heyquilt 0.0.1 → 0.3.90

package/src/server.js

@@ -0,0 +1,4187 @@
+// Relay server: holds one shared Yjs document per room, relays updates and
+// presence between clients, stores files shared in chat, and persists rooms
+// to disk. It checks who each client is (see identity.js) and owns the
+// room's claims, so only the person who made a claim can release it (with
+// sign-in on, the account that made it, so two people who share a display
+// name can't release each other's claims). Safe to
+// run on the public internet: rooms need their secret, creating rooms can
+// require a relay key, and rooms have size quotas.
+//
+// Access: a room created with a view-only secret has an owner (the first
+// person to sign in). By default only the owner lets people in; they can
+// open that to editors or anyone in the session. People who may admit
+// approve joiners and give them a role:
+// editors change files, viewers only watch and chat, and agents can be
+// limited to some folders. The relay enforces it by undoing file changes a
+// member isn't allowed to make, before anyone else sees them.
+import http from 'node:http'
+import { makeChatLink, extendChatLink, pruneChatLinks, handleChatLink, fetchPublicFile } from './chat-links.js'
+import fs from 'node:fs'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import os from 'node:os'
+import { fileURLToPath } from 'node:url'
+import { WebSocketServer } from 'ws'
+import * as Y from 'yjs'
+import { handleAgentMcp, handleHostedMcp, watchFeatures } from './relay-mcp.js'
+import { dropCheckpoints } from './relay-turn-sync.js'
+import { UpdateCheck } from './update-check.js'
+import {
+  MSG_SYNC, MSG_AWARENESS, MSG_QUERY_AWARENESS, MSG_AUTH, MSG_CLAIM, MSG_CLAIMS, MAX_SHARED_FILE_BYTES,
+  MSG_ACCESS, MSG_ADMIN, MSG_MEMBERS, MSG_PASS, MSG_BRANCH, MSG_BRANCHES,
+  CLOSE_AUTH_FAILED, CLOSE_NAME_TAKEN, CLOSE_ROOM_FULL, CLOSE_DENIED, CLOSE_ENDED, CLOSE_NEEDS_UPDATE, CLOSE_PASS_EXPIRED,
+  encoding, decoding, syncProtocol, awarenessProtocol,
+  ROOM_DOC, syncHeader,
+  syncStep1Message, updateMessage, awarenessMessage, bytesMessage, jsonMessage
+} from './protocol.js'
+import { BranchStore, DEFAULT_KEY, BRANCH_IDLE_MS, BRANCH_TTL_MS, DETACHED_TTL_MS, MAX_BRANCHES, validBranchKey, covers, splitLegacyDoc } from './branchdocs.js'
+import { parsePublicKey, verifyChallenge } from './identity.js'
+import { verifyPass, PASS_TTL_MS } from './passes.js'
+import { cleanAccess, narrowAccess, relayAccess, fromRelay, sameAccess, mayChange, TALK_REFUSED } from './session-access.js'
+import { canAdmit, cleanAdmitBy, DEFAULT_ADMIT_BY, BAD_ADMIT_BY } from './admit-policy.js'
+import { patternsOverlap } from './fsutil.js'
+import { globMatcher } from './pathrules.js'
+import { personaName, firstName, PERSONA_SEP } from './persona.js'
+import { adoptLegacyEnv } from './legacy.js'
+import { makeStore, DiskStore } from './blobstore.js'
+import { JOIN_HOST } from './ui/invite.js'
+import { PresenceReporter, PRESENCE_FILE } from './presence.js'
+import { cleanSessionName, BAD_SESSION_NAME } from './session-name.js'
+import { hostedWebhooks } from './relay-webhooks.js'
+import { noteCloudAi, cloudAiWaker } from './relay-ai-vm.js'
+import { normalizeHosted, hostedIn, newHosted } from './hosted-agents.js'
+import { ChatArchive } from './chat-archive.js'
+import { asksRelay, relayAnswer } from './relay-ask.js'
+import { RELAY_BY, isRelay } from './branches.js'
+import { commitForMember, agentCommitsOf, POLICY_RANK, ruleSetter, agentsCanCommit, pullRequestsFor, mergeForMember, unpublishedFor, remindUnpublished, notePushedFor, repoRecordFor, finishTaskFor, reviewPulls } from './relay-commit.js'
+import { appCredentials, revokeGitHubToken, noteMemberLogins } from './relay-github.js'
+import { mirrorManager, syncStateOf, runGit } from './relay-git.js'
+import { leaseKeeper, LEASE_HEARTBEAT_MS } from './relay-lease.js'
+import { bringInBranch, BACKSTOP_MS, ACTIVE_BACKSTOP_MS, syncStatus, markFolderBrought } from './relay-sync.js'
+import { noteCiResult } from './relay-ci.js'
+import { outboundFor, replayBundle, liveSyncOn, adoptBranch, receiveAgentPush } from './relay-outbound.js'
+import { ensureView, syncViewRefs, serveGit, parseUpdates, viewRepoOf, viewDir } from './relay-githttp.js'
+import { relayFileKey } from './relay-filekey.js'
+import { RoomMeter, roomDiskBytes } from './relay-metrics.js'
+import { clusterConfig, clusterProblems, Cluster, NOT_ROOMS, roomOfPath, replaySource, canReplay, displaceRoom, packRoom, unpackRoom, placeStaged, removeLocalRoom, MOVING, ELSEWHERE } from './relay-cluster.js'
+import { joiningRoom, sessionArg } from './mcp-room.js'
+import { clashAction, heldForClash, reviewClashes, noteMergeChecks, openOfflineClash } from './relay-clash.js'
+import { AGENT_COMMITS } from './github-commit.js'
+import { UPSTREAM_CHECK_MS, SYNC_EVERY_MS, SYNC_EVERY_GIT_MS, upstreamsOf, noteFolders, relayEntry, relayLooks, dueBranches, checkBranch, folderOn, connectedOn, hostedOn, validToken, folderAble, catcherAble, noteHolds, connectedAs, describeRelayCheck, loadBranch, parseRepo, configureGithubBudget, CLASH_IDLE_MS, noteConnection } from './relay-upstream.js'
+
+const ROOM_RE = /^[A-Za-z0-9_-]{1,64}$/
+const MAX_NAME = 64
+// A hosted agent counts as online this long after its last tool call.
+// Agents over HTTP have no connection to watch: each tool call is a check-in, good for this long.
+export const HOSTED_ONLINE_MS = 30 * 60 * 1000
+// An agent that works in turns (its machine is cleaned up after every run, so it connects for a turn and
+// is gone between them) shows as away, not offline, for this long after its last turn.
+export const AWAY_MS = 7 * 24 * 60 * 60 * 1000
+// A room's renames: each one saves the room and queues a presence report, so they're rationed.
+const RENAME_MS = 2000
+const MAX_PATTERN = 500
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/ // never in a claim: branch claims are keyed `<branch>\0<pattern>`
+// A room's documents together (the room's and every branch's) may take this many times the size limit before new branches are refused.
+const MAX_TOTAL_FACTOR = 10
+const newEpoch = () => crypto.randomBytes(8).toString('hex')
+// The file queue: requests for a claimed file (a title, and a summary of the plan), and handoffs.
+const MAX_REQUEST_TITLE = 120
+const MAX_REQUEST_TEXT = 300
+const MAX_HANDOFF_TEXT = 2000
+const MAX_QUEUE = 20
+const MAX_SCOPES = 20
+// Removed accounts remembered per room, so an older pass's grant can't bring them back.
+const MAX_REMOVED = 200
+const ROLES = ['editor', 'viewer']
+const MB = 1024 * 1024
+const DAY = 24 * 60 * 60 * 1000
+const BOX_REMIND_MS = DAY // a box whose holder is away: one reminder a day (sweepBoxes)
+// How often a branch's "last used" time (see Room.noteBranchSeen) is saved while it is busy.
+const BRANCH_SEEN_SAVE_MS = 60 * 60 * 1000
+// A message to the relay older than this when it reaches the relay gets no answer (answerRelay).
+const RELAY_ASK_MS = 10 * 60 * 1000
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..')
+const LOGO = path.join(ROOT, 'assets', 'logo.svg')
+const hash = (s) => crypto.createHash('sha256').update(String(s)).digest()
+const sameSecret = (a, b) => a.length === b.length && crypto.timingSafeEqual(a, b)
+
+/** Relay settings, from options or environment variables. */
+// How often a room asks the accounts API what agents may commit (its org's or workspace's choice), besides being told.
+const POLICY_EVERY_MS = 10 * 60 * 1000
+
+export function relayConfig (opts = {}) {
+  const env = adoptLegacyEnv({ ...process.env })
+  const num = (v, d) => (v === undefined || v === '' || Number.isNaN(Number(v)) ? d : Number(v))
+  // The accounts API's public key. With it, every connection needs a pass (see passes.js).
+  const passPublicKey = opts.passPublicKey ?? env.QUILT_PASS_PUBLIC_KEY ?? ''
+  return {
+    passPublicKey,
+    // Presence reports for the dashboard (presence.js): only when both are set.
+    apiUrl: opts.apiUrl ?? env.QUILT_API_URL ?? '',
+    relayApiSecret: opts.relayApiSecret ?? env.RELAY_API_SECRET ?? '',
+    // With passes on, the accounts API decides who may start sessions: the relay key isn't used.
+    relayKey: passPublicKey ? '' : (opts.relayKey ?? env.QUILT_RELAY_KEY ?? ''),
+    // A room's whole history lives in memory while anyone is in it, and takes
+    // several times its stored size there: keep this well under the machine's memory.
+    maxRoomBytes: num(opts.maxRoomBytes ?? env.QUILT_MAX_ROOM_MB, 32) * (opts.maxRoomBytes !== undefined ? 1 : MB),
+    maxRoomFileBytes: num(opts.maxRoomFileBytes ?? env.QUILT_MAX_ROOM_FILES_MB, 2048) * (opts.maxRoomFileBytes !== undefined ? 1 : MB),
+    maxConnsPerIp: num(opts.maxConnsPerIp ?? env.QUILT_MAX_CONNS_PER_IP, 50),
+    maxNewRoomsPerHour: num(opts.maxNewRoomsPerHour ?? env.QUILT_MAX_NEW_ROOMS_PER_HOUR, 30),
+    roomTtlDays: num(opts.roomTtlDays ?? env.QUILT_ROOM_TTL_DAYS, 30),
+    idleUnloadMs: num(opts.idleUnloadMs, 60 * 1000),
+    // A branch document nobody is on leaves memory this long after its last use (the room may stay).
+    branchIdleMs: num(opts.branchIdleMs, BRANCH_IDLE_MS),
+    // How often the relay asks GitHub about a branch only hosted agents are working on (relay-upstream.js),
+    // and whether it does by itself (tests turn that off and ask with checkUpstreams).
+    upstreamCheckMs: num(opts.upstreamCheckMs, UPSTREAM_CHECK_MS),
+    upstreamAuto: opts.upstreamAuto !== false,
+    // A read-only GitHub token of the relay's own (a Fly secret, public repositories only), used when
+    // a session has none: GitHub allows 60 requests an hour per IP without one, 5000 with.
+    githubToken: opts.githubToken ?? env.QUILT_GITHUB_TOKEN ?? '',
+    // GitHub as a node (relay-sync.js): commits come in through the relay's git mirror, on by default; QUILT_GIT_SYNC=0 keeps the REST path.
+    gitSync: opts.gitSync ?? env.QUILT_GIT_SYNC !== '0',
+    gitRemote: typeof opts.gitRemote === 'function' ? opts.gitRemote : null, // tests: a repository slug -> where its git is
+    syncAuto: opts.syncAuto === true, // the relay's own commit timer: off; commits happen when someone asks for one (quilt_git_commit, a git push)
+    crashAt: typeof opts.crashAt === 'string' ? opts.crashAt : null, // tests: where to inject a crash (relay-sync.js crashPoint)
+    leaseTtlMs: num(opts.leaseTtlMs, undefined),
+    pushGapMs: num(opts.pushGapMs ?? env.QUILT_PUSH_GAP_MS, undefined),
+    pushesPerHour: num(opts.pushesPerHour, undefined),
+    activeBackstopMs: num(opts.activeBackstopMs, undefined),
+    backoffStartMs: num(opts.backoffStartMs, undefined),
+    backoffMaxMs: num(opts.backoffMaxMs, undefined),
+    leaseMarginMs: num(opts.leaseMarginMs, undefined),
+    leaseHeartbeatMs: num(opts.leaseHeartbeatMs, undefined),
+    atPoint: typeof opts.atPoint === 'function' ? opts.atPoint : null,
+    folderAheadWaitMs: num(opts.folderAheadWaitMs, undefined),
+    syncQuietMs: num(opts.syncQuietMs, undefined),
+    syncMaxMs: num(opts.syncMaxMs, undefined),
+    // How many GitHub API requests an hour the relay makes without a token, for every session together.
+    githubAnonPerHour: num(opts.githubAnonPerHour ?? env.QUILT_GITHUB_ANON_PER_HOUR, 50),
+    // A clash assignee with no progress this long is handed on to the next agent (relay-upstream.js).
+    clashIdleMs: num(opts.clashIdleMs, CLASH_IDLE_MS),
+    // Whether a write to a file in an open relay clash (or its task moved to QA or Done by its
+    // assignee) makes the relay look again at once; on with upstreamAuto unless set.
+    upstreamOnChange: opts.upstreamOnChange ?? opts.upstreamAuto !== false,
+    // A claim whose holder has done nothing in the session this long is let go (see sweepClaims):
+    // handed to the first one waiting in its file queue, or released.
+    claimIdleMs: num(opts.claimIdleMs, 20 * 60 * 1000),
+    trustProxy: opts.trustProxy ?? /^(1|true|yes)$/i.test(env.QUILT_TRUST_PROXY || ''),
+    // Large files: Supabase Storage when both are set, otherwise the relay's own disk.
+    storageUrl: opts.storageUrl ?? env.QUILT_STORAGE_URL ?? '',
+    storageKey: opts.storageKey ?? env.QUILT_STORAGE_KEY ?? '',
+    storageBucket: opts.storageBucket ?? env.QUILT_STORAGE_BUCKET ?? 'session-files',
+    maxStoredFileBytes: num(opts.maxStoredFileBytes ?? env.QUILT_MAX_STORED_FILE_MB, 100) * (opts.maxStoredFileBytes !== undefined ? 1 : MB),
+    // The clock for each room's traffic meter (relay-metrics.js); tests move it.
+    now: typeof opts.now === 'function' ? opts.now : Date.now
+  }
+}
+
+/** The files a transaction changed in a branch document (entries in files or blobs, or text inside one). */
+function changedPaths (tr, e) {
+  const out = new Set()
+  for (const [type, events] of tr.changedParentTypes) {
+    if (type !== e.files && type !== e.blobs) continue
+    for (const ev of events) {
+      if (ev.target === type) { for (const k of ev.changes.keys.keys()) out.add(k); continue }
+      let t = ev.target
+      while (t && t._item && t._item.parent !== type) t = t._item.parent
+      if (t && t._item && t._item.parentSub) out.add(t._item.parentSub)
+    }
+  }
+  return out
+}
+
+class Room {
+  constructor (name, dataDir, cfg, log) {
+    this.name = name
+    this.cfg = cfg
+    this.log = log
+    this.doc = new Y.Doc()
+    this.conns = new Map() // ws -> Set<awareness clientID>
+    this.names = new Map() // ws -> verified name
+    this.docFile = dataDir && path.join(dataDir, `${name}.ydoc`)
+    this.metaFile = dataDir && path.join(dataDir, `${name}.json`)
+    this.meta = {}
+    this.bytes = 0
+    // Messages and bytes in and out per minute, for /stats and placement (relay-metrics.js).
+    this.meter = new RoomMeter({ now: cfg.now || Date.now })
+    this.full = false
+    this.unsavable = false // a disk error stopped a save: the room is read-only (see diskError)
+    if (dataDir) {
+      // A room whose files can't be read (cut off by a crash, or a disk error) is refused,
+      // not treated as new: that would overwrite it, or let the sweep delete it.
+      try {
+        if (fs.existsSync(this.docFile)) {
+          const buf = fs.readFileSync(this.docFile)
+          Y.applyUpdate(this.doc, buf)
+          this.bytes = buf.length
+        }
+        if (fs.existsSync(this.metaFile)) this.meta = JSON.parse(fs.readFileSync(this.metaFile, 'utf8'))
+      } catch (err) {
+        this.doc.destroy()
+        throw Object.assign(new Error(`could not read the session's data: ${err.message}`), { unreadable: true })
+      }
+    }
+    this.meta.identities = this.meta.identities || {} // name -> public key
+    this.meta.claims = this.meta.claims || {} // pattern -> { by, byId?, pattern, note, ts }; byId is the account, with sign-in on
+    // Each branch's files live in a document of their own (branchdocs.js); the session's
+    // branches are key -> { by, at, base, seen, stored }, and the default is the first one joined.
+    this.meta.branches = this.meta.branches || {}
+    // With the mirror on, every synced branch is fetched again as soon as someone is on it: a webhook may have been missed while the relay was down (plan §5.1).
+    if (cfg.gitSync && this.meta.upstreams && typeof this.meta.upstreams === 'object') for (const rec of Object.values(this.meta.upstreams)) if (rec && rec.repo) { rec.checkedAt = 0; delete rec.webhookAt }
+    // CI results the relay hadn't noted when it last stopped (noteChecks): noted now, in the order they came.
+    if (Array.isArray(this.meta.ciPending) && this.meta.ciPending.length) setTimeout(() => { if (!this.destroyed) for (const ev of this.meta.ciPending.slice()) this.runCi(ev) }, 500).unref?.()
+    this.store = new BranchStore({
+      dir: dataDir && path.join(dataDir, 'branches', name),
+      idleMs: cfg.branchIdleMs,
+      onLoad: (e) => this.wireBranch(e),
+      onSave: (e) => this.noteBranchSaved(e),
+      onDiskError: (err) => this.diskError(err)
+    })
+    // A room saved before branch documents: its one document becomes the default branch's.
+    this.migrateLegacy()
+    this.pruneBranches()
+    this.awareness = new awarenessProtocol.Awareness(this.doc)
+    this.awareness.setLocalState(null)
+    // Claim holder (see holderKey) -> when they last did something in the session (changed the
+    // document: a file, a message, their AI's feed; or used a hosted tool), for sweepClaims.
+    this.meta.seen = this.meta.seen || {}
+    this.loadedAt = Date.now()
+    // Member id -> { name, kind, role, scopes, since }. The id is the public key, or
+    // '<kind>:<sub>' for members approved with a pass (an account, on any computer).
+    this.meta.members = this.meta.members || {}
+    this.access = new Map() // ws -> { key, id, name, kind, role, scopes, owner } for people in the room
+    // ws -> { key, id, name, kind, invitedAs, since } waiting for the owner. A hosted agent (one
+    // that only talks to the relay over HTTP, see relay-mcp.js) waits under a { hosted: id } stand-in.
+    this.pending = new Map()
+    this.hostedSeen = new Map() // member id -> when a hosted agent last called a tool
+    this.hostedExpiry = new Map() // member id -> the timer that shows it offline when its check-in runs out
+    this.files = this.doc.getMap('files')
+    this.blobs = this.doc.getMap('blobs')
+    this.fileKeys = this.doc.getMap('fileKeys')
+    this.chat = this.doc.getArray('chat')
+    // Every message, kept past the room's newest 500, for hosted agents' conversations (chat-archive.js).
+    this.chatArchive = new ChatArchive(dataDir && path.join(dataDir, `${name}.chat.jsonl`), { log: (m) => log(`[${name}] ${m}`) })
+    this.chatArchive.add(this.chat.toArray())
+    this.chat.observe((ev) => { if (ev.changes.added.size) this.chatArchive.add(this.chat.toArray()) })
+    // A message to the relay (@Quilt, or direct) gets its answer (relay-ask.js).
+    this.relayAnswered = new Set()
+    this.chat.observe((ev) => {
+      for (const item of ev.changes.added) for (const m of item.content.getContent()) if (asksRelay(m)) this.answerRelay(m, ev.transaction.origin)
+    })
+    this.feed = this.doc.getArray('agentFeed')
+    this.activity = this.doc.getArray('activity') // { by, path, kind, detail, ts }
+    this.commitRequests = this.doc.getMap('commitRequests') // id -> { id, by, message, ts, state, ... }
+    this.published = this.doc.getMap('published') // path -> [content ids] the relay committed to GitHub (upstream.js)
+    this.taskComments = this.doc.getMap('taskComments') // task id -> [{ id, by, text, ts }] (task-comments.js)
+    // Undoes changes from people who may not make them: file changes from viewers and from
+    // people outside their folders, and posts from people who may not post (chat, the feed,
+    // task comments, words of their own in the activity log, commit requests). Only their connections are tracked.
+    // Branch documents get a guard each (wireBranch) sharing these tracked connections. The room
+    // document's files maps are only in rooms from before branch documents.
+    this.guard = new Y.UndoManager([this.files, this.blobs, this.fileKeys, this.chat, this.feed, this.taskComments, this.activity, this.commitRequests, this.published], { trackedOrigins: new Set(), captureTimeout: 0 })
+    // What checkChange works on: the room document's parts, its guard and who hears its updates.
+    this.roomParts = {
+      guard: this.guard, recorded: null, undoing: null,
+      files: this.files, blobs: this.blobs, fileKeys: this.fileKeys, chat: this.chat, feed: this.feed, taskComments: this.taskComments, activity: this.activity, commitRequests: this.commitRequests, published: this.published,
+      listeners: () => this.conns.keys(), frame: () => ROOM_DOC
+    }
+    this.guard.on('stack-item-added', ({ stackItem, type }) => { if (type === 'undo') this.roomParts.recorded = stackItem })
+    // What a tracked change added to the activity log, read before Yjs merges the new entries
+    // into older ones (after which a change event can no longer tell them apart).
+    this.activityAdded = new WeakMap()
+    this.tasks = this.doc.getMap('tasks')
+    // The audit trail: what a connection with a visit changed (files, chat, the board), by path or task id.
+    this.auditAs = null // a hosted agent whose tool is running now (relay-mcp.js): its changes are its
+    this.doc.on('afterTransaction', (tr) => {
+      if (!this.presence) return
+      const visit = tr.origin && tr.origin.visit ? tr.origin.visit : (this.auditAs && this.hostedVisit ? this.hostedVisit(this.auditAs) : null)
+      if (visit) this.auditChange(tr, visit)
+    })
+    this.doc.on('afterTransaction', (tr) => {
+      const events = tr.changedParentTypes.get(this.activity)
+      if (!events || !this.guard.trackedOrigins.has(tr.origin)) return
+      this.activityAdded.set(tr, events.flatMap((e) => [...e.changes.added].flatMap((item) => item.content.getContent())))
+    })
+    // The room's own document against the size limit; each branch document has a limit of its
+    // own (branchFull). A disk error (diskError, possibly from migrateLegacy above) keeps it read-only.
