@livedesk/hub 0.1.58 → 0.1.61

package/src/server.js

@@ -30,7 +30,10 @@ import {
   observeRemoteAudioStopConfirmation,
   remoteAudioSubscriberOwns
 } from './remote-audio-subscription-contract.mjs';
-import { isReusedLiveStreamFrameReady } from './live-stream-monitor-contract.js';
+import {
+  createReadOnlyControlPresentationReconcileCoordinator,
+  isReusedLiveStreamFrameReady
+} from './live-stream-monitor-contract.js';
 import { createLiveCaptureTransitionRetryCoordinator } from './live-capture-transition-retry.mjs';
 import { buildMode4AtlasSessionKey, Mode4AtlasPool, planMode4AtlasInputTransitions } from './mode4-atlas-pool.js';
 import { resolveMode4AtlasTileSize } from './mode4-atlas-sizing.js';
@@ -60,11 +63,18 @@ import { PRODUCTION_SUPABASE_PUBLISHABLE_KEY, PRODUCTION_SUPABASE_URL } from '..
 import { createHubRuntime } from './runtime/hub-runtime.js';
 import { hubRuntimeStatus } from './runtime/hub-runtime-status.js';
 import { roleGuardResponse } from './http/hub-role-guard.js';
-import {
-  clearHubUiSessionCookie,
-  createHubUiSessionAuthority,
-  serializeHubUiSessionCookie
-} from './http/hub-ui-session.js';
+import {
+  clearHubUiSessionCookie,
+  createHubUiSessionAuthority,
+  serializeHubUiSessionCookie
+} from './http/hub-ui-session.js';
+import {
+  resolveWorkspaceAccess,
+  WorkspaceAccessError,
+  workspaceEntitlementCanRequest,
+  workspaceRoleCanControl,
+  workspaceRoleCanRequest
+} from './auth/workspace-access.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const webDistCandidates = [
@@ -176,7 +186,8 @@ const supabasePublishableKey = String(configuredSupabaseKey || PRODUCTION_SUPABA
 const SUPABASE_AUTH_TIMEOUT_MS = process.env.LIVEDESK_AUTH_TEST_MODE === '1'
   ? readPositiveIntegerEnv('LIVEDESK_AUTH_TEST_TIMEOUT_MS', AUTH_REQUEST_TIMEOUT_MS)
   : AUTH_REQUEST_TIMEOUT_MS;
-const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
+const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
+const HUB_WORKSPACE_STORAGE_KEY = 'livedesk.hub.workspace';
 const runtimeAuthStatePath = process.env.LIVEDESK_DESKTOP_HOST === '1'
   ? ''
   : String(process.env.LIVEDESK_AUTH_STATE_PATH || '').trim();
@@ -194,10 +205,18 @@ const persistentSessionGcToken = persistentSessionGcEnabled
   ? String(process.env.LIVEDESK_PERSISTENT_SESSION_TEST_TOKEN || '').trim()
   : '';
 let connectedDeviceCount = 0;
-let runtimeAccessToken = '';
-let runtimeRefreshToken = '';
-let runtimeAccessTokenExpiresAt = 0;
-const hubUiSessionAuthority = createHubUiSessionAuthority();
+let runtimeAccessToken = '';
+let runtimeRefreshToken = '';
+let runtimeAccessTokenExpiresAt = 0;
+let runtimeAuthEpoch = 0;
+let runtimeAccessTokenRefreshOwner = null;
+let runtimeWorkspaceAccess = null;
+let workspaceAccessLastAttemptAt = 0;
+let licenseRefreshLastAttemptAt = 0;
+const hubUiSessionAuthority = createHubUiSessionAuthority({
+  onRevoke: (session, reason) => retireHubUiSessionSockets(session, reason)
+});
+const consoleProxyToken = crypto.randomBytes(32).toString('base64url');
 let roleWatchInFlight = false;
 let verifiedLicense = {
   userId: '',
@@ -217,7 +236,16 @@ const HUB_HOST_TARGET_RENEW_MS = Math.max(1000, Math.min(
   readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_RENEW_MS', 20_000),
   Math.max(1000, HUB_HOST_TARGET_LEASE_MS - 1000)
 ));
-const HUB_ACCESS_TOKEN_REFRESH_SKEW_MS = 90_000;
+const HUB_ACCESS_TOKEN_REFRESH_SKEW_MS = 90_000;
+const WORKSPACE_ACCESS_REVERIFY_MS = Math.max(
+  30_000,
+  Math.min(5 * 60_000, readPositiveIntegerEnv('LIVEDESK_WORKSPACE_ACCESS_REVERIFY_MS', 60_000))
+);
+const LICENSE_REFRESH_INTERVAL_MS = Math.max(
+  30 * 60_000,
+  readPositiveIntegerEnv('LIVEDESK_LICENSE_REFRESH_INTERVAL_MS', 30 * 60_000)
+);
+const TEAM_UI_ACCESS_MAX_AGE_MS = 60_000;
 const hubWakeBaseUrl = String(process.env.LIVEDESK_WAKE_URL || 'https://livedesk-wake.lovecrdm.workers.dev').trim();
 const hubConsoleDirectSignalBaseUrl = String(
   process.env.LIVEDESK_CONSOLE_SIGNAL_URL
@@ -284,6 +312,52 @@ function broadcastRemoteInputRouteState(deviceId, reason = '') {
   }
 }
 
+function reconcileReadOnlyControlPresentationSubscribers(deviceId) {
+  const normalizedDeviceId = String(deviceId || '').trim();
+  if (!normalizedDeviceId) return;
+  const clients = new Set([
+    ...(frameClientsByDeviceId.get(normalizedDeviceId) || []),
+    ...frameWildcardClients
+  ]);
+  for (const ws of clients) {
+    const liveOptions = ws.liveDeskLiveOptions;
+    if (ws.readyState !== 1
+      || ws.liveDeskAutoStart !== true
+      || !(ws.liveDeskDeviceIds instanceof Set)
+      || !ws.liveDeskDeviceIds.has(normalizedDeviceId)
+      || liveOptions?.allowReadOnlyControlBorrow !== true
+      || String(liveOptions?.streamPurpose || '').trim().toLowerCase() !== 'wall') {
+      continue;
+    }
+    startFrameSubscriptionLive(ws, 'control-borrow-reconcile', normalizedDeviceId, {
+      ...liveOptions,
+      forceRestart: false,
+      reuseExisting: true
+    });
+  }
+}
+
+const readOnlyControlPresentationReconcileCoordinator =
+  createReadOnlyControlPresentationReconcileCoordinator({
+    onReconcile: reconcileReadOnlyControlPresentationSubscribers
+  });
+
+function readRemoteLiveStreamEventPurpose(event) {
+  const explicitPurpose = String(event?.streamPurpose || '').trim().toLowerCase();
+  if (explicitPurpose) return explicitPurpose;
+  const commandId = String(event?.commandId || '').trim();
+  const activeStream = event?.device?.activeLiveStream;
+  if (!commandId || !activeStream) return '';
+  const pendingDescriptor = activeStream.pendingDescriptor;
+  if (String(pendingDescriptor?.commandId || '').trim() === commandId) {
+    return String(pendingDescriptor?.streamPurpose || '').trim().toLowerCase();
+  }
+  if (String(activeStream.commandId || '').trim() === commandId) {
+    return String(activeStream.streamPurpose || '').trim().toLowerCase();
+  }
+  return '';
+}
+
 function handleRemoteHubEvent(type, event) {
   liveDeskUpdateManager?.handleRemoteEvent(type, event);
   hubTransferJobs?.handleRemoteEvent(type, event);
@@ -338,9 +412,32 @@ function handleRemoteHubEvent(type, event) {
     broadcastRemoteInputRouteState(deviceId, event?.reason || type);
     return;
   }
+  if (type === 'RemoteLiveStreamStarted'
+    || type === 'RemoteLiveStreamOpened'
+    || type === 'RemoteLiveStreamReady'
+    || type === 'RemoteLiveStreamStopped') {
+    const liveStreamEventDeviceId = String(event?.deviceId || event?.device?.deviceId || '').trim();
+    const liveStreamEventPurpose = readRemoteLiveStreamEventPurpose(event);
+    if ((type === 'RemoteLiveStreamStarted' || type === 'RemoteLiveStreamOpened')
+      && liveStreamEventPurpose === 'control') {
+      readOnlyControlPresentationReconcileCoordinator
+        .cancelForControlTransition(liveStreamEventDeviceId);
+    } else if (type === 'RemoteLiveStreamReady' && liveStreamEventPurpose === 'control') {
+      readOnlyControlPresentationReconcileCoordinator
+        .reconcileReadyControl(liveStreamEventDeviceId);
+    } else if (type === 'RemoteLiveStreamStopped'
+      && liveStreamEventPurpose === 'control'
+      && event?.captureStopConfirmed === true) {
+      readOnlyControlPresentationReconcileCoordinator
+        .scheduleAfterConfirmedStop(liveStreamEventDeviceId);
+    }
+  }
   if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
     connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
     const deviceId = String(event?.deviceId || event?.device?.deviceId || '').trim();
+    if (type === 'RemoteDeviceDisconnected') {
+      readOnlyControlPresentationReconcileCoordinator.cancelForControlTransition(deviceId);
+    }
     broadcastRemoteInputRouteState(deviceId, event?.reason || type);
   }
   if (type !== 'RemoteDeviceConnected') {
@@ -368,7 +465,7 @@ function handleRemoteHubEvent(type, event) {
   }
 }
 
-function activeLicensePlan() {
+function activeLicensePlan() {
   if (testLicensePlan) {
     return testLicensePlan;
   }
@@ -381,12 +478,22 @@ function activeLicensePlan() {
   if (Number.isFinite(expiresAt) && expiresAt <= now) {
     return 'free';
   }
-  return verifiedLicense.plan === 'pro' ? 'pro' : verifiedLicense.plan === 'ltd' ? 'ltd' : 'free';
-}
-
-function activeDeviceLimit() {
-  const plan = activeLicensePlan();
-  return plan === 'pro' ? Number.POSITIVE_INFINITY : plan === 'ltd' ? PLUS_DEVICE_LIMIT : FREE_DEVICE_LIMIT;
+  return verifiedLicense.plan === 'team'
+    ? 'team'
+    : verifiedLicense.plan === 'pro'
+      ? 'pro'
+      : verifiedLicense.plan === 'ltd'
+        ? 'ltd'
+        : 'free';
+}
+
+function activeDeviceLimit() {
+  const plan = activeLicensePlan();
+  return plan === 'team' || plan === 'pro'
+    ? Number.POSITIVE_INFINITY
+    : plan === 'ltd'
+      ? PLUS_DEVICE_LIMIT
+      : FREE_DEVICE_LIMIT;
 }
 
 function hasHubFeatureAccess() {
@@ -409,7 +516,7 @@ function hasHubFeatureAccessForRequest(req) {
   return ids.size <= limit;
 }
 
