@real-life/trust-protocol 0.4.0 → 0.5.0

package/dist/membership/holder.js

@@ -1,5 +1,5 @@
 // membership/holder — groups on the holder (lib Stage 2, PR 7a; Membership
-// Tasks 0.19 on Access 0.57, Delivery 0.81): founding, the prelude and
+// Tasks 0.20 on Access 0.57, Delivery 0.82): founding, the prelude and
 // the invite, the accept, admission and welcome, evidence and vouches, on
 // HolderState and the engine. The pure forms and checks are the root
 // module's (membership.ts).
@@ -10,7 +10,7 @@
 //                                  that context is the founder's member
 //                                  anchor, its memberOp the genesis)
 //               membership.invite  the prelude toward a contact (Membership
-//                                  1.2); the invite follows its answer
+//                                  3.5); the invite follows its answer
 //               membership.vouch   a vouch@2 for a held consent pair
 //                                  (Access 5.3), relayed as evidence
 //   decision    group-invite: accept signs and sends the accept (3.2),
@@ -18,21 +18,24 @@
 //   tasks       membership-invite/0.2 (proof absent), membership-accept/0.2
 //               (proof required), membership-evidence/0.2 and /0.1 (proof
 //               absent): channel bindings on member keys (receive.ts);
-//               x-membership-prelude-request/0.1, x-membership-prelude-
-//               reply/0.1 (tuple binding) and x-membership-welcome/0.1
-//               (channel binding), this library's experimental forms; all
-//               signature-class: signed acks
+//               membership-prelude-request/0.1 and membership-prelude-
+//               reply/0.1 (proof required, tuple binding; Membership 3.5),
+//               and x-membership-welcome/0.1 (channel binding), this
+//               library's experimental form; all signature-class: signed acks
 //   keepKeys    the member keys of held groups and of groups on the way in,
-//               and the tuple rkid of every held prelude (sent or answered)
-//   retain      declined and expired invitations leave `joining`
+//               and the tuple rkid of every prelude sent and held, and of an
+//               answered one while its answer may still travel
+//   retain      declined and expired invitations leave `joining`; a
+//               binding once its relationship ended and no open or accepted
+//               invitation rests on it (RLTP-MT-3945)
 //
 // Choices this file makes where spec and note leave them open:
-//   - the prelude is application-level (Membership 1.2): this library
-//     carries it over the relationship tuple as two experimental, signed
-//     documents; the invitee's holder answers on its own, registering its member label and key first (Identity 6.1),
+//   - the prelude (Membership 3.5) travels over the relationship tuple as
+//     its two registered types; the invitee's holder answers on its own
+//     (3960), registering its member label and key first (Identity 6.1),
 //     with a displayed member card (2.6) whose key the invite is sealed
 //     to. An answer is taken only on a thread whose request this holder
-//     sent (the outbox holds it)
+//     sent and still holds, on its tuple (3965)
 //   - the welcome: Membership 3.3 carries it in access-operation/0.1 with
 //     a member.add envelope and a sealed rltp-welcome/0.1 (Section 4),
 //     Access's materialization deciding; until the Access envelope is
@@ -45,34 +48,37 @@
 //     3.3), a member's the oid of its accept document's digest (a member admitted later is
 //     unknown to earlier members until their port materializes it)
 //   - the admission without a human act at the admitting member: the
-//     invitation is read as the anticipated admission act — the inviter
-//     decided when it invited, so the accept (n = 1) or the evidence that
-//     completes the vouches admits in the same commit. Membership 3280
-//     (the accept grants nothing) and 3800 (evidence grants nothing) can be
-//     read against this; an open spec reading for Membership 0.20, no
-//     admission prompt yet
+//     invitation stands as the inviter's act of admission (RLTP-MT-3282),
+//     so the accept (n = 1) or the evidence that completes the vouches