+    this.full = this.unsavable || this.bytes > cfg.maxRoomBytes
+    this.saveTimer = null
+    this.unloadTimer = null
+    this.presence = null // a PresenceReporter when the relay reports presence (set by startServer)
+    this.lastRenameAt = 0 // when the owner last renamed the session (RENAME_MS)
+
+    this.doc.on('update', (update, origin, doc, tr) => {
+      if (origin === this.guard && this.roomParts.undoing) { this.roomParts.undoing.push(update); return } // sent merged, below
+      if (origin && origin !== this.guard && this.guard.trackedOrigins.has(origin) && !this.checkChange(origin, update, tr)) return
+      if (origin && this.conns.has(origin)) this.noteActivity(this.holderKeys(origin))
+      const msg = updateMessage(update)
+      for (const ws of this.conns.keys()) if (ws !== origin) send(ws, msg)
+      this.bytes += update.length
+      if (!this.full && this.bytes > cfg.maxRoomBytes) {
+        this.full = true
+        this.log(`[${name}] over the size limit; further edits are refused`)
+      }
+      this.scheduleSave()
+    })
+    this.awareness.on('update', ({ added, updated, removed }, origin) => {
+      const changed = added.concat(updated, removed)
+      if (origin && this.conns.has(origin)) {
+        const ids = this.conns.get(origin)
+        // Updated too: a client back from a drop speaks for the same id over a new connection.
+        for (const id of added.concat(updated)) ids.add(id)
+        for (const id of removed) ids.delete(id)
+      }
+      const msg = awarenessMessage(this.awareness, changed)
+      for (const ws of this.conns.keys()) send(ws, msg)
+      // Which upstream each branch follows, and where its folders are (relay-upstream.js).
+      if (origin && this.conns.has(origin)) this.noteUpstreams()
+    })
+    this.githubFetch = globalThis.fetch // set by startServer (tests give their own: never the network)
+    this.upstreamRun = null // the relay's look at GitHub under way (checkUpstreams)
+    this.syncAsked = new Map() // branch -> when quilt_sync_branch last made the relay ask GitHub (syncUpstreamNow)
+    this.upstreamSoonKeys = new Set() // branches to look at again at once (upstreamSoon)
+    this.lookedFor = new WeakSet() // connections whose arrival made their branch due a look (reconnect reconciliation)
+    // A relay clash's task moved to QA or Done by its assignee: the files count as merged (relay-upstream.js).
+    this.tasks.observe((ev, tr) => {
+      for (const [id, c] of ev.changes.keys) {
+        const t = this.tasks.get(id)
+        // A clash task done or gone: its files are let go of, whoever held them for it (online or not).
+        if (!t || t.column === 'done') this.dropClashClaims(id)
+        if (tr.origin === 'relay-upstream') continue
+        // Moved (or moved again, after someone else did) to QA or Done: whose move it was decides.
+        if (c.action !== 'update' || !t || (t.column !== 'qa' && t.column !== 'done')) continue
+        this.noteClashMoved(id, t, tr.origin)
+      }
+    })
+  }
+
+  get exists () { return !!this.meta.secretHash }
+
+  /** Rooms made by newer clients have an owner who approves people. Older rooms let everyone edit. */
+  get controlled () { return !!this.meta.viewSecretHash }
+
+  /**
+   * First client to open a room sets its secrets; later clients must match one.
+   * Returns 'editor' or 'viewer' (what the secret invites you as), 'bad-secret'
+   * or 'need-key' (creating rooms needs the relay key). `publicKey` is the
+   * creator's: in a controlled room, only they can become its owner.
+   */
+  authorize (secret, key, viewSecret = '', publicKey = '') {
+    if (!this.meta.secretHash) {
+      if (this.cfg.relayKey && !sameSecret(hash(key || ''), hash(this.cfg.relayKey))) return 'need-key'
+      this.meta.secretHash = hash(secret || '').toString('hex')
+      if (viewSecret) this.meta.viewSecretHash = hash(viewSecret).toString('hex')
+      if (publicKey) this.meta.creator = publicKey
+      this.meta.createdAt = Date.now()
+      this.touch()
+      return 'editor'
+    }
+    if (sameSecret(hash(secret || ''), Buffer.from(this.meta.secretHash, 'hex'))) return 'editor'
+    if (this.controlled && sameSecret(hash(secret || ''), Buffer.from(this.meta.viewSecretHash, 'hex'))) return 'viewer'
+    return 'bad-secret'
+  }
+
+  /**
+   * Where someone stands when they sign in: let in now (with a role), or wait
+   * for the owner. `account` is '<kind>:<sub>' from their pass when sign-in is
+   * on: then they are their account, on any computer, not their key.
+   */
+  accessFor (key, name, kind, invitedAs, account = '', pass = null) {
+    if (!this.controlled) return { state: 'approved', role: 'editor', scopes: [], owner: false }
+    if (!this.meta.owner) {
+      // The room's creator becomes its owner when they sign in, and nobody else, however much
+      // earlier they get here: until then invitees wait. (Rooms made before creators were
+      // recorded, with nobody signed in yet, go to the first person invited to edit.)
+      const creator = this.meta.creator
+      if (creator ? key === creator : invitedAs === 'editor') { this.meta.owner = key; this.saveMeta() }
+    }
+    if (account) this.noteKey(account, key)
+    if (this.isOwner(key, account)) {
+      if (account) {
+        // Remember the owner's account, so they're the owner on any computer.
+        // Names come from accounts and can change: show the owner by the name they use now.
+        if (this.meta.ownerSub !== account || this.meta.ownerName !== name) { this.meta.ownerSub = account; this.meta.ownerName = name; this.saveMeta() }
+      }
+      return { state: 'approved', role: 'editor', scopes: [], owner: true }
+    }
+    // A room pass with a grant (from the accounts API) lets them straight in, with its access.
+    const granted = this.passGrant(pass)
+    if (granted) {
+      this.noteGranted(account, name, kind, granted, cleanFrom(pass && pass.from))
+      return { state: 'approved', ...relayAccess(granted), owner: false, id: account }
+    }
+    // Members approved with a pass are kept under their account; older ones under their key.
+    const id = account && this.meta.members[account] ? account : key
+    const m = this.storedMember(id, pass)
+    if (m) {
+      if (m.name !== name || m.kind !== kind) { m.name = name; m.kind = kind; this.saveMeta() }
+      return { state: 'approved', ...memberAccess(m), owner: false, id }
+    }
+    // A person's cloud AI stands where its person stands (never as the owner).
+    const standing = this.cloudAiStanding(pass)
+    if (standing) return { state: 'approved', ...standing, owner: false, id: account }
+    return { state: 'pending', invitedAs }
+  }
+
+  /**
+   * A person's cloud AI (routes/ai-vm.js on the API: its pass names its person in `of`) comes in
+   * with its person's standing here: the owner's AI edits, a member's AI has the member's access.
+   * Null when its person would wait (or its pass isn't a cloud AI's).
+   */
+  cloudAiStanding (pass) {
+    if (!pass || pass.kind !== 'agent' || !/^person:[A-Za-z0-9_-]{1,64}$/.test(String(pass.of || ''))) return null
+    if (this.meta.ownerSub === pass.of) return { role: 'editor', scopes: [], scopesExcept: [], talk: true }
+    const m = this.storedMember(pass.of, pass)
+    return m ? memberAccess(m) : null
+  }
+
+  /**
+   * What a pass for this room lets its holder do here (the grant the accounts API signed
+   * into it), or null: no pass for this room, no grant, or the owner removed them after it
+   * was issued. An owner's narrowing made after it was issued still applies.
+   */
+  passGrant (pass) {
+    if (!pass || pass.room !== this.name) return null
+    const access = cleanAccess(pass.access)
+    if (!access) return null
+    const account = `${pass.kind}:${pass.sub}`
+    const issued = typeof pass.iat === 'number' ? pass.iat : pass.exp - PASS_TTL_MS
+    const removedAt = (this.meta.removed || {})[account]
+    if (removedAt && issued <= removedAt) return null
+    const m = this.meta.members[account]
+    if (m && m.setAt && issued <= m.setAt) return narrowAccess(access, fromRelay(m))
+    return access
+  }
+
+  /**
+   * True when this pass was issued no later than the owner's last change to its holder,
+   * and that change cut what it grants. A pass from the same millisecond as the change
+   * (or from a clock a little behind) may already carry it, but the relay can't tell, so
+   * the app is asked for a newer one: otherwise more access waits for the next refresh.
+   */
+  passPredatesChange (pass) {
+    if (!pass || pass.room !== this.name) return false
+    const access = cleanAccess(pass.access)
+    const m = this.meta.members[`${pass.kind}:${pass.sub}`]
+    if (!access || !m || !m.setAt) return false
+    const issued = typeof pass.iat === 'number' ? pass.iat : pass.exp - PASS_TTL_MS
+    return issued <= m.setAt && !sameAccess(access, narrowAccess(access, fromRelay(m)))
+  }
+
+  /**
+   * The member record that may let this pass in, or null. Someone let in as a type (by a
+   * grant, or by the owner approving them as one) has their access in the API: only a pass
+   * for this room speaks for it, so without one their stored record lets nobody in, or an
+   * access type narrowed or deleted on the API would never reach the relay. Members from
+   * before access types keep coming in on their record.
+   */
+  storedMember (id, pass) {
+    const m = this.meta.members[id]
+    if (!m) return null
+    return m.granted && !(pass && pass.room === this.name) ? null : m
+  }
+
+  /** Keeps someone let in by their pass's grant on the member list, with that access and where it comes from (`from`, see cleanFrom). */
+  noteGranted (id, name, kind, access, from = null) {
+    const m = this.meta.members[id]
+    if (m && m.name === name && m.kind === kind && sameAccess(fromRelay(m), access) && JSON.stringify(m.from || null) === JSON.stringify(from)) return
+    this.meta.members[id] = { ...(m || {}), name, kind, ...relayAccess(access), since: m?.since || Date.now(), granted: true, ...(from ? { from } : {}) }
+    if (!from) delete this.meta.members[id].from
+    this.saveMeta()
+  }
+
+  /**
+   * A fresh pass arrived (see renewPass): its grant applies now. Someone waiting is let in,
+   * and someone in the room gets the new access, both without the owner.
+   */
+  passRenewed (ws) {
+    const granted = this.passGrant(ws.pass)
+    if (!granted) return
+    const id = `${ws.pass.kind}:${ws.pass.sub}`
+    if (this.meta.ownerSub === id) return
+    const waiting = this.pending.get(ws)
+    if (waiting) {
+      this.pending.delete(ws)
+      this.noteGranted(id, waiting.name, waiting.kind, granted, cleanFrom(ws.pass.from))
+      this.log(`[${this.name}] ${waiting.name} was let in by their invite`)
+      this.enter(ws, { key: waiting.key, id, name: waiting.name, kind: waiting.kind, ...relayAccess(granted), owner: false })
+      return
+    }
+    const a = this.access.get(ws)
+    if (!a || a.owner) return
+    const refresh = this.passPredatesChange(ws.pass) ? { refresh: true } : {}
+    if (sameAccess(fromRelay(a), granted)) {
+      if (refresh.refresh) send(ws, jsonMessage(MSG_ACCESS, { ...this.accessMessage(a), ...refresh }))
+      return
+    }
+    this.noteGranted(id, a.name, a.kind, granted, cleanFrom(ws.pass.from))
+    Object.assign(a, relayAccess(granted))
+    this.setAccess(ws, a)
+    send(ws, jsonMessage(MSG_ACCESS, { ...this.accessMessage(a), ...refresh }))
+    this.broadcastMembers()
+  }
+
+  /**
+   * Remembers which computer keys an account has used here, so removing the
+   * account also removes members approved by one of those keys.
+   */
+  noteKey (account, key) {
+    const keys = (this.meta.accountKeys = this.meta.accountKeys || {})
+    const seen = keys[account] || []
+    if (seen.includes(key)) return
+    keys[account] = [...seen, key].slice(-20)
+    this.saveMeta()
+  }
+
+  /** The owner is their account once it's known, and until then the key that made the room. */
+  isOwner (key, account = '') {
+    if (account && this.meta.ownerSub) return this.meta.ownerSub === account
+    return this.meta.owner === key
+  }
+
+  /**
+   * With sign-in on: may this pass use the session's files over HTTP? In a session with an
+   * owner, only the owner and the people they let in may (by account, or an older member's key).
+   * Unlike accessFor, it changes nothing.
+   */
+  letIn (pass) {
+    if (!this.controlled) return true
+    const account = `${pass.kind}:${pass.sub}`
+    if (this.meta.owner && this.isOwner(pass.key, account)) return true
+    if (this.passGrant(pass)) return true
+    return !!(this.storedMember(account, pass) || this.storedMember(pass.key, pass))
+  }
+
+  /** With sign-in on: the relay access a pass has here over HTTP (null for the owner, or nobody). */
+  httpAccess (pass) {
+    const account = `${pass.kind}:${pass.sub}`
+    if (!this.controlled || (this.meta.owner && this.isOwner(pass.key, account))) return null
+    const granted = this.passGrant(pass)
+    if (granted) return relayAccess(granted)
+    const m = this.storedMember(account, pass) || this.storedMember(pass.key, pass)
+    return m ? memberAccess(m) : null
+  }
+
+  /** The id the member list shows the owner under. */
+  get ownerId () { return this.meta.ownerSub || this.meta.owner }
+
+  /**
+   * Where a hosted agent (HTTP only, no key) stands: approved with its role, or waiting for
+   * the owner. Waiting puts it on the owner's list like a connection would. It never becomes
+   * the owner: a room with no owner yet keeps it waiting.
+   */
+  hostedRequest (pass, invitedAs) {
+    const id = `${pass.kind}:${pass.sub}`
+    const a = this.hostedAccess(pass)
+    if (a.state === 'approved') return a
+    if (!this.controlled) return { state: 'approved', role: 'editor', scopes: [], owner: false, id }
+    const waiting = [...this.pending].find(([k, p]) => k.hosted && p.id === id)
+    if (waiting) { waiting[1].since = Date.now(); waiting[1].invitedAs = invitedAs; return { state: 'pending', invitedAs } }
+    this.pending.set({ hosted: id }, { key: '', id, name: pass.name, kind: pass.kind === 'agent' ? 'agent' : 'human', invitedAs, since: Date.now() })
+    this.log(`[${this.name}] ${pass.name} (hosted) is waiting to be let in`)
+    this.broadcastMembers()
+    return { state: 'pending', invitedAs }
+  }
+
+  /**
+   * Puts a hosted agent back on the waiting list after a relay restart (the list lives in
+   * memory; relay.hosted remembers who was waiting). Skips anyone already let in.
+   */
+  restoreHosted (id, { name, kind, invitedAs }) {
+    if (!this.controlled || !name) return
+    if (this.meta.members[id] || id === this.meta.owner || id === this.meta.ownerSub) return
+    if ([...this.pending].some(([k, p]) => k.hosted && p.id === id)) return
+    this.pending.set({ hosted: id }, { key: '', id, name, kind: kind === 'agent' ? 'agent' : 'human', invitedAs: invitedAs || 'viewer', since: Date.now() })
+    this.broadcastMembers()
+  }
+
+  /**
+   * A hosted agent's current standing: approved (with its access) or pending. A room pass
+   * with a grant approves it, and puts it on the member list.
+   */
+  hostedAccess (pass) {
+    const id = `${pass.kind}:${pass.sub}`
+    if (!this.controlled) return { state: 'approved', role: 'editor', scopes: [], owner: false, id }
+    if (this.meta.owner && this.isOwner(pass.key || '', id)) return { state: 'approved', role: 'editor', scopes: [], owner: true, id }
+    const granted = this.passGrant(pass)
+    if (granted) {
+      this.noteGranted(id, pass.name, pass.kind === 'agent' ? 'agent' : 'human', granted, cleanFrom(pass.from))
+      return { state: 'approved', ...relayAccess(granted), owner: false, id }
+    }
+    const m = this.storedMember(id, pass)
+    if (m) {
+      if (m.name !== pass.name) { m.name = pass.name; this.saveMeta() }
+      return { state: 'approved', ...memberAccess(m), owner: false, id }
+    }
+    // Let in as a type, but this pass isn't for this room (the accounts API didn't know which
+    // room the agent is in, after a restart): a pass for this room will let it in.
+    if (this.meta.members[id]?.granted) return { state: 'pending', id, needsRoomPass: true }
+    return { state: 'pending', id }
+  }
+
+  /** What a connection's change did, for the audit trail: files changed, messages posted, tasks touched. */
+  auditChange (tr, visit) {
+    const act = (action, target) => this.presence.act(visit, action, target)
+    for (const e of tr.changedParentTypes.get(this.activity) || []) {
+      for (const item of e.changes.added) {
+        for (const x of item.content.getContent()) if (x && ACTIVITY_KINDS.includes(x.kind) && x.path) act(x.kind, String(x.path))
+      }
+    }
+    for (const e of tr.changedParentTypes.get(this.chat) || []) {
+      for (const item of e.changes.added) for (const m of item.content.getContent()) if (m && typeof m === 'object') act('messaged', m.to ? `to ${m.to}` : '')
+    }
+    const tasks = new Set()
+    for (const e of tr.changedParentTypes.get(this.tasks) || []) {
+      if (e.target === this.tasks) for (const k of e.keysChanged || []) tasks.add(k)
+      else if (e.path.length) tasks.add(String(e.path[0]))
+    }
+    // A comment on a task is work on that task.
+    for (const e of tr.changedParentTypes.get(this.taskComments) || []) {
+      if (e.target === this.taskComments) for (const k of e.keysChanged || []) if (this.taskComments.has(k)) tasks.add(k)
+    }
+    for (const id of tasks) act('task', id)
+  }
+
+  /** The audit trail, for a member by id: the visit of their connection here, or of the hosted agent. */
+  audit (id, action, target) {
+    if (!this.presence || !id) return
+    for (const ws of this.conns.keys()) {
+      if (ws.visit && ws.pass && `${ws.pass.kind}:${ws.pass.sub}` === id) return this.presence.act(ws.visit, action, target)
+    }
+    const v = this.hostedVisit && this.hostedVisit(id)
+    if (v) this.presence.act(v, action, target)
+  }
+
+  /** A hosted agent just used a tool: it shows as online for a while, and stops waiting. */
+  hostedActive (id) {
+    const was = this.hostedSeen.get(id) || 0
+    this.hostedSeen.set(id, Date.now())
+    this.noteHostedUpstream(id)
+    this.noteActivity([id])
+    for (const [k, p] of this.pending) if (k.hosted && p.id === id) this.pending.delete(k)
+    // Newly online, or a newer check-in time: everyone's member list shows it (once a minute at most).
+    if (Date.now() - was >= 60 * 1000) this.broadcastMembers()
+    // And shows it gone when this check-in runs out with no other.
+    clearTimeout(this.hostedExpiry.get(id))
+    const t = setTimeout(() => {
+      this.hostedExpiry.delete(id)
+      if (!this.hostedOnline().some((h) => h.id === id)) this.broadcastMembers()
+    }, HOSTED_ONLINE_MS + 1000)
+    t.unref?.()
+    this.hostedExpiry.set(id, t)
+  }
+
+  /** Hosted agents active in the last few minutes, for status and presence. */
+  hostedOnline () {
+    const cutoff = Date.now() - HOSTED_ONLINE_MS
+    const out = []
+    for (const [id, ts] of this.hostedSeen) {
+      if (ts < cutoff) { this.hostedSeen.delete(id); continue }
+      const m = this.meta.members[id]
+      if (m) out.push({ id, name: m.name, kind: m.kind, role: m.role, seen: ts })
+    }
+    return out
+  }
+
+  /** Tells every connection the claims changed (a hosted agent claimed or released). */
+  broadcastClaims () {
+    this.saveMeta()
+    for (const other of this.conns.keys()) send(other, jsonMessage(MSG_CLAIMS, { claims: this.claimList(other.branch) }))
+    this.noteClaimsChanged()
+  }
+
+  /** A claim the relay's bring-in waits on (rec.waitingOn) was let go of, handed on or swept: that branch is looked at again at once. */
+  noteClaimsChanged () {
+    if (this.cfg.gitSync && this.mirrors) for (const key of Object.keys(this.meta.sync || {})) if (Object.keys((this.meta.sync[key] || {}).pending || {}).length) this.outbound.schedule(key)
+    for (const [key, rec] of Object.entries(this.meta.upstreams || {})) {
+      const w = rec && rec.waitingOn
+      if (!w) continue
+      const c = this.meta.branches[key] ? this.claimFor(w.path, key) : null
+      if (c && c.by === w.by && c.pattern === w.pattern) continue
+      delete rec.waitingOn
+      this.upstreamSoon(key)
+    }
+    // A file held for a claim that is gone now (its note above may have been cleared by a later look): looked at again.
+    if (this.cfg.gitSync && this.mirrors) {
+      for (const [key, st] of Object.entries(this.meta.sync || {})) {
+        if (!st || !this.meta.branches[key]) continue
+        if ((st.held || []).some((h) => h.why === 'claimed' && !this.claimFor(h.path, key))) this.upstreamSoon(key)
+      }
+    }
+  }
+
+  /** May this connection change this file? */
+  mayWrite (a, rel) { return mayChange(a, rel) }
+
+  /** Whether a change by this connection to rel would stand (checkChange), so a box on it would hold their work. */
+  mayBox (ws, rel) {
+    const a = this.access.get(ws)
+    rel = String(rel ?? '').trim().replace(/^\.\//, '')
+    if (a && !this.mayWrite(a, rel)) return false
+    return !(a && a.kind === 'agent' && this.cfg.gitSync && ws.branch && heldForClash(this, this.resolveKey(ws.branch), rel))
+  }
+
+  /**
+   * A restricted member (viewer, or agent limited to folders) changed a document: the room's
+   * (`d` = roomParts) or a branch's (`d` = its entry). Returns true to pass it on, or false
+   * after scheduling an undo of what they may not change. The undo runs once the guard has
+   * recorded the change, whichever order Yjs fires its events in.
+   */
+  checkChange (ws, update, tr, d = this.roomParts) {
+    const a = this.access.get(ws)
+    const touched = new Map() // path -> the types (files, blobs) it changed in
+    const refused = []
+    const posts = [] // chat and the feed, for people who may not post
+    // Only the parts of the change that were refused are undone: one update can carry
+    // allowed and refused changes together (an edit and a post in one transaction).
+    const undo = new Set()
+    for (const [type, events] of tr.changedParentTypes) {
+      if (type === d.chat || type === d.feed || type === d.taskComments) {
+        if (a?.talk === false) { posts.push(type === d.chat ? 'chat' : type === d.feed ? 'the feed' : 'a task comment'); undo.add(type) }
+        continue
+      }
+      // What the relay published is the relay's record alone: a viewer or a member limited to folders may not change it.
+      if (type === d.published) { refused.push('the record of published files'); undo.add(type); continue }
+      if (type === d.commitRequests) {
+        // Asking for a commit is a message to the host; marking one done (same message) isn't.