-function licenseSnapshot() {
+function licenseSnapshot() {
   const plan = activeLicensePlan();
   const limit = activeDeviceLimit();
   return {
@@ -417,47 +524,80 @@ function licenseSnapshot() {
     status: plan === 'free' ? 'free' : 'active',
     deviceLimit: Number.isFinite(limit) ? limit : null,
     connectedDeviceCount,
-    featureAccess: connectedDeviceCount <= limit,
-    verifiedAt: verifiedLicense.verifiedAt ? new Date(verifiedLicense.verifiedAt).toISOString() : '',
+    featureAccess: connectedDeviceCount <= limit,
+    workspaceId: verifiedLicense.workspaceId || runtimeWorkspaceAccess?.workspaceId || '',
+    workspaceKind: verifiedLicense.workspaceKind || runtimeWorkspaceAccess?.workspaceKind || 'personal',
+    memberLimit: Number.isSafeInteger(verifiedLicense.memberLimit) ? verifiedLicense.memberLimit : 1,
+    commercialUse: verifiedLicense.commercialUse === true,
+    verifiedAt: verifiedLicense.verifiedAt ? new Date(verifiedLicense.verifiedAt).toISOString() : '',
     expiresAt: verifiedLicense.expiresAt || ''
   };
-}
-
-async function syncVerifiedLicense(accessToken) {
-  const token = String(accessToken || '').trim();
+}
+
+function workspaceAccessSnapshot(access = runtimeWorkspaceAccess) {
+  if (!access?.workspaceId) return null;
+  return {
+    workspaceId: access.workspaceId,
+    name: access.workspaceName || '',
+    kind: access.workspaceKind || 'personal',
+    role: access.role || '',
+    membershipRevision: Math.max(0, Number(access.membershipRevision || 0)),
+    plan: access.plan || 'free',
+    status: access.entitlementStatus || 'inactive',
+    deviceLimit: access.deviceLimit,
+    memberLimit: access.memberLimit,
+    commercialUse: access.commercialUse === true,
+    verifiedAt: access.verifiedAt ? new Date(access.verifiedAt).toISOString() : ''
+  };
+}
+
+function workspaceRemoteAccessActive(access = runtimeWorkspaceAccess) {
+  return Boolean(access?.workspaceId) && (access.workspaceKind !== 'team'
+    || (access?.plan === 'team' && access?.entitlementStatus === 'active'));
+}
+
+async function verifyWorkspaceAccess(accessToken, user, requestedWorkspaceId = '') {
+  return resolveWorkspaceAccess({
+    accessToken,
+    requestedWorkspaceId,
+    userId: user?.id || '',
+    supabaseUrl,
+    supabasePublishableKey,
+    fetchResponse: (url, options, timeoutMs) => fetchAuthResponse(fetch, url, options, timeoutMs),
+    timeoutMs: SUPABASE_AUTH_TIMEOUT_MS
+  });
+}
+
+function applyVerifiedWorkspaceLicense(access) {
+  verifiedLicense = {
+    userId: access.userId || '',
+    workspaceId: access.workspaceId,
+    workspaceKind: access.workspaceKind,
+    plan: ['ltd', 'pro', 'team'].includes(access.plan) ? access.plan : 'free',
+    status: access.entitlementStatus === 'active' ? 'active' : 'inactive',
+    expiresAt: '',
+    memberLimit: access.memberLimit,
+    commercialUse: access.commercialUse === true,
+    verifiedAt: Date.now()
+  };
+  return licenseSnapshot();
+}
+
+async function syncVerifiedLicense(accessToken, requestedWorkspaceId = '') {
+  const token = String(accessToken || '').trim();
   if (!token) {
     throw new Error('supabase-access-token-required');
-  }
-  const user = await verifySupabaseUser(token);
-  const headers = {
-    apikey: supabasePublishableKey,
-    Authorization: `Bearer ${token}`,
-    Accept: 'application/json'
-  };
-  const userId = user.id;
-  const query = new URLSearchParams({
-    select: 'user_id,product_key,plan,status,expires_at,updated_at',
-    user_id: `eq.${userId}`,
-    product_key: 'eq.livedesk',
-    limit: '1'
-  });
-  const entitlementResponse = await fetch(`${supabaseUrl}/rest/v1/livedesk_entitlements?${query}`, { headers });
-  if (!entitlementResponse.ok) {
-    throw new Error(`supabase-entitlement-query-failed:${entitlementResponse.status}`);
-  }
-  const rows = await entitlementResponse.json();
-  const entitlement = Array.isArray(rows) ? rows[0] : null;
-  const plan = entitlement?.plan === 'pro' ? 'pro' : entitlement?.plan === 'ltd' ? 'ltd' : 'free';
-  const status = entitlement?.status === 'active' ? 'active' : 'inactive';
-  verifiedLicense = {
-    userId,
-    plan,
-    status,
-    expiresAt: String(entitlement?.expires_at || ''),
-    verifiedAt: Date.now()
-  };
-  return licenseSnapshot();
-}
+  }
+  const user = await verifySupabaseUser(token);
+  const selectedWorkspaceId = String(
+    requestedWorkspaceId
+    || runtimeWorkspaceAccess?.workspaceId
+    || readPersistedWorkspaceId()
+    || ''
+  ).trim();
+  const access = await verifyWorkspaceAccess(token, user, selectedWorkspaceId);
+  return applyVerifiedWorkspaceLicense(access);
+}
 
 function normalizeSessionExpiryMs(value) {
   const numeric = Number(value || 0);
@@ -475,7 +615,7 @@ function readRuntimeAuthState() {
   }
 }
 
-function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
+function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
   try {
     const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
     const session = typeof raw === 'string' ? JSON.parse(raw) : raw;
@@ -483,7 +623,12 @@ function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
   } catch {
     return null;
   }
-}
+}
+
+function readPersistedWorkspaceId(state = readRuntimeAuthState()) {
+  const workspaceId = String(state?.[HUB_WORKSPACE_STORAGE_KEY]?.workspaceId || '').trim();
+  return workspaceId.slice(0, 160);
+}
 
 function writePrivateRuntimeAuthState(state) {
   if (!runtimeAuthStatePath) return false;
@@ -501,7 +646,7 @@ function writePrivateRuntimeAuthState(state) {
   }
 }
 
-function persistRuntimeSession(session) {
+function persistRuntimeSession(session) {
   if (!runtimeAuthStatePath) return false;
   const state = readRuntimeAuthState();
   const previous = readPersistedRuntimeSession(state) || {};
@@ -526,25 +671,43 @@ function persistRuntimeSession(session) {
   state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(normalized.session);
   writePrivateRuntimeAuthState(state);
   return true;
-}
+}
+
+function persistRuntimeWorkspace(access) {
+  const workspaceId = String(access?.workspaceId || '').trim();
+  if (!runtimeAuthStatePath || !workspaceId) return false;
+  const state = readRuntimeAuthState();
+  state[HUB_WORKSPACE_STORAGE_KEY] = {
+    workspaceId,
+    workspaceKind: String(access?.workspaceKind || 'personal'),
+    selectedAt: new Date().toISOString()
+  };
+  writePrivateRuntimeAuthState(state);
+  return true;
+}
 
-function clearPersistedRuntimeSession() {
+function clearPersistedRuntimeSession() {
   if (!runtimeAuthStatePath) return false;
-  const state = readRuntimeAuthState();
-  delete state[CLIENT_AUTH_STORAGE_KEY];
-  return writePrivateRuntimeAuthState(state);
-}
+  const state = readRuntimeAuthState();
+  delete state[CLIENT_AUTH_STORAGE_KEY];
+  delete state[HUB_WORKSPACE_STORAGE_KEY];
+  return writePrivateRuntimeAuthState(state);
+}
 
-function clearRuntimeSession() {
-  runtimeAccessToken = '';
-  runtimeRefreshToken = '';
-  runtimeAccessTokenExpiresAt = 0;
+function clearRuntimeSession() {
+  runtimeAuthEpoch += 1;
+  runtimeAccessToken = '';
+  runtimeRefreshToken = '';
+  runtimeAccessTokenExpiresAt = 0;
+  runtimeWorkspaceAccess = null;
+  workspaceAccessLastAttemptAt = 0;
+  licenseRefreshLastAttemptAt = 0;
   hubUiSessionAuthority.revokeAll();
   runtimeManager.setAuthenticated(false);
   try { clearPersistedRuntimeSession(); } catch { /* runtime auth is already invalid */ }
 }
 
-async function getRuntimeAccessToken() {
+async function getRuntimeAccessToken() {
   const accessToken = String(runtimeAccessToken || '').trim();
   const expiresSoon = runtimeAccessTokenExpiresAt > 0
     && runtimeAccessTokenExpiresAt <= Date.now() + HUB_ACCESS_TOKEN_REFRESH_SKEW_MS;
@@ -560,52 +723,74 @@ async function getRuntimeAccessToken() {
     return accessToken;
   }
 
-  const refreshToken = String(runtimeRefreshToken || '').trim();
-  if (!refreshToken) {
-    return accessToken;
-  }
-
-  const response = await fetchAuthResponse(
-    fetch,
-    `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
-    {
-      method: 'POST',
-      headers: {
-        apikey: supabasePublishableKey,
-        'Content-Type': 'application/json',
-        Accept: 'application/json'
-      },
-      body: JSON.stringify({ refresh_token: refreshToken })
-    },
-    SUPABASE_AUTH_TIMEOUT_MS
-  );
-  if (!response.ok) {
-    if (response.status === 400 || response.status === 401 || response.status === 403) {
-      clearRuntimeSession();
-      throw new Error(`hub-session-refresh-failed:${response.status}`);
-    }
-    throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
-  }
-  const refreshed = await response.json().catch(() => null);
-  const nextAccessToken = String(refreshed?.access_token || '').trim();
-  if (!nextAccessToken) {
-    throw new Error('hub-session-refresh-missing-access-token');
-  }
-  runtimeAccessToken = nextAccessToken;
-  runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
-  runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
-    || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
-  try {
-    persistRuntimeSession({
-      access_token: runtimeAccessToken,
-      refresh_token: runtimeRefreshToken,
-      expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
-    });
-  } catch (error) {
-    console.warn(`[VuvoDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
-  }
-  return runtimeAccessToken;
-}
+  const refreshToken = String(runtimeRefreshToken || '').trim();
+  if (!refreshToken) {
+    return accessToken;
+  }
+  if (runtimeAccessTokenRefreshOwner?.epoch === runtimeAuthEpoch
+    && runtimeAccessTokenRefreshOwner.refreshToken === refreshToken) {
+    return runtimeAccessTokenRefreshOwner.promise;
+  }
+  const owner = {
+    epoch: runtimeAuthEpoch,
+    userId: currentBoundHubUserId(),
+    workspaceId: currentBoundHubWorkspaceId(),
+    refreshToken,
+    promise: null
+  };
+  owner.promise = (async () => {
+    const response = await fetchAuthResponse(
+      fetch,
+      `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
+      {
+        method: 'POST',
+        headers: {
+          apikey: supabasePublishableKey,
+          'Content-Type': 'application/json',
+          Accept: 'application/json'
+        },
+        body: JSON.stringify({ refresh_token: refreshToken })
+      },
+      SUPABASE_AUTH_TIMEOUT_MS
+    );
+    if (!response.ok) {
+      if (response.status === 400 || response.status === 401 || response.status === 403) {
+        if (runtimeAuthEpoch === owner.epoch && runtimeRefreshToken === owner.refreshToken) {
+          clearRuntimeSession();
+        }
+        throw new Error(`hub-session-refresh-failed:${response.status}`);
+      }
+      throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
+    }
+    const refreshed = await response.json().catch(() => null);
+    const nextAccessToken = String(refreshed?.access_token || '').trim();
+    if (!nextAccessToken) throw new Error('hub-session-refresh-missing-access-token');
+    if (runtimeAuthEpoch !== owner.epoch
+      || runtimeRefreshToken !== owner.refreshToken
+      || currentBoundHubUserId() !== owner.userId
+      || currentBoundHubWorkspaceId() !== owner.workspaceId) {
+      throw new Error('hub-session-refresh-superseded');
+    }
+    runtimeAccessToken = nextAccessToken;
+    runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
+    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
+      || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
+    try {
+      persistRuntimeSession({
+        access_token: runtimeAccessToken,
+        refresh_token: runtimeRefreshToken,
+        expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
+      });
+    } catch (error) {
+      console.warn(`[VuvoDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
+    }
+    return runtimeAccessToken;
+  })().finally(() => {
+    if (runtimeAccessTokenRefreshOwner === owner) runtimeAccessTokenRefreshOwner = null;
+  });
+  runtimeAccessTokenRefreshOwner = owner;
+  return owner.promise;
+}
 
 async function verifySupabaseUser(accessToken) {
   const token = String(accessToken || '').trim();
@@ -637,21 +822,51 @@ async function verifySupabaseUser(accessToken) {
   };
 }
 
-function authVerificationHttpStatus(message) {
+function authVerificationHttpStatus(message) {
   const upstreamStatus = Number(String(message || '').match(/supabase-user-verification-failed:(\d+)/)?.[1] || 0);
   return upstreamStatus === 401 || upstreamStatus === 403 ? 401 : 502;
 }
 
