@kubun/plugin-p2p 0.11.0 → 0.12.0

package/lib/context/group.js

@@ -1,19 +1,51 @@
 import { createCapability, createRevocationRecord } from '@kokuin/capability';
 import { normalizeDID, stringifyToken } from '@kokuin/token';
 import { HLC } from '@kubun/hlc';
-import { getDelegationStore as resolveDelegationStore } from '@kubun/store-delegation';
+import { MAX_CAP_TTL_SECONDS, getDelegationStore as resolveDelegationStore } from '@kubun/store-delegation';
 import { getGraphStore as resolveGraphStore } from '@kubun/store-graph';
 import { getP2PStore as resolveP2PStore } from '@kubun/store-p2p';
+import { adminCount, readGroupAnchor } from '@kumiai/mls';
 import { GraphQLError } from 'graphql';
-import { ADMIN_ROLE_ENTRY_TYPE, foldAdminRoster, isLedgerAdminAtHLC, loadVerifiedAdminEntries, reprojectAdminRoster } from '../groups/admin-roster.js';
-import { reprojectCircleDefs, reprojectCircleMembers, reprojectGroupSettings } from '../groups/circle-projection.js';
+import { ADMIN_ROLE_ENTRY_TYPE } from '../groups/admin-roster.js';
+import { signCatalogSet } from '../groups/catalog-token.js';
 import { CIRCLE_DEF_ENTRY_TYPE, CIRCLE_MEMBER_ENTRY_TYPE, encodeCircleMemberSubject, GROUP_SETTINGS_ENTRY_TYPE } from '../groups/circle-reducers.js';
-import { readGroupAnchor } from '../groups/group-anchor.js';
+import { awaitControlRequestSettled, settleControlRequest, toControlRequestData } from '../groups/control-request.js';
 import { decodeFullJoinRequest, decodeInvitePayload, decodeJoinRequest, encodeInvitePayload } from '../groups/invite-payload.js';
-import { applyInviteGrants, applyInviteRevocations, finalizeJoinedGroup } from '../groups/join-utils.js';
-import { ledgerEntryDigest, signLedgerEntry } from '../groups/ledger-entry.js';
-import { checkPeerAccess, toISO } from './types.js';
-/** Default write-grant lifetime in seconds (30 days). */ const DEFAULT_GRANT_EXPIRES_IN = 2_592_000;
+import { resolveJoinRequestDID } from '../groups/join-request-identity.js';
+import { applyInviteControlState, applyInviteGrants, applyInviteRevocations, collectInviteSeeds, finalizeJoinedGroup } from '../groups/join-utils.js';
+import { signLedgerEntry } from '../groups/ledger.js';
+import { GROUP_CONTROL_DENIED, LAST_GROUP_ADMIN, requireGroupAdmin } from './require-admin.js';
+import { checkPeerAccess, toCircleData, toISO } from './types.js';
+/** Project a stored catalog row into the GraphQL `PeerCatalog` shape. */ function toCatalogData(row) {
+    return {
+        id: row.id,
+        ownerDID: row.owner_did,
+        name: row.name,
+        description: row.description,
+        filterCriteria: JSON.stringify(row.filter_criteria),
+        active: row.active === 1,
+        sourceGroupID: row.source_group_id,
+        sourceCircleID: row.source_circle_id,
+        createdAt: toISO(row.created_at)
+    };
+}
+/**
+ * Default write-grant lifetime in seconds (30 days).
+ *
+ * Sits exactly at `MAX_CAP_TTL_SECONDS`. Raising it above that ceiling mints
+ * silently — the mint guard below tests the `expiresIn` argument, not the
+ * effective lifetime, so a raised default never reaches it. Every receiver then
+ * drops the grant, which is a harder failure to trace than a throw.
+ */ const DEFAULT_GRANT_EXPIRES_IN = 2_592_000;
+/**
+ * How long an invite waits for its Add commit to land before refusing.
+ *
+ * Sized for the commit lane, not for a local write: the Add goes to the group's
+ * commit log and can be rebased by a concurrent commit before it is accepted, so
+ * the bound has to cover several attempts plus their round-trips. It is a
+ * refusal deadline, not a latency target — an invite that waits this long has
+ * hit a real fault, and the caller can retry.
+ */ const INVITE_COMMIT_TIMEOUT = 30_000;
 export function createGroupContext(ctx, deps) {
     let p2pStorePromise = null;
     let delegationStorePromise = null;
@@ -21,6 +53,142 @@ export function createGroupContext(ctx, deps) {
     const getP2PStore = ()=>p2pStorePromise ??= resolveP2PStore(deps.stores);
     const getDelegationStore = ()=>delegationStorePromise ??= resolveDelegationStore(deps.stores);
     const getGraphStore = ()=>graphStorePromise ??= resolveGraphStore(deps.stores);
+    /**
+   * Mint the identity of a new circle.
+   *
+   * The ONE place a circle id comes from, so the source can be changed without
+   * hunting call sites: the id is handed to the caller before the commit
+   * carrying the definition lands, and every later step names the circle by it.
+   */ const mintCircleID = ()=>deps.runtime.getRandomID();
+    /**
+   * Mint an already-settled `no_op` request: the state the caller asked for is
+   * the state that already holds, so there is no entry to sign, no commit to
+   * drive and nothing to broadcast. The caller still gets a real, resolvable
+   * request — a terminal status IS the outcome, and "nothing to do" is an
+   * outcome an app must be able to read back.
+   *
+   * The enqueue and the settle share one transaction so a crash can never leave
+   * a request that reports `pending` for work that will never run.
+   */ const settleNoOpRequest = async (groupID)=>{
+        const requestID = deps.runtime.getRandomID();
+        const request = await deps.stores.withTransaction(async (tx)=>{
+            const txStore = await resolveP2PStore(tx);
+            const at = new Date().toISOString();
+            await txStore.enqueueControlRequest({
+                id: requestID,
+                groupID,
+                kind: 'ledger',
+                enqueuedAt: at
+            });
+            await txStore.settleControlRequest({
+                id: requestID,
+                outcome: 'no_op',
+                settledAt: at
+            });
+            const row = await txStore.getControlRequest(requestID);
+            if (row == null) {
+                throw new Error('Failed to read the control request after settling it');
+            }
+            return toControlRequestData(row);
+        });
+        // Announce only once the row is durable: a settle emitted from inside the
+        // transaction would tell subscribers about a row a rollback erases.
+        deps.stores.onCommit(()=>{
+            deps.emitter.emit('controlRequestSettled', request).catch((error)=>{
+                deps.logger.error('controlRequestSettled emit failed', {
+                    groupID,
+                    error
+                });
+            });
+        });
+        return request;
+    };
+    /**
+   * Report a commit lane's refusal, from inside the lane.
+   *
+   * Takes no store provider, on purpose. Every caller runs inside a
+   * `stores.onCommit` callback, and those fire AFTER the mutation's transaction
+   * has committed — under `mutateGraph` `deps.stores` IS that transaction, so a
+   * settle written through it waits on a transaction that is already over and
+   * never lands. Silently: `settleControlRequest` swallows everything, so the
+   * row stays `pending`, `controlRequestSettled` never fires, and every waiter
+   * times out instead of learning the outcome. `deps.deviceStores` exists for
+   * exactly this, and a helper that closes over it is what stops the next
+   * deferred settle reaching for the wrong provider.
+   */ const settleRejectedFromLane = (requestID, error)=>{
+        void settleControlRequest({
+            stores: deps.deviceStores,
+            requestID,
+            outcome: 'rejected',
+            error: error instanceof Error ? error.message : String(error),
+            emitter: deps.emitter,
+            logger: deps.logger
+        });
+    };
+    /**
+   * Queue the request that will report a signed entry's outcome, then drive the
+   * MLS commit that enacts it.
+   *
+   * Nothing is projected, broadcast or emitted here, and there is nowhere to write
+   * the entry: an entry enters the group's ledger by being ENACTED. This device
+   * then folds its own committed entry through the same `ingestVerifiedLedgerEntry`
+   * a receiver runs, from the same signed token.
+   */ const enqueueLedgerEntryRequest = async (params)=>{
+        const { groupID, token } = params;
+        const requestID = deps.runtime.getRandomID();
+        const enqueuedAt = new Date().toISOString();
+        await deps.stores.withTransaction(async (tx)=>{
+            const txStore = await resolveP2PStore(tx);
+            await txStore.enqueueControlRequest({
+                id: requestID,
+                groupID,
+                kind: 'ledger',
+                enqueuedAt
+            });
+        });
+        // The commit is the ONLY delivery: the token rides the commit's own frame as
+        // a sealed body, so every co-member resolves it, folds it and emits from
+        // that frame. A separate `ledger:entry` broadcast would race the commit and
+        // hand co-members an entry the group has not yet accepted, so none is sent.
+        //
+        // It is driven AFTER the request row is durable, and decoupled from this
+        // resolver's write transaction — the local MLS handle advances only when the
+        // hub accepts — so it is deferred to the outermost commit. Deferring is what
+        // guarantees the request exists to be settled by the time the lane can
+        // settle it.
+        const build = deps.groupManager.buildEnactLedgerCommit({
+            groupID,
+            tokens: [
+                token
+            ],
+            requestID
+        });
+        deps.stores.onCommit(()=>{
+            void deps.commitToGroup(groupID, build).catch((error)=>{
+                deps.logger.error('enact-ledger commit lane failed', {
+                    groupID,
+                    error
+                });
+                // A lane throw is the group refusing the entry or the deadline
+                // expiring — the request is over and the app must be told. The local
+                // admin gate is NOT this: it throws before anything is enqueued, so a
+                // refused caller has no row to settle.
+                settleRejectedFromLane(requestID, error);
+            });
+        });
+        // Built from the values just written rather than read back: this handler
+        // runs inside `mutateGraph`'s write transaction, so the enqueued row is not
+        // yet visible on any other connection.
+        return {
+            id: requestID,
+            groupID,
+            kind: 'ledger',
+            status: 'pending',
+            error: null,
+            enqueuedAt,
+            settledAt: null
+        };
+    };
     return {
         create: async (input)=>{
             const result = await deps.groupManager.createGroup({
@@ -80,29 +248,46 @@ export function createGroupContext(ctx, deps) {
                 createdAt: toISO(row.created_at)
             };
         },
-        addMember: async (groupID, memberDID, role)=>{
+        requireAdmin: async (groupID, action)=>{
             const store = await getP2PStore();
-            await store.addGroupMember({
-                group_id: groupID,
-                member_did: memberDID,
-                role,
-                hlc: HLC.serialize(deps.hlc.now())
-            });
-            const row = await store.getGroupMember(groupID, memberDID);
-            if (row == null) throw new Error('Failed to add group member');
-            const memberData = {
-                groupID: row.group_id,
-                memberDID: row.member_did,
-                role: row.role,
-                createdAt: toISO(row.created_at)
-            };
-            await deps.emitter.emit('groupMemberJoined', {
-                ...memberData,
-                groupID: memberData.groupID
+            await requireGroupAdmin({
+                store,
+                groupID,
+                did: deps.identity.id,
+                action
+            });
+        },
+        requireCircleAdmin: async (circleID, action)=>{
+            const store = await getP2PStore();
+            // Tombstoned circles count: deleting an already-deleted circle is a no-op
+            // the gate still has to run ahead of, and skipping them here would send
+            // that path back through a context-method gate whose extensions the
+            // rollback wrapper strips.