+        if (a?.talk !== false) continue
+        for (const e of events) {
+          for (const [id, c] of e.changes.keys) {
+            const now = type.get(id)
+            if (c.action === 'add' || (c.action === 'update' && now?.message !== c.oldValue?.message)) { posts.push('a commit request'); undo.add(type); break }
+          }
+        }
+        continue
+      }
+      // Keys wrapped for the relay (plan §10) follow the same rule: added, never changed or removed, by anyone held to a folder.
+      if (type === d.fileKeys || (d.relayKeys && type === d.relayKeys)) {
+        // Keys to stored files: viewers may not touch them, and others may
+        // only add new ones, so nobody can lock people out of stored files.
+        for (const e of events) {
+          if (e.target !== type) { refused.push('a file key'); undo.add(type); continue }
+          for (const [id, c] of e.changes.keys) if (a?.role === 'viewer' || c.action !== 'add') { refused.push(`file key ${id}`); undo.add(type) }
+        }
+        continue
+      }
+      if (type !== d.files && type !== d.blobs) continue
+      const touch = (rel) => touched.set(rel, [...(touched.get(rel) || []), type])
+      for (const e of events) {
+        if (e.target === type) for (const k of e.changes.keys.keys()) touch(k)
+        else {
+          // A change inside a file's text: walk up to the entry in files.
+          let t = e.target
+          while (t && t._item && t._item.parent !== type) t = t._item.parent
+          if (t && t._item && t._item.parentSub) touch(t._item.parentSub)
+        }
+      }
+    }
+    for (const [rel, types] of touched) {
+      // A file held for a clash with GitHub (relay-clash.js): agents propose the merge with quilt_clash; only people edit it in place.
+      if (d.key && a && a.kind === 'agent' && this.cfg.gitSync && heldForClash(this, d.key, rel)) { refused.push(`${rel} (held for a clash: propose with quilt_clash)`); for (const t of types) undo.add(t); continue }
+      if (this.mayWrite(a, rel)) continue
+      refused.push(rel)
+      for (const t of types) undo.add(t)
+      // The log entry for a change that's undone would describe something that never happened.
+      if (d.activity && tr.changedParentTypes.has(d.activity)) undo.add(d.activity)
+    }
+    // Activity entries come apart from the file changes they describe (files are in branch
+    // documents now): one about a file this member may not change describes a change undone there.
+    let quiet = false
+    const added = d.activity && tr.changedParentTypes.has(d.activity) ? (this.activityAdded.get(tr) || []) : []
+    if (added.length && !undo.has(d.activity) && a && a.talk !== false && added.some((x) => x && typeof x.path === 'string' && x.path && !this.mayWrite(a, x.path))) {
+      undo.add(d.activity)
+      quiet = true
+    }
+    // The activity log is written by apps as files change. Someone who may not post may add
+    // only those entries, for files on their branch they may change, never words of their own.
+    if (a?.talk === false && added.length && !undo.has(d.activity)) {
+      const plain = (x) => x && typeof x === 'object' && Object.keys(x).every((k) => ACTIVITY_FIELDS.includes(k)) &&
+        x.by === a.name && ACTIVITY_KINDS.includes(x.kind) &&
+        (x.kind === 'switched' ? x.path === '' : typeof x.path === 'string' && this.mayWrite(a, x.path) && (x.kind === 'deleted' || touched.has(x.path) || this.onBranch(ws, x.path))) &&
+        (x.detail === undefined || ACTIVITY_DETAIL.test(x.detail)) && typeof x.ts === 'number' &&
+        (x.branch === undefined || validBranchKey(x.branch)) && (x.from === undefined || validBranchKey(x.from))
+      if (!added.every(plain)) { posts.push('the activity log'); undo.add(d.activity) }
+    }
+    refused.push(...posts)
+    // The guard recorded this change just before this 'update' (its stack-item-added): only
+    // that one is kept or undone, never another change that arrived in the same moment.
+    const item = d.recorded
+    d.recorded = null
+    if (!refused.length && !quiet) { this.forget(item, d); return true }
+    if (refused.length) this.log(`[${this.name}] undid ${a ? a.name : 'someone'}'s change to ${refused.slice(0, 3).join(', ')}${refused.length > 3 ? '…' : ''} (not allowed)`)
+    queueMicrotask(() => {
+      // Send the change and its undo as one update: nobody sees the change,
+      // and nobody is left missing part of this person's history.
+      const others = d.guard.undoStack.filter((x) => x !== item)
+      const scope = d.guard.scope
+      d.guard.undoStack = item ? [item] : []
+      d.guard.scope = scope.filter((t) => undo.has(t))
+      d.undoing = []
+      try { d.guard.undo() } finally {
+        d.guard.scope = scope
+        d.guard.undoStack = others
+        d.guard.redoStack = []
+        const merged = Y.mergeUpdates([update, ...d.undoing])
+        d.undoing = null
+        for (const other of d.listeners()) send(other, updateMessage(merged, d.frame(other)))
+      }
+      if (!refused.length) return
+      const why = posts.length === refused.length
+        ? TALK_WHY
+        : a && a.role === 'viewer' ? 'you can only view this session' : 'that is outside the folders you may change'
+      send(ws, jsonMessage(MSG_ACCESS, { ...this.accessMessage(a), refused: refused.slice(0, 20), why }))
+    })
+    return false
+  }
+
+  /** An allowed change: the guard never needs to undo it. */
+  forget (item, d = this.roomParts) {
+    const i = item ? d.guard.undoStack.indexOf(item) : -1
+    if (i >= 0) d.guard.undoStack.splice(i, 1)
+  }
+
+  /** The room's default branch: the first one anyone joined (∅, a folder without git, until then). */
+  get defaultKey () { return this.meta.defaultBranch || DEFAULT_KEY }
+
+  /** The document a branch name stands for: ∅ is the default branch. */
+  resolveKey (key) { return key === DEFAULT_KEY ? this.defaultKey : key }
+
+  /** Bytes the room takes: its own document and every branch's (capped at MAX_TOTAL_FACTOR times the limit, see assertBranchRoom). */
+  totalBytes () {
+    let n = this.bytes
+    if (this.store) for (const key of Object.keys(this.meta.branches)) n += this.store.size(key)
+    return n
+  }
+
+  /** Adds a branch to the session (once): who started it, when, and the commit it started from. True when new. */
+  noteBranch (key, { by = '', base = null } = {}) {
+    if (this.meta.branches[key]) return false
+    this.meta.branches[key] = { by, at: Date.now(), base: typeof base === 'string' && /^[0-9a-f]{40,64}$/.test(base) ? base : null, epoch: newEpoch() }
+    if (!this.meta.defaultBranch) this.meta.defaultBranch = key
+    this.saveMeta()
+    return true
+  }
+
+  /**
+   * Which document of branch `key` this is: a new id each time the branch's document is
+   * started (including after a prune). An app's saved copy of an older one is not merged in.
+   */
+  branchEpoch (key) {
+    const b = this.meta.branches[key]
+    if (!b) return null
+    if (!b.epoch) { b.epoch = newEpoch(); this.saveMeta() } // noted before epochs
+    return b.epoch
+  }
+
+  /** Whether branch `key`'s document is over the size limit (every document has the limit of its own). */
+  branchFull (key) { return this.store.size(key) > this.cfg.maxRoomBytes }
+
+  /** Branch `key`'s document, loaded, and added to the session when new (hosted agents and chat links use this). */
+  branchDoc (key, { by = '', base = null, editor = true } = {}) {
+    this.assertMigrated()
+    const k = this.resolveKey(key)
+    if (!this.meta.branches[k]) this.assertBranchRoom(editor)
+    if (this.noteBranch(k, { by, base })) this.broadcastBranches()
+    this.noteBranchSeen(k)
+    return this.store.load(k)
+  }
+
+  /**
+   * Branch `key` was used just now (joined, edited, saved, or left): refreshed in the
+   * session's meta, so the 30-day prune (task 4) never deletes a branch someone is on.
+   * Saved at most once an hour per branch unless `force` (a join is worth saving right
+   * away), so busy editing doesn't write the session's meta file on every keystroke.
+   */
+  noteBranchSeen (key, { force = false, used = false } = {}) {
+    const b = this.meta.branches[key]
+    if (!b) return
+    const now = Date.now()
+    // `used`: a member's app came onto the branch or left it. `seen` also moves when the relay
+    // itself loads or saves the branch, so only `used` says when someone last worked there (relay-ask.js).
+    if (used) b.used = now
+    if (!force && b.seen && now - b.seen < BRANCH_SEEN_SAVE_MS) return
+    b.seen = now
+    this.saveMeta()
+  }
+
+  /** A branch document just loaded: guarded like the room's files, its changes sent to the connections on it, and saved. */
+  wireBranch (e) {
+    e.guard = new Y.UndoManager([e.files, e.blobs, e.fileKeys, e.relayKeys, e.modes], { trackedOrigins: this.guard.trackedOrigins, captureTimeout: 0 })
+    e.recorded = null
+    e.undoing = null
+    e.listeners = () => e.conns
+    e.frame = (ws) => ws.branchAs
+    e.guard.on('stack-item-added', ({ stackItem, type }) => { if (type === 'undo') e.recorded = stackItem })
+    e.doc.on('update', (update, origin, doc, tr) => {
+      if (origin === e.guard && e.undoing) { e.undoing.push(update); return } // sent merged, by checkChange
+      if (origin && origin !== e.guard && this.guard.trackedOrigins.has(origin) && !this.checkChange(origin, update, tr, e)) return
+      if (origin && this.conns.has(origin)) this.noteActivity(this.holderKeys(origin))
+      // A member (hosted or connected) wrote a file in the relay's open clash on this branch: it looks again at once.
+      const rec = origin !== 'relay-upstream' && this.meta.upstreams ? this.meta.upstreams[e.key] : null
+      if (rec && rec.clash) for (const rel of changedPaths(tr, e)) this.noteClashWrite(e.key, rel)
+      // GitHub as a node: a member's change on a synced branch is pending for the next commit (relay-outbound.js).
+      if (origin !== 'relay-upstream' && this.cfg.gitSync && this.mirrors && rec) for (const rel of changedPaths(tr, e)) this.outbound.note(e.key, rel)
+      // A file edited in the session is no longer GitHub's version: its "from GitHub" mark goes (relay-sync.js markFromGithub).
+      if (origin !== 'relay-upstream') {
+        const gh = e.doc.getMap('fromGithub')
+        const gone = gh.size ? [...changedPaths(tr, e)].filter((rel) => gh.has(rel)) : []
+        if (gone.length) e.doc.transact(() => { for (const rel of gone) gh.delete(rel) }, 'relay-upstream')
+      }
+      for (const ws of e.conns) if (ws !== origin) send(ws, updateMessage(update, ws.branchAs))
+      const was = e.bytes > this.cfg.maxRoomBytes
+      e.bytes += update.length
+      if (!was && e.bytes > this.cfg.maxRoomBytes) {
+        // Only this branch: the room and the other branches carry on, and nobody is disconnected.
+        this.log(`[${this.name}] branch ${e.key} is over the size limit; further edits to it are refused (git checkout -b a new branch to keep syncing)`)
+        this.broadcastBranches()
+      }
+      this.store.scheduleSave(e)
+    })
+  }
+
+  /** Whether `rel` is a file on the branch this connection is on. */
+  onBranch (ws, rel) {
+    const e = ws.branch ? this.store.get(ws.branch) : null
+    return !!e && (e.files.has(rel) || e.blobs.has(rel))
+  }
+
+  /** A branch document was saved: records it was used just now (see noteBranchSeen), and the
+   * stored files it points at are remembered for when it is unloaded (storedIds). */
+  noteBranchSaved (e) {
+    const b = this.meta.branches[e.key]
+    if (!b) return
+    b.seen = Date.now()
+    const ids = [...e.blobs.values()].filter((x) => x && x.stored && x.stored.id).map((x) => x.stored.id).sort()
+    if (String(ids) !== String(b.stored || [])) b.stored = ids
+    this.saveMeta()
+  }
+
+  /**
+   * A room saved before branch documents kept everything in one document. That document
+   * becomes the default branch's as it is (every app's saved copy still matches it), and its
+   * room-wide parts (chat, tasks, the feed, commit requests, activity) move to a new room
+   * document. Once, before anyone connects. The branch file is written first, so the files
+   * are never only in memory, and a crash part-way is finished at the next load.
+   */
+  migrateLegacy () {
+    if (this.meta.layout === 2) return
+    const legacy = this.doc
+    if (this.docFile && (legacy.getMap('files').size || legacy.getMap('blobs').size)) {
+      const stored = [...legacy.getMap('blobs').values()].filter((x) => x && x.stored && x.stored.id).map((x) => x.stored.id).sort()
+      const room = splitLegacyDoc(legacy)
+      if (!this.store.write(DEFAULT_KEY, Y.encodeStateAsUpdate(legacy))) { room.destroy(); return } // read-only now; tried again at the next load
+      const state = Y.encodeStateAsUpdate(room)
+      try {
+        fs.writeFileSync(this.docFile + '.tmp', state)
+        fs.renameSync(this.docFile + '.tmp', this.docFile)
+      } catch (err) { room.destroy(); this.diskError(err); return }
+      legacy.destroy()
+      this.doc = room
+      this.bytes = state.length
+      this.meta.branches[DEFAULT_KEY] = { by: '', at: this.meta.createdAt || Date.now(), base: null, stored, epoch: newEpoch() }
+      this.log(`[${this.name}] moved its files into the default branch's document`)
+    } else if (this.store.stored(DEFAULT_KEY) && !this.meta.branches[DEFAULT_KEY]) {
+      // Stopped after both files were written, before this was saved: the default branch's
+      // entry is recovered with the stored ids its document already points at, so the stored-
+      // file sweep (collectStored) never mistakes them for unused before anyone loads it. Read
+      // directly, rather than through store.load: this runs before the room's own guard exists,
+      // which wireBranch (the store's onLoad) needs.
+      let stored = []
+      try {
+        const probe = new Y.Doc()
+        Y.applyUpdate(probe, fs.readFileSync(this.store.file(DEFAULT_KEY)))
+        stored = [...probe.getMap('blobs').values()].filter((x) => x && x.stored && x.stored.id).map((x) => x.stored.id).sort()
+        probe.destroy()
+      } catch (err) { this.log(`[${this.name}] could not read the default branch while recovering: ${err.message}`) }
+      this.meta.branches[DEFAULT_KEY] = { by: '', at: this.meta.createdAt || Date.now(), base: null, stored, epoch: newEpoch() }
+    }
+    if (this.meta.branches[DEFAULT_KEY] && !this.meta.defaultBranch) this.meta.defaultBranch = DEFAULT_KEY
+    this.meta.layout = 2
+    if (this.exists) this.saveMeta()
+  }
+
+  /**
+   * The default branch is ∅ (a folder without git, or a room from before branch documents)
+   * and nothing else is in the session: `key`, its first real branch, takes ∅'s document, so
+   * nobody diverges. Two names already in the session stay two branches.
+   */
+  adoptDefault (key) {
+    if (key === DEFAULT_KEY || this.defaultKey !== DEFAULT_KEY || !this.meta.branches[DEFAULT_KEY] || this.meta.branches[key]) return false
+    if (Object.keys(this.meta.branches).some((k) => k !== DEFAULT_KEY)) return false
+    this.store.rename(DEFAULT_KEY, key)
+    this.meta.branches[key] = this.meta.branches[DEFAULT_KEY]
+    delete this.meta.branches[DEFAULT_KEY]
+    this.meta.defaultBranch = key
+    for (const ws of this.conns.keys()) if (ws.branch === DEFAULT_KEY) ws.branch = key
+    for (const [id, k] of Object.entries(this.meta.hostedBranch || {})) if (k === DEFAULT_KEY) this.meta.hostedBranch[id] = key
+    this.saveMeta()
+    return true
+  }
+
+  /** Takes branch `key` out of the session: its document, its claims, hosted agents' choice of it. Never the git branch. */
+  removeBranch (key, { save = true } = {}) {
+    this.store.remove(key)
+    delete this.meta.branches[key]
+    for (const [k, c] of Object.entries(this.meta.claims)) if (this.branchOf(c) === key) delete this.meta.claims[k]
+    for (const [id, k] of Object.entries(this.meta.hostedBranch || {})) if (k === key) delete this.meta.hostedBranch[id]
+    if (save) this.saveMeta()
+  }
+
+  /**
+   * Branches nobody has been on for BRANCH_TTL_MS leave the session (never the default
+   * branch); a detached checkout (key starting with '@', with no branch name to come back
+   * to) leaves sooner, after DETACHED_TTL_MS.
+   */
+  pruneBranches (now = Date.now()) {
+    let gone = 0
+    for (const [key, b] of Object.entries(this.meta.branches)) {
+      const ttl = key.startsWith('@') ? DETACHED_TTL_MS : BRANCH_TTL_MS
+      if (key === this.defaultKey || now - (b.seen || b.at || 0) < ttl) continue
+      this.removeBranch(key, { save: false })
+      gone++
+    }
+    if (!gone) return
+    this.log(`[${this.name}] removed ${gone} branch(es) nobody was on for a while`)
+    if (this.exists) this.saveMeta()
+  }
+
+  /**
+   * The branch with the most members on it (connected apps, and hosted agents that chose
+   * one); ties go to the owner's, then the default. Hosted agents and chat links work here
+   * unless they chose a branch.
+   */
+  activeBranch () {
+    const count = new Map()
+    const counted = new Set()
+    for (const ws of this.conns.keys()) {
+      const who = this.names.get(ws)
+      if (!ws.branch || counted.has(who)) continue
+      counted.add(who)
+      count.set(ws.branch, (count.get(ws.branch) || 0) + 1)
+    }
+    for (const [id, k] of Object.entries(this.meta.hostedBranch || {})) {
+      if (this.meta.branches[k] && this.hostedSeen.has(id)) count.set(k, (count.get(k) || 0) + 1)
+    }
+    if (!count.size) return this.defaultKey
+    const top = Math.max(...count.values())
+    const tied = [...count].filter(([, n]) => n === top).map(([k]) => k)
+    const owner = [...this.access].find(([, a]) => a.owner)?.[0]?.branch
+    if (owner && tied.includes(owner)) return owner
+    if (tied.includes(this.defaultKey)) return this.defaultKey
+    return tied.sort()[0]
+  }
+
+  /** The branch a hosted agent works on: the one it chose (quilt_switch_branch), or the active branch. */
+  hostedBranch (id) {
+    const k = (this.meta.hostedBranch || {})[id]
+    return k && this.meta.branches[k] ? k : this.activeBranch()
+  }
+
+  /**
+   * A hosted agent that hasn't chosen a branch is pinned to the active branch (its first call on
+   * files), so it stays there until quilt_switch_branch even as people check other branches out.
+   */
+  pinHostedBranch (id) {
+    const k = (this.meta.hostedBranch || {})[id]
+    if (k && this.meta.branches[k]) return k
+    const to = this.activeBranch()
+    this.meta.hostedBranch = { ...(this.meta.hostedBranch || {}), [id]: to }
+    this.saveMeta()
+    this.broadcastBranches()
+    return to
+  }
+
+  /**
+   * A hosted agent works on branch `key` from now on (quilt_switch_branch), kept per member.
+   * `create`: a new branch in the session, started from a copy of the files on the branch it
+   * is on (as `git switch -c` carries a folder's work). Returns { branch, created, from }.
+   */
+  setHostedBranch (id, key, { create = false, by = '', editor = true, github = null } = {}) {
+    if (!validBranchKey(key) || key === DEFAULT_KEY) throw new Error(`"${String(key).slice(0, 60)}" isn't a branch name.`)
+    const to = this.resolveKey(key)
+    const from = this.hostedBranch(id)
+    const exists = !!this.meta.branches[to]
+    if (!exists && !create) throw new Error(`${key} isn't in this session. Pass create: true to start it: from GitHub when the branch is there, otherwise from a copy of the files on ${from}.`)
+    if (exists && create) throw new Error(`${key} is already in this session: switch to it without create.`)
+    if (!exists && github) {
+      // The branch as it is on GitHub (branchFromGitHub): its files at its head, and the commit
+      // they are, so the relay brings later commits on it in (relay-upstream.js).
+      this.assertMigrated()
+      this.assertBranchRoom(editor, github.bytes || 0)
+      const e = this.branchDoc(to, { by, base: null, editor })
+      e.doc.transact(() => {
+        for (const [rel, t] of github.texts) { const y = new Y.Text(); y.insert(0, t); e.files.set(rel, y) }
+        for (const [rel, b] of github.blobs) e.blobs.set(rel, b)
+      }, 'hosted-branch')
+      upstreamsOf(this)[to] = { ...github.upstream, head: github.upstream.sha, checkedAt: Date.now(), hostedAt: Date.now() }
+    } else if (!exists) {
+      this.assertMigrated()
+      this.assertBranchRoom(editor, this.store.size(from)) // a copy of `from`'s files
+      const src = this.branchDoc(from, { by })
+      const e = this.branchDoc(to, { by, base: this.meta.branches[from] ? this.meta.branches[from].base : null, editor })
+      e.doc.transact(() => {
+        for (const [rel, t] of src.files) { const y = new Y.Text(); y.insert(0, t.toString()); e.files.set(rel, y) }
+        for (const [rel, b] of src.blobs) e.blobs.set(rel, b)
+        for (const [k, v] of src.fileKeys) e.fileKeys.set(k, v)
+        for (const [k, v] of src.relayKeys) e.relayKeys.set(k, v)
+      }, 'hosted-branch')
+      this.noteBranchCut(to, from)
+    }
+    this.meta.hostedBranch = { ...(this.meta.hostedBranch || {}), [id]: to }
+    if (this.meta.remoteBranches && this.meta.remoteBranches[to]) delete this.meta.remoteBranches[to]
+    this.saveMeta()
+    this.broadcastBranches()
+    return { branch: to, created: !exists, from }
+  }
+
+  /**
+   * GitHub as a node: a branch cut in the session from a live-synced branch is mirrored to the
+   * GitHub branch of the same name (plan §0, §2): its record follows the same repository, and it
+   * is measured from where it was cut, so its first push creates it on GitHub on that commit.
+   */
+  noteBranchCut (to, from) {
+    if (!this.cfg.gitSync || !this.mirrors) return false
+    const recs = upstreamsOf(this)
+    const src = recs[from]
+    if (!src || !src.repo || !src.ref || recs[to]) return false
+    const base = (this.meta.sync && this.meta.sync[from] && this.meta.sync[from].base) || src.sha
+    if (!base) return false
+    const remote = src.name && src.name.endsWith(`/${src.ref}`) ? src.name.slice(0, -(src.ref.length + 1)) : 'origin'
+    recs[to] = { repo: src.repo, name: `${remote}/${to}`, ref: to, sha: base, head: null, cutFrom: from, cutAt: base, checkedAt: 0, ...(src.github ? { github: { ...src.github } } : {}) }
+    syncStateOf(this, to).base = base
+    this.saveMeta()
+    return true
+  }
+
+  /** A hosted agent's branch choice, forgotten once its membership here ends (it left, or the owner removed it). */
+  forgetHostedBranch (id, { save = true } = {}) {
+    if (!this.meta.hostedBranch || !(id in this.meta.hostedBranch)) return
+    delete this.meta.hostedBranch[id]
+    if (save) this.saveMeta()
+  }
+
+  /**
+   * Whether a new branch may start: not over the session's branch limit or its total size
+   * (every document together, with `adding` bytes more for the copy a new branch starts
+   * from), and (unless `editor` is false) started by someone who may change files. Shared by
+   * branchRequest's join and branchDoc (hosted agents, chat links), so the same caps and
+   * editor-only rule apply wherever a branch can be created. Refusing here never
+   * disconnects anyone: the folder stays on its branch.
