@ours.network/cowork 1.0.6 → 1.0.7

package/docs/03-configuration.md

@@ -10,7 +10,7 @@ The default cowork config file is `~/.ours-cowork/config.json`. It contains only
 }
 ```
 
-Room identity naming is not configurable. Creation uses exactly `ours-cowork:<normalized room name>`; ID-based and slug-based modes are unsupported.
+Room identity naming is not configurable. Creation NFC-normalizes the room name and uses `ours-cowork:<first 52 Unicode code points>`, making the complete SDK identity at most 64 code points without adding an opaque uniqueness suffix. ID-based and slug-based modes are unsupported.
 
 Cowork overrides are `OURS_COWORK_CONFIG`, `OURS_COWORK_STATE_DIR`, and `OURS_COWORK_REST_PORT`. The default console URL is `http://127.0.0.1:3052/`. Setting the REST port enables the loopback listener on that port. Explicitly setting `rest.enabled` to `false` disables both the web console and HTTP room RPC. Configuration, private files, and the complete cowork state directory must remain owned by the daemon account with the modes enforced at startup.
 
@@ -30,6 +30,6 @@ The old cowork keys `brokerUrl` and `daemon`, and the old overrides `OURS_COWORK
 
 Cowork persists each room's exact `identity_name` in durable room metadata before creating that identity. It filters the daemon-global identity list by those local names. This is application bookkeeping only: cowork does not infer ownership, root/role membership, provenance, or a same-user security boundary.
 
-Fresh and packet-pending provisioning never adopt an identity merely because its name exists. An established room is restored only against its durably recorded CID. A collision therefore fails closed. In the rare crash window where the shared daemon committed a new identity before cowork persisted its CID, restart also fails closed rather than guessing ownership. Recovery requires an operator to verify that no cowork room metadata records the candidate CID, explicitly remove that exact orphan with the standard ours identity tooling, and then start or restart the cowork daemon; boot retries the packet-pending create. Identity removal is destructive—do not perform it when provenance is uncertain. `ours-cowork room recover` is unrelated invite-secret recovery and does not provision room identities.
+Fresh and packet-pending provisioning never adopt an identity merely because its name exists. Cowork validates the final name and checks its availability before writing a fresh sentinel; a proven SDK `NAME_INVALID` or `NAME_TAKEN` refusal discards only that exact empty sentinel. An established room is restored only against its durably recorded CID. A collision therefore fails closed. On upgrade, an empty-CID sentinel produced by the former overlength-name defect is rewritten to the bounded name before provisioning; an established non-empty-CID identity is never renamed. A forbidden SDK character retained inside the bounded name remains a typed failure and requires operator-assisted room recreation rather than lossy character replacement. In the rare crash window where the shared daemon committed a new identity before cowork persisted its CID, restart also fails closed rather than guessing ownership. Recovery requires an operator to verify that no cowork room metadata records the candidate CID, explicitly remove that exact orphan with the standard ours identity tooling, and then start or restart the cowork daemon; boot retries the packet-pending create. Identity removal is destructive—do not perform it when provenance is uncertain. `ours-cowork room recover` is unrelated invite-secret recovery and does not provision room identities.
 
 CLI room commands always use `management.sock`; they do not switch to REST. The HTTP listener is unauthenticated and restricted to `127.0.0.1`. Do not expose it through port forwarding, a reverse proxy, or a non-loopback bind.

package/docs/05-room-workflow.md

@@ -8,9 +8,9 @@ ours-cowork room list
 ours-cowork room show <room-id>
 ```
 
-In the web console, choose Create room, enter Name, Goal, and Briefing, and submit once. Names are trimmed and Unicode NFC-normalized, must contain 1–64 Unicode characters, and cannot contain Unicode control or format characters. The normalized name must not collide with an identity already in the shared daemon. The created room is selected automatically and its Invite panel opens. Add invitation requirements one at a time; the UI does not combine room creation and invites into a fabricated atomic operation.
+In the web console, choose Create room, enter Name, Goal, and Briefing, and submit once. Names are trimmed and Unicode NFC-normalized, must contain 1–64 Unicode characters, and cannot contain Unicode control or format characters. The bounded identity name must not collide with an identity already in the shared daemon. The created room is selected automatically and its Invite panel opens. Add invitation requirements one at a time; the UI does not combine room creation and invites into a fabricated atomic operation.
 
-Update the display name with `ours-cowork room settings <room-id> --name "New name"`; other mutable mission fields use the same `room settings` command. A new room identity is exactly `ours-cowork:<normalized creation name>`, and that exact authenticated name is persisted and frozen. Messenger therefore displays the room name from the identity itself rather than separate `room_name` metadata. Renaming a room changes only mutable local metadata; it does not change the identity name, CID, contacts, invites, URLs, history, or earlier author labels. Because identity names are daemon-global, attempting to create another room with the same normalized creation name fails closed. Earlier unreleased ID- and slug-based formats are unsupported and receive no migration. Inspect admitted seats with `room participants`. A room activates only when its recorded invite requirement is satisfied. Roles are display labels; participant identity CIDs, not roles, are authorization keys.
+Update the display name with `ours-cowork room settings <room-id> --name "New name"`; other mutable mission fields use the same `room settings` command. A new room identity is `ours-cowork:<bounded creation name>`: NFC normalization followed by the first 52 Unicode code points, for a 64-code-point maximum including the prefix. That authenticated name is persisted and frozen. Messenger displays the retained human-readable prefix from the identity itself; longer local `room_name` metadata remains available in Cowork. Renaming a room changes only mutable local metadata; it does not change the identity name, CID, contacts, invites, URLs, history, or earlier author labels. Because identity names are daemon-global, the same normalized name—or distinct long names sharing the retained prefix—collides and fails cleanly without a losing room sentinel. Earlier unreleased ID- and slug-based formats are unsupported and receive no migration. Inspect admitted seats with `room participants`. A room activates only when its recorded invite requirement is satisfied. Roles are display labels; participant identity CIDs, not roles, are authorization keys.
 
