < LIMITS.activityFreshMs;
-            if (!pub || !fresh || !verifyActivity(pub, space.name, memberId, session, state, seenParam, ts, sig)) {
+            if (!pub || !fresh || !verifyActivity(pub, spaceName, memberId, session, state, seenParam, ts, sig)) {
                 return this.json(res, 403, { error: "activity report must be signed by the member's key and recent" });
             }
+            if (this.requireAccounts && this.accounts && !this.localTrusted(ip)) {
+                const auth = this.accounts.authorize(pub, memberId);
+                if (!auth.ok) {
+                    return this.json(res, 403, { code: "NOT_SIGNED_IN", error: auth.reason === "suspended"
+                            ? "this account has been suspended by the relay operator"
+                            : "this device is not signed in to an account that may report here — run pantheon login" });
+                }
+            }
+            const space = target.live ?? this.getOrCreateSpace(spaceName, spaceToken, { retired: true });
+            if (!space)
+                return this.json(res, 404, { error: "no such space" });
+            const member = space.members.get(memberId);
+            if (!member)
+                return this.json(res, 400, { error: "member, session and state=busy|idle are required" });
             if (member.activity.size > 64 && !member.activity.has(session)) {
                 const oldest = [...member.activity.entries()].sort((a, b) => a[1].at - b[1].at)[0];
                 if (oldest)
                     member.activity.delete(oldest[0]);
             }
-            member.activity.set(session, { busy: state === "busy", at: Date.now() });
+            const prev = member.activity.get(session);
+            if (prev?.ts !== undefined && ts < prev.ts)
+                return this.json(res, 409, { error: "an activity report older than the last one from this session — ignored" });
+            member.activity.set(session, { busy: state === "busy", at: Date.now(), ts });
             const seen = Number(url.searchParams.get("seen"));
             if (Number.isFinite(seen) && seen > (member.seen_seq ?? 0))
                 member.seen_seq = seen;
@@ -437,7 +744,7 @@ export class Relay {
                     res.writeHead(429, { "content-type": "text/html; charset=utf-8", "retry-after": "60" });
                     return void res.end("<p>Too many attempts. Wait a minute and try again.</p>");
                 }
-                return this.readForm(req, (body) => {
+                return this.readForm(req, res, (body) => {
                     if (!tokenOk(body.token ?? "")) {
                         this.noteAdminFail(ip);
                         A0.audit({ event: "admin_login_failed", ip });
@@ -479,7 +786,7 @@ export class Relay {
             if (url.pathname === "/admin/action" && req.method === "POST") {
                 if (!authed)
                     return this.json(res, 403, { error: "sign in at /admin" });
-                return this.readForm(req, (body) => this.adminAction(res, A0, body, ip));
+                return this.readForm(req, res, (body) => this.adminAction(res, A0, body, ip));
             }
             if (url.pathname === "/admin/space") {
                 if (!authed)
@@ -498,7 +805,7 @@ export class Relay {
         if (url.pathname === "/auth/signup" && req.method === "POST") {
             if (!this.authRateOk(ip))
                 return this.json(res, 429, { error: "too many attempts from your network — wait a minute and try again" });
-            return this.readJson(req, async (b) => {
+            return this.readJson(req, res, async (b) => {
                 if (!b || typeof b.email !== "string" || typeof b.username !== "string" || typeof b.pubkey !== "string") {
                     return this.json(res, 400, { error: "email, username and pubkey are required" });
                 }
@@ -506,63 +813,74 @@ export class Relay {
                     return this.json(res, 400, { error: "that does not look like an email address" });
                 if (!validUsername(normalizeUsername(b.username)))
                     return this.json(res, 400, { error: "username must be 2–32 chars: letters, digits, . _ - (not at the ends)" });
+                const over = this.emailRefusal("signup", b.email, ip);
+                if (over)
+                    return this.json(res, 429, { error: over, reason: "email_budget" });
                 const started = A.startVerification(b.email, "signup", { username: b.username, pubkey: b.pubkey, label: String(b.label ?? "a device").slice(0, 60) });
                 if (!started.ok) {
                     if (started.reason === "blocked")
                         return this.json(res, 403, { error: "this email cannot sign up on this relay", reason: "blocked" });
+                    if (started.reason === "locked")
+                        return this.json(res, 429, { error: LOCKED_MSG, reason: started.reason });
                     const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute to resend"
-                        : started.reason === "in_progress_elsewhere" ? "a code for this email is already on its way to another device — use that one, or wait 10 minutes for it to expire"
-                            : started.reason === "username_taken" ? "that username is taken"
-                                : started.reason === "email_taken" ? "that email already has an account — use `pantheon login` from this machine instead"
+                        : started.reason === "username_taken" ? "that username is taken"
+                            : started.reason === "email_taken" ? "that email already has an account — use `pantheon login` from this machine instead"
+                                : started.reason === "device_other_account" ? DEVICE_OTHER_ACCOUNT
                                     : "check the email and username";
                     return this.json(res, 409, { error: msg, reason: started.reason });
                 }
                 A.audit({ event: "signup", target: normalizeUsername(b.username), ip });
-                if (!this.emailBudgetOk())
-                    return this.json(res, 429, { error: "the relay is sending too many codes right now — try again shortly" });
                 const sent = await this.email.sendCode(b.email, started.code, "signup");
                 if (sent)
-                    this.emailSends.push(Date.now());
+                    this.noteEmailSent("signup", b.email, ip);
                 return this.json(res, 200, { ok: true, sent, via: this.email.kind });
             });
         }
         if (url.pathname === "/auth/login" && req.method === "POST") {
             if (!this.authRateOk(ip))
                 return this.json(res, 429, { error: "too many attempts from your network — wait a minute and try again" });
-            return this.readJson(req, async (b) => {
+            return this.readJson(req, res, async (b) => {
                 if (!b || typeof b.email !== "string" || typeof b.pubkey !== "string")
                     return this.json(res, 400, { error: "email and pubkey are required" });
+                const own = A.isDeviceOf(b.email, b.pubkey);
+                const over = this.emailRefusal("login", b.email, ip, b.pubkey, own);
+                if (over)
+                    return this.json(res, 429, { error: over, reason: "email_budget" });
                 const started = A.startVerification(b.email, "login", { pubkey: b.pubkey, label: String(b.label ?? "a device").slice(0, 60) });
                 if (!started.ok && started.reason === "blocked")
                     return this.json(res, 403, { error: "this email cannot sign in on this relay", reason: "blocked" });
+                if (!started.ok && started.reason === "device_other_account")
+                    return this.json(res, 409, { error: DEVICE_OTHER_ACCOUNT, reason: started.reason });
                 if (!started.ok) {
-                    const code = started.reason === "too_soon" || started.reason === "in_progress_elsewhere" ? 429 : 404;
-                    const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute" : started.reason === "in_progress_elsewhere" ? "a code for this email is already on its way to another device — use that one, or wait 10 minutes for it to expire" : "no active account for that email — `pantheon signup` first";
+                    const code = started.reason === "too_soon" || started.reason === "locked" ? 429 : 404;
+                    const msg = started.reason === "too_soon" ? "a code was just sent — check your email, or wait a minute" : started.reason === "locked" ? LOCKED_MSG : "no active account for that email — `pantheon signup` first";
                     return this.json(res, code, { error: msg, reason: started.reason });
                 }
-                if (!this.emailBudgetOk())
-                    return this.json(res, 429, { error: "the relay is sending too many codes right now — try again shortly" });
                 const sent = await this.email.sendCode(b.email, started.code, "login");
                 if (sent)
-                    this.emailSends.push(Date.now());
+                    this.noteEmailSent("login", b.email, ip, b.pubkey, own);
                 return this.json(res, 200, { ok: true, sent, via: this.email.kind });
             });
         }
         if (url.pathname === "/auth/verify" && req.method === "POST") {
             if (!this.authRateOk(ip))
                 return this.json(res, 429, { error: "too many attempts from your network — wait a minute and try again" });
-            return this.readJson(req, (b) => {
+            return this.readJson(req, res, (b) => {
                 if (!b || typeof b.email !== "string" || typeof b.code !== "string")
                     return this.json(res, 400, { error: "email and code are required" });
-                const r = A.verify(b.email, b.code.trim(), ip, typeof b.pubkey === "string" ? b.pubkey : undefined);
+                const r = A.verify(b.email, b.code.trim(), ip, typeof b.pubkey === "string" ? b.pubkey : undefined, this.localTrusted(ip) ? null : netOf(ip));
                 if (!r.ok) {
                     const msg = r.reason === "expired" ? "that code has expired — request a new one"
                         : r.reason === "other_device" ? "that code was requested from a different device — request a new one from this one"
                             : r.reason === "suspended" ? "this account is suspended — contact the relay operator"
                                 : r.reason === "too_many_attempts" ? "too many wrong tries — request a new code"
-                                    : r.reason === "no_pending" ? "no code is pending for that email — run signup or login first"
-                                        : "that code is not right";
-                    return this.json(res, 400, { error: msg, reason: r.reason });
+                                    : r.reason === "locked" ? LOCKED_MSG
+                                        : r.reason === "several_pending" ? "codes for this email were asked for from more than one device, and this pantheon is too old to say which device it is — run  pantheon upgrade , then verify again"
+                                            : r.reason === "device_other_account" ? DEVICE_OTHER_ACCOUNT
+                                                : r.reason === "no_pending" ? "no code is pending for that email — run signup or login first"
+                                                    : r.tries_left === 0 ? "that code is not right, and it was the last try — request a new code"
+                                                        : `that code is not right — ${r.tries_left ?? "a few"} ${r.tries_left === 1 ? "try" : "tries"} left on it`;
+                    return this.json(res, 400, { error: msg, reason: r.reason, ...(r.tries_left !== undefined ? { tries_left: r.tries_left } : {}) });
                 }
                 return this.json(res, 200, { ok: true, account: { id: r.account.id, username: r.account.username, email: r.account.email }, session: r.session.id, device: r.device.id });
             });
@@ -587,8 +905,10 @@ export class Relay {
             const hit = A.revoke(who.account.id, kind, id, ip);
             for (const sid of hit.sessionIds)
                 this.dropSessionEverywhere(sid);
-            if (hit.deviceId)
+            if (hit.deviceId) {
                 this.dropDeviceSockets(who.account.id, hit.deviceId);
+                this.noteAccountRemoval(who.account.username);
+            }
             return this.json(res, 200, { ok: true, revoked: hit.sessionIds.length, device_removed: !!hit.deviceId });
         }
         if (url.pathname === "/account/delete" && req.method === "POST") {
@@ -599,6 +919,7 @@ export class Relay {
             A.deleteAccount(who.account.id, ip);
             for (const s of sessions)
                 this.dropSessionEverywhere(s.id);
+            this.noteAccountRemoval(who.account.username);
             return this.json(res, 200, { ok: true });
         }
         if (url.pathname === "/audit" && req.method === "GET") {
@@ -607,7 +928,7 @@ export class Relay {
                 return this.json(res, 403, { error: "this request must be signed by a device on the account" });
             const space = url.searchParams.get("space") ?? undefined;
             if (space) {
-                const sp = this.spaces.get(space);
+                const sp = this.live(space);