+            const circle = await store.getCircle(circleID, {
+                includeRemoved: true
             });
-            return memberData;
+            if (circle == null) {
+                // A gate that returns for an unknown id passes every caller it cannot
+                // place in a group. Safe today only because each op re-reads the circle
+                // and refuses, so the gate would be the only thing between a stranger and
+                // an operation if one ever stopped.
+                throw new Error(`Failed to ${action}: circle not found`);
+            }
+            await requireGroupAdmin({
+                store,
+                groupID: circle.group_id,
+                did: deps.identity.id,
+                action
+            });
+        },
+        isAdmin: async (groupID, did)=>{
+            const store = await getP2PStore();
+            // The same call `requireGroupAdmin` makes, deliberately: one membership
+            // row is the single answer to "may this DID act as an admin", so what a
+            // read surface reports and what the gate enforces cannot drift apart.
+            return await store.isGroupAdmin(groupID, did);
         },
-        setMemberRole: async ({ groupID, memberDID, role })=>{
+        requestSetMemberRole: async ({ groupID, memberDID, role })=>{
             const store = await getP2PStore();
             // Read the anchor through the engine transaction's stores: under
             // `mutateGraph` this handler already runs inside that transaction, so the
@@ -119,99 +304,115 @@ export function createGroupContext(ctx, deps) {
             // Defense-in-depth + fail-loud UX. The fold on every peer is the ultimate
             // authority — a non-admin's entry is dropped at fold time — but checking
             // here lets the caller fail loudly instead of silently emitting a no-op.
-            if (!await isLedgerAdminAtHLC({
+            // The GraphQL resolver runs this same gate before its rollback wrapper so
+            // the refusal keeps its code; repeating it here covers direct callers.
+            await requireGroupAdmin({
                 store,
                 groupID,
-                anchor,
                 did: selfDID,
-                atHLC: hlc,
-                logger: deps.logger
-            })) {
-                throw new Error('not authorized: only a group admin can set member roles');
-            }
+                action: 'set member roles'
+            });
             if (role === 'admin') {
                 // Admin implies membership: a grant must target an existing member.
                 if (!await store.isGroupMemberAtHLC(groupID, memberDID, hlc)) {
                     throw new Error('cannot grant admin to a non-member');
                 }
-            } else if (!await isLedgerAdminAtHLC({
-                store,
-                groupID,
-                anchor,
-                did: memberDID,
-                atHLC: hlc,
-                logger: deps.logger
-            })) {
-                // Demoting a DID that is not currently an admin is a no-op; don't mint a
-                // dead ledger entry + broadcast for it.
-                const existing = await store.getGroupMember(groupID, memberDID);
-                if (existing == null) {
-                    throw new Error('cannot change role: not a group member');
+            } else {
+                if (!await store.isGroupAdmin(groupID, memberDID)) {
+                    // Demoting a DID that is not currently an admin is a no-op; don't mint
+                    // a dead ledger entry + broadcast for it. The caller still gets a real,
+                    // resolvable request — one that is already settled, because the state
+                    // it asked for is the state that already holds. No lane runs, so
+                    // nothing here may touch the commit path.
+                    const existing = await store.getGroupMember(groupID, memberDID);
+                    if (existing == null) {
+                        throw new Error('cannot change role: not a group member');
+                    }
+                    return await settleNoOpRequest(groupID);
+                }
+                // Refuse the last admin's demotion where the caller can see it, the same
+                // guard `leave` and `requestRemoveMember` apply to their own paths. The
+                // group would refuse it anyway — the fold drops an entry that empties the
+                // admin set — but that refusal arrives asynchronously, on the lane, as a
+                // `rejected` settle the caller has to wait for, and a group with no admin
+                // can never grant, revoke or remove again, so this is fail-closed.
+                //
+                // The survivor set comes from the same projected rows the authority check
+                // above reads, exactly as `requestRemoveMember` counts its own: a grant
+                // reaches the ledger when it is signed but the projection only when its
+                // commit is enacted, so counting ledger admins would let the only admin
+                // who can still act be demoted in favour of one who cannot yet.
+                const members = await store.listGroupMembers(groupID);
+                const survivors = members.filter((member)=>member.role === 'admin' && normalizeDID(member.member_did) !== normalizeDID(memberDID));
+                if (survivors.length === 0) {
+                    throw new GraphQLError('cannot demote: this is the only admin — promote another member first', {
+                        extensions: {
+                            code: GROUP_CONTROL_DENIED,
+                            reason: LAST_GROUP_ADMIN,
+                            groupID
+                        }
+                    });
                 }
-                return {
-                    groupID: existing.group_id,
-                    memberDID: existing.member_did,
-                    role: existing.role,
-                    createdAt: toISO(existing.created_at)
-                };
             }
-            const value = role === 'admin' ? 'admin' : 'revoked';
+            const value = role === 'admin' ? 'admin' : 'member';
             const token = await signLedgerEntry(deps.identity, {
                 type: ADMIN_ROLE_ENTRY_TYPE,
                 subject: memberDID,
                 value,
-                hlc
+                groupID,
+                ord: hlc
             });
-            const entryID = ledgerEntryDigest(token);
-            // Append the durable entry and reproject the admin overlay atomically, so a
-            // crash can never leave the durable ledger and the projected `role` column
-            // diverged. Reads inside the transaction use the transaction-bound store.
-            // `appendLedgerEntry` normalizes `issuer_did`, so the raw self DID is passed.
-            const memberData = await deps.stores.withTransaction(async (tx)=>{
+            // The `role` column and `groupMemberRoleChanged` are both written by the
+            // roster mirror when the commit lands, so what comes back is the PENDING
+            // request, not a member row.
+            const requestID = deps.runtime.getRandomID();
+            const enqueuedAt = new Date().toISOString();
+            await deps.stores.withTransaction(async (tx)=>{
                 const txStore = await resolveP2PStore(tx);
-                await txStore.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: ADMIN_ROLE_ENTRY_TYPE,
-                    subject: memberDID,
-                    value,
-                    hlc,
-                    issuer_did: selfDID,
-                    signed_token: token
-                });
-                await reprojectAdminRoster({
-                    store: txStore,
+                await txStore.enqueueControlRequest({
+                    id: requestID,
                     groupID,
-                    anchor,
-                    logger: deps.logger
+                    kind: 'ledger',
+                    enqueuedAt
                 });
-                const row = await txStore.getGroupMember(groupID, memberDID);
-                if (row == null) throw new Error('Failed to read group member after role change');
-                return {
-                    groupID: row.group_id,
-                    memberDID: row.member_did,
-                    role: row.role,
-                    createdAt: toISO(row.created_at)
-                };
             });
-            // Record-before-send: defer the fan-out (so co-members fold the same entry
-            // against their own anchor) and the local emit to the OUTERMOST commit. Under
-            // `mutateGraph` this handler runs inside the engine's write transaction, so
-            // the inner `withTransaction` above nests inline and does NOT commit on its
-            // own — the outer transaction commits later. Registering via `onCommit` keeps
-            // a rolled-back role change from ever being broadcast or observed locally.
-            deps.stores.onCommit(()=>{
-                deps.scheduleBroadcast(groupID, {
-                    type: 'ledger:entry',
-                    groupID,
+            // The commit is the ONLY delivery of the role change: without it a newly
+            // promoted admin is an admin nowhere and every commit they author is refused.
+            // Driven AFTER the request row is durable and deferred to the outermost
+            // commit, because the local MLS handle advances only when the hub accepts. A
+            // missing commit hub is logged on the lane's promise, not fatal.
+            const build = deps.groupManager.buildEnactLedgerCommit({
+                groupID,
+                tokens: [
                     token
-                });
-                void deps.emitter.emit('groupMemberRoleChanged', {
-                    ...memberData,
-                    groupID: memberData.groupID
+                ],
+                requestID
+            });
+            deps.stores.onCommit(()=>{
+                void deps.commitToGroup(groupID, build).catch((error)=>{
+                    deps.logger.error('enact-ledger commit lane failed', {
+                        groupID,
+                        error
+                    });
+                    // A lane throw is the group refusing the entry or the deadline
+                    // expiring — the request is over and the app must be told. The local
+                    // admin gate is NOT this: it throws above, before anything is
+                    // enqueued, so a refused caller has no row to settle.
+                    settleRejectedFromLane(requestID, error);
                 });
             });
-            return memberData;
+            // Built from the values just written rather than read back: this handler
+            // runs inside `mutateGraph`'s write transaction, so the enqueued row is
+            // not yet visible on any other connection.
+            return {
+                id: requestID,
+                groupID,
+                kind: 'ledger',
+                status: 'pending',
+                error: null,
+                enqueuedAt,
+                settledAt: null
+            };
         },
         listMembers: async (groupID)=>{
             const store = await getP2PStore();
@@ -223,8 +424,19 @@ export function createGroupContext(ctx, deps) {
                     createdAt: toISO(row.created_at)
                 }));
         },
-        createCircle: async (p)=>{
-            const groupID = p.groupID;
+        requestCreateCircle: async (input)=>{
+            const groupID = input.groupID;
+            const store = await getP2PStore();
+            // Defense-in-depth + fail-loud UX. The fold on every peer is the ultimate
+            // authority — a non-admin's entry is dropped at fold time — but checking
+            // here lets the caller fail loudly instead of receiving a request that
+            // settles `committed` for a circle no peer ever projects.
+            await requireGroupAdmin({
+                store,
+                groupID,
+                did: deps.identity.id,
+                action: 'create a circle'
+            });
             // Read the anchor through the engine transaction's stores: under
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
@@ -235,87 +447,65 @@ export function createGroupContext(ctx, deps) {
             if (anchor == null) {
                 throw new Error('cannot create circle: group has no genesis anchor');
             }
-            const circleID = deps.runtime.getRandomID();
+            // The caller is handed the id back before the commit lands, because every
+            // step that follows a create — membership, catalogs, the invite seeds —
+            // names the circle by id. An internal caller may supply a DERIVED id so
+            // its own retry converges on this circle; see `CreateCircleInput`.
+            const circleID = input.circleID ?? mintCircleID();
             const hlc = HLC.serialize(deps.hlc.now());
             const value = {
-                name: p.name,
-                description: p.description ?? '',
+                name: input.name,
+                description: input.description ?? '',
                 catalogIDs: []
             };
             const token = await signLedgerEntry(deps.identity, {
                 type: CIRCLE_DEF_ENTRY_TYPE,
                 subject: circleID,
                 value,
-                hlc
-            });
-            const entryID = ledgerEntryDigest(token);
-            // Append the signed entry and reproject the circle-definition overlay
-            // atomically so a crash can never leave the durable ledger and the
-            // projected row diverged. `appendLedgerEntry` normalizes `issuer_did`, so
-            // the raw self DID is passed.