+//     admits in the same commit — before invite.validUntil +
+//     membership-skew + the longest give-up horizon by the inviter's
+//     clock; later the consent stays as evidence (an admission prompt is
+//     not built)
 //   - founding: the genesis admits under the rule of one (vouchThreshold
 //     "1"); a stricter rule needs policy.change, which is not built, so
 //     found refuses another (threshold-unsupported). A member's own vouch
 //     for its own invitee never counts beside its admission and is refused
 //     (own-admission)
 //   - the prelude is bound both ways: the request names the inviter's
-//     member anchor and the answering holder files the prelude under
-//     (genesis digest, inviter), so an invite surfaces as the contact that
-//     asked as that inviter; the inviter files its request by thread
+//     member anchor and the answering holder keeps the binding under
+//     (genesis digest, inviter) with the arrival tuple (3925), so an invite
+//     surfaces as the contact that asked as that inviter; the inviter files its request by thread
 //     (group, contact, own rkid) and takes an answer only for exactly that
 //     group on exactly that thread and tuple
 //   - invitations are kept per thread: a new invite opens its own thread
 //     beside earlier ones, so an accept signed in time on an earlier thread
 //     still answers it; an accept answers exactly the invitation of its
 //     thread, and an admission answers every invitation to its subject
+//   - the lock keys of 3950–3957 and 3980: the engine serializes every
+//     operation of a holder and commits by CAS over the whole state
+//     (receive.ts), a superset of every key the rules name
 //   - bounded state (tick): an issued invitation leaves past validUntil +
 //     membership-skew + the longest give-up horizon (P90D, RLTP-MT-3090),
 //     as does evidence (an accept signed in time may arrive that late), or
 //     once its subject is on the roster; an outgoing prelude past an
 //     invite's life and the horizon (its answer may travel that long); an
-//     answered prelude no open or accepted invitation rests on past an
-//     invite's life + skew + P90D; an accepted or joined invitation past
+//     answered prelude's binding once its relationship ended and no open
+//     or accepted invitation rests on it (3945); an accepted or joined invitation past
 //     validUntil + skew + two horizons — the accept's delivery and the
 //     welcome's — so the welcome finds the accepted state and the member
 //     key (kept while an invitation is open or accepted); an explicit abort
@@ -83,9 +89,10 @@
 //     under the inviter's member key over (anchor, group, thread, and both
 //     pair anchors of the channel it travels on, checked against the
 //     document's issuer and recipient as stage 8 authenticated them), so
-//     no other contact can replay it on its own channel; the
-//     answering holder never overwrites a binding (group, inviter) held for
-//     another contact. Residue: the binding links the inviter's member
+//     no other contact can replay it on its own channel (3905, 3910); the
+//     answering holder keeps one binding per relationship (3930, 3935):
+//     a request from another relationship is refused while the bound one
+//     is current, whichever entries they feed. Residue: the binding links the inviter's member
 //     anchor to its pair channel transferably (the invite names that
 //     anchor before consent anyway)
 //   - the admission policy: the group rule vouchThreshold n reads as the
@@ -117,18 +124,17 @@ import { b64uOf, fromB64u, iso, sameDigest, toU } from '../core.js';
 import { anchorOfEd, diSignWith, diVerify, digestBytes, digestDoc } from '../crypto.js';
 import { seal } from '../delivery.js';
 import { cardBody } from '../encounter.js';
-import { ACCEPT_TYPE, EVIDENCE_TYPE, EVIDENCE_TYPE_01, INVITE_TYPE, MEMBERSHIP_SKEW, acceptProblem, enclosedCardOk, evidenceProblem, inviteCredentialBody, inviteProblem, memberLabelOf, membershipSchemaOk, oidOf, vouchCredentialBody, vouchProblem, withinBudget, } from '../membership.js';