                 const member = sp?.allow.get(who.account.username);
                 if (!sp || !member?.admitted)
                     return this.json(res, 403, { error: "you are not a member of that space" });
@@ -675,11 +996,47 @@ export class Relay {
             }
         }
     }
-    emailBudgetOk() {
-        const now = Date.now();
-        this.emailSends = this.emailSends.filter((t) => now - t < 3_600_000);
+    emailRefusal(kind, email, ip, pubkey = "", own = false) {
+        const now = Date.now(), hour = 3_600_000;
+        const live = (v) => v.filter((t) => now - t < hour);
+        this.emailSends = this.emailSends.filter((s) => now - s.at < hour);
         const cap = Number(process.env.PANTHEON_EMAIL_MAX_PER_HOUR) || 200;
-        return this.emailSends.length < cap;
+        const reserved = Math.min(cap - 1, Math.max(0, Number(process.env.PANTHEON_EMAIL_RESERVED_PER_HOUR ?? Math.floor(cap / 4)) || 0));
+        const perAddress = Number(process.env.PANTHEON_EMAIL_MAX_PER_ADDRESS) || 5;
+        const perNet = Number(process.env.PANTHEON_EMAIL_MAX_PER_NETWORK) || 20;
+        if (live(this.emailSendsTo.get(this.emailBucket(email, pubkey, own)) ?? []).length >= perAddress) {
+            return own ? "this device has asked for too many codes in the last hour — use the latest one, or try again in an hour"
+                : "too many codes were sent to this address in the last hour — use the latest one, or try again in an hour";
+        }
+        if (!own && !this.localTrusted(ip) && live(this.emailSendsFrom.get(netOf(ip)) ?? []).length >= perNet)
+            return "too many codes were requested from your network in the last hour — try again later";
+        if (this.emailSends.length >= cap)
+            return "the relay is sending too many codes right now — try again shortly";
+        if (kind === "signup" && this.emailSends.filter((s) => s.signup).length >= cap - reserved)
+            return "the relay is taking too many new sign-ups right now — try again shortly";
+        return null;
+    }
+    emailBucket(email, pubkey, own) {
+        const to = email.trim().toLowerCase();
+        return own ? `${to}\u0000${pubkey}` : to;
+    }
+    noteEmailSent(kind, email, ip, pubkey = "", own = false) {
+        const now = Date.now(), hour = 3_600_000;
+        this.emailSends.push({ at: now, signup: kind === "signup" });
+        const bump = (m, k) => {
+            m.set(k, [...(m.get(k) ?? []).filter((t) => now - t < hour), now]);
+            if (m.size > 10_000)
+                for (const [key, v] of m) {
+                    const keep = v.filter((t) => now - t < hour);
+                    if (keep.length)
+                        m.set(key, keep);
+                    else
+                        m.delete(key);
+                }
+        };
+        bump(this.emailSendsTo, this.emailBucket(email, pubkey, own));
+        if (!own && !this.localTrusted(ip))
+            bump(this.emailSendsFrom, netOf(ip));
     }
     authRateOk(ip) {
         if (this.localTrusted(ip))
@@ -699,41 +1056,134 @@ export class Relay {
         }
         return recent.length <= 20;
     }
-    readJson(req, cb) {
-        let raw = "";
-        req.on("data", (c) => { raw += c; if (raw.length > 64_000)
-            req.destroy(); });
-        req.on("end", () => { try {
-            cb(raw ? JSON.parse(raw) : {});
+    readBody(req, res, limit, cb) {
+        const HARD = 4 * 1024 * 1024;
+        let done = false;
+        const tooBig = () => {
+            if (done)
+                return;
+            done = true;
+            if (!res.headersSent) {
+                res.setHeader("connection", "close");
+                this.json(res, 413, { error: `request body too large: the limit here is ${limit} bytes` });
+            }
+        };
+        const declared = Number(req.headers["content-length"]);
+        if (Number.isFinite(declared) && declared > HARD) {
+            tooBig();
+            req.resume();
+            res.on("finish", () => req.destroy());
+            return;
+        }
+        const chunks = [];
+        let size = 0, over = false;
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > HARD) {
+                tooBig();
+                res.on("finish", () => req.destroy());
+                return;
+            }
+            if (size > limit) {
+                over = true;
+                chunks.length = 0;
+                return;
+            }
+            if (!over)
+                chunks.push(Buffer.isBuffer(c) ? c : Buffer.from(c));
+        });
+        req.on("end", () => {
+            if (over)
+                return tooBig();
+            if (done)
+                return;
+            done = true;
+            cb(Buffer.concat(chunks).toString("utf8"));
+        });
+        req.on("error", () => { if (done)
+            return; done = true; cb(null); });
+    }
+    settle(res, r) {
+        if (r && typeof r.catch === "function") {
+            r.catch((e) => {
+                this.log(`! http handler failed: ${e?.message ?? e}`);
+                if (isStorageError(e))
+                    this.noteStorageFailure("http handler", e);
+                try {
+                    if (!res.headersSent)
+                        this.json(res, 500, { error: "the relay could not handle that request" });
+                    else
+                        res.end();
+                }
+                catch { }
+            });
         }
-        catch {
-            cb(null);
-        } });
-        req.on("error", () => cb(null));
+    }
+    readJson(req, res, cb) {
+        this.readBody(req, res, 64_000, (raw) => {
+            let body = null;
+            if (raw !== null) {
+                try {
+                    body = raw ? JSON.parse(raw) : {};
+                }
+                catch {
+                    body = null;
+                }
+            }
+            try {
+                this.settle(res, cb(body));
+            }
+            catch (e) {
+                this.settle(res, Promise.reject(e));
+            }
+        });
     }
     dropSessionEverywhere(sessionId) {
+        this.authEpoch++;
         for (const sp of this.spaces.values()) {
             for (const m of sp.members.values()) {
                 const s = m.sessions.get(sessionId);
                 if (s) {
-                    try {
-                        s.ws.close(1008, "SESSION_REVOKED");
-                    }
-                    catch { }
+                    this.hangUp(s.ws, "SESSION_REVOKED");
                     m.sessions.delete(sessionId);
                 }
             }
         }
     }
+    hangUp(ws, reason) {
+        try {
+            ws.close(1008, reason);
+        }
+        catch { }
+        const t = setTimeout(() => { try {
+            ws.terminate();
+        }
+        catch { } }, 100);
+        t.unref?.();
+    }
+    stillIn(sp, me, sessionId, ws) {
+        if (ws.readyState !== 1)
+            return false;
+        if (sp.deleted || this.spaces.get(spaceKey(sp.name)) !== sp)
+            return false;
+        if (sp.members.get(me.id) !== me || me.sessions.get(sessionId)?.ws !== ws)
+            return false;
+        return !!sp.allow.get(me.id)?.admitted;
+    }
     dropDeviceSockets(_accountId, _deviceId) {
     }
-    readForm(req, cb) {
-        let raw = "";
-        req.on("data", (c) => { raw += c; if (raw.length > 8_000)
-            req.destroy(); });
-        req.on("end", () => { const o = {}; for (const [k, v] of new URLSearchParams(raw))
-            o[k] = v; cb(o); });
-        req.on("error", () => cb({}));
+    readForm(req, res, cb) {
+        this.readBody(req, res, 8_000, (raw) => {
+            const o = {};
+            for (const [k, v] of new URLSearchParams(raw ?? ""))
+                o[k] = v;
+            try {
+                this.settle(res, cb(o));
+            }
+            catch (e) {
+                this.settle(res, Promise.reject(e));
+            }
+        });
     }
     adminLoginPage(res, wrong) {
         res.writeHead(wrong ? 401 : 200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "referrer-policy": "no-referrer" });
@@ -785,7 +1235,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
             if (exact(sp.allow))
                 return sp.name;
         const safeOf = (name) => name.replace(/[^a-z0-9._-]/gi, "_");
-        const live = new Set([...this.spaces.keys()].map(safeOf));
+        const live = new Set(this.spaces.keys());
         let files = [];
         try {
             files = readdirSync(this.dataDir);
@@ -797,7 +1247,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
             if (!f.endsWith(".members.json"))
                 continue;
             const safe = f.slice(0, -".members.json".length);
-            if (live.has(safe))
+            if (live.has(safe.toLowerCase()))
                 continue;
             try {
                 if (!exact(new Allowlist(this.dataDir, safe)))
@@ -939,28 +1389,27 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         return { goals, refusals: st.refusals };
     }
     deleteSpace(name) {
-        const sp = this.spaces.get(name);
+        const sp = this.spaces.get(spaceKey(name));
         if (sp) {
             sp.deleted = true;
             for (const m of sp.members.values())
-                for (const s of m.sessions.values()) {
-                    try {
-                        s.ws.close(1008, "SPACE_DELETED");
-                    }
-                    catch { }
-                }
-            this.spaces.delete(name);
+                for (const s of m.sessions.values())
+                    this.hangUp(s.ws, "SPACE_DELETED");
+            this.spaces.delete(spaceKey(name));
         }
         setTimeout(() => this.deleteSpaceFiles(name), 600).unref?.();
         const safe = name.replace(/[^a-z0-9._-]/gi, "_");
         try {
             const hash = sp?.allow ? JSON.parse(readFileSync(join(this.dataDir, `${safe}.members.json`), "utf8")).tokenHash ?? null : null;
-            writeFileSync(join(this.dataDir, `${safe}.deleted.json`), JSON.stringify({ name, at: Date.now(), tokenHash: hash }));
+            const earlier = sp?.allow ? sp.allow.tokenHashes().filter((h) => h !== hash) : [];
+            writeFileSync(join(this.dataDir, `${safe}.deleted.json`), JSON.stringify({ name, at: Date.now(), tokenHash: hash, ...(earlier.length ? { retiredTokenHashes: earlier } : {}) }));
+            this.tombstoneFile(name);
+            this.tombstoneStems.set(spaceKey(name), safe);
         }
         catch { }
         const existed = !!sp || [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
         this.deleteSpaceFiles(name);
-        this.deletedSpaces.set(name, Date.now());
+        this.deletedSpaces.set(spaceKey(name), Date.now());
         if (this.deletedSpaces.size > 1000)
             for (const [k, t] of this.deletedSpaces)
                 if (Date.now() - t > 3_600_000)
@@ -980,14 +1429,17 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
                     return this.json(res, 404, { error: "no such account" });
                 const live = A.sessionsFor(acct.id).filter((s) => !s.revoked_at);
                 A.setStatus(acct.id, act === "suspend" ? "suspended" : "active", ip);
-                if (act === "suspend")
+                this.authEpoch++;
+                if (act === "suspend") {
                     for (const s of live)
                         this.dropSessionEverywhere(s.id);
+                    this.noteAccountRemoval(acct.username);
+                }
                 this.log(`[admin] ${act} ${acct.username} from ${ip}`);
                 return done(`${acct.username} ${act === "suspend" ? "suspended and signed out everywhere" : "reinstated"}`);
             }
             case "revoke_invite": {
-                const sp = this.spaces.get(id);
+                const sp = this.spaces.get(spaceKey(id));
                 const allow = sp ? sp.allow : new Allowlist(this.dataDir, id.replace(/[^a-z0-9._-]/gi, "_"));
                 const token = (body.token ?? "").trim();
                 const inv = allow.findInvite(token);
@@ -1004,8 +1456,12 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
                 const hit = A.adminRevoke(act === "revoke_session" ? "session" : "device", id, ip);
                 for (const sid of hit.sessionIds)
                     this.dropSessionEverywhere(sid);
-                if (hit.deviceId && hit.accountId)
+                if (hit.deviceId && hit.accountId) {
                     this.dropDeviceSockets(hit.accountId, hit.deviceId);
+                    const owner = A.accountById(hit.accountId);
+                    if (owner)
+                        this.noteAccountRemoval(owner.username);
+                }
                 return done(hit.sessionIds.length || hit.deviceId ? `revoked ${act === "revoke_session" ? "session" : "device"} ${id}` : `nothing to revoke for ${id}`);
             }
             case "block": {
@@ -1091,28 +1547,220 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
             default: return this.json(res, 400, { error: `unknown action "${act}"` });
         }
     }
-    spaceForRead(name, token) {
-        const live = this.spaces.get(name);
-        if (live)
-            return secretEq(live.token, token) ? live : null;
-        if (!name || !token || !this.spaceOnDisk(name))
+    readTarget(name, token) {
+        if (!name || !token)
             return null;
