@staix/agent-hub 0.20.0 → 0.22.0

package/src/rooms/wire.ts

@@ -0,0 +1,465 @@
+/** Rooms wire v1. Persistence, publication, transport and envelope policy belong to X3/X4. */
+import {
+  assertRoomCryptoReady, decodeBase64url, encodeBase64url, randomBytes,
+  encryptEpoch, decryptEpoch, importEpochKey, generateEpochKey, sha256,
+  signBytes, verifyBytes, hmac, verifyHmac, wrapEpochKey, unwrapEpochKey, assertAgreementKeyUsable,
+  type HubIdentity, type PublicHubIdentity, type EpochKey, type WrappedEpochKey,
+} from "./crypto.ts";
+
+export const ROOM_WIRE_LIMITS = Object.freeze({
+  plaintext: 65536, frame: 131072, roster: 524288, enrollment: 16384,
+  members: 64, recipients: 64, exposedPeers: 64,
+});
+export type RoomWireCode = "invalid_wire" | "limit" | "untrusted" | "wrong_epoch" |
+  "authentication_failed" | "state_unavailable" | "state_changed" | "expired";
+export class RoomWireError extends Error {
+  constructor(readonly code: RoomWireCode) { super(`Room wire: ${code}`); this.name = "RoomWireError"; }
+}
+function fail(code: RoomWireCode = "invalid_wire"): never { throw new RoomWireError(code); }
+const enc = new TextEncoder();
+const U64_MAX = 18446744073709551615n;
+const ID = /^[a-z][a-z0-9-]{0,31}$/;
+const FP = /^[0-9a-f]{64}$/;
+export interface RoomMember extends PublicHubIdentity { label: string; exposedPeers: string[] }
+export interface FrameWire {
+  v: 1; type: "frame"; room: string; epoch: string; sender: string;
+  recipients: string[]; seq: string; nonce: string; ciphertext: string; signature: string;
+}
+export interface RosterWire {
+  v: 1; type: "roster"; room: string; epoch: string; owner: string;
+  members: PublicHubIdentity[]; wraps: WrappedEpochKey[];
+  privateNonce: string; privateCiphertext: string; signature: string;
+}
+export interface InviteWire {
+  v: 1; type: "invite"; room: string; owner: string; broker: string;
+  inviteId: string; expiresAt: number; secret: string;
+}
+export interface JoinWire {
+  v: 1; type: "join"; room: string; owner: string; inviteId: string;
+  member: PublicHubIdentity; nonce: string; privateNonce: string;
+  privateCiphertext: string; signature: string; mac: string;
+}
+
+/** Lexicographic ASCII object keys, preserved array order, no optional/unknown values. */
+export function canonicalBytes(value: unknown): Uint8Array {
+  function visit(x: unknown, depth: number): unknown {
+    if (depth > 12) fail("limit");
+    if (x === null || typeof x === "boolean" || typeof x === "string") return x;
+    if (typeof x === "number" && Number.isSafeInteger(x) && !Object.is(x, -0)) return x;
+    if (Array.isArray(x)) return x.map(item => visit(item, depth + 1));
+    if (typeof x !== "object" || x === null || Object.getPrototypeOf(x) !== Object.prototype) fail();
+    const out: Record<string, unknown> = {};
+    for (const key of Object.keys(x).sort()) {
+      if (key === "__proto__" || key === "constructor" || key === "prototype") fail();
+      out[key] = visit((x as Record<string, unknown>)[key], depth + 1);
+    }
+    return out;
+  }
+  return enc.encode(JSON.stringify(visit(value, 0)));
+}
+function object(x: unknown, keys: string[]): Record<string, unknown> {
+  if (typeof x !== "object" || x === null || Array.isArray(x)) fail();
+  const o = x as Record<string, unknown>;
+  if (Object.keys(o).length !== keys.length || keys.some(key => !Object.hasOwn(o, key))) fail();
+  return o;
+}
+function text(x: unknown): string { if (typeof x !== "string") fail(); return x; }
+function fingerprint(x: unknown): string { const s = text(x); if (!FP.test(s)) fail(); return s; }
+function id(x: unknown): string { const s = text(x); if (!ID.test(s)) fail(); return s; }
+function b64(x: unknown, length?: number, max: number = ROOM_WIRE_LIMITS.roster): string {
+  const s = text(x);
+  if (s.length > Math.ceil(max * 4 / 3) || !/^[A-Za-z0-9_-]*$/.test(s)) fail("limit");
+  try { decodeBase64url(s, length); } catch { fail(); }
+  return s;
+}
+export function positiveU64(x: unknown): string {
+  const s = text(x);
+  if (!/^[1-9][0-9]{0,19}$/.test(s) || BigInt(s) > U64_MAX) fail();
+  return s;
+}
+function sorted<T>(values: T[], key: (x: T) => string): T[] {
+  for (let i = 1; i < values.length; i++) if (key(values[i - 1]!) >= key(values[i]!)) fail();
+  return values;
+}
+function array<T>(x: unknown, max: number, parse: (x: unknown) => T, nonempty = false): T[] {
+  if (!Array.isArray(x) || x.length > max || (nonempty && x.length === 0)) fail("limit");
+  return x.map(parse);
+}
+function publicIdentity(x: unknown): PublicHubIdentity {
+  const o = object(x, ["fingerprint", "signingKey", "agreementKey"]);
+  return { fingerprint: fingerprint(o.fingerprint), signingKey: b64(o.signingKey, 32), agreementKey: b64(o.agreementKey, 32) };
+}
+function exposed(x: unknown): string[] { return sorted(array(x, 64, id), x => x); }
+function privateMember(x: unknown): RoomMember {
+  const o = object(x, ["fingerprint", "signingKey", "agreementKey", "label", "exposedPeers"]);
+  return { ...publicIdentity({ fingerprint: o.fingerprint, signingKey: o.signingKey, agreementKey: o.agreementKey }), label: id(o.label), exposedPeers: exposed(o.exposedPeers) };
+}
+function base(o: Record<string, unknown>, type: string): void { if (o.v !== 1 || o.type !== type) fail(); }
+function ciphertext(x: unknown, max: number, exact?: number): string {
+  const s = b64(x, exact, max);
+  const n = decodeBase64url(s).length;
+  if (n < 16 || n > max) fail("limit");
+  return s;
+}
+function wrap(x: unknown): WrappedEpochKey {
+  const o = object(x, ["v", "owner", "recipient", "ephemeralKey", "salt", "nonce", "ciphertext", "signature"]);
+  if (o.v !== 1) fail();