-            const circleData = await deps.stores.withTransaction(async (tx)=>{
-                const txStore = await resolveP2PStore(tx);
-                await txStore.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: CIRCLE_DEF_ENTRY_TYPE,
-                    subject: circleID,
-                    value,
-                    hlc,
-                    issuer_did: deps.identity.id,
-                    signed_token: token
-                });
-                await reprojectCircleDefs({
-                    store: txStore,
-                    groupID,
-                    anchor,
-                    logger: deps.logger
-                });
-                const row = await txStore.getCircle(circleID);
-                if (row == null) throw new Error('Failed to read circle after create');
-                return {
-                    id: row.id,
-                    groupID: row.group_id,
-                    name: row.name,
-                    description: row.description,
-                    createdAt: toISO(row.created_at)
-                };
+                groupID,
+                ord: hlc
             });
-            // Record-before-send: defer the fan-out (so co-members fold the same entry
-            // against their own anchor) and the local emit to the OUTERMOST commit. Under
-            // `mutateGraph` this handler runs inside the engine's write transaction, so
-            // the inner `withTransaction` above nests inline and does NOT commit on its
-            // own — the outer transaction commits later. Registering via `onCommit` keeps
-            // a rolled-back creation from ever being broadcast or observed locally.
-            deps.stores.onCommit(()=>{
-                deps.scheduleBroadcast(groupID, {
-                    type: 'ledger:entry',
-                    groupID,
-                    token
-                });
-                void deps.emitter.emit('circleCreated', {
-                    ...circleData,
-                    groupID: circleData.groupID
-                });
+            // No no-op branch: the subject is freshly minted, so there is no prior
+            // state for the requested one to already equal.
+            const request = await enqueueLedgerEntryRequest({
+                groupID,
+                token
             });
-            return circleData;
+            return {
+                request,
+                circleID
+            };
         },
         listCircles: async (groupID)=>{
             const store = await getP2PStore();
             const rows = await store.listCirclesByGroup(groupID);
-            return rows.map((row)=>({
-                    id: row.id,
-                    groupID: row.group_id,
-                    name: row.name,
-                    description: row.description,
-                    createdAt: toISO(row.created_at)
-                }));
+            return rows.map(toCircleData);
         },
-        addCircleMember: async (circleID, memberDID, role)=>{
+        requestAddCircleMember: async ({ circleID, memberDID, role })=>{
             const store = await getP2PStore();
             const circleRow = await store.getCircle(circleID);
             if (circleRow == null) throw new Error('Failed to add circle member: circle not found');
             const groupID = circleRow.group_id;
+            // Defense-in-depth + fail-loud UX, as in the other circle producers: an
+            // ungated non-admin's entry would ride a commit the group accepts, so the
+            // request would settle `committed` while every peer's fold drops it.
+            //
+            // It runs BEFORE the no-op check: answering a non-admin `no_op` would both
+            // grant them an outcome they have no authority to ask for and leak whether
+            // the membership they named already held.
+            await requireGroupAdmin({
+                store,
+                groupID,
+                did: deps.identity.id,
+                action: 'add a circle member'
+            });
+            // No-op when the DID is already an active member at exactly this role: the
+            // entry would fold to the state that already holds. A tombstoned row is NOT
+            // a no-op — re-adding it is a revival, and only a fresh entry performs one.
+            const existingMember = await store.getCircleMember(circleID, memberDID);
+            if (existingMember != null && existingMember.removed_at_hlc == null && existingMember.role === role) {
+                return await settleNoOpRequest(groupID);
+            }
             // Read the anchor through the engine transaction's stores: under
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
@@ -335,124 +525,122 @@ export function createGroupContext(ctx, deps) {
                 type: CIRCLE_MEMBER_ENTRY_TYPE,
                 subject,
                 value,
-                hlc
-            });
-            const entryID = ledgerEntryDigest(token);
-            // Append the signed entry and reproject the circle-member overlay
-            // atomically so a crash can never leave the durable ledger and the
-            // projected row diverged. `appendLedgerEntry` normalizes `issuer_did`, so
-            // the raw self DID is passed.
-            const circleMemberData = await deps.stores.withTransaction(async (tx)=>{
-                const txStore = await resolveP2PStore(tx);
-                await txStore.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: CIRCLE_MEMBER_ENTRY_TYPE,
-                    subject,
-                    value,
-                    hlc,
-                    issuer_did: deps.identity.id,
-                    signed_token: token
-                });
-                await reprojectCircleMembers({
-                    store: txStore,
-                    groupID,
-                    anchor,
-                    logger: deps.logger
-                });
-                const row = await txStore.getCircleMember(circleID, memberDID);
-                if (row == null) throw new Error('Failed to read circle member after add');
-                return {
-                    circleID: row.circle_id,
-                    memberDID: row.member_did,
-                    role: row.role,
-                    createdAt: toISO(row.created_at)
-                };
+                groupID,
+                ord: hlc
             });
-            // Record-before-send: defer the fan-out (so co-members fold the same entry
-            // against their own anchor) and the local emit to the OUTERMOST commit. Under
-            // `mutateGraph` this handler runs inside the engine's write transaction, so
-            // the inner `withTransaction` above nests inline and does NOT commit on its
-            // own — the outer transaction commits later. Registering via `onCommit` keeps
-            // a rolled-back addition from ever being broadcast or observed locally.
-            deps.stores.onCommit(()=>{
-                deps.scheduleBroadcast(groupID, {
-                    type: 'ledger:entry',
-                    groupID,
-                    token
-                });
-                void deps.emitter.emit('circleMemberAdded', {
-                    ...circleMemberData,
-                    circleID: circleMemberData.circleID
-                });
+            return await enqueueLedgerEntryRequest({
+                groupID,
+                token
             });
-            return circleMemberData;
         },
         createCatalog: async (p)=>{
             const graphStore = await getGraphStore();
-            const id = deps.runtime.getRandomID();
+            const id = p.catalogID ?? deps.runtime.getRandomID();
             const hlcStr = HLC.serialize(deps.hlc.now());
+            const filterCriteria = JSON.parse(p.filterCriteria);
+            // Sign a self-contained `catalog:set` token at creation so the catalog can
+            // be forwarded (invite seed / broadcast) with creator-bound provenance a
+            // receiver re-verifies. The signed record carries every authoritative field.
+            const signedToken = await signCatalogSet(deps.identity, {
+                id,
+                ownerDID: ctx.viewerDID,
+                name: p.name,
+                description: p.description ?? '',
+                filterCriteria,
+                hlc: hlcStr
+            });
             await graphStore.createCatalog({
                 id,
                 owner_did: ctx.viewerDID,
                 name: p.name,
                 description: p.description ?? '',
-                filter_criteria: JSON.parse(p.filterCriteria),
-                hlc: hlcStr
+                filter_criteria: filterCriteria,
+                hlc: hlcStr,
+                signed_token: signedToken
             });
             const row = await graphStore.getCatalog(id);
             if (row == null) throw new Error('Failed to create catalog');
-            return {
-                id: row.id,
-                ownerDID: row.owner_did,
-                name: row.name,
-                description: row.description,
-                filterCriteria: JSON.stringify(row.filter_criteria),
-                createdAt: toISO(row.created_at)
-            };
+            return toCatalogData(row);
         },
-        listCatalogs: async (ownerDID)=>{
+        listStoredCatalogs: async (filter)=>{
             const graphStore = await getGraphStore();
-            if (ownerDID != null) {
-                const rows = await graphStore.listCatalogs(ownerDID);
-                return rows.map((row)=>({
-                        id: row.id,
-                        ownerDID: row.owner_did,
-                        name: row.name,
-                        description: row.description,
-                        filterCriteria: JSON.stringify(row.filter_criteria),
-                        createdAt: toISO(row.created_at)
-                    }));
-            }
-            // listCatalogs requires ownerDID -- for unfiltered, list groups then catalogs
+            const rows = await graphStore.listStoredCatalogs(filter);
+            return rows.map(toCatalogData);
+        },
+        listControlRequests: async (groupID)=>{
             const store = await getP2PStore();
-            const groups = await store.listGroups();
-            const ownerDIDs = new Set(groups.map((s)=>s.created_by));
-            const allCatalogs = await Promise.all(Array.from(ownerDIDs).map((did)=>graphStore.listCatalogs(did)));
-            return allCatalogs.flat().map((row)=>({
-                    id: row.id,
-                    ownerDID: row.owner_did,
-                    name: row.name,
-                    description: row.description,
-                    filterCriteria: JSON.stringify(row.filter_criteria),
-                    createdAt: toISO(row.created_at)
-                }));
+            const rows = await store.getControlRequests(groupID);
+            return rows.map(toControlRequestData);
         },
-        invite: async (groupID, joinRequest, grants, revocations)=>{
-            checkPeerAccess(ctx.viewerDID, deps.identity.id, deps.autoAcceptPeers);
+        getControlRequest: async (id)=>{
             const store = await getP2PStore();
-            const ownIdentity = deps.identity;
-            const joinReq = decodeJoinRequest(joinRequest);
-            const result = await deps.groupManager.inviteToGroup({
+            const row = await store.getControlRequest(id);
+            return row == null ? null : toControlRequestData(row);
+        },
+        ackControlRequest: async (id)=>{
+            const store = await getP2PStore();
+            await store.ackControlRequest(id);
+        },
+        awaitSettle: async (id, timeoutMs)=>await awaitControlRequestSettled({
                 stores: deps.stores,
+                emitter: deps.emitter,
+                requestID: id,
+                timeoutMs
+            }),
+        activateCatalogSync: async (catalogID)=>{
+            const graphStore = await getGraphStore();
+            if (await graphStore.getCatalog(catalogID) == null) {
+                throw new Error(`Catalog ${catalogID} not found`);
+            }
+            await graphStore.setCatalogActive(catalogID, true);
+            const row = await graphStore.getCatalog(catalogID);
+            if (row == null) throw new Error(`Catalog ${catalogID} not found`);
+            return toCatalogData(row);
+        },
+        deactivateCatalogSync: async (catalogID)=>{
+            const graphStore = await getGraphStore();
+            if (await graphStore.getCatalog(catalogID) == null) {
+                throw new Error(`Catalog ${catalogID} not found`);
+            }
+            await graphStore.setCatalogActive(catalogID, false);
+            const row = await graphStore.getCatalog(catalogID);
+            if (row == null) throw new Error(`Catalog ${catalogID} not found`);
+            return toCatalogData(row);
+        },
+        requestInvite: async (input)=>{
+            const { groupID, joinRequest, grants, revocations } = input;
+            checkPeerAccess(ctx.viewerDID, deps.identity.id, deps.autoAcceptPeers);
+            const store = await getP2PStore();
+            // Inviting adds a member to the MLS group — an admin action. kumiai already
+            // gates the committer at BUILD time (`createInvite` throws "the inviter must
+            // be an admin in the group roster"), so without this gate a non-admin's
+            // invite still fails — but only after enqueuing a request and reaching the
+            // lane, which then settles `rejected` on the build throw. This gate makes it
+            // fail fast and clean (`NOT_GROUP_ADMIN` before any row is written), and it
+            // is the local half of the defense-in-depth the receive side completes: the
+            // one path kumiai's build gate cannot catch is an inviter admin at build who
+            // is demoted before co-members fold the commit, which the receive policy
+            // refuses (`CommitRejectedError`, group-mls.ts).