+import { ACCEPT_TYPE, EVIDENCE_TYPE, EVIDENCE_TYPE_01, INVITE_TYPE, MEMBERSHIP_SKEW, PRELUDE_REPLY_TYPE, PRELUDE_REQUEST_TYPE, acceptProblem, enclosedCardOk, evidenceProblem, inviteCredentialBody, inviteProblem, inviterBindingBody, memberLabelOf, membershipSchemaOk, oidOf, preludeRequestProblem, vouchCredentialBody, vouchProblem, withinBudget, } from '../membership.js';
 import { withLabel, withPairNonce } from '../identity-state.js';
 import { ED_PKCS8 } from '../keys-seed.js';
 import { tupleByRkid } from '../receive.js';
+import { INVITE_RATE, blockedRel, rateCount, relOfRkid, withRate } from '../message/holder.js';
 import { entryOf, findContact, liveRel, activeTuple } from '../trust/state.js';
 import { groupStarRematch, withGroupHits } from '../trust/group-star.js';
 const TT = 'https://real-life.org/trust-tasks/';
-/** This library's experimental forms (receive.ts SIGNATURE_CLASS). */
-export const PRELUDE_REQUEST_TYPE = TT + 'x-membership-prelude-request/0.1';
-export const PRELUDE_REPLY_TYPE = TT + 'x-membership-prelude-reply/0.1';
+/** This library's experimental form of the welcome (receive.ts SIGNATURE_CLASS). */
 export const WELCOME_TYPE = TT + 'x-membership-welcome/0.1';
-export { INVITE_TYPE, ACCEPT_TYPE, EVIDENCE_TYPE };
+export { INVITE_TYPE, ACCEPT_TYPE, EVIDENCE_TYPE, PRELUDE_REQUEST_TYPE, PRELUDE_REPLY_TYPE };
 /** How long an invite is answerable (validUntil − validFrom), as the probe had it. */
 export const INVITE_LIFE = 24 * 3_600_000;
 /** The longest give-up horizon (Delivery [P1D, P90D]): what late answers may still need (RLTP-MT-3090). */
@@ -161,6 +167,12 @@ const ownName = (state) => {
     return typeof n === 'string' && n.length ? [...n].slice(0, 200).join('') : undefined;
 };
 const groupOfLabel = (state, label) => label === undefined ? undefined : Object.values(state.groups).find((g) => g.memberLabel === label);
+/** RLTP-MT-3282: the inviter admits on its own invitation without a
+ *  further human act only before invite.validUntil + membership-skew +
+ *  the longest give-up horizon, by its own clock; later, the admission
+ *  would wait for a human act, which this library does not offer — the
+ *  consent stays as evidence until its retention lets it go. */
+const admissionOpen = (invite, when) => when < untilOf(invite) + MEMBERSHIP_SKEW + HORIZON_MAX;
 /** The policy (see the header): admitted when vouchThreshold distinct
  *  members stand behind it, the admitting member one of them. */
 function policyMet(g, ev) {
@@ -255,16 +267,18 @@ const inviteDef = {
         const ch = channelTo(ctx.snapshot, input.contactId);
         if (!ch)
             return no('no-own-channel');
+        // no invitation toward a blocked relationship (Message Tasks 6410)
+        if (blockedRel(ctx.snapshot, ch.rel.id))
+            return no('blocked', 'RLTP-MSG-6410');
         const own = await ctx.keys.anchorOf(ch.tuple.ownPairLabel);
         const at = iso(ctx.when);
         const body = {
             id: ctx.entropy.id('doc.id'), type: PRELUDE_REQUEST_TYPE, issuer: own.anchor, recipient: ch.tuple.counterpartAnchor,
             threadId: ctx.entropy.id('thread.id'), issuedAt: at, payload: { genesisDigest: g.id, group: g.did ?? '', name: g.name, inviter: g.memberAnchor, binding: {} },
         };
-        // the inviter's member anchor proven: signed under it over (anchor, group, thread)
-        body.payload.binding = await signDoc(ctx, g.memberLabel, g.memberAnchor, {
-            type: 'x-membership-inviter@0.1', inviter: g.memberAnchor, genesisDigest: g.id, threadId: body.threadId, from: own.anchor, to: ch.tuple.counterpartAnchor,
-        }, at);
+        // the inviter binding (RLTP-MT-3905): signed under the member anchor
+        // over (inviter, genesis digest, thread, from, to)
+        body.payload.binding = await signDoc(ctx, g.memberLabel, g.memberAnchor, inviterBindingBody({ inviter: g.memberAnchor, genesisDigest: g.id, threadId: body.threadId, from: own.anchor, to: ch.tuple.counterpartAnchor }), at);
         const doc = await signDoc(ctx, ch.tuple.ownPairLabel, own.anchor, body, at);
         return sealed(ctx, doc, { contactId: ch.contact.id, rkid: ch.tuple.rkid, keyAgreement: ch.tuple.counterpartKeyAgreement });
     },
@@ -286,22 +300,20 @@ function arrival(state, rkid) {
 const preludeKey = (group, inviter) => `${group} ${inviter}`;
 const preludeRequestTask = {