+  return { v: 1, owner: fingerprint(o.owner), recipient: fingerprint(o.recipient), ephemeralKey: b64(o.ephemeralKey, 32), salt: b64(o.salt, 32), nonce: b64(o.nonce, 12), ciphertext: ciphertext(o.ciphertext, 48, 48), signature: b64(o.signature, 64) };
+}
+function parseFrame(x: unknown): FrameWire {
+  const o = object(x, ["v", "type", "room", "epoch", "sender", "recipients", "seq", "nonce", "ciphertext", "signature"]); base(o, "frame");
+  return { v: 1, type: "frame", room: b64(o.room, 32), epoch: positiveU64(o.epoch), sender: fingerprint(o.sender), recipients: sorted(array(o.recipients, 64, fingerprint, true), x => x), seq: positiveU64(o.seq), nonce: b64(o.nonce, 12), ciphertext: ciphertext(o.ciphertext, 65552), signature: b64(o.signature, 64) };
+}
+function parseRoster(x: unknown): RosterWire {
+  const o = object(x, ["v", "type", "room", "epoch", "owner", "members", "wraps", "privateNonce", "privateCiphertext", "signature"]); base(o, "roster");
+  const members = sorted(array(o.members, 64, publicIdentity, true), x => x.fingerprint);
+  const wraps = sorted(array(o.wraps, 64, wrap, true), x => x.recipient);
+  const owner = fingerprint(o.owner);
+  if (!members.some(m => m.fingerprint === owner) || wraps.length !== members.length || wraps.some((w, i) => w.owner !== owner || w.recipient !== members[i]!.fingerprint)) fail();
+  return { v: 1, type: "roster", room: b64(o.room, 32), epoch: positiveU64(o.epoch), owner, members, wraps, privateNonce: b64(o.privateNonce, 12), privateCiphertext: ciphertext(o.privateCiphertext, 524288), signature: b64(o.signature, 64) };
+}
+export function brokerUrl(x: unknown): string {
+  const s = text(x); if (s.length > 2048 || !/^[\x21-\x7e]+$/.test(s)) fail();
+  let u: URL; try { u = new URL(s); } catch { fail(); }
+  if (u.username || u.password || u.hash || !u.hostname || (u.protocol !== "wss:" && !(u.protocol === "ws:" && (u.hostname === "127.0.0.1" || u.hostname === "[::1]")))) fail();
+  if (u.href !== s) fail(); return s;
+}
+function timestamp(x: unknown): number { if (typeof x !== "number" || !Number.isSafeInteger(x) || x <= 0) fail(); return x; }
+function parseInvite(x: unknown): InviteWire {
+  const o = object(x, ["v", "type", "room", "owner", "broker", "inviteId", "expiresAt", "secret"]); base(o, "invite");
+  return { v: 1, type: "invite", room: b64(o.room, 32), owner: fingerprint(o.owner), broker: brokerUrl(o.broker), inviteId: b64(o.inviteId, 32), expiresAt: timestamp(o.expiresAt), secret: b64(o.secret, 32) };
+}
+function parseJoin(x: unknown): JoinWire {
+  const o = object(x, ["v", "type", "room", "owner", "inviteId", "member", "nonce", "privateNonce", "privateCiphertext", "signature", "mac"]); base(o, "join");
+  return { v: 1, type: "join", room: b64(o.room, 32), owner: fingerprint(o.owner), inviteId: b64(o.inviteId, 32), member: publicIdentity(o.member), nonce: b64(o.nonce, 32), privateNonce: b64(o.privateNonce, 12), privateCiphertext: ciphertext(o.privateCiphertext, 4096), signature: b64(o.signature, 64), mac: b64(o.mac, 32) };
+}
+function decode<T>(input: Uint8Array, max: number, parse: (x: unknown) => T): T {
+  if (!(input instanceof Uint8Array) || input.length > max) fail("limit");
+  let raw: unknown;
+  try { raw = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(input)); } catch { fail(); }
+  const result = parse(raw), bytes = canonicalBytes(result);
+  if (bytes.length !== input.length || bytes.some((b, i) => input[i] !== b)) fail();
+  return result;
+}
+export const decodeFrame = (input: Uint8Array): FrameWire => decode(input, ROOM_WIRE_LIMITS.frame, parseFrame);
+export const decodeRoster = (input: Uint8Array): RosterWire => decode(input, ROOM_WIRE_LIMITS.roster, parseRoster);
+export const decodeInvite = (input: Uint8Array): InviteWire => decode(input, ROOM_WIRE_LIMITS.enrollment, parseInvite);
+export const decodeJoin = (input: Uint8Array): JoinWire => decode(input, ROOM_WIRE_LIMITS.enrollment, parseJoin);
+function unsigned<T extends { signature: string }>(x: T): Omit<T, "signature"> { const { signature: _, ...rest } = x; return rest; }
+const domain = (purpose: string, value: unknown): Uint8Array => canonicalBytes(["agent-hub.rooms.v1", purpose, value]);
+const digest = async (bytes: Uint8Array): Promise<string> => encodeBase64url(await sha256(bytes));
+async function authenticateIdentity(identity: PublicHubIdentity): Promise<void> {
+  const hash = await sha256(decodeBase64url(identity.signingKey, 32));
+  if (Array.from(hash, b => b.toString(16).padStart(2, "0")).join("") !== identity.fingerprint) fail("untrusted");
+}
+async function verifyRosterSignature(roster: RosterWire): Promise<void> {
+  const owner = roster.members.find(m => m.fingerprint === roster.owner);
+  if (!owner) fail("untrusted");
+  if (!await verifyBytes(owner, domain("roster-signature", unsigned(roster)), decodeBase64url(roster.signature, 64))) fail("authentication_failed");
+}
+async function verifyFrameSignature(frame: FrameWire, sender: PublicHubIdentity): Promise<void> {
+  if (!await verifyBytes(sender, domain("frame-signature", unsigned(frame)), decodeBase64url(frame.signature, 64))) fail("authentication_failed");
+}
+
+/** Only instances minted by verification carry an epoch key. */
+export interface VerifiedEpoch { readonly room: string; readonly epoch: string; readonly digest: string }
+interface EpochState { roster: RosterWire; members: RoomMember[]; key: EpochKey }
+const epochs = new WeakMap<VerifiedEpoch, EpochState>();
+function state(epoch: VerifiedEpoch): EpochState { const s = epochs.get(epoch); if (!s) fail("untrusted"); return s; }
+function verified(roster: RosterWire, members: RoomMember[], key: EpochKey, hash: string): VerifiedEpoch {
+  const result = Object.freeze({ room: roster.room, epoch: roster.epoch, digest: hash });
+  epochs.set(result, { roster, members, key }); return result;