+            await requireGroupAdmin({
+                store,
                 groupID,
-                identity: ownIdentity,
-                recipientDID: joinReq.did,
-                recipientKeyPackage: joinReq.publicPackage,
-                permission: 'member'
+                did: deps.identity.id,
+                action: 'invite a member to the group'
             });
-            // Look up group name for the invite payload
+            const ownIdentity = deps.identity;
+            const joinReq = decodeJoinRequest(joinRequest);
+            // The recipient comes from the KeyPackage's own credential, never from the
+            // request's `did` field. The two halves go to different subsystems — the
+            // KeyPackage becomes an MLS leaf, this DID becomes a membership row and a
+            // role entry — so a forged pairing names one identity in the ratchet and
+            // another in the projections, and nothing downstream reconciles them: a
+            // co-member folds the row from the roster diff while the inviter writes
+            // the one it was handed. Resolving here makes every caller safe rather
+            // than each having to remember.
+            const recipientDID = resolveJoinRequestDID(joinRequest);
             const groupRow = await store.getGroup(groupID);
+            if (groupRow == null) throw new Error('Failed to invite member: group not found');
+            const groupName = groupRow.name;
             const boundHubs = await store.listHubsByGroupID(groupID);
             const suggestedHubs = boundHubs.map((hub)=>hub.server_did == null ? {
                     url: hub.url
@@ -460,34 +648,121 @@ export function createGroupContext(ctx, deps) {
                     url: hub.url,
                     serverDID: hub.server_did
                 });
-            const encoded = encodeInvitePayload({
+            // Seed the joiner with the group's control state so it is current the
+            // instant it joins — the ledger (circles/members/admin roster), the
+            // inviter's own model access-defaults, and the group's catalogs — without
+            // waiting for a broadcast or a catch-up round-trip.
+            //
+            // Collected ONCE, here, rather than per attempt inside the encoder: they
+            // are the caller's snapshot of the group's control state, and nothing in
+            // them turns on which attempt the group accepts. Re-collecting per rebase
+            // would only make the payload vary between attempts for no gain.
+            const seeds = await collectInviteSeeds({
+                stores: deps.stores,
+                identity: ownIdentity,
+                ownerDID: ctx.viewerDID,
                 groupID,
-                groupName: groupRow?.name ?? '',
-                suggestedHubs,
-                invite: result.invite,
-                welcomeMessage: result.welcomeMessage,
-                ratchetTree: result.ratchetTree,
-                ...grants != null && grants.length > 0 ? {
-                    grants
-                } : {},
-                ...revocations != null && revocations.length > 0 ? {
-                    revocations
-                } : {}
+                logger: deps.logger
+            });
+            const requestID = deps.runtime.getRandomID();
+            const enqueuedAt = new Date().toISOString();
+            await deps.stores.withTransaction(async (tx)=>{
+                const txStore = await resolveP2PStore(tx);
+                await txStore.enqueueControlRequest({
+                    id: requestID,
+                    groupID,
+                    kind: 'invite',
+                    enqueuedAt
+                });
             });
-            await deps.emitter.emit('groupMemberJoined', {
+            const build = deps.groupManager.buildInviteCommit({
                 groupID,
-                memberDID: joinReq.did,
-                role: 'member',
-                createdAt: new Date().toISOString()
-            });
-            // Fan out the add-commit to existing members so their MLS ratchet +
-            // local roster learn about the new member (RFC 9750 §6.1). The joiner
-            // itself receives the Welcome out-of-band via the invite payload above.
-            deps.stores.onCommit(()=>deps.scheduleSendCommit(groupID, result.commitMessage));
+                identity: ownIdentity,
+                recipientDID,
+                recipientKeyPackage: joinReq.publicPackage,
+                permission: 'member',
+                requestID,
+                encodeInvitePayload: async (material)=>encodeInvitePayload({
+                        groupID,
+                        groupName,
+                        suggestedHubs,
+                        invite: material.invite,
+                        welcomeMessage: material.welcomeMessage,
+                        ratchetTree: material.ratchetTree,
+                        ...grants != null && grants.length > 0 ? {
+                            grants
+                        } : {},
+                        ...revocations != null && revocations.length > 0 ? {
+                            revocations
+                        } : {},
+                        ...seeds.accessDefaults.length > 0 ? {
+                            accessDefaults: seeds.accessDefaults
+                        } : {},
+                        ...seeds.catalogs.length > 0 ? {
+                            catalogs: seeds.catalogs
+                        } : {}
+                    })
+            });
+            deps.stores.onCommit(()=>{
+                void deps.commitToGroup(groupID, build).catch((error)=>{
+                    deps.logger.error('invite commit lane failed', {
+                        groupID,
+                        error
+                    });
+                    settleRejectedFromLane(requestID, error);
+                });
+            });
+            let settled;
+            try {
+                settled = await awaitControlRequestSettled({
+                    stores: deps.stores,
+                    emitter: deps.emitter,
+                    requestID,
+                    timeoutMs: deps.inviteCommitTimeoutMs ?? INVITE_COMMIT_TIMEOUT
+                });
+            } catch (waitError) {
+                // The wait elapsed without a settle. A PARKED Add commit (the inviter's
+                // hub is offline) leaves the request `pending` and the commit still in
+                // flight — it may yet land and add the member — so this is NOT a failure
+                // to report. Read the authoritative row: only a still-`pending` request
+                // returns the truthful pending shape below; anything else fell through
+                // the wait's own settle/timeout race and is handled by the status branch.
+                const parkedRow = await store.getControlRequest(requestID);
+                if (parkedRow == null) {
+                    throw waitError;
+                }
+                settled = toControlRequestData(parkedRow);
+            }
+            if (settled.status === 'pending') {
+                // Truthful pending result — NOT a throw: the caller learns the invite has
+                // not landed yet rather than being told it failed. `request` carries that
+                // status back. No payload rides a pending result: the commit that would
+                // produce it has not been accepted, so there is nothing to hand over yet.
+                return {
+                    request: settled,
+                    invitePayload: null,
+                    groupID,
+                    groupName
+                };
+            }
+            if (settled.status !== 'committed') {
+                // A definitively-failed invite (`rejected`/`lost`/`no_op`) SHOULD report
+                // failure — a settled-negative is a real error, not a pending outcome.
+                throw new Error(`group/invite: the add commit did not land (${settled.status}${settled.error == null ? '' : ` — ${settled.error}`})`);
+            }
+            // Read the payload from the settled row rather than from the callback that
+            // fired alongside it: this is the one route both the live path and a
+            // replayed adopt write to, so a caller answered after a restart is
+            // answered identically.
+            const invitePayload = await store.getControlRequestResult(requestID);
+            if (invitePayload == null) {
+                throw new Error('group/invite: the add commit landed without an invite payload');
+            }
             return {
-                invitePayload: encoded,
+                request: settled,
+                invitePayload,
                 groupID,
-                groupName: groupRow?.name ?? ''
+                groupName
             };
         },
         join: async (invitePayloadStr, joinRequestPayloadStr)=>{
@@ -529,6 +804,25 @@ export function createGroupContext(ctx, deps) {
                 emitter: deps.emitter,
                 logger: deps.logger
             });
+            // Fold the invite-carried control state (ledger, access-defaults,
+            // catalogs) now the MLS handle exists, so the genesis anchor is readable
+            // and the joiner projects circles/members at join. Reads the anchor
+            // through the engine transaction's stores so the registry shares its
+            // connection (a separate connection deadlocks single-connection SQLite).
+            await applyInviteControlState({
+                stores: deps.stores,
+                groupID: invite.groupID,
+                accessDefaults: invite.accessDefaults,
+                catalogs: invite.catalogs,
+                hlc: deps.hlc,
+                getGroupAnchor: (gid)=>deps.registry.readHandle(gid, (handle)=>readGroupAnchor(handle), {
+                        stores: deps.stores
+                    }),
+                getGroupLedger: (gid)=>deps.registry.readHandle(gid, (handle)=>handle.ledger, {
+                        stores: deps.stores
+                    }),
+                logger: deps.logger
+            });
             return await finalizeJoinedGroup({
                 stores: deps.stores,
                 emitter: deps.emitter,
@@ -538,135 +832,228 @@ export function createGroupContext(ctx, deps) {
         },
         leave: async (groupID)=>{
             // One HLC orders BOTH the MLS self-removal tombstone and the admin-role
-            // self-revocation appended below. Sharing a single stamp is what lets a
+            // self-revocation enacted below. Sharing a single stamp is what lets a
             // receiver's deterministic fold keep this leaver's control entries signed
             // at or before departure and drop everything they sign strictly later.
             const hlc = HLC.serialize(deps.hlc.now());
             const store = await getP2PStore();
             const groupRow = await store.getGroup(groupID);
             const ownIdentity = deps.identity;
-            // Read the anchor while the MLS handle is still live — `leaveGroup` tears
-            // it down. Under `mutateGraph` this handler already runs inside the engine
-            // transaction, so the registry's restore/persist must share its connection
-            // (a separate connection blocks on the outer write lock under SQLite).
-            const anchor = await deps.registry.readHandle(groupID, async (handle)=>readGroupAnchor(handle), {
+            // Anchor and roster in one lock: both come from the live handle, which
+            // `leaveGroup` tears down. Under `mutateGraph` this handler already runs
+            // inside the engine transaction, so the registry's restore/persist must
+            // share its connection (a separate connection blocks on the outer write
+            // lock under SQLite).
+            const { anchor, roster } = await deps.registry.readHandle(groupID, async (handle)=>({
+                    anchor: readGroupAnchor(handle),
+                    roster: handle.roster
+                }), {
                 stores: deps.stores
             });
-            // Resolve self-admin BEFORE the self-tombstone: once the tombstone writes
-            // `removed_at_hlc == hlc`, membership-at-HLC (which requires
-            // `removed_at_hlc > hlc`) would read false and wrongly report the leaver
-            // as a non-admin, suppressing the revocation.
-            const selfIsAdmin = anchor != null && await isLedgerAdminAtHLC({
-                store,
-                groupID,
-                anchor,
-                did: ownIdentity.id,
-                atHLC: hlc,
-                logger: deps.logger
-            });
-            // Revoke the leaver's own control authority atomically with the tombstone.
-            // Only admins fold authoritatively, so only an admin needs revoking — a
-            // non-admin leave appends nothing and broadcasts no ledger entry.
+            // Authority is read from the HANDLE's roster, not the membership row's
+            // `role`, because the demotion below has to be one the group will enact:
+            // `commitLedgerEntries` judges the roster its own ledger folds to and
+            // refuses an entry that would empty the admin set. Reading the mirrored
+            // column instead lets this producer mint an entry the commit then refuses,
+            // and a lane failure is logged rather than returned — so the caller would
+            // watch a leave succeed and nothing happen.
