@muhkoo/connect 0.14.0-alpha.9 → 0.15.0-alpha.1

package/dist/server/index.js

@@ -1,10 +1,10 @@
 import { prove, verify as verify$1 } from '@zk-kit/groth16';
+import { ristretto255_oprf } from '@noble/curves/ed25519.js';
 import { p256 } from '@noble/curves/nist.js';
 import { buildPoseidon } from 'circomlibjs';
 import { scrypt } from '@noble/hashes/scrypt.js';
 import { entropyToMnemonic, validateMnemonic, mnemonicToEntropy } from '@scure/bip39';
 import { wordlist } from '@scure/bip39/wordlists/english.js';
-import { ristretto255_oprf } from '@noble/curves/ed25519.js';
 
 const _isTty = (() => {
     try {
@@ -316,7 +316,7 @@ function fromBase64Url(b64url) {
     return fromBase64$2(padded);
 }
 /** Concatenate any number of byte arrays into a single Uint8Array. */
-function concatBytes(...arrays) {
+function concatBytes$1(...arrays) {
     let total = 0;
     for (const a of arrays)
         total += a.byteLength;
@@ -1243,6 +1243,8 @@ class KeyStore {
     static instance;
     _keys = new Map();
     _authKeys = new Map();
+    /** The exact pairs marked vault-backed, so a pair written over them later is never taken for them. */
+    _vaultBacked = new Map();
     constructor() { }
     static getInstance() {
         if (!KeyStore.instance) {
@@ -1280,7 +1282,28 @@ class KeyStore {
         const dehydrated = await this.dehydrateKeyPair(id);
         appLogger.debug(`Stored remote public keys for ${id}: ecdhPub=${dehydrated.ecdhPub.slice(0, 16)}...`);
     }
+    /** Generate an own pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    async generateKeyPair() {
+        const ecdh = await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-384' }, true, ['deriveKey', 'deriveBits']);
+        const ecdsa = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-384' }, true, ['sign', 'verify']);
+        return {
+            ecdh: { privateKey: ecdh.privateKey, publicKey: ecdh.publicKey },
+            ecdsa: { privateKey: ecdsa.privateKey, publicKey: ecdsa.publicKey },
+        };
+    }
     async hydrateKeyPair(id, dehydrated) {
+        const { ecdh, ecdsa } = await this.importKeyPair(dehydrated);
+        const existing = this._keys.get(id);
+        if (!existing || !existing.privateKey) {
+            this._keys.set(id, ecdh);
+        }
+        const existingAuth = this._authKeys.get(id);
+        if (!existingAuth || !existingAuth.privateKey) {
+            this._authKeys.set(id, ecdsa);
+        }
+    }
+    /** Import a dehydrated pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    async importKeyPair(dehydrated) {
         const ecdhPubJwk = JSON.parse(deserialize(dehydrated.ecdhPub));
         const ecdhPublicKey = await crypto.subtle.importKey('jwk', ecdhPubJwk, { name: 'ECDH', namedCurve: 'P-384' }, true, []);
         const ecdsaPubJwk = JSON.parse(deserialize(dehydrated.ecdsaPub));
@@ -1295,14 +1318,10 @@ class KeyStore {
             const ecdsaPrivJwk = JSON.parse(deserialize(dehydrated.ecdsaPriv));
             ecdsaPrivateKey = await crypto.subtle.importKey('jwk', ecdsaPrivJwk, { name: 'ECDSA', namedCurve: 'P-384' }, true, ['sign']);
         }
-        const existing = this._keys.get(id);
-        if (!existing || !existing.privateKey) {
-            this._keys.set(id, { privateKey: ecdhPrivateKey, publicKey: ecdhPublicKey });
-        }
-        const existingAuth = this._authKeys.get(id);
-        if (!existingAuth || !existingAuth.privateKey) {
-            this._authKeys.set(id, { privateKey: ecdsaPrivateKey, publicKey: ecdsaPublicKey });
-        }
+        return {
+            ecdh: { privateKey: ecdhPrivateKey, publicKey: ecdhPublicKey },
+            ecdsa: { privateKey: ecdsaPrivateKey, publicKey: ecdsaPublicKey },
+        };
     }
     getKeyPair(id) {
         return this._keys.get(id) || null;
@@ -1310,12 +1329,54 @@ class KeyStore {
     getAuthKeyPair(id) {
         return this._authKeys.get(id) || null;
     }
+    /** Record that the pair `id` holds now came from the seed-wrapped vault (ChatKeyVault). */
+    markVaultBacked(id) {
+        const ecdh = this._keys.get(id);
+        const ecdsa = this._authKeys.get(id);
+        if (ecdh && ecdsa)
+            this._vaultBacked.set(id, { ecdh, ecdsa });
+    }
+    /**
+     * Put `pair` in place as `id`'s own pair and mark it vault-backed, in one
+     * synchronous step: whatever `id` held before is dropped, so a pair minted
+     * while the vault pair was being fetched or generated is never kept and
+     * marked in its place (design §3.3).
+     */
+    replaceOwnKeyPair(id, pair) {
+        this.forget(id);
+        this._keys.set(id, pair.ecdh);
+        this._authKeys.set(id, pair.ecdsa);
+        this._vaultBacked.set(id, { ecdh: pair.ecdh, ecdsa: pair.ecdsa });
+    }
+    /**
+     * Whether `id`'s own pair was loaded from, or persisted to, the vault in this
+     * tab, and is still the very pair that was marked. A Space identity must be
+     * vault-backed (design §3.3): any other pair, such as one minted by a locked
+     * DM subscription, never takes part, even one that lands over the marked pair.
+     */
+    isVaultBacked(id) {
+        const marked = this._vaultBacked.get(id);
+        return !!marked && marked.ecdh.privateKey != null
+            && this._keys.get(id) === marked.ecdh && this._authKeys.get(id) === marked.ecdsa;
+    }
+    /** Drop every key held for `id` (SpecA §6.4 `KeyStore.forget`). */
+    forget(id) {
+        this._keys.delete(id);
+        this._authKeys.delete(id);
+        this._vaultBacked.delete(id);
+    }
     async dehydrateKeyPair(id) {
         const keyPair = this._keys.get(id);
         const authKeyPair = this._authKeys.get(id);
         if (!keyPair || !authKeyPair) {
             throw new Error(`No key pair for ${id}`);
         }
+        return this.exportKeyPair({ ecdh: keyPair, ecdsa: authKeyPair });
+    }
+    /** Dehydrate a pair that is not (yet) in the store, in the same format as {@link dehydrateKeyPair}. */
+    async exportKeyPair(pair) {
+        const keyPair = pair.ecdh;
+        const authKeyPair = pair.ecdsa;
         const ecdhPubJwk = await crypto.subtle.exportKey('jwk', keyPair.publicKey);
         const ecdhPrivJwk = keyPair.privateKey ? await crypto.subtle.exportKey('jwk', keyPair.privateKey) : null;
         const ecdsaPubJwk = await crypto.subtle.exportKey('jwk', authKeyPair.publicKey);
@@ -1340,7 +1401,7 @@ class KeyStore {
         const x = fromBase64Url(jwk.x);
         const y = fromBase64Url(jwk.y);
         // SEC1 uncompressed point: 0x04 || x || y
-        return concatBytes(new Uint8Array([0x04]), x, y);
+        return concatBytes$1(new Uint8Array([0x04]), x, y);
     }
     async packDehydratedKeys(id) {
         const dehydrated = await this.dehydrateKeyPair(id);
@@ -1371,7 +1432,6 @@ class DoubleRatchet {
     sessionType;
     maxSkip = 3000;
     overlapPeriod = 30000; // ms
-    windowSize = 100; // messages per DH ratchet
     constructor(senderId, recipientId, sessionType, isClient = true) {
         this.sessionType = sessionType;
         const keyStore = KeyStore.getInstance();
@@ -1423,7 +1483,7 @@ class DoubleRatchet {
             throw new Error('Missing own private key');
         }
         const sharedSecret = await crypto.subtle.deriveBits({ name: 'ECDH', public: newPubKey }, ownPriv, 384);
-        const input = concatBytes(this.state.rootKey, new Uint8Array(sharedSecret));
+        const input = concatBytes$1(this.state.rootKey, new Uint8Array(sharedSecret));
         const keys = await this.hkdf(input, 'DoubleRatchetDH', 64);
         this.state.rootKey = keys.subarray(0, 32);
         this.state.recvChainKey = keys.subarray(32);
@@ -1445,16 +1505,24 @@ class DoubleRatchet {
             throw new Error(`Session type mismatch: expected ${this.sessionType}, got ${sessionType}`);
         }
         const keyStore = KeyStore.getInstance();
-        if (this.sessionType === 'specific' && this.state.sendCount >= this.windowSize && this.state.sendCount > 0) {
-            newDhKey = true;
-        }
+        // The DH-ratchet path is disabled, deliberately. It used to fire by
+        // itself once `sendCount` passed a 100-message window, and it was wrong
+        // in three ways at once: it wrote the fresh pair into the PROCESS-GLOBAL
+        // `KeyStore` under our own id (clobbering the long-term ECDH key that
+        // every other ratchet and the Space key-unwrap path read back from the
+        // same entry), it stepped our sending chain without telling the peer (so
+        // message 101 of any conversation stopped decrypting), and it hardcoded
+        // the client role regardless of which half of the session we are.
+        //
+        // No caller in the SDK asks for a rotation — every one passes `false` —
+        // so failing loudly here is strictly better than silently desynchronising
+        // a session. Rotation returns on the standard trigger (receipt of a new
+        // peer `dhPub`) with the key schedule rebuilt; see
+        // docs/superpowers/specs/2026-09-24-dm-protocol-design.md §0 and §3.6.
         if (newDhKey && this.sessionType === 'specific') {
-            appLogger.debug(`Generating new DH key pair for ${senderId}`);
-            const ecdhKeyPair = await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-384' }, true, ['deriveKey', 'deriveBits']);
-            this.state.clientDhPriv = ecdhKeyPair.privateKey;
-            this.state.clientDhPub = ecdhKeyPair.publicKey;
-            keyStore.keys.set(senderId, { privateKey: ecdhKeyPair.privateKey, publicKey: ecdhKeyPair.publicKey });
-            await this.dhRatchet(this.state.serverDhPub, true);
+            throw new Error('DoubleRatchet: DH key rotation is disabled — the previous implementation ' +
+                'corrupted the process-global KeyStore and desynchronised the peer. ' +
+                'Rotation is reinstated with the key-schedule rewrite (audit H1).');
         }
         const [messageKey, newChainKey] = await this.symmetricRatchet(this.state.sendChainKey);
         this.state.sendChainKey = newChainKey;
@@ -2209,6 +2277,7 @@ class WSTransport extends EventCore {
     pongFrame;
     heartbeatTimer = null;
     pongTimer = null;
+    terminalCloseCodes;
     constructor(opts) {
         super();
         if (!opts || !opts.url) {
@@ -2225,6 +2294,7 @@ class WSTransport extends EventCore {
         this.heartbeatTimeout = opts.heartbeatTimeout ?? 10000;
         this.pingFrame = opts.pingFrame ?? "ping";
         this.pongFrame = opts.pongFrame ?? "pong";
+        this.terminalCloseCodes = opts.terminalCloseCodes ?? [];
     }
     /** Open the socket. Resolves when CONNECTED fires. Rejects on first error. */
     async connect() {
@@ -2277,12 +2347,17 @@ class WSTransport extends EventCore {
                         reject(err);
                     }
                 };
-                socket.onclose = () => {
+                socket.onclose = (ev) => {
+                    const code = typeof ev?.code === "number" ? ev.code : undefined;
                     const wasConnected = this._isConnected;
                     this._isConnected = false;
                     this._isConnecting = false;
                     this.stopHeartbeat();
-                    this.emit(EventCoreEvents.DISCONNECTED, undefined);
+                    this.emit(EventCoreEvents.DISCONNECTED, code !== undefined ? { code, reason: ev?.reason ?? "" } : undefined);
+                    if (code !== undefined && this.terminalCloseCodes.includes(code)) {
+                        this.autoReconnect = false;
+                        return;
+                    }
                     if (this.autoReconnect && wasConnected) {
                         this.scheduleReconnect();
                     }
@@ -2312,6 +2387,14 @@ class WSTransport extends EventCore {
         this._isConnected = false;
         this._isConnecting = false;
     }
+    /** Restart reconnecting after a terminal close or `disconnect()`; the next URL comes from `urlProvider`. */
+    resume() {
+        // A reconnect already pending is left to run: a second timer would dial on top of it.
+        if (this._isConnected || this._isConnecting || this.reconnectTimeout)
+            return;
+        this.autoReconnect = true;
+        this.scheduleReconnect();
+    }
     /**
      * Send a raw frame. If currently disconnected, the frame is queued and sent
      * after the next successful reconnect (up to `maxQueueSize`).
@@ -2412,6 +2495,7 @@ class WSTransport extends EventCore {
         this.reconnectAttempts++;
         this.emit(EventCoreEvents.RECONNECTING, { attempt: this.reconnectAttempts });
         this.reconnectTimeout = setTimeout(async () => {
+            this.reconnectTimeout = null;
             try {
                 await this.connect();
             }
@@ -2529,8 +2613,9 @@ class BroadcastChannel {
                 void this.announce();
             }
         });
-        this.transport.on(EventCoreEvents.DISCONNECTED, () => {
-            this.emit(BroadcastChannelEvents.DISCONNECTED);
+        // `detail` is the close `{code, reason}` when the socket reported one.
+        this.transport.on(EventCoreEvents.DISCONNECTED, (e) => {
+            this.emit(BroadcastChannelEvents.DISCONNECTED, e.detail);
         });
         this.transport.on(EventCoreEvents.RECONNECTING, (e) => {
             this.emit(BroadcastChannelEvents.RECONNECTING, e.detail);
@@ -2565,6 +2650,10 @@ class BroadcastChannel {
     disconnect() {
         this.transport.disconnect();
     }
+    /** Reconnect after a terminal close (see `terminalCloseCodes`) or `disconnect()`, on a fresh `urlProvider` URL. */
+    resume() {
+        this.transport.resume();
+    }
     /**
      * Send our `keyExchange` frame to the room. Idempotent — only sends on the
      * first call. Call this once your higher-level handshake (e.g. sending a
@@ -3424,6 +3513,79 @@ class DoubleRatchetManager {
     }
 }
 
+/**
+ * OPRF (Oblivious PRF) — RFC 9497, ristretto255-SHA512, mode 0x00.
+ *
+ * Used to gate the password/recovery factors of the identity vault
+ * ({@link ./vault}). The wrap key for a password factor is
+ * `HKDF(OPRF(serverKey, scrypt(password)))`, so:
+ *   - the client cannot derive the wrap key offline (it needs the server's
+ *     secret-keyed evaluation), and
+ *   - the server learns nothing — it only ever sees a *blinded* group element,
+ *     never the password or the resulting key.
+ *
+ * Net effect: a stolen vault blob is NOT offline-crackable; every guess costs a
+ * round-trip to a rate-limited server endpoint. The same OPRF backs the M2
+ * Google/email factors.
+ *
+ * Thin wrapper over `@noble/curves`' vetted `ristretto255_oprf` so the protocol
+ * (blind / blindEvaluate / finalize) lives in one named place. CLIENT uses
+ * {@link oprfBlind} + {@link oprfFinalize}.
+ *
+ * The `oprfDeriveKey` / `oprfBlindEvaluate` helpers here are the SERVER half,
+ * but note they are used only by this repo's tests. The accelerator does NOT
+ * import them: it has an independent implementation in its own
+ * `src/services/oprf.ts`, also built directly on `@noble/curves`. (An earlier
+ * version of this comment claimed the accelerator's VaultDO imported them; it
+ * does not — it imports `@muhkoo/connect` in exactly two files, both for
+ * Groth16 verification.) Any protocol change therefore has to land in BOTH
+ * repos in lockstep.
+ *
+ * KNOWN WEAKNESS — mode 0x00, tracked as audit finding C4 and NOT fixed here.
+ * This uses RFC 9497 base mode: the server returns a bare evaluation with no
+ * DLEQ proof, and {@link oprfFinalize} verifies nothing. A hostile server can
+ * answer `{evaluated: blinded}` (i.e. k=1); the unblinded point is then just
+ * `H(input)` and the wrap key collapses to a pure function of public strings,
+ * destroying the offline-uncrackability guarantee stated above.
+ *
+ * The fix is `ristretto255_oprf.voprf` (mode 0x01) with the server's public key
+ * pinned as a build-time constant and the proof verified on every finalize.
+ * noble's `voprf` variant is already present and unused. It cannot be done
+ * client-side alone: the wire response (`{evaluated}` / `{evaluated, evaluated2}`)
+ * carries no proof field, and the pinned public keys must correspond to the
+ * accelerator's actual K1/K2 secrets. Changing only this file would break login
+ * against the live server.
+ */
+const OPRF = ristretto255_oprf.oprf;
+// Domain separation for the server key derivation (RFC 9497 `info`).
+new TextEncoder().encode("muhkoo-oprf-v1");
+/**
+ * The RFC 9497 mode this client speaks, declared on every evaluation request.
+ *
+ * Declaring it is what lets the server refuse loudly instead of answering in a
+ * mode we did not ask for — the silent substitution that IS audit finding C4.
+ * A server too old to know the field drops it and answers in base mode, which is
+ * what we asked for anyway, so sending it is safe in both directions and imposes
+ * no deploy ordering.
+ *
+ * NOT to be confused with the vault's KEY VERSION, a different axis that also
+ * uses small integers: there, `2` means "per-account key". Here `2` means POPRF.
+ * The server half of these constants is `accelerator/src/services/oprf.ts` and
+ * MUST hold the same numbers.
+ */
+const OPRF_PROTOCOL_BASE = 0;
+/** What this SDK build actually speaks. Bumped to POPRF by the mode migration. */
+const OPRF_PROTOCOL = OPRF_PROTOCOL_BASE;
+/** CLIENT: blind `input` (e.g. `scrypt(password)`) before the server eval. */
+function oprfBlind(input) {
+    const { blind, blinded } = OPRF.blind(input);
+    return { blind, blinded };
+}
+/** CLIENT: fold the server's blinded evaluation into the final 64-byte OPRF output. */
+function oprfFinalize(input, blind, evaluated) {
+    return OPRF.finalize(input, blind, evaluated);
+}
+
 /**
  * HTTP client for the accelerator's `/api/auth/*` endpoints.
  *
@@ -3436,6 +3598,27 @@ class DoubleRatchetManager {
  * a `baseUrl`, optional custom `fetch`, throws typed `Error`s on failure
  * (with the worker's message inlined where available).
  */
+/**
+ * A non-2xx response from `/api/auth/*`, carrying the HTTP status and the
+ * worker's machine-readable `code` alongside its human `error` string.
+ *
+ * Exists because the status used to be discarded: every failure arrived as a
+ * bare `Error` whose only distinguishing feature was its message, so classifying
+ * one meant regex-matching a sentence the server is free to reword. See
+ * `VaultUnavailableError`, which still does exactly that for rate limits.
+ */
+class AuthHttpError extends Error {
+    label;
+    status;
+    code;
+    constructor(label, status, code, detail) {
+        super(`AuthClient.${label}: ${detail}`);
+        this.label = label;
+        this.status = status;
+        this.code = code;
+        this.name = "AuthHttpError";
+    }
+}
 class AuthClient {
     baseUrl;
     fetchFn;
@@ -3474,18 +3657,26 @@ class AuthClient {
         return await this.parse("verify", res);
     }
     // ---- Identity vault (M1.0) ----------------------------------------------
-    /** Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key. */
-    async oprfEvaluate(username, blinded) {
-        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded }));
+    /**
+     * Blinded OPRF evaluation — the server-gated half of a password/recovery wrap key.
+     *
+     * `oprfProtocol` declares the RFC 9497 mode this client speaks so the server
+     * can refuse rather than answer in a different one. A server too old to know
+     * the field drops it and answers in base mode, so this is safe against any
+     * deployment.
+     */
+    async oprfEvaluate(username, blinded, oprfProtocol = OPRF_PROTOCOL) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded, oprfProtocol }));
         return await this.parse("oprfEvaluate", res);
     }
     /**
-     * Gated split-key OPRF evaluation (M2 — email/google factors). Requires a
-     * live `verifyToken` from {@link emailOtpVerify}; returns BOTH trust
-     * domains' evaluations. The recover token is consumed by this call.
+     * Gated OPRF evaluation (M2 — email/google factors). Requires a live
+     * `verifyToken` from {@link emailOtpVerify}; returns BOTH keys'
+     * evaluations (K1 and K2, both operated by Muhkoo). The recover token is
+     * consumed by this call.