+}
+export function roomMembers(epoch: VerifiedEpoch): RoomMember[] { return structuredClone(state(epoch).members); }
+function rosterContext(roster: Pick<RosterWire, "room" | "epoch" | "owner" | "members">): Uint8Array {
+  return domain("epoch", { room: roster.room, epoch: roster.epoch, owner: roster.owner, members: roster.members });
+}
+/** minEpoch="0" is initial enrollment only; an installed epoch requires its digest. */
+export interface OwnerPin { room: string; owner: string; minEpoch: string; digest?: string }
+
+async function verifyPinnedRosterEnvelope(input: { wire: Uint8Array; pin: OwnerPin }): Promise<{
+  wire: Uint8Array; roster: RosterWire; rosterDigest: string;
+}> {
+  if (!(input.wire instanceof Uint8Array)) fail();
+  const wire = Uint8Array.from(input.wire);
+  await assertRoomCryptoReady();
+  const roster = decodeRoster(wire), pin = input.pin;
+  if (roster.room !== pin.room || roster.owner !== pin.owner) fail("untrusted");
+  const min = pin.minEpoch === "0" ? "0" : positiveU64(pin.minEpoch);
+  const rosterDigest = await digest(canonicalBytes(roster));
+  if (BigInt(roster.epoch) < BigInt(min)) fail("wrong_epoch");
+  if (roster.epoch === min && (pin.digest === undefined || rosterDigest !== pin.digest)) fail("untrusted");
+  for (const member of roster.members) await authenticateIdentity(member);
+  await verifyRosterSignature(roster);
+  return { wire, roster, rosterDigest };
+}
+
+/** Public proof products intentionally contain no epoch key, wrap, or private metadata. */
+export interface VerifiedPublicRoster {
+  readonly room: string;
+  readonly epoch: string;
+  readonly owner: string;
+  readonly digest: string;
+  readonly members: readonly Readonly<PublicHubIdentity>[];
+}
+interface PublicRosterState { wire: Uint8Array; members: readonly Readonly<PublicHubIdentity>[] }
+const publicRosters = new WeakMap<VerifiedPublicRoster, PublicRosterState>();
+function publicRosterState(proof: VerifiedPublicRoster): PublicRosterState {
+  const state = publicRosters.get(proof);
+  if (!state) fail("untrusted");
+  return state;
+}
+export function publicRosterWire(proof: VerifiedPublicRoster): Uint8Array {
+  return Uint8Array.from(publicRosterState(proof).wire);
+}
+export async function verifyPublicRoster(input: { wire: Uint8Array; pin: OwnerPin }): Promise<VerifiedPublicRoster> {
+  const { wire, roster, rosterDigest } = await verifyPinnedRosterEnvelope(input);
+  const members = Object.freeze(roster.members.map(member => Object.freeze({ ...member })));
+  const proof = Object.freeze({ room: roster.room, epoch: roster.epoch, owner: roster.owner, digest: rosterDigest, members });
+  publicRosters.set(proof, { wire, members });
+  return proof;
+}
+
+export interface VerifiedPublicFrame {
+  readonly room: string;
+  readonly epoch: string;
+  readonly sender: string;
+  readonly seq: string;
+  readonly digest: string;
+  readonly rosterDigest: string;
+  readonly recipients: readonly string[];
+}
+interface PublicFrameState { wire: Uint8Array }
+const publicFrames = new WeakMap<VerifiedPublicFrame, PublicFrameState>();
+function publicFrameState(proof: VerifiedPublicFrame): PublicFrameState {
+  const state = publicFrames.get(proof);
+  if (!state) fail("untrusted");
+  return state;
+}
+export function publicFrameWire(proof: VerifiedPublicFrame): Uint8Array {
+  return Uint8Array.from(publicFrameState(proof).wire);
+}
+export async function verifyPublicFrame(input: { wire: Uint8Array; roster: VerifiedPublicRoster }): Promise<VerifiedPublicFrame> {
+  if (!(input.wire instanceof Uint8Array)) fail();
+  const wire = Uint8Array.from(input.wire);
+  await assertRoomCryptoReady();
+  const roster = input.roster;
+  publicRosterState(roster);
+  const frame = decodeFrame(wire);
+  if (frame.room !== roster.room || frame.epoch !== roster.epoch) fail("wrong_epoch");
+  const sender = roster.members.find(member => member.fingerprint === frame.sender);
+  if (!sender || frame.recipients.some(recipient => !roster.members.some(member => member.fingerprint === recipient))) fail("untrusted");
+  await verifyFrameSignature(frame, sender);
+  const frameDigest = await digest(canonicalBytes(frame));
+  const proof = Object.freeze({ room: frame.room, epoch: frame.epoch, sender: frame.sender, seq: frame.seq,
+    digest: frameDigest, rosterDigest: roster.digest, recipients: Object.freeze([...frame.recipients]) });
+  publicFrames.set(proof, { wire });
+  return proof;
+}
+
+export async function acceptRoomEpoch(input: { wire: Uint8Array; identity: HubIdentity; pin: OwnerPin }): Promise<VerifiedEpoch> {
+  const { roster, rosterDigest } = await verifyPinnedRosterEnvelope(input);
+  const owner = roster.members.find(m => m.fingerprint === roster.owner)!;
+  const own = roster.members.find(m => m.fingerprint === input.identity.public.fingerprint);
+  if (!own || own.signingKey !== input.identity.public.signingKey || own.agreementKey !== input.identity.public.agreementKey) fail("untrusted");
+  const context = rosterContext(roster);
+  const key = await unwrapEpochKey({ recipient: input.identity, owner, context, wrapped: roster.wraps.find(w => w.recipient === own.fingerprint)! });
+  const plain = await decryptEpoch({ key, purpose: "roster", context, nonce: decodeBase64url(roster.privateNonce, 12), ciphertext: decodeBase64url(roster.privateCiphertext) });
+  const privateRoster = decode(plain, ROOM_WIRE_LIMITS.roster, x => {
+    const o = object(x, ["room", "epoch", "members"]);
+    return { room: b64(o.room, 32), epoch: positiveU64(o.epoch), members: sorted(array(o.members, 64, privateMember, true), m => m.fingerprint) };
+  });