+   */
+  assertBranchRoom (editor = true, adding = 0) {
+    if (this.unsavable) throw new Error("The relay can't save this session right now, so it can't take another branch.")
+    if (this.totalBytes() + adding > this.cfg.maxRoomBytes * MAX_TOTAL_FACTOR) throw new Error("This session is at its size limit across all its branches, so it can't take another branch. Branches nobody is on leave the session after 30 days.")
+    if (Object.keys(this.meta.branches).length >= MAX_BRANCHES) throw new Error(`This session already has ${MAX_BRANCHES} branches, its limit; an existing one has to go before another can start.`)
+    if (!editor) throw new Error('you can only view this session, so you cannot start a new branch')
+  }
+
+  /** A room whose move to branch documents failed on the relay's disk (migrateLegacy) stays read-only: no branch document is used. */
+  assertMigrated () {
+    if (this.meta.layout !== 2) throw new Error("The relay couldn't finish updating how it stores this session (its disk refused), so the session is read-only until the relay is fixed.")
+  }
+
+  /** The session's branches, for everyone's branch menu (hosted: the hosted agents on each). */
+  branchList () {
+    const hosted = new Map()
+    for (const h of this.hostedOnline()) {
+      const k = this.hostedBranch(h.id)
+      hosted.set(k, [...(hosted.get(k) || []), h.name])
+    }
+    const ups = this.meta.upstreams || {}
+    const list = Object.entries(this.meta.branches).map(([key, b]) => {
+      const relay0 = relayEntry(ups[key])
+      const live = relay0 && this.cfg.gitSync && this.mirrors ? liveSyncOn(this, key) : false
+      const sync = relay0 && this.cfg.gitSync && this.mirrors ? syncStatus(this, key, { live }) : null
+      const st = this.meta.sync && this.meta.sync[key]
+      // `git`: this relay serves the session's branches over git (relay-githttp.js): agents' folders use it as their origin.
+      const relay = relay0 ? { ...relay0, ...(sync ? { sync } : {}), ...(live ? { live: true } : {}), ...(this.cfg.gitSync && this.cfg.gitHttp !== false && this.cfg.passPublicKey && this.mirrors && this.dataDirOf && /^github\.com\//.test(String(relay0.repo || '')) ? { git: true } : {}), ...(live && this.meta.largeToRelay === true && this.relayFileKey ? { fileKey: this.relayFileKey.publicKey } : {}), ...(live && st && st.protected && !st.protected.leased ? { protected: true } : {}), ...(live && st && st.protected && st.protected.leased ? { leased: true, ...(this.sameOwner(ups[key].leasedBy) ? { liveIn: ups[key].leasedBy } : {}) } : {}), ...(st && st.pr && st.pr.number ? { pr: { number: st.pr.number, url: st.pr.url || '' } } : {}) } : null
+      const merged = ups[key] && ups[key].merged ? { into: ups[key].merged.into, number: ups[key].merged.number, at: ups[key].merged.at } : null
+      return { key, by: b.by || '', at: b.at || 0, base: b.base || null, default: key === this.defaultKey, hosted: hosted.get(key) || [], ...(this.branchFull(key) ? { full: true } : {}), ...(relay ? { relay } : {}), ...(merged ? { merged } : {}) }
+    })
+    // Branches on GitHub the session doesn't have yet (a create webhook, §5.4): in the menu, synced once someone opens them.
+    for (const [key, r] of Object.entries(this.meta.remoteBranches || {})) if (!this.meta.branches[key]) list.push({ key, by: '', at: (r && r.at) || 0, base: null, default: false, hosted: [], onGitHub: true })
+    return list
+  }
+
+  // ------------------------------------------------------- upstream (relay-upstream.js) --
+  // Commits pushed to GitHub come into a branch through a member's folder. A branch only hosted
+  // agents are working on, with no folder online, is brought up to date by the relay instead.
+
+  /** Members' presence says which upstream each branch follows, and the commit its folders are at. */
+  noteUpstreams () {
+    if (!this.exists || this.ended || this.destroyed) return
+    noteHolds(this)
+    const was = new Map(Object.entries(upstreamsOf(this)).map(([key, rec]) => [key, rec && rec.sha]))
+    if (noteFolders(this, this.log)) {
+      this.saveMeta(); this.broadcastBranches(); this.noteConnections()
+      // A folder brought GitHub's commits in itself (an older app): their files are marked as from GitHub too.
+      if (this.cfg.gitSync && this.mirrors) {
+        for (const [key, rec] of Object.entries(upstreamsOf(this))) {
+          const from = was.get(key)
+          if (rec && rec.sha && from && rec.sha !== from && rec.relayHead !== rec.sha) markFolderBrought(this, key, from, rec.sha, { log: this.log })
+        }
+      }
+    }
+    // With the mirror on, a branch due a look (at start, after a member connects, or when the backstop is up) is looked at as soon as someone is on it.
+    if (this.cfg.gitSync && this.mirrors) {
+      for (const ws of this.conns.keys()) if (ws.branch && !this.lookedFor.has(ws)) { this.lookedFor.add(ws); const rec = upstreamsOf(this)[ws.branch]; if (rec) { rec.checkedAt = 0; delete rec.webhookAt } }
+      this.lookSoon()
+    }
+  }
+
+  /**
+   * What agents may commit, when the session's org or workspace sets it for all its sessions (the accounts API's
+   * /v1/relay/session-policy): kept in meta.agentCommitsSet ({ mode, by, name }) and put before the owner's own.
+   * Asked when the room loads, about every ten minutes, and at once when the API says it changed (/github/policy).
+   */
+  async refreshPolicy () {
+    if (!this.cfg.apiUrl || !this.cfg.relayApiSecret || this.destroyed || !this.exists) return
+    this.policyAt = Date.now()
+    try {
+      const res = await (this.apiFetch || globalThis.fetch)(`${String(this.cfg.apiUrl).replace(/\/+$/, '')}/v1/relay/session-policy`, { method: 'POST', headers: { 'content-type': 'application/json', authorization: `Bearer ${this.cfg.relayApiSecret}` }, body: JSON.stringify({ room: this.name }) })
+      if (!res.ok || this.destroyed) return
+      const b = await res.json()
+      const next = AGENT_COMMITS.includes(b.agentCommits) ? { mode: b.agentCommits, by: ['org', 'team'].includes(b.by) ? b.by : 'workspace', name: String(b.name || '').slice(0, 100) } : null
+      if (JSON.stringify(next) === JSON.stringify(this.meta.agentCommitsSet || null)) return
+      const was = agentCommitsOf(this)
+      if (next) this.meta.agentCommitsSet = next; else delete this.meta.agentCommitsSet
+      this.saveMeta()
+      if (agentCommitsOf(this) === 'off' && was !== 'off') this.revokeAgentTokens({ access: 'write' })
+      this.broadcastAccess()
+      this.log(`[${this.name}] what agents may commit: ${next ? `${next.mode}, set by the ${next.by}${next.name ? ` ${next.name}` : ''}` : 'the session owner decides'}`)
+    } catch (err) { this.log(`[${this.name}] could not ask the accounts API what agents may commit: ${err.message}`) }
+  }
+
+  /** Each branch that follows a GitHub repository learns whether a member's connection lets agents commit there (relay-upstream.js noteConnection). */
+  noteConnections ({ keys = null, force = false } = {}) {
+    if (force || Date.now() - (this.policyAt || 0) > POLICY_EVERY_MS) this.refreshPolicy()
+    // Which GitHub account each person linked, for commit authorship (relay-github.js); about once an hour.
+    if (this.cfg.gitSync && this.mirrors) noteMemberLogins(this, { force, fetch: this.apiFetch }).catch(() => {})
+    for (const [key, rec] of Object.entries(upstreamsOf(this))) {
+      if (!rec || !rec.repo || (keys && !keys.includes(key))) continue
+      // A "yes" stands an hour; a "no" is asked again every ten minutes (someone may have connected
+      // from an app that couldn't say so), unless forced.
+      if (!force && rec.github && Date.now() - (rec.github.at || 0) < (rec.github.state === 'ok' ? 60 : 10) * 60 * 1000) continue
+      noteConnection(this, key, { force }).then((changed) => { if (changed && !this.destroyed) { this.saveMeta(); this.broadcastBranches(); this.broadcastAccess() } }).catch((err) => this.log(`[${this.name}] ${key}: could not check the GitHub connection: ${err.message}`))
+    }
+  }
+
+  /** A hosted agent just called a tool: its branch counts as worked on (kept, so it outlasts the room leaving memory), and is looked at if due. */
+  noteHostedUpstream (id) {
+    const key = this.meta.layout === 2 ? this.hostedBranch(id) : null
+    const rec = key && (this.meta.upstreams || {})[key]
+    if (rec && Date.now() - (rec.hostedAt || 0) >= 60 * 1000) { rec.hostedAt = Date.now(); this.saveMeta() }
+    this.lookSoon()
+  }
+
+  /** The relay's next look at the branches due (not forced), as soon as the current turn is over. */
+  lookSoon () {
+    if (!this.cfg.upstreamAuto || this.upstreamSoonTimer) return
+    this.upstreamSoonTimer = setTimeout(() => {
+      this.upstreamSoonTimer = null
+      this.checkUpstreams().catch((err) => this.log(`[${this.name}] could not look for new commits: ${err.message}`))
+    }, 0)
+    this.upstreamSoonTimer.unref?.()
+  }
+
+  /**
+   * Looks at GitHub for the branches due (or, with `force`, every branch the relay looks after,
+   * except those GitHub told to wait), one at a time; only `keys` when given. One run at a time:
+   * an ask meanwhile gets that run.
+   */
+  checkUpstreams ({ force = false, keys = null } = {}) {
+    // A look asked for (force) waits for one under way, then has its own: the one under way may not include its branches.
+    if (this.upstreamRun) return force ? this.upstreamRun.catch(() => {}).then(() => this.checkUpstreams({ force, keys })) : this.upstreamRun
+    if (!this.exists || this.ended || this.destroyed || this.meta.layout !== 2) return Promise.resolve([])
+    this.noteConnections({ keys }) // the connections, about once an hour per branch, with the relay's own looks
+    const now = Date.now()
+    // With the mirror on: about every minute (git ls-remote, no API quota); webhooks in between (addendum 16.13).
+    const live = this.cfg.gitSync && this.mirrors
+    const activeMs = Number.isFinite(this.cfg.activeBackstopMs) ? this.cfg.activeBackstopMs : ACTIVE_BACKSTOP_MS
+    const due = live && !force
+      ? [...new Set([...dueBranches(this, { now, everyMs: activeMs, keys }).filter((k) => relayLooksActive(this, k)), ...dueBranches(this, { now, everyMs: BACKSTOP_MS, keys })])]
+      : dueBranches(this, { now, everyMs: force ? 0 : this.cfg.upstreamCheckMs, keys })
+    if (!due.length) return Promise.resolve([])
+    this.upstreamRun = (async () => {
+      const out = []
+      for (const key of due) {
+        if (this.destroyed || !relayLooks(this, key)) continue
+        try {
+          // Through the relay's git mirror (GitHub as a node), or the older REST path.
+          const r = this.cfg.gitSync && this.mirrors ? await bringInBranch(this, key, { log: this.log }) : await checkBranch(this, key, { fetch: this.githubFetch, log: this.log, fallbackToken: this.cfg.githubToken })
+          out.push({ branch: key, ...r })
+          // GitHub out of reach for a look: the branch says so (offline), until a look gets through.
+          const sync = this.cfg.gitSync && this.meta.sync && this.meta.sync[key]
+          if (sync && r.unreachable && !sync.paused) {
+            sync.paused = { why: 'unreachable', at: Date.now(), text: 'a look at GitHub failed', backoffMs: 0, until: 0 }
+            const rec = upstreamsOf(this)[key]
+            if (rec) rec.problem = `GitHub unreachable since ${new Date(sync.paused.at).toISOString().slice(11, 16)} UTC: the session keeps working, and GitHub's changes come in when it answers`
+            this.saveMeta(); this.broadcastBranches()
+          }
+          // GitHub answered: an outage is over. Commits asked for meanwhile go now; otherwise the branch just says it is reachable again.
+          if (sync && sync.paused && sync.paused.why === 'unreachable' && ['brought', 'up-to-date', 'recovered', 'rewrite'].includes(r.state)) {
+            if (Array.isArray(sync.asked) && sync.asked.length) this.outbound.recover(key).catch((err) => this.log(`[${this.name}] ${key}: could not make the commits asked for: ${err.message}`))
+            else {
+              delete sync.paused
+              const rec = upstreamsOf(this)[key]
+              if (rec && /^GitHub unreachable since/.test(rec.problem || '')) delete rec.problem
+              this.saveMeta(); this.broadcastBranches()
+            }
+          }
+        } catch (err) {
+          this.log(`[${this.name}] ${key}: could not look for new commits: ${err.message}`)
+          out.push({ branch: key, state: 'error' })
+        }
+      }
+      return out
+    })().finally(() => { this.upstreamRun = null })
+    return this.upstreamRun
+  }
+
+  /** Looks at branches `keys` now, after any look under way (not the one under way: it may not include them). */
+  async checkUpstreamsNow (keys) {
+    while (this.upstreamRun) { try { await this.upstreamRun } catch {} }
+    return this.checkUpstreams({ force: true, keys })
+  }
+
+  /** The claims held for clash task `id` (and its holder's requests for its files) let go of: the merge is done. */
+  dropClashClaims (id) {
+    const held = Object.values(this.meta.claims || {}).some((c) => c.clash === id || (c.queue || []).some((r) => r.clash === id))
+    if (!held) return
+    this.dropRequests((r) => r.clash === id)
+    this.dropClaims((c) => c.clash === id, (c) => `the merge ${c.by} held it for (task ${id}) is done.`)
+    this.broadcastClaims()
+  }
+
+  /**
+   * Claims the files of clash task `id` for its assignee `who` (a claimant: { name, id, talk, branch })
+   * on that branch, taking them over from whoever held them for the task before. A file someone else
+   * holds is asked for in its file queue instead. Returns { claimed: [path], asked: [{ path, holder }] }.
+   */
+  claimClashFiles (who, id, paths, { upstream = 'upstream' } = {}) {
+    const claimed = []
+    const asked = []
+    for (const rel of paths) {
+      try {
+        this.claimRequest(who, { op: 'claim', pattern: rel, note: `Merging commits from ${upstream} (task ${id})`, clash: id })
+        claimed.push(rel)
+      } catch {
+        const c = this.claimFor(rel, who.branch)
+        if (!c) continue
+        try {
+          this.claimRequest(who, { op: 'request', path: rel, title: `Merging commits from ${upstream}`, description: `Task ${id}: the commits clash with the session's work in this file. I merge it once you hand it over.`, task: id, clash: id })
+          asked.push({ path: rel, holder: c.by })
+        } catch {}
+      }
+    }
+    if (claimed.length || asked.length) this.broadcastClaims()
+    return { claimed, asked }
+  }
+
+  /** Branch `key` is looked at again at once, a moment from now (several asks make one look). */
+  upstreamSoon (key) {
+    if (!this.cfg.upstreamOnChange || !key) return
+    this.upstreamSoonKeys.add(key)
+    if (this.upstreamAgainTimer) return
+    this.upstreamAgainTimer = setTimeout(() => {
+      this.upstreamAgainTimer = null
+      const keys = [...this.upstreamSoonKeys]
+      this.upstreamSoonKeys.clear()
+      this.checkUpstreamsNow(keys).catch((err) => this.log(`[${this.name}] could not look for new commits: ${err.message}`))
+    }, 50)
+    this.upstreamAgainTimer.unref?.()
+  }
+
+  /** A file on branch `key` changed by a member: when it is in the relay's open clash there, the relay looks again at once. */
+  noteClashWrite (key, rel) {
+    const rec = (this.meta.upstreams || {})[key]
+    if (rec && rec.clash && rec.clash.files && rel in rec.clash.files) this.upstreamSoon(key)
+  }
+
+  /**
+   * A task moved to QA or Done: when it is a relay clash's and its assignee moved it, the files it
+   * lists count as merged as they are (for that commit), and the relay looks again at once.
+   * Who moved it: the connection's member (or one of its AI sessions), or the hosted agent whose tool ran.
+   */
+  noteClashMoved (id, task, origin) {
+    const recs = this.meta.upstreams || {}
+    const key = Object.keys(recs).find((k) => recs[k] && recs[k].clash && recs[k].clash.task === id)
+    if (!key || !task.assignee) return
+    const names = []
+    if (origin && this.conns.has(origin)) {
+      names.push(this.names.get(origin))
+      const states = this.awareness.getStates()
+      for (const cid of this.conns.get(origin)) for (const p of (states.get(cid)?.personas || [])) if (p && p.name) names.push(p.name)
+    } else if (this.auditAs && this.meta.members[this.auditAs]) names.push(this.meta.members[this.auditAs].name)
+    if (!names.includes(task.assignee)) return
+    const rec = recs[key]
+    rec.clash.settled = { by: task.assignee, at: Date.now() }
+    this.saveMeta()
+    this.log(`[${this.name}] ${key}: ${task.assignee} moved the clash task ${id} to ${task.column}: its files count as merged`)
+    this.upstreamSoon(key)
+  }
+
+  /**
+   * quilt_sync_branch where no folder can do it: the relay asks GitHub about branch `key` now
+   * (at most once a minute per branch) and brings commits in as on its own looks.
+   * Returns { state, said } (said: for the AI that asked).
+   */
+  async syncUpstreamNow (key) {
+    key = this.resolveKey ? this.resolveKey(key) : key
+    const rec = upstreamsOf(this)[key]
+    if (!rec || !rec.repo || !rec.ref) return { state: 'unknown-repo', said: `The relay doesn't know which GitHub repository \`${key}\` follows yet: a member's folder on it (a git clone) tells it once it is online.` }
+    if (!rec.sha) return { state: 'unknown-commit', said: `The relay doesn't know which commit of ${rec.name || 'the upstream'} the session's files on \`${key}\` are at yet: a member's folder on it, in step with the session, tells it.` }
+    // With the mirror on, folders follow the relay's commits: only an older app's folder brings them in itself.
+    const folder = this.cfg.gitSync && this.mirrors ? catcherAble(this, key) : folderAble(this, key)
+    if (folder) return { state: 'folder', said: `${folder}'s folder on \`${key}\` brings commits in itself (it fetches ${rec.name} about once a minute), so the relay leaves it to that folder.` }
+    if (!relayLooks(this, key)) return { state: 'not-looking', said: `The relay isn't looking after \`${key}\` right now.` }
+    const now = Date.now()
+    const last = this.syncAsked.get(key) || 0
+    // Through the mirror a look is a git ls-remote, no API quota: folders waiting for a commit ask too (session.js bringIn).
+    const mirror = this.cfg.gitSync && this.mirrors
+    if (now - last < (mirror ? SYNC_EVERY_GIT_MS : SYNC_EVERY_MS)) {
+      const ago = Math.max(1, Math.round((now - (rec.checkedAt || last)) / 1000))
+      return { state: 'recent', said: `The relay asked GitHub about ${rec.name} for \`${key}\` ${ago}s ago, and asks at most once ${mirror ? `every ${SYNC_EVERY_GIT_MS / 1000} seconds` : 'a minute'} per branch. ${rec.clash ? `Its clash is task ${rec.clash.task} on the board.` : rec.problem ? `Note: ${rec.problem}.` : rec.sha === rec.head ? `\`${key}\` was up to date with ${rec.name} then.` : ''}`.trim() }
+    }
+    this.syncAsked.set(key, now)
+    if (rec.backoffUntil > now) return { state: 'backoff', said: `Not now: ${rec.problem || 'GitHub asked the relay to slow down'}.` }
+    const out = await this.checkUpstreamsNow([key])
+    const r = out.find((x) => x.branch === key)
+    return { state: r ? r.state : 'not-looking', said: describeRelayCheck(r, upstreamsOf(this)[key] || rec, key, this) }
+  }
+
+  /**
+   * A member's commit to GitHub from the session's copy of the files on branch `key`
+   * (relay-commit.js): who is { name, kind, access }; `req` says files, message, branch,
+   * pullRequest, withOthers, task. One at a time per session.
+   */
+  async commitFor (who, key, req = {}) {
+    const run = () => commitForMember(this, {
+      who,
+      key,
+      files: Array.isArray(req.files) ? req.files.slice(0, 1000).map(String) : null,
+      message: typeof req.message === 'string' ? req.message : '',
+      branch: typeof req.branch === 'string' ? req.branch : '',
+      pullRequest: req.pullRequest === true,
+      withOthers: req.withOthers === true,
+      task: typeof req.task === 'string' ? req.task : null
+    }, { fetch: this.githubFetch, log: this.log })
+    const next = (this.committing || Promise.resolve()).then(run, run)
+    this.committing = next.catch(() => {})
+    return next
+  }
+
+  /**
+   * A token for the repository branch `key` follows, for a member's folder (relay-github.js): read,
+   * to fetch or clone; write (`access`), to push with, while git is on for everyone here (git for
+   * everyone: agentCommitsOf isn't 'off'; an agent's pre-push hook holds its pushes to the policy's
+   * branches). An agent's or a person's write token is their own (minted for them alone, `actingFor`
+   * their account, so the org's Require GitHub and the workspace's repositories apply as for anyone),
+   * kept here so it can be taken back at GitHub when they are removed or git turns off. `who`:
+   * { name, kind, id } (id: their account, person:<id>). { token, expiresAt, repo, access } or
+   * { state } when there is none. A token the owner pasted by hand is never handed out.
+   */
+  async gitTokenFor (key, { access = 'read', who = null, repo: asked = null } = {}) {
+    key = this.resolveKey(key)
+    // The repository: the one the folder's git names (`asked`, owner/name), when a branch here follows
+    // it; else the branch's own record, else the default branch's (a new feature branch has no record yet).
+    let rec = null
+    if (typeof asked === 'string' && /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(asked)) {
+      rec = Object.values(upstreamsOf(this)).find((r) => r && r.repo && String(r.repo).toLowerCase() === `github.com/${asked}`.toLowerCase()) || null
+    }
+    if (!rec) rec = (repoRecordFor(this, key) || {}).rec || null
+    const repo = rec && rec.repo ? parseRepo(`https://${rec.repo}`) : null
+    if (!repo || !repo.github) return { state: 'not-github' }
+    const full = `${repo.owner}/${repo.name}`
+    const agent = !!who && who.kind === 'agent' && !!who.name
+    const person = !!who && who.kind !== 'agent' && /^person:[A-Za-z0-9_-]{1,64}$/.test(who.id || '')
+    const on = agentCommitsOf(this) !== 'off'
+    const level = access === 'write' && on && (agent || person) ? 'write' : 'read'
+    // A person reading: the relay's own read token, as before. Everyone writing, and agents always, get one of their own.