-        if (new Allowlist(this.dataDir, safeName(name)).tokenMatches(token) !== true)
+        const live = this.live(name);
+        if (live) {
+            const st = this.tokenState(live, token);
+            return st ? { live, allow: live.allow, st } : null;
+        }
+        if (this.aliasOf(name) || !this.spaceOnDisk(name))
             return null;
-        return this.getOrCreateSpace(name, token);
+        const allow = new Allowlist(this.dataDir, safeName(name));
+        const st = allow.tokenMatches(token) === true ? "current" : allow.tokenRetired(token) ? "retired" : null;
+        return st ? { live: undefined, allow, st } : null;
+    }
+    unsignedRefusal(name, allow, st) {
+        if (this.readsMode === "signed")
+            return "This relay serves only signed reads.";
+        if (allow.removalRecorded())
+            return `"${name}" has removed a member, so it serves only signed reads.`;
+        if (st !== "current")
+            return `"${name}" has a new token since this machine last connected, so it serves this read only signed.`;
+        return null;
+    }
+    upgradeAct(name, seq, goal, why) {
+        return {
+            id: UPGRADE_NOTE_ID, seq, ts: Date.now(), space: name, from: RELAY_MEMBER, act: "NOTE",
+            body: `${UPGRADE_NOTE}\n${why}`, to: null, goal, ref: null, meta: { notice: "upgrade_required" },
+        };
+    }
+    upgradeAnswer(res, path, url, n, error) {
+        const since = url.searchParams.get("since");
+        const seq = since !== null ? Math.max(0, Math.min(n.head, Number(since) || 0)) : n.head;
+        const act = this.upgradeAct(n.name, seq, url.searchParams.get("goal"), n.why);
+        const common = { code: "UPGRADE_REQUIRED", error, note: UPGRADE_NOTE };
+        if (path === "/act")
+            return this.json(res, 200, { act, ...common });
+        if (path === "/obligations")
+            return this.json(res, 200, { obligations: [], closed_goals: [], seq: n.head, worker_online: false, ...common });
+        if (since !== null && Number(since) >= n.head)
+            return this.json(res, 200, { acts: [], head: n.head, ...common });
+        return this.json(res, 200, { acts: [act], head: n.head, ...common });
+    }
+    tokenState(sp, token) {
+        if (!token)
+            return null;
+        if (sp.token && secretEq(sp.token, token))
+            return "current";
+        if (sp.allow.tokenMatches(token) === true) {
+            sp.token = token;
+            this.handTokenToWaiting(sp);
+            return "current";
+        }
+        return sp.allow.tokenRetired(token) ? "retired" : null;
+    }
+    knownToken(sp) {
+        if (!sp.token) {
+            const t = sp.allow.currentTokenFromInvites();
+            if (t)
+                sp.token = t;
+        }
+        return sp.token;
+    }
+    handTokenToWaiting(sp) {
+        for (const m of sp.members.values()) {
+            if (!sp.allow.get(m.id)?.admitted)
+                continue;
+            for (const s of m.sessions.values())
+                if (s.wantsToken) {
+                    s.wantsToken = false;
+                    this.send(s.ws, { t: "token", token: sp.token });
+                }
+        }
+    }
+    ensureToken(sp) {
+        if (!this.knownToken(sp))
+            this.rotateSpaceToken(sp, "its current token was not in memory");
+        return sp.token;
+    }
+    rotateSpaceToken(sp, why) {
+        const next = randomBytes(16).toString("hex");
+        sp.allow.rotateToken(next);
+        sp.token = next;
+        let told = 0;
+        for (const m of sp.members.values()) {
+            if (!sp.allow.get(m.id)?.admitted)
+                continue;
+            for (const s of m.sessions.values()) {
+                this.send(s.ws, { t: "token", token: next });
+                told++;
+            }
+        }
+        this.log(`[${sp.name}] * space token rotated (${why}); sent to ${told} live session${told === 1 ? "" : "s"}`);
+    }
+    noteAccountRemoval(username) {
+        this.authEpoch++;
+        const u = normalizeUsername(username);
+        const seen = new Set();
+        for (const sp of this.spaces.values()) {
+            seen.add(safeName(sp.name));
+            if (sp.allow.get(u))
+                sp.allow.noteRemoval();
+        }
+        let files = [];
+        try {
+            files = readdirSync(this.dataDir).filter((f) => f.endsWith(".members.json"));
+        }
+        catch { }
+        for (const f of files) {
+            const stem = f.slice(0, -".members.json".length);
+            if (seen.has(stem))
+                continue;
+            try {
+                const al = new Allowlist(this.dataDir, stem);
+                if (al.get(u))
+                    al.noteRemoval();
+            }
+            catch { }
+        }
+    }
+    readGate(req, url, ip) {
+        const params = {};
+        for (const [k, v] of url.searchParams) {
+            if (k in params)
+                return { ok: false, status: 400, error: `the query names "${k}" twice` };
+            params[k] = v;
+        }
+        const name = params.space ?? "", token = params.token ?? "";
+        const upgrade = (why) => ({
+            ok: false, status: 401, code: "UPGRADE_REQUIRED",
+            error: `${why} This pantheon is too old to read it: run  pantheon upgrade  (or npm i -g @join-pantheon/cli), then try again.`,
+        });
+        const target = this.readTarget(name, token);
+        if (params.sig === undefined) {
+            if (!target)
+                return this.readsMode === "signed" ? upgrade("This relay serves only signed reads.") : { ok: false, status: 404, error: "no such space" };
+            const why = this.unsignedRefusal(name, target.allow, target.st);
+            if (why) {
+                const head = target.live ? target.live.ledger.head : ledgerTailSeq(join(this.dataDir, `${safeName(name)}.jsonl`));
+                return { ...upgrade(why), notice: { name, head, why } };
+            }
+            const space = target.live ?? this.getOrCreateSpace(name, token);
+            if (!space)
+                return { ok: false, status: 404, error: "no such space" };
+            return { ok: true, space, reader: null };
+        }
+        if (!target)
+            return { ok: false, status: 404, error: "no such space" };
+        const reader = params.reader ?? "";
+        const ts = Number(params.ts);
+        const refused = { ok: false, status: 403, error: "a read must be signed, recently, by the key of a member admitted to this team" };
+        const pub = reader ? target.allow.pubkeyOf(reader) : null;
+        if (!pub || !Number.isFinite(ts) || Math.abs(Date.now() - ts) >= LIMITS.activityFreshMs)
+            return refused;
+        const { sig, ...signed } = params;
+        let signer = pub;
+        if (signed.dpub) {
+            const cert = { pub: signed.dpub, run: signed.drun ?? "", expires: Number(signed.dexp), sig: signed.dcert ?? "" };
+            if (![target.allow.spaceId(), name].some((t) => t && verifyDelegate(pub, t, reader, cert)))
+                return refused;
+            signer = signed.dpub;
+        }
+        if (!verifyRead(signer, req.method ?? "GET", url.pathname, signed, sig))
+            return refused;
+        if (this.requireAccounts && this.accounts && !this.localTrusted(ip)) {
+            const auth = this.accounts.authorize(pub, reader);
+            if (!auth.ok) {
+                return { ok: false, status: 403, code: "NOT_SIGNED_IN", error: auth.reason === "suspended"
+                        ? "this account has been suspended by the relay operator"
+                        : "this device is not signed in to an account that may read here — run pantheon login" };
+            }
+        }
+        const space = target.live ?? this.getOrCreateSpace(name, token, { retired: true });
+        if (!space)
+            return { ok: false, status: 404, error: "no such space" };
+        return { ok: true, space, reader };
+    }
+    tombstoneStems = null;
+    tombstoneFile(name) {
+        if (!this.tombstoneStems) {
+            this.tombstoneStems = new Map();
+            try {
+                for (const f of readdirSync(this.dataDir)) {
+                    if (!f.endsWith(".deleted.json"))
+                        continue;
+                    const stem = f.slice(0, -".deleted.json".length);
+                    this.tombstoneStems.set(stem.toLowerCase(), stem);
+                }
+            }
+            catch { }
+        }
+        const stem = this.tombstoneStems.get(spaceKey(name));
+        return stem ? join(this.dataDir, `${stem}.deleted.json`) : null;
     }
     tombstone(name, _token) {
+        const f = this.tombstoneFile(name);
+        if (!f)
+            return null;
         try {
-            return JSON.parse(readFileSync(join(this.dataDir, `${safeName(name)}.deleted.json`), "utf8")).at;
+            return JSON.parse(readFileSync(f, "utf8")).at;
         }
         catch {
             return null;
         }
     }
     tombstoneMatches(name, token) {
+        const f = this.tombstoneFile(name);
+        if (!f)
+            return false;
         try {
-            const t = JSON.parse(readFileSync(join(this.dataDir, `${safeName(name)}.deleted.json`), "utf8"));
-            return !!t.tokenHash && !!token && createHash("sha256").update(token).digest("hex") === t.tokenHash;
+            const t = JSON.parse(readFileSync(f, "utf8"));
+            if (!token)
+                return false;
+            const h = createHash("sha256").update(token).digest("hex");
+            return (!!t.tokenHash && h === t.tokenHash) || (Array.isArray(t.retiredTokenHashes) && t.retiredTokenHashes.includes(h));
         }
         catch {
             return false;
@@ -1130,20 +1778,50 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
     spaceOnDisk(name) {
         return existsSync(join(this.dataDir, `${name.replace(/[^a-z0-9._-]/gi, "_")}.members.json`));
     }
+    live(name) {
+        const sp = this.spaces.get(spaceKey(name));
+        return sp && sp.name === name ? sp : undefined;
+    }
+    aliasOf(name) {
+        const sp = this.spaces.get(spaceKey(name));
+        if (sp)
+            return sp.name !== name;
+        if (!name || !this.spaceOnDisk(name))
+            return false;
+        const stem = safeName(name);
+        try {
+            if (!readdirSync(this.dataDir).includes(`${stem}.members.json`))
+                return true;
+        }
+        catch { }
+        const recorded = this.recordedName(stem);
+        return recorded !== null && recorded !== name;
+    }
+    recordedName(stem) {
+        try {
+            const n = new Allowlist(this.dataDir, stem).recordedName();
+            if (n)
+                return n;
+        }
+        catch { }
+        return firstLedgerName(join(this.dataDir, `${stem}.jsonl`));
+    }
     spacePlan(name) {
         if (!this.accounts)
             return null;
         const owner = this.accounts.spaceOwner(name);
-        if (!owner)
-            return null;
-        return { name: owner.plan, limits: this.accounts.limitsFor(owner), owner };
+        if (owner)
+            return { name: owner.plan, limits: this.accounts.limitsFor(owner), owner };
+        if (this.accounts.spaceOrphaned(name))
+            return { name: "free", limits: planLimits(this.accounts.plans(), "free"), owner: null };
+        return null;
     }
     planView(acct, sp) {
         const fresh = this.accounts?.accountById(acct.id) ?? acct;
         return { name: fresh.plan, limits: this.accounts.limitsFor(fresh), usage: { spaces: this.accounts.spacesOwned(fresh.id).length, members: sp.allow.admittedCount() } };
     }
     planRefusal(space, plan, target, msg, cid, fail, actor, ip) {
-        this.accounts?.audit({ event: "plan_limit", actor_account: actor ?? plan.owner.id, space: space.name, target, detail: `${plan.name}: ${msg.slice(0, 160)}`, ip });
+        this.accounts?.audit({ event: "plan_limit", actor_account: actor ?? plan.owner?.id ?? null, space: space.name, target, detail: `${plan.name}: ${msg.slice(0, 160)}`, ip });
         this.log(`[${space.name}] ! PLAN_LIMIT (${target}, ${plan.name} plan)`);
         fail("PLAN_LIMIT", msg, cid);
     }
@@ -1200,7 +1878,7 @@ button:hover{background:#1d4ed8}.err{color:var(--bad);margin-top:12px}
         for (const d of devices)
             devByAcct.set(d.account_id, (devByAcct.get(d.account_id) ?? 0) + 1);
         const emailCap = Number(process.env.PANTHEON_EMAIL_MAX_PER_HOUR) || 200;
-        const emailsHour = this.emailSends.filter((t) => Date.now() - t < 3_600_000).length;
+        const emailsHour = this.emailSends.filter((s) => Date.now() - s.at < 3_600_000).length;
         let snapshots = [];
         try {
             snapshots = readdirSync(join(this.dataDir, "backups")).filter((f) => f.startsWith("accounts-") && f.endsWith(".db")).sort();
@@ -1380,8 +2058,8 @@ ${done ? `<div class=done role=status>${esc(done)}</div>` : ""}
     }
     adminSpace(res, url, name) {
         const safe = name.replace(/[^a-z0-9._-]/gi, "_");
-        const sp = this.spaces.get(name) ?? null;
-        const tomb = this.deletedSpaces.get(name);
+        const sp = this.spaces.get(spaceKey(name)) ?? null;
+        const tomb = this.deletedSpaces.get(spaceKey(name));
         const onDisk = [".jsonl", ".state.json", ".members.json"].some((suf) => existsSync(join(this.dataDir, `${safe}${suf}`)));