 Close with `ours-cowork room close <room-id>`. Close is forward-only and removes the live standard SDK room identity while retaining the local archive. Archive deletion is a separate explicit operation described in the limitations topic.
 

package/docs/08-backup-restore.md

@@ -6,7 +6,7 @@ Back up the complete cowork state directory as one unit, preserving ownership an
 
 For restore, stop cowork, replace the complete cowork state directory with the complete backup, restore its original owner and `0700`/`0600` permissions, ensure the shared daemon already contains the corresponding room identities, and then start cowork. Do not merge individual room directories from different snapshots. Restore to a compatible package version and verify `ours-cowork status` plus representative `room show` and `room history` calls.
 
-An established room restores only by choosing its exact persisted `ours-cowork:<normalized creation name>` identity with `force: false` and verifying the exact durable identity CID. Mutable `room_name` metadata does not participate in restore or Messenger display. If that exact identity is absent from the shared daemon or its CID differs, startup fails clearly; cowork never renames, adopts, or recreates an established identity. Only a durable `packet_pending` room may create a missing identity.
+An established room restores only by choosing its exact persisted `ours-cowork:<bounded creation name>` identity with `force: false` and verifying the exact durable identity CID. Mutable `room_name` metadata does not participate in established restore. If that exact identity is absent from the shared daemon or its CID differs, startup fails clearly; cowork never renames, adopts, or recreates an established identity. Only a durable `packet_pending` room may create a missing identity. Upgrade recovery may rewrite an empty-CID overlength sentinel to the deterministic 64-code-point bounded name before that first creation; it never rewrites a name with an established CID.
 
 Earlier unreleased ID- and slug-based identity formats are rejected. This unreleased major provides no migration or down-migration.
 

package/docs/10-limitations.md

@@ -15,7 +15,7 @@
 - The web console and HTTP room RPC have no authentication. They bind only to `127.0.0.1` and must not be forwarded, proxied, or exposed remotely.
 - Web updates use periodic polling rather than push. A view can lag daemon state until its next refresh; confirmed mutations trigger an immediate refresh.
 - Browser state is transient apart from the selected-room URL hash. Invite receipts disappear when closed and are not recoverable from browser storage.
-- Room identity names are daemon-global. Creating another room with the same normalized name collides and fails closed. Each identity is exactly `ours-cowork:<normalized creation name>` and freezes at creation, so a later `room_name` edit does not rename Messenger contacts. Interfaces distinguish renamed rooms by CID/room ID; local aliases do not change authenticated provenance.
+- Room identity names are daemon-global. Each identity is `ours-cowork:` plus at most the first 52 code points of the NFC-normalized creation name and freezes at creation. The same name, or distinct long names with the same retained prefix, therefore collides and fails cleanly; Cowork does not append a hash or opaque uniqueness token. A later `room_name` edit does not rename Messenger contacts. Interfaces distinguish renamed rooms by CID/room ID; local aliases do not change authenticated provenance.
 - Fresh and packet-pending provisioning refuses to adopt a same-name identity without a durably recorded expected CID. A crash after shared-daemon identity creation but before cowork's CID save can therefore leave an unproven orphan that prevents startup. After verifying no cowork metadata records its CID, an operator must remove that exact orphan with standard ours identity tooling and restart cowork. This destructive recovery is intentionally manual and fail-closed.
 - Cowork selects room identities by the exact names stored in its local room records. That filter prevents unrelated daemon-global identities from appearing as cowork rooms, but it is bookkeeping rather than an ownership, provenance, membership, or same-user security model.
 - Pre-1.0 custom room actor state cannot be opened by the standard SDK runtime. Back it up with the old release, recreate the room, and re-invite its participants.

package/docs/11-web-console.md

@@ -30,7 +30,7 @@ Every room operation is carried by the single route `POST /rpc` with the envelop
 
 The room activates after its durable invitation requirements are satisfied. Participants shows admitted identities and their invite roles.
 
-Names are trimmed and Unicode NFC-normalized, must contain 1–64 Unicode characters, and cannot contain Unicode control or format characters. At creation, the normalized name must not collide with an identity already in the shared daemon. Change local room metadata in Room settings. The browser continues to route by the opaque room ID; renaming does not change the URL, storage key, or underlying `ours-cowork:<creation name>` identity. Unnamed creation requests use `Room <first 8 room_id characters>`.
+Names are trimmed and Unicode NFC-normalized, must contain 1–64 Unicode code points, and cannot contain Unicode control or format characters. The SDK identity retains at most the first 52 code points after `ours-cowork:`; retained path separators, surrogates, and Unicode line/paragraph separators are also invalid under the SDK contract. At creation, the bounded name must not collide with an identity already in the shared daemon. Change local room metadata in Room settings. The browser continues to route by the opaque room ID; renaming does not change the URL, storage key, or underlying bounded identity. Unnamed creation requests use `Room <first 8 room_id characters>`.
 
 ## Communication and records
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cowork",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Durable ours mission rooms on the shared ours daemon.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",