+    if (!agent && level === 'read') {
+      const r = await appCredentials(this, full, { access: level })
+      return r.token ? { token: r.token, expiresAt: r.expiresAt, repo: full, access: level } : { state: r.state }
+    }
+    if (!this.agentTokens) this.agentTokens = new Map()
+    const k = `${agent ? who.name : who.id}\0${full}\0${level}`.toLowerCase()
+    const hit = this.agentTokens.get(k)
+    if (hit && hit.expiresAt - Date.now() > 5 * 60 * 1000) return { token: hit.token, expiresAt: hit.expiresAt, repo: full, access: level }
+    // Who the token is for decides when the org requires GitHub (plan §2): an agent's member key is agent:<id>, a person's person:<id>.
+    const actor = agent ? (Object.entries(this.meta.members || {}).find(([k, m]) => k.startsWith('agent:') && m && m.name === who.name) || [])[0] : who.id
+    const r = await appCredentials(this, full, { access: level, share: false, ...(actor ? { actingFor: actor } : {}) })
+    if (!r.token) return { state: r.state, ...(r.why ? { why: r.why } : {}), ...(r.require ? { require: true } : {}) }
+    this.agentTokens.set(k, { token: r.token, expiresAt: r.expiresAt, name: who.name, account: agent ? actor || '' : who.id, access: level })
+    return { token: r.token, expiresAt: r.expiresAt, repo: full, access: level }
+  }
+
+  /** Takes back the tokens handed to members' folders: one agent's (`name`), one account's (`account`), or every write token (`access`). */
+  revokeAgentTokens ({ name = null, account = null, access = null } = {}) {
+    if (!this.agentTokens) return
+    for (const [k, t] of this.agentTokens) {
+      if ((name && t.name !== name) || (account && t.account !== account) || (access && t.access !== access)) continue
+      this.agentTokens.delete(k)
+      revokeGitHubToken(t.token, { fetch: this.githubFetch }).then((ok) => { if (ok) this.log(`[${this.name}] took back ${t.name}'s ${t.access} token for GitHub`) })
+    }
+  }
+
+  /** Everyone's access again: what agents may do with commits, and whether they can (the GitHub connection) changed. */
+  broadcastAccess () { for (const [cws, a] of this.access) send(cws, jsonMessage(MSG_ACCESS, this.accessMessage(a))) }
+
+  /**
+   * Git for this session, the owner's call ('off', 'branches', 'any'; '' follows the rule over the session,
+   * or the default): within the rule over it (an org's, a team's, a workspace's), which is a ceiling: the
+   * owner may be stricter, never looser. Everyone's access says it.
+   */
+  setAgentCommits (mode) {
+    if (mode !== '' && !AGENT_COMMITS.includes(mode)) throw new Error(`pick one of ${AGENT_COMMITS.join(', ')}`)
+    const set = this.meta.agentCommitsSet
+    if (mode && set && POLICY_RANK[mode] > POLICY_RANK[set.mode]) {
+      const what = set.mode === 'off' ? 'turned git off for its sessions' : 'lets agents push only to branches of their own in its sessions'
+      throw new Error(`${ruleSetter(set)} ${what}: change it in its settings`)
+    }
+    if ((mode || undefined) !== this.meta.agentCommits) {
+      const was = agentCommitsOf(this)
+      if (mode) this.meta.agentCommits = mode; else delete this.meta.agentCommits
+      this.saveMeta()
+      if (agentCommitsOf(this) === 'off' && was !== 'off') this.revokeAgentTokens({ access: 'write' }) // nobody's folder can push any more, at once
+      for (const [cws, a] of this.access) send(cws, jsonMessage(MSG_ACCESS, this.accessMessage(a)))
+    }
+    return agentCommitsOf(this)
+  }
+
+  /** The owner sets (or clears, with '') the read-only GitHub token. Never echoed or logged. */
+  setGithubToken (token) {
+    const t = String(token ?? '').trim()
+    if (t && !validToken(t)) throw new Error("That doesn't look like a GitHub token (ghp_… or github_pat_…).")
+    if (t) this.meta.githubToken = t
+    else delete this.meta.githubToken
+    this.log(`[${this.name}] the owner ${t ? 'set' : 'cleared'} the GitHub token for bringing in commits`)
+    this.upstreamTokenChanged()
+    this.broadcastAccess() // the owner sees whether a token is set; everyone sees whether agents can commit now
+    return { ok: true, githubToken: !!t }
+  }
+
+  /**
+   * A branch on GitHub a hosted agent switches to with create (quilt_switch_branch): its files at
+   * the branch's head, from the repository the session follows (the agent's branch's, else any
+   * branch's). { state: 'loaded', texts, blobs, skipped, bytes, upstream: { repo, name, ref, sha } }
+   * or { state, repo } saying why not ('no-repo', 'not-github', 'no-branch', 'private', ...).
+   */
+  async branchFromGitHub (id, key) {
+    const recs = upstreamsOf(this)
+    const mine = recs[this.hostedBranch(id)]
+    const src = mine && mine.repo ? mine : Object.values(recs).find((r) => r && r.repo)
+    if (!src) return { state: 'no-repo' }
+    const repo = parseRepo(`https://${src.repo}`)
+    if (!repo || !repo.github) return { state: 'not-github', repo: src.repo }
+    const own = validToken(this.meta.githubToken) ? this.meta.githubToken : null
+    const token = own || (validToken(this.cfg.githubToken) ? this.cfg.githubToken : null)
+    const r0 = await loadBranch({ repo: src.repo, ref: key, token, fetch: this.githubFetch })
+    const r = r0.state === 'token-refused' && !own ? { ...r0, state: 'private' } : r0
+    const remote = src.name && src.ref && src.name.endsWith(`/${src.ref}`) ? src.name.slice(0, -(src.ref.length + 1)) : 'origin'
+    return { ...r, repo: src.repo, ...(r.state === 'loaded' ? { upstream: { repo: src.repo, name: `${remote}/${key}`, ref: key, sha: r.head } } : {}) }
+  }
+
+  /** The owner set (or cleared) the read-only GitHub token: every branch is looked at afresh. */
+  upstreamTokenChanged () {
+    for (const rec of Object.values(upstreamsOf(this))) { delete rec.problem; delete rec.backoffUntil; delete rec.backoffMs; delete rec.etag; rec.checkedAt = 0 }
+    this.saveMeta()
+    this.broadcastBranches()
+    if (this.cfg.upstreamAuto) this.checkUpstreams().catch(() => {})
+  }
+
+  broadcastBranches () {
+    const msg = jsonMessage(MSG_BRANCHES, { branches: this.branchList() })
+    for (const ws of this.conns.keys()) send(ws, msg)
+  }
+
+  /**
+   * GitHub said `repo` (owner/name) moved `ref` (a branch name) to `sha`. Every branch of this
+   * session that follows it looks now: folders on it are told to fetch (older apps ignore the
+   * field and find it on their next look), and the relay checks GitHub itself for a branch no
+   * folder can bring in. Returns whether any branch follows it.
+   */
+  /** The open clashes on every branch (relay-clash.js): timeouts and hand-offs, about once a minute, one branch at a time in its queue. */
+  async reviewClashTick () {
+    if (!this.cfg.gitSync || !this.mirrors || !this.meta.sync) return []
+    const out = []
+    for (const [key, st] of Object.entries(this.meta.sync)) {
+      if (!st || !Array.isArray(st.held) || !st.held.some((h) => h.why === 'clash')) continue
+      const rec = upstreamsOf(this)[key]
+      const repo = rec && parseRepo(`https://${rec.repo}`)
+      if (!repo) continue
+      out.push(...await this.mirrors.queue(repo.slug, rec.ref, () => reviewClashes(this, key)))
+    }
+    return out
+  }
+
+  /** Whether session `other` has this session's owner in it (its owner or a member): then the app may offer to open it ("Open the live session", plan §8). */
+  sameOwner (other) {
+    if (!other || !this.meta.ownerSub) return false
+    if (this.dataDirOf) {
+      try {
+        const m = JSON.parse(fs.readFileSync(path.join(this.dataDirOf, `${other}.json`), 'utf8'))
+        return m.ownerSub === this.meta.ownerSub || !!(m.members && m.members[this.meta.ownerSub])
+      } catch {}
+    }
+    // On another relay machine: the accounts API knows who owns it and who has been in it (asked once, then remembered).
+    if (this.cluster) return this.cluster.sameOwner(other, this.meta.ownerSub, () => { if (!this.destroyed) this.broadcastBranches() }) === true
+    return false
+  }
+
+  /** The relay pushed `sha` to branch `key`'s upstream: folders on it fetch now and follow it (no file is written: the session has it). */
+  tellPushed (key, sha) {
+    const msg = jsonMessage(MSG_BRANCHES, { branches: this.branchList(), pushed: { branch: key, sha } })
+    for (const ws of this.conns.keys()) send(ws, msg)
+  }
+
+  /** Session → GitHub for this room (relay-outbound.js): batches per branch, the push. */
+  get outbound () {
+    if (!this._outbound) this._outbound = outboundFor(this)
+    return this._outbound
+  }
+
+  /** Where the git of `repo` ({ slug, host, owner, name }) is: GitHub, or wherever tests say. */
+  gitRemoteUrl (repo) {
+    return this.cfg.gitRemote ? this.cfg.gitRemote(repo.slug) : `https://${repo.slug}.git`
+  }
+
+  /** What signs the relay's git in to read `repo`: the owner's token, a member's GitHub connection, the relay's own token, or nothing (a public repository). */
+  async gitToken (repo, { access = 'read', actingFor = '' } = {}) {
+    return (await this.gitTokenState(repo, { access, actingFor })).token
+  }
+
+  /** { token } for the relay's git on `repo`, or { token: null, state, why? } saying why not (plan §2: the workspace's access mode, the org's Require GitHub). */
+  async gitTokenState (repo, { access = 'read', actingFor = '' } = {}) {
+    if (validToken(this.meta.githubToken)) return { token: this.meta.githubToken }
+    const r = await appCredentials(this, `${repo.owner}/${repo.name}`, { access, fresh: false, actingFor })
+    if (r.token) return { token: r.token }
+    if (r.state === 'not-allowed' || r.require) return { token: null, state: r.state, ...(r.why ? { why: r.why } : {}), ...(r.require ? { require: true } : {}) }
+    return { token: validToken(this.cfg.githubToken) ? this.cfg.githubToken : null, state: r.state }
+  }
+
+  /** A check suite finished on `repo`: the pull requests this room's tasks are in are looked at now (relay-commit.js reviewPulls). */
+  noteChecks ({ repo, sha = '', branch = '', conclusion = '' }) {
+    const want = String(repo).toLowerCase().replace(/^github\.com\//, '')
+    const follows = Object.values(upstreamsOf(this)).some((rec) => rec && rec.repo && String(rec.repo).toLowerCase().replace(/^github\.com\//, '') === want)
+    if (!follows) return false
+    // Checks on a commit the relay pushed with merged files in it (relay-clash.js): failing pulls both parties in; passing lets held files go.
+    if (this.cfg.gitSync && this.mirrors && /^[0-9a-f]{40}$/.test(sha)) {
+      for (const [key, rec] of Object.entries(upstreamsOf(this))) {
+        if (!rec || String(rec.repo).toLowerCase().replace(/^github\.com\//, '') !== want || (branch && rec.ref !== branch && !(rec.ref && branch === `quilt/live/${rec.ref}`))) continue
+        const repoObj = parseRepo(`https://${rec.repo}`)
+        this.mirrors.queue(repoObj.slug, rec.ref, () => noteMergeChecks(this, key, { sha, conclusion })).then((r) => { if (r.length) { this.saveMeta(); this.broadcastBranches() } }).catch((err) => this.log(`[${this.name}] ${key}: could not look at the checks on ${sha.slice(0, 7)}: ${err.message}`))
+      }
+    }
+    reviewPulls(this, { fetch: this.githubFetch, log: this.log }).catch((err) => this.log(`[${this.name}] could not look at the pull requests: ${err.message}`))
+    // CI failing on a branch the session follows is a task on the board until it passes again (relay-ci.js). Kept in
+    // the room's meta until noted, so a restart meanwhile (a deploy) notes it when the room is back.
+    if (branch && sha) {
+      const ev = { repo, sha, branch, conclusion, at: Date.now() }
+      this.meta.ciPending = [...(Array.isArray(this.meta.ciPending) ? this.meta.ciPending : []), ev].slice(-50)
+      this.saveMeta()
+      this.runCi(ev)
+    }
+    return true
+  }
+
+  /** Notes CI result `ev` on the board (relay-ci.js), then drops it from the room's pending ones: unless the room shut down first. */
+  runCi (ev) {
+    noteCiResult(this, ev, { fetch: this.githubFetch, log: this.log }).finally(() => {
+      if (this.destroyed) return
+      const same = (x) => x && x.sha === ev.sha && x.branch === ev.branch && x.conclusion === ev.conclusion && x.at === ev.at
+      this.meta.ciPending = (Array.isArray(this.meta.ciPending) ? this.meta.ciPending : []).filter((x) => !same(x))
+      this.saveMeta()
+    })
+  }
+
+  /** GitHub says pull request `number` on `repo` changed: looked at now when this room follows that repository (relay-commit.js reviewPulls). */
+  notePull ({ repo, number, action = '', merged = false, head = '', base = '', sha = '' }) {
+    const want = String(repo).toLowerCase().replace(/^github\.com\//, '')
+    const recs = upstreamsOf(this)
+    const follows = Object.values(recs).some((rec) => rec && rec.repo && String(rec.repo).toLowerCase().replace(/^github\.com\//, '') === want)
+    if (!follows) return false
+    // §5.6: the pull request's source branch, when the session has it, is marked merged (the branch list says so; a deletion on GitHub then moves its members to the base).
+    if (merged && head) {
+      const key = this.resolveKey ? this.resolveKey(head) : head
+      const rec = recs[key]
+      if (rec && String(rec.repo).toLowerCase().replace(/^github\.com\//, '') === want && rec.ref === head) {
+        rec.merged = { at: Date.now(), into: base || '', number, ...(sha ? { sha } : {}) }
+        this.saveMeta(); this.broadcastBranches()
+      }
+    }
+    // Addendum 16.5: the live pull request of a protected branch (or of a session without the branch's lease).
+    if (this.cfg.gitSync && this.meta.sync) {
+      for (const [key, rec] of Object.entries(recs)) {
+        const p = this.meta.sync[key] && this.meta.sync[key].protected
+        if (!rec || !p || !p.pr || p.pr.number !== number || String(rec.repo).toLowerCase().replace(/^github\.com\//, '') !== want) continue
+        if (merged) {
+          p.merged = { at: Date.now(), ...(sha ? { sha } : {}) }
+          rec.problem = `${rec.ref} is protected: the live pull request #${number} is merged; commits go through a new one (opened with the next commit)`
+          this.checkUpstreamsNow([key]).catch((err) => this.log(`[${this.name}] could not look for new commits: ${err.message}`))
+        } else if (action === 'closed') {
+          p.closed = Date.now()
+          rec.problem = `${rec.ref} is protected: pull request #${number} was closed without merging; the session keeps its work, and a new pull request opens with the next commit`
+        } else if (action === 'reopened') { delete p.closed; delete p.askedFor }
+        this.saveMeta(); this.broadcastBranches()
+      }
+    }
+    reviewPulls(this, { fetch: this.githubFetch, log: this.log, only: number }).catch((err) => this.log(`[${this.name}] could not look at pull request #${number}: ${err.message}`))
+    return true
+  }
+
+  /**
+   * GitHub said `repo` moved `ref` (a branch): `after` is its new head (`sha` from an older API),
+   * `before` the old one, `forced` a rewrite, `deleted` or `created` the branch itself. Every
+   * branch of this session that follows it looks now: folders on it are told, and the relay reads
+   * the truth from git (only the ref name is trusted). A push whose head is the one the relay
+   * itself pushed is an echo, and ignored. Returns 'echo', true (a branch follows it) or false.
+   */
+  notePush ({ repo, ref, sha = '', after = '', before = '', forced = false, deleted = false, created = false }) {
+    const want = String(repo).toLowerCase().replace(/^github\.com\//, '')
+    const head = typeof after === 'string' && after ? after : (typeof sha === 'string' ? sha : '')
+    let hit = false
+    let echo = false
+    for (const [key, rec] of Object.entries(upstreamsOf(this))) {
+      if (!rec || !rec.repo || rec.ref !== ref || String(rec.repo).toLowerCase().replace(/^github\.com\//, '') !== want) continue
+      hit = true
+      rec.webhookAt = Date.now()
+      if (deleted) { this.noteBranchDeleted(key, rec); continue } // §5.4
+      if (rec.gone && (head || created)) { delete rec.gone; delete rec.problem; this.saveMeta() } // pushed again: the branch is back on GitHub
+      if (created && !head) { this.saveMeta(); continue } // a branch made on GitHub: in the menu, nothing to bring in yet
+      const sync = this.cfg.gitSync && this.meta.sync && this.meta.sync[key]
+      if (head && sync && sync.pushed === head && sync.base === head) { echo = true; this.saveMeta(); continue } // our own push, come back round
+      const at = this.cfg.gitSync && this.mirrors && this.meta.sync && this.meta.sync[key] && this.meta.sync[key].base ? this.meta.sync[key].base : rec.sha
+      if (head && at === head) { this.saveMeta(); continue } // already there
+      const msg = jsonMessage(MSG_BRANCHES, { branches: this.branchList(), pushed: { branch: key, sha: head, ...(forced ? { forced: true } : {}) } })
+      for (const ws of this.conns.keys()) send(ws, msg)
+      this.checkUpstreamsNow([key]).catch((err) => this.log(`[${this.name}] could not look for new commits: ${err.message}`))
+    }
+    // §5.4: a branch created on GitHub that the session doesn't have appears in the branch menu, not synced until someone opens it.
+    if (created && !hit && ref && validBranchKey(ref) && !this.meta.branches[this.resolveKey ? this.resolveKey(ref) : ref]) {
+      const follows = Object.values(upstreamsOf(this)).some((rec) => rec && rec.repo && String(rec.repo).toLowerCase().replace(/^github\.com\//, '') === want)
+      if (follows) {
+        if (!this.meta.remoteBranches || typeof this.meta.remoteBranches !== 'object') this.meta.remoteBranches = {}
+        this.meta.remoteBranches[ref] = { at: Date.now() }
+        this.saveMeta(); this.broadcastBranches()
+        return true
+      }
+    }
+    if (deleted && !hit && this.meta.remoteBranches && this.meta.remoteBranches[ref]) { delete this.meta.remoteBranches[ref]; this.saveMeta(); this.broadcastBranches(); return true }
+    return hit ? (echo ? 'echo' : true) : false
+  }
+
+  /**
+   * A synced branch was deleted on GitHub (§5.4). After its pull request merged, its members are moved to the
+   * branch it merged into (hosted agents are moved; people's folders are told) and told. Otherwise the session
+   * keeps the branch: it comes back with the next commit, unless the owner turned that off (recreateDeleted).
+   */
+  noteBranchDeleted (key, rec) {
+    const now = Date.now()
+    rec.gone = now
+    const merged = rec.merged && rec.merged.into ? rec.merged : null
+    if (merged) {
+      const into = this.resolveKey ? this.resolveKey(merged.into) : merged.into
+      const where = this.meta.branches[into] ? into : this.defaultKey
+      rec.problem = `${rec.ref} was merged into ${merged.into} (pull request #${merged.number}) and deleted on GitHub`
+      const moved = []
+      for (const [id, k] of Object.entries(this.meta.hostedBranch || {})) {
+        if (k !== key) continue
+        const m = this.meta.members[id]
+        try { this.setHostedBranch(id, where, {}); moved.push(m && m.name) } catch {}
+      }
+      for (const ws of this.conns.keys()) if (ws.branch === key && this.names && this.names.get(ws) && !moved.includes(this.names.get(ws))) moved.push(this.names.get(ws))
+      if (this.postChat) for (const name of [...new Set(moved.filter(Boolean))]) this.postChat({ by: RELAY_BY, to: name, kind: 'nudge', text: `${rec.ref} was merged into ${merged.into} and deleted on GitHub (pull request #${merged.number}): you are on ${where} now${this.meta.hostedBranch && Object.values(this.meta.hostedBranch).includes(where) ? '' : ' (a folder: git checkout ' + where + ')'}.` })
+    } else if (this.meta.recreateDeleted === true) {
+      rec.problem = `${rec.ref} was deleted on GitHub: the session keeps it, and it comes back with the next commit (the owner's choice)`
+    } else {
+      // Addendum 16.10: a deletion on GitHub is meant; publication pauses, the work stays in the session.
+      rec.problem = `${rec.ref} was deleted on GitHub: the session keeps it and its work, and nothing is pushed there unless the owner lets Quilt recreate deleted branches`
+    }
+    this.log(`[${this.name}] ${key}: ${rec.problem}`)
+    this.saveMeta(); this.broadcastBranches()
+  }
+
+  /**
+   * A connection's branch request; returns the reply fields. join: subscribe to a branch's
+   * document (one at a time), adding the branch to the session when new. confirm: the relay
+   * holds everything the app has of the branch it joined, up to the app's state vector (an
+   * app asks before it clears its folder for a switch).
+   */
+  branchRequest (ws, req) {
+    const key = String(req.branch ?? '')
+    if (!validBranchKey(key)) throw new Error(`"${key.slice(0, 60)}" isn't a branch name`)
+    if (req.op === 'join') {
+      this.assertMigrated()
+      // An app from before branch documents names the branch the old document was; else the first real branch takes ∅.
+      let adopted = false
+      if (validBranchKey(String(req.adopt || ''))) adopted = this.adoptDefault(String(req.adopt))
+      adopted = this.adoptDefault(key) || adopted
+      const k = this.resolveKey(key)
+      const created = !this.meta.branches[k]
+      if (created) {
+        const a = this.access.get(ws)
+        // A new branch starts as a copy of the folder, about the size of the branch it is on now.
+        this.assertBranchRoom(!(a && a.role === 'viewer'), ws.branch && ws.branch !== k ? this.store.size(ws.branch) : 0)
+      }
+      try { this.store.load(k) } catch (err) {
+        if (!err.unreadable) throw err
+        this.log(`[${this.name}] ${err.message}`)
+        throw new Error("This branch's data can't be read on the relay right now")
+      }
+      if (ws.branch && ws.branch !== k) {
+        // Kept a moment longer: a sync message the app sent for it just before switching,
+        // still in flight, is applied rather than silently dropped (handle, MSG_SYNC).
+        this.store.unsubscribe(ws, ws.branch)
+        ws.prevBranch = ws.branch
+      }
+      this.store.subscribe(ws, k)
+      ws.branch = k // the document, as the relay keeps it
+      ws.branchAs = key // as the app named it (∅ without git): its sync messages carry this
+      this.noteBranch(k, { by: this.names.get(ws) || '', base: req.base })
+      this.noteBranchSeen(k, { force: true, used: true })
+      // Everyone hears a new branch, and a default branch that just took its real name.