-async function queryAuthoritativeRuntimeRole() {
-  const accessToken = await getRuntimeAccessToken();
-  if (runtimeRole !== 'hub' || !accessToken || !runtimeDeviceId) {
-    return '';
-  }
-  const query = new URLSearchParams({
-    select: 'role,enabled,role_version,assigned_hub_id',
-    device_id: `eq.${runtimeDeviceId}`,
-    limit: '1'
-  });
+async function queryRuntimeDeviceWorkspace(accessToken) {
+  const token = String(accessToken || '').trim();
+  if (!token || !runtimeDeviceId) return '';
+  const query = new URLSearchParams({
+    select: 'workspace_id,role,enabled',
+    device_id: `eq.${runtimeDeviceId}`,
+    enabled: 'eq.true',
+    limit: '1'
+  });
+  const response = await fetchAuthResponse(
+    fetch,
+    `${supabaseUrl}/rest/v1/livedesk_devices?${query}`,
+    {
+      headers: {
+        apikey: supabasePublishableKey,
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json'
+      }
+    },
+    SUPABASE_AUTH_TIMEOUT_MS
+  );
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`hub-device-workspace-query-not-authenticated:${response.status}`);
+  }
+  if (!response.ok) return '';
+  const rows = await response.json().catch(() => []);
+  const record = Array.isArray(rows) ? rows[0] : null;
+  return record?.enabled === false ? '' : String(record?.workspace_id || '').trim();
+}
+
+async function queryAuthoritativeRuntimeDevice() {
+  const accessToken = await getRuntimeAccessToken();
+  if (runtimeRole !== 'hub' || !accessToken || !runtimeDeviceId) {
+    return { role: '', workspaceId: '' };
+  }
+  const query = new URLSearchParams({
+    select: 'workspace_id,role,enabled,role_version,assigned_hub_id',
+    device_id: `eq.${runtimeDeviceId}`,
+    limit: '1'
+  });
   const response = await fetchAuthResponse(
     fetch,
     `${supabaseUrl}/rest/v1/livedesk_devices?${query}`,
@@ -664,38 +879,149 @@ async function queryAuthoritativeRuntimeRole() {
     },
     SUPABASE_AUTH_TIMEOUT_MS
   );
-  if (response.status === 401 || response.status === 403) {
-    if (!desktopMainAuthConfig) clearRuntimeSession();
-    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`hub-role-query-failed:${response.status}`);
   }
   const rows = await response.json().catch(() => []);
   const record = Array.isArray(rows) ? rows[0] : null;
-  if (!record || record.enabled === false) {
-    return '';
-  }
-  const role = String(record.role || '').trim().toLowerCase();
-  return role === 'hub' || role === 'client' ? role : '';
-}
+  if (!record || record.enabled === false) {
+    return { role: '', workspaceId: '' };
+  }
+  const role = String(record.role || '').trim().toLowerCase();
+  return {
+    role: role === 'hub' || role === 'client' ? role : '',
+    workspaceId: String(record.workspace_id || '').trim()
+  };
+}
+
+async function queryAuthoritativeRuntimeRole() {
+  return (await queryAuthoritativeRuntimeDevice()).role;
+}
 
-async function watchAuthoritativeRuntimeRole() {
+async function watchAuthoritativeRuntimeRole() {
   if (runtimeRole !== 'hub' || roleWatchInFlight || !runtimeAccessToken) {
     return;
-  }
-  roleWatchInFlight = true;
-  try {
-    const role = await queryAuthoritativeRuntimeRole();
+  }
+  const watchAuthEpoch = runtimeAuthEpoch;
+  const watchUserId = currentBoundHubUserId();
+  const watchWorkspaceId = currentBoundHubWorkspaceId();
+  roleWatchInFlight = true;
+  try {
+    const authoritativeDevice = await queryAuthoritativeRuntimeDevice();
+    if (runtimeAuthEpoch !== watchAuthEpoch
+      || currentBoundHubUserId() !== watchUserId
+      || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+    const role = authoritativeDevice.role;
     if (role === 'client') {
       console.warn('[VuvoDesk Hub] Supabase selected another Sync Server. Transitioning this runtime to Client.');
       void clearHubHostTarget('role-demoted').finally(() => {
-        setTimeout(() => process.exit(ROLE_TRANSITION_EXIT_CODE), 150);
-      });
-    }
-  } catch {
-    // A temporary provider failure must not stop a working Hub. The next
-    // interval retries the authoritative role check.
+        setTimeout(() => process.exit(ROLE_TRANSITION_EXIT_CODE), 150);
+      });
+      return;
+    }
+    if (authoritativeDevice.workspaceId
+      && authoritativeDevice.workspaceId !== currentBoundHubWorkspaceId()) {
+      const token = await getRuntimeAccessToken();
+      const userId = currentBoundHubUserId();
+      const movedAccess = await verifyWorkspaceAccess(
+        token,
+        { id: userId },
+        authoritativeDevice.workspaceId
+      );
+      if (movedAccess.userId !== userId || movedAccess.role !== 'owner') {
+        throw new WorkspaceAccessError('hub-device-workspace-mismatch', { status: 403 });
+      }
+      if (runtimeAuthEpoch !== watchAuthEpoch
+        || currentBoundHubUserId() !== watchUserId
+        || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+      await clearHubHostTarget('hub-workspace-moved');
+      if (runtimeAuthEpoch !== watchAuthEpoch
+        || currentBoundHubUserId() !== watchUserId
+        || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+      hubUiSessionAuthority.revokeAll('hub-workspace-moved');
+      runtimeAuthEpoch += 1;
+      runtimeWorkspaceAccess = movedAccess;
+      try { persistRuntimeWorkspace(movedAccess); } catch {}
+      applyVerifiedWorkspaceLicense(movedAccess);
+      licenseRefreshLastAttemptAt = Date.now();
+      workspaceAccessLastAttemptAt = Date.now();
+      hubConsoleDirect?.invalidateWorkspaceAccess('hub-workspace-moved');
+      if (workspaceRemoteAccessActive(movedAccess)) {
+        scheduleAuthenticatedHubHostTargetPublication('hub-workspace-moved');
+      }
+      return;
+    }
+    const now = Date.now();
+    if (now - workspaceAccessLastAttemptAt < WORKSPACE_ACCESS_REVERIFY_MS) {
+      return;
+    }
+    workspaceAccessLastAttemptAt = now;
+    const token = await getRuntimeAccessToken();
+    const userId = currentBoundHubUserId();
+    const previousAccess = runtimeWorkspaceAccess;
+    const access = await verifyWorkspaceAccess(token, { id: userId }, currentBoundHubWorkspaceId());
+    if (access.role !== 'owner') {
+      throw new WorkspaceAccessError('workspace-owner-required', { status: 403 });
+    }
+    if (runtimeAuthEpoch !== watchAuthEpoch
+      || currentBoundHubUserId() !== watchUserId
+      || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+    const licenseChanged = !previousAccess
+      || previousAccess.plan !== access.plan
+      || previousAccess.entitlementStatus !== access.entitlementStatus
+      || previousAccess.deviceLimit !== access.deviceLimit
+      || previousAccess.memberLimit !== access.memberLimit
+      || previousAccess.commercialUse !== access.commercialUse;
+    const teamBecameInactive = access.workspaceKind === 'team'
+      && !workspaceRemoteAccessActive(access)
+      && workspaceRemoteAccessActive(previousAccess);
+    const teamBecameActive = access.workspaceKind === 'team'
+      && workspaceRemoteAccessActive(access)
+      && !workspaceRemoteAccessActive(previousAccess);
+    runtimeWorkspaceAccess = access;
+    try { persistRuntimeWorkspace(access); } catch { /* the verified in-memory owner remains authoritative */ }
+    if (licenseChanged || now - licenseRefreshLastAttemptAt >= LICENSE_REFRESH_INTERVAL_MS) {
+      applyVerifiedWorkspaceLicense(access);
+      licenseRefreshLastAttemptAt = now;
+    }
+    if (teamBecameInactive) {
+      hubConsoleDirect?.close();
+      await clearHubHostTarget('workspace-entitlement-inactive');
+    } else if (teamBecameActive) {
+      hubConsoleDirect?.refresh();
+      scheduleAuthenticatedHubHostTargetPublication('workspace-entitlement-activated');
+    }
+    // The revision also changes for invitations, billing and unrelated member
+    // updates. Closing every healthy peer here would turn a harmless Team
+    // metadata change into an input outage. Exact member removal is handled by
+    // the owner revoke endpoint; every Team signaling socket is independently
+    // revalidated by the Wake Worker within its bounded access window.
+  } catch (error) {
+    if (error instanceof WorkspaceAccessError
+      && error.status < 500
+      && runtimeAuthEpoch === watchAuthEpoch
+      && currentBoundHubUserId() === watchUserId
+      && currentBoundHubWorkspaceId() === watchWorkspaceId) {
+      runtimeWorkspaceAccess = null;
+      verifiedLicense = {
+        userId: '',
+        workspaceId: currentBoundHubWorkspaceId(),
+        workspaceKind: 'personal',
+        plan: 'free',
+        status: 'inactive',
+        expiresAt: '',
+        memberLimit: 1,
+        commercialUse: false,
+        verifiedAt: Date.now()
+      };
+      hubUiSessionAuthority.revokeAll();
+      hubConsoleDirect?.close();
+    }
+    // A temporary provider failure must not stop a working Hub. The next
+    // interval retries the authoritative role check.
   } finally {
     roleWatchInFlight = false;
   }
@@ -1402,17 +1728,87 @@ hubConsoleDirect = createHubConsoleDirect({
   deviceId: runtimeDeviceId,
   httpBaseUrl: `http://127.0.0.1:${httpPort}`,
   stunUrls: hubConsoleDirectStunUrls,
-  getAccessToken: () => getRuntimeAccessToken()
+  getAccessToken: () => getRuntimeAccessToken(),
+  getWorkspaceAccess: () => runtimeWorkspaceAccess,
+  consoleProxyToken
 });
 const httpConnections = new Set();
 const frameWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const atlasWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const inputWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const audioWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
-const browserWebSocketServers = [frameWss, atlasWss, inputWss, audioWss];
-const frameCaptureTransitionRetries = createLiveCaptureTransitionRetryCoordinator();
-
-httpServer.on('connection', socket => {
+const browserWebSocketServers = [frameWss, atlasWss, inputWss, audioWss];
+const frameCaptureTransitionRetries = createLiveCaptureTransitionRetryCoordinator();
+
+function retireHubUiSessionSocket(ws, reason = 'hub-ui-session-revoked') {
+  if (!ws || ws.liveDeskUiSessionRevoked === true) return false;
+  ws.liveDeskUiSessionRevoked = true;
+  if (ws.liveDeskUiSessionTimer) clearTimeout(ws.liveDeskUiSessionTimer);
+  ws.liveDeskUiSessionTimer = null;
+  if (ws.liveDeskInputClientId) {
+    for (const deviceId of ws.liveDeskInputDeviceIds || []) {
+      remoteHub.releaseInputOwner(
+        deviceId,
+        ws.liveDeskInputClientId,
+        String(reason || 'hub-ui-session-revoked').slice(0, 120)
+      );
+    }
+    ws.liveDeskInputDeviceIds?.clear?.();
+  }
+  try {
+    ws.close(1008, String(reason || 'hub-ui-session-revoked').slice(0, 120));
+  } catch {
+    try { ws.terminate(); } catch {}
+  }
+  return true;
+}
+
+function retireHubUiSessionSockets(session, reason = 'hub-ui-session-revoked') {
+  const sessionId = String(session?.sessionId || '');
+  if (!sessionId) return 0;
+  let retired = 0;
+  for (const wss of browserWebSocketServers) {
+    for (const ws of wss.clients) {
+      if (ws.liveDeskUiSessionId !== sessionId) continue;
+      if (retireHubUiSessionSocket(ws, reason)) retired += 1;
+    }
+  }
+  return retired;
+}
+
+function bindHubUiSessionSocket(ws, req) {
+  const authorization = req?.liveDeskAuthorization;
+  const sessionId = String(authorization?.sessionId || '');
+  if (!sessionId) return;
+  ws.liveDeskUiSessionId = sessionId;
+  ws.liveDeskUiSessionUserId = String(authorization.userId || '');
+  ws.liveDeskUiSessionWorkspaceId = String(authorization.workspaceId || '');
+  ws.liveDeskUiSessionRevoked = false;
+  const armDeadline = () => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
+    const deadline = hubUiSessionAuthority.sessionDeadline(sessionId);
+    if (!deadline) {
+      retireHubUiSessionSocket(ws, 'hub-ui-session-expired');
+      return;
+    }
+    const delay = deadline - Date.now();
+    if (delay <= 0) {
+      retireHubUiSessionSocket(ws, 'hub-ui-session-expired');
+      return;
+    }
+    ws.liveDeskUiSessionTimer = setTimeout(armDeadline, Math.min(delay, 60_000));
+    ws.liveDeskUiSessionTimer.unref?.();
+  };
+  armDeadline();
+  const cleanup = () => {
+    if (ws.liveDeskUiSessionTimer) clearTimeout(ws.liveDeskUiSessionTimer);
+    ws.liveDeskUiSessionTimer = null;
+  };
+  ws.once('close', cleanup);
+  ws.once('error', cleanup);
+}
+
+httpServer.on('connection', socket => {
   httpConnections.add(socket);
   socket.once('close', () => httpConnections.delete(socket));
 });
@@ -1509,13 +1905,34 @@ function isSecureHubHttpRequest(req) {
     || String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https';
 }
 