         if (!name || (!sp && (!onDisk || (tomb && Date.now() - tomb < 3_600_000))))
             return this.json(res, 404, { error: `no space "${name}" on this relay` });
@@ -1563,7 +2241,12 @@ ${url.searchParams.get("done") ? `<div class=done role=status>${esc(url.searchPa
             return void res.end(JSON.stringify(data, null, 2));
         }
         const cols = data.length ? Object.keys(data[0]) : [];
-        const cell = (v) => { const s = String(v ?? ""); return /[",\n]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s; };
+        const cell = (v) => {
+            let s = String(v ?? "");
+            if (/^[=+\-@\t\r]/.test(s))
+                s = `'${s}`;
+            return /[",\n\r]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s;
+        };
         const csv = [cols.join(","), ...data.map((r) => cols.map((k) => cell(r[k])).join(","))].join("\n");
         res.writeHead(200, { "content-type": "text/csv", "content-disposition": `attachment; filename="${table}.csv"` });
         res.end(csv);
@@ -1628,22 +2311,60 @@ pantheon signup --email you@work.com --username you</code></pre>
         const touch = () => {
             if (dbSession && Date.now() - lastTouch > 60_000) {
                 lastTouch = Date.now();
-                this.accounts?.touchSession(dbSession);
+                try {
+                    this.accounts?.touchSession(dbSession);
+                }
+                catch (e) {
+                    this.noteStorageFailure("session touch", e);
+                }
             }
         };
         let sessionId = "";
         let role = "interactive";
+        let myPubkey = "";
+        let delegated = null;
+        let authEpoch = -1, authOk = true;
         let lastMsg = "";
         let alive = true;
         const nonce = newNonce();
+        const accountStillOk = () => {
+            if (!acct || !this.accounts)
+                return true;
+            if (authEpoch !== this.authEpoch) {
+                authEpoch = this.authEpoch;
+                try {
+                    authOk = this.accounts.authorize(myPubkey, me?.id ?? "").ok;
+                }
+                catch {
+                    authOk = false;
+                }
+            }
+            return authOk;
+        };
         ws.on("pong", () => { alive = true; touch(); });
         const probe = ws;
         probe._alive = () => alive;
         probe._clear = () => { alive = false; };
+        let refusalStamps = [];
+        let refusedOut = false;
         const fail = (code, message, cid) => {
+            if (refusedOut)
+                return;
+            const now = Date.now();
+            refusalStamps.push(now);
+            if (refusalStamps.length > REFUSAL_BUDGET) {
+                refusalStamps = refusalStamps.filter((t) => now - t < REFUSAL_WINDOW_MS);
+                if (refusalStamps.length > REFUSAL_BUDGET) {
+                    refusedOut = true;
+                    this.log(`[${space?.name ?? "?"}] ! ${me?.id ?? "an unauthenticated socket"} closed: ${refusalStamps.length} refused requests in ${REFUSAL_WINDOW_MS / 1000}s`);
+                    this.send(ws, { t: "error", code: "TOO_MANY_REFUSALS", message: `this connection had ${REFUSAL_BUDGET} requests refused within ${REFUSAL_WINDOW_MS / 1000}s, so the relay closed it. Reconnect, and fix the request that keeps being refused (the last one: ${code}).` });
+                    this.hangUp(ws, "TOO_MANY_REFUSALS");
+                    return;
+                }
+            }
             if (cid && space && me && !space.deleted) {
-                noteRefusal(space.store.refusals, { ts: Date.now(), member: me.id, act: lastMsg || "?", code });
-                space.store.flush(space.goals, space.obligations, space.profiles);
+                noteRefusal(space.store.refusals, { ts: now, member: me.id, act: lastMsg || "?", code });
+                space.store.save(space.goals, space.obligations, space.profiles);
             }
             this.send(ws, { t: "error", code, message, ...(cid ? { cid } : {}) });
         };
@@ -1667,8 +2388,11 @@ pantheon signup --email you@work.com --username you</code></pre>
             helloTimer = null;
         } };
         ws.on("close", clearHelloTimer);
-        this.send(ws, { t: "challenge", nonce, v: PROTOCOL_VERSION });
+        this.send(ws, { t: "challenge", nonce, v: PROTOCOL_VERSION, features: [...this.features] });
         ws.on("message", (raw) => {
+            if (refusedOut)
+                return;
+            let reqCid;
             try {
                 let msg;
                 try {
@@ -1677,6 +2401,8 @@ pantheon signup --email you@work.com --username you</code></pre>
                 catch {
                     return fail("BAD_JSON", "message was not JSON");
                 }
+                if (typeof msg?.cid === "string")
+                    reqCid = (msg.cid).slice(0, 64);
                 const parsed = Inbound.safeParse(msg);
                 if (!parsed.success) {
                     const cid = typeof msg?.cid === "string"
@@ -1695,32 +2421,42 @@ pantheon signup --email you@work.com --username you</code></pre>
                         return reject("BAD_NONCE", "challenge mismatch — reconnect");
                     if (!m.token && !m.enroll)
                         return reject("NO_CREDENTIAL", "present either a space token or an invite");
-                    if (!verifyChallenge(m.pubkey, m.space, m.member, m.nonce, m.sig)) {
+                    if (m.delegate && !this.features.includes("delegate"))
+                        return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
+                    if (m.delegate && m.enroll)
+                        return reject("BAD_DELEGATE", "a woken run cannot redeem an invite");
+                    if (!verifyChallenge(m.delegate ? m.delegate.pub : m.pubkey, m.space, m.member, m.nonce, m.sig)) {
                         return reject("BAD_SIGNATURE", `signature does not match the presented key for "${m.member}"`);
                     }
                     const gated = this.requireAccounts && !!this.accounts && !this.localTrusted(ip);
                     const pre = gated ? this.accounts.authorize(m.pubkey, m.member) : null;
                     let sp;
+                    let staleToken = false;
                     if (m.enroll) {
-                        sp = this.spaces.get(m.space) ?? null;
+                        sp = this.live(m.space) ?? null;
+                        if (!sp && this.aliasOf(m.space))
+                            return reject("NO_SUCH_SPACE", `no space "${m.space}" on this relay`);
                         if (!sp && this.spaceOnDisk(m.space)) {
                             const inv = new Allowlist(this.dataDir, safeName(m.space)).findInvite(m.enroll);
                             if (inv?.token === m.enroll && inv.space_token)
-                                sp = this.getOrCreateSpace(m.space, inv.space_token);
+                                sp = this.getOrCreateSpace(m.space, inv.space_token, { claim: "invite", retired: true });
                         }
                         if (!sp)
                             return reject("NO_SUCH_SPACE", `no space "${m.space}" on this relay`);
                     }
                     else {
-                        const tomb = this.deletedSpaces.get(m.space) ?? this.tombstone(m.space, m.token ?? "");
+                        const tomb = this.deletedSpaces.get(spaceKey(m.space)) ?? this.tombstone(m.space, m.token ?? "");
                         if (tomb && Date.now() - tomb < 3_600_000 || (tomb && this.tombstoneMatches(m.space, m.token ?? ""))) {
                             return reject("SPACE_DELETED", `the space "${m.space}" was removed by the relay operator. Start a new one with a different name, or contact them.`);
                         }
-                        const isNew = !this.spaces.has(m.space) && !this.spaceOnDisk(m.space);
+                        if (this.aliasOf(m.space)) {
+                            return reject("NAME_TAKEN", `a team with a name too close to "${m.space}" already exists here — use its exact name, or pick another`);
+                        }
+                        const isNew = !this.live(m.space) && !this.spaceOnDisk(m.space);
                         if (isNew && this.nameCollides(m.space)) {
                             return reject("NAME_TAKEN", `a team with a name too close to "${m.space}" already exists here — pick another name`);
                         }
-                        if (!this.spaces.has(m.space)) {
+                        if (!this.live(m.space)) {
                             const denied = this.mayCreateSpace(ip);
                             if (denied)
                                 return reject(denied.code, denied.message);
@@ -1739,9 +2475,19 @@ pantheon signup --email you@work.com --username you</code></pre>
                                 return reject("PLAN_LIMIT", msg);
                             }
                         }
-                        sp = this.getOrCreateSpace(m.space, m.token);
+                        if (!this.live(m.space) && this.unboundOnDisk(safeName(m.space))) {
+                            const e = this.spaceOnDisk(m.space) ? new Allowlist(this.dataDir, safeName(m.space)).get(m.member) : undefined;
+                            if (!e?.admitted || e.publicKey !== m.pubkey) {
+                                this.unbound.add(safeName(m.space));
+                                this.log(`[${m.space}] ! REFUSED ${m.member}: the space has no bound token, and only an admitted member of it (with their key) may bind one`);
+                                return reject("UNBOUND_SPACE", `"${m.space}" was created before this relay kept a space's token, so it can only be reopened by one of its admitted members, from their own machine. ` +
+                                    `If you are one, connect with your own identity; otherwise ask a member of "${m.space}" for an invite, or the relay operator.`);
+                            }
+                        }
+                        sp = this.getOrCreateSpace(m.space, m.token, { claim: { member: m.member, pubkey: m.pubkey }, retired: true });
                         if (!sp)
                             return reject("BAD_TOKEN", "wrong token for this space");
+                        staleToken = this.tokenState(sp, m.token) === "retired";
                         if (isNew) {
                             this.noteSpaceCreate(ip);
                             this.accounts?.recordSpace(sp.name, pre?.ok ? pre.account.id : null);
@@ -1770,20 +2516,38 @@ pantheon signup --email you@work.com --username you</code></pre>
                         const plan = this.spacePlan(sp.name);
                         if (plan && !sp.allow.get(m.member)?.admitted && sp.allow.admittedCount() >= plan.limits.members) {
                             this.accounts?.audit({ event: "plan_limit", actor_account: acct?.id ?? null, space: sp.name, target: "join", detail: `${plan.name}: ${sp.allow.admittedCount()}/${plan.limits.members} people`, ip });
-                            return reject("PLAN_LIMIT", `"${sp.name}" is full: its owner's ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. Ask ${plan.owner.username} to upgrade at https://www.joinpantheon.network`);
+                            return reject("PLAN_LIMIT", `"${sp.name}" is full: its owner's ${plan.name} plan allows ${fmtLimit(plan.limits.members)} people. ${plan.owner ? `Ask ${plan.owner.username} to upgrade at https://www.joinpantheon.network` : "Its owner's account was deleted; the relay operator can move it to another plan."}`);
                         }
                         const r = sp.allow.redeem(m.enroll, m.member, m.pubkey);
                         if (!r.ok) {
                             this.log(`[${sp.name}] ! invite refused for ${m.member}: ${r.why}`);
                             return reject("BAD_INVITE", r.fix ? `${r.why}\n${r.fix}` : r.why);
                         }
-                        enrolled = sp.token;
+                        enrolled = this.ensureToken(sp);
                         this.log(`[${sp.name}] * ENROLLED ${m.member} via invite from ${r.entry.admitted_by}${r.entry.may_wake ? " (may wake)" : ""}`);
                     }
+                    if (staleToken && !enrolled) {
+                        const e = sp.allow.get(m.member);
+                        if (e && e.publicKey === m.pubkey && !e.admitted && e.revoked_at) {
+                            this.log(`[${sp.name}] ! REFUSED ${m.member}: removed (earlier token)`);
+                            return reject("REVOKED", `"${m.member}" was removed from "${sp.name}"${e.revoked_by ? ` by ${e.revoked_by}` : ""}. Only a member of the team can let you back in (pantheon admit ${m.member}); until then this machine cannot read or send in it.`);
+                        }
+                        if (!e || e.publicKey !== m.pubkey || !e.admitted) {
+                            this.log(`[${sp.name}] ! REFUSED ${m.member}: an earlier token, and not an admitted member with this key`);
+                            return reject("BAD_TOKEN", "wrong token for this space — this team's token has changed since, and only its admitted members are handed the new one. Ask a member for a fresh invite.");
+                        }
+                    }
+                    if (m.member.toLowerCase() === RELAY_MEMBER && !sp.allow.get(m.member)) {