+      return { ok: true, branch: k, created, base: this.meta.branches[k].base, epoch: this.branchEpoch(k), listChanged: created || adopted }
+    }
+    if (req.op === 'confirm') {
+      const k = this.resolveKey(key)
+      const e = k === ws.branch ? this.store.get(k) : null
+      if (!e) throw new Error(`you are not on ${key}`)
+      let want
+      try {
+        want = new Uint8Array(Buffer.from(String(req.sv || ''), 'base64'))
+        Y.decodeStateVector(want)
+      } catch { throw new Error('that is not a state vector') }
+      if (!covers(Y.encodeStateVector(e.doc), want)) throw new Error(`not all of your changes on ${key} have reached the relay yet`)
+      return { ok: true, branch: k }
+    }
+    if (req.op === 'remove') {
+      const a = this.access.get(ws)
+      if (!a || (this.controlled && !a.owner)) throw new Error('only the session owner can remove a branch')
+      const k = this.resolveKey(key)
+      if (!this.meta.branches[k]) throw new Error(`${key} isn't in this session`)
+      if (k === this.defaultKey) throw new Error(`${key} is the session's default branch; it stays`)
+      const on = [...this.conns.keys()].filter((c) => c.branch === k).map((c) => this.names.get(c))
+      if (on.length) throw new Error(`${[...new Set(on)].join(', ')} ${on.length === 1 ? 'is' : 'are'} on ${key}; it can be removed once nobody is`)
+      this.removeBranch(k)
+      return { ok: true, branch: k, listChanged: true }
+    }
+    throw new Error('unknown branch request')
+  }
+
+  /** Can this connection's app handle the session as it is now? */
+  supported (ws) {
+    return !this.meta.largeFiles || (ws.features || []).includes('large-files')
+  }
+
+  /**
+   * The session now keeps large files in storage. Older apps would get
+   * entries with no contents, so they're sent away to update.
+   */
+  startLargeFiles () {
+    if (this.meta.largeFiles) return
+    this.meta.largeFiles = true
+    for (const ws of [...this.conns.keys(), ...this.pending.keys()]) {
+      if (!ws.hosted && !this.supported(ws)) { ws.endReason = 'needs_update'; ws.close(CLOSE_NEEDS_UPDATE, NEEDS_UPDATE) }
+    }
+  }
+
+  get admitBy () { return cleanAdmitBy(this.meta.admitBy) || DEFAULT_ADMIT_BY }
+
+  /** May this connection's access let people in, under the room's setting? */
+  personCanAdmit (a) { return canAdmit(a, this.admitBy) }
+
+  accessMessage (a) {
+    // The owner learns whether a GitHub token is set (never the token itself); nobody else hears of it.
+    return { state: 'approved', role: a.role, scopes: a.scopes || [], scopesExcept: a.scopesExcept || [], talk: a.talk !== false, owner: !!a.owner, controlled: this.controlled, admitBy: this.admitBy, canAdmit: this.personCanAdmit(a), agentCommits: agentCommitsOf(this), ...(this.meta.agentCommitsSet ? { agentCommitsBy: { by: this.meta.agentCommitsSet.by, name: this.meta.agentCommitsSet.name, mode: this.meta.agentCommitsSet.mode } } : {}), agentsCanCommit: agentsCanCommit(this, this.defaultKey), ...(this.cfg.gitSync ? { githubSync: this.meta.githubSync !== false, largeToRelay: this.meta.largeToRelay === true } : {}), ...(a.owner ? { githubToken: !!this.meta.githubToken } : {}) }
+  }
+
+  /** Tracks restricted connections so their file changes are checked. */
+  setAccess (ws, a) {
+    this.access.set(ws, a)
+    // With live sync to GitHub, agents' changes are checked too: a file held for a clash is theirs to propose, not to write (relay-clash.js).
+    const restricted = a.role === 'viewer' || (a.scopes && a.scopes.length) || (a.scopesExcept && a.scopesExcept.length) || a.talk === false || (a.kind === 'agent' && !!this.cfg.gitSync)
+    if (restricted) this.guard.trackedOrigins.add(ws)
+    else this.guard.trackedOrigins.delete(ws)
+  }
+
+  memberList () {
+    const online = new Map()
+    for (const a of this.access.values()) online.set(a.owner ? this.ownerId : a.id, true)
+    const http = new Map() // member id -> its last check-in, for agents over HTTP
+    for (const h of this.hostedOnline()) { online.set(h.id, true); http.set(h.id, h.seen) }
+    const list = []
+    if (this.meta.owner) {
+      const ownerName = this.meta.ownerName || Object.entries(this.meta.identities).find(([, k]) => k === this.meta.owner)?.[0] || 'owner'
+      list.push({ key: this.ownerId, name: ownerName, kind: 'human', role: 'owner', scopes: [], online: online.has(this.ownerId), ...this.awayOf(this.ownerId, online), from: { kind: 'owner' } })
+    }
+    pruneChatLinks(this) // chat links that ran out leave the list
+    for (const [key, m] of Object.entries(this.meta.members)) list.push({ key, name: m.name, kind: m.kind, ...memberAccess(m), online: online.has(key), ...(http.has(key) ? { http: true, lastSeen: http.get(key) } : this.awayOf(key, online)), ...(m.chat ? { chat: true, expiresAt: m.expiresAt } : {}), from: m.chat ? { kind: 'chat' } : m.from || { kind: m.granted ? 'grant' : 'approved' } })
+    return list
+  }
+
+  /** { away, lastSeen } for an agent between turns (see noteTurns). */
+  awayOf (key, online) {
+    const at = online.has(key) ? null : this.awaySince(key)
+    return at ? { away: true, lastSeen: at } : {}
+  }
+
+  pendingList () {
+    return [...this.pending.values()].map((p) => ({ key: p.id, name: p.name, kind: p.kind, invitedAs: p.invitedAs, since: p.since }))
+  }
+
+  /** Sends everyone the member list; people who may let others in also see who's waiting. */
+  broadcastMembers (replyTo = null, reply = null) {
+    if (!this.controlled) return
+    const members = this.memberList()
+    const pending = this.pendingList()
+    const admitBy = this.admitBy
+    for (const [ws, a] of this.access) {
+      const msg = { members, sessionName: this.meta.name || '', admitBy, pending: this.personCanAdmit(a) ? pending : [], ...(ws === replyTo && reply ? { reply } : {}) }
+      send(ws, jsonMessage(MSG_MEMBERS, msg))
+    }
+  }
+
+  /** Changes to who's in the room. Letting people in follows admitBy; the rest is owner-only. Returns the reply fields. */
+  adminRequest (ws, req) {
+    const me = this.access.get(ws)
+    if (!me) throw new Error('only the session owner can do that')
+    if (req.op === 'admitBy') {
+      if (!me.owner) throw new Error('only the session owner can do that')
+      const next = cleanAdmitBy(req.admitBy)
+      if (!next) throw new Error(BAD_ADMIT_BY)
+      if (next !== this.admitBy) {
+        this.meta.admitBy = next
+        this.saveMeta()
+        // Everyone's access follows the new setting (canAdmit / admitBy on the access message).
+        for (const [cws, a] of this.access) send(cws, jsonMessage(MSG_ACCESS, this.accessMessage(a)))
+      }
+      return { ok: true }
+    }
+    if (['syncUpstream', 'commit', 'gitToken', 'pulls', 'merge', 'githubRecheck', 'unpublished', 'finishTask'].includes(req.op)) throw new Error(`${req.op} is answered by itself`) // see the MSG_ADMIN handler
+    // A folder's git pushed: what went up goes on record, and the chat hears it (relay-commit.js).
+    if (req.op === 'pushed') {
+      if (!ws.branch) throw new Error('not in this session')
+      return notePushedFor(this, { who: { name: me.name, kind: me.kind === 'agent' ? 'agent' : 'human', access: me }, key: ws.branch, branch: String(req.branch || ''), sha: String(req.sha || ''), count: req.count, files: req.files, subject: typeof req.subject === 'string' ? req.subject : '' }, { fetch: this.githubFetch, log: this.log })
+    }
+    if (req.op === 'githubSync') {
+      // The owner's "Sync with GitHub" switch (plan §15): on by default once a connection covers the repository.
+      if (!me.owner) throw new Error('only the session owner can do that')
+      this.meta.githubSync = req.on !== false
+      this.saveMeta(); this.broadcastBranches()
+      for (const [cws, acc] of this.access) send(cws, jsonMessage(MSG_ACCESS, this.accessMessage(acc)))
+      return { ok: true, githubSync: this.meta.githubSync }
+    }
+    if (req.op === 'largeToRelay') {
+      // Large files on branches that sync with GitHub (plan §10): the owner agrees that the relay may read them, so it can commit them.
+      if (!me.owner) throw new Error('only the session owner can do that')
+      this.meta.largeToRelay = req.on === true
+      this.saveMeta(); this.broadcastBranches()
+      for (const [cws, acc] of this.access) send(cws, jsonMessage(MSG_ACCESS, this.accessMessage(acc)))
+      return { ok: true, largeToRelay: this.meta.largeToRelay }
+    }
+    if (req.op === 'agentCommits') {
+      // What agents may do with commits (relay-commit.js): the owner's call.
+      if (!me.owner) throw new Error('only the session owner can do that')
+      return { ok: true, agentCommits: this.setAgentCommits(req.agentCommits) }
+    }
+    if (req.op === 'workspace') {
+      // Which workspace the session is in (the owner's app knows): webhook events say so, so an agent in several can tell them apart.
+      if (!me.owner) throw new Error('only the session owner can do that')
+      const id = String(req.id || '').slice(0, 64)
+      if ((this.meta.workspace || '') !== id) {
+        this.meta.workspace = id || undefined
+        this.saveMeta()
+        // The app links the session to the workspace on the accounts API first: its git rule applies now.
+        this.refreshPolicy()
+      }
+      return { ok: true, workspace: this.meta.workspace || '' }
+    }
+    // A chat link lets a chat AI in, so whoever may let people in may make one, and set how long it lasts.
+    if (req.op === 'approve' || req.op === 'deny' || req.op === 'chatlink' || req.op === 'chatextend') {
+      if (!this.personCanAdmit(me)) throw new Error('you cannot let people into this session')
+    } else if (!me.owner) {
+      throw new Error('only the session owner can do that')
+    }
+    if (req.op === 'name') {
+      // The owner's app names the session after its folder, and the owner can rename it.
+      const name = cleanSessionName(req.name)
+      if (!name) throw new Error(BAD_SESSION_NAME)
+      // Re-sending the same name (the app does this on every launch) should write nothing
+      // and report nothing: only an actual rename is news.
+      if (name !== this.meta.name) {
+        // A new session's first name (its folder's, sent as it starts) isn't a rename: the
+        // owner may rename it straight away.
+        if (this.meta.name) {
+          if (Date.now() - this.lastRenameAt < RENAME_MS) throw new Error('Renaming too fast; try again in a moment')
+          this.lastRenameAt = Date.now()
+        }
+        this.meta.name = name
+        this.saveMeta()
+        if (this.presence) this.presence.rename({ room: this.name, name })
+      }
+      return { ok: true }
+    }
+    if (req.op === 'chatlink') {
+      // A link a chat-only AI (ChatGPT, claude.ai, Grok…) works through by opening pages (chat-links.js).
+      // It joins as a member of its own; the token is in this reply only, to whoever asked.
+      const l = makeChatLink(this, { name: req.name, minutes: req.minutes, by: me.name })
+      this.log(`[${this.name}] chat link made for ${l.name}`)
+      return { ok: true, token: l.token, name: l.name, expiresAt: l.expiresAt }
+    }
+    if (req.op === 'chatextend') {
+      // How long a chat link still works, from now. One that ran out is gone: a new link is needed.
+      const l = extendChatLink(this, String(req.key || ''), req.minutes)
+      return { ok: true, name: l.name, expiresAt: l.expiresAt }
+    }
+    if (req.op === 'githubToken') {
+      // A read-only token the relay uses to bring commits in from a private repository while no
+      // folder is online (relay-upstream.js). Kept on the relay only: never in presence, the
+      // branch list, a reply or the log. An empty token clears it.
+      return this.setGithubToken(req.token)
+    }
+    if (req.op === 'end') {
+      // Reply first; the relay then sends everyone away and deletes the room.
+      setTimeout(() => this.onEnd && this.onEnd(), 50)
+      return { ok: true }
+    }
+    const key = String(req.key || '')
+    const role = ROLES.includes(req.role) ? req.role : null
+    const scopes = Array.isArray(req.scopes)
+      ? req.scopes.map((s) => String(s).trim().replace(/^\.\//, '').replace(/\/+$/, '')).filter(Boolean).slice(0, MAX_SCOPES)
+      : null
+    if (scopes && scopes.some((s) => s.length > MAX_PATTERN || s.split('/').includes('..'))) throw new Error('bad folder')
+    // Apps with access types send the access itself ({ files, folders, foldersExcept, talk }),
+    // and the type it came from (typeId), which the relay doesn't need: the API keeps grants.
+    const requested = req.access === undefined ? null : cleanAccess(req.access)
+    if (req.access !== undefined && !requested) throw new Error('bad access')
+    if (key === this.meta.owner || key === this.meta.ownerSub) throw new Error('the owner always has full access')
+    // `key` is the id from the member or pending list. One account may be waiting on several computers.
+    const waiting = [...this.pending].filter(([, p]) => p.id === key)
+    if (req.op === 'approve') {
+      if (!waiting.length) throw new Error('nobody with that key is waiting')
+      const p = waiting[0][1]
+      const access = requested ? relayAccess(requested) : { role: role || p.invitedAs, scopes: scopes || [], scopesExcept: [], talk: true }
+      // Let in as a type: their access lives in the API now (see storedMember).
+      this.meta.members[key] = { name: p.name, kind: p.kind, ...access, since: Date.now(), ...(req.typeId ? { granted: true } : {}) }
+      if (this.meta.removed) delete this.meta.removed[key]
+      this.saveMeta()
+      this.log(`[${this.name}] ${p.name} approved as ${access.role}`)
+      for (const [pws, w] of waiting) {
+        this.pending.delete(pws)
+        // A hosted agent has no connection to let in: it finds out on its next tool call.
+        if (pws.hosted) continue
+        this.enter(pws, { key: w.key, id: key, name: w.name, kind: w.kind, ...access, owner: false })
+        // Their app fetches a fresh pass now, so the grant the owner's app just wrote applies.
+        send(pws, jsonMessage(MSG_ACCESS, { ...this.accessMessage(this.access.get(pws)), refresh: true }))
+      }
+      return { ok: true }
+    }
+    if (req.op === 'deny') {
+      if (!waiting.length) throw new Error('nobody with that key is waiting')
+      for (const [pws, w] of waiting) {
+        this.pending.delete(pws)
+        // A hosted agent finds out on its next tool call; relay.hosted remembers it, across restarts.
+        if (pws.hosted) { if (this.onHostedDenied) this.onHostedDenied(w.id); continue }
+        pws.close(CLOSE_DENIED, 'The session owner did not let you in')
+      }
+      return { ok: true }
+    }
+    const m = this.meta.members[key]
+    if (!m) throw new Error('no such member')
+    if (req.op === 'set') {
+      const want = requested || { ...fromRelay(m), ...(role ? { files: role === 'viewer' ? 'view' : 'edit' } : {}), ...(scopes ? { folders: scopes } : {}) }
+      // Someone let in as a type keeps what both their record (their last pass) and the owner
+      // allow: more needs a fresh pass from the API. Older members get what the owner asks.
+      const stored = m.granted ? narrowAccess(want, fromRelay(m)) : want
+      // Remembered with when, so a pass issued before now can't undo it (see passGrant).
+      Object.assign(m, relayAccess(stored), { setAt: Date.now() })
+      this.saveMeta()
+      for (const [cws, a] of this.access) {
+        if (a.id !== key) continue
+        // Someone let in by a grant gets what both their pass and the owner allow: the owner's
+        // app can narrow access at once, but more waits for a pass from the API that allows it.
+        Object.assign(a, relayAccess(this.passGrant(cws.pass) || stored))
+        this.setAccess(cws, a)
+        send(cws, jsonMessage(MSG_ACCESS, { ...this.accessMessage(a), refresh: true }))
+      }
+      return { ok: true }
+    }
+    if (req.op === 'remove') {
+      // An account goes with any older entries for keys it has used here, so it can't get back in by key.
+      const gone = [key, ...((this.meta.accountKeys || {})[key] || [])]
+      // Their claims go with them: nobody left could release them.
+      const names = gone.map((id) => this.meta.members[id]?.name).filter(Boolean)
+      const theirs = (x) => x.byId ? gone.includes(x.byId) : names.includes(x.by)
+      this.dropRequests(theirs)
+      this.dropClaims(theirs, (c) => `${c.by} was removed from the session.`)
+      for (const n of names) this.revokeAgentTokens({ name: n }) // a removed agent's folder can't push or fetch any more
+      for (const id of gone) this.revokeAgentTokens({ account: id }) // nor a removed person's
+      for (const id of gone) delete this.meta.members[id]
+      // A pass issued before now can't bring them back by its grant (see passGrant). Removals
+      // older than a pass lasts can match no valid pass, so they go; the newest are kept.
+      const cutoff = Date.now() - PASS_TTL_MS
+      const removed = Object.entries({ ...(this.meta.removed || {}), [key]: Date.now() }).filter(([, at]) => at > cutoff).sort((a, b) => a[1] - b[1])
+      this.meta.removed = Object.fromEntries(removed.slice(-MAX_REMOVED))
+      this.saveMeta()
+      for (const [cws, a] of this.access) if (gone.includes(a.id)) { cws.endReason = 'removed'; cws.close(CLOSE_DENIED, 'The session owner removed you') }
+      for (const id of gone) { this.hostedSeen.delete(id); this.forgetHostedBranch(id); if (this.onHostedGone) this.onHostedGone(id, 'removed') }
+      this.broadcastClaims()
+      return { ok: true }
+    }
+    throw new Error('unknown request')
+  }
+
+  touch () {
+    this.meta.lastActive = Date.now()
+    this.saveMeta()
+  }
+
+  /** A name belongs to the first key that signs in with it. */
+  keyMatches (name, publicKey) {
+    const known = this.meta.identities[name]
+    return !known || known === publicKey
+  }
+
+  bindName (name, publicKey) {
+    if (this.meta.identities[name]) return
+    this.meta.identities[name] = publicKey
+    this.saveMeta()
+  }
+
+  /** Presence may only describe the sender, under their verified name. */
+  samePerson (a, b) {
+    const x = this.access.get(a)
+    const y = this.access.get(b)
+    return !!(x && y && x.key === y.key && x.name === y.name)
+  }
+
+  presenceAllowed (ws, update) {
+    const name = this.names.get(ws)
+    const dec = decoding.createDecoder(update)
+    const n = decoding.readVarUint(dec)
+    for (let i = 0; i < n; i++) {
+      const id = decoding.readVarUint(dec)
+      decoding.readVarUint(dec) // clock
+      const state = JSON.parse(decoding.readVarString(dec))
+      for (const [other, ids] of this.conns) {
+        if (other === ws || !ids.has(id)) continue
+        // The same person over a new connection: they're back from a drop the relay hasn't
+        // noticed yet (its heartbeat takes up to a minute). The old connection is dead; let
+        // it go now, or they'd stay unseen until it does.
+        if (this.samePerson(other, ws)) { ids.delete(id); other.endReason = 'replaced'; other.terminate(); continue }
+        return false
+      }
+      if (state !== null && state.name !== name) return false
+      // Only a person's cloud AI says whose AI it is, and only its own person's (its pass says so).
+      if (state !== null && state.aiOf !== undefined && state.aiOf !== (ws.pass && ws.pass.of ? ws.pass.ofName : undefined)) return false
+    }
+    return true
+  }
+
+  /** Who a claim from this connection belongs to: their name, or with sign-in on, their account; on the branch they're on. */
+  claimant (ws, as = null) {
+    const name = this.names.get(ws)
+    const a = this.access.get(ws)
+    const who = ws.pass ? { name, id: `${ws.pass.kind}:${ws.pass.sub}`, owner: !!(a && a.owner), talk: !(a && a.talk === false), branch: ws.branch } : { name, branch: ws.branch }
+    // One of several AI sessions working through this person's app (persona.js): its claims are
+    // its own, under "<first name> · <label>" and the account plus the session's id. Nobody can
+    // claim as someone else's: the name is built here from the connection's own.
+    if (!as || typeof as.id !== 'string' || !/^[A-Za-z0-9_-]{4,40}$/.test(as.id)) return who
+    return { ...who, name: personaName(name, as.label), ...(who.id ? { id: `${who.id}~${as.id}` } : {}), persona: true, of: name }
+  }
+
+  /** Which branch a claim is on: its own, or the default branch (claims from before branches). */
+  branchOf (c) { return c.branch ? this.resolveKey(c.branch) : this.defaultKey }
+
+  /** Where a claim on `pattern` on `branch` is kept in meta.claims: the default branch keeps bare paths. */
+  claimKey (branch, pattern) {
+    const b = this.resolveKey(branch || this.defaultKey)
+    return b === this.defaultKey ? pattern : `${b}\0${pattern}`
+  }
+
+  shownClaim (c) { return { ...c, queue: c.queue || [], active: this.holderPresent(c), activeAt: this.lastActive(c) } }
+
+  /**
+   * The claims on one branch (the default when none is given), each with `active` (whoever
+   * holds it is in the session now), `activeAt` (when they last did something there) and its
+   * file queue: who asked for it next ({ id, path, by, title, description, task, ts }), oldest first.
+   */
+  claimList (branch) {
+    const b = this.resolveKey(branch || this.defaultKey)
+    return Object.values(this.meta.claims).filter((c) => this.branchOf(c) === b).map((c) => this.shownClaim(c)).sort((x, y) => x.ts - y.ts)
+  }
+
+  /** Every claim on every branch. */
+  allClaims () { return Object.values(this.meta.claims).map((c) => this.shownClaim(c)).sort((x, y) => x.ts - y.ts) }
+
+  /** The files on a branch, for telling whether two patterns overlap (and the room document's, in rooms from before branches). */
+  branchPaths (branch) {
+    const e = this.store.load(this.resolveKey(branch || this.defaultKey))
+    return [...e.files.keys(), ...e.blobs.keys(), ...this.doc.getMap('files').keys(), ...this.doc.getMap('blobs').keys()]
+  }
+
+  /** Who holds a claim: their account with sign-in on, otherwise their name. */
+  holderKey (c) { return c.byId || `name:${c.by}` }
+
+  /** The holder keys a connection speaks for: its account, and its name (claims older than sign-in). */
+  holderKeys (ws) {
+    const keys = [`name:${this.names.get(ws)}`]
+    if (ws.pass) keys.push(`${ws.pass.kind}:${ws.pass.sub}`)
+    return keys
+  }
+
+  /** The holder key of a claimant (see holderKey): an AI session's activity is its own, not its person's. */
+  claimantKey (who) { return who.id || `name:${who.name}` }
+
+  /** Someone did something in the session: their claims' idle time starts again. */
+  noteActivity (keys) {
+    const now = Date.now()
+    let save = false
+    for (const k of keys) {
+      if (!Object.values(this.meta.claims).some((c) => this.holderKey(c) === k)) continue
+      // Saved now and then, so a relay restart doesn't count them idle for longer than they were.