+  if (privateRoster.room !== roster.room || privateRoster.epoch !== roster.epoch || privateRoster.members.length !== roster.members.length || privateRoster.members.some((m, i) => canonicalBytes({ fingerprint: m.fingerprint, signingKey: m.signingKey, agreementKey: m.agreementKey }).toString() !== canonicalBytes(roster.members[i]).toString()) || new Set(privateRoster.members.map(m => m.label)).size !== privateRoster.members.length) fail("untrusted");
+  return verified(roster, privateRoster.members, key, rosterDigest);
+}
+export async function createRoomEpoch(input: { owner: HubIdentity; members: RoomMember[]; previous?: VerifiedEpoch }): Promise<{ wire: Uint8Array; epoch: VerifiedEpoch }> {
+  await assertRoomCryptoReady();
+  const members = sorted(input.members.map(privateMember).sort((a, b) => a.fingerprint.localeCompare(b.fingerprint)), m => m.fingerprint);
+  if (!members.length || members.length > 64 || new Set(members.map(m => m.label)).size !== members.length) fail();
+  const owner = input.owner.public.fingerprint;
+  const own = members.find(m => m.fingerprint === owner);
+  if (!own || own.signingKey !== input.owner.public.signingKey || own.agreementKey !== input.owner.public.agreementKey) fail("untrusted");
+  if (input.previous && state(input.previous).roster.owner !== owner) fail("untrusted");
+  for (const member of members) await authenticateIdentity(member);
+  const room = input.previous?.room ?? encodeBase64url(randomBytes(32));
+  const epoch = positiveU64(input.previous ? String(BigInt(input.previous.epoch) + 1n) : "1");
+  const publicMembers = members.map(({ label: _, exposedPeers: __, ...member }) => member);
+  const header = { room, epoch, owner, members: publicMembers }, context = rosterContext(header);
+  const key = await generateEpochKey(), wraps: WrappedEpochKey[] = [];
+  for (const recipient of publicMembers) wraps.push(await wrapEpochKey({ owner: input.owner, recipient, context, key }));
+  const nonce = randomBytes(12);
+  const encrypted = await encryptEpoch({ key, purpose: "roster", context, nonce, plaintext: canonicalBytes({ room, epoch, members }) });
+  const body = { v: 1 as const, type: "roster" as const, ...header, wraps, privateNonce: encodeBase64url(nonce), privateCiphertext: encodeBase64url(encrypted) };
+  const roster = { ...body, signature: encodeBase64url(await signBytes(input.owner, domain("roster-signature", body))) };
+  const wire = canonicalBytes(roster); decodeRoster(wire);
+  return { wire, epoch: verified(roster, members, key, await digest(wire)) };
+}
+
+export interface SequencePort {
+  /** Atomically persist a strictly increasing room/sender counter, never reset on epoch changes.
+   * Refuse unless expectedCurrentDigest is still the installed current roster. */
+  reserve(input: SequenceBinding): Promise<string>;
+  /** Synchronous final fence after encryption/signing. X3 must additionally fence outbox publication. */
+  isCurrent(input: SequenceBinding): boolean;
+}
+export interface SequenceBinding { room: string; sender: string; epoch: string; rosterDigest: string }
+export interface ReplayCommit {
+  room: string; sender: string; recipient: string; seq: string; frameDigest: string;
+  frameEpoch: string; expectedCurrentEpoch: string; expectedCurrentDigest: string;
+  selectedRosterDigest: string;
+  previousExpiresAt: number | null;
+  plaintext: Uint8Array;
+}
+export interface ReplayPort {
+  /** One durable transaction: recheck installed current roster and persisted grace deadline,
+   * reject revoked sender/recipient, compare+advance high-water, and record accepted digest.
+   * Duplicate means a previously accepted identical digest, never an unseen lower seq.
+   * The transaction uses its own local clock, not a remote timestamp or caller's nowMs.
+   * X3 also commits inbox delivery here before any success receipt is created. */
+  accept(input: ReplayCommit): Promise<
+    { status: "accepted"; gap: string } | { status: "duplicate" | "stale" | "conflict" | "trust_changed" }
+  >;
+}
+async function portCall<T>(call: () => Promise<T>): Promise<T> {
+  try { return await call(); } catch { fail("state_unavailable"); }
+}
+function frameContext(epoch: VerifiedEpoch, sender: string): Uint8Array {
+  return domain("sender-key", { room: epoch.room, epoch: epoch.epoch, sender, rosterDigest: epoch.digest });
+}
+function frameAad(frame: Pick<FrameWire, "room" | "epoch" | "sender" | "seq">): Uint8Array {
+  return enc.encode(`${frame.room}|${frame.epoch}|${frame.sender}|${frame.seq}`);
+}
+export async function sealFrame(input: {
+  epoch: VerifiedEpoch; identity: HubIdentity; recipients: string[]; plaintext: Uint8Array; sequence: SequencePort;
+}): Promise<Uint8Array> {
+  await assertRoomCryptoReady();
+  const epoch = input.epoch, identity = input.identity, sequence = input.sequence;
+  const current = state(epoch), sender = identity.public.fingerprint;
+  const member = current.roster.members.find(m => m.fingerprint === sender);
+  if (!member || member.signingKey !== input.identity.public.signingKey || member.agreementKey !== input.identity.public.agreementKey) fail("untrusted");
+  if (!(input.plaintext instanceof Uint8Array) || input.plaintext.length > ROOM_WIRE_LIMITS.plaintext) fail("limit");
+  const recipients = sorted(array(input.recipients, 64, fingerprint, true), x => x);
+  if (recipients.some(fp => !current.roster.members.some(m => m.fingerprint === fp))) fail("untrusted");
+  const plaintext = input.plaintext.slice();
+  if (!sequence || typeof sequence.reserve !== "function" || typeof sequence.isCurrent !== "function") fail("state_unavailable");
+  const binding = { room: epoch.room, sender, epoch: epoch.epoch, rosterDigest: epoch.digest };
+  const seq = positiveU64(await portCall(() => sequence.reserve({ ...binding })));
+  const header = { v: 1 as const, type: "frame" as const, room: epoch.room, epoch: epoch.epoch, sender, recipients, seq };