      */
-    async oprfEvaluateGated(username, blinded, factorType, purpose, verifyToken) {
-        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded, factorType, purpose, verifyToken }));
+    async oprfEvaluateGated(username, blinded, factorType, purpose, verifyToken, oprfProtocol = OPRF_PROTOCOL) {
+        const res = await this.fetchFn(`${this.baseUrl}/api/auth/oprf`, this.json("POST", { username, blinded, factorType, purpose, verifyToken, oprfProtocol }));
         return await this.parse("oprfEvaluateGated", res);
     }
     /**
@@ -3592,10 +3783,13 @@ class AuthClient {
             // Leave body null; we'll fall through to the status-only message.
         }
         if (!res.ok) {
-            const msg = body && typeof body === "object" && "error" in body
-                ? String(body.error)
-                : `${res.status} ${res.statusText}`;
-            throw new Error(`AuthClient.${label}: ${msg}`);
+            const obj = body && typeof body === "object" ? body : null;
+            const msg = obj && "error" in obj ? String(obj.error) : `${res.status} ${res.statusText}`;
+            // Throws `AuthHttpError` rather than `Error` so callers can classify
+            // by STATUS and CODE instead of regex-matching a human sentence.
+            // `VaultUnavailableError` still does the latter for rate limits; new
+            // code should not copy it — a server-side copy edit breaks it.
+            throw new AuthHttpError(label, res.status, obj && typeof obj.code === "string" ? obj.code : undefined, msg);
         }
         return body;
     }
@@ -6481,7 +6675,7 @@ async function parseOrThrow(response, op) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.14.0-alpha.9";
+const VERSION = "0.15.0-alpha.1";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -6597,6 +6791,24 @@ class HttpClient {
         const tag = `${init?.method ?? "GET"} ${reqPath(input)}`;
         return this.fetchFn(input, finalInit).then((res) => { console.info(`[muhkoo:http] ${tag} → ${res.status} ${Math.round(performance.now() - t)}ms`); return res; }, (err) => { console.info(`[muhkoo:http] ${tag} → ERROR ${Math.round(performance.now() - t)}ms`); throw err; });
     };
+    /**
+     * {@link fetch} with the JSON helpers' stale-session recovery: a 401 on a
+     * request made while a session token is held runs `onUnauthorized` once
+     * and, if that recovered, replays the request once with the fresh token.
+     * The final response is returned whatever its status, never thrown. The
+     * replay re-sends `init` as given, so its body must be re-sendable (a
+     * string or bytes, not a stream).
+     */
+    fetchWithRecovery = async (input, init) => {
+        const res = await this.fetch(input, init);
+        // `onUnauthorized` is consulted at most once per call, so a replay that
+        // still 401s (recovery minted a token the endpoint still rejects) can't loop.
+        if (res.status !== 401 || !this.onUnauthorized || !this.getSessionToken())
+            return res;
+        if (!(await this.onUnauthorized()))
+            return res;
+        return this.fetch(input, init);
+    };
     /** True when `input` resolves to {@link baseOrigin} (relative URLs always do). */
     isSameOrigin(input) {
         try {
@@ -6627,23 +6839,15 @@ class HttpClient {
     del(path, body) {
         return this.request("DELETE", path, body);
     }
-    async request(method, path, body, allowRecovery = true) {
+    async request(method, path, body) {
         const url = path.startsWith("http") ? path : `${this.baseUrl}${path.startsWith("/") ? "" : "/"}${path}`;
         const init = { method };
         if (body !== undefined) {
             init.headers = { "Content-Type": "application/json" };
             init.body = JSON.stringify(body);
         }
-        const res = await this.fetch(url, init);
-        // Stale session: try to silently re-auth and replay the request once.
-        // `allowRecovery` is cleared on the retry so a still-401 response (e.g.
-        // recovery minted a token the endpoint still rejects) can't loop.
-        if (res.status === 401 && allowRecovery && this.onUnauthorized && this.getSessionToken()) {
-            const recovered = await this.onUnauthorized();
-            if (recovered) {
-                return this.request(method, path, body, false);
-            }
-        }
+        // Stale session: silently re-auth and replay the request once.
+        const res = await this.fetchWithRecovery(url, init);
         let parsed = null;
         try {
             parsed = await res.json();
@@ -6861,69 +7065,19 @@ function mnemonicToSeed(mnemonic) {
 }
 
 /**
- * OPRF (Oblivious PRF) — RFC 9497, ristretto255-SHA512, mode 0x00.
- *
- * Used to gate the password/recovery factors of the identity vault
- * ({@link ./vault}). The wrap key for a password factor is
- * `HKDF(OPRF(serverKey, scrypt(password)))`, so:
- *   - the client cannot derive the wrap key offline (it needs the server's
- *     secret-keyed evaluation), and
- *   - the server learns nothing — it only ever sees a *blinded* group element,
- *     never the password or the resulting key.
- *
- * Net effect: a stolen vault blob is NOT offline-crackable; every guess costs a
- * round-trip to a rate-limited server endpoint. The same OPRF backs the M2
- * Google/email factors.
- *
- * Thin wrapper over `@noble/curves`' vetted `ristretto255_oprf` so the protocol
- * (blind / blindEvaluate / finalize) lives in one named place. CLIENT uses
- * {@link oprfBlind} + {@link oprfFinalize}.
- *
- * The `oprfDeriveKey` / `oprfBlindEvaluate` helpers here are the SERVER half,
- * but note they are used only by this repo's tests. The accelerator does NOT
- * import them: it has an independent implementation in its own
- * `src/services/oprf.ts`, also built directly on `@noble/curves`. (An earlier
- * version of this comment claimed the accelerator's VaultDO imported them; it
- * does not — it imports `@muhkoo/connect` in exactly two files, both for
- * Groth16 verification.) Any protocol change therefore has to land in BOTH
- * repos in lockstep.
- *
- * KNOWN WEAKNESS — mode 0x00, tracked as audit finding C4 and NOT fixed here.
- * This uses RFC 9497 base mode: the server returns a bare evaluation with no
- * DLEQ proof, and {@link oprfFinalize} verifies nothing. A hostile server can
- * answer `{evaluated: blinded}` (i.e. k=1); the unblinded point is then just
- * `H(input)` and the wrap key collapses to a pure function of public strings,
- * destroying the offline-uncrackability guarantee stated above.
- *
- * The fix is `ristretto255_oprf.voprf` (mode 0x01) with the server's public key
- * pinned as a build-time constant and the proof verified on every finalize.
- * noble's `voprf` variant is already present and unused. It cannot be done
- * client-side alone: the wire response (`{evaluated}` / `{evaluated, evaluated2}`)
- * carries no proof field, and the pinned public keys must correspond to the
- * accelerator's actual K1/K2 secrets. Changing only this file would break login
- * against the live server.
- */
-const OPRF = ristretto255_oprf.oprf;
-// Domain separation for the server key derivation (RFC 9497 `info`).
-new TextEncoder().encode("muhkoo-oprf-v1");
-/** CLIENT: blind `input` (e.g. `scrypt(password)`) before the server eval. */
-function oprfBlind(input) {
-    const { blind, blinded } = OPRF.blind(input);
-    return { blind, blinded };
-}
-/** CLIENT: fold the server's blinded evaluation into the final 64-byte OPRF output. */
-function oprfFinalize(input, blind, evaluated) {
-    return OPRF.finalize(input, blind, evaluated);
-}
-
-/**
- * Verification-gated vault factors (M2 — email, later Google).
+ * Verification-gated vault factors (M2 — email and Google).
  *
  * These factors have NO client-side secret: the user proves *channel control*
- * (an email OTP) and the server releases a split-key OPRF evaluation —
- * `wrapKey = HKDF( OPRF(K1, input) ‖ OPRF(K2, input) )` where K1 lives on the
- * accelerator and K2 in a separate trust domain, so no single server-side
- * compromise can derive the wrap key offline. See accelerator
+ * (an email OTP, or a verified Google ID token) and the server releases a
+ * two-key OPRF evaluation —
+ * `wrapKey = HKDF( OPRF(K1, input) ‖ OPRF(K2, input) )`. Both keys are
+ * operated by Muhkoo (K1 is the accelerator's `OPRF_KEY`), and the accelerator
+ * relays K2's evaluation to the client verbatim, which folds it in with no
+ * verification. So the fold protects a stolen vault blob against outside
+ * attackers only — not against the operator, and not against an accelerator
+ * compromise. Muhkoo can recover the seed of any account with a gated factor;
+ * the hosted sign-in UI discloses this, and custom enroll UIs must too. See
+ * `docs/superpowers/specs/2026-09-25-vault-poprf-design.md` §2.4, and accelerator
  * `AUTH_M2_PLAN.md` §1; the canonical reference implementation is
  * accelerator `tests/gated-oprf.test.ts` — keep these derivations in
  * byte-exact lockstep with it.
@@ -7001,6 +7155,14 @@ async function gatedWrapKey(input, blind, evaluatedB64, evaluated2B64) {
  * one-time key delivered in a URL fragment a TV can't receive).
  */
 const PKCE_STORE_KEY = "muhkoo.hosted.pkce";
+/**
+ * A same-origin path the app may be sent back to after sign-in. It starts with
+ * "/", not "//", and has no backslash or control characters (design §4.4.9).
+ */
+function isSameOriginPath(p) {
+    return typeof p === "string" && p.startsWith("/") && !p.startsWith("//") && !p.includes("\\")
+        && ![...p].some((c) => c.charCodeAt(0) < 0x20);
+}
 // ---- device pairing: constants (tv-device-pairing-spec.md §4.5, §9) --------
 /** RFC-8628-style backoff step applied on every `slow_down` (spec §9.1). */
 const SLOW_DOWN_STEP_S = 5;
@@ -7084,12 +7246,15 @@ class HostedAuth {
      * (App side) Begin hosted login: stash a PKCE verifier + state, then send
      * the browser to the hosted authorize page. Returns the URL it redirects to
      * (also useful for popup mode / tests). `redirectUri` must be registered for
-     * the app in the portal.
+     * the app in the portal. `returnTo`, a same-origin path, rides the stash and
+     * comes back from {@link handleCallback}; anything else is refused here.
      */
     async login(opts) {
+        if (opts.returnTo !== undefined && !isSameOriginPath(opts.returnTo))
+            throw new Error('returnTo must be a same-origin path (start with "/", not "//").');
         const { codeVerifier, codeChallenge } = await generatePkce();
         const state = randomState();
-        this.store({ codeVerifier, state, appId: opts.appId, redirectUri: opts.redirectUri });
+        this.store({ codeVerifier, state, appId: opts.appId, redirectUri: opts.redirectUri, ...(opts.returnTo ? { returnTo: opts.returnTo } : {}) });
         const params = {
             app_id: opts.appId,
             redirect_uri: opts.redirectUri,
@@ -7135,7 +7300,8 @@ class HostedAuth {
     /**
      * (App side) Complete login on the callback URL: verify state, exchange the
      * code (+ PKCE verifier) for the session, unseal the seed from the fragment,
-     * establish the session, and scrub the URL. Returns the signed-in user.
+     * establish the session, and scrub the URL. Returns the signed-in user, with
+     * the `returnTo` passed to {@link login} when it is still a same-origin path.
      */
     async handleCallback() {
         const loc = this.location();
@@ -7157,7 +7323,8 @@ class HostedAuth {
         this.deps.session.setIdentity(identity);
         this.deps.session.setSeed(seed);
         this.scrubUrl();
-        return { username: res.username, commitment: res.commitment };
+        const returnTo = isSameOriginPath(stash.returnTo) ? stash.returnTo : undefined;
+        return { username: res.username, commitment: res.commitment, ...(returnTo ? { returnTo } : {}) };
     }
     /**
      * (Hosted-page side) Finish an /authorize request after the user has
@@ -7902,6 +8069,34 @@ class VaultUnavailableError extends Error {
         this.cause = cause;
     }
 }
+/**
+ * The vault refused the OPRF protocol this client speaks.
+ *
+ * Distinct from {@link VaultUnavailableError} because the remedy is different and
+ * the two used to be conflated: "unavailable" means retry, and a version mismatch
+ * never resolves by retrying — it resolves by updating the app (or the server).
+ *
+ * Critically, this must NOT be caught into the
+ * `vaultSeed ?? deriveMasterSeedFromPassword(...)` fallback in `login`/`unlock`.
+ * That fallback is correct for an account with no password factor, and wrong for
+ * a refusal: it derives a different seed, and on a legacy-migrated account —
+ * where the fallback seed happens to be the right one — it would let
+ * `migrateLegacyPasswordFactor` rewrite the factor as a side effect of a failure
+ * the user was never shown.
+ */
+class VaultProtocolMismatchError extends Error {
+    constructor(cause) {
+        super("This app version can't talk to the secure vault. Update the app and try again.");
+        this.name = "VaultProtocolMismatchError";
+        this.cause = cause;
+    }
+}
+/** Is `e` the vault refusing our OPRF protocol (HTTP 409)? */
+function isProtocolRefusal(e) {
+    // Classified by STATUS and CODE, never by matching the server's prose.
+    const err = e;
+    return !!err && err.status === 409 && err.code === "oprf_protocol_unsupported";
+}
 /**
  * A stored device pairing that the account has since revoked.
  *
@@ -7996,7 +8191,13 @@ class ZkAuth {
         try {
             await this.enrollPasswordFactor(username, password, seed, token);
         }
-        catch {
+        catch (e) {
+            // "Best effort" is right for a transient failure — we retry next
+            // login. It is wrong for a protocol refusal: that will fail every
+            // time, and swallowing it means the user is told nothing while the
+            // account quietly never gets its factor. Surface that one.
+            if (e instanceof VaultProtocolMismatchError)
+                throw e;
             /* migrate next time */
         }
     }
@@ -8194,15 +8395,16 @@ class ZkAuth {
     }
     /**
      * Add an **email** as a recovery + login factor (M2 verification-gated:
-     * the server only releases the split-key OPRF eval after the address is
+     * the server only releases the gated OPRF eval after the address is
      * OTP-verified). Sends the code, then returns a `confirm` continuation:
      *
      *   const { confirm } = await client.auth.zk.enrollEmailFactor("me@x.com");
      *   await confirm(codeFromInbox);
      *
      * Requires being signed in with the seed held (like the other enrolls).
-     * Custody note: gated factors trade some custody for recoverability — the
-     * trade-off should be disclosed in the enroll UI.
+     * Custody note: Muhkoo holds the keys behind gated factors, so it can
+     * recover the seed of any account with an email or Google factor. The
+     * hosted sign-in UI discloses this; a custom enroll UI must too.
      */
     async enrollEmailFactor(email) {
         const seed = this.deps.session.seed;
@@ -8228,7 +8430,7 @@ class ZkAuth {
     /**
      * Recover an account via its enrolled **email** factor. Sends a code to the
      * enrolled address (the response never reveals whether one exists), then
-     * `confirm(code)` completes: gated read + split-key eval → unwrap seed →
+     * `confirm(code)` completes: gated read + gated OPRF eval → unwrap seed →
      * normal ZK login. After this, call {@link changePassword} to set a new
      * password.
      *
@@ -8258,12 +8460,15 @@ class ZkAuth {
     }
     // --- Google factor (M2.3) ------------------------------------------------
     // Google is pure authentication UX: its verified ID token gates the
-    // split-key OPRF eval that releases the master seed. The ZK identity layer
+    // OPRF eval that releases the master seed. The ZK identity layer
     // is unchanged. The app obtains `idToken` via Google Identity Services and
     // passes it in; the SDK never renders Google UI.
     /**
      * Link a Google account as a recovery + login factor. Requires being signed
      * in with the seed held. `idToken` is a fresh Google ID token (GIS).
+     * Custody note: as with {@link enrollEmailFactor}, Muhkoo holds the keys
+     * behind this factor and can recover the seed of an account that has it.
+     * The hosted sign-in UI discloses this; a custom enroll UI must too.
      */
     async enrollGoogleFactor(idToken) {
         const seed = this.deps.session.seed;
@@ -8281,7 +8486,7 @@ class ZkAuth {
     }
     /**
      * Sign in with Google — verify the ID token, unlock the seed via the gated
-     * split-key eval, and establish a session. Same machinery serves "Sign in
+     * OPRF eval, and establish a session. Same machinery serves "Sign in
      * with Google" and "recover with Google"; the account must have linked the
      * factor first.
      */
@@ -8304,7 +8509,8 @@ class ZkAuth {
      * Register a brand-new, **passwordless** account whose only factor is Google.
      * A random master seed is generated and wrapped under the Google-gated key;
      * the user can add a password / passkey / phrase later. The ZK registration
-     * is identical to a password signup.
+     * is identical to a password signup. Custody note: see
+     * {@link enrollGoogleFactor} — Muhkoo can recover this account's seed.
      */
     async registerWithGoogle(username, idToken) {
         const seed = randomSeed();
@@ -8631,7 +8837,16 @@ class ZkAuth {
     async passwordWrapKey(username, password) {
         const pre = passwordPreHash(username, password);
         const { blind, blinded } = oprfBlind(pre);
-        const { evaluated } = await this.deps.auth.oprfEvaluate(username, toBase64$1(blinded));
+        const { evaluated } = await this.deps.auth
+            .oprfEvaluate(username, toBase64$1(blinded), OPRF_PROTOCOL)
+            .catch((e) => {
+            // Raised here, at the one place that knows the call was an OPRF
+            // evaluation, so every caller up the stack sees the typed error
+            // rather than a generic transport failure.
+            if (isProtocolRefusal(e))
+                throw new VaultProtocolMismatchError(e);
+            throw e;
+        });
         return wrapKeyFromOprf(oprfFinalize(pre, blind, fromBase64$1(evaluated)));
     }
     /**
@@ -8655,7 +8870,14 @@ class ZkAuth {
             return null; // genuinely no factor → legacy account
         const key = await this
             .passwordWrapKey(username, password)
-            .catch((e) => { throw new VaultUnavailableError(e); }); // OPRF eval unreachable / rate-limited
+            .catch((e) => {
+            // A protocol refusal passes through UNCHANGED. Wrapping it here
+            // would erase the type one line after it was raised, and tell the
+            // user to check their connection about a version mismatch.
+            if (e instanceof VaultProtocolMismatchError)
+                throw e;
+            throw new VaultUnavailableError(e); // OPRF eval unreachable / rate-limited
+        });
         try {
             return await unwrapSeed({ iv: factor.iv, ct: factor.wrap }, key);
         }
@@ -9530,81 +9752,759 @@ class SpacePacketCipher {
 }
 
 /**
- * `Space` — a client handle for one shared space.
- *
- * A space is the unit everything is built on. It carries:
- *   - **realtime transport** over a {@link BroadcastChannel} (group handshake,
- *     roster frames, raw-frame passthrough);
- *   - **fan-out group messaging** — `Message`s sealed once with the space's
- *     group key (via {@link SpacePacketCipher}), wrapped in a cleartext
- *     {@link Packet} envelope, broadcast AND persisted by the server as
- *     history (the `spaceMessage` frame);
- *   - **room-scoped file storage** via {@link FileStorage} over the shard
- *     endpoint;
- *   - **legacy per-peer Double Ratchet messaging** (`send`/`announce`) for the
- *     ephemeral, no-history path — unchanged so existing callers (the chat hook
- *     reached via `client.message.room(name)`) keep working.
- *
- * `Space` was formerly `Room`; `Room` remains exported as an alias. The
- * fan-out methods (`sendMessage`/`onMessage`/`history`/`join`/`admit`/`rotate`)
- * require a {@link SpaceKeyring} dep; without one only the transport + DR +
- * file surface is available.
+ * Trust-layer errors shared by Spaces and, later, DMs (design §3.3, §6.9;
+ * SpecA §6.6). Class names are public API and are frozen at their first
+ * release (design Q16).
  */
-class Space {
-    deps;
-    name;
-    historyPolicy;
-    channel = null;
-    pending = [];
-    cipher;
-    /** Per-instance event bus for fan-out events (isolated across spaces). */
-    events = new EventTarget();
-    rawWired = false;
-    catchUpUnsub = null;
-    /** Optional P2P swarm for this Space (block exchange among members). */
-    peerNet = null;
-    constructor(deps) {
-        this.deps = deps;
-        this.name = deps.name;
-        this.historyPolicy = deps.historyPolicy ?? "static";
-        this.cipher = deps.keyring ? new SpacePacketCipher(deps.keyring) : null;
+/** The session holds no seed, so it has no stable identity and may not take part (design §3.3, T7). */
+class IdentityLockedError extends Error {
+    code = "identity-locked";
+    constructor(message = "This session is locked. Sign in again (or call client.auth.zk.unlock(password)) to use encrypted spaces. " +
+        "Earlier SDK versions silently used a temporary key here, which hid your earlier messages from other members.") {
+        super(message);
+        this.name = "IdentityLockedError";
     }
-    /** The encoded space id (same as the transport name for fan-out spaces). */
-    get id() {
-        return this.name;
+}
+/**
+ * The stable chat keys could not be loaded (design §3.3). `retryable` says
+ * whether the same call can succeed later. It is true when the vault could not
+ * be reached or written (a 5xx or a network error on `chat-keys`), which the
+ * next open retries (§9.2 I8). It is false when the saved keys were read but do
+ * not unwrap under this session's seed, because they are damaged or were saved
+ * under another seed, and when the client has no vault: retrying fails the same way.