-function currentBoundHubUserId() {
+function currentBoundHubUserId() {
   return String(
     runtimeManager.getSnapshot().userId
     || readPersistedRuntimeSession()?.user?.id
     || ''
   ).trim();
-}
+}
+
+function workspaceAccessHttpStatus(error) {
+  return error instanceof WorkspaceAccessError
+    ? Math.max(400, Math.min(599, Number(error.status || 403)))
+    : authVerificationHttpStatus(error instanceof Error ? error.message : String(error));
+}
+
+function currentBoundHubWorkspaceId() {
+  return String(
+    runtimeWorkspaceAccess?.workspaceId
+    || readPersistedWorkspaceId()
+    || currentBoundHubUserId()
+    || ''
+  ).trim();
+}
+
+function runtimeAuthOwnerIsCurrent(epoch, userId, workspaceId) {
+  return runtimeAuthEpoch === epoch
+    && currentBoundHubUserId() === String(userId || '')
+    && currentBoundHubWorkspaceId() === String(workspaceId || '');
+}
 
 function isPublicHubApiRequest(req) {
   const method = String(req.method || 'GET').toUpperCase();
@@ -1524,21 +1941,98 @@ function isPublicHubApiRequest(req) {
     || (method === 'POST' && path === '/api/auth/session');
 }
 
-function isTrustedNativeLoopbackRequest(req) {
+function isTrustedNativeLoopbackRequest(req) {
   return isLoopbackAddress(req.socket?.remoteAddress)
     && !String(req.headers.origin || '').trim()
     && !String(req.headers['sec-fetch-site'] || '').trim();
-}
-
-function authorizeHubUiRequest(req) {
-  if (process.env.LIVEDESK_TEST_MODE === '1') {
-    return { ok: true, explicitTestMode: true };
-  }
-  if (isTrustedNativeLoopbackRequest(req)) {
-    return { ok: true, nativeLoopback: true };
-  }
-  return hubUiSessionAuthority.authorize(req, currentBoundHubUserId());
-}
+}
+
+function authorizeConsoleProxyRequest(req) {
+  const suppliedToken = String(req.headers['x-livedesk-console-proxy'] || '').trim();
+  if (!suppliedToken) return null;
+  if (!isTrustedNativeLoopbackRequest(req)
+    || !secureExactTestTokenMatches(suppliedToken, consoleProxyToken)) {
+    return { ok: false, status: 403, error: 'console-proxy-not-authorized' };
+  }
+  const workspaceId = String(req.headers['x-livedesk-workspace-id'] || '').trim();
+  const workspaceKind = String(req.headers['x-livedesk-workspace-kind'] || '').trim().toLowerCase();
+  const userId = String(req.headers['x-livedesk-workspace-user-id'] || '').trim();
+  const role = String(req.headers['x-livedesk-workspace-role'] || '').trim().toLowerCase();
+  const membershipRevision = Number(req.headers['x-livedesk-membership-revision'] || 0);
+  const accessExpiresAt = Number(req.headers['x-livedesk-workspace-access-expires-at'] || 0);
+  if (!workspaceId
+    || workspaceKind !== String(runtimeWorkspaceAccess?.workspaceKind || '').trim().toLowerCase()
+    || !userId
+    || workspaceId !== currentBoundHubWorkspaceId()
+    || !workspaceRoleCanControl(role)
+    || !Number.isSafeInteger(membershipRevision)
+    || membershipRevision < 0
+    || !Number.isFinite(accessExpiresAt)
+    || (workspaceKind === 'team' && accessExpiresAt <= Date.now())
+    || (workspaceKind === 'personal' && accessExpiresAt !== 0)) {
+    return { ok: false, status: 403, error: 'console-workspace-access-invalid' };
+  }
+  return {
+    ok: true,
+    consoleProxy: true,
+    workspaceId,
+    workspaceKind,
+    userId,
+    role,
+    plan: String(runtimeWorkspaceAccess?.plan || 'free'),
+    entitlementStatus: String(runtimeWorkspaceAccess?.entitlementStatus || 'inactive'),
+    membershipRevision,
+    accessExpiresAt
+  };
+}
+
+function authorizationWorkspaceAccess(authorization) {
+  return {
+    workspaceKind: String(
+      authorization?.workspaceKind
+      || runtimeWorkspaceAccess?.workspaceKind
+      || 'personal'
+    ).trim().toLowerCase(),
+    plan: String(
+      authorization?.plan
+      || runtimeWorkspaceAccess?.plan
+      || 'free'
+    ).trim().toLowerCase(),
+    entitlementStatus: String(
+      authorization?.entitlementStatus
+      || runtimeWorkspaceAccess?.entitlementStatus
+      || 'active'
+    ).trim().toLowerCase()
+  };
+}
+
+function authorizeHubUiRequest(req) {
+  if (process.env.LIVEDESK_TEST_MODE === '1') {
+    return { ok: true, explicitTestMode: true };
+  }
+  const consoleAuthorization = authorizeConsoleProxyRequest(req);
+  if (consoleAuthorization) return consoleAuthorization;
+  if (isTrustedNativeLoopbackRequest(req)) {
+    return { ok: true, nativeLoopback: true };
+  }
+  return hubUiSessionAuthority.authorize(req, {
+    workspaceId: currentBoundHubWorkspaceId(),
+    allowedRoles: ['owner', 'operator']
+  });
+}
+
+function authorizedWorkspaceRole(req) {
+  if (req.liveDeskAuthorization?.role) return req.liveDeskAuthorization.role;
+  const consoleAuthorization = authorizeConsoleProxyRequest(req);
+  if (consoleAuthorization?.ok) return consoleAuthorization.role;
+  const uiAuthorization = hubUiSessionAuthority.authorize(req, {
+    workspaceId: currentBoundHubWorkspaceId(),
+    allowedRoles: ['owner', 'operator']
+  }, { requireCsrf: false });
+  return uiAuthorization?.ok
+    ? uiAuthorization.role
+    : String(runtimeWorkspaceAccess?.role || '').trim().toLowerCase();
+}
 
 app.use((req, res, next) => {
   if (!isTrustedBrowserRequest(req)) {
@@ -1566,13 +2060,29 @@ app.use((req, res, next) => {
     next();
     return;
   }
-  const authorization = authorizeHubUiRequest(req);
-  if (!authorization.ok) {
+  const authorization = authorizeHubUiRequest(req);
+  if (!authorization.ok) {
     noStore(res);
     res.status(authorization.status).json({ ok: false, error: authorization.error });
-    return;
-  }
-  next();
+    return;
+  }
+  if (!workspaceEntitlementCanRequest(
+    authorizationWorkspaceAccess(authorization),
+    req.method,
+    req.path
+  )) {
+    noStore(res);
+    res.status(403).json({ ok: false, error: 'workspace-entitlement-inactive' });
+    return;
+  }
+  if (authorization.role
+    && !workspaceRoleCanRequest(authorization.role, req.method, req.path)) {
+    noStore(res);
+    res.status(403).json({ ok: false, error: 'workspace-owner-required' });
+    return;
+  }
+  req.liveDeskAuthorization = authorization;
+  next();
 });
 app.use((req, res, next) => {
   if (runtimeRole === 'client' && req.path.startsWith('/api/remote')) {
@@ -1774,7 +2284,7 @@ function normalizeTransferChunk(body = {}) {
   };
 }
 
-function normalizeLiveOptions(payload = {}) {
+function normalizeLiveOptions(payload = {}) {
   const mode = String(payload.frameMode || payload.mode || 'mode3-h264-hw').trim() || 'mode3-h264-hw';
   const streamPurpose = String(payload.streamPurpose || payload.purpose || 'wall').trim().slice(0, 24) || 'wall';
   const maxFps = streamPurpose === 'control' ? 60 : 30;
@@ -1784,10 +2294,11 @@ function normalizeLiveOptions(payload = {}) {
     maxHeight: clampNumber(payload.maxHeight, 180, 2160, 360),
     quality: clampNumber(payload.quality, 20, 95, 45),
     monitorIndex: normalizeMonitorIndex(payload.monitorIndex ?? payload.screenIndex ?? payload.displayIndex),
-    monitorSelections: normalizeMonitorSelections(payload.monitorSelections),
-    forceRestart: /^(1|true|yes|on)$/i.test(String(payload.forceRestart ?? '')),
-    reuseExisting: /^(1|true|yes|on)$/i.test(String(payload.reuseExisting ?? '')),
-    streamPurpose,
+    monitorSelections: normalizeMonitorSelections(payload.monitorSelections),
+    forceRestart: /^(1|true|yes|on)$/i.test(String(payload.forceRestart ?? '')),
+    reuseExisting: /^(1|true|yes|on)$/i.test(String(payload.reuseExisting ?? '')),
+    allowReadOnlyControlBorrow: /^(1|true|yes|on)$/i.test(String(payload.allowReadOnlyControlBorrow ?? '')),
+    streamPurpose,
     mode,
     frameMode: mode
   };
@@ -1888,15 +2399,23 @@ function unregisterFrameClient(ws) {
   retireFrameClientSendLane(ws);
 }
 
-function hasOtherFrameStreamOwner(ws, deviceId, streamId, streamPurpose = '') {
+function hasOtherFrameStreamOwner(ws, deviceId, streamId, streamPurpose = '') {
   if (!streamId) {
     return false;
   }
-  for (const candidate of frameClients) {
-    if (candidate === ws || candidate.readyState !== candidate.OPEN) {
-      continue;
-    }
-    if (candidate.liveDeskStreamIdsByDeviceId instanceof Map
+  for (const candidate of frameClients) {
+    if (candidate === ws || candidate.readyState !== candidate.OPEN) {
+      continue;
+    }
+    const expectedBinding = candidate.liveDeskExpectedStreamBindingsByDeviceId instanceof Map
+      ? candidate.liveDeskExpectedStreamBindingsByDeviceId.get(deviceId)
+      : null;
+    if (expectedBinding?.readOnlyControlBorrow === true) {
+      // A presentation observer can share immutable packets, but it must never
+      // keep the native Control owner alive after the real controller leaves.
+      continue;
+    }
+    if (candidate.liveDeskStreamIdsByDeviceId instanceof Map
       && candidate.liveDeskStreamIdsByDeviceId.get(deviceId) === streamId) {
       return true;
     }
@@ -1987,17 +2506,28 @@ function scheduleFrameStreamStop(deviceId, streamId, streamPurpose) {
   pendingFrameStreamStops.set(key, { timer });
 }
 