+  const nonce = randomBytes(12);
+  const encrypted = await encryptEpoch({ key: current.key, purpose: "frame", context: frameContext(epoch, sender), aad: frameAad(header), nonce, plaintext });
+  const body = { ...header, nonce: encodeBase64url(nonce), ciphertext: encodeBase64url(encrypted) };
+  const wire = canonicalBytes({ ...body, signature: encodeBase64url(await signBytes(identity, domain("frame-signature", body))) });
+  decodeFrame(wire);
+  let fresh: boolean; try { fresh = sequence.isCurrent({ ...binding }); } catch { fail("state_unavailable"); }
+  if (fresh !== true) fail("state_changed");
+  return wire;
+}
+export type FrameOpenResult = { status: "accepted"; plaintext: Uint8Array; gap: string } | { status: "duplicate" | "stale" };
+export async function openFrame(input: {
+  wire: Uint8Array; identity: HubIdentity; current: VerifiedEpoch;
+  previous?: { epoch: VerifiedEpoch; expiresAt: number }; replay: ReplayPort; nowMs?: number;
+}): Promise<FrameOpenResult> {
+  await assertRoomCryptoReady();
+  const currentEpoch = input.current, identity = input.identity, replay = input.replay;
+  const frame = decodeFrame(input.wire), current = state(currentEpoch), recipient = identity.public.fingerprint;
+  if (frame.room !== currentEpoch.room || !frame.recipients.includes(recipient)) fail("untrusted");
+  const receiver = current.roster.members.find(m => m.fingerprint === recipient);
+  const sender = current.roster.members.find(m => m.fingerprint === frame.sender);
+  if (!sender || !receiver || receiver.agreementKey !== input.identity.public.agreementKey || receiver.signingKey !== input.identity.public.signingKey) fail("untrusted");
+  let selected = currentEpoch;
+  let previousExpiresAt: number | null = null;
+  if (frame.epoch !== currentEpoch.epoch) {
+    const previous = input.previous;
+    if (!previous || !Number.isSafeInteger(previous.expiresAt) || (input.nowMs ?? Date.now()) >= previous.expiresAt || previous.epoch.room !== frame.room || previous.epoch.epoch !== frame.epoch || BigInt(previous.epoch.epoch) + 1n !== BigInt(currentEpoch.epoch)) fail("wrong_epoch");
+    const prior = state(previous.epoch);
+    const priorSender = prior.roster.members.find(m => m.fingerprint === frame.sender);
+    const priorReceiver = prior.roster.members.find(m => m.fingerprint === recipient);
+    if (!priorSender || !priorReceiver || priorSender.signingKey !== sender.signingKey || priorSender.agreementKey !== sender.agreementKey || priorReceiver.signingKey !== receiver.signingKey || priorReceiver.agreementKey !== receiver.agreementKey || prior.roster.owner !== current.roster.owner) fail("untrusted");
+    selected = previous.epoch; previousExpiresAt = previous.expiresAt;
+  }
+  const selectedState = state(selected);
+  if (frame.recipients.some(fp => !selectedState.roster.members.some(m => m.fingerprint === fp))) fail("untrusted");
+  await verifyFrameSignature(frame, sender);
+  const nonce = decodeBase64url(frame.nonce, 12);
+  const plaintext = await decryptEpoch({ key: selectedState.key, purpose: "frame", context: frameContext(selected, frame.sender), aad: frameAad(frame), nonce, ciphertext: decodeBase64url(frame.ciphertext) });
+  if (plaintext.length > ROOM_WIRE_LIMITS.plaintext) fail("limit");
+  if (!replay || typeof replay.accept !== "function") fail("state_unavailable");
+  const frameDigest = await digest(canonicalBytes(frame));
+  const result = await portCall(() => replay.accept({ room: frame.room, sender: frame.sender, recipient, seq: frame.seq, frameDigest, frameEpoch: frame.epoch, expectedCurrentEpoch: currentEpoch.epoch, expectedCurrentDigest: currentEpoch.digest, selectedRosterDigest: selected.digest, previousExpiresAt, plaintext: plaintext.slice() }));
+  if (!result || typeof result !== "object") fail("state_unavailable");
+  if (result.status === "accepted") {
+    if (typeof result.gap !== "string" || !/^(0|[1-9][0-9]{0,19})$/.test(result.gap) || BigInt(result.gap) > U64_MAX) fail("state_unavailable");
+    return { status: "accepted", plaintext, gap: result.gap };
+  }
+  if (result.status === "duplicate" || result.status === "stale") return { status: result.status };
+  fail("state_changed");
+}
+
+function inviteClaims(invite: InviteWire): Omit<InviteWire, "secret"> { const { secret: _, ...claims } = invite; return claims; }
+export async function createInvite(input: {
+  epoch: VerifiedEpoch; owner: HubIdentity; broker: string; expiresAt: number; nowMs?: number;
+}): Promise<Uint8Array> {
+  await assertRoomCryptoReady();
+  const s = state(input.epoch);
+  if (s.roster.owner !== input.owner.public.fingerprint) fail("untrusted");
+  const expiresAt = timestamp(input.expiresAt);
+  if (expiresAt <= (input.nowMs ?? Date.now())) fail("expired");
+  const token: InviteWire = { v: 1, type: "invite", room: input.epoch.room, owner: s.roster.owner, broker: brokerUrl(input.broker), inviteId: encodeBase64url(randomBytes(32)), expiresAt, secret: encodeBase64url(randomBytes(32)) };
+  const wire = canonicalBytes(token); decodeInvite(wire); return wire;
+}
+function joinCore(join: JoinWire): Omit<JoinWire, "signature" | "mac"> { const { signature: _, mac: __, ...core } = join; return core; }
+function joinContext(invite: InviteWire, member: PublicHubIdentity, nonce: string): Uint8Array {
+  return domain("join-private", { invite: inviteClaims(invite), member, nonce });
+}
+export async function createJoin(input: {
+  invite: Uint8Array; identity: HubIdentity; label: string; exposedPeers: string[]; nowMs?: number;
+}): Promise<Uint8Array> {
+  await assertRoomCryptoReady();
+  const invite = decodeInvite(input.invite);
+  // Joiner preflight tolerates a 10 minute remote-clock difference. Owner expiry is exact.