+ */
+class IdentityUnavailableError extends Error {
+    reason;
+    retryable;
+    code = "identity-unavailable";
+    constructor(message = "Your chat keys could not be loaded right now. Try again.", reason, retryable = true) {
+        super(message);
+        this.reason = reason;
+        this.retryable = retryable;
+        this.name = "IdentityUnavailableError";
     }
-    /** The keyring backing this space's group keys, if any. */
-    get keyring() {
-        return this.deps.keyring;
+}
+/** A membership-log or pin failure. `detail` carries server fields (`reason`, `head`, ...). */
+class SpaceTrustError extends Error {
+    code;
+    detail;
+    constructor(code, message, detail) {
+        super(message ?? code);
+        this.code = code;
+        this.detail = detail;
+        this.name = "SpaceTrustError";
     }
-    // -- transport -------------------------------------------------------------
-    /** Open the space websocket (resolves the ticket + identity lazily). */
-    async connect() {
-        if (!this.channel) {
-            // The WS upgrade ticket is single-use + short-TTL, so a reconnect
-            // must mint a FRESH one — otherwise the socket drops (idle timeout,
-            // network blip) and never comes back. `buildUrl` is handed to the
-            // transport as a `urlProvider` it calls before each reconnect.
-            const buildUrl = async () => {
-                const ticket = await this.deps.fetchTicket();
-                return (`${this.deps.wsBaseUrl}/api/spaces/${encodeURIComponent(this.name)}/websocket` +
-                    (ticket ? `?ticket=${encodeURIComponent(ticket)}` : ""));
-            };
-            const url = await buildUrl();
-            this.channel = this.deps.createChannel
-                ? this.deps.createChannel(url, this.deps.myId())
-                : new BroadcastChannel({
-                    url,
-                    myId: this.deps.myId(),
-                    autoAnnounce: false,
-                    urlProvider: buildUrl,
-                    // Keep recovering across network flaps (each attempt mints a
-                    // fresh ticket); teardown calls disconnect() which stops it.
-                    maxReconnectAttempts: 0,
+}
+/** This user may not open this Space (design §4.5.12, V25). */
+class AdmissionDeniedError extends Error {
+    code;
+    constructor(code, message) {
+        super(message ?? code);
+        this.code = code;
+        this.name = "AdmissionDeniedError";
+    }
+}
+
+/**
+ * Length-prefixed encoding (SpecA §3.1), the primitive every signed byte string
+ * in `src/spaces/trust` is built from:
+ *
+ *   LP(x) := uint32be(len(x)) ‖ x
+ *
+ * Usernames carry no charset rule, so bare concatenation would not be
+ * injective; every variable field is length-prefixed. A string goes in as the
+ * UTF-8 of the exact transmitted string, never a re-encoding of it.
+ *
+ * Ported unchanged from the accelerator's `src/trust/lp.ts`; the two must stay
+ * byte-identical (`tests/fixtures/mlog-v1.json` pins both).
+ */
+/** uint32be(len) ‖ bytes */
+function lp(bytes) {
+    if (bytes.length > 0xffffffff)
+        throw new Error("lp: field too long");
+    const out = new Uint8Array(4 + bytes.length);
+    new DataView(out.buffer).setUint32(0, bytes.length, false);
+    out.set(bytes, 4);
+    return out;
+}
+/** lp(utf8(s)) */
+function lpStr(s) {
+    return lp(utf8Encode(s));
+}
+/**
+ * Canonical decimal of a safe integer: `String(n)`, so "-1", "0", "42" (and
+ * -0 is "0"). Throws on a float, NaN, an infinity or an unsafe integer, so no
+ * such value can ever reach a signature.
+ */
+function dec(n) {
+    if (!Number.isSafeInteger(n))
+        throw new Error("dec: not a safe integer");
+    return String(n);
+}
+function concatBytes(...parts) {
+    let length = 0;
+    for (const p of parts)
+        length += p.length;
+    const out = new Uint8Array(length);
+    let offset = 0;
+    for (const p of parts) {
+        out.set(p, offset);
+        offset += p.length;
+    }
+    return out;
+}
+
+/**
+ * The canonical byte strings of the e2e-channels trust layer (spec §6.10).
+ * Every signature and every hash is computed over these bytes, and the
+ * accelerator builds the same bytes; `tests/fixtures/mlog-v1.json` pins both
+ * sides.
+ *
+ * Rules:
+ *   - every field is `LP`'d (`lp.ts`); strings as the UTF-8 of the exact
+ *     transmitted string (an `ik` is never normalised before signing);
+ *   - integers go through `dec`, so "-1" is valid (the enable intent's seq);
+ *   - a hash is never over signature bytes: ECDSA is malleable.
+ *
+ * Changing any byte here breaks every stored log. It is a new label, not an edit.
+ *
+ * Ported unchanged from the accelerator's `src/trust/canonical.ts` (the
+ * server-only app roster encoder is left out). No npm dependencies (§6.9).
+ */
+const LABEL_CHATKEY = "muhkoo-chatkey-v1";
+const LABEL_MLOG = "muhkoo-mlog-v1";
+const LABEL_EPOCH_COMMIT = "muhkoo-epoch-commit-v1";
+const CANONICAL_DEC = /^(0|[1-9]\d*)$/;
+/** LP(LABEL_CHATKEY) ‖ LP(lower(memberId)) ‖ LP(ik) ‖ LP(ecdh) ‖ LP(ecdsa) */
+function certBytes(memberId, cert) {
+    return concatBytes(lpStr(LABEL_CHATKEY), lpStr(memberId.toLowerCase()), lpStr(cert.ik), lpStr(cert.ecdh), lpStr(cert.ecdsa));
+}
+/**
+ * Over the integer keys in ascending numeric order: LP(dec(e)) ‖ LP(value).
+ * `{}` gives no bytes. Throws on a key that is not a canonical decimal
+ * ("01", "-1", "1.0") or a value that is not a string.
+ */
+function epochMapBytes(map) {
+    const epochs = [];
+    for (const key of Object.keys(map)) {
+        if (!CANONICAL_DEC.test(key))
+            throw new Error("epochMapBytes: key is not a canonical decimal");
+        const e = Number(key);
+        if (!Number.isSafeInteger(e))
+            throw new Error("epochMapBytes: key is not a safe integer");
+        if (typeof map[key] !== "string")
+            throw new Error("epochMapBytes: value is not a string");
+        epochs.push(e);
+    }
+    epochs.sort((a, b) => a - b);
+    return concatBytes(...epochs.map((e) => concatBytes(lpStr(dec(e)), lpStr(map[dec(e)]))));
+}
+/** The per-op concatenated LPs of §3.5. `leave` has none. */
+function opBytes(entry) {
+    switch (entry.op) {
+        case "genesis": {
+            const b = entry.body;
+            return concatBytes(lpStr(b.visibility), lpStr(b.policy), lpStr(b.appId), lpStr(dec(b.baseEpoch)), lp(epochMapBytes(b.legacyCommits)));
+        }
+        case "add":
+            return concatBytes(lpStr(entry.body.member), lpStr(entry.body.memberIk), lpStr(entry.body.role));
+        case "role":
+            return concatBytes(lpStr(entry.body.member), lpStr(entry.body.role));
+        case "remove":
+            return lpStr(entry.body.member);
+        case "leave":
+            return new Uint8Array(0);
+        case "join":
+            return lpStr(entry.body.via);
+        case "link": {
+            const b = entry.body;
+            return concatBytes(lpStr(b.linkId), lpStr(b.role), lpStr(b.standing ? "1" : "0"), lpStr(dec(b.expiresAt)), lpStr(dec(b.maxUses)), lpStr(b.linkEcdhPub), lpStr(b.linkSignPub), lp(epochMapBytes(b.keyCommits)));
+        }
+        case "unlink":
+            return lpStr(entry.body.linkId);
+        case "redeem":
+            return lpStr(entry.body.linkId);
+        case "svc": {
+            const b = entry.body;
+            return concatBytes(lpStr(b.member), lpStr(b.action), lpStr(b.ecdhPub), lpStr(b.ecdsaPub), lpStr(b.mode), lpStr(dec(b.rosterSeq)));
+        }
+        case "retire":
+            return concatBytes(lpStr(entry.body.member), lpStr(entry.body.reason));
+        default: {
+            const unknownOp = entry;
+            throw new Error(`opBytes: unknown op ${String(unknownOp.op)}`);
+        }
+    }
+}
+/** LP(LABEL_MLOG) ‖ LP(spaceId) ‖ LP(dec(seq)) ‖ LP(prev) ‖ LP(op) ‖ LP(by) ‖ LP(ik) ‖ LP(dec(at)) ‖ LP(opBytes). seq −1 is valid (enable intent). */
+function entryBytes(entry) {
+    return concatBytes(lpStr(LABEL_MLOG), lpStr(entry.spaceId), lpStr(dec(entry.seq)), lpStr(entry.prev), lpStr(entry.op), lpStr(entry.by), lpStr(entry.ik), lpStr(dec(entry.at)), lp(opBytes(entry)));
+}
+/** SHA-256 over bytes (WebCrypto). */
+async function sha256(bytes) {
+    return new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+}
+/** b64 (standard, padded) of SHA-256(entryBytes). Never over `sig` or `lsig`. */
+async function entryHash(entry) {
+    return toBase64$2(await sha256(entryBytes(entry)));
+}
+/** LP(LABEL_EPOCH_COMMIT) ‖ LP(spaceId) ‖ LP(dec(epoch)) ‖ LP(dec(prevKeyed)) ‖ LP(keyCommit) ‖ LP(dec(headSeq)) ‖ LP(headHash) ‖ LP(sole?"1":"0") ‖ LP(by) ‖ LP(ik) ‖ LP(dec(at)) */
+function ecBytes(ec) {
+    return concatBytes(lpStr(LABEL_EPOCH_COMMIT), lpStr(ec.spaceId), lpStr(dec(ec.epoch)), lpStr(dec(ec.prevKeyed)), lpStr(ec.keyCommit), lpStr(dec(ec.headSeq)), lpStr(ec.headHash), lpStr("1" ), lpStr(ec.by), lpStr(ec.ik), lpStr(dec(ec.at)));
+}
+/**
+ * keyCommit(e, K) := b64url_nopad(HKDF-SHA256(ikm = K, salt = utf8("epoch:" + e),
+ * info = utf8("muhkoo/space/key-commit/v1\n" + spaceId), L = 32)) (design §4.2.4).
+ * The same function as accelerator/scripts/gen-mlog-fixture.mjs `keyCommit`.
+ */
+async function keyCommit(epoch, key, spaceId) {
+    const ikm = await crypto.subtle.importKey("raw", key, "HKDF", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: utf8Encode(`epoch:${dec(epoch)}`),
+        info: utf8Encode(`muhkoo/space/key-commit/v1\n${spaceId}`),
+    }, ikm, 256);
+    return toBase64Url(new Uint8Array(bits));
+}
+
+/**
+ * Identity keys (IK): an account's P-256 ECDSA public key, raw uncompressed
+ * SEC1 (`0x04 ‖ X ‖ Y`, 65 bytes), registered once with the account.
+ *
+ * Stored IKs come in two spellings. Newer clients register base64
+ * (`exportPublicKeyBase64`); older registrations stored 130-char hex. The
+ * decode rule is the accelerator's: 130 hex digits (either case, optional
+ * `0x`) first, otherwise base64.
+ *
+ * Two IKs are compared as decoded bytes, never as strings: a hex-registered
+ * account and a base64 log entry name the same key.
+ *
+ * Verification is P-256 ECDSA with SHA-256 over IEEE P1363 (r ‖ s, 64 bytes)
+ * signatures in standard or url base64. It fails closed and never throws: a
+ * bad key, a bad signature, or a value with no canonical encoding is simply
+ * "not validly signed". Nothing here logs; a refusal is the caller's to report.
+ *
+ * Ported unchanged from the accelerator's `src/lib/ik.ts` and the primitives of
+ * `src/trust/verify.ts`. No npm dependencies (§6.9).
+ */
+/** Raw uncompressed P-256 point length. */
+const RAW_P256_BYTES = 65;
+/** The longest accepted spelling: `0x` + 130 hex. A base64 IK is 88 chars. */
+const MAX_IK_CHARS = 132;
+const HEX_IK = /^[0-9a-fA-F]{130}$/;
+/** Standard or url alphabet, optional trailing padding. No whitespace: `atob` would skip it. */
+const B64_CHARS = /^[A-Za-z0-9+/_-]+={0,2}$/;
+const P256 = { name: "ECDSA", namedCurve: "P-256" };
+const ECDSA_SHA256 = { name: "ECDSA", hash: "SHA-256" };
+const P1363_P256_BYTES = 64;
+/** 64 bytes is 88 base64 chars; anything much longer is not a signature. */
+const MAX_SIG_CHARS = 128;
+/**
+ * Raw uncompressed P-256 point (0x04‖X‖Y, 65 bytes) from 130-hex (optional 0x,
+ * either case) or base64 (standard or url alphabet, padded or not). `null` if
+ * malformed, the wrong length, or not 0x04-prefixed. It does not check that
+ * the point is on the curve; `importIk` (below) does.
+ */
+function decodeRawP256(s) {
+    if (typeof s !== "string" || s.length === 0 || s.length > MAX_IK_CHARS)
+        return null;
+    const hex = s.startsWith("0x") ? s.slice(2) : s;
+    let raw;
+    if (HEX_IK.test(hex)) {
+        raw = new Uint8Array(RAW_P256_BYTES);
+        for (let i = 0; i < RAW_P256_BYTES; i++)
+            raw[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    else {
+        if (!B64_CHARS.test(s))
+            return null;
+        try {
+            raw = fromBase64Url(s);
+        }
+        catch {
+            // Malformed base64 is not a key; null is the "invalid" answer.
+            return null;
+        }
+    }
+    if (raw.length !== RAW_P256_BYTES || raw[0] !== 0x04)
+        return null;
+    return raw;
+}
+/** Byte equality of two IK encodings; false if either does not decode. */
+function ikEquals(a, b) {
+    const x = decodeRawP256(a);
+    const y = decodeRawP256(b);
+    if (!x || !y)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < RAW_P256_BYTES; i++)
+        diff |= x[i] ^ y[i];
+    return diff === 0;
+}
+/** `null` if `ik` does not decode, or is not a point on P-256. */
+async function importIk(ik) {
+    const raw = decodeRawP256(ik);
+    if (!raw)
+        return null;
+    try {
+        return await crypto.subtle.importKey("raw", raw, P256, false, ["verify"]);
+    }
+    catch {
+        // Not on the curve: not an identity key.
+        return null;
+    }
+}
+/** `sig`: 64-byte P1363, standard or url base64. Never throws. */
+async function verifyP256(ik, sigB64, data) {
+    if (typeof sigB64 !== "string" || sigB64 === "" || sigB64.length > MAX_SIG_CHARS)
+        return false;
+    let sig;
+    try {
+        sig = fromBase64Url(sigB64);
+    }
+    catch {
+        return false;
+    }
+    if (sig.length !== P1363_P256_BYTES)
+        return false;
+    const key = await importIk(ik);
+    if (!key)
+        return false;
+    try {
+        return await crypto.subtle.verify(ECDSA_SHA256, key, sig, data);
+    }
+    catch {
+        return false;
+    }
+}
+/** fp(IK) = b64(SHA-256(raw 65 bytes)) (design §3.2). Throws if `ik` is not a P-256 point. */
+async function fingerprint$1(ik) {
+    const raw = decodeRawP256(ik);
+    if (!raw)
+        throw new Error("fingerprint: not a P-256 identity key");
+    return toBase64$2(new Uint8Array(await crypto.subtle.digest("SHA-256", raw)));
+}
+
+/**
+ * KeyringClient — HTTP implementation of {@link KeyringTransport} against the
+ * accelerator's per-space keyring endpoints. All blobs are opaque to the
+ * server; this client just moves them.
+ *
+ *   POST /api/spaces/:id/keyring/join-request   { ...JoinRequest }
+ *   GET  /api/spaces/:id/keyring/blobs/:member  -> WrappedKey[]
+ *   POST /api/spaces/:id/keyring/wrap           { targetMemberId, fromMemberId, wrapped }
+ *   GET  /api/spaces/:id/keyring/pending        -> JoinRequest[]
+ *   GET  /api/spaces/:id/keyring/roster         -> { memberId, identityEcdhPub }[]
+ *   POST /api/spaces/:id/keyring/rotate         { nextEpoch } -> { epoch }
+ *   GET  /api/spaces/:id/keyring/log            ?since&limit -> { entries, head }
+ *   POST /api/spaces/:id/keyring/log            { entry, ec? } -> { ok, head }
+ *   GET  /api/spaces/:id/keyring/state          (status only)
+ *   GET  /api/spaces/:id/metadata               -> SpaceMetadata
+ */
+/** A keyring route answered non-2xx; status and JSON body preserved (the existing methods keep their plain Errors). */
+class KeyringHttpError extends Error {
+    status;
+    body;
+    constructor(status, body, route) {
+        super(`KeyringClient ${route}: ${status}${body && typeof body.error === "string" ? ` ${body.error}` : ""}`);
+        this.status = status;
+        this.body = body;
+        this.name = "KeyringHttpError";
+    }
+}
+class KeyringClient {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    url(suffix) {
+        return `${this.deps.httpBaseUrl}/api/spaces/${encodeURIComponent(this.deps.spaceId)}${suffix}`;
+    }
+    async post(suffix, body) {
+        const res = await this.deps.fetch(this.url(suffix), {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok)
+            throw new Error(`KeyringClient POST ${suffix}: ${res.status} ${res.statusText}`);
+        return (await res.json().catch(() => ({})));
+    }
+    async get(suffix) {
+        const res = await this.deps.fetch(this.url(suffix));
+        if (!res.ok)
+            throw new Error(`KeyringClient GET ${suffix}: ${res.status} ${res.statusText}`);
+        return (await res.json());
+    }
+    /**
+     * The log routes. Sent through `fetchWithRecovery` when given, as `probeState` is, so a stale session is
+     * re-established before a 401 reads as locked (design §6.9): a GET replays safely, and a POST body is a string.
+     */
+    async request(method, suffix, body) {
+        const res = await (this.deps.fetchWithRecovery ?? this.deps.fetch)(this.url(suffix), method === "POST"
+            ? { method, headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) }
+            : undefined);
+        const text = await res.text();
+        let json = null;
+        try {
+            json = text ? JSON.parse(text) : null;
+        }
+        catch {
+            json = null;
+        }
+        if (!res.ok)
+            throw new KeyringHttpError(res.status, json, `${method} ${suffix.split("?")[0]}`);
+        return json;
+    }
+    /** GET /keyring/log (design §3.6): entries with seq > since, ascending, ≤ limit; head null = no log. */
+    async fetchLog(since = -1, limit = 500) {
+        return this.request("GET", `/keyring/log?since=${since}&limit=${limit}`);
+    }
+    /** POST /keyring/log {entry, ec?} → {ok, head}; `409 {error:"Log moved", head}` (no code) on a compare-and-set miss. */
+    async postLogEntry(entry, ec) {
+        return this.request("POST", "/keyring/log", ec ? { entry, ec } : { entry });
+    }
+    /**
+     * Status of GET /keyring/state, or "network" when the request fails: 403 is not-member, 401 is locked,
+     * anything else resumes (design §6.9). Sent through `fetchWithRecovery` when given, so a stale session
+     * is re-established before a 401 is believed.