     proof: 'required',
+    // stage 7: the payload schema (RLTP-MT-3905)
     decode(p) {
-        const x = p;
-        if (x === null || typeof x !== 'object' || Object.keys(x).length !== 5 || typeof x.genesisDigest !== 'string' || typeof x.group !== 'string' ||
-            typeof x.name !== 'string' || typeof x.inviter !== 'string' || !/^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$/.test(x.inviter) ||
-            x.binding === null || typeof x.binding !== 'object')
-            return refuse('malformed');
-        return memberLabelOf(x.genesisDigest) === null ? refuse('validation-failed') : x;
+        if (!membershipSchemaOk('payload-membership-prelude-request.schema.json', p))
+            return refuse('malformed', 'RLTP-MT-3905');
+        return memberLabelOf(p.genesisDigest) === null ? refuse('validation-failed') : p;
     },
     async prepare(ctx, doc, arr) {
-        if (!(await diVerify(doc, doc.issuer, ctx.crypto.subtle)))
-            return refuse('validation-failed', 'RLTP-MT-2130');
-        // the claimed inviter proven by its own member key, for this group and thread
-        const b = doc.payload.binding;
-        if (b.type !== 'x-membership-inviter@0.1' || b.inviter !== doc.payload.inviter || b.genesisDigest !== doc.payload.genesisDigest ||
-            b.threadId !== doc.threadId || b.from !== doc.issuer || b.to !== doc.recipient || !(await diVerify(b, doc.payload.inviter, ctx.crypto.subtle)))
-            return refuse('validation-failed', 'RLTP-MT-3020');
+        // the document proof under its issuer, the binding's fields (genesis
+        // digests by their decoded bytes) and its proof under the inviter
+        // (RLTP-MT-3905, 3910); the issuer and recipient are the arrival
+        // tuple's pair anchors by the core's tuple binding (receive.ts)
+        const bad = await preludeRequestProblem(doc, ctx.crypto.subtle);
+        if (bad)
+            return refuse('validation-failed', bad === 'documentProof' ? 'RLTP-MT-3900' : 'RLTP-MT-3905');
         const a = arrival(ctx.snapshot, arr.rkid);
         const label = memberLabelOf(doc.payload.genesisDigest);
         const member = await ctx.keys.anchorOf(label);
@@ -318,14 +330,17 @@ const preludeRequestTask = {
     apply(state, prepared, doc, arr) {
         const p = prepared.value;
         const a = arrival(state, arr.rkid);
-        // a binding (group, inviter) held for another contact is never
-        // overwritten: compared by the entries the two arrival tuples feed now
-        // (a merge, a split or a chaining since moves it with them); a binding
-        // whose tuple is gone (a departure) is free
+        // the binding per relationship (RLTP-MT-3925–3935): a request under a
+        // held key from a tuple of the bound tuple's relationship replaces the
+        // tuple (3930); from another relationship it is refused while the bound
+        // one is current, whatever entry either feeds (3935), and replaces the
+        // binding once that one has ended. The relationships are read through
+        // the tuples now (3940): a merge, a split or a chaining moves them
         const bound = state.joining.preludes[preludeKey(toU(doc.payload.genesisDigest), doc.payload.inviter)];
-        const was = bound ? arrival(state, bound.rkid) : null;
-        if (was && was.contactId !== a.contactId)
-            return refuse('validation-failed', 'RLTP-MT-3030');
+        const was = bound ? tupleByRkid(state, bound.rkid) : null;
+        const here = tupleByRkid(state, arr.rkid);
+        if (was && liveRel(was.rel) && was.rel.id !== here.rel.id)
+            return refuse('validation-failed', 'RLTP-MT-3935');
         const keys = Object.hasOwn(state.addresses.keys, p.rkid) ? state.addresses.keys : { ...state.addresses.keys, [p.rkid]: { label: p.label, lastShown: arr.when } };
         return {
             state: {
@@ -341,24 +356,23 @@ const preludeRequestTask = {
 };
 const preludeReplyTask = {
     proof: 'required',
+    // stage 7: the payload schema (RLTP-MT-3960)
     decode(p) {
-        const x = p;
-        if (x === null || typeof x !== 'object' || Object.keys(x).length !== 2 || typeof x.genesisDigest !== 'string' || x.card === null || typeof x.card !== 'object')
-            return refuse('malformed');