+                        return reject("RESERVED_NAME", `"${m.member}" is the name the relay itself speaks as — choose another name`);
+                    }
                     const verdict = enrolled ? "ok" : sp.allow.present(m.member, m.pubkey);
+                    if (verdict === "pending-full") {
+                        this.log(`[${sp.name}] ! REFUSED ${m.member}: too many names already waiting to be admitted`);
+                        return reject("PENDING_FULL", `"${sp.name}" already has too many names waiting to be admitted. Ask a member to admit you by invite instead (pantheon invite), or to clear the waiting list.`);
+                    }
                     if (verdict === "key-mismatch") {
                         this.log(`[${sp.name}] ! REFUSED ${m.member}: key mismatch (${fingerprint(m.pubkey)})`);
-                        return reject("KEY_MISMATCH", `"${m.member}" is already registered here with a different key — another machine, or this one before its key was replaced. If this is really you, an admitted member runs  pantheon admit ${m.member} --forget  and sends you a new invite.`);
+                        return reject("KEY_MISMATCH", `"${m.member}" is already registered here with a different key. If you are someone else, join under your own name (--me <your-name>). If this is really you on another machine, an admitted member who has checked it is you runs  pantheon admit ${m.member} --forget  (it removes whoever holds the name now) and sends you a new invite.`);
                     }
                     if (verdict === "revoked") {
                         const e = sp.allow.get(m.member);
@@ -1809,16 +2573,24 @@ pantheon signup --email you@work.com --username you</code></pre>
                             newRepo = m.repo;
                         else {
                             const known = sp.allow.repoList().map((r) => r.origin ?? r.fingerprint).join(", ");
-                            this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${m.repo_origin ?? m.repo} not bound to this space`);
+                            this.log(`[${sp.name}] ! REFUSED ${m.member}: repo ${repoLabelSafe(m.repo_origin) ?? m.repo} not bound to this space`);
                             return reject("REPO_MISMATCH", `this checkout (${m.repo_origin ?? "no origin"}) is not one of the repos "${sp.name}" works from (${known || "none yet"}). ` +
                                 `Open your agent in the team's repo, or if this repo really belongs to the team: pantheon repo add`);
                         }
                     }
+                    if (m.delegate) {
+                        const teamIds = [sp.allow.spaceId(), sp.name];
+                        if (!teamIds.some((t) => verifyDelegate(m.pubkey, t, m.member, m.delegate))) {
+                            return reject("BAD_DELEGATE", `that run key is not vouched for by ${m.member}'s key for "${sp.name}", or its certificate has expired`);
+                        }
+                        delegated = { pub: m.delegate.pub, run: m.delegate.run, expires: m.delegate.expires };
+                    }
                     space = sp;
+                    myPubkey = m.pubkey;
                     clearHelloTimer();
                     sessionId = acctSession ?? this.mintSession();
-                    role = m.role;
-                    me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, m.role, ws, m.pkg);
+                    role = delegated ? "worker" : m.role;
+                    me = this.attach(sp, m.member, m.display ?? m.member, m.agent ?? "unknown", sessionId, role, ws, m.pkg);
                     const firstSession = me.sessions.size === 1;
                     const prior = typeof m.session === "string" ? m.session : "";
                     const stale = prior && prior !== sessionId ? me.sessions.get(prior) : undefined;
@@ -1846,19 +2618,25 @@ pantheon signup --email you@work.com --username you</code></pre>
                             this.pushObligations(sp);
                     }
                     sp.lastTouch = Date.now();
-                    if (newRepo && sp.allow.addRepo(newRepo, m.repo_origin ?? null, me.id)) {
-                        this.log(`[${sp.name}] + repo ${m.repo_origin ?? newRepo} registered by ${me.id}`);
-                        this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.repo_origin ?? newRepo}`, meta: { repo: newRepo, repo_origin: m.repo_origin ?? null } });
+                    if (newRepo && sp.allow.addRepo(newRepo, repoLabelSafe(m.repo_origin), me.id)) {
+                        const label = repoLabelSafe(m.repo_origin);
+                        this.log(`[${sp.name}] + repo ${label ?? newRepo} registered by ${me.id}`);
+                        this.commit(sp, { from: me.id, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${label ?? newRepo}`, meta: { repo: newRepo, repo_origin: label ?? null } });
                         this.broadcast(sp, { t: "repos", repos: sp.allow.repoList() });
                     }
                     this.send(ws, {
                         t: "welcome", member: me.id, session: sessionId, space: sp.name, seq: sp.ledger.head,
                         roster: this.roster(sp), goals: [...sp.goals.values()],
                         obligations: [...sp.obligations.values()], members: this.members(sp), profiles: [...sp.profiles.values()],
-                        space_id: sp.allow.spaceId(), repos: sp.allow.repoList(),
+                        space_id: sp.allow.spaceId(), repos: sp.allow.repoList(), features: [...this.features],
                         ...(acct ? { plan: this.planView(acct, sp) } : {}),
-                        ...(enrolled ? { token: enrolled } : {}),
+                        ...(enrolled ? { token: enrolled } : staleToken && this.knownToken(sp) ? { token: sp.token } : {}),
                     });
+                    if (staleToken && !enrolled && !sp.token) {
+                        const mine = me.sessions.get(sessionId);
+                        if (mine)
+                            mine.wantsToken = true;
+                    }
                     let from = m.from_seq && m.from_seq > 0 ? m.from_seq : sp.ledger.head;
                     for (let page = sp.ledger.since(from); page.length; page = sp.ledger.since(from)) {
                         for (const r of page) {
@@ -1868,6 +2646,11 @@ pantheon signup --email you@work.com --username you</code></pre>
                         }
                         from = page[page.length - 1].seq;
                     }
+                    if (versionBelow(m.pkg, "0.30.0")) {
+                        const why = this.unsignedRefusal(sp.name, sp.allow, "current");
+                        if (why)
+                            this.send(ws, { t: "act", act: this.upgradeAct(sp.name, sp.ledger.head, null, why) });
+                    }
                     if (firstSession && m.role !== "cli") {
                         this.commit(sp, { from: me.id, act: "JOIN", body: `${me.display} online (${me.agent})`, to: null, goal: null, ref: null });
                     }
@@ -1877,6 +2660,19 @@ pantheon signup --email you@work.com --username you</code></pre>
                 }
                 if (!space || !me)
                     return reject("NOT_JOINED", "say hello first");
+                if (!this.stillIn(space, me, sessionId, ws) || (acct && !accountStillOk())) {
+                    if (ws.readyState === 1)
+                        this.hangUp(ws, "REVOKED");
+                    return;
+                }
+                if (delegated && Date.now() > delegated.expires + 10 * 60_000) {
+                    if (ws.readyState === 1)
+                        this.hangUp(ws, "REVOKED");
+                    return;
+                }
+                if (delegated && m.t !== "act" && m.t !== "open_goal" && m.t !== "claim" && m.t !== "worker_state") {
+                    return fail("NOT_FOR_A_RUN", `an unattended run cannot ${m.t.replace(/_/g, " ")} — its member does that from their own session`, m.cid);
+                }
                 if (m.t === "publish_profile") {
                     if (m.profile.member !== me.id) {
                         return fail("PROFILE_NOT_YOURS", `you may publish only the profile for ${me.id}`, m.cid);
@@ -1909,6 +2705,13 @@ pantheon signup --email you@work.com --username you</code></pre>
                     const target = space.allow.get(m.member);
                     if (!target)
                         return fail("NO_SUCH_MEMBER", `"${m.member}" has never connected, so there is no key to admit`, m.cid);
+                    if (!m.revoke && !m.forget && !m.wake_only && !target.admitted && space.allow.removedWhen(m.member) !== null) {
+                        const founder = space.allow.founder();
+                        if (founder && me.id !== founder)
+                            return fail("FOUNDER_ONLY", `${m.member} was removed from "${space.name}"; only ${founder}, who founded it, can bring them back`, m.cid);
+                    }
+                    if (m.wake_only && (m.revoke || m.forget || !target.admitted))
+                        return fail("NOT_ADMITTED", `"${m.member}" is not in "${space.name}" now, so there is no wake permission to change`, m.cid);
                     if (!m.revoke && !m.forget) {
                         const plan = this.spacePlan(space.name);
                         if (plan && m.may_wake && !plan.limits.wake)
@@ -1922,19 +2725,16 @@ pantheon signup --email you@work.com --username you</code></pre>
                             return fail("FOUNDER_ONLY", `only ${founder}, who founded "${space.name}", can remove a member`, m.cid);
                         if (m.member === founder)
                             return fail("FOUNDER_STAYS", "the founder cannot be removed from their own team", m.cid);
-                        if (m.forget)
-                            space.allow.forget(m.member);
-                        else
-                            space.allow.revoke(m.member, me.id);
+                        const removed = m.forget ? space.allow.forget(m.member) : space.allow.revoke(m.member, me.id);
                         if (space.profiles.delete(m.member))
                             this.broadcast(space, { t: "profiles", profiles: [...space.profiles.values()] });
-                        for (const s of space.members.get(m.member)?.sessions.values() ?? []) {
-                            try {
-                                s.ws.close(1008, "REVOKED");
-                            }
-                            catch { }
-                        }
+                        const gone = space.members.get(m.member);
+                        for (const s of gone?.sessions.values() ?? [])
+                            this.hangUp(s.ws, "REVOKED");
+                        gone?.sessions.clear();
                         space.members.delete(m.member);
+                        if (removed && this.rotateOnRemove)
+                            this.rotateSpaceToken(space, `${m.member} ${m.forget ? "forgotten" : "removed"} by ${me.id}`);
                         this.log(`[${space.name}] - ${m.forget ? "FORGOT" : "REVOKED"} ${m.member} by ${me.id}`);
                     }
                     else {
@@ -1964,7 +2764,15 @@ pantheon signup --email you@work.com --username you</code></pre>
                     this.accounts?.audit({ event: "space_deleted", actor_account: acct?.id ?? null, space: name, detail: `by its founder ${me.id}`, ip });
                     this.log(`[${name}] * DELETED by its founder ${me.id}`);
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: name, seq: space.ledger.head });
-                    setTimeout(() => { this.deleteSpace(name); this.accounts?.markSpaceDeleted(name); }, 50).unref?.();
+                    setTimeout(() => {
+                        try {
+                            this.deleteSpace(name);
+                            this.accounts?.markSpaceDeleted(name);
+                        }
+                        catch (e) {
+                            this.noteStorageFailure(`[${name}] delete`, e);
+                        }
+                    }, 50).unref?.();
                     return;
                 }
                 if (m.t === "invite") {
@@ -1985,7 +2793,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (space.allow.openInvites().length >= LIMITS_SPACE.openInvites)
                         return fail("TOO_MANY_INVITES", `this team already has ${LIMITS_SPACE.openInvites} unused invites — revoke some: pantheon invite --revoke all`, m.cid);
                     const token = randomBytes(18).toString("base64url");
-                    const inv = space.allow.mintInvite(me.id, m.may_wake, m.ttl_minutes, token, space.token);
+                    const inv = space.allow.mintInvite(me.id, m.may_wake, m.ttl_minutes, token, this.ensureToken(space));
                     this.log(`[${space.name}] * invite minted by ${me.id}, valid ${m.ttl_minutes}m, single use`);
                     this.send(ws, { t: "invite", url: token, expires_at: inv.expires_at });
                     return;
@@ -2034,14 +2842,14 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (existing && m.base && existing.added_by !== me.id && space.allow.founder() !== me.id) {
                         return fail("NOT_YOURS", `only ${existing.added_by} (who registered this repo) or the team's founder can change which branch its runs start from`, m.cid);
                     }