+      if (now - (this.meta.seen[k] || 0) > 60 * 1000) save = true
+      this.meta.seen[k] = now
+    }
+    if (save) this.saveMeta()
+  }
+
+  /** When a claim's holder last did something in the session (since the relay loaded it, at the earliest). */
+  lastActive (c) {
+    return Math.max(this.meta.seen[this.holderKey(c)] ?? this.loadedAt, c.ts || 0)
+  }
+
+  /** Whether a claim's holder is in the session now: connected, or a hosted agent seen lately. */
+  holderPresent (c) {
+    if (c.byId) {
+      // An AI session's claim (account~session) is here while its person's app is.
+      const base = c.byId.split('~')[0]
+      const seen = this.hostedSeen.get(base)
+      if (seen && Date.now() - seen < HOSTED_ONLINE_MS) return true
+      for (const ws of this.conns.keys()) if (ws.pass && `${ws.pass.kind}:${ws.pass.sub}` === base) return true
+      return false
+    }
+    for (const n of this.names.values()) if (n === c.by || (c.by.startsWith(`${firstName(n)}${PERSONA_SEP}`))) return true
+    return this.hostedOnline().some((h) => h.name === c.by)
+  }
+
+  /** The claim covering a file on a branch: its own, or a folder or glob claim that matches it (the earliest). The
+   * live record in meta.claims, not a shown copy: claimRequestOp mutates its queue in place. */
+  claimFor (file, branch) {
+    const own = this.meta.claims[this.claimKey(branch, file)]
+    if (own) return own
+    const b = this.resolveKey(branch || this.defaultKey)
+    return Object.values(this.meta.claims).filter((c) => this.branchOf(c) === b && globMatcher(c.pattern)(file)).sort((x, y) => x.ts - y.ts)[0] || null
+  }
+
+  /**
+   * Lets go of the claims `pick` chooses. A claim someone is waiting for in its file queue goes
+   * to the first of them instead of being released (`why` says why, in the message they get).
+   * Returns how many went.
+   */
+  dropClaims (pick, why = null) {
+    let n = 0
+    for (const c of Object.values(this.meta.claims)) {
+      if (!pick(c)) continue
+      n++
+      if (c.queue && c.queue.length) this.handOff(c, c.queue[0], { context: why ? why(c) : `${c.by} let go of it.`, auto: true })
+      else delete this.meta.claims[this.claimKey(c.branch, c.pattern)]
+    }
+    this.forgetSeen()
+    return n
+  }
+
+  /** Takes the requests `pick` chooses out of every file queue (someone removed, or gone). */
+  dropRequests (pick) {
+    for (const c of Object.values(this.meta.claims)) {
+      if (!c.queue) continue
+      c.queue = c.queue.filter((r) => !pick(r))
+      if (!c.queue.length) delete c.queue
+    }
+  }
+
+  forgetSeen () {
+    for (const k of Object.keys(this.meta.seen)) if (!Object.values(this.meta.claims).some((c) => this.holderKey(c) === k)) delete this.meta.seen[k]
+  }
+
+  /**
+   * Gives claim `c` to the one who asked for it in request `r`, with the holder's context,
+   * and tells them in a direct message (which wakes their agent). The rest of the queue
+   * stays with the claim: the new holder hands it on in turn.
+   */
+  handOff (c, r, { context = '', auto = false } = {}) {
+    const now = Date.now()
+    const queue = (c.queue || []).filter((x) => x.id !== r.id)
+    const next = { ...(c.branch ? { branch: c.branch } : {}), by: r.by, ...(r.byId ? { byId: r.byId } : {}), ...(r.of ? { of: r.of } : {}), pattern: c.pattern, note: String(r.title || '').slice(0, 500), ts: now, from: c.by, ...(r.clash ? { clash: r.clash } : {}) }
+    if (queue.length) next.queue = queue
+    this.meta.claims[this.claimKey(c.branch, c.pattern)] = next
+    this.meta.seen[this.holderKey(next)] = now
+    const text = auto
+      ? `📦 ${c.pattern} is yours now: you asked for it ("${r.title}"). ${context}`.trim()
+      : `📦 I'm handing you ${c.pattern} (you asked: "${r.title}"). My context: ${context}`
+    // Sent as from the holder; marked as a handoff, it wakes them but asks for no answer (duties.js).
+    this.postChat({ by: c.by, to: r.by, text, kind: 'handoff', path: c.pattern })
+    this.log(`[${this.name}] ${c.pattern} handed from ${c.by} to ${r.by}${auto ? ' (automatically)' : ''}`)
+  }
+
+  /** A chat entry written by the relay itself (file queue requests and handoffs). */
+  postChat ({ by, to = null, text, kind, path: file, re }) {
+    const chat = this.doc.getArray('chat')
+    const msg = { id: crypto.randomBytes(8).toString('hex'), by, to, text: String(text).slice(0, 4000), ts: Date.now(), kind, path: file }
+    if (re) msg.re = re
+    this.doc.transact(() => {
+      chat.push([msg])
+      if (chat.length > 500) chat.delete(0, chat.length - 500)
+    })
+    return msg
+  }
+
+  /**
+   * Answers message `m` to the relay, sent in a change from `origin` (a connection, or a hosted
+   * agent's or chat link's tool), once it has settled: a post undone (someone who may not talk)
+   * gets no answer, nor does a message from before now (a room moved, or loaded again). The
+   * answer goes to the asker alone, and asks for no reply. Only the owner (or anyone, in a
+   * session nobody controls) may trim, and only from the app.
+   */
+  answerRelay (m, origin) {
+    if (!m.id || this.relayAnswered.has(m.id) || Math.abs(Date.now() - (m.ts || 0)) > RELAY_ASK_MS) return
+    this.relayAnswered.add(m.id)
+    if (this.relayAnswered.size > 200) this.relayAnswered.delete(this.relayAnswered.values().next().value)
+    const a = origin && this.access.get(origin)
+    const asker = { name: (origin && this.names.get(origin)) || m.by, mayTrim: !!a && (a.owner || !this.controlled) }
+    setImmediate(() => {
+      if (this.destroyed || this.ended || !this.chat.toArray().some((x) => x && x.id === m.id)) return
+      let text
+      try { text = relayAnswer(this, m, asker) } catch (err) { text = `I couldn't answer that: ${err.message}` }
+      this.postChat({ by: RELAY_BY, to: m.by, text, kind: 'nudge', re: m.id })
+    })
+  }
+
+  /**
+   * Lets go of claims whose holder has done nothing in the session for claimIdleMs (no edit,
+   * no message, no tool call): handed to the first one waiting for it, or released. Returns
+   * how many went (and tells everyone, when any did).
+   */
+  sweepClaims (now = Date.now()) {
+    const mins = Math.round(this.cfg.claimIdleMs / 60000)
+    // A box never times out: it holds unfinished work nobody else has (sweepBoxes reminds its holder instead).
+    const n = this.dropClaims((c) => !c.box && now - this.lastActive(c) >= this.cfg.claimIdleMs, (c) => `${c.by} had done nothing in the session for ${mins} minutes.`)
+    if (n) this.log(`[${this.name}] let go of ${n} claim(s) idle for ${mins} minutes`)
+    // Also when a holder came or went: everyone's app shows whose claims are held by someone away.
+    const shown = this.allClaims().map((c) => `${c.branch || ''}\0${c.pattern}\0${c.active}`).join('\n')
+    if (n || shown !== this.claimsShown) { this.claimsShown = shown; this.broadcastClaims() }
+    return n
+  }
+
+  /**
+   * Boxes never time out like claims; one whose holder has been away a day gets one reminder a day in chat
+   * (to their person, for an AI session's box). The session owner can release it. Returns how many were sent.
+   */
+  sweepBoxes (now = Date.now()) {
+    let n = 0
+    for (const c of Object.values(this.meta.claims)) {
+      if (!c.box || this.holderPresent(c)) continue
+      if (now - this.lastActive(c) < BOX_REMIND_MS || now - (c.reminded || 0) < BOX_REMIND_MS) continue
+      c.reminded = now
+      this.postChat({ by: RELAY_BY, to: c.of || c.by, kind: 'nudge', path: c.pattern, text: `📦 Your unfinished work on ${c.pattern}${c.branch ? ` (on ${c.branch})` : ''} is still in a box: nobody else has it in their folder. When you're back, commit it, unpack it (quilt_unpack) or put it back.` })
+      n++
+    }
+    if (n) this.saveMeta()
+    return n
+  }
+
+  /**
+   * Handles a claim/release request. `who` is { name } without sign-in, where
+   * claims belong to a verified name; with it, { name, id, owner }, where they
+   * belong to the account (id). Returns the reply fields.
+   */
+  /** A claim request (claimRequestOp), and on success a line in the audit trail. */
+  claimRequest (who, req) {
+    const r = this.claimRequestOp(who, req)
+    const action = CLAIM_ACTIONS[req && req.op]
+    if (action && who && who.id) this.audit(who.id, action, String(req.pattern || req.path || req.request || '').slice(0, 300))
+    return r
+  }
+
+  claimRequestOp (who, req) {
+    const { name, id } = who
+    // Whose claim is this? Older claims in a sign-in room have no account: they belong to their
+    // name, as they did when made, and claiming one again adopts it under this account.
+    // (The owner may release any of them too.)
+    const own = (c) => id ? (c.byId ? c.byId === id : c.by === name) : c.by === name
+    // A person may also release or hand off what their own AI sessions hold (account~session).
+    const mine = (c) => own(c) || (!who.persona && !!id && !!c.byId && c.byId.startsWith(`${id}~`))
+    const pattern = String(req.pattern ?? '').trim().replace(/^\.\//, '')
+    // Claims are per branch: one on src/a.js on main never blocks src/a.js on feature-x.
+    const branch = this.resolveKey(who.branch || this.defaultKey)
+    const at = (p) => this.claimKey(branch, p)
+    const onBranch = branch === this.defaultKey ? {} : { branch }
+    if (req.op === 'touch') return { ok: true } // an AI session is at work: its claims' idle time starts again
+    if (req.op === 'claim') {
+      if (!pattern) throw new Error('pattern required')
+      if (pattern.length > MAX_PATTERN) throw new Error('pattern too long')
+      if (CONTROL_CHARS.test(pattern)) throw new Error('a pattern cannot contain control characters')
+      const existing = this.meta.claims[at(pattern)]
+      // A clash task's files (clash.js): claimed for its assignee while it merges, and taken over
+      // from the one before when the task is handed on (only by whoever it is assigned to now).
+      const clash = typeof req.clash === 'string' && /^[0-9a-f]{16}$/.test(req.clash) ? req.clash : null
+      if (clash) {
+        const t = this.tasks.get(clash)
+        if (!t || t.column === 'done' || t.assignee !== name) throw new Error(`task ${clash} isn't yours to merge`)
+      }
+      const takeOver = (c) => !!clash && c.clash === clash
+      if (existing && !mine(existing) && !takeOver(existing)) throw new Error(`${pattern} is already claimed by ${existing.by}`)
+      const paths = this.branchPaths(branch)
+      const other = this.claimList(branch).find((c) => !mine(c) && !takeOver(c) && patternsOverlap(c.pattern, pattern, paths))
+      if (other) throw new Error(`${pattern} overlaps ${other.by}'s claim on ${other.pattern}`)
+      // A box (docs/superpowers/specs/2026-10-16-git-boxes-design.md): this claim's file is the holder's
+      // unfinished work, kept out of everyone else's folder until it's committed or unpacked. Only on one
+      // file (never a glob), and sticky: claiming one's own boxed file again keeps the box.
+      const box = (req.box === true || !!(existing && mine(existing) && existing.box)) && !/[*?[]/.test(pattern)
+      this.meta.claims[at(pattern)] = { ...onBranch, by: name, ...(id ? { byId: id } : {}), pattern, note: who.talk === false ? '' : String(req.note ?? '').slice(0, 500), ts: Date.now(), ...(who.persona ? { of: who.of } : {}), ...(clash ? { clash } : {}), ...(existing?.queue ? { queue: existing.queue } : {}), ...(box ? { box: true } : {}) }
+      return { ok: true }
+    }
+    if (req.op === 'release') {
+      // A holder can't just let go of a file someone is waiting for: they hand it off, with
+      // their context (op 'handoff'). Releasing everything lets go of the rest.
+      const queued = (c) => c.queue && c.queue.length
+      if (pattern === '*' || !pattern) {
+        const held = Object.values(this.meta.claims).filter((c) => mine(c) && queued(c) && this.branchOf(c) === branch).map((c) => c.pattern)
+        // Boxes stay: a box opens when it's committed or unpacked (op 'unbox'), not when its holder stops.
+        return { ok: true, released: this.dropClaims((c) => mine(c) && !queued(c) && !c.box && this.branchOf(c) === branch), ...(held.length ? { held } : {}) }
+      }
+      const c = this.meta.claims[at(pattern)]
+      if (!c) return { ok: true, released: 0 }
+      // The owner may release anyone's claim. Someone under the same name may release one
+      // held by an account that isn't here (theirs from before a re-invite), but not take it.
+      // Either way, the first one waiting for it gets it.
+      const stale = c.by === name && !this.holderPresent(c)
+      if (!mine(c) && !who.owner && !stale) throw new Error(`${pattern} is claimed by ${c.by}; only they can release it (or the session owner)`)
+      if (mine(c) && queued(c)) throw new Error(`${c.queue.map((r) => r.by).join(', ')} ${c.queue.length === 1 ? 'is' : 'are'} waiting for ${pattern} in its file queue: hand it off with your context instead of releasing it`)
+      this.dropClaims((x) => x === c, () => mine(c) ? `${c.by} let go of it.` : `${name} (the session owner) released ${c.by}'s claim.`)
+      return { ok: true, released: 1 }
+    }
+    if (req.op === 'unbox') {
+      // The holder's box opens: `release` lets go of the claim too (it was committed: the first one
+      // waiting for the file gets it); otherwise the holder keeps the file, its content now in every folder.
+      const c = this.meta.claims[at(pattern)]
+      if (!c || !c.box) return { ok: true, unboxed: 0 }
+      // A person may unpack what their own AI sessions boxed (mine, or `of` them without sign-in); the session owner, anyone's.
+      if (!mine(c) && !(!who.persona && c.of === name) && !who.owner) throw new Error(`${pattern} is boxed by ${c.by}; only they can unpack it (or the session owner)`)
+      if (req.release === true) this.dropClaims((x) => x === c, () => `${c.by} committed it.`)
+      else { delete c.box; delete c.reminded }
+      return { ok: true, unboxed: 1 }
+    }
+    if (req.op === 'request') {
+      // Asking for a file someone else holds: a line in that claim's file queue. Its holder is
+      // told now, and must hand it off (with context) before letting go.
+      const file = String(req.path ?? '').trim().replace(/^\.\//, '')
+      if (!file || file.length > MAX_PATTERN) throw new Error('path required')
+      if (CONTROL_CHARS.test(file)) throw new Error('a path cannot contain control characters')
+      if (who.talk === false) throw new Error('you may not post in this session')
+      const c = this.claimFor(file, branch)
+      if (!c) throw new Error(`${file} is not claimed: claim it and go ahead`)
+      if (mine(c)) throw new Error(`${file} is already yours`)
+      const title = String(req.title ?? '').trim().slice(0, MAX_REQUEST_TITLE)
+      if (!title) throw new Error('title required: what you want to do, in a few words')
+      const description = String(req.description ?? '').trim().slice(0, MAX_REQUEST_TEXT)
+      const task = req.task ? String(req.task).slice(0, 80) : undefined
+      c.queue = c.queue || []
+      // One request per person per claim: asking again updates it and keeps its place.
+      const prev = c.queue.find((r) => id ? r.byId === id : r.by === name)
+      if (!prev && c.queue.length >= MAX_QUEUE) throw new Error(`${c.queue.length} are already waiting for ${c.pattern}`)
+      const r = prev || { id: crypto.randomBytes(6).toString('hex'), by: name, ...(id ? { byId: id } : {}), ...(who.persona ? { of: who.of } : {}), ts: Date.now() }
+      Object.assign(r, { path: file, title, description, ...(task ? { task } : {}) })
+      // Asked for by a clash task's assignee for the merge: let go of when the task is done (dropClashClaims).
+      if (typeof req.clash === 'string' && /^[0-9a-f]{16}$/.test(req.clash) && this.tasks.get(req.clash)?.assignee === name) r.clash = req.clash
+      if (!prev) c.queue.push(r)
+      this.postChat({ by: name, to: c.by, kind: 'queue', path: file, text: `📥 File queue · ${file}: ${`${title}${description ? ` — ${description}` : ''}`.replace(/[.!?]+$/, '')}. When you're done with it, hand it off to me with your context.` })
+      return { ok: true, request: r.id, position: c.queue.indexOf(r) + 1, holder: c.by, pattern: c.pattern }
+    }
+    if (req.op === 'withdraw') {
+      // The one who asked (or the owner) takes a request back.
+      for (const c of Object.values(this.meta.claims)) {
+        const r = (c.queue || []).find((x) => x.id === req.request)
+        if (!r) continue
+        if (!(id ? r.byId === id : r.by === name) && !who.owner) throw new Error('that request is not yours')
+        c.queue = c.queue.filter((x) => x !== r)
+        if (!c.queue.length) delete c.queue
+        return { ok: true, withdrawn: 1 }
+      }
+      return { ok: true, withdrawn: 0 }
+    }
+    if (req.op === 'handoff') {
+      // The holder passes a claim to someone waiting for it (the first, unless `to` names a
+      // request id or a person), with what they know: what they changed, what's left, gotchas.
+      const c = this.meta.claims[at(pattern)] || (pattern && this.claimFor(pattern, branch))
+      if (!c) throw new Error(`${pattern || 'that'} is not claimed`)
+      if (!mine(c) && !who.owner) throw new Error(`${c.pattern} is ${c.by}'s to hand off`)
+      const queue = c.queue || []
+      if (!queue.length) throw new Error(`nobody is waiting for ${c.pattern}: release it instead`)
+      const to = req.to ? String(req.to) : ''
+      const r = to ? queue.find((x) => x.id === to || x.by === to) : queue[0]
+      if (!r) throw new Error(`${to} is not waiting for ${c.pattern}`)
+      const context = String(req.context ?? '').trim().slice(0, MAX_HANDOFF_TEXT)
+      if (!context && mine(c)) throw new Error('context required: what you changed, what is left and anything they should know')
+      this.handOff(c, r, { context: context || `${name} (the session owner) handed it on.`, auto: !mine(c) })
+      return { ok: true, to: r.by, pattern: c.pattern, waiting: queue.length - 1 }
+    }
+    if (req.op === 'clear-inactive') {
+      // The owner clears every claim held by someone who isn't in the session now.
+      if (!who.owner) throw new Error('only the session owner can clear claims')
+      return { ok: true, released: this.dropClaims((c) => !this.holderPresent(c)) }
+    }
+    throw new Error('unknown claim operation')
+  }
+
+  saveMeta () {
+    if (this.ended || !this.metaFile || this.crashed || this.released) return // crashed: a failure injected in a test (relay-sync.js crashPoint)
+    // Written whole, then renamed: a crash mid-write leaves the old file, never a cut-off one.
+    try {
+      const tmp = this.metaFile + '.tmp'
+      fs.writeFileSync(tmp, JSON.stringify(this.meta))
+      fs.renameSync(tmp, this.metaFile)
+    } catch (err) { this.diskError(err) }
+  }
+
+  /**
+   * A save failed (the disk is full, or not writable). The relay stays up and the
+   * room stays readable, but takes no new changes rather than losing them quietly.
+   */
+  diskError (err) {
+    if (!this.unsavable) this.log(`[${this.name}] could not save the session (${err.message}); it is read-only until the relay's disk is fixed and it is reloaded`)
+    this.unsavable = true
+    this.full = true
+  }
+
+  scheduleSave () {
+    if (!this.docFile || this.saveTimer) return
+    this.saveTimer = setTimeout(() => this.save(), 1000)
+  }
+
+  save () {
+    if (this.ended || this.crashed || this.released) return
+    clearTimeout(this.saveTimer)
+    this.saveTimer = null
+    if (!this.docFile || !this.exists) return
+    const state = Y.encodeStateAsUpdate(this.doc)
+    this.bytes = state.length
+    try {
+      const tmp = this.docFile + '.tmp'
+      fs.writeFileSync(tmp, state)
+      fs.renameSync(tmp, this.docFile)
+    } catch (err) { this.diskError(err) }
+  }
+
+  /**
+   * Challenges the client to prove it holds the key for its name, then lets
+   * it into the room. Nothing else is accepted until then.
+   */
+  admit (ws, name, publicKey, key, { kind = 'human', invitedAs = 'editor', account = '' } = {}, onJoin) {
+    if (this.ended) return ws.close(CLOSE_ENDED, 'The owner ended this session')
+    clearTimeout(this.unloadTimer)
+    const nonce = crypto.randomBytes(32)
+    let joined = false
+    let waiting = false
+    ws.meter = this.meter
+    ws.on('message', (data) => {
+      const buf = new Uint8Array(data)
+      this.meter.in(buf.length)
+      // A fresh pass may come at any time, even while waiting for the owner.
+      // (MSG_PASS is under 128, so it is the whole first byte.)
+      if (ws.pass && buf[0] === MSG_PASS) {
+        if (!renewPass(ws, buf)) this.log(`[${this.name}] ignored a pass refresh from ${name} that wasn't theirs`)
+        else this.passRenewed(ws)
+        return
+      }
+      if (joined || this.access.has(ws)) {
+        joined = true
+        try { this.handle(ws, buf) } catch (err) { this.log(`[${this.name}] bad message: ${err.message}`) }
+        return
+      }
+      if (waiting) return // nothing counts until the owner lets them in
+      try {
+        const dec = decoding.createDecoder(buf)
+        if (decoding.readVarUint(dec) !== MSG_AUTH) throw new Error('not signed in')
+        if (!verifyChallenge(key, this.name, nonce, decoding.readVarUint8Array(dec))) throw new Error('bad signature')
+      } catch (err) {
+        this.log(`[${this.name}] refused ${name}: ${err.message}`)
+        return ws.close(CLOSE_AUTH_FAILED, 'Could not verify who you are')
+      }
+      if (this.ended) return ws.close(CLOSE_ENDED, 'The owner ended this session')
+      // Its messages are the relay's own (relay-ask.js): nobody may write as it.
+      if (isRelay(name)) return ws.close(CLOSE_NAME_TAKEN, `"${RELAY_BY}" is the relay's own name; pick another name`)
+      // The session may have started storing files while this app signed in.
+      if (!this.supported(ws)) return ws.close(CLOSE_NEEDS_UPDATE, NEEDS_UPDATE)
+      // With sign-in on, names come from accounts and can't be taken, so they aren't bound to keys.
+      if (!account) {
+        // Re-check: someone else may have taken the name while we waited.