-function stopFrameClientStreams(ws) {
+function stopFrameClientStreams(ws) {
   const streams = ws.liveDeskStreamIdsByDeviceId instanceof Map
     ? ws.liveDeskStreamIdsByDeviceId
     : null;
   if (!streams) {
     return;
   }
-  const streamPurpose = String(ws.liveDeskLiveOptions?.streamPurpose || 'wall');
-  for (const [deviceId, streamId] of streams.entries()) {
-    if (!streamId || hasOtherFrameStreamOwner(ws, deviceId, streamId, streamPurpose)) {
-      continue;
+  const requestedStreamPurpose = String(ws.liveDeskLiveOptions?.streamPurpose || 'wall');
+  for (const [deviceId, streamId] of streams.entries()) {
+    const expectedBinding = ws.liveDeskExpectedStreamBindingsByDeviceId instanceof Map
+      ? ws.liveDeskExpectedStreamBindingsByDeviceId.get(deviceId)
+      : null;
+    if (expectedBinding?.readOnlyControlBorrow === true) {
+      // Borrowers own only browser presentation resources. The real Control
+      // subscriber remains the sole native stop owner.
+      continue;
+    }
+    const streamPurpose = expectedBinding?.streamId === streamId
+      ? String(expectedBinding.streamPurpose || requestedStreamPurpose)
+      : requestedStreamPurpose;
+    if (!streamId || hasOtherFrameStreamOwner(ws, deviceId, streamId, streamPurpose)) {
+      continue;
     }
     scheduleFrameStreamStop(deviceId, streamId, streamPurpose);
   }
@@ -3030,21 +3560,21 @@ function startFrameSubscriptionLive(
     const monitorIndex = Object.prototype.hasOwnProperty.call(liveOptions.monitorSelections || {}, deviceId)
       ? liveOptions.monitorSelections[deviceId]
       : liveOptions.monitorIndex;
-    const result = remoteHub.startLiveStream(deviceId, {
-      ...liveOptions,
-      monitorIndex,
-      reuseExisting: liveOptions.forceRestart !== true
-        && (liveOptions.reuseExisting === true || reason === 'subscribe' || reason === 'watchdog'),
-      // Wall capture is one shared native encoder per device. Two open browser
-      // views may ask for different soft profiles (for example mobile 5 fps at
-      // 1080p and desktop 20 fps at 540p). Once a healthy shared owner exists,
-      // those preferences must bind to that owner instead of replacing it back
-      // and forth every time either view refreshes its subscription.
-      reuseSharedExisting: liveOptions.forceRestart !== true
-        && String(liveOptions.streamPurpose || '').trim().toLowerCase() === 'wall'
-        && hasOtherFrameStreamDemand(ws, deviceId, 'wall'),
-      silentReuse: reason === 'watchdog' && liveOptions.forceRestart !== true
-    });
+    const result = remoteHub.startLiveStream(deviceId, {
+      ...liveOptions,
+      monitorIndex,
+      reuseExisting: liveOptions.forceRestart !== true
+        && (liveOptions.reuseExisting === true || reason === 'subscribe' || reason === 'watchdog'),
+      // Wall capture is one shared native encoder per device. Two open browser
+      // views may ask for different soft profiles (for example mobile 5 fps at
+      // 1080p and desktop 20 fps at 540p). Once a healthy shared owner exists,
+      // those preferences must bind to that owner instead of replacing it back
+      // and forth every time either view refreshes its subscription.
+      reuseSharedExisting: liveOptions.forceRestart !== true
+        && String(liveOptions.streamPurpose || '').trim().toLowerCase() === 'wall'
+        && hasOtherFrameStreamDemand(ws, deviceId, 'wall'),
+      silentReuse: reason === 'watchdog' && liveOptions.forceRestart !== true
+    });
     if (result?.ok) {
       if (result.sharedProfileReused === true) {
         ws.liveDeskSharedProfileReuseCount = Math.max(
@@ -3053,18 +3583,25 @@ function startFrameSubscriptionLive(
         ) + 1;
       }
       frameCaptureTransitionRetries.complete(ws, deviceId, intentGeneration, 'capture-started');
-      const expectedBinding = {
+      const expectedBinding = {
         deviceId,
         sessionId: String(result.sessionId || device.sessionId || ''),
         streamId: String(result.streamId || ''),
         streamPurpose: String(result.streamPurpose || liveOptions.streamPurpose || 'wall'),
         commandId: String(result.commandId || ''),
-        captureGeneration: Number(result.captureGeneration || 0),
-        monitorIndex: Number(result.monitorIndex || 0),
-        readySent: false
+        captureGeneration: Number(result.captureGeneration || 0),
+        monitorIndex: Number(result.monitorIndex || 0),
+        readOnlyControlBorrow: result.readOnlyControlBorrow === true,
+        presentationPurpose: result.presentationPurpose === 'wall' ? 'wall' : '',
+        effectiveProfile: result.effectiveProfile || null,
+        readySent: false
       };
       const activeStream = device?.activeLiveStream;
-      const reusedFrameReady = isReusedLiveStreamFrameReady(result, activeStream, expectedBinding);
+      // A new read-only browser presentation has no decoder history from the
+      // already-running Control stream. It must enter through the next exact
+      // key frame even when the native owner itself is already ready.
+      const reusedFrameReady = expectedBinding.readOnlyControlBorrow !== true
+        && isReusedLiveStreamFrameReady(result, activeStream, expectedBinding);
       expectedBinding.readySent = reusedFrameReady;
       ws.liveDeskStreamIdsByDeviceId.set(deviceId, result.streamId);
       const installedBindingIdentity = replaceExpectedFrameBindingForClient(
@@ -3076,19 +3613,24 @@ function startFrameSubscriptionLive(
         skipped.push({ deviceId, reason: 'invalid-live-stream-binding' });
         continue;
       }
-      cancelPendingFrameStreamStop(deviceId, result.streamId, String(liveOptions.streamPurpose || 'wall'));
-      started.push({
+      if (expectedBinding.readOnlyControlBorrow !== true) {
+        cancelPendingFrameStreamStop(deviceId, result.streamId, expectedBinding.streamPurpose);
+      }
+      started.push({
         deviceId: expectedBinding.deviceId,
         sessionId: expectedBinding.sessionId,
         streamId: expectedBinding.streamId,
         streamPurpose: expectedBinding.streamPurpose,
         commandId: expectedBinding.commandId,
         captureGeneration: expectedBinding.captureGeneration,
-        monitorIndex: expectedBinding.monitorIndex,
-        ready: reusedFrameReady,
-        fps: result.fps,
-        reused: result.reused === true
-      });
+        monitorIndex: expectedBinding.monitorIndex,
+        readOnlyControlBorrow: expectedBinding.readOnlyControlBorrow,
+        presentationPurpose: expectedBinding.presentationPurpose,
+        effectiveProfile: expectedBinding.effectiveProfile,
+        ready: reusedFrameReady,
+        fps: result.fps,
+        reused: result.reused === true
+      });
     } else {
       ws.liveDeskStreamIdsByDeviceId.delete(deviceId);
       replaceExpectedFrameBindingForClient(ws, deviceId, null);
@@ -3160,9 +3702,10 @@ function startFrameSubscriptionLive(
       }
     }
   }
-  if (reason === 'watchdog' && !started.some(item => item.reused !== true)) {
-    return;
-  }
+  if ((reason === 'watchdog' && !started.some(item => item.reused !== true))
+    || (reason === 'control-borrow-reconcile' && started.length === 0)) {
+    return;
+  }
   sendJson(ws, {
     type: 'RemoteFrameLiveAutoStart',
     timestamp: new Date().toISOString(),
@@ -3439,21 +3982,30 @@ function broadcastRemoteBinaryFrame(frameEvent) {
       continue;
     }
     const requiresReadyKeyFrame = String(expectedBinding.streamPurpose || '').toLowerCase() === 'control' && isH264;
-    if (!expectedBinding.readySent && (!requiresReadyKeyFrame || isKeyFrame)) {
-      expectedBinding.readySent = sendJson(client, {
-        type: 'RemoteFrameStreamReady',
-        deviceId,
-        sessionId: expectedBinding.sessionId,
-        streamId: expectedBinding.streamId,
-        streamPurpose: expectedBinding.streamPurpose,
-        commandId: expectedBinding.commandId,
-        captureGeneration: expectedBinding.captureGeneration,
-        monitorIndex: expectedBinding.monitorIndex
-      });
-      if (!expectedBinding.readySent) {
-        continue;
-      }
-    }
+    if (!expectedBinding.readySent) {
+      // A fresh H.264 decoder cannot consume dependent Control deltas. Keep
+      // the browser lane closed until the first exact key frame; otherwise a
+      // newly attached PWA can remain on "Preparing video" until a later IDR.
+      if (requiresReadyKeyFrame && !isKeyFrame) {
+        continue;
+      }
+      expectedBinding.readySent = sendJson(client, {
+        type: 'RemoteFrameStreamReady',
+        deviceId,
+        sessionId: expectedBinding.sessionId,
+        streamId: expectedBinding.streamId,
+        streamPurpose: expectedBinding.streamPurpose,
+        commandId: expectedBinding.commandId,
+        captureGeneration: expectedBinding.captureGeneration,
+        monitorIndex: expectedBinding.monitorIndex,
+        readOnlyControlBorrow: expectedBinding.readOnlyControlBorrow === true,
+        presentationPurpose: expectedBinding.presentationPurpose || '',
+        effectiveProfile: expectedBinding.effectiveProfile || null
+      });
+      if (!expectedBinding.readySent) {
+        continue;
+      }
+    }
     const lane = ensureFrameClientSendLane(client);
     if (client.liveDeskFrameBackpressured
       && lane.backpressuredDeviceIds.has(deviceId)
@@ -3954,7 +4506,7 @@ app.get('/api/settings', async (_req, res) => {
   }
 });
 
-app.patch('/api/settings', async (req, res) => {
+app.patch('/api/settings', async (req, res) => {
   noStore(res);
   try {
     const body = req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : {};
@@ -3974,9 +4526,72 @@ app.patch('/api/settings', async (req, res) => {
     }
     res.status(error?.status || 400).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
   }
-});
-
-function sendCaptureError(res, error) {
+});
+
+function wallPreferencesResponse(record) {
+  return {
+    ok: true,
+    revision: Number(record?.revision || 0),
+    updatedAt: String(record?.updatedAt || ''),
+    wallPreferences: {
+      cadence: String(record?.cadence || record?.settings?.wall?.cadence || 'fast'),
+      viewScale: Number(record?.viewScale ?? record?.settings?.wall?.viewScale ?? 100),
+      showThisComputer: Boolean(
+        record?.settings?.connection?.showThisComputer
+        ?? liveDeskSettingsStore.getCached()?.connection?.showThisComputer
+      )
+    }
+  };
+}
+
+app.get('/api/remote/wall-preferences', async (_req, res) => {
+  noStore(res);
+  try {
+    res.json(wallPreferencesResponse(await liveDeskSettingsStore.getWallPreferencesRecord()));
+  } catch (error) {
+    res.status(500).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+});
+
+app.patch('/api/remote/wall-preferences', async (req, res) => {
+  noStore(res);
+  try {
+    const body = req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : null;
+    const allowedKeys = new Set(['revision', 'cadence', 'viewScale']);
+    if (!body || Object.keys(body).some(key => !allowedKeys.has(key))) {
+      res.status(400).json({ ok: false, error: 'wall-preferences-invalid' });
+      return;
+    }
+    const revision = Number(body.revision);
+    const cadence = String(body.cadence || '').trim().toLowerCase();
+    const viewScale = Number(body.viewScale);
+    if (!Number.isSafeInteger(revision)
+      || revision < 0
+      || !['slow', 'fast'].includes(cadence)
+      || !Number.isFinite(viewScale)
+      || viewScale < 0
+      || viewScale > 100) {
+      res.status(400).json({ ok: false, error: 'wall-preferences-invalid' });
+      return;
+    }
+    const record = await liveDeskSettingsStore.update({ wall: { cadence, viewScale } }, revision);
+    res.json(wallPreferencesResponse(record));
+  } catch (error) {
+    if (error instanceof SettingsConflictError) {
+      const wall = error.settings?.settings?.wall || {};
+      res.status(409).json(wallPreferencesResponse({
+        revision: error.settings.revision,
+        updatedAt: error.settings.updatedAt,
+        cadence: wall.cadence,
+        viewScale: wall.viewScale
+      }));
+      return;
+    }
+    res.status(error?.status || 400).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+});
+
+function sendCaptureError(res, error) {
   const rawCode = String(error?.message || error?.code || 'capture-request-failed');
   const code = rawCode.replace(/[^a-z0-9-:]/gi, '-').toLowerCase().slice(0, 100);
   const status = Number.isInteger(error?.status) && error.status >= 400 && error.status <= 599
@@ -4227,9 +4842,9 @@ app.post('/api/settings/agent/run', async (req, res) => {
     return;
   }
   try {
-    if (!(await synchronizeAgentEnablement())) {
-      throw new AgentRuntimeError('agent-disabled', 'Enable Codex Agent in Settings before running commands.', { status: 409 });
-    }
+    if (!(await synchronizeAgentEnablement())) {
+      throw new AgentRuntimeError('agent-disabled', 'Codex Agent was explicitly turned off in Settings.', { status: 409 });
+    }
     const instruction = typeof req.body?.instruction === 'string' ? req.body.instruction.slice(0, 4000) : '';
     const deviceIds = normalizeDeviceIds(req.body?.deviceIds).slice(0, 500);
     const connectedDeviceIds = new Set(connectedAgentDeviceIds());
@@ -4345,20 +4960,23 @@ app.post('/api/settings/agent/summary', async (req, res) => {
   }
 });
 