-                    const added = space.allow.addRepo(m.repo, m.origin ?? null, me.id, m.base ?? null);
+                    const added = space.allow.addRepo(m.repo, repoLabelSafe(m.origin), me.id, m.base ?? null);
                     if (!added && m.base && space.allow.setRepoBase(m.repo, m.base)) {
-                        this.log(`[${space.name}] ~ repo ${m.origin ?? m.repo} base branch → ${m.base} (by ${me.id})`);
+                        this.log(`[${space.name}] ~ repo ${repoLabelSafe(m.origin) ?? m.repo} base branch → ${m.base} (by ${me.id})`);
                         this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
                     }
                     if (added) {
-                        this.log(`[${space.name}] + repo ${m.origin ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
-                        this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${m.origin ?? m.repo}`, meta: { repo: m.repo, repo_origin: m.origin ?? null } });
+                        this.log(`[${space.name}] + repo ${repoLabelSafe(m.origin) ?? m.repo} registered by ${me.id}${m.base ? ` (base ${m.base})` : ""}`);
+                        this.commit(space, { from: me.id, session: sessionId, role, act: "NOTE", to: null, goal: null, ref: null, body: `repo registered with this space: ${repoLabelSafe(m.origin) ?? m.repo}`, meta: { repo: m.repo, repo_origin: repoLabelSafe(m.origin) ?? null } });
                         this.broadcast(space, { t: "repos", repos: space.allow.repoList() });
                     }
                     this.send(ws, { t: "ack", cid: m.cid, id: m.repo, seq: space.ledger.head });
@@ -2077,11 +2885,11 @@ pantheon signup --email you@work.com --username you</code></pre>
                             }
                         }
                         const held = space.contLocks.get(m.obligation);
-                        if (held && held.session !== sessionId && Date.now() - held.at < LIMITS.claimTtlMs) {
+                        if (held && held.session !== sessionId && this.claimHolds(space, held)) {
                             return fail("CLAIMED", `another of your sessions (${held.session}) is handling this`, m.cid);
                         }
                         for (const [k, v] of space.contLocks) {
-                            if (Date.now() - v.at > LIMITS.claimTtlMs)
+                            if (!this.claimHolds(space, v))
                                 space.contLocks.delete(k);
                         }
                         space.contLocks.set(m.obligation, { session: sessionId, member: me.id, at: Date.now() });
@@ -2094,7 +2902,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                     if (o.owner !== me.id)
                         return fail("NOT_YOURS", `${o.owner} owes that, not you`, m.cid);
                     if (o.claimed_by && o.claimed_by.session !== sessionId) {
-                        if (Date.now() - o.claimed_by.at < LIMITS.claimTtlMs) {
+                        if (this.claimHolds(space, o.claimed_by)) {
                             const holder = o.claimed_by;
                             const live = [...me.sessions.keys()].includes(holder.session);
                             const left = Math.ceil((LIMITS.claimTtlMs - (Date.now() - holder.at)) / 60_000);
@@ -2124,6 +2932,8 @@ pantheon signup --email you@work.com --username you</code></pre>
                 if (m.t === "open_goal") {
                     if (!this.writeOk(me))
                         return fail("RATE_LIMIT", "too many goals opened too fast — wait a few seconds", m.cid);
+                    if (this.spaceFull(space))
+                        return fail("SPACE_FULL", this.spaceFullMessage(space), m.cid);
                     const openCount = [...space.goals.values()].filter((g) => g.state !== "CLOSED").length;
                     if (openCount >= LIMITS_SPACE.openGoals)
                         return fail("TOO_MANY_GOALS", `this team has ${openCount} goals still open — close some first`, m.cid);
@@ -2131,12 +2941,19 @@ pantheon signup --email you@work.com --username you</code></pre>
                         if (!space.members.has(id) && !space.allow.get(id)?.admitted)
                             return fail("NO_SUCH_MEMBER", `nobody here is called "${id}"`, m.cid);
                     }
+                    if (!this.features.includes("act-sig"))
+                        delete m.sig;
+                    if (m.sig || delegated) {
+                        const why = goalSigProblem(m, me.id, myPubkey, [space.allow.spaceId(), space.name], delegated);
+                        if (why)
+                            return fail("BAD_GOAL_SIGNATURE", why, m.cid);
+                    }
                     const invited = (m.invite ?? [...space.members.keys()]).filter((x) => x !== me.id);
                     if (m.deadline !== undefined && m.deadline <= Date.now()) {
                         return fail("DEADLINE_PAST", `deadline ${new Date(m.deadline).toISOString()} is already in the past`, m.cid);
                     }
                     const goal = {
-                        id: newId("g"),
+                        id: m.id && !space.goals.has(m.id) ? m.id : newId("g"),
                         title: m.title,
                         acceptance: m.acceptance,
                         members: [me.id, ...new Set(invited)],
@@ -2147,6 +2964,7 @@ pantheon signup --email you@work.com --username you</code></pre>
                         opened_at: Date.now(),
                         ...(m.deadline !== undefined ? { deadline: m.deadline } : {}),
                         ...(m.kind !== undefined ? { kind: m.kind } : {}),
+                        ...(m.sig ? { sig: m.sig } : {}),
                     };
                     space.goals.set(goal.id, goal);
                     space.store.flush(space.goals, space.obligations, space.profiles);
@@ -2156,16 +2974,38 @@ pantheon signup --email you@work.com --username you</code></pre>
                         body: `goal opened: ${goal.title}\nacceptance: ${goal.acceptance || "(none stated)"}` +
                             (goal.deadline ? `\ndeadline: ${new Date(goal.deadline).toISOString()}` : "") +
                             (goal.kind === "worklist" ? `\nkind: worklist — ${me.id}'s own list; peers may read it, nobody owes anything in it` : ""),
+                        meta: { goal_members: goal.members, goal_budget: goal.budget, ...(m.sig ? { goal_sig: m.sig, goal_text: { title: goal.title, acceptance: goal.acceptance } } : {}) },
                     });
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: goal.id, seq: rec.seq });
                     return;
                 }
-                const fp = fingerprint_(me.id, m.act, m.body, m.goal ?? null, m.ref ?? null, { to: m.to ?? null, meta: m.meta ?? null, defers_to: m.defers_to ?? null });
+                if (!this.features.includes("act-sig"))
+                    delete m.sig;
+                if (m.sig || delegated) {
+                    const why = actSigProblem(m, me.id, myPubkey, [space.allow.spaceId(), space.name], delegated);
+                    if (why)
+                        return fail("BAD_ACT_SIGNATURE", why, m.cid);
+                }
+                if (m.act === "NOTE" && m.meta && ("goal_members" in m.meta || "organization_profile" in m.meta || "notice" in m.meta))
+                    return fail("BAD_META", "goal_members, organization_profile and notice are written by the relay, not sent", m.cid);
+                if (m.act === "NOTE" && m.body.startsWith("repo registered with this space: "))
+                    return fail("BAD_META", "that line is written by the relay, not sent", m.cid);
+                const fromRepo = m.repo && space.allow.hasRepo(m.repo) ? m.repo : null;
+                const { from_repo: _forged, ...senderMeta } = (m.meta ?? {});
+                const hasMeta = !!m.meta && (Object.keys(senderMeta).length > 0 || _forged === undefined);
+                const storedMeta = hasMeta || m.defers_to || m.affects || fromRepo
+                    ? { ...senderMeta, ...(m.defers_to ? { defers_to: m.defers_to } : {}), ...(m.affects ? { affects: m.affects } : {}), ...(fromRepo ? { from_repo: fromRepo } : {}) }
+                    : undefined;
+                const fp = actFingerprint(me.id, m.act, m.body, m.goal ?? null, m.ref ?? null, m.to ?? null, storedMeta);
                 const prior = space.recent.get(fp);
                 if (prior && Date.now() - prior.at < LIMITS.dedupeWindowMs) {
                     this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: prior.id, seq: prior.seq });
                     return;
                 }
+                if (m.sig && m.id && (space.ledger.find(m.id) || space.droppedIds?.has(m.id)))
+                    return fail("ID_TAKEN", `an act with id ${m.id} already exists`, m.cid);
+                if (m.sig && m.id && !idIsFresh(m.id))
+                    return fail("BAD_ACT_ID", `act id ${m.id} was not made in the last day — check this machine's clock`, m.cid);
                 if (m.after_seq !== undefined) {
                     const mine = me.id;
                     const missed = space.ledger.since(m.after_seq)
@@ -2184,33 +3024,77 @@ pantheon signup --email you@work.com --username you</code></pre>
                 const err = this.validateAct(space, me, m.act, m.goal ?? null, m.ref ?? null, m.to ?? null, m.meta, m.defers_to, m.body.length, m.summary, m.repo, role);
                 if (err)
                     return fail(err.code, err.message, m.cid);
+                if (m.act === "PROPOSE" && m.affects?.length) {
+                    const g = m.goal ? space.goals.get(m.goal) : undefined;
+                    const outside = m.affects.filter((x) => !g?.members.includes(x));
+                    if (outside.length) {
+                        return fail("NOT_IN_GOAL", `${outside.join(", ")} ${outside.length === 1 ? "is" : "are"} not in ${g ? `"${g.title}"` : "this goal"}, so could never ACCEPT this proposal there. Name only members of the goal in affects.`, m.cid);
+                    }
+                }
+                const wasFull = this.spaceFull(space);
+                if (wasFull && !this.freesRoom(space, me.id, m.act, m.ref ?? null))
+                    return fail("SPACE_FULL", this.spaceFullMessage(space), m.cid);
                 const rec = this.commit(space, {
+                    ...(m.sig && m.id ? { id: m.id } : {}),
                     from: me.id, session: sessionId, role, act: m.act, body: m.body,
                     ...(m.summary ? { summary: m.summary } : {}),
+                    ...(m.sig ? { sig: m.sig } : {}),
                     to: m.to ?? null, goal: m.goal ?? null, ref: m.ref ?? null,
-                    ...(m.meta || m.defers_to || m.affects
-                        ? { meta: { ...(m.meta ?? {}),
+                    ...((m.meta && (Object.keys(withoutFromRepo(m.meta)).length > 0 || !("from_repo" in m.meta))) || m.defers_to || m.affects || fromRepo
+                        ? { meta: { ...withoutFromRepo(m.meta),
                                 ...(m.defers_to ? { defers_to: m.defers_to } : {}),
-                                ...(m.affects ? { affects: m.affects } : {}) } }
+                                ...(m.affects ? { affects: m.affects } : {}),
+                                ...(fromRepo ? { from_repo: fromRepo } : {}) } }
                         : {}),
                 });
+                if (wasFull && m.act === "CLOSE") {
+                    try {
+                        this.compactSpace(space);
+                    }
+                    catch (e) {
+                        this.noteStorageFailure(`[${space.name}] compacting after a close`, e);
+                    }
+                }
                 space.recent.set(fp, { id: rec.id, seq: rec.seq, at: Date.now() });
                 for (const [k, v] of space.recent)
                     if (Date.now() - v.at > LIMITS.dedupeWindowMs)
                         space.recent.delete(k);
+                for (const k of space.recent.keys()) {
+                    if (space.recent.size <= RECENT_MAX)
+                        break;
+                    space.recent.delete(k);
+                }
                 this.send(ws, { t: "ack", ...(m.cid ? { cid: m.cid } : {}), id: rec.id, seq: rec.seq });
             }
             catch (e) {
-                this.log(`! message handling failed: ${e.message}`);
-                try {
-                    ws.send(JSON.stringify({ t: "error", code: "STORAGE", message: "the relay could not save that — try again in a moment" }));
+                const cidPart = reqCid ? { cid: reqCid } : {};
+                const send = (code, message) => { try {
+                    ws.send(JSON.stringify({ t: "error", code, message, ...cidPart }));
                 }
-                catch { }
+                catch { } };
+                if (e instanceof SpaceFull) {
+                    send("SPACE_FULL", `${e.message}. Nothing new can be recorded until finished goals are closed (the relay then compacts their old acts), or the relay operator raises PANTHEON_SPACE_MAX_BYTES.`);
+                    return;
+                }
+                if (e instanceof RosterUnreadable) {
+                    this.log(`!! ${e.message} — every member of this space is refused until it is repaired (it was left in place)`);
+                    if (!space)