+     */
+    async probeState() {
+        try {
+            const res = await (this.deps.fetchWithRecovery ?? this.deps.fetch)(this.url("/keyring/state"));
+            try {
+                await res.text();
+            }
+            catch { /* ignore */ }
+            return res.status;
+        }
+        catch {
+            return "network";
+        }
+    }
+    async postJoinRequest(req) {
+        await this.post("/keyring/join-request", req);
+    }
+    async fetchBlobs(memberId) {
+        const body = await this.get(`/keyring/blobs/${encodeURIComponent(memberId)}`);
+        return body.blobs ?? [];
+    }
+    async postWrappedKey(targetMemberId, wrapped, fromMemberId) {
+        await this.post("/keyring/wrap", { targetMemberId, fromMemberId, wrapped });
+    }
+    async fetchPending() {
+        const body = await this.get("/keyring/pending");
+        return body.pending ?? [];
+    }
+    async fetchRoster() {
+        const body = await this.get("/keyring/roster");
+        return body.roster ?? [];
+    }
+    async rotate(nextEpoch) {
+        return this.post("/keyring/rotate", { nextEpoch });
+    }
+    async invite(username) {
+        await this.post("/keyring/invite", { username });
+    }
+    // -- Shareable invite links ----------------------------------------------
+    // A capability token tied to this space. Redeeming it allowlists the holder
+    // so the keeper admits them — the link IS the invitation. Mint/list/revoke
+    // require the caller to be the creator or an existing member.
+    async createInviteLink(opts = {}) {
+        return this.post("/keyring/link", opts);
+    }
+    async listInviteLinks() {
+        const body = await this.get("/keyring/links");
+        return body.links ?? [];
+    }
+    /** Set a member's role ("viewer" | "editor"). Owner-only on the server. */
+    async setMemberRole(username, role) {
+        await this.post("/keyring/role", { username, role });
+    }
+    /** Roster with roles (owner/members only). */
+    async members() {
+        const body = await this.get("/keyring/members");
+        return body.members ?? [];
+    }
+    async revokeInviteLink(token) {
+        await this.post("/keyring/link-revoke", { token });
+    }
+    /** Redeem a link: the server allowlists this member and asks the keeper to
+     *  wrap the group key for their identity. Caller must be authenticated. */
+    async redeemInvite(req) {
+        await this.post("/keyring/redeem", req);
+    }
+    async fetchMetadata() {
+        try {
+            return await this.get("/metadata");
+        }
+        catch {
+            return null;
+        }
+    }
+}
+
+/**
+ * `Space` — a client handle for one shared space.
+ *
+ * A space is the unit everything is built on. It carries:
+ *   - **realtime transport** over a {@link BroadcastChannel} (group handshake,
+ *     roster frames, raw-frame passthrough);
+ *   - **fan-out group messaging** — `Message`s sealed once with the space's
+ *     group key (via {@link SpacePacketCipher}), wrapped in a cleartext
+ *     {@link Packet} envelope, broadcast AND persisted by the server as
+ *     history (the `spaceMessage` frame);
+ *   - **room-scoped file storage** via {@link FileStorage} over the shard
+ *     endpoint;
+ *   - **legacy per-peer Double Ratchet messaging** (`send`/`announce`) for the
+ *     ephemeral, no-history path — unchanged so existing callers (the chat hook
+ *     reached via `client.message.room(name)`) keep working.
+ *
+ * `Space` was formerly `Room`; `Room` remains exported as an alias. The
+ * fan-out methods (`sendMessage`/`onMessage`/`history`/`join`/`admit`/`rotate`)
+ * require a {@link SpaceKeyring} dep; without one only the transport + DR +
+ * file surface is available.
+ */
+/** WebSocket close code for a refused private-Space socket (design §3.6; accelerator NOT_MEMBER_CLOSE_CODE). */
+const NOT_MEMBER_CLOSE_CODE = 4403;
+/** At most one resume after a 4403 per Space per this interval (design §6.7). */
+const NOT_MEMBER_RECHECK_MS = 60_000;
+const NOT_MEMBER_MESSAGE = "You're not a member of this private channel. Ask the owner to add you.";
+const IDENTITY_MISMATCH_MESSAGE = "The owner added a different identity for you. Ask them to re-add you.";
+class Space {
+    deps;
+    name;
+    historyPolicy;
+    channel = null;
+    /**
+     * The log turned this user away and closed `channel` (design §3.7). Its
+     * single-use ticket is spent, so it is never dialled again: the next
+     * `connect()` checks the log and opens a new channel on a fresh ticket.
+     */
+    channelSpent = false;
+    /** Every raw channel listener (`on`), attached to each channel this Space opens. */
+    listeners = [];
+    cipher;
+    /** Per-instance event bus for fan-out events (isolated across spaces). */
+    events = new EventTarget();
+    rawWired = false;
+    catchUpUnsub = null;
+    /** Optional P2P swarm for this Space (block exchange among members). */
+    peerNet = null;
+    _admission;
+    /** Whether admission follows the log's changes yet (subscribed once, on the first open the log admits). */
+    admissionWired = false;
+    /** When the last resume after a 4403 ran (design §6.7: at most one per {@link NOT_MEMBER_RECHECK_MS}). */
+    lastResumeAt = -Infinity;
+    resumeTimer = null;
+    /** Bumped by `disconnect()`: a /keyring/state answer that arrives after it is dropped. */
+    teardowns = 0;
+    constructor(deps) {
+        this.deps = deps;
+        this.name = deps.name;
+        this.historyPolicy = deps.historyPolicy ?? "static";
+        this.cipher = deps.keyring ? new SpacePacketCipher(deps.keyring) : null;
+        this._admission = deps.locked ? "locked" : "requesting";
+        deps.keyring?.onKeysChanged(() => {
+            if (this._admission === "requesting")
+                this.setAdmission("keyed");
+        });
+    }
+    /** The encoded space id (same as the transport name for fan-out spaces). */
+    get id() {
+        return this.name;
+    }
+    /** The keyring backing this space's group keys, if any. */
+    get keyring() {
+        return this.deps.keyring;
+    }
+    /** Where this member stands in this Space (design §4.5.12, as the slice ships it). */
+    get admission() {
+        return this._admission;
+    }
+    /** Subscribe to admission changes. Returns an unsubscribe. */
+    onAdmission(h) {
+        const l = (e) => h(e.detail);
+        this.events.addEventListener("admission", l);
+        return () => this.events.removeEventListener("admission", l);
+    }
+    setAdmission(s) {
+        if (this._admission === s)
+            return;
+        this._admission = s;
+        this.emitEvent("admission", s);
+    }
+    /** The log turned this user away; nothing reconnects until it admits them again. */
+    denied() {
+        return this._admission === "not-member" || this._admission === "identity-mismatch";
+    }
+    /**
+     * Sync the membership log and derive admission from it, before any ticket
+     * (design §3.4, §3.7, §4.5.12). A 403 from the log route is not-member and a
+     * 401 is locked. Any other failure is fatal only where this client has
+     * verified the log before (it holds a high-water mark). Otherwise the Space
+     * opens as unlogged this time, and the next open or `mlog` frame syncs again.
+     */
+    async admitByLog(ls) {
+        try {
+            await ls.sync();
+        }
+        catch (e) {
+            if (e instanceof KeyringHttpError && e.status === 403) {
+                this.setAdmission("not-member");
+                throw new AdmissionDeniedError("not-member", NOT_MEMBER_MESSAGE);
+            }
+            if (e instanceof KeyringHttpError && e.status === 401) {
+                this.setAdmission("locked");
+                throw new IdentityLockedError();
+            }
+            // A mark that cannot be read counts as held: the failure is not waved through.
+            if (await ls.hasHighWater().catch(() => true))
+                throw e;
+            log.warn("Space: the member list could not be read; opening without it", {
+                spaceId: this.name,
+                code: failureCode(e),
+                message: e instanceof Error ? e.message : String(e),
+            });
+        }
+        await this.evaluateAdmission();
+        if (this._admission === "not-member")
+            throw new AdmissionDeniedError("not-member", NOT_MEMBER_MESSAGE);
+        if (this._admission === "identity-mismatch")
+            throw new AdmissionDeniedError("identity-mismatch", IDENTITY_MISMATCH_MESSAGE);
+        if (!this.admissionWired) {
+            this.admissionWired = true;
+            ls.onChange(() => {
+                void this.evaluateAdmission().catch((e) => {
+                    log.warn("Space: admission could not be re-derived from the member list", {
+                        spaceId: this.name,
+                        code: failureCode(e),
+                        message: e instanceof Error ? e.message : String(e),
+                    });
+                });
+            });
+        }
+    }
+    /** Re-derive admission from the verified log (design §3.4 rows, §3.7, §4.5.12). */
+    async evaluateAdmission() {
+        const ls = this.deps.logSync;
+        if (!ls)
+            return;
+        // Before the logEnabled check: a log that went missing leaves the Space unlogged, and broken.
+        if (ls.integrity.broken) {
+            this.setAdmission("integrity");
+            return;
+        }
+        if (!ls.logEnabled)
+            return;
+        const m = ls.member(this.deps.myId());
+        if (!m) {
+            this.setAdmission("not-member");
+            this.dropChannel();
+            return;
+        }
+        if (!ikEquals(m.ik, await ls.signer.identityKeyRaw())) {
+            this.setAdmission("identity-mismatch");
+            this.dropChannel();
+            return;
+        }
+        if (this._admission !== "keyed")
+            this.setAdmission(this.deps.keyring?.hasAnyKey() ? "keyed" : "requesting");
+    }
+    /**
+     * A 4403 alone never shows not-member: ask /keyring/state first (design §6.9, AV12).
+     * 403 is not-member and 401, which `probeState` returns only once a silent re-auth has failed, is
+     * locked; either closes the channel for good, like a log refusal. Any
+     * other answer (404 while step I has no state route, 2xx, 5xx, a network error) resumes, at most
+     * once per {@link NOT_MEMBER_RECHECK_MS}.
+     */
+    async onNotMemberClose() {
+        const teardowns = this.teardowns;
+        const status = this.deps.probeState
+            ? await this.deps.probeState().catch(() => "network")
+            : "network";
+        if (teardowns !== this.teardowns)
+            return; // disconnected while asking: nothing to resume
+        if (status === 403) {
+            this.setAdmission("not-member");
+            this.dropChannel();
+            return;
+        }
+        if (status === 401) {
+            this.setAdmission("locked");
+            this.dropChannel();
+            return;
+        }
+        if (this.resumeTimer)
+            return;
+        const wait = Math.max(0, this.lastResumeAt + NOT_MEMBER_RECHECK_MS - Date.now());
+        this.resumeTimer = setTimeout(() => {
+            this.resumeTimer = null;
+            this.lastResumeAt = Date.now();
+            this.channel?.resume?.();
+        }, wait);
+    }
+    /** Close the socket of a user the log turned away, and never dial that channel again (design §3.7). */
+    dropChannel() {
+        if (!this.channel || this.channelSpent)
+            return;
+        this.channelSpent = true;
+        this.disconnect();
+    }
+    // -- transport -------------------------------------------------------------
+    /**
+     * Open the space websocket (resolves the ticket + identity lazily). On a
+     * Space with a membership log, the log is checked first: a user it does not
+     * list, or lists under another identity key, is refused with
+     * {@link AdmissionDeniedError} before any ticket is fetched (design §4.5.12).
+     */
+    async connect() {
+        if (this.deps.locked)
+            throw new IdentityLockedError();
+        const ls = this.deps.logSync;
+        // Checked on the first open, and again on a Space the log turned away, so a later call never reopens its socket unchecked.
+        // A channel the log closed is replaced, not redialled: its ticket was single-use.
+        if (ls && (!this.channel || this.channelSpent || this.denied()))
+            await this.admitByLog(ls);
+        if (!this.channel || this.channelSpent) {
+            const spent = this.channel;
+            // The WS upgrade ticket is single-use + short-TTL, so a reconnect
+            // must mint a FRESH one — otherwise the socket drops (idle timeout,
+            // network blip) and never comes back. `buildUrl` is handed to the
+            // transport as a `urlProvider` it calls before each reconnect.
+            const buildUrl = async (reconnect = false) => {
+                const ticket = await this.deps.fetchTicket();
+                if (!ticket && reconnect && this.deps.keyring && this.deps.hasSession?.()) {
+                    // A reconnect with a live session never goes ticketless (anonymous): let the transport retry.
+                    throw new Error("Space: no WebSocket ticket yet; retrying");
+                }
+                const q = new URLSearchParams();
+                if (ticket)
+                    q.set("ticket", ticket);
+                q.set("refuse", "close"); // be refused with the 4403 close, which this SDK treats as terminal (design §3.6)
+                return `${this.deps.wsBaseUrl}/api/spaces/${encodeURIComponent(this.name)}/websocket?${q.toString()}`;
+            };
+            const url = await buildUrl();
+            this.channel = this.deps.createChannel
+                ? this.deps.createChannel(url, this.deps.myId())
+                : new BroadcastChannel({
+                    url,
+                    myId: this.deps.myId(),
+                    autoAnnounce: false,
+                    urlProvider: () => buildUrl(true),
+                    // Keep recovering across network flaps (each attempt mints a
+                    // fresh ticket); teardown calls disconnect() which stops it.
+                    maxReconnectAttempts: 0,
+                    // A 4403 stops the transport; the Space decides whether to resume.
+                    terminalCloseCodes: [NOT_MEMBER_CLOSE_CODE],
                 });
-            for (const [event, handler] of this.pending)
+            this.channelSpent = false;
+            this.rawWired = false;
+            for (const [event, handler] of this.listeners) {
+                spent?.off(event, handler);
                 this.channel.on(event, handler);
-            this.pending.length = 0;
+            }
             // Fan-out spaces drive their own `{name}` handshake + frame routing.
             // Legacy (keyring-less) callers wire these themselves, so leave that
             // path byte-for-byte unchanged.
@@ -9615,6 +10515,11 @@ class Space {
                     // (re-runs on each reconnect to re-form the mesh).
                     this.peerNet?.start();
                 });
+                this.channel.on(BroadcastChannelEvents.DISCONNECTED, (e) => {
+                    const detail = e.detail;
+                    if (detail?.code === NOT_MEMBER_CLOSE_CODE)
+                        void this.onNotMemberClose();
+                });
                 this.wireFanout();
                 // Register offline catch-up once: on each reconnect the sync
                 // engine pages history forward to fill any gap we missed.
@@ -9626,6 +10531,11 @@ class Space {
         await this.channel.connect();
     }
     disconnect() {
+        this.teardowns++;
+        if (this.resumeTimer) {
+            clearTimeout(this.resumeTimer);
+            this.resumeTimer = null;
+        }
         this.channel?.disconnect();
         this.catchUpUnsub?.();
         this.catchUpUnsub = null;
@@ -9651,21 +10561,16 @@ class Space {
     onPeerGossip(handler) {
         return this.peerNet?.onGossip(handler) ?? (() => { });
     }
-    /** Subscribe to a raw channel event. Buffered until `connect()` if early. */
+    /** Subscribe to a raw channel event. Buffered until `connect()` if early, and kept across a new channel. */
     on(event, handler) {
-        if (this.channel)
-            this.channel.on(event, handler);
-        else
-            this.pending.push([event, handler]);
+        this.listeners.push([event, handler]);
+        this.channel?.on(event, handler);
     }
     off(event, handler) {
-        if (this.channel)
-            this.channel.off(event, handler);
-        else {
-            const i = this.pending.findIndex(([e, h]) => e === event && h === handler);
-            if (i >= 0)
-                this.pending.splice(i, 1);
-        }
+        const i = this.listeners.findIndex(([e, h]) => e === event && h === handler);
+        if (i >= 0)
+            this.listeners.splice(i, 1);
+        this.channel?.off(event, handler);
     }
     // -- legacy Double Ratchet path (unchanged) --------------------------------
     /** Advertise our keyExchange to the room (idempotent per connection). */
@@ -9905,6 +10810,8 @@ class Space {
      * hold nothing, request a key and poll until one arrives (or timeout).
      */
     async join(opts = {}) {
+        if (this.deps.locked)
+            return false;
         const keyring = this.requireKeyring();
         await this.connect();
         if (await keyring.loadFromCache())
@@ -9922,10 +10829,27 @@ class Space {
         }
         return false;
     }
-    /** Creator path: mint the initial group key, then connect. */
+    /** Creator path: mint epoch 0; for a private Space, sign the genesis + ec(0) BEFORE connecting (design §4.5.10). */
     async create() {
+        if (this.deps.locked)
+            throw new IdentityLockedError();
         const keyring = this.requireKeyring();
         await keyring.bootstrapNew();
+        const ls = this.deps.logSync;
+        if (this.deps.visibility === "private" && ls) {
+            if (!this.deps.appId)
+                throw new Error("Space: a private Space's genesis needs the app id.");
+            const appId = await this.deps.appId();
+            const k0 = keyring.rawKey(0);
+            await ls.append("genesis", { visibility: "private", policy: this.historyPolicy, appId, baseEpoch: -1, legacyCommits: {} }, async (hash, entry) => {
+                const ec = {
+                    v: 1, spaceId: this.name, epoch: 0, prevKeyed: -1,
+                    keyCommit: await keyCommit(0, k0, this.name),
+                    headSeq: 0, headHash: hash, sole: true, by: entry.by, ik: entry.ik, at: entry.at,
+                };
+                return { ...ec, sig: await ls.signer.sign(ecBytes(ec)) };
+            });
+        }
         await this.connect();
         // Publish our identity in the member directory so peers can verify our
         // message signatures (the creator never "joins", so register here).
@@ -9945,8 +10869,45 @@ class Space {
     }
     /** Rotate to a fresh epoch and re-wrap to the roster (rotate spaces). */
     async rotate(roster) {
+        if (this.deps.logSync?.logEnabled)
+            throw new SpaceTrustError("log-refused", "Key rotation for signed spaces arrives with a later release.");
         return this.requireKeyring().rotate(roster);
     }
+    // -- signed member list (design §3.5–§3.8) ---------------------------------
+    /** Whether this Space has a verified membership log. */
+    get logEnabled() {
+        return !!this.deps.logSync?.logEnabled;
+    }
+    /** The verified member list, or null when this Space has no log. */
+    membership() {
+        return this.deps.logSync?.logEnabled ? this.deps.logSync.members() : null;
+    }
+    /** Called with the member list (null when unlogged) each time the log is re-synced. Returns an unsubscribe. */
+    onMembership(h) {
+        return this.deps.logSync ? this.deps.logSync.onChange(() => h(this.membership())) : () => { };
+    }
+    requireLog() {
+        const ls = this.deps.logSync;
+        if (!ls?.logEnabled)
+            throw new SpaceTrustError("log-refused", "This space has no signed member list.");
+        return ls;
+    }
+    /** Add by exact username (design §3.8; the owner, or an editor for viewers). Looks the IK up in the directory. */
+    async add(username, opts = {}) {
+        const ls = this.requireLog();
+        const memberIk = await ls.directory.lookup(username);
+        return ls.append("add", { member: username, memberIk, role: opts.role ?? "viewer" });
+    }
+    /** Remove a member. In this build it cuts them off at the relay; it does not rotate the key. */
+    async remove(memberId) {
+        return this.requireLog().append("remove", { member: memberId });
+    }
+    async setRole(memberId, role) {
+        return this.requireLog().append("role", { member: memberId, role });
+    }
+    async leave() {
+        return this.requireLog().append("leave", {});
+    }
     // -- room-scoped files (no websocket needed) -------------------------------
     async putFile(file, metadata, opts = {}) {
         const result = await this.fileStorage(opts.backgroundUpload)
@@ -10033,6 +10994,13 @@ class Space {
         const f = frame;
         if (!f || typeof f !== "object")
             return;
+        if (f.mlog && typeof f.mlog === "object") {
+            this.deps.logSync?.scheduleSync();
+            return;
+        }
+        if (f.rotateDue) {
+            return;
+        } // no client can answer a rotation request yet: key rotation for signed spaces comes later
         if (typeof f.spaceMessage === "string" && this.cipher) {
             const handle = Number(f.timestamp ?? 0);
             const decoded = await this.decodeFrame(f.spaceMessage, this.cipher, /*raw*/ true, handle);
@@ -10083,7 +11051,10 @@ class Space {
             // A new member appeared — refresh the directory so their future
             // messages verify, and (if we hold the key) auto-admit them.
             void this.deps.keyring?.refreshDirectory({ force: true });
-            if (this.deps.autoAdmit !== false && this.deps.keyring?.hasAnyKey() && req.memberId !== this.deps.myId()) {
+            if (this.deps.autoAdmit !== false &&
+                this.deps.keyring?.hasAnyKey() &&
+                req.memberId !== this.deps.myId() &&
+                this.deps.keyring.canWrapTo(req.memberId)) {
                 void this.deps.keyring.admit(req.memberId, req.identityEcdhPub).catch(() => { });
             }
             return;
@@ -10099,6 +11070,9 @@ class Space {
      * (replacement content for an existing handle). Requires a keyring.