-app.get('/api/remote/status', async (_req, res) => {
+app.get('/api/remote/status', async (req, res) => {
   noStore(res);
   if (runtimeRole !== 'hub') {
     res.status(403).json({ ok: false, error: 'role-not-allowed' });
     return;
-  }
+  }
   try {
+    const includePairingPin = authorizedWorkspaceRole(req) === 'owner';
     const [secretStatus, wallPreferences] = await Promise.all([
-      Promise.resolve(remoteHub.getStatus({ includeSecrets: true })),
+      Promise.resolve(includePairingPin ? remoteHub.getStatus({ includeSecrets: true }) : {}),
       liveDeskSettingsStore.getWallPreferencesRecord()
     ]);
+    const visibleStatus = { ...remoteHub.getStatus({ includeSecrets: false }) };
+    if (!includePairingPin) delete visibleStatus.pairingPin;
     res.json({
-      ...remoteHub.getStatus({ includeSecrets: false }),
-      pairingPin: secretStatus.pairingPin,
+      ...visibleStatus,
+      ...(includePairingPin ? { pairingPin: secretStatus.pairingPin } : {}),
       product: 'LiveDesk',
       runtimeRole,
       deviceId: runtimeDeviceId,
@@ -4366,6 +4984,7 @@ app.get('/api/remote/status', async (_req, res) => {
       roleSource: runtimeRoleSource,
       agentPackage: '@livedesk/client',
       wallPreferences,
+      workspace: workspaceAccessSnapshot(),
       consoleDirect: hubConsoleDirect?.inspect() || { enabled: false, state: 'starting' },
       frameLanes: snapshotFrameLaneResourceHealth(),
       update: getLiveDeskUpdateStatus()
@@ -4546,72 +5165,242 @@ app.post('/api/runtime/switch-role', (req, res) => {
   res.redirect(307, '/api/runtime/role');
 });
 
-app.get('/api/auth/status', (_req, res) => {
-  noStore(res);
-  res.json({ ok: true, authenticated: runtimeManager.getSnapshot().authenticated, userId: runtimeManager.getSnapshot().userId || null, role: runtimeRole });
-});
+app.get('/api/auth/status', (_req, res) => {
+  noStore(res);
+  res.json({
+    ok: true,
+    authenticated: runtimeManager.getSnapshot().authenticated,
+    userId: runtimeManager.getSnapshot().userId || null,
+    role: runtimeRole,
+    workspace: workspaceAccessSnapshot()
+  });
+});
 
-app.post('/api/auth/session', async (req, res) => {
-  noStore(res);
-  const normalized = normalizeRuntimeAuthSession(req.body);
+app.post('/api/auth/session', async (req, res) => {
+  noStore(res);
+  const consoleProxyAuthorization = authorizeConsoleProxyRequest(req);
+  if (consoleProxyAuthorization) {
+    if (!consoleProxyAuthorization.ok) {
+      res.status(consoleProxyAuthorization.status).json({ ok: false, error: consoleProxyAuthorization.error });
+      return;
+    }
+    const validConsoleWorkspaceMember = consoleProxyAuthorization.workspaceKind === 'team'
+      ? ['owner', 'operator'].includes(consoleProxyAuthorization.role)
+      : consoleProxyAuthorization.workspaceKind === 'personal'
+        && consoleProxyAuthorization.role === 'owner';
+    if (!validConsoleWorkspaceMember
+      || !workspaceEntitlementCanRequest(consoleProxyAuthorization, 'POST', '/api/auth/session')) {
+      res.status(403).json({ ok: false, error: 'workspace-member-session-required' });
+      return;
+    }
+    const accessExpiresAt = consoleProxyAuthorization.workspaceKind === 'team'
+      ? Math.min(Number(consoleProxyAuthorization.accessExpiresAt || 0), Date.now() + TEAM_UI_ACCESS_MAX_AGE_MS)
+      : 0;
+    const uiSession = hubUiSessionAuthority.renew(req, consoleProxyAuthorization.userId, {
+      workspaceId: consoleProxyAuthorization.workspaceId,
+      workspaceKind: consoleProxyAuthorization.workspaceKind,
+      role: consoleProxyAuthorization.role,
+      plan: consoleProxyAuthorization.plan,
+      entitlementStatus: consoleProxyAuthorization.entitlementStatus,
+      membershipRevision: consoleProxyAuthorization.membershipRevision,
+      accessExpiresAt
+    });
+    res.setHeader('Set-Cookie', serializeHubUiSessionCookie(uiSession.sessionId, uiSession.expiresAt, {
+      secure: isSecureHubHttpRequest(req)
+    }));
+    res.json({
+      ok: true,
+      authenticated: true,
+      persisted: false,
+      runtimeOwner: false,
+      userId: consoleProxyAuthorization.userId,
+      role: runtimeRole,
+      workspace: {
+        workspaceId: consoleProxyAuthorization.workspaceId,
+        kind: consoleProxyAuthorization.workspaceKind,
+        role: consoleProxyAuthorization.role,
+        membershipRevision: consoleProxyAuthorization.membershipRevision,
+        plan: consoleProxyAuthorization.plan,
+        status: consoleProxyAuthorization.entitlementStatus
+      },
+      license: licenseSnapshot(),
+      uiSession: {
+        csrfToken: uiSession.csrfToken,
+        expiresAt: uiSession.expiresAt,
+        accessExpiresAt
+      }
+    });
+    return;
+  }
+  const requestAuthEpoch = runtimeAuthEpoch;
+  const requestBoundUserId = currentBoundHubUserId();
+  const requestBoundWorkspaceId = currentBoundHubWorkspaceId();
+  const normalized = normalizeRuntimeAuthSession(req.body);
   if (!normalized.ok) {
     res.status(400).json({ ok: false, error: normalized.error });
     return;
-  }
-  const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
-  try {
-    const user = await verifySupabaseUser(accessToken);
-    const boundUserId = currentBoundHubUserId();
-    if (boundUserId && boundUserId !== user.id) {
-      res.status(403).json({ ok: false, error: 'hub-account-mismatch' });
-      return;
-    }
-    if (!boundUserId && !isLoopbackAddress(req.socket?.remoteAddress)) {
-      res.status(403).json({ ok: false, error: 'hub-first-account-binding-must-be-local' });
-      return;
-    }
-    runtimeAccessToken = accessToken;
-    runtimeRefreshToken = refreshToken;
-    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
-    runtimeManager.setAuthenticated(true, user.id);
+  }
+  const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
+  try {
+    const user = await verifySupabaseUser(accessToken);
+    const explicitlyRequestedWorkspaceId = req.body?.workspaceId ?? req.body?.workspace_id ?? '';
+    const authoritativeWorkspaceId = await queryRuntimeDeviceWorkspace(accessToken);
+    const nativeRuntimeWorkspaceFallback = !String(explicitlyRequestedWorkspaceId || '').trim()
+      && isTrustedNativeLoopbackRequest(req)
+      ? currentBoundHubWorkspaceId() || authoritativeWorkspaceId
+      : '';
+    const access = await verifyWorkspaceAccess(
+      accessToken,
+      user,
+      explicitlyRequestedWorkspaceId || nativeRuntimeWorkspaceFallback
+    );
+    const boundUserId = currentBoundHubUserId();
+    const boundWorkspaceId = currentBoundHubWorkspaceId();
+    if (runtimeAuthEpoch !== requestAuthEpoch
+      || boundUserId !== requestBoundUserId
+      || boundWorkspaceId !== requestBoundWorkspaceId) {
+      res.status(409).json({ ok: false, error: 'hub-auth-session-superseded' });
+      return;
+    }
+    if (authoritativeWorkspaceId && authoritativeWorkspaceId !== access.workspaceId) {
+      res.status(403).json({ ok: false, error: 'hub-device-workspace-mismatch' });
+      return;
+    }
+    const sameRuntimeOwner = Boolean(boundUserId) && boundUserId === user.id;
+    const memberUiOnly = Boolean(boundUserId)
+      && boundWorkspaceId === access.workspaceId
+      && ['owner', 'operator'].includes(access.role)
+      && (!sameRuntimeOwner
+        || access.role !== 'owner'
+        || !isTrustedNativeLoopbackRequest(req));
+    const ownerLocalWorkspaceRebind = sameRuntimeOwner
+      && boundWorkspaceId
+      && boundWorkspaceId !== access.workspaceId
+      && access.role === 'owner'
+      && isTrustedNativeLoopbackRequest(req)
+      && authoritativeWorkspaceId === access.workspaceId;
+    if (boundWorkspaceId && boundWorkspaceId !== access.workspaceId && !ownerLocalWorkspaceRebind) {
+      res.status(403).json({ ok: false, error: 'hub-workspace-mismatch' });
+      return;
+    }
+    if (!boundUserId
+      && (access.role !== 'owner' || !isLoopbackAddress(req.socket?.remoteAddress))) {
+      res.status(403).json({
+        ok: false,
+        error: access.role === 'owner'
+          ? 'hub-first-account-binding-must-be-local'
+          : 'hub-owner-session-required'
+      });
+      return;
+    }
+    if (!memberUiOnly && !refreshToken) {
+      res.status(400).json({ ok: false, error: 'refresh-token-required' });
+      return;
+    }
+    if (ownerLocalWorkspaceRebind) {
+      hubUiSessionAuthority.revokeAll('hub-workspace-rebound');
+    }
+    if (access.workspaceKind === 'team' && !workspaceRemoteAccessActive(access)) {
+      hubUiSessionAuthority.revokeWorkspaceMember(access.workspaceId, user.id);
+    }
+    const uiAccessExpiresAt = access.workspaceKind === 'team'
+      ? Date.now() + TEAM_UI_ACCESS_MAX_AGE_MS
+      : 0;
+    const uiSession = hubUiSessionAuthority.renew(req, user.id, {
+      workspaceId: access.workspaceId,
+      workspaceKind: access.workspaceKind,
+      role: access.role,
+      plan: access.plan,
+      entitlementStatus: access.entitlementStatus,
+      membershipRevision: access.membershipRevision,
+      accessExpiresAt: uiAccessExpiresAt
+    });
+    res.setHeader('Set-Cookie', serializeHubUiSessionCookie(uiSession.sessionId, uiSession.expiresAt, {
+      secure: isSecureHubHttpRequest(req)
+    }));
+    if (memberUiOnly) {
+      res.json({
+        ok: true,
+        authenticated: true,
+        persisted: false,
+        runtimeOwner: false,
+        userId: user.id,
+        role: runtimeRole,
+        workspace: workspaceAccessSnapshot(access),
+        license: licenseSnapshot(),
+        hostTarget: {
+          ok: true,
+          pending: false,
+          active: remoteHub.getStatus({ includeSecrets: false }).hostTargetActive === true
+        },
+        uiSession: {
+          csrfToken: uiSession.csrfToken,
+          expiresAt: uiSession.expiresAt,
+          accessExpiresAt: uiAccessExpiresAt
+        }
+      });
+      return;
+    }
+    if (boundUserId && !sameRuntimeOwner) {
+      res.status(403).json({ ok: false, error: 'hub-account-mismatch' });
+      return;
+    }
+    runtimeAuthEpoch += 1;
+    runtimeAccessToken = accessToken;
+    runtimeRefreshToken = refreshToken;
+    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
+    runtimeWorkspaceAccess = access;
+    if (ownerLocalWorkspaceRebind) {
+      hubConsoleDirect?.invalidateWorkspaceAccess('hub-workspace-rebound');
+    }
+    workspaceAccessLastAttemptAt = Date.now();
+    licenseRefreshLastAttemptAt = Date.now();
+    runtimeManager.setAuthenticated(true, user.id);
     const persisted = persistRuntimeSession({
       access_token: accessToken,
       refresh_token: refreshToken,
       expires_at: expiresAt,
-      user
-    });
-    const hostTarget = runtimeRole === 'hub'
-      ? {
-          ok: true,
-          pending: true,
-          active: remoteHub.getStatus({ includeSecrets: false }).hostTargetActive === true
-        }
-      : { ok: true, pending: false, active: false };
-    const uiSession = hubUiSessionAuthority.issue(user.id);
-    res.setHeader('Set-Cookie', serializeHubUiSessionCookie(uiSession.sessionId, uiSession.expiresAt, {
-      secure: isSecureHubHttpRequest(req)
-    }));
-    res.json({
+      user
+    });
+    const workspacePersisted = persistRuntimeWorkspace(access);
+    applyVerifiedWorkspaceLicense(access);
+    const teamRemoteActive = workspaceRemoteAccessActive(access);
+    let hostTarget = runtimeRole === 'hub'
+      ? {
+          ok: true,
+          pending: true,
+          active: remoteHub.getStatus({ includeSecrets: false }).hostTargetActive === true
+        }
+      : { ok: true, pending: false, active: false };
+    if (runtimeRole === 'hub' && !teamRemoteActive) {
+      hubConsoleDirect?.close();
+      const cleared = await clearHubHostTarget('workspace-entitlement-inactive');
+      hostTarget = { ok: cleared.ok, pending: false, active: false, error: cleared.error || '' };
+    }
+    res.json({
       ok: true,
-      authenticated: true,
-      persisted,
-      userId: user.id,
-      role: runtimeRole,
+      authenticated: true,
+      persisted: persisted && workspacePersisted,
+      runtimeOwner: true,
+      userId: user.id,
+      role: runtimeRole,
+      workspace: workspaceAccessSnapshot(access),
+      license: licenseSnapshot(),
       hostTarget,
       uiSession: {
         csrfToken: uiSession.csrfToken,
         expiresAt: uiSession.expiresAt
       }
     });
-    if (runtimeRole === 'hub') {
+    if (runtimeRole === 'hub' && teamRemoteActive) {
       hubConsoleDirect?.refresh();
       scheduleAuthenticatedHubHostTargetPublication('session-received');
     }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const status = authVerificationHttpStatus(message);
-    res.status(status).json({ ok: false, error: message });
-  }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = workspaceAccessHttpStatus(error);
+    res.status(status).json({ ok: false, error: message });
+  }
 });
 