+            const selfIsAdmin = anchor != null && roster.roles.get(normalizeDID(ownIdentity.id)) === 'admin';
+            // Revoke the leaver's own control authority as it goes. Only admins fold
+            // authoritatively, so only an admin needs revoking — a non-admin leave
+            // enacts no ledger entry and drives no commit.
             let revokeToken = null;
-            if (selfIsAdmin && anchor != null) {
-                const value = 'revoked';
-                const token = await signLedgerEntry(deps.identity, {
-                    type: ADMIN_ROLE_ENTRY_TYPE,
-                    subject: ownIdentity.id,
-                    value,
-                    hlc
-                });
-                const entryID = ledgerEntryDigest(token);
-                // `appendLedgerEntry` normalizes `issuer_did`, so the raw self DID is passed.
-                await store.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
+            // A group the leaver is alone in has nobody to revoke to and no state to
+            // converge: leaving it is deleting it. Nothing is enacted, so a solo owner
+            // is never trapped in their own group by the guard below.
+            // From the ROSTER, like the authority above it and for the same reason: a
+            // projection that lags reports a group this device is alone in, which skips
+            // the last-admin guard entirely and lets the only admin walk out of a group
+            // that still has members.
+            const hasCoMembers = [
+                ...roster.roles.keys()
+            ].some((did)=>normalizeDID(did) !== normalizeDID(ownIdentity.id));
+            if (selfIsAdmin && anchor != null && hasCoMembers) {
+                // Refuse the last admin's departure where the caller can see it. The
+                // group would refuse it anyway — one admin means this demotion empties
+                // the admin set — but that refusal arrives on the lane, asynchronously,
+                // as a log line. The app's move is to promote a successor first.
+                if (adminCount(roster) <= 1) {
+                    throw new GraphQLError('cannot leave: you are the only admin — promote another member first', {
+                        extensions: {
+                            code: GROUP_CONTROL_DENIED,
+                            reason: LAST_GROUP_ADMIN,
+                            groupID
+                        }
+                    });
+                }
+                revokeToken = await signLedgerEntry(deps.identity, {
                     type: ADMIN_ROLE_ENTRY_TYPE,
                     subject: ownIdentity.id,
-                    value,
-                    hlc,
-                    issuer_did: ownIdentity.id,
-                    signed_token: token
-                });
-                await reprojectAdminRoster({
-                    store,
+                    value: 'member',
                     groupID,
-                    anchor,
-                    logger: deps.logger
+                    ord: hlc
                 });
-                revokeToken = token;
             }
-            // Both broadcasts go out BEFORE MLS teardown — once `leaveGroup` deletes
-            // the local MLS handle we can no longer encrypt to the group. They are
-            // awaited (not deferred to `onCommit`) so the encrypt happens against the
-            // still-live handle; deferring would fail with the handle gone. A pre-commit
-            // send that a later rollback orphans is benign here: it is an authentic
-            // self-signed revoke converging early, monotonic toward less privilege for
-            // a DID that itself invoked leave — symmetric to the leaveRequest below.
-            // Best-effort: a failed notify must not block the leave itself.
-            try {
-                await deps.broadcastNow(groupID, {
-                    type: 'group:leaveRequest',
+            const leftData = groupRow != null ? {
+                id: groupRow.id,
+                name: groupRow.name,
+                description: groupRow.description,
+                createdBy: groupRow.created_by,
+                createdAt: toISO(groupRow.created_at),
+                groupID
+            } : null;
+            // Announce the departure, then tear the MLS state down. The order is
+            // load-bearing: the announcement is encrypted to the group, and teardown
+            // deletes the key it encrypts under. Advisory and best-effort — a failed
+            // notify must not block the leave itself.
+            const announceAndTearDown = async ()=>{
+                try {
+                    await deps.broadcastNow(groupID, {
+                        type: 'group:leaveRequest',
+                        groupID,
+                        memberDID: ownIdentity.id,
+                        hlc
+                    });
+                } catch (error) {
+                    deps.logger.warn('leave-request broadcast failed', {
+                        groupID,
+                        error
+                    });
+                }
+                // `deviceStores`, never `stores`: this runs after the commit lane has
+                // resolved, so under `mutateGraph` the request's transaction is long
+                // over and a write through it would never land — silently, since
+                // nothing throws and the lane's `catch` sees no error. The departed
+                // admin would keep its MLS state, and so the group's key.
+                await deps.groupManager.leaveGroup({
+                    stores: deps.deviceStores,
                     groupID,
-                    memberDID: ownIdentity.id,
+                    identity: ownIdentity,
                     hlc
                 });
-            } catch (error) {
-                deps.logger.warn('leave-request broadcast failed', {
-                    groupID,
-                    error
-                });
-            }
-            if (revokeToken != null) {
+            };
+            // The same order with the local rows already written: announce first, then
+            // drop the key that the announcement was encrypted under.
+            const announceThenDropKey = async ()=>{
                 try {
                     await deps.broadcastNow(groupID, {
-                        type: 'ledger:entry',
+                        type: 'group:leaveRequest',
                         groupID,
-                        token: revokeToken
+                        memberDID: ownIdentity.id,
+                        hlc
                     });
                 } catch (error) {
-                    deps.logger.warn('self-revoke broadcast failed', {
+                    deps.logger.warn('leave-request broadcast failed', {
                         groupID,
                         error
                     });
                 }
+                await deps.groupManager.tearDownGroupMLS(deps.deviceStores, groupID);
+            };
+            const emitGroupLeft = ()=>{
+                if (leftData == null) return;
+                deps.emitter.emit('groupLeft', leftData).catch((error)=>{
+                    deps.logger.error('groupLeft emit failed', {
+                        groupID,
+                        error
+                    });
+                });
+            };
+            if (revokeToken == null) {
+                // Nothing to enact, so nothing to confirm — but still nothing that may
+                // be AWAITED here. The announcement publishes on the group's lane, which
+                // encrypts under the live handle, and this handler runs inside the
+                // engine's write transaction: the lane's own reads take a second
+                // connection and block on the outer write lock, so awaiting it hangs the
+                // mutation for good on a hub-bound group. Deferred to the outermost
+                // commit for exactly the reason the self-revoke path below is.
+                //
+                // The LOCAL record of the departure is written here rather than out
+                // there, because it must be true the moment this returns: a screen that
+                // navigates away on success would otherwise still be told this device
+                // belongs to the group it just left.
+                await deps.groupManager.markGroupLeft({
+                    stores: deps.stores,
+                    groupID,
+                    identity: ownIdentity,
+                    hlc
+                });
+                deps.stores.onCommit(()=>{
+                    // A tick past the commit hook, not just past the transaction: KubunDB
+                    // fires a non-transactional `onCommit` SYNCHRONOUSLY, so a store write
+                    // made from inside it still lands while the outer write is finalizing
+                    // and blocks on the connection it is holding.
+                    setTimeout(()=>{
+                        void announceThenDropKey().then(emitGroupLeft).catch((error)=>{
+                            deps.logger.error('leave teardown failed', {
+                                groupID,
+                                error
+                            });
+                        });
+                    }, 0);
+                });
+                return {
+                    groupID
+                };
             }
-            await deps.groupManager.leaveGroup({
-                stores: deps.stores,
+            // The commit is the ONLY delivery of the self-demotion, and the leave waits
+            // on it. A revocation that reached co-members by an ephemeral broadcast
+            // alone was held by whoever happened to be listening and by no one else,
+            // and it never entered the group's authenticated ledger at all — so a peer
+            // that rebuilt from that ledger folded the departed admin back to admin.
+            //
+            // Local state therefore moves only once the group has taken the demotion:
+            // teardown runs on the lane's success, and the entry lands in this device's
+            // own store through the same fold every co-member runs. A lane that never
+            // lands leaves the leaver in the group, still an admin — the state the
+            // group agrees on — rather than a member of nothing who is an admin
+            // everywhere.
+            const requestID = deps.runtime.getRandomID();
+            const enqueuedAt = new Date().toISOString();
+            await deps.stores.withTransaction(async (tx)=>{
+                const txStore = await resolveP2PStore(tx);
+                await txStore.enqueueControlRequest({
+                    id: requestID,
+                    groupID,
+                    kind: 'ledger',
+                    enqueuedAt
+                });
+            });
+            const build = deps.groupManager.buildEnactLedgerCommit({
                 groupID,
-                identity: ownIdentity,
-                hlc
+                tokens: [
+                    revokeToken
+                ],
+                requestID
             });
-            if (groupRow != null) {
-                const leftData = {
-                    id: groupRow.id,
-                    name: groupRow.name,
-                    description: groupRow.description,
-                    createdBy: groupRow.created_by,
-                    createdAt: toISO(groupRow.created_at),
-                    groupID
-                };
-                // Defer past the outermost commit: the `groupLeft` listener reads the P2P
-                // store on the main connection (deadlocks single-conn SQLite / uncommitted on PG).
-                deps.stores.onCommit(()=>{
-                    deps.emitter.emit('groupLeft', leftData).catch((error)=>{
-                        deps.logger.error('groupLeft emit failed', {
-                            groupID,
-                            error
-                        });
+            // Deferred to the outermost commit for the reason every other lane is:
+            // awaiting it inside this write transaction deadlocks the single
+            // connection the lane's own reads need.
+            deps.stores.onCommit(()=>{
+                void deps.commitToGroup(groupID, build).then(async ()=>{
+                    await announceAndTearDown();
+                    // Already past the outermost commit here, so the emit needs no
+                    // further deferral: the listener's reads run on their own connection.
+                    emitGroupLeft();
+                }).catch((error)=>{
+                    deps.logger.error('leave self-revoke commit lane failed', {
+                        groupID,
+                        error
                     });
+                    settleRejectedFromLane(requestID, error);
                 });
-            }
+            });
             return {
                 groupID
             };
         },
-        removeMember: async (groupID, memberDID)=>{
-            // One HLC orders BOTH the MLS-roster tombstone and the admin-role
-            // revocation appended below. Sharing a single stamp is what makes the
-            // revocation drop exactly the ex-admin's control entries signed after the
-            // removal: the deterministic fold keeps entries at or before this HLC and
-            // drops everything the ex-admin signs strictly later.
+        requestRemoveMember: async (input)=>{
+            const { groupID, memberDID } = input;
+            // One HLC orders BOTH the MLS-roster tombstone the accepted commit writes
+            // and the admin-role revocation signed below to ride it. Sharing a single
+            // stamp is what makes the revocation drop exactly the ex-admin's control
+            // entries signed after the removal: the deterministic fold keeps entries
+            // at or before this HLC and drops everything signed strictly later.
             const hlc = HLC.serialize(deps.hlc.now());
             // Read the anchor through the engine transaction's stores: under
             // `mutateGraph` this handler already runs inside that transaction, so the
@@ -680,110 +1067,177 @@ export function createGroupContext(ctx, deps) {
             }
             const store = await getP2PStore();
             const selfDID = deps.identity.id;
-            // Only a current admin may remove a member. This gate runs BEFORE the
-            // roster tombstone so a non-admin attempt rolls back without touching the
-            // MLS roster; the schema-layer `failTransactionFatal` wrap turns the throw
-            // into a full-transaction rollback and forwards the message to the caller.