      */
     async sealMessage(payload, channel, contentType, clientId) {
+        if (this.deps.logSync?.integrity.broken) {
+            throw new SpaceTrustError("integrity", "This space's member list couldn't be verified. You can still read messages you already have; sending is paused.");
+        }
         const cipher = this.requireCipher(contentType);
         const message = new Message(payload);
         const headers = await cipher.seal(message.serialize());
@@ -10278,6 +11252,10 @@ class Space {
 function delay(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+/** A failure's HTTP status or error code, for a log line. */
+function failureCode(e) {
+    return (e instanceof KeyringHttpError ? e.status : e?.code) ?? "unknown";
+}
 /**
  * Zero-pad a numeric server handle for use as a cache key, so string-ordered
  * keys sort in handle order. Must match the offline layer's `padHandle`.
@@ -10494,7 +11472,7 @@ function parseMaybeJson(text) {
  * at channel creation hands the key to the keeper. MUST match the accelerator's
  * `KEEPER_MEMBER_ID`.
  */
-const KEEPER_MEMBER_ID = "__keeper__";
+const KEEPER_MEMBER_ID$1 = "__keeper__";
 /** Staging-only keyring diagnostics (group-key cache hit/miss, persist, pulls). */
 const KEYRING_DEBUG = (() => {
     try {
@@ -10523,10 +11501,24 @@ class SpaceKeyring {
      *  this window won't re-fetch (the roster hasn't changed that fast); genuine
      *  membership changes use `{ force: true }` (join requests / history loads). */
     static DIR_COOLDOWN_MS = 5000;
+    keyListeners = new Set();
     constructor(deps) {
         this.deps = deps;
         this.policy = deps.historyPolicy ?? "static";
     }
+    /** Notified whenever this keyring gains a key (bootstrap, cache hit, pull). Returns an unsubscribe. */
+    onKeysChanged(h) {
+        this.keyListeners.add(h);
+        return () => this.keyListeners.delete(h);
+    }
+    notifyKeys() {
+        for (const h of this.keyListeners) {
+            try {
+                h();
+            }
+            catch { /* a listener's failure never breaks the keyring */ }
+        }
+    }
     // -- member directory (for verifying sender signatures) -------------------
     /** The cached ECDSA verify key for a member, if known. */
     ecdsaKeyFor(memberId) {
@@ -10581,6 +11573,14 @@ class SpaceKeyring {
     hasAnyKey() {
         return this.keys.size > 0;
     }
+    /** The raw 32-byte group key for `epoch`, for its key commitment (design §4.2.4). */
+    rawKey(epoch) {
+        return this.keys.get(epoch);
+    }
+    /** Whether a key may be wrapped to `memberId` (design §4.5.1: on a signed Space, log members and the keeper only). */
+    canWrapTo(memberId) {
+        return this.deps.canWrapTo ? this.deps.canWrapTo(memberId) : true;
+    }
     // -- lifecycle -------------------------------------------------------------
     /** Hydrate keys from the PersonalSpace cache, if available. Best-effort —
      * a cache miss/failure (e.g. not unlocked) must not block joining. */
@@ -10622,6 +11622,7 @@ class SpaceKeyring {
         }
         this.epoch = Math.max(0, ...Array.from(this.keys.keys()));
         klog(`loadFromCache: HIT ${this.keys.size} epoch(s), current=${this.epoch}`);
+        this.notifyKeys();
         return true;
     }
     async persist() {
@@ -10651,19 +11652,29 @@ class SpaceKeyring {
         this.keys.set(0, generateSpaceKey());
         this.epoch = 0;
         await this.persist();
+        this.notifyKeys();
     }
     // -- newcomer: request + pull ---------------------------------------------
     /**
      * Post a join request so an online key-holder can wrap a key for us. Also
      * publishes our identity keys in the member directory (so others can verify
-     * our message signatures, and the keeper can wrap to us).
+     * our message signatures, and the keeper can wrap to us). With a `keyCert`
+     * dep it also carries the IK certificate over exactly those two strings.
      */
     async requestKey(desiredEpoch) {
+        let keyCert;
+        try {
+            keyCert = this.deps.keyCert ? await this.deps.keyCert() : undefined;
+        }
+        catch {
+            keyCert = undefined; // step I never requires a certificate; the join still goes out (server brief §3)
+        }
         await this.deps.transport.postJoinRequest({
             memberId: this.deps.memberId,
             identityEcdhPub: this.deps.identityEcdhPub,
             identityEcdsaPub: this.deps.identityEcdsaPub,
             desiredEpoch,
+            ...(keyCert ? { keyCert } : {}),
         });
     }
     /**
@@ -10691,6 +11702,7 @@ class SpaceKeyring {
         if (added > 0) {
             this.epoch = Math.max(this.epoch, ...Array.from(this.keys.keys()));
             await this.persist();
+            this.notifyKeys();
         }
         klog(`pullKeys: +${added} epoch(s) (now hold ${this.keys.size}, current=${this.epoch})`);
         return added;
@@ -10717,6 +11729,8 @@ class SpaceKeyring {
      * `rotate` space they receive only the current epoch.
      */
     async admit(targetMemberId, identityEcdhPub) {
+        if (!this.canWrapTo(targetMemberId))
+            throw new Error(`SpaceKeyring: ${targetMemberId} is not a member of this space`);
         const recipient = await importEcdhPublicKey(identityEcdhPub);
         const epochs = this.policy === "static"
             ? Array.from(this.keys.keys())
@@ -10724,148 +11738,55 @@ class SpaceKeyring {
         for (const epoch of epochs) {
             const key = this.keys.get(epoch);
             if (!key)
-                continue;
-            const wrapped = await wrapSpaceKey(key, epoch, recipient);
-            await this.deps.transport.postWrappedKey(targetMemberId, wrapped, this.deps.memberId);
-        }
-    }
-    /**
-     * Admit every outstanding join request (an online key-holder fulfilling
-     * pending newcomers). Returns the ids admitted.
-     */
-    async admitPending() {
-        const pending = await this.deps.transport.fetchPending();
-        const admitted = [];
-        for (const req of pending) {
-            if (req.memberId === this.deps.memberId)
-                continue;
-            await this.admit(req.memberId, req.identityEcdhPub);
-            admitted.push(req.memberId);
-        }
-        return admitted;
-    }
-    /**
-     * Rotate to a fresh epoch (rotate spaces). Mints a new group key, advances
-     * the epoch, and re-wraps it to every member in `roster` (plus ourselves).
-     */
-    async rotate(roster) {
-        const members = roster ?? (await this.deps.transport.fetchRoster());
-        const { epoch: nextEpoch } = await this.deps.transport.rotate(this.epoch + 1);
-        const newKey = generateSpaceKey();
-        this.keys.set(nextEpoch, newKey);
-        this.epoch = nextEpoch;
-        for (const m of members) {
-            if (m.memberId === this.deps.memberId)
-                continue;
-            const recipient = await importEcdhPublicKey(m.identityEcdhPub);
-            const wrapped = await wrapSpaceKey(newKey, nextEpoch, recipient);
-            await this.deps.transport.postWrappedKey(m.memberId, wrapped, this.deps.memberId);
-        }
-        await this.persist();
-        return nextEpoch;
-    }
-    /** Add `username` to a private channel's membership allowlist (member-only). */
-    async invite(username) {
-        await this.deps.transport.invite(username);
-    }
-}
-
-/**
- * KeyringClient — HTTP implementation of {@link KeyringTransport} against the
- * accelerator's per-space keyring endpoints. All blobs are opaque to the
- * server; this client just moves them.
- *
- *   POST /api/spaces/:id/keyring/join-request   { ...JoinRequest }
- *   GET  /api/spaces/:id/keyring/blobs/:member  -> WrappedKey[]
- *   POST /api/spaces/:id/keyring/wrap           { targetMemberId, fromMemberId, wrapped }
- *   GET  /api/spaces/:id/keyring/pending        -> JoinRequest[]
- *   GET  /api/spaces/:id/keyring/roster         -> { memberId, identityEcdhPub }[]
- *   POST /api/spaces/:id/keyring/rotate         { nextEpoch } -> { epoch }
- *   GET  /api/spaces/:id/metadata               -> SpaceMetadata
- */
-class KeyringClient {
-    deps;
-    constructor(deps) {
-        this.deps = deps;
-    }
-    url(suffix) {
-        return `${this.deps.httpBaseUrl}/api/spaces/${encodeURIComponent(this.deps.spaceId)}${suffix}`;
-    }
-    async post(suffix, body) {
-        const res = await this.deps.fetch(this.url(suffix), {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(body),
-        });
-        if (!res.ok)
-            throw new Error(`KeyringClient POST ${suffix}: ${res.status} ${res.statusText}`);
-        return (await res.json().catch(() => ({})));
-    }
-    async get(suffix) {
-        const res = await this.deps.fetch(this.url(suffix));
-        if (!res.ok)
-            throw new Error(`KeyringClient GET ${suffix}: ${res.status} ${res.statusText}`);
-        return (await res.json());
-    }
-    async postJoinRequest(req) {
-        await this.post("/keyring/join-request", req);
-    }
-    async fetchBlobs(memberId) {
-        const body = await this.get(`/keyring/blobs/${encodeURIComponent(memberId)}`);
-        return body.blobs ?? [];
-    }
-    async postWrappedKey(targetMemberId, wrapped, fromMemberId) {
-        await this.post("/keyring/wrap", { targetMemberId, fromMemberId, wrapped });
-    }
-    async fetchPending() {
-        const body = await this.get("/keyring/pending");
-        return body.pending ?? [];
-    }
-    async fetchRoster() {
-        const body = await this.get("/keyring/roster");
-        return body.roster ?? [];
-    }
-    async rotate(nextEpoch) {
-        return this.post("/keyring/rotate", { nextEpoch });
-    }
-    async invite(username) {
-        await this.post("/keyring/invite", { username });
-    }
-    // -- Shareable invite links ----------------------------------------------
-    // A capability token tied to this space. Redeeming it allowlists the holder
-    // so the keeper admits them — the link IS the invitation. Mint/list/revoke
-    // require the caller to be the creator or an existing member.
-    async createInviteLink(opts = {}) {
-        return this.post("/keyring/link", opts);
-    }
-    async listInviteLinks() {
-        const body = await this.get("/keyring/links");
-        return body.links ?? [];
-    }
-    /** Set a member's role ("viewer" | "editor"). Owner-only on the server. */
-    async setMemberRole(username, role) {
-        await this.post("/keyring/role", { username, role });
-    }
-    /** Roster with roles (owner/members only). */
-    async members() {
-        const body = await this.get("/keyring/members");
-        return body.members ?? [];
-    }
-    async revokeInviteLink(token) {
-        await this.post("/keyring/link-revoke", { token });
-    }
-    /** Redeem a link: the server allowlists this member and asks the keeper to
-     *  wrap the group key for their identity. Caller must be authenticated. */
-    async redeemInvite(req) {
-        await this.post("/keyring/redeem", req);
+                continue;
+            const wrapped = await wrapSpaceKey(key, epoch, recipient);
+            await this.deps.transport.postWrappedKey(targetMemberId, wrapped, this.deps.memberId);
+        }
     }
-    async fetchMetadata() {
-        try {
-            return await this.get("/metadata");
+    /**
+     * Admit every outstanding join request (an online key-holder fulfilling
+     * pending newcomers). Returns the ids admitted.
+     */
+    async admitPending() {
+        const pending = await this.deps.transport.fetchPending();
+        const admitted = [];
+        for (const req of pending) {
+            if (req.memberId === this.deps.memberId)
+                continue;
+            // The server's pending list still holds ex-members after a remove.
+            if (!this.canWrapTo(req.memberId))
+                continue;
+            await this.admit(req.memberId, req.identityEcdhPub);
+            admitted.push(req.memberId);
         }
-        catch {
-            return null;
+        return admitted;
+    }
+    /**
+     * Rotate to a fresh epoch (rotate spaces). Mints a new group key, advances
+     * the epoch, and re-wraps it to every member in `roster` (plus ourselves).
+     */
+    async rotate(roster) {
+        const members = roster ?? (await this.deps.transport.fetchRoster());
+        const { epoch: nextEpoch } = await this.deps.transport.rotate(this.epoch + 1);
+        const newKey = generateSpaceKey();
+        this.keys.set(nextEpoch, newKey);
+        this.epoch = nextEpoch;
+        for (const m of members) {
+            if (m.memberId === this.deps.memberId)
+                continue;
+            // The roster keeps ex-members too; the same rule as admit applies to every wrap.
+            if (!this.canWrapTo(m.memberId))
+                continue;
+            const recipient = await importEcdhPublicKey(m.identityEcdhPub);
+            const wrapped = await wrapSpaceKey(newKey, nextEpoch, recipient);
+            await this.deps.transport.postWrappedKey(m.memberId, wrapped, this.deps.memberId);
         }
+        await this.persist();
+        return nextEpoch;
+    }
+    /** Add `username` to a private channel's membership allowlist (member-only). */
+    async invite(username) {
+        await this.deps.transport.invite(username);
     }
 }
 
@@ -11899,25 +12820,640 @@ class PeerNetwork {
         try {
             this.signaler.broadcast("bye");
         }
-        catch { /* socket may be gone */ }
-        for (const off of this.offs)
-            off();
-        this.transport.close();
-        this.host.close();
-    }
-}
-
-/**
- * Whether this environment can do WebRTC peering. `RTCPeerConnection` is
- * Window-only (absent in Node/Workers/SSR), so this gates whether a
- * {@link ./PeerNetwork} can be built at all.
- */
-function isP2pCapable() {
-    try {
-        return typeof RTCPeerConnection !== "undefined";
+        catch { /* socket may be gone */ }
+        for (const off of this.offs)
+            off();
+        this.transport.close();
+        this.host.close();
+    }
+}
+
+/**
+ * Whether this environment can do WebRTC peering. `RTCPeerConnection` is
+ * Window-only (absent in Node/Workers/SSR), so this gates whether a
+ * {@link ./PeerNetwork} can be built at all.
+ */
+function isP2pCapable() {
+    try {
+        return typeof RTCPeerConnection !== "undefined";
+    }
+    catch {
+        return false;
+    }
+}
+
+/**
+ * `ChatKeyVault` — SDK-owned lifecycle for a member's long-lived ratchet/space
+ * keypair (the connect `KeyStore` entry keyed by the member id / username).
+ *
+ * Historically each app hand-rolled this (see the web app's old
+ * `personal/spaceLoader.ts`): generate a keypair at register, seed-wrap it, and
+ * PUT it to the personal space; on login GET + unwrap + hydrate the `KeyStore`.
+ * That scaffolding now lives here so ANY app gets a **stable** member keypair
+ * across reloads for free — without which the member re-admits to every space on
+ * every load and the group-key cache can never round-trip.
+ *
+ * Security invariant: the wrapping secret is the **master seed** (not the
+ * password), so the blob survives password changes and unlocks under a passkey.
+ * The seed is only ever held in memory (never persisted), so this vault can only
+ * provision/rehydrate while the client is unlocked.
+ */
+/** Staging-only diagnostics: is the member keypair stable across reloads? */
+const VAULT_DEBUG = (() => {
+    try {
+        return typeof location !== "undefined" && /(^|\.)staging\./.test(location.hostname);
+    }
+    catch {
+        return false;
+    }
+})();
+function vlog(msg) {
+    if (VAULT_DEBUG)
+        console.info(`[muhkoo:vault] ${msg}`);
+}
+/** A short, stable fingerprint of the member's current keypair (ecdsa pub). */
+async function fingerprint(memberId) {
+    try {
+        const raw = await KeyStore.getInstance().getRawEcdsaPublicKey(memberId);
+        if (!raw)
+            return "none";
+        let s = 0;
+        for (const b of raw)
+            s = (s * 31 + b) >>> 0;
+        return s.toString(16).padStart(8, "0");
+    }
+    catch {
+        return "err";
+    }
+}
+/** Personal-space key holding the seed-wrapped, dehydrated ratchet keypair. */
+const CHAT_KEYS_KEY = "chat-keys";
+/**
+ * The saved blob was read but does not unwrap, parse or import under this
+ * seed: it is damaged, or was saved under another seed. Unlike a store
+ * failure, retrying with the same seed fails the same way (design §9.2 I8).
+ */
+class ChatKeysUnreadableError extends Error {
+    reason;
+    constructor(reason) {
+        super("The saved chat keys do not unwrap under this seed.");
+        this.reason = reason;
+        this.name = "ChatKeysUnreadableError";
+    }
+}
+class ChatKeyVault {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    /**
+     * Register-time: ensure a vault-backed keypair exists for `memberId`,
+     * seed-wrap it and persist it. Idempotent for a pair that is already
+     * vault-backed. Otherwise a fresh pair is generated, persisted, and only
+     * then swapped in, replacing whatever the tab held: a throwaway key is never
+     * persisted as the stable one, and a failed persist leaves the tab's keys
+     * as they were, with nothing marked.
+     */
+    async provision(memberId, seedSecret) {
+        const ks = KeyStore.getInstance();
+        const fresh = ks.isVaultBacked(memberId) ? null : await ks.generateKeyPair();
+        const dehydrated = fresh ? await ks.exportKeyPair(fresh) : await ks.dehydrateKeyPair(memberId);
+        const plaintext = new TextEncoder().encode(JSON.stringify(dehydrated));
+        await this.store.put(CHAT_KEYS_KEY, await wrapWithPassphrase(seedSecret, plaintext));
+        if (fresh)
+            ks.replaceOwnKeyPair(memberId, fresh);
+        vlog(`provision: minted+persisted keypair fp=${await fingerprint(memberId)}`);
+    }
+    /**
+     * Sign-in / unlock time: fetch the wrapped blob, unwrap it with the seed, and
+     * hydrate the `KeyStore`, restoring the SAME keypair the member had before.
+     * Returns `true` when a vault-backed keypair is now in hand, and `false` when
+     * there is no blob yet (a brand-new member; the caller provisions). A store
+     * failure propagates as thrown; a blob that does not unwrap, parse or import
+     * throws `ChatKeysUnreadableError`. Nothing in the `KeyStore` changes until
+     * the saved pair is imported; it then replaces whatever pair the tab held,
+     * in one step, so a pair minted meanwhile is never kept in its place.
+     */
+    async rehydrate(memberId, seedSecret) {
+        const ks = KeyStore.getInstance();
+        if (ks.isVaultBacked(memberId))
+            return true;
+        const wrapped = await this.store.get(CHAT_KEYS_KEY);
+        if (!wrapped) {
+            vlog("rehydrate: no chat-keys blob (new member → will provision)");
+            return false;
+        }
+        ks.replaceOwnKeyPair(memberId, await this.unwrapPair(seedSecret, wrapped));
+        vlog(`rehydrate: HIT — restored stable keypair fp=${await fingerprint(memberId)}`);
+        return true;
+    }
+    /** Unwrap, parse and import a saved pair, outside the `KeyStore`. */
+    async unwrapPair(seedSecret, wrapped) {
+        try {
+            const bytes = await unwrapWithPassphrase(seedSecret, wrapped);
+            return await KeyStore.getInstance().importKeyPair(JSON.parse(new TextDecoder().decode(bytes)));
+        }
+        catch (e) {
+            throw new ChatKeysUnreadableError(e);
+        }
+    }
+    /**
+     * Ensure a stable keypair is in hand: rehydrate from the vault if a blob
+     * exists, otherwise mint one and persist it (so it's stable next session).
+     * Used at register and lazily when a space is first opened.
+     */
+    async ensure(memberId, seedSecret) {
+        if (await this.rehydrate(memberId, seedSecret))
+            return;
+        await this.provision(memberId, seedSecret);
+    }
+}
+
+/**
+ * A certificate by the account IK over the member's P-384 chat keys (design §3.2).
+ * `ecdh`/`ecdsa` must be the EXACT strings posted as identityEcdhPub/identityEcdsaPub.
+ * Minted in memory, never stored client-side.
+ */
+async function mintKeyCert(signer, memberId, ecdh, ecdsa) {
+    const ik = await signer.identityKeyRaw();
+    const sig = await signer.sign(certBytes(memberId, { ik, ecdh, ecdsa }));
+    return { v: 1, ik, ecdh, ecdsa, sig };
+}
+
+/** Ids the platform reserves; never a member (server brief §2.8). */
+const RESERVED = /^(__keeper__$|__log__(:|$)|__agent__:|__fn__:|__link__:|__machine__:)/;
+/**
+ * Ops this client does not interpret yet: links and redeems arrive with the
+ * link routes (step A0a), and log-enabled channels carry no agents or
+ * functions, so `svc` and `retire` change nothing here.
+ */
+const UNSUPPORTED = new Set(["join", "link", "unlink", "redeem", "svc", "retire"]);
+/**
+ * A verified private membership log (design §3.5–§3.7). Pure: it fetches nothing.