+                        return reject("SPACE_UNREADABLE", "the relay cannot read this team's member list, so nobody can be let in until its operator repairs it. Nothing was changed; tell the relay operator.");
+                    send("SPACE_UNREADABLE", "the relay cannot read this team's member list; tell the relay operator.");
+                    return;
+                }
+                this.noteStorageFailure(`[${space?.name ?? "?"}] ${lastMsg || "message"}`, e);
+                send("STORAGE", "the relay could not save that — try again in a moment");
             }
         });
         const closeWork = (code) => {
             if (dbSession) {
-                this.accounts?.endSession(dbSession);
+                try {
+                    this.accounts?.endSession(dbSession);
+                }
+                catch (e) {
+                    this.noteStorageFailure("session end", e);
+                }
                 dbSession = null;
             }
             if (!space || !me)
@@ -2233,7 +3117,8 @@ pantheon signup --email you@work.com --username you</code></pre>
                 else
                     v.at = Date.now();
             }
-            if (me.sessions.size === 0 && role !== "cli") {
+            const stillMember = space.members.get(me.id) === me && !!space.allow.get(me.id)?.admitted;
+            if (me.sessions.size === 0 && role !== "cli" && stillMember) {
                 me.last_seen = Date.now();
                 this.commit(space, { from: me.id, act: "LEAVE", body: `${me.display} offline`, to: null, goal: null, ref: null });
             }
@@ -2245,7 +3130,7 @@ pantheon signup --email you@work.com --username you</code></pre>
             closeWork(code);
         }
         catch (e) {
-            this.log(`! cleanup after a disconnect failed: ${e.message}`);
+            this.noteStorageFailure(`[${space?.name ?? "?"}] cleanup after a disconnect`, e);
         } });
         ws.on("error", () => { });
     }
@@ -2265,21 +3150,26 @@ pantheon signup --email you@work.com --username you</code></pre>
         const now = Date.now();
         for (const sp of this.spaces.values()) {
             try {
-                if (now - (this.compactedAt.get(sp.name) ?? 0) > LIMITS.ledgerCompactEveryMs)
+                const every = this.spaceFull(sp) ? 60_000 : LIMITS.ledgerCompactEveryMs;
+                if (now - (this.compactedAt.get(sp.name) ?? 0) > every)
                     this.compactSpace(sp);
                 this.lapseClaims(sp, now);
             }
             catch (e) {
-                this.log(`! [${sp.name}] housekeeping failed: ${e.message}`);
+                this.noteStorageFailure(`[${sp.name}] housekeeping`, e);
             }
         }
         try {
             this.evictSpaces();
         }
         catch (e) {
-            this.log(`! evicting idle spaces failed: ${e.message}`);
+            this.noteStorageFailure("evicting idle spaces", e);
         }
     }
+    claimHolds(sp, holder, now = Date.now()) {
+        const live = [...sp.members.values()].some((m) => m.sessions.has(holder.session));
+        return now - holder.at < (live ? LIMITS.claimLiveTtlMs : LIMITS.claimTtlMs);
+    }
     lapseClaims(sp, now) {
         const live = new Set();
         for (const m of sp.members.values())
@@ -2287,14 +3177,15 @@ pantheon signup --email you@work.com --username you</code></pre>
                 live.add(id);
         let lapsed = 0;
         for (const o of sp.obligations.values()) {
-            if (o.claimed_by && !live.has(o.claimed_by.session) && now - o.claimed_by.at >= LIMITS.claimTtlMs) {
+            if (o.claimed_by && !this.claimHolds(sp, o.claimed_by, now)) {
                 delete o.claimed_by;
                 lapsed++;
             }
         }
         for (const [k, v] of sp.contLocks)
-            if (!live.has(v.session) && now - v.at >= LIMITS.claimTtlMs)
+            if (!this.claimHolds(sp, v, now))
                 sp.contLocks.delete(k);
+        void live;
         if (lapsed)
             this.pushObligations(sp);
     }
@@ -2312,6 +3203,8 @@ pantheon signup --email you@work.com --username you</code></pre>
                 return { code: "NO_SUCH_MEMBER", message: `nobody here is called "${id}" — members: ${[...sp.members.keys()].join(", ")}` };
             }
         }
+        if (ref === UPGRADE_NOTE_ID)
+            return { code: "UPGRADE_REQUIRED", message: `${UPGRADE_NOTE}. That notice is from the relay, not a teammate, so there is nothing to reply to.` };
         if (ref && !sp.ledger.find(ref))
             return { code: "BAD_REF", message: `no act with id ${ref}` };
         if (meta && JSON.stringify(meta).length > LIMITS_SPACE.metaBytes) {
@@ -2327,6 +3220,10 @@ pantheon signup --email you@work.com --username you</code></pre>
             return { code: "ESCALATE_IS_LOCAL",
                 message: "ESCALATE is for your own human. Use HUMAN_REQUIRED to notify one named peer's human." };
         }
+        if (meta && ("authority" in meta || "unverified_domains" in meta)) {
+            delete meta["authority"];
+            delete meta["unverified_domains"];
+        }
         if (act === "HUMAN_REQUIRED" && (!to || to.length !== 1)) {
             return { code: "ONE_HUMAN_REQUIRED",
                 message: "HUMAN_REQUIRED must name exactly one human owner. Send separate requests when separate people must decide." };
@@ -2335,6 +3232,9 @@ pantheon signup --email you@work.com --username you</code></pre>
             const domains = Array.isArray(meta?.decision_domains)
                 ? [...new Set(meta.decision_domains.filter((x) => typeof x === "string" && x.trim().length > 0))]
                 : [];
+            if (domains.some((d) => d.length > 64 || /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/.test(d))) {
+                return { code: "BAD_DECISION_DOMAIN", message: "decision_domains are single-line names of up to 64 characters, as profiles publish them" };
+            }
             if (!domains.length) {
                 return { code: "DECISION_DOMAINS_REQUIRED",
                     message: "HUMAN_REQUIRED must name decision_domains so the relay can verify the human owner. Call pantheon_route_decision first." };
@@ -2506,7 +3406,13 @@ pantheon signup --email you@work.com --username you</code></pre>
     commit(sp, partial) {
         if (sp.deleted)
             return { ...partial, id: newId("a"), seq: sp.ledger.head, ts: Date.now(), space: sp.name };
-        const rec = sp.ledger.append({ ...partial, id: newId("a"), ts: Date.now(), space: sp.name });
+        if ((partial.act === "JOIN" || partial.act === "LEAVE") && this.spaceFull(sp)) {
+            return { ...partial, id: newId("a"), seq: sp.ledger.head, ts: Date.now(), space: sp.name };
+        }
+        let id = partial.id ?? newId("a");
+        while (!partial.id && sp.ledger.find(id))
+            id = newId("a");
+        const rec = sp.ledger.append({ ...partial, id, ts: Date.now(), space: sp.name }, this.maxLedgerBytes + SPACE_HARD_SLACK);
         sp.lastTouch = rec.ts;
         const m = sp.members.get(rec.from);
         if (m) {
@@ -2514,13 +3420,22 @@ pantheon signup --email you@work.com --username you</code></pre>
             if (rec.act !== "JOIN" && rec.act !== "LEAVE" && (m.seen_seq ?? 0) < rec.seq - 1)
                 m.seen_seq = rec.seq - 1;
         }
+        this.effects(sp, rec);
+        if (sp.store.rebuilt && rec.act !== "JOIN" && rec.act !== "LEAVE")
+            sp.store.rebuilt = null;
+        this.pushObligations(sp);
+        this.broadcast(sp, { t: "act", act: rec });
+        this.broadcast(sp, { t: "roster", roster: this.roster(sp) });
+        return rec;
+    }
+    effects(sp, rec, ctx) {
         if (rec.goal) {
             const goal = sp.goals.get(rec.goal);
             if (goal) {
                 goal.acts++;
                 const run = sp.lastActor.get(rec.goal);
                 sp.lastActor.set(rec.goal, run && run.member === rec.from ? { member: rec.from, run: run.run + 1 } : { member: rec.from, run: 1 });
-                this.applyObligations(sp, rec, goal);
+                this.applyObligations(sp, rec, goal, ctx);
                 this.broadcast(sp, { t: "goal", goal });
                 if (goal.acts >= goal.budget && goal.state === "OPEN") {
                     goal.state = "STALLED";
@@ -2531,14 +3446,10 @@ pantheon signup --email you@work.com --username you</code></pre>
             }
         }
         else {
-            this.applyObligations(sp, rec, null);
+            this.applyObligations(sp, rec, null, ctx);
         }
-        this.pushObligations(sp);
-        this.broadcast(sp, { t: "act", act: rec });
-        this.broadcast(sp, { t: "roster", roster: this.roster(sp) });
-        return rec;
     }
-    applyObligations(sp, rec, goal) {
+    applyObligations(sp, rec, goal, ctx) {
         const closeFor = (owner, ref) => {
             for (const [id, o] of sp.obligations)
                 if (o.owner === owner && o.ref === ref)
@@ -2642,8 +3553,9 @@ pantheon signup --email you@work.com --username you</code></pre>
                     const answer = sp.ledger.find(rec.ref);
                     const asked = answer?.act === "ANSWER" && answer.from === rec.from && answer.ref ? sp.ledger.find(answer.ref) : undefined;
                     const decider = asked?.act === "ESCALATE" ? asked.from : asked?.act === "HUMAN_REQUIRED" ? asked.to?.[0] : undefined;
-                    const retracted = new Set(sp.ledger.all().filter((r) => r.act === "RETRACT" && r.ref).map((r) => r.ref));
-                    const stillAnswered = asked && sp.ledger.all().some((r) => r.act === "ANSWER" && r.ref === asked.id && r.from === rec.from && r.id !== answer.id && !retracted.has(r.id));
+                    const retracted = ctx?.retracted ?? new Set(sp.ledger.all().filter((r) => r.act === "RETRACT" && r.ref).map((r) => r.ref));
+                    const answersTo = asked ? (ctx ? ctx.answers.get(asked.id) ?? [] : sp.ledger.all().filter((r) => r.act === "ANSWER" && r.ref === asked.id)) : [];
+                    const stillAnswered = answersTo.some((r) => r.from === rec.from && r.id !== answer.id && !retracted.has(r.id));
                     const alreadyLive = asked && [...sp.obligations.values()].some((o) => o.kind === "HUMAN" && o.ref === asked.id);
                     if (asked && decider === rec.from && !stillAnswered && !alreadyLive && !retracted.has(asked.id)) {
                         this.oblige(sp, { kind: "HUMAN", owner: `human:${decider}`, ref: asked.id, goal: asked.goal,
@@ -2681,6 +3593,23 @@ pantheon signup --email you@work.com --username you</code></pre>
         const id = newId("o");
         sp.obligations.set(id, { ...o, id, created_at: Date.now() });
     }
+    freesRoom(sp, member, act, ref) {
+        if (act === "CLOSE" || act === "RETRACT" || act === "WITHDRAW")
+            return true;
+        if (act === "ANSWER" && ref) {
+            for (const o of sp.obligations.values())
+                if (o.kind === "HUMAN" && o.ref === ref && o.owner === `human:${member}`)
+                    return true;
+        }
+        return false;
+    }
+    spaceFull(sp) {
+        return sp.ledger.bytes >= this.maxLedgerBytes;
+    }
+    spaceFullMessage(sp) {
+        return `"${sp.name}" has reached the relay's limit for one team's history (${(sp.ledger.bytes / 1e6).toFixed(1)} of ${(this.maxLedgerBytes / 1e6).toFixed(1)} MB), so nothing new can be recorded. ` +
+            `Close finished goals: the relay compacts their old acts away, which frees room. Or ask the relay operator to raise PANTHEON_SPACE_MAX_BYTES.`;
+    }
     pushObligations(sp) {
         sp.store.flush(sp.goals, sp.obligations, sp.profiles);
         this.broadcast(sp, { t: "obligations", list: [...sp.obligations.values()] });
@@ -2753,18 +3682,23 @@ pantheon signup --email you@work.com --username you</code></pre>
                 continue;
             const idle = now - sp.lastTouch;
             const junk = this.isJunkSpace(sp);
-            if (junk && idle > this.limits.spaceJunkDeleteMs) {
-                sp.store.close(sp.goals, sp.obligations, sp.profiles);
-                this.spaces.delete(name);
-                this.compactedAt.delete(name);
-                this.deleteSpaceFiles(sp.name);
-                this.log(`[${name}] evicted junk space (idle ${Math.round(idle / 3_600_000)}h, no work, no members) — files removed`);
+            try {
+                if (junk && idle > this.limits.spaceJunkDeleteMs) {
+                    sp.store.close(sp.goals, sp.obligations, sp.profiles);
+                    this.spaces.delete(name);
+                    this.compactedAt.delete(name);
+                    this.deleteSpaceFiles(sp.name);
+                    this.log(`[${name}] evicted junk space (idle ${Math.round(idle / 3_600_000)}h, no work, no members) — files removed`);
+                }
+                else if (idle > this.limits.spaceIdleEvictMs) {
+                    sp.store.close(sp.goals, sp.obligations, sp.profiles);
+                    this.spaces.delete(name);
+                    this.compactedAt.delete(name);
+                    this.log(`[${name}] evicted from memory (idle ${Math.round(idle / 3_600_000)}h) — reloads from disk on next connect`);
+                }
             }
-            else if (idle > this.limits.spaceIdleEvictMs) {
-                sp.store.close(sp.goals, sp.obligations, sp.profiles);
-                this.spaces.delete(name);
-                this.compactedAt.delete(name);