-            if (!await isLedgerAdminAtHLC({
+            // Only a current admin may remove a member. This gate runs before anything
+            // is signed or enqueued, so a non-admin attempt leaves no request behind;
+            // the schema-layer `failTransactionFatal` wrap turns the throw into a
+            // full-transaction rollback and forwards the message to the caller. The
+            // resolver runs the same gate ahead of that wrap so the refusal keeps its
+            // code; repeating it here covers direct callers.
+            await requireGroupAdmin({
                 store,
                 groupID,
-                anchor,
                 did: selfDID,
-                atHLC: hlc,
-                logger: deps.logger
-            })) {
-                throw new Error('only a group admin can remove a member');
-            }
-            // Resolve whether the removed DID is an admin BEFORE the tombstone. Once
-            // the roster tombstone writes `removed_at_hlc == hlc`, membership-at-HLC
-            // (which requires `removed_at_hlc > hlc`) would read false and wrongly
-            // report a removed admin as a non-admin, suppressing the revocation.
-            const removedIsAdmin = await isLedgerAdminAtHLC({
-                store,
-                groupID,
-                anchor,
-                did: memberDID,
-                atHLC: hlc,
-                logger: deps.logger
+                action: 'remove a member'
             });
-            // Refuse to remove the last admin: fold the admin set at this HLC and check
-            // what survives once the removed DID is dropped. A group with no admins can
-            // never grant, revoke, or remove again, so this is fail-closed.
+            // Resolve whether the removed DID is an admin from the roster as it stands
+            // NOW: this is the only point at which they are still a member, and the
+            // answer decides whether the commit must carry a demotion at all.
+            const removedIsAdmin = await store.isGroupAdmin(groupID, memberDID);
+            // Refuse to remove the last admin: check what survives once the removed DID
+            // is dropped. A group with no admins can never grant, revoke, or remove
+            // again, so this is fail-closed.
+            //
+            // The survivor set is read from the same projected rows the authority check
+            // reads, never from the ledger. A grant reaches the ledger the moment it is
+            // signed but reaches the projection only when its commit is enacted, so the
+            // ledger holds admins who cannot yet act. Counting those as survivors would
+            // permit removing the only admin who can — and if the pending grant's commit
+            // never lands, the group is left with no effective admin at all.
             if (removedIsAdmin) {
-                const entries = await loadVerifiedAdminEntries(store, groupID, deps.logger);
-                const admins = foldAdminRoster(entries, anchor, hlc).admins;
-                const survivors = new Set(admins);
-                survivors.delete(normalizeDID(memberDID));
-                if (survivors.size === 0) {
-                    throw new Error('cannot remove the last admin');
+                const members = await store.listGroupMembers(groupID);
+                const removedDID = normalizeDID(memberDID);
+                const survivors = members.filter((member)=>member.role === 'admin' && normalizeDID(member.member_did) !== removedDID);
+                if (survivors.length === 0) {
+                    // The same refusal `leave` and `requestSetMemberRole` raise, carrying
+                    // the same pair: one rule, three paths, and an app matching on the
+                    // code has to reach it from all three.
+                    throw new GraphQLError('cannot remove the last admin — promote another member first', {
+                        extensions: {
+                            code: GROUP_CONTROL_DENIED,
+                            reason: LAST_GROUP_ADMIN,
+                            groupID
+                        }
+                    });
                 }
             }
-            // MLS-roster delta + projected tombstone, stamped with the shared HLC.
-            const { commitMessage } = await deps.groupManager.removeGroupMember({
-                stores: deps.stores,
-                groupID,
-                memberDID,
-                hlc
-            });
-            // Revoke the ex-admin's control authority atomically with the tombstone.
+            // Revoke the ex-admin's control authority on the commit that evicts them.
             // Only admins fold authoritatively, so only an admin needs revoking — a
-            // non-admin removal appends nothing and broadcasts no ledger entry.
+            // non-admin removal carries no ledger entry at all.
+            //
+            // Minted BEFORE the removal so it can ride that very commit: a receiver
+            // refuses a Remove whose target is still an admin in the roster the commit's
+            // entries fold to, so an admin can only be evicted by a commit that also
+            // demotes them.
+            //
+            // The token is NOT appended here. On the lane the accepted commit's
+            // `onAccepted` is its writer, and only that path knows the group took this
+            // attempt: a row written here would survive a lane that never lands,
+            // demoting the target in THIS device's admin-roster fold while every
+            // co-member still folds them as an admin.
             let revokeToken = null;
             if (removedIsAdmin) {
-                const value = 'revoked';
-                const token = await signLedgerEntry(deps.identity, {
+                revokeToken = await signLedgerEntry(deps.identity, {
                     type: ADMIN_ROLE_ENTRY_TYPE,
                     subject: memberDID,
-                    value,
-                    hlc
-                });
-                const entryID = ledgerEntryDigest(token);
-                // `appendLedgerEntry` normalizes `issuer_did`, so the raw self DID is passed.
-                await store.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: ADMIN_ROLE_ENTRY_TYPE,
-                    subject: memberDID,
-                    value,
-                    hlc,
-                    issuer_did: selfDID,
-                    signed_token: token
-                });
-                await reprojectAdminRoster({
-                    store,
+                    value: 'member',
                     groupID,
-                    anchor,
-                    logger: deps.logger
+                    ord: hlc
                 });
-                revokeToken = token;
             }
-            await deps.emitter.emit('groupMemberLeft', {
+            // The request is enqueued before the lane is armed so a crash can never
+            // leave a commit driving toward a request that does not exist.
+            const requestID = deps.runtime.getRandomID();
+            const enqueuedAt = new Date().toISOString();
+            await deps.stores.withTransaction(async (tx)=>{
+                const txStore = await resolveP2PStore(tx);
+                await txStore.enqueueControlRequest({
+                    id: requestID,
+                    groupID,
+                    kind: 'remove',
+                    enqueuedAt
+                });
+            });
+            // The commit is the ONLY delivery of the demotion: the token rides the
+            // commit's own frame as a sealed body, so every co-member resolves it,
+            // folds it and emits from that frame. A separate `ledger:entry` broadcast
+            // would race the commit and hand co-members a demotion the group has not
+            // yet accepted, so none is sent.
+            //
+            // The tombstone and the announcement move with it: they happen in the
+            // lane's `onAccepted`, so nothing here observes a removal the group never
+            // took. Driving is deferred to the outermost commit — awaiting the lane
+            // from inside this write transaction would deadlock the single connection
+            // the lane's own reads need.
+            const build = deps.groupManager.buildRemoveCommit({
                 groupID,
                 memberDID,
-                role: '',
-                createdAt: new Date().toISOString()
-            });
-            // Record-before-send: defer the MLS commit fan-out (so existing members
-            // advance their MLS epoch and tombstone the removed member) and the revoke
-            // broadcast (so co-members fold the same entry against their own anchor) to
-            // the OUTERMOST commit. Registering via `onCommit` keeps a rolled-back
-            // removal from ever being sent or observed.
+                hlc,
+                requestID,
+                ...revokeToken != null ? {
+                    ledgerEntries: [
+                        revokeToken
+                    ]
+                } : {}
+            });
             deps.stores.onCommit(()=>{
-                deps.scheduleSendCommit(groupID, commitMessage);
-                if (revokeToken != null) {
-                    deps.scheduleBroadcast(groupID, {
-                        type: 'ledger:entry',
+                void deps.commitToGroup(groupID, build).catch((error)=>{
+                    deps.logger.error('remove-member commit lane failed', {
                         groupID,
-                        token: revokeToken
+                        error
                     });
-                }
+                    // A lane throw is the group refusing the removal or the deadline
+                    // expiring — the request is over and the app must be told. The local
+                    // admin gate is NOT this: it throws above, before anything is
+                    // enqueued, so a refused caller has no row to settle.
+                    settleRejectedFromLane(requestID, error);
+                });
             });
+            // Built from the values just written rather than read back: this handler
+            // runs inside `mutateGraph`'s write transaction, so the enqueued row is
+            // not yet visible on any other connection.
             return {
-                groupID
+                id: requestID,
+                groupID,
+                kind: 'remove',
+                status: 'pending',
+                error: null,
+                enqueuedAt,
+                settledAt: null
             };
         },
-        update: async (input)=>{
+        requestUpdate: async (input)=>{
             const groupID = input.groupID;
+            const store = await getP2PStore();
+            // Defense-in-depth + fail-loud UX. The fold on every peer is the ultimate
+            // authority — a non-admin's entry is dropped at fold time — but checking
+            // here lets the caller fail loudly instead of receiving a request that
+            // settles `committed` for a change the fold silently discarded.
+            //
+            // It runs BEFORE the no-op check: answering a non-admin `no_op` would
+            // both grant them an outcome they have no authority to ask for and leak
+            // whether the state they named already held.
+            await requireGroupAdmin({
+                store,
+                groupID,
+                did: deps.identity.id,
+                action: 'update a group'
+            });
+            // `group.settings` folds per field: carry ONLY the fields the caller set.
+            // An explicit empty string (or empty list) clears the field; an omitted
+            // field is left out of the value entirely so the prior value survives.
+            const value = {};
+            if (input.name !== undefined) value.name = input.name;
+            if (input.description !== undefined) value.description = input.description;
+            if (input.openCircleIDs !== undefined) value.openCircleIDs = input.openCircleIDs;
+            // The commit-hub designation carries only its hub identity (URL + optional
+            // server DID), never a local hub-row id: it is the shared identity every
+            // device folds and matches against its own bound hubs. An absent server DID
+            // is left off entirely rather than carried as null.
+            if (input.commitHub !== undefined) {
+                value.commitHub = input.commitHub.serverDID != null ? {
+                    url: input.commitHub.url,
+                    serverDID: input.commitHub.serverDID
+                } : {
+                    url: input.commitHub.url
+                };
+            }
+            // No-op when the caller set no field: every `UpdateGroupInput` field but
+            // `groupID` is optional, so an input carrying only `groupID` asks for
+            // nothing. Minting an empty-value `group.settings` entry would drive a
+            // commit that folds to the state that already holds.
+            if (Object.keys(value).length === 0) {
+                return await settleNoOpRequest(groupID);
+            }
             // Read the anchor through the engine transaction's stores: under
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
@@ -794,93 +1248,42 @@ export function createGroupContext(ctx, deps) {
             if (anchor == null) {
                 throw new Error('cannot update group: group has no genesis anchor');
             }
-            // No-op when the caller set neither field: `UpdateGroupInput` makes both
-            // `name` and `description` optional, so an input carrying only `groupID`
-            // would otherwise mint an empty-value `group.settings` entry + broadcast
-            // that folds to the same projected state. Return the current group row
-            // without appending an entry, broadcasting, or emitting.