+ * An entry that chains correctly but fails its rule, signature or signer
+ * binding is a no-op (SEC4). A chain break, a bad or missing genesis, a genesis
+ * for another app, or an entry that cannot be encoded is integrity, and
+ * nothing after it is applied. `apply` never throws on an entry a relay sends,
+ * and it returns ok only once a genesis has been applied, so after an ok result
+ * `head` is never null (a private log also has its `owner`).
+ */
+class MembershipLog {
+    opts;
+    byId = new Map();
+    hashes = new Map();
+    invalidList = [];
+    ownerId = null;
+    headVal = null;
+    humanRemovalSeq = -1;
+    publicLog = false;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    get owner() { return this.ownerId; }
+    get head() { return this.headVal; }
+    get members() { return [...this.byId.values()]; }
+    get lastHumanRemovalSeq() { return this.humanRemovalSeq; }
+    get invalid() { return this.invalidList; }
+    /** A public log: this client treats the Space as unlogged (a public genesis is step A0a). */
+    get unsupported() { return this.publicLog; }
+    member(id) { return this.byId.get(id); }
+    isMember(id) { return this.byId.has(id); }
+    hashAt(seq) { return this.hashes.get(seq); }
+    async apply(entries) {
+        for (const e of entries) {
+            if (typeof e !== "object" || e === null)
+                return { ok: false, integrity: "malformed" };
+            const expectSeq = (this.headVal?.seq ?? -1) + 1;
+            if (e.seq !== expectSeq || e.prev !== (this.headVal?.hash ?? "") || e.spaceId !== this.opts.spaceId) {
+                return { ok: false, integrity: "chain" };
+            }
+            const { sig, lsig: _lsig, ...unsigned } = e;
+            let hash;
+            try {
+                hash = await entryHash(unsigned);
+            }
+            catch {
+                // An unknown op, a non-integer `at`, a missing body or a bad epoch map:
+                // an honest server never stores one, and its hash cannot be computed.
+                return { ok: false, integrity: "malformed" };
+            }
+            if (e.seq === 0) {
+                const bad = await this.checkGenesis(e, sig);
+                if (bad)
+                    return { ok: false, integrity: bad };
+            }
+            else {
+                const reason = await this.check(e, sig);
+                if (reason)
+                    this.invalidList.push({ seq: e.seq, reason });
+                else
+                    this.mutate(e);
+            }
+            this.headVal = { seq: e.seq, hash };
+            this.hashes.set(e.seq, hash);
+        }
+        // A server that reports a head but sends no entries has withheld the genesis.
+        if (!this.headVal)
+            return { ok: false, integrity: "missing-genesis" };
+        return { ok: true };
+    }
+    async checkGenesis(e, sig) {
+        if (e.op !== "genesis")
+            return "chain";
+        const b = e.body;
+        if (!(await verifyP256(e.ik, sig, entryBytes(e))))
+            return "genesis";
+        if (b.appId !== this.opts.appId)
+            return "wrong-app";
+        if (b.visibility !== "private") {
+            this.publicLog = true;
+            return null;
+        }
+        this.ownerId = e.by;
+        this.byId.set(e.by, Object.freeze({ id: e.by, ik: e.ik, role: "owner", since: 0 }));
+        return null;
+    }
+    async check(e, sig) {
+        if (this.publicLog)
+            return "unsupported-op";
+        if (e.op === "genesis")
+            return "genesis-seq";
+        if (UNSUPPORTED.has(e.op))
+            return "unsupported-op";
+        const signer = this.byId.get(e.by);
+        if (!signer)
+            return "not-member";
+        if (!ikEquals(signer.ik, e.ik))
+            return "identity-bound";
+        if (!(await verifyP256(e.ik, sig, entryBytes(e))))
+            return "bad-signature";
+        const b = e.body;
+        switch (e.op) {
+            case "add": {
+                if (signer.role === "viewer")
+                    return "not-owner";
+                if (signer.role === "editor" && b.role !== "viewer")
+                    return "editor-role";
+                if (!b.member || RESERVED.test(b.member))
+                    return "target-reserved";
+                if (this.byId.has(b.member))
+                    return "target-member";
+                if (!decodeRawP256(b.memberIk))
+                    return "bad-member-ik";
+                if (b.role !== "viewer" && b.role !== "editor")
+                    return "malformed";
+                return null;
+            }
+            case "role": {
+                if (signer.role !== "owner")
+                    return "not-owner";
+                if (!b.member || RESERVED.test(b.member))
+                    return "target-reserved";
+                if (b.member === this.ownerId)
+                    return "target-owner";
+                if (!this.byId.has(b.member))
+                    return "target-not-member";
+                if (b.role !== "viewer" && b.role !== "editor")
+                    return "malformed";
+                return null;
+            }
+            case "remove": {
+                if (signer.role === "viewer")
+                    return "not-owner";
+                if (!b.member || RESERVED.test(b.member))
+                    return "target-reserved";
+                if (b.member === this.ownerId)
+                    return "target-owner";
+                const target = this.byId.get(b.member);
+                if (!target)
+                    return "target-not-member";
+                if (signer.role === "editor" && target.role === "editor")
+                    return "target-editor";
+                return null;
+            }
+            case "leave":
+                return e.by === this.ownerId ? "owner-leave" : null;
+            default:
+                return "unsupported-op";
+        }
+    }
+    /**
+     * Applies an entry `check` accepted. A member record is never changed in
+     * place: a role change stores a new record, so a `LogMember` a caller
+     * already holds keeps the state it was read at.
+     */
+    mutate(e) {
+        const b = e.body;
+        switch (e.op) {
+            case "add":
+                this.byId.set(b.member, Object.freeze({ id: b.member, ik: b.memberIk, role: b.role, since: e.seq }));
+                return;
+            case "role":
+                this.byId.set(b.member, Object.freeze({ ...this.byId.get(b.member), role: b.role }));
+                return;
+            case "remove":
+                this.byId.delete(b.member);
+                this.humanRemovalSeq = e.seq;
+                return;
+            case "leave":
+                this.byId.delete(e.by);
+                this.humanRemovalSeq = e.seq;
+                return;
+        }
+    }
+}
+
+const MAX_APPEND_RETRIES = 3;
+const SYNC_DEBOUNCE_MS = 1000;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Must equal SpaceKeyring's KEEPER_MEMBER_ID (and the accelerator's); duplicated so this module does not import SpaceKeyring. */
+const KEEPER_MEMBER_ID = "__keeper__";
+/**
+ * Who a client may wrap a Space key to (design §4.5.1): the keeper always; while
+ * the log's integrity is broken, nobody else; on a log-enabled Space, current
+ * log members only, whatever the server's roster or pending list still holds
+ * after a remove; on a Space without a log, anyone, as before.
+ */
+function logCanWrapTo(ls) {
+    return (id) => id === KEEPER_MEMBER_ID || (!ls.integrity.broken && (!ls.logEnabled || ls.isMember(id)));
+}
+/**
+ * One Space's membership log, as this client has verified it (design §3.6–§3.7).
+ * Syncs the whole log from −1 on each call (slice logs are tiny, so no entry
+ * cache), checks the head against the high-water mark kept in `muhkoo.trust`,
+ * checks the genesis against the pins (TOFU against the directory the first
+ * time), and pins every IK a verified `add` names (design §3.4).
+ */
+class LogSync {
+    deps;
+    log = null;
+    enabled = false;
+    integrityState = { broken: false };
+    changed = new Set();
+    fps = new Map();
+    listeners = new Set();
+    timer = null;
+    running = null;
+    followUp = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    get logEnabled() { return this.enabled; }
+    get integrity() { return this.integrityState; }
+    get signer() { return this.deps.signer; }
+    get directory() { return this.deps.directory; }
+    member(id) { return this.log?.member(id); }
+    isMember(id) { return !!this.log?.isMember(id); }
+    members() {
+        return (this.log?.members ?? []).map((m) => ({
+            id: m.id, role: m.role, ik: m.ik,
+            fingerprint: this.fps.get(m.id) ?? "",
+            identityChanged: this.changed.has(m.id.toLowerCase()),
+        }));
+    }
+    onChange(h) {
+        this.listeners.add(h);
+        return () => this.listeners.delete(h);
+    }
+    /**
+     * An `mlog` frame marks the log stale; sync once a burst of frames settles.
+     * A failure is logged with its code and reported through `onChange`, never
+     * thrown; integrity is left as it was, and the next frame or open retries.
+     */
+    scheduleSync() {
+        if (this.timer)
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = null;
+            void this.sync().catch((e) => {
+                const code = e instanceof KeyringHttpError ? e.status : e?.code;
+                log.warn("LogSync: background sync failed", {
+                    spaceId: this.deps.spaceId,
+                    code: code ?? "unknown",
+                    message: e instanceof Error ? e.message : String(e),
+                });
+                this.emit();
+            });
+        }, SYNC_DEBOUNCE_MS);
+    }
+    hwKey() {
+        return `loghw:${this.deps.commitment()}:${this.deps.spaceId}`;
+    }
+    /** Whether this client holds a high-water mark for this Space, i.e. has verified its log before (design §3.7 item 3). */
+    async hasHighWater() {
+        return (await (await this.deps.store()).get(this.hwKey())) !== undefined;
+    }
+    /**
+     * Fetch and verify the whole log. Single-flight: a call made while a sync
+     * runs does not start a second one alongside it. It waits for exactly one
+     * follow-up run, which starts once the running one ends, so it sees whatever
+     * prompted the call; every call made in the meantime shares that follow-up.
+     */
+    sync() {
+        if (this.followUp)
+            return this.followUp;
+        if (!this.running)
+            return this.startSync();
+        const followUp = this.running.catch(() => undefined).then(() => {
+            this.followUp = null;
+            return this.startSync();
+        });
+        this.followUp = followUp;
+        return followUp;
+    }
+    startSync() {
+        const run = this.runSync().finally(() => {
+            if (this.running === run)
+                this.running = null;
+        });
+        this.running = run;
+        return run;
+    }
+    async runSync() {
+        const store = await this.deps.store();
+        const hw = await store.get(this.hwKey()); // read BEFORE the request (design §3.7 item 3)
+        const all = [];
+        let since = -1;
+        let head = null;
+        for (let page = 0; page < 10_000; page++) {
+            const r = await this.deps.transport.fetchLog(since, 500);
+            head = r.head;
+            const fresh = r.entries.filter((e) => e.seq > since);
+            all.push(...fresh);
+            if (!r.head || fresh.length === 0 || all[all.length - 1].seq >= r.head.seq)
+                break;
+            since = all[all.length - 1].seq;
+        }
+        if (!head) {
+            this.log = null;
+            this.enabled = false;
+            this.integrityState = hw ? { broken: true, reason: "log-missing" } : { broken: false };
+            this.emit();
+            return;
+        }
+        // Only a Space that has a log needs the app id, so an unlogged Space never waits on it.
+        const appId = await this.deps.appId();
+        const log = new MembershipLog({ spaceId: this.deps.spaceId, appId });
+        const res = await log.apply(all);
+        if (log.unsupported) {
+            // A public genesis is unlogged only where this client never recorded a private
+            // chain: a mark or a genesis pin means the log this client verified was replaced.
+            let swapped = { broken: false };
+            if (hw)
+                swapped = { broken: true, reason: "fork" };
+            else {
+                const pinned = await this.deps.pins.get("spaces", await this.spacePinKey());
+                if (pinned !== undefined && pinned !== log.hashAt(0))
+                    swapped = { broken: true, reason: "genesis-pin" };
+            }
+            this.log = null;
+            this.enabled = false;
+            this.integrityState = swapped;
+            this.emit();
+            return;
+        }
+        let integrity = res.ok ? { broken: false } : { broken: true, reason: res.integrity };
+        if (!integrity.broken && hw) {
+            if (log.head.seq < hw.seq)
+                integrity = { broken: true, reason: "rollback" };
+            else if (log.hashAt(hw.seq) !== hw.hash)
+                integrity = { broken: true, reason: "fork" };
+        }
+        // The view this client already holds is a high-water mark too: a lower head is never adopted.
+        const prior = this.log?.head ?? null;
+        const lower = prior !== null && (log.head?.seq ?? -1) < prior.seq;
+        if (!integrity.broken && lower)
+            integrity = { broken: true, reason: "rollback" };
+        if (!integrity.broken)
+            integrity = await this.checkGenesis(log);
+        if (!integrity.broken)
+            await this.pinMembers(log);
+        if (!integrity.broken) {
+            // Re-read: another tab may have recorded a newer head while this sync ran. The mark never goes down.
+            const cur = await store.get(this.hwKey());
+            if (!cur || cur.seq <= log.head.seq) {
+                await store.put(this.hwKey(), {
+                    seq: log.head.seq,
+                    hash: log.head.hash,
+                    humanRemovalSeq: Math.max(hw?.humanRemovalSeq ?? -1, cur?.humanRemovalSeq ?? -1, log.lastHumanRemovalSeq),
+                });
+            }
+        }
+        if (!lower)
+            this.log = log;
+        this.enabled = true;
+        this.integrityState = integrity;
+        this.emit();
+    }
+    /** Genesis trust (design §3.7 item 2): the pinned genesis hash, else TOFU with the owner's IK checked against the directory. */
+    async checkGenesis(log) {
+        const owner = log.owner;
+        // A signed genesis can still name no usable owner (`by` null or ""): an honest server never stores one.
+        if (typeof owner !== "string" || owner === "")
+            return { broken: true, reason: "malformed" };
+        const ownerIk = log.member(owner).ik;
+        const genesisHash = log.hashAt(0);
+        const sKey = await this.spacePinKey();
+        const pinned = await this.deps.pins.get("spaces", sKey);
+        if (pinned !== undefined && pinned !== genesisHash)
+            return { broken: true, reason: "genesis-pin" };
+        if (pinned === undefined) {
+            if (!ikEquals(await this.deps.directory.lookup(owner), ownerIk))
+                return { broken: true, reason: "owner-identity" };
+            // A conflict here means another tab pinned a different genesis after our read.
+            const { conflicts } = await this.deps.pins.pin("spaces", { [sKey]: genesisHash });
+            if (conflicts.length)
+                return { broken: true, reason: "genesis-pin" };
+        }
+        const { conflicts } = await this.deps.pins.pin("identity", { [owner.toLowerCase()]: await fingerprint$1(ownerIk) });
+        return conflicts.length ? { broken: true, reason: "owner-identity" } : { broken: false };
+    }
+    /** "s:" + b64url(SHA-256(utf8(spaceId))), the spaces-v1 key; computed exactly as PinStore.spacePinKey, which this layer may not import. */
+    async spacePinKey() {
+        return "s:" + toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8Encode(this.deps.spaceId))));
+    }
+    /** Pin every IK a verified add names (design §3.4 row 2); a different pinned IK flags the member (identity-changed). */
+    async pinMembers(log) {
+        const entries = {};
+        for (const m of log.members) {
+            const fp = await fingerprint$1(m.ik);
+            this.fps.set(m.id, fp);
+            if (m.id !== log.owner)
+                entries[m.id.toLowerCase()] = fp;
+        }
+        if (!Object.keys(entries).length)
+            return;
+        const { conflicts } = await this.deps.pins.pin("identity", entries);
+        this.changed = new Set(conflicts);
+    }
+    /**
+     * Sign and append one entry. On `409 Log moved`: re-sync, re-sign against the
+     * new head and retry, at most 3 times with jitter (design §9.2 I9). Nothing is
+     * signed while integrity is broken, including after a re-sync that breaks it.
+     * Any other refusal → SpaceTrustError("log-refused") carrying the server's code and reason.
+     * Once the server has stored the entry, its `{seq}` is returned even if the sync confirming it fails.
+     */
+    async append(op, body, ec) {
+        for (let attempt = 0; attempt <= MAX_APPEND_RETRIES; attempt++) {
+            if (attempt > 0 || (op !== "genesis" && !this.log))
+                await this.sync();
+            if (this.integrityState.broken)
+                throw new SpaceTrustError("integrity", "This space's member list couldn't be verified. You can still read messages you already have; sending is paused.");
+            const head = this.log?.head ?? null;
+            const unsigned = {
+                v: 1,
+                spaceId: this.deps.spaceId,
+                seq: head ? head.seq + 1 : 0,
+                prev: head?.hash ?? "",
+                op,
+                by: this.deps.me(),
+                ik: await this.deps.signer.identityKeyRaw(),
+                at: Date.now(),
+                body,
+            };
+            const sig = await this.deps.signer.sign(entryBytes(unsigned));
+            const entry = { ...unsigned, sig };
+            const commit = ec ? await ec(await entryHash(unsigned), unsigned) : undefined;
+            let r;
+            try {
+                r = await this.deps.transport.postLogEntry(entry, commit);
+            }
+            catch (e) {
+                if (e instanceof KeyringHttpError && e.status === 409 && !e.body?.code) {
+                    await sleep(50 + Math.floor(Math.random() * 200));
+                    continue;
+                }
+                if (e instanceof KeyringHttpError) {
+                    throw new SpaceTrustError("log-refused", String(e.body?.error ?? e.message), { status: e.status, ...(e.body ?? {}) });
+                }
+                throw e;
+            }
+            // The entry is stored: a failure of this sync is not a refusal, and the entry is never re-sent.
+            // It is logged, a background sync applies the entry later, and the stored seq is still returned.
+            try {
+                await this.sync();
+            }
+            catch (e) {
+                const code = e instanceof KeyringHttpError ? e.status : e?.code;
+                log.warn("LogSync: the entry was stored, but the sync confirming it failed", {
+                    spaceId: this.deps.spaceId,
+                    seq: r.head.seq,
+                    code: code ?? "unknown",
+                    message: e instanceof Error ? e.message : String(e),
+                });
+                this.scheduleSync();
+            }
+            return { seq: r.head.seq };
+        }
+        throw new SpaceTrustError("log-conflict", "The member list changed while saving. Try again.");
     }
-    catch {
-        return false;
+    emit() {
+        for (const h of this.listeners) {
+            try {
+                h();
+            }
+            catch { /* a listener's failure never breaks sync */ }
+        }
     }
 }
 
@@ -11959,6 +13495,10 @@ class SpaceNamespace {
     spaceCache;
     /** Spaces built this session, by id — used to route offline send replays. */
     openSpaces = new Map();
+    /** In-flight identity loads, by member id; each entry is deleted once it settles. */
+    identityInFlight = new Map();
+    /** Chat-key certificates, by member and the exact key strings; a failed mint is dropped so the next join retries. */
+    certs = new Map();
     /** Unique id for THIS device/session — the P2P peer identity. A user's own
      *  devices share a member id, so the mesh MUST distinguish them by this or a
      *  device treats its siblings' signals as its own echo and never connects. */
@@ -11972,7 +13512,8 @@ class SpaceNamespace {
             deps.offline.registerReplayer("space", async (entry) => {
                 const { spaceId, frame } = entry.args;
                 let space = this.openSpaces.get(spaceId);
-                if (!space)
+                // A Space built while the session was locked never connects: build it again now (design §3.3).
+                if (!space || space.admission === "locked")
                     space = await this.get(spaceId);
                 await space.connect();
                 if (!space.isConnected())
@@ -11996,13 +13537,15 @@ class SpaceNamespace {
      * the first VFS write hang forever instead of failing.
      */
     async createSpace(opts = {}) {
+        if (opts.messaging !== false && !this.deps.session.seed)
+            throw new IdentityLockedError();
         const historyPolicy = opts.historyPolicy ?? "static";
         const identity = await generateSpaceIdentity();
         // Register the space (server records pubkey + policy; the DO is lazy).
         // For a private space the server also records the creator (this user) as
         // its first member — so the metadata POST must carry the user session.
         await this.deps.http.post(`/api/spaces/${encodeURIComponent(identity.id)}/metadata`, { spacePubKey: identity.id, historyPolicy, visibility: opts.private ? "private" : "public" });
-        const space = await this.build(identity.id, historyPolicy);
+        const space = await this.build(identity.id, historyPolicy, opts.private ? "private" : "public", { messaging: opts.messaging });
         if (opts.messaging !== false)
             await space.create();
         return space;
@@ -12014,9 +13557,13 @@ class SpaceNamespace {
         await space.join({ timeoutMs: opts.timeoutMs });
         return space;
     }
-    /** A handle to a space without auto-connecting (uses cached keys on demand). */
-    async get(spaceId, historyPolicy = "static") {
-        return this.build(spaceId, historyPolicy);
+    /**
+     * A handle to a space without auto-connecting (uses cached keys on demand).
+     * `messaging: false` opens a files-only space, as {@link createSpace} makes:
+     * no keyring and no identity, so it opens whether or not the session is locked.