-        return x;
+        return membershipSchemaOk('payload-membership-prelude-reply.schema.json', p) ? p : refuse('malformed', 'RLTP-MT-3960');
     },
     async prepare(ctx, doc, arr) {
         const s = ctx.snapshot;
         if (!(await diVerify(doc, doc.issuer, ctx.crypto.subtle)))
-            return refuse('validation-failed', 'RLTP-MT-2130');
-        // the answer to exactly the prelude this holder sent: its group, thread and tuple
+            return refuse('validation-failed', 'RLTP-MT-3960');
+        // the answer to exactly the prelude this holder sent and still holds:
+        // its group (genesis digests by their decoded bytes), thread and tuple (3965)
         const g = s.groups[toU(doc.payload.genesisDigest) ?? ''];
         const asked = g?.preludes[doc.threadId];
         if (!g || g.memberAnchor === undefined || !asked || asked.rkid !== arr.rkid)
-            return refuse('validation-failed', 'RLTP-MT-3030');
+            return refuse('validation-failed', 'RLTP-MT-3965');
         const card = doc.payload.card;
         if (!(await enclosedCardOk(card, card.anchor, ctx.crypto.subtle)))
-            return refuse('validation-failed', 'RLTP-MT-2250');
+            return refuse('validation-failed', 'RLTP-MT-3960');
         const a = arrival(s, arr.rkid);
         const S = ctx.crypto.subtle;
         const at = iso(ctx.when);
@@ -381,6 +395,12 @@ const preludeReplyTask = {
         const g = state.groups[toU(doc.payload.genesisDigest)];
         const preludes = { ...g.preludes };
         delete preludes[doc.threadId];
+        // under a block of the relationship the reply arrives on: the waiting
+        // prelude closes, acknowledged, and no invitation is issued or sent —
+        // one transaction with the block check (RLTP-MT-3975, 3980)
+        const rel = relOfRkid(state, arr.rkid);
+        if (rel !== null && blockedRel(state, rel))
+            return { state: { ...state, groups: { ...state.groups, [g.id]: { ...g, preludes } } } };
         // a member is not invited again; every invitation is its own thread,
         // kept beside earlier ones (an accept signed in time may still travel)
         if (Object.hasOwn(g.roster, p.invitee))
@@ -396,44 +416,91 @@ const preludeReplyTask = {
 };
 // ── the invite at the invitee (Membership 3.1) ─────────────────────────
 const invitePromptId = (credDigest) => 'invite:' + credDigest;
+/** The invitation's attribution (RLTP-MT-3100): the relationship of the
+ *  prelude binding held for its genesis digest and issuer, read through
+ *  the binding's tuple now (3940), or none. */
+function attribution(state, inv) {
+    const pre = state.joining.preludes[preludeKey(toU(inv.credentialSubject.genesisDigest) ?? '', inv.issuer)];
+    const relId = pre ? relOfRkid(state, pre.rkid) : null;
+    return pre && relId !== null ? { pre, relId } : null;
+}
+/** Whether the holder holds the credential digest in any record (3105):
+ *  surfaced, declined, or a received invitation. */
+const knownInvite = (state, credDigest) => state.joining.surfaced.includes(credDigest) || state.joining.declined.includes(credDigest) || Object.hasOwn(state.joining.invites, credDigest);
+const sortedWith = (xs, x) => (xs.includes(x) ? [...xs] : [...xs, x].sort());
 const inviteTask = {
     proof: 'absent',
     decode: (p) => (membershipSchemaOk('payload-membership-invite.schema.json', p) ? p : refuse('malformed')),
     // the prelude check (3030): the invite reaches the key of the own
-    // derivation from its genesis digest, after a prelude this holder answered
+    // derivation from its genesis digest. The ack is sealed to the inviter's
+    // card and filed under the contact of the binding's relationship, or
+    // under the member where no binding attributes it (3100)
     channel(state, doc, rkid) {
         const inv = doc.payload.invite;
         const label = memberLabelOf(inv.credentialSubject.genesisDigest);
         if (label === null || state.addresses.keys[rkid]?.label !== label)
             return refuse('validation-failed', 'RLTP-MT-3030');
-        // the contact that asked as this inviter (the prelude's binding)
-        const pre = state.joining.preludes[preludeKey(toU(inv.credentialSubject.genesisDigest) ?? '', inv.issuer)];