 function updateHubHostTargetLeaseState(patch = {}) {
@@ -4643,19 +5432,20 @@ function hubWakeSignalUrl() {
   return url.toString();
 }
 
-function buildHubWakeEventId(target, remoteStatus, endpointCandidates) {
-  return crypto.createHash('sha256').update(JSON.stringify({
-    deviceId: runtimeDeviceId,
+function buildHubWakeEventId(target, remoteStatus, endpointCandidates, workspaceId = currentBoundHubWorkspaceId()) {
+  return crypto.createHash('sha256').update(JSON.stringify({
+    workspaceId,
+    deviceId: runtimeDeviceId,
     leaseId: target.leaseId || '',
     hostInstanceId: target.hostInstanceId || remoteStatus.hostInstanceId || '',
     endpointCandidates: [...endpointCandidates].sort()
   })).digest('hex').slice(0, 40);
 }
 
-async function notifyHubOnline({ accessToken, target, remoteStatus, endpointCandidates }) {
-  const url = hubWakeSignalUrl();
-  if (!url) return { ok: false, skipped: true, reason: 'wake-disabled' };
-  const eventId = buildHubWakeEventId(target, remoteStatus, endpointCandidates);
+async function notifyHubOnline({ accessToken, target, remoteStatus, endpointCandidates, workspaceId }) {
+  const url = hubWakeSignalUrl();
+  if (!url) return { ok: false, skipped: true, reason: 'wake-disabled' };
+  const eventId = buildHubWakeEventId(target, remoteStatus, endpointCandidates, workspaceId);
   if (hubWakeNotificationState.lastEventId === eventId && hubWakeNotificationState.state === 'notified') {
     return { ok: true, skipped: true, eventId };
   }
@@ -4678,7 +5468,11 @@ async function notifyHubOnline({ accessToken, target, remoteStatus, endpointCand
         'Content-Type': 'application/json',
         Accept: 'application/json'
       },
-      body: JSON.stringify({ deviceId: runtimeDeviceId, eventId })
+      body: JSON.stringify({
+        workspaceId,
+        deviceId: runtimeDeviceId,
+        eventId
+      })
     }, SUPABASE_AUTH_TIMEOUT_MS);
     const data = await response.json().catch(() => null);
     if (!response.ok || data?.ok === false) {
@@ -4727,9 +5521,8 @@ async function callHubSupabaseRpc(name, payload, accessToken) {
   );
   const data = await response.json().catch(() => null);
   const result = Array.isArray(data) ? data[0] : data;
-  if (response.status === 401 || response.status === 403) {
-    if (!desktopMainAuthConfig) clearRuntimeSession();
-    throw new Error(`${name}-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`${name}-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`${name}-failed:${response.status}`);
@@ -4740,16 +5533,21 @@ async function callHubSupabaseRpc(name, payload, accessToken) {
   return result;
 }
 
-async function promoteCurrentRuntimeToHub() {
-  if (runtimeRole !== 'hub' || !runtimeDeviceId) {
-    throw new Error('hub-runtime-identity-unavailable');
-  }
+async function promoteCurrentRuntimeToHub() {
+  if (runtimeRole !== 'hub' || !runtimeDeviceId) {
+    throw new Error('hub-runtime-identity-unavailable');
+  }
+  if (runtimeWorkspaceAccess?.workspaceKind === 'team'
+    && !workspaceRemoteAccessActive(runtimeWorkspaceAccess)) {
+    throw new Error('workspace-entitlement-inactive');
+  }
   const accessToken = await getRuntimeAccessToken();
   if (!accessToken) {
     throw new Error('hub-session-required');
   }
-  const result = await callHubSupabaseRpc('set_livedesk_device_role', {
-    p_device_id: runtimeDeviceId,
+  const result = await callHubSupabaseRpc('set_livedesk_workspace_device_role', {
+    p_workspace_id: currentBoundHubWorkspaceId(),
+    p_device_id: runtimeDeviceId,
     p_role: 'hub',
     p_assigned_hub_id: null,
     p_expected_role_version: null
@@ -4758,10 +5556,22 @@ async function promoteCurrentRuntimeToHub() {
   return result;
 }
 
-async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {}) {
-  if (runtimeRole !== 'hub') {
-    throw new Error('hub-role-not-allowed');
-  }
+async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {}) {
+  const operationAuthEpoch = runtimeAuthEpoch;
+  const operationUserId = currentBoundHubUserId();
+  const operationWorkspaceId = currentBoundHubWorkspaceId();
+  if (runtimeRole !== 'hub') {
+    throw new Error('hub-role-not-allowed');
+  }
+  if (runtimeWorkspaceAccess?.workspaceKind === 'team'
+    && !workspaceRemoteAccessActive(runtimeWorkspaceAccess)) {
+    updateHubHostTargetLeaseState({
+      state: 'inactive',
+      lastReason: String(reason || 'renewal'),
+      lastError: 'workspace-entitlement-inactive'
+    });
+    return { ok: false, active: false, error: 'workspace-entitlement-inactive' };
+  }
   if (hubHostTargetRenewInFlight) {
     return { ok: false, error: 'host-target-publish-already-running', hostTarget: remoteHub.getStatus({ includeSecrets: false }) };
   }
@@ -4777,7 +5587,10 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
     if (!accessToken) {
       throw new Error('hub-session-required');
     }
-    const authoritativeRole = await queryAuthoritativeRuntimeRole();
+    const authoritativeRole = await queryAuthoritativeRuntimeRole();
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
     if (authoritativeRole !== 'hub') {
       throw new Error(authoritativeRole === 'client' ? 'hub-role-no-longer-authoritative' : 'hub-role-not-authoritative');
     }
@@ -4788,9 +5601,12 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
       leaseMs: HUB_HOST_TARGET_LEASE_MS,
       takeover
     });
-    if (!local?.ok || !local.hostTarget) {
-      throw new Error(local?.error || 'local-host-target-failed');
-    }
+    if (!local?.ok || !local.hostTarget) {
+      throw new Error(local?.error || 'local-host-target-failed');
+    }
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
 
     const remoteStatus = remoteHub.getStatus({ includeSecrets: true });
     if (!remoteStatus.agentEndpointAccountRouteReady) {
@@ -4800,8 +5616,9 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
     const endpointCandidates = Array.isArray(target.endpointCandidates) && target.endpointCandidates.length > 0
       ? target.endpointCandidates
       : [target.endpoint].filter(Boolean);
-    await callHubSupabaseRpc('set_livedesk_remote_host_target', {
-      p_node_id: runtimeDeviceId,
+    await callHubSupabaseRpc('set_livedesk_workspace_remote_host_target', {
+      p_workspace_id: operationWorkspaceId,
+      p_node_id: runtimeDeviceId,
       p_lease_id: target.leaseId,
       p_host_instance_id: target.hostInstanceId || remoteStatus.hostInstanceId || runtimeDeviceId,
       p_endpoint: target.endpoint || remoteStatus.agentEndpoint,
@@ -4815,7 +5632,19 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
       p_endpoint_candidates: endpointCandidates,
       p_pairing_pin: remoteStatus.pairingPin || ''
     }, accessToken);
-    await notifyHubOnline({ accessToken, target, remoteStatus, endpointCandidates });
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
+    await notifyHubOnline({
+      accessToken,
+      target,
+      remoteStatus,
+      endpointCandidates,
+      workspaceId: operationWorkspaceId
+    });
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
 
     updateHubHostTargetLeaseState({
       state: 'active',
@@ -4851,7 +5680,10 @@ async function publishHubHostTargetWithPendingRoleTakeover(reason = 'renewal') {
   return result;
 }
 
-async function clearHubHostTarget(reason = 'shutdown') {
+async function clearHubHostTarget(reason = 'shutdown') {
+  const operationAuthEpoch = runtimeAuthEpoch;
+  const operationUserId = currentBoundHubUserId();
+  const operationWorkspaceId = currentBoundHubWorkspaceId();
   if (hubHostTargetRenewTimer) {
     clearInterval(hubHostTargetRenewTimer);
     hubHostTargetRenewTimer = null;
@@ -4864,18 +5696,24 @@ async function clearHubHostTarget(reason = 'shutdown') {
   try {
     const accessToken = await getRuntimeAccessToken();
     if (accessToken && targetNodeId && targetLeaseId && targetInstanceId) {
-      await callHubSupabaseRpc('clear_livedesk_remote_host_target', {
-        p_node_id: targetNodeId,
+      await callHubSupabaseRpc('clear_livedesk_workspace_remote_host_target', {
+        p_workspace_id: operationWorkspaceId,
+        p_node_id: targetNodeId,
         p_lease_id: targetLeaseId,
         p_host_instance_id: targetInstanceId,
         p_force: false
       }, accessToken);
     }
-  } catch (cause) {
-    error = cause instanceof Error ? cause.message : String(cause);
-    console.error(`[VuvoDesk Hub] Host target ${reason} clear failed: ${error}`);
-  }
-  try {
+  } catch (cause) {
+    error = cause instanceof Error ? cause.message : String(cause);
+    console.error(`[VuvoDesk Hub] Host target ${reason} clear failed: ${error}`);
+  }
+  const currentRemoteStatus = remoteHub.getStatus({ includeSecrets: false });
+  if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)
+    || (targetLeaseId && String(currentRemoteStatus.hostTargetLeaseId || '') !== targetLeaseId)) {
+    return { ok: true, superseded: true, error, lease: getHubHostTargetLeaseStatus() };
+  }
+  try {
     await remoteHub.setHostTarget({ enabled: false, nodeId: targetNodeId });
   } catch (cause) {
     error = error || (cause instanceof Error ? cause.message : String(cause));
@@ -4914,16 +5752,31 @@ function scheduleAuthenticatedHubHostTargetPublication(reason = 'session-receive
   });
 }
 