+  if ((input.nowMs ?? Date.now()) > invite.expiresAt + 600000) fail("expired");
+  const privateData = { label: id(input.label), exposedPeers: exposed(input.exposedPeers) };
+  const member = publicIdentity(input.identity.public), nonce = encodeBase64url(randomBytes(32));
+  await authenticateIdentity(member);
+  const privateNonce = randomBytes(12), secret = decodeBase64url(invite.secret, 32);
+  const key = await importEpochKey(secret);
+  const encrypted = await encryptEpoch({ key, purpose: "invite", context: joinContext(invite, member, nonce), nonce: privateNonce, plaintext: canonicalBytes(privateData) });
+  const core = { v: 1 as const, type: "join" as const, room: invite.room, owner: invite.owner, inviteId: invite.inviteId, member, nonce, privateNonce: encodeBase64url(privateNonce), privateCiphertext: encodeBase64url(encrypted) };
+  const signature = encodeBase64url(await signBytes(input.identity, domain("join-signature", { invite: inviteClaims(invite), request: core })));
+  const body = { ...core, signature };
+  const wire = canonicalBytes({ ...body, mac: encodeBase64url(await hmac(secret, domain("join-mac", { invite: inviteClaims(invite), request: body }))) });
+  decodeJoin(wire); return wire;
+}
+export interface EnrollmentPort {
+  /** Transactionally compare original stored invite digest/expiry against the owner clock,
+   * consume its one-time secret, bind admitted identity + request digest, and persist outcome.
+   * Only the exact same request digest may return duplicate; changed context refuses.
+   * X3 must bind membership publication to this durable enrollment outcome. */
+  consume(input: {
+    room: string; owner: string; inviteId: string; inviteDigest: string; requestDigest: string;
+    expiresAt: number; member: RoomMember;
+  }): Promise<"accepted" | "duplicate" | "refused">;
+}
+export async function acceptJoin(input: {
+  issuedInvite: Uint8Array; wire: Uint8Array; owner: HubIdentity; enrollment: EnrollmentPort; nowMs?: number;
+}): Promise<{ status: "accepted"; member: RoomMember } | { status: "duplicate" }> {
+  await assertRoomCryptoReady();
+  const invite = decodeInvite(input.issuedInvite), join = decodeJoin(input.wire);
+  if (invite.owner !== input.owner.public.fingerprint || join.room !== invite.room || join.owner !== invite.owner || join.inviteId !== invite.inviteId) fail("untrusted");
+  if ((input.nowMs ?? Date.now()) >= invite.expiresAt) fail("expired");
+  const secret = decodeBase64url(invite.secret, 32), core = joinCore(join);
+  if (!await verifyHmac(secret, domain("join-mac", { invite: inviteClaims(invite), request: { ...core, signature: join.signature } }), decodeBase64url(join.mac, 32))) fail("authentication_failed");
+  await authenticateIdentity(join.member);
+  if (!await verifyBytes(join.member, domain("join-signature", { invite: inviteClaims(invite), request: core }), decodeBase64url(join.signature, 64))) fail("authentication_failed");
+  await assertAgreementKeyUsable(join.member);
+  const key = await importEpochKey(secret);
+  const plain = await decryptEpoch({ key, purpose: "invite", context: joinContext(invite, join.member, join.nonce), nonce: decodeBase64url(join.privateNonce, 12), ciphertext: decodeBase64url(join.privateCiphertext) });
+  const privateData = decode(plain, 4096, x => { const o = object(x, ["label", "exposedPeers"]); return { label: id(o.label), exposedPeers: exposed(o.exposedPeers) }; });
+  if (!input.enrollment || typeof input.enrollment.consume !== "function") fail("state_unavailable");
+  const inviteDigest = await digest(canonicalBytes(invite)), requestDigest = await digest(canonicalBytes(join));
+  const member = { ...join.member, ...privateData };
+  const result = await portCall(() => input.enrollment.consume({ room: invite.room, owner: invite.owner, inviteId: invite.inviteId, inviteDigest, requestDigest, expiresAt: invite.expiresAt, member: structuredClone(member) }));
+  if (result === "accepted") return { status: "accepted", member };
+  if (result === "duplicate") return { status: "duplicate" };
+  fail("state_changed");
+}

package/src/ui/index.html

@@ -194,6 +194,8 @@ progress.critical::-moz-progress-bar{background:var(--red)}
 .peer-fold>summary{padding:var(--space-1) 0;color:var(--muted);font-weight:500;font-size:var(--text-xs)}
 .peer-more{padding:var(--space-1) 0 0 var(--space-3);border-left:2px solid var(--line)}
 .notice-warn{color:var(--amber)}
+#rooms-section[data-empty="true"]{display:none}
+.room-metadata{overflow-wrap:anywhere}
 /* Stream: aligned rows. The filter chips and Follow latest sit in the section head, outside the scrolling list, so they stay in view while it scrolls. */
 .stream{padding:0}
 .event{display:grid;grid-template-columns:minmax(0,1fr);gap:var(--space-1);align-items:baseline}
@@ -453,6 +455,8 @@ main[data-stale]>:not(#notice):not(#disconnected){opacity:.6;transition:opacity
 </div>
 <div class="stack">
 <section id="projects-panel" aria-labelledby="projects-title" data-view="agents" hidden><div class="section-head"><h2 id="projects-title">Projects</h2><span id="project-count" class="meta"></span></div><div id="projects"></div></section>
+<section id="schedules-section" aria-labelledby="schedules-title" data-view="agents" hidden><div class="section-head"><h2 id="schedules-title">Schedules</h2><span id="schedule-count" class="meta"></span></div><div id="schedules"></div></section>
+<section id="rooms-section" aria-labelledby="rooms-title" data-view="agents" data-empty="true" hidden><div class="section-head"><h2 id="rooms-title">Rooms</h2><span id="room-count" class="meta"></span></div><div id="rooms"></div></section>
 <section aria-labelledby="peers-title" data-view="agents" hidden><div class="section-head"><h2 id="peers-title">Peers &amp; queues</h2><span id="peer-count" class="meta"></span></div><div id="peers"><div class="skeleton" aria-hidden="true"><span class="skeleton-bar skeleton-tall"></span><span class="skeleton-bar skeleton-tall"></span><span class="skeleton-bar skeleton-tall"></span></div><p class="empty">Loading peers...</p></div></section>
 <section aria-labelledby="permissions-title" data-view="agents" hidden><div class="section-head"><h2 id="permissions-title">Pending approvals</h2><span id="permission-count" class="meta"></span></div><div id="permissions"></div></section>
 <section aria-labelledby="budget-title" data-view="agents" hidden><div class="section-head"><h2 id="budget-title">Usage budgets</h2></div><div id="budget"></div>
@@ -1160,10 +1164,10 @@ function renderPlanning(snapshot) {
   });
 }
 
-function peerMark(peer, reviewer = false) {
+function peerMark(peer, reviewer = false, role) {
   const key = Object.hasOwn(peerPalette, peer || '') ? peer : 'other';
   const mark = el('span', undefined, 'peer-mark peer-' + key), color = el('span', undefined, 'peer-color-dot' + (reviewer ? ' reviewer' : ''));
-  color.setAttribute('aria-hidden', 'true'); mark.append(color, el('span', (reviewer ? 'reviewer: ' : 'owner: ') + (peer || 'unassigned'))); return mark;
+  color.setAttribute('aria-hidden', 'true'); mark.append(color, el('span', (role || (reviewer ? 'reviewer' : 'owner')) + ': ' + (peer || 'unassigned'))); return mark;
 }
 // A sprite icon in the page (#469 R4). Decorative unless a label is given; the text beside it carries the meaning otherwise.