-            if (input.name === undefined && input.description === undefined) {
-                const store = await getP2PStore();
-                const row = await store.getGroup(groupID);
-                if (row == null) throw new Error(`Group ${groupID} not found`);
-                return {
-                    id: row.id,
-                    name: row.name,
-                    description: row.description,
-                    createdBy: row.created_by,
-                    createdAt: toISO(row.created_at)
-                };
-            }
             const hlc = HLC.serialize(deps.hlc.now());
-            // `group.settings` folds per field: carry ONLY the fields the caller set.
-            // An explicit empty string clears the field; an omitted field is left out
-            // of the value entirely so the prior value survives.
-            const value = {};
-            if (input.name !== undefined) value.name = input.name;
-            if (input.description !== undefined) value.description = input.description;
             const token = await signLedgerEntry(deps.identity, {
                 type: GROUP_SETTINGS_ENTRY_TYPE,
                 subject: groupID,
                 value,
-                hlc
-            });
-            const entryID = ledgerEntryDigest(token);
-            // Append the signed entry and reproject the group-settings overlay
-            // atomically so a crash can never leave the durable ledger and the
-            // projected group row diverged. `appendLedgerEntry` normalizes
-            // `issuer_did`, so the raw self DID is passed.
-            const updatedGroupData = await deps.stores.withTransaction(async (tx)=>{
-                const txStore = await resolveP2PStore(tx);
-                await txStore.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: GROUP_SETTINGS_ENTRY_TYPE,
-                    subject: groupID,
-                    value,
-                    hlc,
-                    issuer_did: deps.identity.id,
-                    signed_token: token
-                });
-                await reprojectGroupSettings({
-                    store: txStore,
-                    groupID,
-                    anchor,
-                    logger: deps.logger
-                });
-                const row = await txStore.getGroup(groupID);
-                if (row == null) throw new Error(`Group ${groupID} not found`);
-                return {
-                    id: row.id,
-                    name: row.name,
-                    description: row.description,
-                    createdBy: row.created_by,
-                    createdAt: toISO(row.created_at)
-                };
+                groupID,
+                ord: hlc
             });
-            // Record-before-send: defer the fan-out (so co-members fold the same entry
-            // against their own anchor) and the local emit to the OUTERMOST commit. Under
-            // `mutateGraph` this handler runs inside the engine's write transaction, so
-            // the inner `withTransaction` above nests inline and does NOT commit on its
-            // own — the outer transaction commits later. Registering via `onCommit` keeps
-            // a rolled-back update from ever being broadcast or observed locally.
-            deps.stores.onCommit(()=>{
-                deps.scheduleBroadcast(groupID, {
-                    type: 'ledger:entry',
-                    groupID,
-                    token
-                });
-                void deps.emitter.emit('groupDataChanged', {
-                    ...updatedGroupData,
-                    groupID
-                });
+            return await enqueueLedgerEntryRequest({
+                groupID,
+                token
             });
-            return updatedGroupData;
         },
-        updateCircle: async (input)=>{
+        requestUpdateCircle: async (input)=>{
             const store = await getP2PStore();
             const existing = await store.getCircle(input.circleID);
             if (existing == null) throw new Error(`Circle ${input.circleID} not found`);
             const groupID = existing.group_id;
+            // Defense-in-depth + fail-loud UX, and it runs BEFORE the no-op check so a
+            // caller with no authority is refused rather than told `no_op`, which would
+            // leak whether the definition they named already held.
+            await requireGroupAdmin({
+                store,
+                groupID,
+                did: deps.identity.id,
+                action: 'update a circle'
+            });
+            // No-op when the caller set no field: every `UpdateCircleInput` field but
+            // `circleID` is optional, so an input carrying only `circleID` asks for
+            // nothing, and the merge below would re-mint the definition that already
+            // holds. Naming a field whose value is unchanged is NOT this case — it
+            // still mints an entry, and the fold that lands it decides from the value
+            // diff whether anything moved.
+            if (input.name === undefined && input.description === undefined && input.catalogIDs === undefined) {
+                return await settleNoOpRequest(groupID);
+            }
             // Read the anchor through the engine transaction's stores: under
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
@@ -904,116 +1307,110 @@ export function createGroupContext(ctx, deps) {
                 type: CIRCLE_DEF_ENTRY_TYPE,
                 subject: input.circleID,
                 value,
-                hlc
-            });
-            const entryID = ledgerEntryDigest(token);
-            const updatedCircleData = await deps.stores.withTransaction(async (tx)=>{
-                const txStore = await resolveP2PStore(tx);
-                await txStore.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: CIRCLE_DEF_ENTRY_TYPE,
-                    subject: input.circleID,
-                    value,
-                    hlc,
-                    issuer_did: deps.identity.id,
-                    signed_token: token
-                });
-                await reprojectCircleDefs({
-                    store: txStore,
-                    groupID,
-                    anchor,
-                    logger: deps.logger
-                });
-                const row = await txStore.getCircle(input.circleID);
-                if (row == null) throw new Error('Failed to read circle after update');
-                return {
-                    id: row.id,
-                    groupID: row.group_id,
-                    name: row.name,
-                    description: row.description,
-                    createdAt: toISO(row.created_at)
-                };
+                groupID,
+                ord: hlc
             });
-            // Record-before-send: defer the fan-out (so co-members fold the same entry
-            // against their own anchor) and the local emit to the OUTERMOST commit. Under
-            // `mutateGraph` this handler runs inside the engine's write transaction, so
-            // the inner `withTransaction` above nests inline and does NOT commit on its
-            // own — the outer transaction commits later. Registering via `onCommit` keeps
-            // a rolled-back update from ever being broadcast or observed locally. Broadcast
-            // first, then emit, to match the order the other producers use.
-            deps.stores.onCommit(()=>{
-                deps.scheduleBroadcast(groupID, {
-                    type: 'ledger:entry',
-                    groupID,
-                    token
-                });
-                if (input.catalogIDs != null) {
-                    void deps.emitter.emit('circleCatalogsChanged', {
-                        ...updatedCircleData,
-                        circleID: input.circleID
-                    });
-                } else {
-                    void deps.emitter.emit('circleDataChanged', {
-                        ...updatedCircleData,
-                        circleID: input.circleID
-                    });
-                }
+            // Which event this becomes is NOT decided here. The fold that lands the
+            // entry compares the projected catalog list before and after and emits
+            // `circleCatalogsChanged` only when it actually moved. That is the only
+            // predicate every peer can evaluate — a remote peer never sees this input —
+            // so naming `catalogIDs` with the list the circle already carries emits
+            // `circleDataChanged`, not `circleCatalogsChanged`.
+            return await enqueueLedgerEntryRequest({
+                groupID,
+                token
             });
-            return updatedCircleData;
         },
         updateCatalog: async (p)=>{
             const graphStore = await getGraphStore();
+            // A catalog is owned by its creator (its `owner_did`, bound and signed at
+            // creation). A device holds foreign-owned catalogs from invite seeds and
+            // discovery, so key alone is not authority to change one — verify ownership
+            // before touching the row.
+            const owned = await graphStore.getCatalog(p.catalogID);
+            if (owned == null) throw new Error(`Catalog ${p.catalogID} not found`);
+            if (owned.owner_did !== ctx.viewerDID) {
+                throw new Error(`Catalog ${p.catalogID} is not owned by this device`);
+            }
             const hlcStr = HLC.serialize(deps.hlc.now());
-            const update = {
+            const name = p.name ?? owned.name;
+            const filterCriteria = p.filterCriteria != null ? JSON.parse(p.filterCriteria) : owned.filter_criteria;
+            // Re-sign the whole record, exactly as creation does. The stored token is
+            // forwarded VERBATIM in an invite seed and matched field-by-field against
+            // the plaintext row it travels with, so a token left describing the record
+            // before this edit does not merely go stale — it makes the catalog
+            // unshareable, silently, on the receiving side. `hlc` alone moving is
+            // enough to break that match, so every update re-signs, not only one that
+            // changes the criteria.
+            const signedToken = await signCatalogSet(deps.identity, {
+                id: p.catalogID,
+                ownerDID: ctx.viewerDID,
+                name,
+                description: owned.description,
+                filterCriteria,
                 hlc: hlcStr
-            };
-            if (p.name != null) update.name = p.name;
-            if (p.filterCriteria != null) {
-                update.filter_criteria = JSON.parse(p.filterCriteria);
-            }
-            await graphStore.updateCatalog(p.catalogID, update);
+            });
+            await graphStore.updateCatalog(p.catalogID, {
+                name,
+                description: owned.description,
+                filter_criteria: filterCriteria,
+                hlc: hlcStr,
+                signed_token: signedToken
+            });
             const row = await graphStore.getCatalog(p.catalogID);
             if (row == null) throw new Error(`Catalog ${p.catalogID} not found`);
-            return {
-                id: row.id,
-                ownerDID: row.owner_did,
-                name: row.name,
-                description: row.description,
-                filterCriteria: JSON.stringify(row.filter_criteria),
-                createdAt: toISO(row.created_at)
-            };
+            return toCatalogData(row);
         },
         deleteCatalog: async (catalogID)=>{
             const graphStore = await getGraphStore();
+            // Owner-scoped, as `updateCatalog`: a device holding a foreign-owned catalog
+            // is not authorized to delete it — verify ownership before the row goes.
+            const owned = await graphStore.getCatalog(catalogID);
+            if (owned == null) throw new Error(`Catalog ${catalogID} not found`);
+            if (owned.owner_did !== ctx.viewerDID) {
+                throw new Error(`Catalog ${catalogID} is not owned by this device`);
+            }
             await graphStore.deleteCatalog(catalogID);
             return {
                 deletedID: catalogID
             };
         },
-        deleteCircle: async (circleID)=>{
+        requestDeleteCircle: async ({ circleID })=>{
             const store = await getP2PStore();
             const existing = await store.getCircle(circleID, {
                 includeRemoved: true
             });
-            // No-op when the circle is absent (never created) or already tombstoned:
-            // minting a dead `removed` entry + broadcast would only churn the ledger
-            // and converge to the same projected state.
-            if (existing == null || existing.removed_at_hlc != null) {
-                return {
-                    deletedID: circleID
-                };
-            }
+            if (existing == null) throw new Error(`Circle ${circleID} not found`);
             const groupID = existing.group_id;
+            // Defense-in-depth + fail-loud UX. The fold on every peer is the ultimate
+            // authority — a non-admin's entry is dropped at fold time — but checking
+            // here lets the caller fail loudly instead of receiving a request that
+            // settles `committed` for a change the fold silently discarded.
+            await requireGroupAdmin({
+                store,
+                groupID,
+                did: deps.identity.id,
+                action: 'delete a circle'
+            });
+            // No-op when the circle is already tombstoned: minting a dead `removed`
+            // entry would only churn the ledger and converge to the same projected
+            // state. The gate runs first, so a non-admin is refused either way.
+            if (existing.removed_at_hlc != null) {
+                return await settleNoOpRequest(groupID);
+            }
+            // Read the anchor through the engine transaction's stores: under
+            // `mutateGraph` this handler already runs inside that transaction, so the
+            // registry's restore/persist must share its connection — a separate
+            // connection blocks forever on the outer write lock (single-connection SQLite).
             const anchor = await deps.registry.readHandle(groupID, async (handle)=>readGroupAnchor(handle), {
                 stores: deps.stores
             });
             if (anchor == null) {
                 throw new Error('cannot delete circle: group has no genesis anchor');
             }
-            // One HLC stamps both the durable tombstone entry and the broadcast token,
-            // so the locally projected `removed_at_hlc` and the HLC every co-member
-            // folds are identical — store and wire can never diverge.