-                this.log(`[${name}] evicted from memory (idle ${Math.round(idle / 3_600_000)}h) — reloads from disk on next connect`);
+            catch (e) {
+                this.noteStorageFailure(`[${name}] eviction flush`, e);
             }
         }
     }
@@ -2777,22 +3711,49 @@ pantheon signup --email you@work.com --username you</code></pre>
             catch { }
         }
     }
-    getOrCreateSpace(name, token) {
-        const existing = this.spaces.get(name);
-        if (existing)
-            return secretEq(existing.token, token) ? existing : null;
+    getOrCreateSpace(name, token, opts = {}) {
+        const claim = opts.claim;
+        const retired = !!opts.retired;
+        const existing = this.spaces.get(spaceKey(name));
+        if (existing) {
+            if (existing.name !== name)
+                return null;
+            const st = this.tokenState(existing, token);
+            return st === "current" || (retired && st === "retired") ? existing : null;
+        }
+        if (this.aliasOf(name))
+            return null;
         const safe = name.replace(/[^a-z0-9._-]/gi, "_");
         const allow = new Allowlist(this.dataDir, safe);
         const match = allow.tokenMatches(token);
-        if (match === false)
-            return null;
-        if (match === null)
+        let raw = token;
+        if (match === false) {
+            if (!(retired && allow.tokenRetired(token)))
+                return null;
+            raw = allow.currentTokenFromInvites() ?? "";
+        }
+        if (match === null) {
+            if (this.unboundOnDisk(safe)) {
+                const who = claim && claim !== "invite" ? claim : null;
+                const e = who ? allow.get(who.member) : undefined;
+                const ok = claim === "invite" || (!!who && !!e?.admitted && e.publicKey === who.pubkey);
+                if (!ok) {
+                    this.unbound.add(safe);
+                    return null;
+                }
+                this.log(`[${name}] bound a token to a space that had none, on the reconnect of ${who ? `its admitted member ${who.member}` : "an invite it issued"}`);
+            }
             allow.bindToken(token);
+            this.unbound.delete(safe);
+        }
+        const ledger = new Ledger(this.dataDir, safe);
         const store = new StateStore(this.dataDir, safe);
-        const restored = store.load();
+        store.headOf = () => ledger.head;
+        store.onError = (e) => this.noteStorageFailure(`[${name}] snapshot save`, e);
+        const restored = store.load({ quarantine: true, expectHistory: ledger.size > 0 });
         const sp = {
-            name, token,
-            ledger: new Ledger(this.dataDir, safe),
+            name, token: raw,
+            ledger,
             allow,
             store,
             members: new Map(),
@@ -2805,27 +3766,197 @@ pantheon signup --email you@work.com --username you</code></pre>
             createdAt: Date.now(),
             lastTouch: Date.now(),
         };
-        this.spaces.set(name, sp);
+        if (restored.unclean) {
+            sp.unclean = restored.unclean;
+            const rebuilt = this.rebuildFromLedger(sp);
+            this.log(`!! [${name}] UNCLEAN LOAD: ${restored.unclean}${restored.quarantined ? ` — moved aside to ${restored.quarantined}` : ""}. ` +
+                `Rebuilt ${rebuilt.goals} goal(s) (${rebuilt.open} open) and ${sp.obligations.size} obligation(s) from ${ledger.size} act(s) in the ledger; ` +
+                `ledger compaction is OFF for this space until a snapshot written from live state (after a real act) is loaded clean.`);
+            store.rebuilt = restored.unclean;
+            try {
+                store.flush(sp.goals, sp.obligations, sp.profiles);
+            }
+            catch (e) {
+                this.noteStorageFailure(`[${name}] rebuilt snapshot`, e);
+            }
+        }
+        else if (restored.rebuilt) {
+            sp.unclean = `its snapshot is still the one rebuilt from the ledger (${restored.rebuilt}), and no act has been built on it yet`;
+            store.rebuilt = restored.rebuilt;
+            this.log(`! [${name}] loaded a snapshot rebuilt from the ledger that no act has built on yet; ledger compaction stays OFF for this run.`);
+        }
+        else if (restored.ledgerHead !== undefined && ledger.head > restored.ledgerHead) {
+            const after = restored.ledgerHead;
+            const missed = ledger.all().filter((r) => r.seq > after);
+            const had = new Set(sp.obligations.keys());
+            let opened = 0;
+            for (const r of missed) {
+                if (r.goal && !sp.goals.has(r.goal)) {
+                    const g = this.goalFromOpening(r);
+                    if (g) {
+                        sp.goals.set(g.id, g);
+                        opened++;
+                    }
+                }
+                this.effects(sp, r);
+            }
+            for (const o of sp.obligations.values())
+                if (!had.has(o.id))
+                    o.created_at = ledger.find(o.ref)?.ts ?? o.created_at;
+            this.log(`! [${name}] the snapshot was ${missed.length} act(s) behind the ledger (seq ${after} < ${ledger.head}) — replayed them${opened ? `, and made again ${opened} goal(s) opened among them` : ""}`);
+            try {
+                store.flush(sp.goals, sp.obligations, sp.profiles);
+            }
+            catch (e) {
+                this.noteStorageFailure(`[${name}] replayed snapshot`, e);
+            }
+        }
+        this.spaces.set(spaceKey(name), sp);
+        try {
+            allow.recordName(name);
+        }
+        catch (e) {
+            this.noteStorageFailure(`[${name}] recording its name`, e);
+        }
         for (const e of allow.all()) {
             if (e.admitted && !sp.members.has(e.member)) {
                 sp.members.set(e.member, { id: e.member, display: e.member, agent: "unknown", last_seen: e.first_seen, sessions: new Map(), activity: new Map(), delivered_seq: 0, stamps: [] });
             }
         }
+        this.rebuildRecent(sp);
         const open = [...sp.goals.values()].filter((g) => g.state !== "CLOSED").length;
         this.log(`[${name}] space ready (seq ${sp.ledger.head}, ${sp.goals.size} goals — ${open} still open, ${sp.obligations.size} obligations restored)`);
+        const founder = allow.founder();
+        const guess = allow.founderGuess();
+        if (founder && (guess || !allow.get(founder)?.admitted)) {
+            this.log(`! [${name}] founder is "${founder}"${guess ? ` — a guess: ${guess} (an older relay rewrote who admitted whom)` : ""}` +
+                `${allow.get(founder)?.admitted ? "" : `, and "${founder}" is not admitted here, so nobody can remove a member or delete the team until they are re-admitted (or the operator steps in)`}`);
+        }
+        if (ledger.outOfOrder) {
+            this.log(`! [${name}] ledger seq is not strictly increasing: ${ledger.outOfOrder} act(s) at or below the one before (first at seq ${ledger.firstOutOfOrder}). ` +
+                `Two relays or two names wrote this file (0.29.1 let "a b" and "a_b" share one); readers paging by seq may skip or repeat those acts. Nothing was renumbered.`);
+        }
         this.compactSpace(sp);
         return sp;
     }
+    rebuildRecent(sp) {
+        const now = Date.now();
+        const recs = sp.ledger.all();
+        const retracted = new Set();
+        const window = [];
+        for (let i = recs.length - 1; i >= 0; i--) {
+            const r = recs[i];
+            if (now - r.ts > LIMITS.dedupeWindowMs)
+                break;
+            if (r.act === "RETRACT" && r.ref)
+                retracted.add(r.ref);
+            window.push(r);
+        }
+        for (const r of window.reverse()) {
+            if (!r.session || !SENDABLE.includes(r.act) || retracted.has(r.id))
+                continue;
+            const fp = actFingerprint(r.from, r.act, r.body, r.goal ?? null, r.ref ?? null, r.to ?? null, r.meta);
+            sp.recent.set(fp, { id: r.id, seq: r.seq, at: r.ts });
+        }
+        for (const k of sp.recent.keys()) {
+            if (sp.recent.size <= RECENT_MAX)
+                break;
+            sp.recent.delete(k);
+        }
+    }
+    rebuildFromLedger(sp) {
+        sp.goals.clear();
+        sp.obligations.clear();
+        const ctx = { retracted: new Set(), answers: new Map() };
+        for (const r of sp.ledger.all()) {
+            if (r.act === "RETRACT" && r.ref)
+                ctx.retracted.add(r.ref);
+            if (r.act === "ANSWER" && r.ref) {
+                const a = ctx.answers.get(r.ref);
+                if (a)
+                    a.push(r);
+                else
+                    ctx.answers.set(r.ref, [r]);
+            }
+            let goal = null;
+            if (r.goal) {
+                goal = sp.goals.get(r.goal) ?? null;
+                if (!goal) {
+                    goal = this.goalFromOpening(r) ?? {
+                        id: r.goal, title: `(recovered goal ${r.goal})`, acceptance: "", members: [r.from],
+                        state: "OPEN", acts: 0, budget: LIMITS.goalBudget, opened_by: r.from, opened_at: r.ts,
+                    };
+                    sp.goals.set(goal.id, goal);
+                }
+                const affects = r.meta?.affects;
+                for (const who of [r.from, ...(r.to ?? []), ...(Array.isArray(affects) ? affects.filter((x) => typeof x === "string") : [])]) {
+                    if (!who.startsWith("human:") && !goal.members.includes(who))
+                        goal.members.push(who);
+                }
+                goal.acts++;
+            }
+            this.applyObligations(sp, r, goal, ctx);
+        }
+        for (const o of sp.obligations.values())
+            o.created_at = sp.ledger.find(o.ref)?.ts ?? o.created_at;
+        let open = 0;
+        for (const g of sp.goals.values()) {
+            if (g.state === "CLOSED")
+                continue;
+            open++;
+            g.budget = Math.max(g.budget, g.acts + Math.ceil(LIMITS.goalBudget / 2));
+        }
+        return { goals: sp.goals.size, open };
+    }
+    goalFromOpening(r) {
+        if (!r.goal || r.act !== "NOTE" || r.session)
+            return null;
+        const mm = GOAL_OPENED.exec(r.body);
+        if (!mm)
+            return null;
+        const meta = r.meta;
+        const deadline = mm[3] ? Date.parse(mm[3]) : NaN;
+        const listed = meta?.goal_members;
+        const members = Array.isArray(listed) ? [...new Set([r.from, ...listed.filter((x) => typeof x === "string" && !x.startsWith("human:"))])] : [r.from];
+        const budget = typeof meta?.goal_budget === "number" && Number.isInteger(meta.goal_budget) && meta.goal_budget > 0 ? meta.goal_budget : LIMITS.goalBudget;
+        return {
+            id: r.goal,
+            title: typeof meta?.goal_text?.title === "string" ? meta.goal_text.title : mm[1],
+            acceptance: typeof meta?.goal_text?.acceptance === "string" ? meta.goal_text.acceptance : (mm[2] !== "(none stated)" ? mm[2] : ""),
+            ...(meta?.goal_sig && typeof meta.goal_sig === "object" ? { sig: meta.goal_sig } : {}),
+            members,
+            state: "OPEN",
+            acts: 0,
+            budget,
+            opened_by: r.from,
+            opened_at: r.ts,
+            ...(Number.isFinite(deadline) ? { deadline } : {}),
+            ...(mm[4] === "worklist" ? { kind: "worklist" } : {}),
+        };
+    }
     compactSpace(sp) {
+        this.compactedAt.set(sp.name, Date.now());
+        if (sp.unclean)
+            return;
         const isLive = (goal) => {
             if (!goal)
                 return false;
             const g = sp.goals.get(goal);
-            return !!g && g.state !== "CLOSED";
+            return !g || g.state !== "CLOSED";
         };
         const referenced = new Set([...sp.obligations.values()].map((o) => o.ref));
-        const { dropped, kept } = sp.ledger.compact({ keepRecent: LIMITS.ledgerKeepRecent, isLive, keep: (id) => referenced.has(id) });
-        this.compactedAt.set(sp.name, Date.now());
+        const before = sp.ledger.all().map((r) => r.id);
+        const { dropped, kept } = sp.ledger.compact({ keepRecent: this.opts.ledgerKeepRecent ?? LIMITS.ledgerKeepRecent, isLive, keep: (id) => referenced.has(id) });
+        if (dropped) {
+            const now = Date.now();
+            const d = (sp.droppedIds ??= new Map());
+            for (const [id, at] of d)
+                if (now - at > DAY)
+                    d.delete(id);
+            for (const id of before)
+                if (!sp.ledger.find(id))
+                    d.set(id, now);
+        }
         if (dropped)
             this.log(`[${sp.name}] compacted ledger — dropped ${dropped} old act(s) from closed goals, ${kept} kept`);
     }
@@ -2861,7 +3992,10 @@ pantheon signup --email you@work.com --username you</code></pre>
     members(sp) {
         return sp.allow.all().map((e) => ({
             member: e.member, admitted: e.admitted, may_wake: e.may_wake,
-            fingerprint: fingerprint(e.publicKey),
+            fingerprint: fingerprint(e.publicKey), pubkey: e.publicKey,
+            ...(e.admitted_by ? { admitted_by: e.admitted_by } : {}),
+            ...(e.revoked_at ? { revoked_at: e.revoked_at, ...(e.revoked_by ? { revoked_by: e.revoked_by } : {}) } : {}),
+            ...(sp.allow.founder() === e.member ? { founder: true } : {}),
         }));
     }
     send(ws, msg) {