 const icon = (id, label) => {
@@ -1288,7 +1292,11 @@ function taskDetail(task, card, stage, ids, overdue) {
   if(overdue)status.append(badge('Overdue','warn'));
   row.append(status);
   const people = el('section', undefined, 'detail-group'); people.append(el('h4', 'People', 'detail-heading'));
-  people.append(peerMark(task.owner)); if (task.reviewer) people.append(peerMark(task.reviewer, true));
+  const holder = (role, peer, reason) => { const mark = peerMark(peer, role === 'reviewer', role); if (reason) mark.append(el('span', ' (' + reason + ')', 'meta')); people.append(mark); };
+  if (Object.prototype.hasOwnProperty.call(task, 'planner')) holder('planner', task.planner, task.plannerReason);
+  const ownerReason = [task.ownerReason, task.reserved && (!task.owner || task.reserved === task.owner) ? 'reserved' : undefined].filter(Boolean).join('; ');
+  holder('owner', task.owner || task.reserved, ownerReason);
+  if (task.reviewer) holder('reviewer', task.reviewer, task.reviewerReason || (task.sameFamilyFallback === true ? 'same-family fallback' : undefined));
   if(task.role){const guidance='Task guidance: '+task.role+' (grants no authority)';people.append(el('p',guidance,'meta'));row.setAttribute('aria-label',row.getAttribute('aria-label')+', '+guidance);}
   row.append(people);
   if (task.detail) row.append(el('p', task.detail, 'body'));
@@ -1489,6 +1497,75 @@ function formatCounter(c, exact) {
 }
 const USAGE_LIMIT_ROWS = 20;
 const USAGE_COVERAGE_NOTE = 'Coverage: Jcode and Kimi (prior to #285) report hub-counted increments; unrecorded sources are noted as unknown.';
+/** #335: what a schedule row says about its next run. The hub classifies (scheduled, due, waiting, held, paused); the page only words it and never invents a time. */
+function scheduleNextLabel(row) {
+  const at = Number.isSafeInteger(row?.next) && row.next > 0 ? new Date(row.next).toLocaleString() : 'unknown';
+  if (row?.state === 'paused') return 'Paused (would be ' + at + ')';
+  if (row?.state === 'scheduled') return at;
+  if (row?.state === 'due') return 'Due now';
+  if (row?.state === 'waiting') return 'Due, waiting for task #' + row.task + ' to close';
+  if (row?.state === 'held') return 'Due, held (the hub is stopping or recovering)';
+  return 'unknown';
+}
+function renderSchedules(schedules) {
+  const section = $('schedules-section'), target = $('schedules');
+  const rows = Array.isArray(schedules) ? schedules : [];
+  section.dataset.empty = rows.length ? 'false' : 'true';
+  $('schedule-count').textContent = rows.length ? rows.length + (rows.length === 1 ? ' schedule' : ' schedules') : '';
+  target.replaceChildren();
+  if (!rows.length) { empty(target, 'No schedules configured.'); return; }
+  const wrap = el('div', undefined, 'usage-table-wrap'), table = el('table', undefined, 'usage-table'), head = el('tr');
+  for (const name of ['Schedule', 'Every', 'Class', 'State', 'Next run', 'Last run', 'Task']) head.append(el('th', name));
+  table.append(head);
+  for (const row of rows) {
+    const line = el('tr');
+    line.append(el('td', String(row.id)), el('td', String(row.every)), el('td', String(row.class) + ' / ' + String(row.queue)), el('td', String(row.state)),
+      el('td', scheduleNextLabel(row)), el('td', Number.isSafeInteger(row.last) ? new Date(row.last).toLocaleString() : 'never'), el('td', Number.isSafeInteger(row.task) ? '#' + row.task : '-'));
+    if (row.error) line.setAttribute('title', 'Last run failed: ' + String(row.error));
+    table.append(line);
+  }
+  wrap.append(table); target.append(wrap);
+}
+function roomMetadataText(value, pattern, limit) {
+  if (typeof value !== 'string' || value.length > limit) return 'unknown';
+  const match = pattern.exec(value);
+  return match && match[0] === value ? value : 'unknown';
+}
+function roomMetadataCount(value) { return Number.isSafeInteger(value) && value >= 0 ? String(value) : 'unknown'; }
+function renderRooms(rooms) {
+  const section = $('rooms-section'), target = $('rooms');
+  const rows = Array.isArray(rooms) ? rooms : [], unavailable = rooms !== undefined && !Array.isArray(rooms);
+  section.dataset.empty = !unavailable && !rows.length ? 'true' : 'false';
+  $('room-count').textContent = rows.length ? rows.length + (rows.length === 1 ? ' room' : ' rooms') : '';
+  target.replaceChildren();
+  if (unavailable) { empty(target, 'Room metadata unavailable.'); return; }
+  for (const room of rows) {
+    const row = el('div', undefined, 'row room-metadata'), head = el('div', undefined, 'row-head');
+    const name = roomMetadataText(room.name, /^[a-z][a-z0-9-]{0,31}$/, 32);
+    const link = ['online', 'connecting', 'offline', 'left'].includes(room.link) ? room.link : 'unknown';
+    head.append(el('span', name, 'label'), badge(link, link === 'online' ? 'ok' : ''));
+    row.append(head, el('p', 'Room: ' + roomMetadataText(room.room, /^[A-Za-z0-9_-]{43}$/, 43) + ' / epoch ' + roomMetadataText(room.epoch, /^[1-9][0-9]{0,19}$/, 20), 'meta'));
+    row.append(el('p', 'Owner fingerprint: ' + roomMetadataText(room.owner, /^[a-f0-9]{64}$/, 64), 'meta'));
+    row.append(el('p', 'Self fingerprint: ' + roomMetadataText(room.member, /^[a-f0-9]{64}$/, 64) + ' / members: ' + roomMetadataCount(room.memberCount), 'meta'));
+    if (!Array.isArray(room.remotePeers)) row.append(el('p', 'Remote peers: unknown', 'meta'));
+    else if (!room.remotePeers.length) row.append(el('p', 'No exposed remote peers.', 'meta'));
+    else {
+      const peers = el('div', undefined, 'peer-summary');
+      for (const peer of room.remotePeers) {
+        const id = roomMetadataText(peer.id, /^[a-z][a-z0-9-]{0,31}@[a-z][a-z0-9-]{0,31}$/, 65);
+        const state = ['idle', 'busy', 'paused', 'offline'].includes(peer.state) ? peer.state : 'unknown';
+        peers.append(el('span', id + ': ' + state, 'meta'));
+      }
+      row.append(peers);
+    }
+    const stats = room.relays, since = Number.isSafeInteger(stats?.since) && stats.since > 0 ? new Date(stats.since) : undefined;
+    const start = since && Number.isFinite(since.getTime()) ? since.toISOString() : 'unknown';
+    row.append(el('p', 'Relay counters since daemon start (start: ' + start + ')', 'meta'));
+    const counters = el('div', undefined, 'peer-summary');
+    counters.append(el('span', 'Outbound handoffs: ' + roomMetadataCount(stats?.outbound), 'meta'), el('span', 'Inbound admitted: ' + roomMetadataCount(stats?.inbound), 'meta'), el('span', 'Withheld outbound (subset): ' + roomMetadataCount(stats?.withheld), 'meta'));
+    row.append(counters); target.append(row);
+  }
+}
 function renderUsage(usage, tasks, budget) {
   if (!usage) return;
   // A failed read is not a hidden view: replace the old figures with an explicit state so stale totals are never shown as current.