-        if (!pre)
-            return refuse('validation-failed', 'RLTP-MT-3030');
-        return { keyAgreement: inv.credentialSubject.card.keyAgreement, contactId: pre.contactId, via: pre.rkid };
+        const at = attribution(state, inv);
+        return at
+            ? { keyAgreement: inv.credentialSubject.card.keyAgreement, contactId: at.pre.contactId, via: at.pre.rkid }
+            : { keyAgreement: inv.credentialSubject.card.keyAgreement, contactId: 'member:' + inv.issuer };
     },
     async prepare(ctx, doc) {
         const bad = await inviteProblem(doc, ctx.crypto.subtle);
         if (bad)
             return refuse('validation-failed', bad);
-        return { credDigest: await digestDoc(doc.payload.invite, ctx.crypto.subtle) };
+        const credDigest = await digestDoc(doc.payload.invite, ctx.crypto.subtle);
+        // the rate (3105, Message Tasks 4115): a digest new to the holder, on a
+        // relationship that accepted 20 new ones in the window, counted before
+        // the block, waits at its carrier: failed(rate-limited) at stage 8,
+        // nothing committed (Delivery RLTP-DEL-6270); a known digest never
+        // counts and is never refused by it
+        const s = ctx.snapshot;
+        const at = attribution(s, doc.payload.invite);
+        if (at && !knownInvite(s, credDigest) && rateCount(s, at.relId, 'invites', ctx.when) >= INVITE_RATE)
+            return refuse('rate-limited', 'RLTP-MT-3105');
+        return { credDigest };
     },
-    // durable buffering and surfacing to the human (3095)
+    // the defined effect (3095): durable buffering and the surfacing
+    // decision, in one transaction under the credential digest's key (3110;
+    // the engine serializes the whole state, receive.ts): exactly one of
+    // decline, surface, or no new effect
     apply(state, prepared, doc, arr) {
         const inv = doc.payload.invite;
         const gd = toU(inv.credentialSubject.genesisDigest);
         const { credDigest } = prepared.value;
-        if (Object.hasOwn(state.groups, gd) || Object.hasOwn(state.joining.invites, credDigest))
-            return { state: state };
-        const pre = state.joining.preludes[preludeKey(gd, inv.issuer)];
+        const at = attribution(state, inv);
+        // the rate counts the new digest before the block is applied (3105, Message Tasks 4130)
+        let next = at && !knownInvite(state, credDigest) ? withRate(state, at.relId, 'invites', arr.when) : state;
+        // decline under a block (3115, Message Tasks 6.4): the register holds
+        // the digest, an open prompt of it closes as declined, silently
+        if (at && blockedRel(state, at.relId)) {
+            const promptId = invitePromptId(credDigest);
+            const prompts = { ...next.prompts };
+            delete prompts[promptId];
+            const held = next.joining.invites[credDigest];
+            const invites = held && held.status === 'open' ? { ...next.joining.invites, [credDigest]: { ...held, status: 'declined' } } : next.joining.invites;
+            return { state: { ...next, prompts, joining: { ...next.joining, invites, declined: sortedWith(next.joining.declined, credDigest) } } };
+        }
+        // no new effect: the register holds it (3120), or it surfaced before
+        // (3125). An invitation into a group the holder holds surfaces like any
+        // other: 3125 names no exception, and the person decides
+        if (next.joining.declined.includes(credDigest) || next.joining.surfaced.includes(credDigest) || Object.hasOwn(next.joining.invites, credDigest))
+            return { state: next };
+        // surface (3125): a prompt opened, the digest kept for the holder's life (3130)
         const validUntil = Date.parse(inv.validUntil);
         const r = {
-            credDigest, group: gd, name: typeof inv.credentialSubject.name === 'string' ? inv.credentialSubject.name : '', contactId: pre.contactId, rkid: pre.rkid,
+            credDigest, group: gd, name: typeof inv.credentialSubject.name === 'string' ? inv.credentialSubject.name : '',
+            ...(at ? { contactId: at.pre.contactId, rkid: at.pre.rkid } : {}),
             memberLabel: memberLabelOf(gd), invite: doc, promptId: invitePromptId(credDigest), validUntil, status: 'open', at: arr.when,