-app.delete('/api/auth/session', async (req, res) => {
-  noStore(res);
+app.delete('/api/auth/session', async (req, res) => {
+  noStore(res);
+  const nativeOwnerLogout = isTrustedNativeLoopbackRequest(req)
+    && !String(req.headers['x-livedesk-console-proxy'] || '').trim();
+  if (!nativeOwnerLogout) {
+    const revoked = hubUiSessionAuthority.revoke(req);
+    res.setHeader('Set-Cookie', clearHubUiSessionCookie({ secure: isSecureHubHttpRequest(req) }));
+    res.json({
+      ok: true,
+      authenticated: runtimeManager.getSnapshot().authenticated,
+      role: runtimeRole,
+      runtimePreserved: true,
+      signedOutUserId: revoked?.userId || null,
+      workspaceId: revoked?.workspaceId || currentBoundHubWorkspaceId()
+    });
+    return;
+  }
   const hostTarget = runtimeRole === 'hub'
     ? await clearHubHostTarget('logout')
     : { ok: true, active: false };
   clearRuntimeSession();
   hubConsoleDirect?.close();
   res.setHeader('Set-Cookie', clearHubUiSessionCookie({ secure: isSecureHubHttpRequest(req) }));
-  res.json({ ok: true, authenticated: false, role: runtimeRole, hostTarget });
-});
+  res.json({ ok: true, authenticated: false, role: runtimeRole, runtimePreserved: false, hostTarget });
+});
 
 app.get('/api/hub/status', (_req, res) => {
   noStore(res);
@@ -5015,34 +5868,19 @@ app.post('/api/runtime/role', async (req, res) => {
     res.status(400).json({ ok: false, error: 'hub-can-only-transition-to-client' });
     return;
   }
-  const authorization = String(req.headers.authorization || '').trim();
-  const accessToken = authorization.replace(/^Bearer\s+/i, '').trim();
+  const accessToken = await getRuntimeAccessToken().catch(() => '');
   if (!accessToken || !runtimeDeviceId) {
     res.status(401).json({ ok: false, error: 'supabase-access-token-and-device-id-required' });
     return;
   }
   try {
-    const response = await fetch(`${supabaseUrl}/rest/v1/rpc/set_livedesk_device_role`, {
-      method: 'POST',
-      headers: {
-        apikey: supabasePublishableKey,
-        Authorization: `Bearer ${accessToken}`,
-        'Content-Type': 'application/json',
-        Accept: 'application/json'
-      },
-      body: JSON.stringify({
-        p_device_id: runtimeDeviceId,
-        p_role: 'client',
-        p_assigned_hub_id: String(req.body?.assignedHubId || '').trim() || null,
-        p_expected_role_version: Number.isInteger(Number(req.body?.expectedRoleVersion)) ? Number(req.body.expectedRoleVersion) : null
-      })
-    });
-    const data = await response.json().catch(() => null);
-    const result = Array.isArray(data) ? data[0] : data;
-    if (!response.ok || result?.ok === false) {
-      res.status(409).json({ ok: false, error: result?.reason || `role-change-rejected:${response.status}` });
-      return;
-    }
+    const result = await callHubSupabaseRpc('set_livedesk_workspace_device_role', {
+      p_workspace_id: currentBoundHubWorkspaceId(),
+      p_device_id: runtimeDeviceId,
+      p_role: 'client',
+      p_assigned_hub_id: String(req.body?.assignedHubId || '').trim() || null,
+      p_expected_role_version: Number.isInteger(Number(req.body?.expectedRoleVersion)) ? Number(req.body.expectedRoleVersion) : null
+    }, accessToken);
     await clearHubHostTarget('role-transition');
     res.json({ ok: true, restarting: true, role: 'client', roleVersion: result?.role_version || 0 });
     setTimeout(() => process.exit(ROLE_TRANSITION_EXIT_CODE), 150);
@@ -5090,38 +5928,103 @@ app.get('/api/remote/registry-credentials', (_req, res) => {
   });
 });
 
-app.get('/api/remote/license', (_req, res) => {
+app.get('/api/remote/license', (_req, res) => {
   noStore(res);
-  res.json(licenseSnapshot());
-});
-
-app.post('/api/remote/license/sync', async (req, res) => {
+  res.json(licenseSnapshot());
+});
+
+app.post('/api/remote/workspace/members/:userId/revoke', async (req, res) => {
+  noStore(res);
+  const workspaceId = String(req.body?.workspaceId || '').trim();
+  const memberUserId = String(req.params.userId || '').trim().slice(0, 160);
+  if (authorizedWorkspaceRole(req) !== 'owner') {
+    res.status(403).json({ ok: false, error: 'workspace-owner-required' });
+    return;
+  }
+  if (!workspaceId || workspaceId !== currentBoundHubWorkspaceId() || !memberUserId) {
+    res.status(400).json({ ok: false, error: 'workspace-and-member-required' });
+    return;
+  }
+  const retiredPeers = hubConsoleDirect?.revokeWorkspaceMember(
+    workspaceId,
+    memberUserId,
+    'workspace-member-revoked'
+  ) || 0;
+  const revokedUiSessions = hubUiSessionAuthority.revokeWorkspaceMember(workspaceId, memberUserId);
+  let wakeRevoked = false;
+  let wakeError = '';
+  try {
+    const accessToken = await getRuntimeAccessToken();
+    if (!accessToken) throw new Error('hub-session-required');
+    const revokeUrl = new URL('/v2/rtc/revoke-member', hubWakeBaseUrl);
+    const response = await fetchAuthResponse(fetch, revokeUrl.href, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json'
+      },
+      body: JSON.stringify({ workspaceId, memberUserId })
+    }, SUPABASE_AUTH_TIMEOUT_MS);
+    wakeRevoked = response.ok;
+    if (!response.ok) wakeError = `wake-member-revoke-failed:${response.status}`;
+  } catch (error) {
+    wakeError = error instanceof Error ? error.message : String(error);
+  }
+  res.json({
+    ok: true,
+    workspaceId,
+    memberUserId,
+    retiredPeers,
+    revokedUiSessions,
+    wakeRevoked,
+    ...(wakeError ? { wakeError } : {})
+  });
+});
+
+app.post('/api/remote/license/sync', async (req, res) => {
   noStore(res);
   try {
-    const authorization = String(req.headers.authorization || '');
-    const accessToken = authorization.replace(/^Bearer\s+/i, '').trim();
-    res.json(await syncVerifiedLicense(accessToken));
-  } catch (err) {
-    verifiedLicense = {
-      userId: '',
-      plan: 'free',
-      status: 'inactive',
-      expiresAt: '',
-      verifiedAt: Date.now()
-    };
-    res.status(401).json({ ok: false, error: err instanceof Error ? err.message : String(err), license: licenseSnapshot() });
-  }
-});
+    const authorization = String(req.headers.authorization || '');
+    const accessToken = authorization.replace(/^Bearer\s+/i, '').trim();
+    res.json(await syncVerifiedLicense(accessToken, req.body?.workspaceId ?? req.body?.workspace_id ?? ''));
+  } catch (err) {
+    const explicitAccessRejection = err instanceof WorkspaceAccessError && err.status < 500;
+    if (explicitAccessRejection) {
+      verifiedLicense = {
+        userId: '',
+        workspaceId: currentBoundHubWorkspaceId(),
+        workspaceKind: runtimeWorkspaceAccess?.workspaceKind || 'personal',
+        plan: 'free',
+        status: 'inactive',
+        expiresAt: '',
+        memberLimit: 1,
+        commercialUse: false,
+        verifiedAt: Date.now()
+      };
+    }
+    res.status(workspaceAccessHttpStatus(err)).json({
+      ok: false,
+      error: err instanceof Error ? err.message : String(err),
+      preserved: !explicitAccessRejection && Date.now() - verifiedLicense.verifiedAt <= LICENSE_VERIFY_MAX_AGE_MS,
+      license: licenseSnapshot()
+    });
+  }
+});
 
 app.delete('/api/remote/license', (_req, res) => {
   noStore(res);
-  verifiedLicense = {
-    userId: '',
-    plan: 'free',
-    status: 'inactive',
-    expiresAt: '',
-    verifiedAt: Date.now()
-  };
+  verifiedLicense = {
+    userId: '',
+    workspaceId: currentBoundHubWorkspaceId(),
+    workspaceKind: runtimeWorkspaceAccess?.workspaceKind || 'personal',
+    plan: 'free',
+    status: 'inactive',
+    expiresAt: '',
+    memberLimit: 1,
+    commercialUse: false,
+    verifiedAt: Date.now()
+  };
   res.json(licenseSnapshot());
 });
 
@@ -5787,10 +6690,26 @@ httpServer.on('upgrade', (req, socket, head) => {
     const label = authorization.status === 403 ? 'Forbidden' : 'Unauthorized';
     socket.write(`HTTP/1.1 ${authorization.status} ${label}\r\nConnection: close\r\n\r\n`);
     socket.destroy();
-    return;
-  }
-  try {
-    const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
+    return;
+  }
+  try {
+    const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
+    if (!workspaceEntitlementCanRequest(
+      authorizationWorkspaceAccess(authorization),
+      'GET',
+      parsed.pathname
+    )) {
+      socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+      socket.destroy();
+      return;
+    }
+    if (authorization.role
+      && !workspaceRoleCanRequest(authorization.role, 'GET', parsed.pathname)) {
+      socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+      socket.destroy();
+      return;
+    }
+    req.liveDeskAuthorization = authorization;
     if (parsed.pathname === '/api/remote/frames/ws') {
       frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
       return;
@@ -5815,7 +6734,8 @@ httpServer.on('upgrade', (req, socket, head) => {
   }
 });
 
-frameWss.on('connection', (ws, req) => {
+frameWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   frameClients.add(ws);
   ws.liveDeskFrameClientId = `rfws-${++frameClientSeq}`;
   try {
@@ -5834,6 +6754,7 @@ frameWss.on('connection', (ws, req) => {
     updateFrameSubscription(ws, {});
   }
   ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     try {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
       if (payload?.type === 'subscribe') {
@@ -5857,7 +6778,8 @@ frameWss.on('connection', (ws, req) => {
   });
 });
 
-atlasWss.on('connection', ws => {
+atlasWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   ws.liveDeskFrameClientId = `atlas-${++frameClientSeq}`;
   try { ws._socket?.setNoDelay?.(true); } catch {}
   const cleanup = () => {
@@ -5871,7 +6793,8 @@ atlasWss.on('connection', ws => {
     ws.liveDeskAtlasSession = null;
     retireFrameClientSendLane(ws);
   };
-  ws.on('message', data => {
+  ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     try {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
       if (payload?.type === 'subscribe' || payload?.type === 'configure') {
@@ -5891,7 +6814,8 @@ atlasWss.on('connection', ws => {
   });
 });
 
-audioWss.on('connection', (ws, req) => {
+audioWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   audioClients.add(ws);
   ws.liveDeskAudioClientId = `raws-${++audioClientSeq}`;
   ws.liveDeskAudioCleanupComplete = false;
@@ -5904,7 +6828,8 @@ audioWss.on('connection', (ws, req) => {
   } catch {
     updateAudioSubscription(ws, {});
   }
-  ws.on('message', data => {
+  ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     try {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
       if (payload?.type === 'subscribe') {
@@ -5925,7 +6850,8 @@ audioWss.on('connection', (ws, req) => {
   });
 });
 
-inputWss.on('connection', ws => {
+inputWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   inputClients.add(ws);
   ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
   ws.liveDeskInputDeviceIds = new Set();
@@ -5934,7 +6860,8 @@ inputWss.on('connection', ws => {
   } catch {
     // Best-effort latency hint for browser input sockets.
   }
-  ws.on('message', data => {
+  ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     let payload;
     try {
       payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
@@ -6103,9 +7030,10 @@ function shutdownHub(signal) {
   hubShutdownPromise = (async () => {
     const startedAt = Date.now();
     console.log(`[VuvoDesk Hub] Shutdown started signal=${signal} grace=${hubShutdownGraceMs}ms timeout=${hubShutdownTimeoutMs}ms.`);
-    if (roleWatchTimer) clearInterval(roleWatchTimer);
-    clearInterval(browserWebSocketHeartbeatTimer);
-    runSynchronousShutdownStep('update manager close', () => liveDeskUpdateManager?.close());
+    if (roleWatchTimer) clearInterval(roleWatchTimer);
+    clearInterval(browserWebSocketHeartbeatTimer);
+    runSynchronousShutdownStep('control presentation reconcile close', () => readOnlyControlPresentationReconcileCoordinator.close());
+    runSynchronousShutdownStep('update manager close', () => liveDeskUpdateManager?.close());
     runSynchronousShutdownStep('mobile console direct close', () => hubConsoleDirect?.close());
     atlasClients.clear();
     runSynchronousShutdownStep('shared folder close', () => hubSharedFolders.close());