@@ -1642,9 +1719,14 @@ function renderUsage(usage, tasks, budget) {
 }
 // Mirrors windowKind in src/hub/window-kind.ts (the page imports nothing): a window from an older hub has no kind. test/ui.test.ts keeps the two equal.
 function windowKindOf(w) { return w.kind || (w.id === 'tokens' ? 'count' : w.source === 'ahub budget set' ? 'manual' : 'native'); }
+function appendRoleDetails(target, peer) {
+  if (typeof peer.form === 'string') target.append(el('p', 'Form: ' + peer.form, 'meta'));
+  if (Array.isArray(peer.capableRoles)) target.append(el('p', 'Capable roles: ' + (peer.capableRoles.join(', ') || 'none'), 'meta'));
+  if (typeof peer.ownerIsolation === 'boolean') target.append(el('p', 'Owner isolation: ' + (peer.ownerIsolation ? 'isolated' : 'not isolated: ' + (peer.ownerIsolationNote || 'execution root not verified')), 'meta'));
+}
 function render(snapshot) {
   renderNeedsAttention(snapshot);
-  const peers = Object.fromEntries(Object.entries(snapshot.status.peers || {}).map(([id, peer]) => [id, {...peer, ...(snapshot.status.roleInfo || {})[id]}])), ids = Object.keys(peers), starts = Array.isArray(snapshot.starts) ? snapshot.starts : [];
+  const peers = Object.fromEntries(Object.entries(snapshot.status.peers || {}).map(([id, peer]) => [id, {...peer, ...(snapshot.status.roleInfo || {})[id], ...(typeof snapshot.status.ownerIsolation?.[id] === 'boolean' ? {ownerIsolation:snapshot.status.ownerIsolation[id],ownerIsolationNote:snapshot.status.ownerIsolationNotes?.[id]} : {})}])), ids = Object.keys(peers), starts = Array.isArray(snapshot.starts) ? snapshot.starts : [];
   $('peer-count').textContent = ids.length + ' peers';
   syncStarts(snapshot);
   update('peers', [peers, starts, starts.map(start => { const pending = pendingStarts.get(startKey(start.peer)); return pending ? [pending.phase, pending.retryAt || null] : null; })], (target) => {
@@ -1660,11 +1742,14 @@ function render(snapshot) {
       // Summary row (#469 R4): name, state, current task and queue. The diagnostic lines below fold into one disclosure.
       const current = (snapshot.boardLegend || []).find(item => item.peer === id)?.activeTasks, summary = el('p', undefined, 'peer-summary');
       summary.append(el('span', peer.queued + ' queued' + (peer.queuedImportant ? ' (' + peer.queuedImportant + ' important)' : ''), 'meta'), el('span', Array.isArray(current) && current.length ? 'Working on ' + current.map(task => '#' + task).join(', ') : 'No active task', 'meta'));
+      // #878: the session title or current plan item the hub observed, already screened (a stub while private).
+      if (typeof peer.doing?.text === 'string' && peer.doing.text) summary.append(el('span', 'Doing: ' + peer.doing.text, 'meta'));
       row.append(head, summary);
       // A status notice asks a person to act (for example, reattach a native session): it stays visible, never folded away.
       if (typeof peer.statusNotice?.message === 'string' && peer.statusNotice.message) row.append(el('p', peer.statusNotice.message, 'meta notice-warn'));
       const more = el('div', undefined, 'peer-more');
       if (peer.flowRoles) more.append(el('p', 'Flow roles: ' + (peer.flowRoles.join(', ') || 'none'), 'meta'));
+      appendRoleDetails(more, peer);
       if (peer.catalogRoles) { more.append(el('p', 'Catalog guidance: ' + (Array.isArray(peer.catalogRoles.value) ? peer.catalogRoles.value.join(', ') || 'none' : 'unconfirmed'), 'meta')); if (peer.catalogRoles.pending !== undefined) more.append(el('p', 'Pending at next start: ' + (peer.catalogRoles.pending.join(', ') || 'none'), 'meta')); }
       if (peer.needsReview) more.append(el('p', peer.needsReview + ' need review: use ahub queue list', 'meta'));
       if (peer.oldestQueuedAt !== undefined) more.append(el('p', 'Oldest pending: ' + Math.max(0, Math.floor((Date.now() - peer.oldestQueuedAt) / 1000)) + 's', 'meta'));
@@ -1726,6 +1811,8 @@ function render(snapshot) {
   renderMemory(snapshot.memory);
   renderSettings(snapshot.settings, snapshot.roster);
   renderUsage(snapshot.usage, snapshot.tasks, snapshot.budget);
+  renderSchedules(snapshot.schedules);
+  renderRooms(snapshot.rooms);
   const stream = $('stream');
   if (!eventCount) { stream.replaceChildren(); empty(stream, 'No activity yet.'); }
   for (const entry of snapshot.events || []) {