         };
-        const prompt = { id: r.promptId, kind: 'group-invite', contactId: r.contactId, groupId: gd, openedAt: arr.when, expiresAt: validUntil + MEMBERSHIP_SKEW };
+        const prompt = { id: r.promptId, kind: 'group-invite', ...(r.contactId !== undefined ? { contactId: r.contactId } : {}), groupId: gd, openedAt: arr.when, expiresAt: validUntil + MEMBERSHIP_SKEW };
         return {
-            state: { ...state, joining: { ...state.joining, invites: { ...state.joining.invites, [credDigest]: r } }, prompts: { ...state.prompts, [prompt.id]: prompt } },
+            state: {
+                ...next,
+                joining: { ...next.joining, invites: { ...next.joining.invites, [credDigest]: r }, surfaced: sortedWith(next.joining.surfaced, credDigest) },
+                prompts: { ...next.prompts, [prompt.id]: prompt },
+            },
             events: [{ type: 'prompt.opened', promptId: prompt.id, kind: 'group-invite' }],
         };
     },
@@ -458,7 +525,7 @@ const acceptDecision = {
         const doc = await signDoc(ctx, r.memberLabel, me.anchor, body, at);
         if (!withinBudget(doc))
             return no('unknown-group', 'RLTP-MT-2220');
-        const out = await sealed(ctx, doc, { contactId: r.contactId, rkid: rkidOf(ctx.snapshot, r.memberLabel) ?? '', keyAgreement: inv.credentialSubject.card.keyAgreement, anchor: inv.issuer, via: r.rkid });
+        const out = await sealed(ctx, doc, { contactId: r.contactId ?? 'member:' + inv.issuer, rkid: rkidOf(ctx.snapshot, r.memberLabel) ?? '', keyAgreement: inv.credentialSubject.card.keyAgreement, anchor: inv.issuer, ...(r.rkid !== undefined ? { via: r.rkid } : {}) });
         return { ...out, acceptDigest: await digestDoc(doc, ctx.crypto.subtle) };
     },
     apply(state, prompt, choice, when, prepared) {
@@ -554,7 +621,7 @@ const acceptTask = {
             return refuse('validation-failed', bad);
         const acceptDigest = await digestDoc(doc, ctx.crypto.subtle);
         const ev = { invite: inv.invite, accept: doc, vouches: [], at: arr.when };
-        const docs = await admissionDocs(ctx, g, ev, acceptDigest, policyMet(g, ev));
+        const docs = await admissionDocs(ctx, g, ev, acceptDigest, policyMet(g, ev) && admissionOpen(inv.invite, arr.when));
         return { group: g.id, acceptDigest, ...docs };
     },
     // the defined effect: the consent recorded (3280); the admission where
@@ -607,7 +674,7 @@ const evidenceTask = (schema) => ({
         const merged = mergeVouches(held?.vouches ?? [], vouches);
         const ev = { invite, accept, vouches: merged, at: arr.when };
         // the inviter admits once the policy holds (the header)
-        const admit = invite.payload.invite.issuer === g.memberAnchor && !Object.hasOwn(g.roster, accept.payload.accept.subject) && policyMet(g, ev);
+        const admit = invite.payload.invite.issuer === g.memberAnchor && !Object.hasOwn(g.roster, accept.payload.accept.subject) && policyMet(g, ev) && admissionOpen(invite, arr.when);
         const welcome = admit ? (await admissionDocs(ctx, g, ev, acceptDigest, true)).welcome : null;
         return { group: g.id, acceptDigest, vouches, welcome };
     },
@@ -717,7 +784,7 @@ const welcomeTask = {
         const i = acceptedInvite(state, doc);
         if (!i || state.addresses.keys[rkid]?.label !== i.memberLabel)
             return refuse('validation-failed');
-        return { keyAgreement: i.invite.payload.invite.credentialSubject.card.keyAgreement, contactId: i.contactId, via: i.rkid };
+        return { keyAgreement: i.invite.payload.invite.credentialSubject.card.keyAgreement, contactId: i.contactId ?? 'member:' + doc.issuer, ...(i.rkid !== undefined ? { via: i.rkid } : {}) };
     },
     // the group stars already accepted are matched against the joined group (5520)
     async prepare(ctx, doc) {
@@ -743,7 +810,7 @@ const welcomeTask = {
         }
         const roster = {};
         for (const m of welcomeRoster(w.roster).values()) {
-            roster[m.anchor] = { anchor: m.anchor, op: m.op, keyAgreement: m.keyAgreement, ...(m.name !== undefined ? { name: m.name } : {}), addedAt: arr.when, ...(m.anchor === doc.issuer ? { contactId: i.contactId, rkid: i.rkid } : {}) };