+            // One HLC stamps the durable tombstone entry, the broadcast token and the
+            // commit body, so the HLC every co-member folds and the one this device
+            // folds back off its own commit are identical.
             const hlc = HLC.serialize(deps.hlc.now());
             const value = {
                 removed: true
@@ -1022,75 +1419,34 @@ export function createGroupContext(ctx, deps) {
                 type: CIRCLE_DEF_ENTRY_TYPE,
                 subject: circleID,
                 value,
-                hlc
-            });
-            const entryID = ledgerEntryDigest(token);
-            await deps.stores.withTransaction(async (tx)=>{
-                const txStore = await resolveP2PStore(tx);
-                await txStore.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: CIRCLE_DEF_ENTRY_TYPE,
-                    subject: circleID,
-                    value,
-                    hlc,
-                    issuer_did: deps.identity.id,
-                    signed_token: token
-                });
-                await reprojectCircleDefs({
-                    store: txStore,
-                    groupID,
-                    anchor,
-                    logger: deps.logger
-                });
-                const row = await txStore.getCircle(circleID, {
-                    includeRemoved: true
-                });
-                if (row == null || row.removed_at_hlc == null) {
-                    throw new Error('Failed to tombstone circle after delete');
-                }
+                groupID,
+                ord: hlc
             });
-            // Record-before-send: defer the fan-out (so co-members fold the same
-            // tombstone against their own anchor) and the local emit to the OUTERMOST
-            // commit. Under `mutateGraph` this handler runs inside the engine's write
-            // transaction, so the inner `withTransaction` above nests inline and does
-            // NOT commit on its own — the outer transaction commits later. Registering
-            // via `onCommit` keeps a rolled-back deletion from ever being broadcast or
-            // observed locally.
-            deps.stores.onCommit(()=>{
-                deps.scheduleBroadcast(groupID, {
-                    type: 'ledger:entry',
-                    groupID,
-                    token
-                });
-                void deps.emitter.emit('circleDeleted', {
-                    id: existing.id,
-                    groupID: existing.group_id,
-                    name: existing.name,
-                    description: existing.description,
-                    createdAt: toISO(existing.created_at)
-                });
+            return await enqueueLedgerEntryRequest({
+                groupID,
+                token
             });
-            return {
-                deletedID: circleID
-            };
         },
-        removeCircleMember: async (circleID, memberDID)=>{
+        requestRemoveCircleMember: async ({ circleID, memberDID })=>{
             const store = await getP2PStore();
+            const circleRow = await store.getCircle(circleID);
+            if (circleRow == null) throw new Error('Failed to remove circle member: circle not found');
+            const groupID = circleRow.group_id;
+            // Defense-in-depth + fail-loud UX, as in `requestDeleteCircle`: without it
+            // a non-admin's entry rides a commit the hub accepts, so the request would
+            // settle `committed` while every peer's fold drops the entry.
+            await requireGroupAdmin({
+                store,
+                groupID,
+                did: deps.identity.id,
+                action: 'remove a circle member'
+            });
             const existing = await store.getCircleMember(circleID, memberDID);
             // No-op when the target is not an active member: a never-added DID
-            // (absent row) or an already-tombstoned one. Minting a dead `removed`
-            // entry + broadcast for it would only churn the ledger and converge to
-            // the same projected state, so return the requested pair untouched.
+            // (absent row) or an already-tombstoned one.
             if (existing == null || existing.removed_at_hlc != null) {
-                return {
-                    circleID,
-                    memberDID
-                };
+                return await settleNoOpRequest(groupID);
             }
-            const circleRow = await store.getCircle(circleID);
-            if (circleRow == null) throw new Error('Failed to remove circle member: circle not found');
-            const groupID = circleRow.group_id;
             // Read the anchor through the engine transaction's stores: under
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
@@ -1101,9 +1457,6 @@ export function createGroupContext(ctx, deps) {
             if (anchor == null) {
                 throw new Error('cannot remove circle member: group has no genesis anchor');
             }
-            // One HLC stamps both the durable tombstone entry and the broadcast token,
-            // so the locally projected `removed_at_hlc` and the HLC every co-member
-            // folds are identical — store and wire can never diverge.
             const hlc = HLC.serialize(deps.hlc.now());
             const subject = encodeCircleMemberSubject(circleID, memberDID);
             const value = {
@@ -1113,62 +1466,25 @@ export function createGroupContext(ctx, deps) {
                 type: CIRCLE_MEMBER_ENTRY_TYPE,
                 subject,
                 value,
-                hlc
-            });
-            const entryID = ledgerEntryDigest(token);
-            // Append the signed tombstone and reproject the circle-member overlay
-            // atomically so a crash can never leave the durable ledger and the
-            // projected row diverged. `appendLedgerEntry` normalizes `issuer_did`, so
-            // the raw self DID is passed.
-            await deps.stores.withTransaction(async (tx)=>{
-                const txStore = await resolveP2PStore(tx);
-                await txStore.appendLedgerEntry({
-                    group_id: groupID,
-                    entry_id: entryID,
-                    type: CIRCLE_MEMBER_ENTRY_TYPE,
-                    subject,
-                    value,
-                    hlc,
-                    issuer_did: deps.identity.id,
-                    signed_token: token
-                });
-                await reprojectCircleMembers({
-                    store: txStore,
-                    groupID,
-                    anchor,
-                    logger: deps.logger
-                });
-                const row = await txStore.getCircleMember(circleID, memberDID);
-                if (row == null || row.removed_at_hlc == null) {
-                    throw new Error('Failed to tombstone circle member after remove');
-                }
+                groupID,
+                ord: hlc
             });
-            // Record-before-send: defer the fan-out (so co-members fold the same
-            // tombstone against their own anchor) and the local emit to the OUTERMOST
-            // commit. Under `mutateGraph` this handler runs inside the engine's write
-            // transaction, so the inner `withTransaction` above nests inline and does
-            // NOT commit on its own — the outer transaction commits later. Registering
-            // via `onCommit` keeps a rolled-back removal from ever being broadcast or
-            // observed locally.
-            deps.stores.onCommit(()=>{
-                deps.scheduleBroadcast(groupID, {
-                    type: 'ledger:entry',
-                    groupID,
-                    token
-                });
-                void deps.emitter.emit('circleMemberRemoved', {
-                    circleID,
-                    memberDID,
-                    role: existing.role,
-                    createdAt: toISO(existing.created_at)
-                });
+            return await enqueueLedgerEntryRequest({
+                groupID,
+                token
             });
-            return {
-                circleID,
-                memberDID
-            };
         },
         grantWriteCapability: async ({ to, res, groupID, expiresIn })=>{
+            // Refused rather than clamped: silently shortening a capability the caller
+            // asked for produces a grant that stops working on a date it was never
+            // told about.
+            if (expiresIn != null && expiresIn > MAX_CAP_TTL_SECONDS) {
+                throw new GraphQLError(`expiresIn ${expiresIn} exceeds the maximum capability lifetime of ${MAX_CAP_TTL_SECONDS} seconds`, {
+                    extensions: {
+                        code: 'GRANT_TTL_TOO_LONG'
+                    }
+                });
+            }
             const [store, delegationStore] = await Promise.all([
                 getP2PStore(),
                 getDelegationStore()
@@ -1240,24 +1556,33 @@ export function createGroupContext(ctx, deps) {
                 getP2PStore(),
                 getDelegationStore()
             ]);
-            const cap = await delegationStore.getDelegationTokenByJTI(jti);
+            // Scoped to the viewer: a co-member can mint a capability reusing a `jti`
+            // it saw broadcast, so an unscoped read can hand back someone else's row
+            // and deny the issuer its own revocation.
+            const cap = await delegationStore.getDelegationTokenByGrantorJTI({
+                jti,
+                grantor: ctx.viewerDID
+            });
             if (cap == null) {
-                // Multi-device-grantor case (the issuing device is not the one running
-                // this resolver) is not yet supported; surface the missing-local-row
-                // condition explicitly so callers can distinguish it from authz.
+                // Both branches deny, but callers act on them differently: rows under
+                // this `jti` from other grantors mean the viewer is not the issuer,
+                // while none at all means the capability is unknown here — the
+                // multi-device-grantor case (the issuing device is not the one running
+                // this resolver) is not yet supported.
+                const others = await delegationStore.listDelegationTokensByJTI(jti);
+                if (others.length > 0) {
+                    throw new GraphQLError(`Only the capability issuer can revoke jti ${jti}`, {
+                        extensions: {
+                            code: 'REVOCATION_UNAUTHORIZED'
+                        }
+                    });
+                }
                 throw new GraphQLError(`No capability found locally for jti ${jti}`, {
                     extensions: {
                         code: 'REVOCATION_CAP_UNKNOWN'
                     }
                 });
             }
-            if (cap.grantor !== ctx.viewerDID) {
-                throw new GraphQLError(`Only the capability issuer can revoke jti ${jti}`, {
-                    extensions: {
-                        code: 'REVOCATION_UNAUTHORIZED'
-                    }
-                });
-            }
             // Resolve the group the cap was granted in from the p2p edge; it targets
             // the revoke broadcast and enriches the emitted event. A missing edge
             // means the group is unknown locally — the broadcast then cannot be
@@ -1270,20 +1595,22 @@ export function createGroupContext(ctx, deps) {
                     }
                 });
             }
+            // `createRevocationRecord` signs the claims itself, so the record is
+            // already the signed token the store persists and the broadcast carries.
             const record = await createRevocationRecord(deps.identity, jti);
-            const signed = await deps.identity.signToken(record);
-            const token = stringifyToken(signed);
+            const revokedAt = record.payload.iat;
+            const token = stringifyToken(record);
             const hlc = HLC.serialize(deps.hlc.now());
             // Self-issued revocations are verified by construction (the revoker is
             // the cap's issuer, checked above); seed `verified_at` with the
-            // record's iat so the hot-path `isRevoked` gate fires immediately
-            // without a separate verification round-trip.
+            // record's iat so the revocation gate fires immediately without a
+            // separate verification round-trip.
             const changed = await delegationStore.addRevocation({
                 jti,
                 revoker_did: deps.identity.id,
-                revoked_iat: record.iat,
+                revoked_iat: revokedAt,
                 revocation_token: token,
-                verified_at: record.iat,
+                verified_at: revokedAt,
                 cap_exp: cap.exp,
                 hlc
             });
@@ -1298,8 +1625,8 @@ export function createGroupContext(ctx, deps) {
                     grantor: cap.grantor,
                     audience: cap.audience,
                     revokerDID: deps.identity.id,
-                    revokedAt: record.iat,
-                    verifiedAt: record.iat,
+                    revokedAt: revokedAt,
+                    verifiedAt: revokedAt,
                     capExp: cap.exp,
                     groupID
                 });