+     */
+    async get(spaceId, historyPolicy = "static", opts = {}) {
+        return this.build(spaceId, historyPolicy, undefined, opts);
     }
     // -------------------------------------------------------------------------
     // Channels — named, app-scoped pointers to spaces. The name → space-id
@@ -12063,7 +13610,7 @@ class SpaceNamespace {
         try {
             const { pubkey } = await this.deps.http.get("/api/app/keeper");
             if (pubkey && space.keyring)
-                await space.keyring.admit(KEEPER_MEMBER_ID, pubkey);
+                await space.keyring.admit(KEEPER_MEMBER_ID$1, pubkey);
         }
         catch (err) {
             console.warn("[client.space] keeper admit failed (channel still usable):", err);
@@ -12114,6 +13661,8 @@ class SpaceNamespace {
      * Returns the open {@link Space}.
      */
     async joinByInvite(spaceId, token, opts = {}) {
+        if (!this.deps.session.seed)
+            throw new IdentityLockedError();
         const memberId = this.myId();
         const { ecdhPub, ecdsaPub } = await this.ensureIdentity(memberId);
         await this.keyringFor(spaceId).redeemInvite({ token, identityEcdhPub: ecdhPub, identityEcdsaPub: ecdsaPub });
@@ -12128,19 +13677,64 @@ class SpaceNamespace {
             spaceId,
             httpBaseUrl: this.deps.http.baseUrl,
             fetch: this.deps.http.fetch,
+            fetchWithRecovery: this.deps.http.fetchWithRecovery,
         });
     }
     // -------------------------------------------------------------------------
     // Internals
     // -------------------------------------------------------------------------
-    async build(spaceId, historyPolicy) {
+    async build(spaceId, historyPolicy, visibility, opts = {}) {
         const memberId = this.myId();
+        const filesOnly = opts.messaging === false;
+        if (filesOnly || !this.deps.session.seed) {
+            // Locked (design §3.3): no identity, no keyring, no join request. The
+            // Space reports admission "locked"; the app re-opens it after sign-in.
+            // A files-only Space (`messaging: false`) is built the same way whether
+            // or not the session is locked, and is never marked locked: its file
+            // chunks carry their own keys, so it needs no identity at all.
+            const keyless = new Space({
+                name: spaceId,
+                wsBaseUrl: this.deps.wsBaseUrl,
+                httpBaseUrl: this.deps.http.baseUrl,
+                fetch: this.deps.http.fetch,
+                myId: () => memberId,
+                fetchTicket: () => this.fetchTicket(),
+                historyPolicy,
+                locked: !filesOnly,
+                shardCache: this.deps.offline?.fileCache,
+                deferShardUpload: this.deps.offline
+                    ? (hash) => this.deps.offline.deferShardUpload(hash)
+                    : undefined,
+            });
+            this.openSpaces.set(spaceId, keyless);
+            return keyless;
+        }
         const { ecdhPub, ecdsaPub } = await this.ensureIdentity(memberId);
         const transport = new KeyringClient({
             spaceId,
             httpBaseUrl: this.deps.http.baseUrl,
             fetch: this.deps.http.fetch,
+            // The 4403 state check runs after the HttpClient's 401 recovery (design §6.9).
+            fetchWithRecovery: this.deps.http.fetchWithRecovery,
         });
+        // The Space's membership log (design §3.6–§3.7), when this client has trust wired.
+        const trust = this.deps.trust;
+        const logSync = trust
+            ? new LogSync({
+                spaceId,
+                me: () => memberId,
+                appId: () => trust.appId(),
+                commitment: () => this.deps.session.commitment,
+                transport: {
+                    fetchLog: (s, l) => transport.fetchLog(s, l),
+                    postLogEntry: (e, ec) => transport.postLogEntry(e, ec),
+                },
+                signer: trust.signer,
+                directory: trust.directory,
+                pins: trust.pins,
+                store: () => trust.store(),
+            })
+            : undefined;
         const keyring = new SpaceKeyring({
             spaceId,
             memberId,
@@ -12150,6 +13744,8 @@ class SpaceNamespace {
             transport,
             cache: this.deps.cache,
             historyPolicy,
+            keyCert: this.deps.trust ? () => this.certFor(memberId, ecdhPub, ecdsaPub) : undefined,
+            canWrapTo: logSync ? logCanWrapTo(logSync) : undefined,
         });
         const space = new Space({
             name: spaceId,
@@ -12160,6 +13756,11 @@ class SpaceNamespace {
             fetchTicket: () => this.fetchTicket(),
             keyring,
             historyPolicy,
+            logSync,
+            visibility,
+            appId: trust ? () => trust.appId() : undefined,
+            probeState: () => transport.probeState(),
+            hasSession: () => !!this.deps.session.token,
             offline: this.spaceCache,
             shardCache: this.deps.offline?.fileCache,
             deferShardUpload: this.deps.offline
@@ -12181,43 +13782,63 @@ class SpaceNamespace {
         }
         return space;
     }
-    /** Ensure the member has an identity keypair; return its public ECDH + ECDSA keys. */
-    async ensureIdentity(memberId) {
+    /**
+     * The member's stable chat identity (design §3.3). A locked session (no
+     * seed) throws `IdentityLockedError`. A vault failure throws
+     * `IdentityUnavailableError`: `retryable` when the vault could not be
+     * reached (§9.2 I8), and not when the saved keys do not unwrap under this
+     * seed. A throwaway pair is never minted: doing so is what hid a reloaded
+     * member's earlier messages from everyone else.
+     *
+     * Concurrent calls for one member share a single load, so two first opens
+     * can never interleave their forget/generate steps and persist a second or
+     * mixed pair.
+     */
+    ensureIdentity(memberId) {
+        let pending = this.identityInFlight.get(memberId);
+        if (!pending) {
+            pending = this.loadIdentity(memberId).finally(() => this.identityInFlight.delete(memberId));
+            this.identityInFlight.set(memberId, pending);
+        }
+        return pending;
+    }
+    async loadIdentity(memberId) {
         const store = KeyStore.getInstance();
-        if (!store.getKeyPair(memberId)) {
-            // Unlocked (seed in hand): rehydrate the member's STABLE keypair from
-            // the vault, or provision + persist one on first use. This keeps the
-            // member the same identity across reloads — no re-admit each session,
-            // and the group-key cache round-trips. Best-effort: a personal-space
-            // hiccup falls through to an ephemeral keypair (today's behavior).
-            const seed = this.deps.session.seed;
-            const staging = (() => { try {
-                return typeof location !== "undefined" && /(^|\.)staging\./.test(location.hostname);
+        const seed = this.deps.session.seed;
+        if (!seed)
+            throw new IdentityLockedError();
+        if (!store.isVaultBacked(memberId)) {
+            if (!this.deps.chatKeys) {
+                throw new IdentityUnavailableError("This client has no chat-key vault; sign in with a session first.", undefined, false);
             }
-            catch {
-                return false;
-            } })();
-            if (staging)
-                console.info(`[muhkoo:vault] ensureIdentity: unlocked=${!!seed} vault=${!!this.deps.chatKeys}`);
-            if (this.deps.chatKeys && seed) {
-                try {
-                    await this.deps.chatKeys.ensure(memberId, toBase64$2(seed));
-                }
-                catch (e) {
-                    if (staging)
-                        console.info(`[muhkoo:vault] ensureIdentity: vault.ensure failed — ${e instanceof Error ? e.message : e}`);
-                }
+            try {
+                await this.deps.chatKeys.ensure(memberId, toBase64$2(seed));
             }
-            if (!store.getKeyPair(memberId)) {
-                if (staging)
-                    console.info("[muhkoo:vault] ensureIdentity: EPHEMERAL keypair (locked / no vault) → will re-admit");
-                await store.generateOwnKeyPair(memberId);
+            catch (e) {
+                if (e instanceof ChatKeysUnreadableError) {
+                    throw new IdentityUnavailableError("Your saved chat keys could not be unlocked with this session's key: they are damaged, " +
+                        "or were saved under a different key. Trying again will not fix this.", e, false);
+                }
+                throw new IdentityUnavailableError(undefined, e);
             }
+            if (!store.isVaultBacked(memberId))
+                throw new IdentityUnavailableError();
         }
         const ecdhPub = await exportEcdhPublicKey(store.getKeyPair(memberId).publicKey);
         const ecdsaPub = await exportEcdsaPublicKey(store.getAuthKeyPair(memberId).publicKey);
         return { ecdhPub, ecdsaPub };
     }
+    /** One certificate per (member, chat keys) for the life of the Client (design §3.2: global, not per Space). */
+    certFor(memberId, ecdh, ecdsa) {
+        const k = `${memberId}\n${ecdh}\n${ecdsa}`;
+        let p = this.certs.get(k);
+        if (!p) {
+            p = mintKeyCert(this.deps.trust.signer, memberId, ecdh, ecdsa);
+            p.catch(() => this.certs.delete(k));
+            this.certs.set(k, p);
+        }
+        return p;
+    }
     async fetchPolicy(spaceId) {
         const meta = await new KeyringClient({
             spaceId,
@@ -12506,6 +14127,328 @@ class AccessTokensNamespace {
     }
 }
 
+/**
+ * POST /api/auth/identity (SpecA §4.1 as amended by CS-7). An unknown name
+ * answers a deterministic decoy, so a lookup never says whether an account
+ * exists. Responses are cached for the life of the Client. Any failure,
+ * including a 429, fails closed (SpecA §4.3).
+ */
+class IdentityDirectory {
+    http;
+    cache = new Map();
+    constructor(http) {
+        this.http = http;
+    }
+    async lookup(username) {
+        const l = username.toLowerCase();
+        return (await this.lookupMany([username]))[l];
+    }
+    async lookupMany(usernames) {
+        const out = {};
+        const missing = [];
+        for (const u of usernames) {
+            const l = u.toLowerCase();
+            const hit = this.cache.get(l);
+            if (hit)
+                out[l] = hit;
+            else if (!missing.includes(l))
+                missing.push(l);
+        }
+        for (let i = 0; i < missing.length; i += 64) {
+            const batch = missing.slice(i, i + 64);
+            let keys;
+            try {
+                keys = (await this.http.post("/api/auth/identity", { usernames: batch }))?.keys;
+            }
+            catch (e) {
+                throw new SpaceTrustError("lookup-failed", "Couldn't verify members right now; retrying.", {
+                    status: e instanceof HttpError ? e.status : undefined,
+                });
+            }
+            for (const l of batch) {
+                const k = keys?.[l];
+                if (typeof k !== "string")
+                    throw new SpaceTrustError("lookup-failed", "Couldn't verify members right now; retrying.");
+                this.cache.set(l, k);
+                out[l] = k;
+            }
+        }
+        return out;
+    }
+}
+
+/**
+ * Derives the IK from the in-memory seed (HKDF(seed,"ecdsa-priv"), non-extractable),
+ * and checks it against the account's registered IK before its first use, because
+ * `unlockWithSeed`/`unlockWithDevice` set a seed without a commitment check.
+ * Locked or mismatched → IdentityLockedError.
+ */
+class SeedIdentitySigner {
+    deps;
+    cached = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async key() {
+        const { session } = this.deps;
+        const seed = session.seed;
+        const username = session.username;
+        if (!seed || !username)
+            throw new IdentityLockedError();
+        if (this.cached && this.cached.seed === seed)
+            return this.cached;
+        const identity = session.identity ?? (await deriveIdentityFromSeed(seed));
+        const ik = await exportPublicKeyBase64(identity.ecdsaKeyPair.publicKey);
+        const registered = await this.deps.directory.lookup(username);
+        if (!ikEquals(registered, ik)) {
+            throw new IdentityLockedError("This session's key is not your account's registered identity. Sign in again.");
+        }
+        this.cached = { seed, priv: identity.ecdsaKeyPair.privateKey, ik };
+        return this.cached;
+    }
+    async identityKeyRaw() {
+        return (await this.key()).ik;
+    }
+    async sign(bytes) {
+        const { priv } = await this.key();
+        return toBase64$2(new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, priv, bytes)));
+    }
+}
+
+/** Reserved personal-KV keys and signing labels (SpecA §4.2; design §3.4, §6.6a). Frozen formats. */
+const DOCS = {
+    identity: { key: "muhkoo.pins/identity-v1", label: "muhkoo-pinmap-v1" },
+    spaces: { key: "muhkoo.pins/spaces-v1", label: "muhkoo-spacepins-v1" },
+};
+/** `hlc` for a pin write: dec(counter) zero-padded to 16 digits, because the server compares strings (CP9). */
+const pad16 = (n) => dec(n).padStart(16, "0");
+/** LP(label) ‖ LP(ownerCommitment) ‖ LP(dec(counter)) ‖ LP(concat over keys sorted (code units) of LP(k) ‖ LP(v)). */
+function pinDocBytes(label, ownerCommitment, counter, entries) {
+    const keys = Object.keys(entries).sort();
+    return concatBytes(lpStr(label), lpStr(ownerCommitment), lpStr(dec(counter)), lp(concatBytes(...keys.map((k) => concatBytes(lpStr(k), lpStr(entries[k]))))));
+}
+/** The `spaces-v1` key for a Space's genesis pin: "s:" + b64url(SHA-256(utf8(spaceId))). */
+async function spacePinKey(spaceId) {
+    return "s:" + toBase64Url(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8Encode(spaceId))));
+}
+class PinStore {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    commitment() {
+        const c = this.deps.commitment();
+        if (!c)
+            throw new SpaceTrustError("pins-invalid", "Sign in first.");
+        return c;
+    }
+    markKey(doc) {
+        return `pinhw:${DOCS[doc].key}:${this.commitment()}`;
+    }
+    kvPath(doc, suffix = "") {
+        return `/api/personal/${encodeURIComponent(this.commitment())}/kv/${encodeURIComponent(DOCS[doc].key)}${suffix}`;
+    }
+    async fetchDoc(doc) {
+        try {
+            const res = await this.deps.http.post(this.kvPath(doc, "/get"), {});
+            return res?.value ?? null;
+        }
+        catch (e) {
+            if (e instanceof HttpError && e.status === 404)
+                return null;
+            throw new SpaceTrustError("pins-stale", "Couldn't verify members right now; retrying.");
+        }
+    }
+    async verify(doc, d) {
+        const ok = d && d.v === 1 && d.ownerCommitment === this.commitment() &&
+            Number.isSafeInteger(d.counter) && d.counter >= 1 &&
+            d.entries && typeof d.entries === "object" &&
+            Object.values(d.entries).every((v) => typeof v === "string") &&
+            (await verifyP256(await this.deps.signer.identityKeyRaw(), d.sig, pinDocBytes(DOCS[doc].label, d.ownerCommitment, d.counter, d.entries)));
+        if (!ok)
+            throw new SpaceTrustError("pins-invalid", "Your saved trust records could not be verified.");
+    }
+    /** The current verified document; an empty bootstrap at counter 0 when none exists and no mark does either. */
+    async read(doc) {
+        const store = await this.deps.store();
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const before = await store.get(this.markKey(doc));
+            const d = await this.fetchDoc(doc);
+            const now = await store.get(this.markKey(doc));
+            if (!d) {
+                if (before !== undefined)
+                    throw new SpaceTrustError("pins-missing", "Your saved trust records are missing.");
+                return { v: 1, ownerCommitment: this.commitment(), counter: 0, entries: {}, sig: "" };
+            }
+            await this.verify(doc, d);
+            if (before !== undefined && d.counter < before)
+                throw new SpaceTrustError("pins-rollback", "Your saved trust records were rolled back.");
+            if (now !== undefined && d.counter < now)
+                continue; // stale, not a rollback (KI6): re-read once
+            await store.put(this.markKey(doc), Math.max(d.counter, now ?? 0));
+            return d;
+        }
+        throw new SpaceTrustError("pins-stale", "Couldn't verify members right now; retrying.");
+    }
+    async get(doc, key) {
+        return (await this.read(doc)).entries[key];
+    }
+    /** Pin new keys. A key already pinned to a different value is reported, never overwritten (design §3.4). */
+    async pin(doc, entries) {
+        return this.mutate(doc, (cur) => {
+            const next = { ...cur };
+            const conflicts = [];
+            for (const [k, v] of Object.entries(entries)) {
+                if (next[k] === undefined)
+                    next[k] = v;
+                else if (next[k] !== v)
+                    conflicts.push(k);
+            }
+            return { next, conflicts };
+        });
+    }
+    async unpin(doc, keys) {
+        await this.mutate(doc, (cur) => {
+            const next = { ...cur };
+            for (const k of keys)
+                delete next[k];
+            return { next, conflicts: [] };
+        });
+    }
+    /** User-confirmed recovery (design §9.1 "Your saved trust records are missing."): forget the high-water mark. */
+    async resetMark(doc) {
+        await (await this.deps.store()).del(this.markKey(doc));
+    }
+    async mutate(doc, change) {
+        const store = await this.deps.store();
+        for (let attempt = 0; attempt <= 3; attempt++) {
+            const cur = await this.read(doc);
+            const { next, conflicts } = change(cur.entries);
+            const same = Object.keys(next).length === Object.keys(cur.entries).length &&
+                Object.entries(next).every(([k, v]) => cur.entries[k] === v);
+            if (same)
+                return { conflicts };
+            const counter = cur.counter + 1;
+            const c = this.commitment();
+            const sig = await this.deps.signer.sign(pinDocBytes(DOCS[doc].label, c, counter, next));
+            const value = { v: 1, ownerCommitment: c, counter, entries: next, sig };
+            const res = await this.deps.http.post(this.kvPath(doc), { value, hlc: pad16(counter) });
+            if (res?.applied === false)
+                continue; // a concurrent writer won: re-read, merge, retry
+            await store.put(this.markKey(doc), counter);
+            return { conflicts };
+        }
+        throw new SpaceTrustError("pins-write-failed", "Couldn't save trust records right now.");
+    }
+}
+
+const TRUST_OPEN_TIMEOUT_MS = 2000;
+const DB_NAME$1 = "muhkoo.trust";
+const STORE = "kv";
+function memoryTrustStore() {
+    const m = new Map();
+    return {
+        persistent: false,
+        async get(k) { return m.get(k); },
+        async put(k, v) { m.set(k, structuredClone(v)); },
+        async del(k) { m.delete(k); },
+    };
+}
+async function openTrustStore(opts = {}) {
+    const idb = opts.idb === undefined ? globalThis.indexedDB : opts.idb;
+    if (!idb)
+        return memoryTrustStore();
+    const db = await new Promise((resolve) => {
+        let settled = false;
+        const done = (v) => { if (!settled) {
+            settled = true;
+            resolve(v);
+        } };
+        const timer = setTimeout(() => done(null), opts.timeoutMs ?? TRUST_OPEN_TIMEOUT_MS);
+        try {
+            const req = idb.open(DB_NAME$1, 1);
+            req.onupgradeneeded = () => {
+                if (!req.result.objectStoreNames.contains(STORE))
+                    req.result.createObjectStore(STORE);
+            };
+            req.onsuccess = () => { clearTimeout(timer); done(req.result); };
+            req.onerror = () => { clearTimeout(timer); done(null); };
+        }
+        catch {
+            clearTimeout(timer);
+            done(null);
+        }
+    });
+    if (!db)
+        return memoryTrustStore();
+    const run = (mode, fn) => new Promise((resolve, reject) => {
+        const r = fn(db.transaction(STORE, mode).objectStore(STORE));
+        r.onsuccess = () => resolve(r.result);
+        r.onerror = () => reject(r.error);
+    });
+    return {
+        persistent: true,
+        get: (k) => run("readonly", (s) => s.get(k)),
+        put: async (k, v) => { await run("readwrite", (s) => s.put(v, k)); },
+        del: async (k) => { await run("readwrite", (s) => s.delete(k)); },
+    };
+}
+
+/** One per Client: shared by every Space (and, in sub-project 4, DMs). */
+class TrustContext {
+    deps;
+    directory;
+    signer;
+    pins;
+    storeP = null;
+    opened = null;
+    appIdP = null;
+    constructor(deps) {
+        this.deps = deps;
+        this.directory = new IdentityDirectory(deps.http);
+        this.signer = new SeedIdentitySigner({ session: deps.session, directory: this.directory });
+        this.pins = new PinStore({
+            http: deps.http,
+            commitment: () => deps.session.commitment,
+            signer: this.signer,
+            store: () => this.store(),
+        });
+        // Start opening muhkoo.trust now, so `persistent` has settled by the time an app asks (KI1).
+        // A failed open reaches whoever awaits store(); it is not an unhandled rejection here.