+            roster[m.anchor] = { anchor: m.anchor, op: m.op, keyAgreement: m.keyAgreement, ...(m.name !== undefined ? { name: m.name } : {}), addedAt: arr.when, ...(m.anchor === doc.issuer && i.contactId !== undefined && i.rkid !== undefined ? { contactId: i.contactId, rkid: i.rkid } : {}) };
         }
         const g = {
             id: w.genesisDigest, name: w.name, did: w.group, genesis: w.genesis, memberLabel: i.memberLabel, rules: { vouchThreshold: w.vouchThreshold },
@@ -761,7 +828,7 @@ const welcomeTask = {
 // ── keys and retention ─────────────────────────────────────────────────
 /** The member keys still needed: held groups' and those on the way in
  *  (an answered prelude, an invitation open or accepted). */
-function memberKeys(state) {
+function memberKeys(state, when) {
     const labels = new Set(Object.values(state.groups).map((g) => g.memberLabel));
     for (const p of Object.values(state.joining.preludes))
         labels.add(p.memberLabel);
@@ -775,8 +842,11 @@ function memberKeys(state) {
     for (const g of Object.values(state.groups))
         for (const p of Object.values(g.preludes))
             out.push(p.rkid);
+    // an answered prelude's tuple, while its answer and the acks may still
+    // travel; the binding itself lives longer (3945) and needs no key
     for (const p of Object.values(state.joining.preludes))
-        out.push(p.rkid);
+        if (p.at + INVITE_LIFE + MEMBERSHIP_SKEW + HORIZON_MAX >= when)
+            out.push(p.rkid);
     return out;
 }
 const untilOf = (invite) => Date.parse(invite.payload.invite.validUntil);
@@ -797,12 +867,18 @@ function retainMembership(state, when) {
     // the accept → admission → welcome chain: two deliveries, each within a give-up horizon
     const late = (i) => i.validUntil + MEMBERSHIP_SKEW + 2 * HORIZON_MAX < when;
     const invites = Object.fromEntries(Object.entries(state.joining.invites).filter(([, i]) => !(i.status === 'declined' || (i.status === 'open' && i.validUntil + MEMBERSHIP_SKEW < when) || ((i.status === 'accepted' || i.status === 'joined') && late(i)))));
-    // an answered prelude no open or accepted invitation still rests on, past an invite's life and the horizon
-    const rests = (p) => Object.values(invites).some((i) => i.group === p.group && i.contactId === p.contactId && (i.status === 'open' || i.status === 'accepted'));
-    const preludes = Object.fromEntries(Object.entries(state.joining.preludes).filter(([, p]) => rests(p) || p.at + INVITE_LIFE + MEMBERSHIP_SKEW + HORIZON_MAX >= when));
+    // a binding lives while the relationship of its tuple is current or an
+    // invitation attributed to it is open or accepted (RLTP-MT-3945); tick
+    // deletes it in its own serialized commit, deciding on the state it reads
+    // there (3947)
+    // an invitation rests on the binding of its key (genesis digest, inviter):
+    // a renewal may have moved the binding to a newer tuple since (3930)
+    const rests = (p) => Object.values(invites).some((i) => i.group === p.group && i.invite.payload.invite.issuer === p.inviter && (i.status === 'open' || i.status === 'accepted'));
+    const current = (p) => { const t = tupleByRkid(state, p.rkid); return t !== null && liveRel(t.rel); };
+    const preludes = Object.fromEntries(Object.entries(state.joining.preludes).filter(([, p]) => current(p) || rests(p)));
     if (Object.keys(invites).length !== Object.keys(state.joining.invites).length || Object.keys(preludes).length !== Object.keys(state.joining.preludes).length)
         changed = true;
-    return changed ? { ...state, groups, joining: { preludes, invites } } : state;
+    return changed ? { ...state, groups, joining: { ...state.joining, preludes, invites } } : state;
 }
 /** When retainMembership lets something go (the timer contract, engine.ts). */
 function membershipDeadlines(state) {
@@ -821,6 +897,7 @@ function membershipDeadlines(state) {
         if (i.status === 'accepted' || i.status === 'joined')
             out.push(i.validUntil + MEMBERSHIP_SKEW + 2 * HORIZON_MAX + 1);
     }
+    // an answered prelude's tuple key leaves keepKeys then (memberKeys)
     for (const p of Object.values(state.joining.preludes))
         out.push(p.at + INVITE_LIFE + MEMBERSHIP_SKEW + HORIZON_MAX + 1);
     return out;