+        this.store().catch(() => undefined);
+    }
+    /** Whether muhkoo.trust survives a restart (KI1): false until the open settles, and false for an in-memory store. */
+    get persistent() {
+        return this.opened?.persistent ?? false;
+    }
+    store() {
+        return (this.storeP ??= (this.deps.openStore ?? openTrustStore)().then((s) => (this.opened = s)));
+    }
+    /** This app's id, from GET /api/app/trust (a genesis must name it, D4). Cached; a failure is retried next call. */
+    appId() {
+        return (this.appIdP ??= this.deps.http
+            .get("/api/app/trust")
+            .then((r) => {
+            if (!r?.appId)
+                throw new Error("app trust: no appId");
+            return r.appId;
+        })
+            .catch((e) => {
+            this.appIdP = null;
+            throw e;
+        }));
+    }
+    /** User-confirmed "Reset trust for this space" (design §9.1): drop its genesis pin and log high-water. */
+    async resetSpacePins(spaceId) {
+        await this.pins.unpin("spaces", [await spacePinKey(spaceId)]);
+        await (await this.store()).del(`loghw:${this.deps.session.commitment}:${spaceId}`);
+    }
+    /** `client.trust.unpin(username)`: forget a member's pinned identity after comparing safety numbers (design §3.4). */
+    async unpinUser(username) {
+        await this.pins.unpin("identity", [username.toLowerCase()]);
+    }
+}
+
 /**
  * Absolute POSIX paths for the VFS.
  *
@@ -13515,6 +15458,18 @@ class VfsNamespace {
      * than by TTL — a stale directory listing shows files that are not there.
      */
     cache = new Map();
+    /**
+     * The write of each directory record still in flight, by id.
+     *
+     * Two writes of one record must land in the order they were made. The
+     * personal space has no compare-and-swap: of two writes of one key that
+     * are in flight together it keeps whichever request finishes last, and
+     * that is often the one sent first. Then the earlier write, sealed before
+     * the later edit was made, undoes it. That is how a file deleted forever
+     * from the Trash, while the move that put it there was still being
+     * written, came back. So each write waits for the one before it.
+     */
+    writing = new Map();
     historyLimit;
     maxEntries;
     maxPathChars;
@@ -13978,10 +15933,7 @@ class VfsNamespace {
         const parentPath = dirname(target);
         await this.mkdir(parentPath, { recursive: true });
         const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
-        const { manifest, size } = await this.deps.content.write(bytes, {
-            name,
-            type: opts.type ?? contentTypeFor(name),
-        });
+        const { manifest, size } = await this.deps.content.write(bytes, { name, type: opts.type ?? contentTypeFor(name) }, { onProgress: opts.onProgress });
         const parent = await this.openDir(parentPath);
         const prior = entryIn(parent.node, name);
         if (prior?.kind === "dir")
@@ -14539,24 +16491,14 @@ class VfsNamespace {
             if (Object.hasOwn(dir.node.entries, name))
                 delete dir.hidden[name];
         }
-        const stored = Object.keys(dir.hidden).length
-            ? { ...dir.node, entries: Object.assign(Object.create(null), dir.hidden, dir.node.entries) }
-            : dir.node;
+        // Not sent until any earlier write of this record has landed: see
+        // `writing`. Whether that one worked or not, this one still goes.
+        const before = this.writing.get(dir.id);
+        const send = () => this.writeRecord(dir);
+        const write = before ? before.then(send, send) : send();
+        this.writing.set(dir.id, write);
         try {
-            let sealed;
-            try {
-                sealed = await seal(dir.key, stored);
-            }
-            catch (err) {
-                // JSON.stringify's own failures: a value too deeply nested to
-                // write. Reading drops those from a stored record, so this is
-                // what the write itself was given.
-                if (!(err instanceof RangeError || err instanceof TypeError))
-                    throw err;
-                const where = dir.path ?? `the directory stored as record ${printable(dir.id, 40)}`;
-                throw new VfsConflictError(`cannot write to ${where}: it would hold a value nested too deeply to store`);
-            }
-            await this.deps.store.put(dirKey(dir.id), sealed);
+            await write;
         }
         catch (err) {
             // The edit above was made in place, on the very object the cache
@@ -14567,8 +16509,38 @@ class VfsNamespace {
             this.cache.delete(dir.id);
             throw err;
         }
+        finally {
+            if (this.writing.get(dir.id) === write)
+                this.writing.delete(dir.id);
+        }
         this.cache.set(dir.id, Promise.resolve(dir));
     }
+    /**
+     * Seal a directory record as it stands NOW and put it in the store.
+     *
+     * Read at the moment of sending, not when the edit was made, so a write
+     * that waited behind another carries every edit made to the record by
+     * then, its own included.
+     */
+    async writeRecord(dir) {
+        const stored = Object.keys(dir.hidden).length
+            ? { ...dir.node, entries: Object.assign(Object.create(null), dir.hidden, dir.node.entries) }
+            : dir.node;
+        let sealed;
+        try {
+            sealed = await seal(dir.key, stored);
+        }
+        catch (err) {
+            // JSON.stringify's own failures: a value too deeply nested to
+            // write. Reading drops those from a stored record, so this is
+            // what the write itself was given.
+            if (!(err instanceof RangeError || err instanceof TypeError))
+                throw err;
+            const where = dir.path ?? `the directory stored as record ${printable(dir.id, 40)}`;
+            throw new VfsConflictError(`cannot write to ${where}: it would hold a value nested too deeply to store`);
+        }
+        await this.deps.store.put(dirKey(dir.id), sealed);
+    }
     async createDir(parentPath, name) {
         assertValidName(name);
         const parent = await this.openDir(parentPath);
@@ -16229,112 +18201,6 @@ class VcsNamespace {
     }
 }
 
-/**
- * `ChatKeyVault` — SDK-owned lifecycle for a member's long-lived ratchet/space
- * keypair (the connect `KeyStore` entry keyed by the member id / username).
- *
- * Historically each app hand-rolled this (see the web app's old
- * `personal/spaceLoader.ts`): generate a keypair at register, seed-wrap it, and
- * PUT it to the personal space; on login GET + unwrap + hydrate the `KeyStore`.
- * That scaffolding now lives here so ANY app gets a **stable** member keypair
- * across reloads for free — without which the member re-admits to every space on
- * every load and the group-key cache can never round-trip.
- *
- * Security invariant: the wrapping secret is the **master seed** (not the
- * password), so the blob survives password changes and unlocks under a passkey.
- * The seed is only ever held in memory (never persisted), so this vault can only
- * provision/rehydrate while the client is unlocked.
- */
-/** Staging-only diagnostics: is the member keypair stable across reloads? */
-const VAULT_DEBUG = (() => {
-    try {
-        return typeof location !== "undefined" && /(^|\.)staging\./.test(location.hostname);
-    }
-    catch {
-        return false;
-    }
-})();
-function vlog(msg) {
-    if (VAULT_DEBUG)
-        console.info(`[muhkoo:vault] ${msg}`);
-}
-/** A short, stable fingerprint of the member's current keypair (ecdsa pub). */
-async function fingerprint(memberId) {
-    try {
-        const raw = await KeyStore.getInstance().getRawEcdsaPublicKey(memberId);
-        if (!raw)
-            return "none";
-        let s = 0;
-        for (const b of raw)
-            s = (s * 31 + b) >>> 0;
-        return s.toString(16).padStart(8, "0");
-    }
-    catch {
-        return "err";
-    }
-}
-/** Personal-space key holding the seed-wrapped, dehydrated ratchet keypair. */
-const CHAT_KEYS_KEY = "chat-keys";
-class ChatKeyVault {
-    store;
-    constructor(store) {
-        this.store = store;
-    }
-    /**
-     * Register-time: ensure a keypair exists for `memberId`, seed-wrap the
-     * dehydrated form, and persist it to the personal space. Idempotent — reuses
-     * an existing in-tab keypair rather than minting a second one.
-     */
-    async provision(memberId, seedSecret) {
-        const ks = KeyStore.getInstance();
-        if (!ks.getKeyPair(memberId)) {
-            try {
-                await ks.generateOwnKeyPair(memberId);
-            }
-            catch (e) {
-                if (!String(e?.message ?? e).includes("already exists"))
-                    throw e;
-            }
-        }
-        const dehydrated = await ks.dehydrateKeyPair(memberId);
-        const plaintext = new TextEncoder().encode(JSON.stringify(dehydrated));
-        await this.store.put(CHAT_KEYS_KEY, await wrapWithPassphrase(seedSecret, plaintext));
-        vlog(`provision: minted+persisted keypair fp=${await fingerprint(memberId)}`);
-    }
-    /**
-     * Sign-in / unlock time: fetch the wrapped blob, unwrap with the seed, and
-     * hydrate the `KeyStore` — restoring the SAME keypair the member had before.
-     * Returns `true` when a keypair is now in hand (already present or hydrated),
-     * `false` when there's no blob yet (a brand-new member → caller provisions).
-     * Throws only on a genuine unwrap failure (wrong secret / tampered blob).
-     */
-    async rehydrate(memberId, seedSecret) {
-        // Already unlocked in this tab — nothing to do.
-        if (KeyStore.getInstance().getKeyPair(memberId)?.privateKey)
-            return true;
-        const wrapped = await this.store.get(CHAT_KEYS_KEY);
-        if (!wrapped) {
-            vlog("rehydrate: no chat-keys blob (new member → will provision)");
-            return false;
-        }
-        const bytes = await unwrapWithPassphrase(seedSecret, wrapped);
-        const dehydrated = JSON.parse(new TextDecoder().decode(bytes));
-        await KeyStore.getInstance().hydrateKeyPair(memberId, dehydrated);
-        vlog(`rehydrate: HIT — restored stable keypair fp=${await fingerprint(memberId)}`);
-        return true;
-    }
-    /**
-     * Ensure a stable keypair is in hand: rehydrate from the vault if a blob
-     * exists, otherwise mint one and persist it (so it's stable next session).
-     * Used at register and lazily when a space is first opened.
-     */
-    async ensure(memberId, seedSecret) {
-        if (await this.rehydrate(memberId, seedSecret))
-            return;
-        await this.provision(memberId, seedSecret);
-    }
-}
-
 /**
  * `HlcTimestamp` — a Hybrid Logical Clock reading, packed into a single
  * lexicographically-sortable string so the whole offline layer (and the
@@ -16612,8 +18478,9 @@ class ConnectivityManager {
  * mutation by re-invoking the real namespace method (with an `isReplay` flag so
  * it doesn't re-enqueue). `drain()` replays entries in HLC order:
  *   - success → remove the entry;
- *   - permanent failure (4xx) → drop it and surface a `SYNC_ERROR` (a write the
- *     server will never accept must not wedge the queue forever);
+ *   - permanent failure (4xx, or a Space whose member list refuses this user)
+ *     → drop it and surface a `SYNC_ERROR` (a write the server will never
+ *     accept must not wedge the queue forever);
  *   - transient/network failure → stop draining and leave the rest for the next
  *     reconnect.
  *
@@ -16688,9 +18555,13 @@ class OutboundQueue {
         }
     }
 }
-/** A 4xx is the server permanently refusing the write; anything else is worth
- *  retrying on the next reconnect. */
+/** A 4xx is the server permanently refusing the write, and so is a Space whose
+ *  member list does not admit this user (design §4.5.12): the relay refuses
+ *  their frames. Anything else, a locked session included, is worth retrying
+ *  on the next reconnect. */
 function isPermanent(err) {
+    if (err instanceof AdmissionDeniedError)
+        return true;
     return err instanceof HttpError && err.status >= 400 && err.status < 500;
 }
 
@@ -17478,6 +19349,8 @@ class Client {
     message;
     /** Fan-out group spaces — `client.space.createSpace(...)`, etc. */
     space;
+    /** Trust records shared by every Space: pins and per-Space log heads (design §3.4, §6.9). */
+    trust;
     /** Programmable Agents — `client.agents.create(appId, …)`, etc. */
     agents;
     /** Serverless functions — `client.functions.deploy(appId, …)`, etc. */
@@ -17617,7 +19490,7 @@ class Client {
                 contentSpace = (async () => {
                     const existing = await personalStore.get(VFS_SPACE_KEY);
                     if (typeof existing === "string" && existing)
-                        return this.space.get(existing);
+                        return this.space.get(existing, "static", { messaging: false });
                     // `messaging: false` — this space only ever holds files, and
                     // file chunks carry their own keys, so it needs no group
                     // keyring and no socket. Creating it the normal way opens a
@@ -17644,9 +19517,9 @@ class Client {
                 // GC. `storage.writeFile` would additionally index the manifest
                 // in the space — a second, diverging source of truth for a file
                 // whose handle the VFS already holds.
-                write: async (data, meta) => {
+                write: async (data, meta, opts) => {
                     const space = await resolveContentSpace();
-                    const { manifest, stat } = await space.putFile(data, { name: meta.name, type: meta.type });
+                    const { manifest, stat } = await space.putFile(data, { name: meta.name, type: meta.type }, { onProgress: opts?.onProgress });
                     return { manifest, size: stat.size };
                 },
                 // Reads go through the manifest alone — no space needed. That is
@@ -17704,6 +19577,16 @@ class Client {
             },
         };
         const chatKeys = new ChatKeyVault(chatKeyStore);
+        // Shared by every Space (and, in sub-project 4, DMs): the account's
+        // identity signer, the identity directory, and the pin/log-head store
+        // (design §3.4, §6.9). Built before `SpaceNamespace` so it can hand the
+        // namespace a reference to wire into each Space it builds.
+        const trustContext = new TrustContext({ http: this.http, session: this.session });
+        this.trust = {
+            get persistent() { return trustContext.persistent; },
+            unpin: (u) => trustContext.unpinUser(u),
+            resetSpacePins: (id) => trustContext.resetSpacePins(id),
+        };
         this.space = new SpaceNamespace({
             http: this.http,
             session: this.session,
@@ -17712,6 +19595,7 @@ class Client {
             offline: this.offline,
             p2p: options.p2p,
             chatKeys,
+            trust: trustContext,
         });
         this.agents = new AgentsNamespace({ http: this.http });
         this.functions = new FunctionsNamespace({ http: this.http, fnHostSuffix: options.functionsHostSuffix });
@@ -18099,7 +19983,7 @@ class DoubleRatchetCipher {
         if (!sessionId) {
             throw new Error("DoubleRatchetCipher: no active session to seal under");
         }
-        const cipherMessage = await this.deps.ratchetManager.encrypt(this.deps.clientId, this.deps.serverId, sessionId, serializedMessage, false, // newDhKey — let the ratchet manage key rotation
+        const cipherMessage = await this.deps.ratchetManager.encrypt(this.deps.clientId, this.deps.serverId, sessionId, serializedMessage, false, // newDhKey — rotation is disabled until the key-schedule rewrite (audit H1)
         this.deps.sessionType);
         return { encrypted: true, cipherMessage: JSON.stringify(cipherMessage) };
     }
@@ -18135,5 +20019,5 @@ var bundledLoader = /*#__PURE__*/Object.freeze({
   default: loadRsWasm
 });
 
-export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES$1 as AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES$1 as AES_GCM_TAG_BYTES, AccessTokensNamespace, AgentsNamespace, AuthClient, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IndexedDbStore, KEEPER_MEMBER_ID, KeyStore, KeyringClient, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64$2 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64$2 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
+export { ACCESS_TOKEN_SCOPES, AES_GCM_IV_BYTES$1 as AES_GCM_IV_BYTES, AES_GCM_KEY_BYTES, AES_GCM_TAG_BYTES$1 as AES_GCM_TAG_BYTES, AccessTokensNamespace, AdmissionDeniedError, AgentsNamespace, AuthClient, AuthHttpError, AuthNamespace, AuthPublicInput, Authenticator, BlockEngine, BroadcastChannel, BroadcastChannelEvents, ChannelExistsError, ChannelNotFoundError, ChunkCipher, CircuitIntegrityError, Client, ConnectivityManager, DEFAULT_AUTH_BASE_URL, DEFAULT_BASE_URL, DEFAULT_BRANCH, DEFAULT_FN_HOST_SUFFIX, DEVICE_IDENTITY_STORAGE_KEY, DEVICE_KEY_DB_NAME, DbCache, DbNamespace, DbTable, DevicePairingError, DeviceRevokedError, DeviceStoreUnavailableError, DoubleRatchet, DoubleRatchetCipher, DoubleRatchetManager, EncryptedSession, EventCore, EventCoreEvents, Field, Field as FieldElement, FileStorage, FunctionsNamespace, HLC, HashKnowledge, HostedAuth, HttpClient, HttpError, IdentityLockedError, IdentityUnavailableError, IndexedDbStore, KEEPER_MEMBER_ID$1 as KEEPER_MEMBER_ID, KeyStore, KeyringClient, KeyringHttpError, KvCache, KvNamespace, LocalEngineHost, LocalStorageSessionStore, Logger, MemorySessionStore, Message, Message as MessageDefault, MessageNamespace, MuhkooAgent, MuhkooDB, MuhkooFunction, MuhkooSpace, NOT_MEMBER_CLOSE_CODE, NOT_MEMBER_RECHECK_MS, NoopStore, OfflineLockedError, OfflineManager, OutboundQueue, P2P_SUBJECT, PAIRING_CODE_ALPHABET, PAIRING_CODE_LENGTH, PBKDF2_DEFAULT_ITERATIONS, PINNED_CIRCUIT_DIGESTS, PREIMAGE_POK_VERIFICATION_KEY, Packet, PasskeyOriginError, PeerExchange, PeerNetwork, PersonalSpaceClient, Poseidon, PreimagePoK, ROOT_ID, Ready, ReauthRequiredError, ReedSolomonCodec, Repo, Retry, Space as Room, SerializeMessage, SessionState, ShardCache, ShardClient, SharedSpaceClient, SnapshotNamespace, Space, SpaceCache, SpaceKeyring, SpaceNamespace, SpacePacketCipher, SpaceSignaler, SpaceTrustError, StorageNamespace, SyncEngine, VERSION, VFS_ROOT_INFO, VaultProtocolMismatchError, VaultUnavailableError, VcsError, VcsNamespace, VfsConflictError, VfsCorruptRecordError, VfsLimitError, VfsLockedError, VfsNamespace, VfsNotFoundError, WSTransport, WebRtcTransport, WorkerEngineHost, ZERO_HLC, ZkAuth, _accountId, _formatBytes, _messageId, _objectId, _packetId, _socketId, _userId, appLogger$1 as appLogger, assertType, base58Decode, base58Encode, buildCommitment, canonicalUserCode, clearDeviceIdentity, compareHlc, compilePrograms, concatBytes$1 as concatBytes, configureDeviceStore, createPasskeyWithPrf, decodeFromHex, decorators, decryptAesGcm, defaultCircuitUrls, defaultRpId, defaultSessionStore, deleteBeatsWrite, deleteRegister, deriveAesKeyFromPassphrase, deriveBitsHkdf, deriveIdentity, deriveIdentityFromSeed, deriveMasterSeedFromPassword, deserialize, deviceFingerprint, deviceIdentityIsEphemeral, deviceIdentityKey, dirKey, ejectAgentPrompt, ejectAgentTools, emptyMap, emptyRegister, encodeToHex, encryptAesGcm, evaluatePasskeyPrf, exportPublicKeyBase64, exportPublicKeyHex, formatUserCode, fromBase64$2 as fromBase64, fromBase64Url, fromHex, generateAuthProof, generateChecksum, generateDevicePairingKeypair, generateId, generatePkce, getIPAddress, getId, getMuhkooAppDescriptor, getSubtle, hasDeviceIdentity, headKey, historyKey, initBn128Wasm, initRsWasm, initializeCircuits, isNewer, isNumber, isOfflineCapable, isP2pCapable, isProvisional, isSameOriginPath, loadDeviceIdentity, log, manifestToStat, materializeRow, merge3, merge3Text, mergeKey, mergeMap, mergeMessage, mergeRegister, messageKey, objectKey, pack, padHandle, pairingVerificationCode, passkeyPrfCapable, passkeySupported, passkeyUsableFromOrigin, persistDeviceIdentity, poseidonHash, protocol, provisionalHandle, quickVerify, randomBytes, randomState, refKey, refsIndexKey, rpIdUsableForOrigin, sealSeed, sealSeedToDevice, serialize, shardHash, signMessage, stableStringify, toBase64$2 as toBase64, toBase64Url, toField, toHex, tombstoneRow, unpack, unsealSeed, unsealSeedFromDevice, unwrapWithPassphrase, utf8Decode, utf8Encode, verify, verifyChecksum, verifyGroth16, verifyHashKnowledge, verifyPreimagePoK, wrapWithPassphrase, writeBeatsTombstone, writeColumns, writeRegister };
 //# sourceMappingURL=index.js.map