+        if (!this.keyMatches(name, publicKey)) return ws.close(CLOSE_NAME_TAKEN, nameTaken(name))
+        this.bindName(name, publicKey)
+      }
+      const acc = this.accessFor(publicKey, name, kind, invitedAs, account, ws.pass)
+      if (acc.state === 'pending') {
+        waiting = true
+        this.pending.set(ws, { key: publicKey, id: account || publicKey, name, kind, invitedAs, since: Date.now() })
+        this.log(`[${this.name}] ${name} is waiting to be let in`)
+        send(ws, jsonMessage(MSG_ACCESS, { state: 'pending', invitedAs, controlled: true }))
+        this.broadcastMembers()
+        onJoin()
+        return
+      }
+      joined = true
+      this.enter(ws, { key: publicKey, id: acc.id || account || publicKey, name, kind, role: acc.role, scopes: acc.scopes, scopesExcept: acc.scopesExcept || [], talk: acc.talk !== false, owner: acc.owner })
+      onJoin()
+    })
+    ws.on('close', (code) => {
+      if (this.pending.delete(ws)) this.broadcastMembers()
+      if (this.access.has(ws) || this.conns.has(ws)) this.leave(ws, code)
+    })
+    send(ws, bytesMessage(MSG_AUTH, nonce))
+  }
+
+  /** Lets a signed-in (and, if needed, approved) person into the room. */
+  enter (ws, a) {
+    this.setAccess(ws, a)
+    this.noteTurns(ws, a)
+    // Presence: an account's visit starts once it's let in (never while it waits for the owner).
+    if (ws.pass && this.presence && !ws.visit) {
+      ws.visit = this.presence.visitStart({ room: this.name, account: `${ws.pass.kind}:${ws.pass.sub}`, name: a.name, owner: !!a.owner, via: 'app', tool: ws.tool || '' })
+      // The accounts API learns who owns a session from this report, and only the owner may
+      // give people access there: tell it now rather than within the minute.
+      if (a.owner) this.presence.tick().catch(() => {})
+    }
+    // A person's cloud AI: the room remembers it, so it can be woken while it is away (relay-ai-vm.js).
+    if (ws.pass && noteCloudAi(this.meta, ws.pass, a.name)) {
+      this.saveMeta()
+      if (this.cloudAiWaker) this.cloudAiWaker.check(this).catch(() => {})
+    }
+    // Back with a pass from before the owner's last change: a newer one may allow more.
+    const refresh = !a.owner && this.passPredatesChange(ws.pass) ? { refresh: true } : {}
+    send(ws, jsonMessage(MSG_ACCESS, { ...this.accessMessage(a), ...refresh }))
+    this.join(ws, a.name)
+    this.broadcastMembers()
+  }
+
+  join (ws, name) {
+    this.conns.set(ws, new Set())
+    this.names.set(ws, name)
+    send(ws, syncStep1Message(this.doc))
+    send(ws, jsonMessage(MSG_BRANCHES, { branches: this.branchList() }))
+    const states = [...this.awareness.getStates().keys()]
+    if (states.length) send(ws, awarenessMessage(this.awareness, states))
+    send(ws, jsonMessage(MSG_CLAIMS, { claims: this.claimList(ws.branch) }))
+    this.touch()
+  }
+
+  /**
+   * An agent that says it works in turns (`turns` among its features) is away between them: the relay
+   * keeps when its last turn ended. One that joins without it (an ordinary computer) is not any more.
+   */
+  noteTurns (ws, a) {
+    const key = a.owner ? this.ownerId : a.id
+    if (!key) return
+    const turns = a.kind === 'agent' && (ws.features || []).includes('turns')
+    const had = this.meta.turns && key in this.meta.turns
+    if (turns) (this.meta.turns ||= {})[key] = 0 // here now
+    else if (had) delete this.meta.turns[key]
+    if (turns || had) this.saveMeta()
+  }
+
+  /** When an agent that works in turns was last here (its last turn ended), or null. */
+  awaySince (key) {
+    const at = this.meta.turns && this.meta.turns[key]
+    return at && Date.now() - at < AWAY_MS ? at : null
+  }
+
+  leave (ws, code) {
+    const left = this.access.get(ws)
+    if (left) {
+      const key = left.owner ? this.ownerId : left.id
+      // Its turn is over once its last connection goes (an agent may have two for a moment while it reconnects).
+      if (this.meta.turns && key in this.meta.turns && ![...this.access].some(([w, x]) => w !== ws && (x.owner ? this.ownerId : x.id) === key)) {
+        this.meta.turns[key] = Date.now()
+        this.saveMeta()
+      }
+    }
+    if (ws.visit) { if (this.presence) this.presence.visitEnd(ws.visit, ws.endReason || endReasonFor(code)); ws.visit = null }
+    const ids = this.conns.get(ws)
+    if (ws.branch) { this.store.unsubscribe(ws, ws.branch); this.noteBranchSeen(ws.branch, { force: true, used: true }) }
+    this.conns.delete(ws)
+    this.names.delete(ws)
+    if (this.access.delete(ws)) {
+      this.guard.trackedOrigins.delete(ws)
+      this.broadcastMembers()
+    }
+    if (ids && ids.size) {
+      awarenessProtocol.removeAwarenessStates(this.awareness, [...ids], null)
+      // Forget their clocks too: back after a drop, a client sends the same state at the
+      // same clock, which would be ignored until its next renewal.
+      for (const id of ids) this.awareness.meta.delete(id)
+    }
+    if (this.conns.size === 0) {
+      this.save()
+      this.touch()
+      this.onEmpty && this.onEmpty()
+    }
+  }
+
+  handle (ws, buf) {
+    const dec = decoding.createDecoder(buf)
+    const type = decoding.readVarUint(dec)
+    if (type === MSG_SYNC) {
+      const docId = decoding.readVarString(dec)
+      let doc = this.doc
+      if (docId !== ROOM_DOC) {
+        // A connection syncs the room's document and the one branch it joined, nothing else.
+        // An edit it sent for the branch it just left, still in flight when the join landed
+        // (ws.prevBranch, set in branchRequest), is still applied rather than lost.
+        const k = this.resolveKey(docId)
+        const e = (k === ws.branch || k === ws.prevBranch) ? this.store.get(k) : null
+        if (!e) return
+        doc = e.doc
+        // A branch over its size limit takes nothing new; the room and every other branch carry
+        // on, and nobody is disconnected for it (its members hear it in the branch list).
+        if (!this.unsavable && this.branchFull(k) && decoding.peekVarUint(dec) !== syncProtocol.messageYjsSyncStep1) return
+      }
+      if (docId === ROOM_DOC ? this.full : this.unsavable) {
+        // Over quota: still answer "what do you have?" so people can read, but refuse new data.
+        if (decoding.peekVarUint(dec) !== syncProtocol.messageYjsSyncStep1) {
+          ws.endReason = 'disconnected'
+          closeSoon(ws, CLOSE_ROOM_FULL, 'room is over the size limit')
+          return
+        }
+      }
+      const enc = syncHeader(docId)
+      const header = encoding.length(enc)
+      syncProtocol.readSyncMessage(dec, enc, doc, ws)
+      if (encoding.length(enc) > header) send(ws, encoding.toUint8Array(enc))
+    } else if (type === MSG_BRANCH) {
+      let req = {}
+      let reply
+      try {
+        req = JSON.parse(decoding.readVarString(dec))
+        reply = { id: req.id, op: req.op, ...this.branchRequest(ws, req) }
+      } catch (err) {
+        reply = { id: req.id, op: req.op, ok: false, error: err.message }
+      }
+      const listChanged = reply.listChanged
+      delete reply.listChanged
+      send(ws, jsonMessage(MSG_BRANCHES, { branches: this.branchList(), reply }))
+      if (reply.ok && reply.op === 'join') {
+        // What the relay has of the branch, and its claims: the app answers with what it has.
+        send(ws, syncStep1Message(this.store.get(ws.branch).doc, ws.branchAs))
+        send(ws, jsonMessage(MSG_CLAIMS, { claims: this.claimList(ws.branch) }))
+      }
+      if (listChanged) this.broadcastBranches()
+    } else if (type === MSG_AWARENESS) {
+      const update = decoding.readVarUint8Array(dec)
+      if (!this.presenceAllowed(ws, update)) return this.log(`[${this.name}] dropped presence from ${this.names.get(ws)} under another name`)
+      awarenessProtocol.applyAwarenessUpdate(this.awareness, update, ws)
+    } else if (type === MSG_QUERY_AWARENESS) {
+      send(ws, awarenessMessage(this.awareness, [...this.awareness.getStates().keys()]))
+    } else if (type === MSG_CLAIM) {
+      let req = {}
+      let reply
+      try {
+        req = JSON.parse(decoding.readVarString(dec))
+        const who = this.claimant(ws, req.as)
+        // No box on a file this member's change to would be undone (checkChange): nothing of theirs would be in it.
+        if (req && req.op === 'claim' && req.box === true && !this.mayBox(ws, req.pattern)) req.box = false
+        reply = { id: req.id, ...this.claimRequest(who, req) }
+        this.noteActivity(who.persona ? [this.claimantKey(who)] : this.holderKeys(ws))
+      } catch (err) {
+        return send(ws, jsonMessage(MSG_CLAIMS, { claims: this.claimList(ws.branch), reply: { id: req.id, ok: false, error: err.message } }))
+      }
+      this.saveMeta()
+      for (const other of this.conns.keys()) {
+        const claims = this.claimList(other.branch)
+        send(other, jsonMessage(MSG_CLAIMS, other === ws ? { claims, reply } : { claims }))
+      }
+      this.noteClaimsChanged()
+    } else if (type === MSG_ADMIN) {
+      let req = {}
+      let reply
+      try {
+        req = JSON.parse(decoding.readVarString(dec))
+        // quilt_sync_branch from a folder that can't bring commits in itself (no git, or its fetch
+        // fails): any member let in may ask the relay to look at GitHub for its branch now.
+        if (req.op === 'syncUpstream') {
+          const id = req.id
+          if (!this.access.get(ws) || !ws.branch) throw new Error('not in this session')
+          this.syncUpstreamNow(ws.branch).then((sync) => ({ id, ok: true, sync }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // A folder's git asking for a token for the session's repository (Quilt's credential helper, in
+        // agents' and people's folders): read to fetch or clone, write to push while git is on for everyone here.
+        if (req.op === 'gitToken') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || !ws.branch) throw new Error('not in this session')
+          this.gitTokenFor(ws.branch, { access: req.access === 'write' ? 'write' : 'read', who: { name: a.name, kind: a.kind === 'agent' ? 'agent' : 'human', id: a.id }, repo: typeof req.repo === 'string' ? req.repo : null })
+            .then((git) => ({ id, ok: true, git }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // Someone just connected GitHub (or asks whether it is): the connection is checked again now.
+        if (req.op === 'githubRecheck') {
+          const id = req.id
+          if (!this.access.get(ws) || !ws.branch) throw new Error('not in this session')
+          const key = this.resolveKey(ws.branch)
+          noteConnection(this, key, { force: true }).then((changed) => { if (changed) { this.saveMeta(); this.broadcastBranches() } return { id, ok: true, github: relayEntry(upstreamsOf(this)[key])?.github || null } }, (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // Which of a member's files (or a task's) aren't in git on GitHub yet (relay-commit.js).
+        if (req.op === 'unpublished') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || !ws.branch) throw new Error('not in this session')
+          unpublishedFor(this, { key: ws.branch, who: a.name, files: Array.isArray(req.files) ? req.files : null, task: typeof req.task === 'string' ? req.task : null, column: typeof req.column === 'string' ? req.column : '' }, { fetch: this.githubFetch })
+            .then((u) => ({ id, ok: true, unpublished: u }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // The branch's pull requests, merging one, and a task moved to Done (which merges its pull request) (relay-commit.js).
+        if (req.op === 'pulls' || req.op === 'merge' || req.op === 'finishTask') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || !ws.branch) throw new Error('not in this session')
+          const who = { name: a.name, kind: a.kind === 'agent' ? 'agent' : 'human', access: a }
+          const run = req.op === 'pulls' ? pullRequestsFor(this, { key: ws.branch }, { fetch: this.githubFetch }) : req.op === 'finishTask' ? finishTaskFor(this, { who, key: ws.branch, task: String(req.task || '') }, { fetch: this.githubFetch, log: this.log }) : mergeForMember(this, { who, key: ws.branch, number: req.number, branch: req.branch, method: req.method, deleteBranch: req.deleteBranch, force: req.force === true }, { fetch: this.githubFetch, log: this.log })
+          run.then((out) => ({ id, ok: true, [req.op]: out }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // A person's folder hands its local commits to the relay (plan §6; relay-outbound.js replayBundle).
+        if (req.op === 'bundle') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || (a.state && a.state !== 'approved') || !ws.branch) throw new Error('not in this session')
+          if (a.role === 'viewer' || a.kind === 'agent') throw new Error('only people\'s folders hand commits to the relay')
+          replayBundle(this, ws.branch, { who: { name: a.name, kind: 'human' }, bundle: String(req.bundle || ''), head: String(req.head || ''), ref: String(req.ref || '') })
+            .then((out) => ({ id, ok: true, bundle: out }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // A member's offline edits clash with the session's (plan §7.1): held and merged as a clash (relay-clash.js).
+        if (req.op === 'offlineClash') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || (a.state && a.state !== 'approved') || !ws.branch || a.role === 'viewer') throw new Error('not in this session')
+          if (!this.cfg.gitSync || !this.mirrors) throw new Error('This session doesn\'t sync live with GitHub.')
+          const text = (v) => typeof v === 'string' && v.length <= 1024 * 1024 ? v : null
+          openOfflineClash(this, ws.branch, { who: { name: a.name }, path: String(req.path || ''), mergeId: typeof req.mergeId === 'string' ? req.mergeId.slice(0, 40) : null, base: text(req.base), ours: text(req.ours), oursDeleted: req.oursDeleted === true, binary: req.binary === true })
+            .then((h) => ({ id, ok: true, offlineClash: { task: h.task, merger: h.merger, reviewer: h.reviewer } }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { this.broadcastBranches(); if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // A person adopts an agent's branch into theirs (addendum 16.7; relay-outbound.js adoptBranch).
+        if (req.op === 'adopt') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || (a.state && a.state !== 'approved') || !ws.branch || a.role === 'viewer') throw new Error('not in this session')
+          if (!this.cfg.gitSync || !this.mirrors) throw new Error('This session doesn\'t sync live with GitHub.')
+          adoptBranch(this, ws.branch, { who: { name: a.name, kind: a.kind === 'agent' ? 'agent' : 'human' }, from: String(req.from || '') })
+            .then((out) => ({ id, ok: true, adopt: out }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // quilt_clash from a folder's AI or app (relay-clash.js): the member's own name and kind.
+        if (req.op === 'clash') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || (a.state && a.state !== 'approved') || !ws.branch) throw new Error('not in this session')
+          if (!this.cfg.gitSync || !this.mirrors) throw new Error('This session doesn\'t sync live with GitHub, so there are no held clashes here.')
+          clashAction(this, { who: { name: a.name, kind: a.kind === 'agent' ? 'agent' : 'human', access: a }, key: ws.branch, action: String(req.action || ''), path: String(req.path || ''), content: typeof req.content === 'string' ? req.content : null, checks: req.checks && typeof req.checks === 'object' ? req.checks : null, force: req.force === true })
+            .then((out) => out.ok ? { id, ok: true, clash: out, text: out.text } : { id, ok: false, error: out.text }, (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        // quilt_commit from a folder: the relay commits the session's copy of the files to GitHub (relay-commit.js).
+        if (req.op === 'commit') {
+          const id = req.id
+          const a = this.access.get(ws)
+          if (!a || !ws.branch) throw new Error('not in this session')
+          this.commitFor({ name: a.name, kind: a.kind === 'agent' ? 'agent' : 'human', access: a }, ws.branch, req)
+            .then((commit) => ({ id, ok: true, commit }), (err) => ({ id, ok: false, error: err.message }))
+            .then((r) => { if (this.conns.has(ws)) send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(this.access.get(ws)) ? this.pendingList() : [], reply: r })) })
+          return
+        }
+        reply = { id: req.id, ...this.adminRequest(ws, req) }
+      } catch (err) {
+        reply = { id: req.id, ok: false, error: err.message }
+      }
+      if (reply.ok) this.broadcastMembers(ws, reply)
+      else {
+        const a = this.access.get(ws)
+        send(ws, jsonMessage(MSG_MEMBERS, { members: this.memberList(), sessionName: this.meta.name || '', admitBy: this.admitBy, pending: this.personCanAdmit(a) ? this.pendingList() : [], reply }))
+      }
+    }
+  }
+
+  destroy () {
+    this.destroyed = true
+    clearTimeout(this.unloadTimer)
+    clearTimeout(this.upstreamSoonTimer)
+    clearTimeout(this.upstreamAgainTimer)
+    this.save()
+    this.store.destroy()
+    this.guard.destroy()
+    this.awareness.destroy()
+    this.doc.destroy()
+  }
+
+  /** Stored-file ids any of the room's documents still points at (unloaded branches: as of their last save). */
+  storedIds () {
+    const ids = new Set()
+    const add = (b) => { if (b && b.stored && b.stored.id) ids.add(b.stored.id) }
+    for (const b of this.blobs.values()) add(b) // rooms from before branch documents
+    for (const [key, meta] of Object.entries(this.meta.branches)) {
+      const e = this.store.get(key)
+      if (e) for (const b of e.blobs.values()) add(b)
+      else for (const id of meta.stored || []) ids.add(id)
+    }
+    return ids
+  }
+}
+
+const TALK_WHY = "you can't post in this session"
+// What an app's activity entries look like (session.js recordActivity, relay-mcp.js quilt_write).
+const ACTIVITY_FIELDS = ['by', 'path', 'kind', 'detail', 'ts', 'branch', 'from']
+const ACTIVITY_KINDS = ['created', 'edited', 'deleted', 'switched']
+// Claim ops as the audit trail names them.
+const CLAIM_ACTIONS = { claim: 'claimed', release: 'released', request: 'requested', handoff: 'handed_off', withdraw: 'withdrew' }
+const ACTIVITY_DETAIL = /^(\+\d+ -\d+|\d+ bytes)?$/
+const nameTaken = (name) => `The name "${name}" belongs to someone else in this room; pick another name`
+
+/** A saved member's access, in the relay's shape (members saved before access types may talk and have no exceptions). */
+const memberAccess = (m) => ({ role: m.role, scopes: m.scopes || [], scopesExcept: m.scopesExcept || [], talk: m.talk !== false })
+
+/**
+ * Why a connection's visit ended, from the close code, when the relay didn't close it
+ * itself (those set ws.endReason). A clean close (1000, 1001, 1005) is the app or agent
+ * leaving; anything else (1006 and the like) is a dropped connection.
+ */
+export function endReasonFor (code) {
+  if (code === 1000 || code === 1001 || code === 1005) return 'left'
+  if (code === CLOSE_DENIED) return 'removed'
+  if (code === CLOSE_ENDED) return 'session_ended'
+  if (code === CLOSE_PASS_EXPIRED) return 'pass_expired'
+  return 'disconnected'
+}
+
+/** Closes the connection when its pass runs out, unless a newer one arrives first. */
+function trackPass (ws, pass) {
+  ws.pass = pass
+  clearTimeout(ws.passTimer)
+  const left = Math.min(Math.max(pass.exp - Date.now(), 0), 2 ** 31 - 1)
+  ws.passTimer = setTimeout(() => { ws.endReason = 'pass_expired'; ws.close(CLOSE_PASS_EXPIRED, PASS_EXPIRED) }, left)
+}
+
+/** A MSG_PASS: a valid pass for the same account (or agent) and key extends the connection. */
+function renewPass (ws, buf) {
+  let next = null
+  try {
+    const dec = decoding.createDecoder(buf)
+    decoding.readVarUint(dec)
+    next = verifyPass(String(JSON.parse(decoding.readVarString(dec)).pass || ''), ws.passKey)
+  } catch {}
+  if (!next || next.sub !== ws.pass.sub || next.kind !== ws.pass.kind || next.key !== ws.pass.key || next.room !== ws.pass.room) return false
+  trackPass(ws, next)
+  return true
+}
+
+function send (ws, msg) {
+  if (ws.readyState !== ws.OPEN) return
+  if (ws.meter) ws.meter.out(msg.byteLength ?? msg.length ?? 0)
+  ws.send(msg, (err) => { if (err) ws.terminate() })
+}
+
+/**
+ * Closes a socket for a reason the app should see (a normal `ws.close`, so a well-behaved
+ * app gets the code and reason in its 'close' handler), but doesn't wait out the library's
+ * full ~30s close-handshake timeout for a peer that never acks: if the close hasn't
+ * finished on its own well before then, it terminates the socket outright. Used for closes
+ * the relay forces for policy reasons (e.g. CLOSE_ROOM_FULL) rather than ones a healthy,
+ * responsive client is expected to negotiate.
+ */
+function closeSoon (ws, code, reason, ms = 2000) {
+  ws.close(code, reason)
+  const t = setTimeout(() => { if (ws.readyState !== ws.CLOSED) ws.terminate() }, ms)
+  ws.once('close', () => clearTimeout(t))
+}
+
+/** Whether anyone (a folder, a connected app or CLI, a hosted agent) is on branch `key` now. */
+function relayLooksActive (room, key) { return folderOn(room, key) || connectedOn(room, key) || hostedOn(room, key).length > 0 }
+
+export function startServer ({ port = 4321, host = '0.0.0.0', dataDir = null, log = console.log, presenceOptions = {}, ...opts } = {}) {
+  const cfg = relayConfig(opts)
+  // Many machines (relay-cluster.js): each room on one of them, the accounts API says which.
+  const cc = clusterConfig(opts)
+  configureGithubBudget({ anonPerHour: cfg.githubAnonPerHour })
+  const passKey = cfg.passPublicKey ? parsePublicKey(cfg.passPublicKey) : null
+  if (cfg.passPublicKey && !passKey) throw new Error('QUILT_PASS_PUBLIC_KEY is not an Ed25519 public key (spki, base64url)')
+  /** With sign-in on: the request's valid pass, or null. With it off: an empty pass. */
+  // The relay's own key for large files on branches that sync with GitHub (relay-filekey.js).
+  const relayFileKeyPair = cfg.gitSync ? relayFileKey(dataDir, { pem: opts.relayFileKey ?? process.env.QUILT_RELAY_FILE_KEY ?? '', log }) : null
+  // Git's hooks on this machine ask the relay with this (relay-githttp.js): a secret of this process.
+  const hookToken = crypto.randomBytes(24).toString('base64url')
+  const httpPass = (req, room = '') => {
+    if (!passKey) return {}
+    const p = verifyPass(String(req.headers['x-quilt-pass'] || ''), passKey)
+    // A room pass is good in its own room only.
+    return p && (!p.room || !room || p.room === room) ? p : null
+  }
+  // Who a new session counts against: their account with sign-in on, otherwise their address.
+  const starterOf = (pass, req) => pass && pass.sub ? `${pass.kind}:${pass.sub}` : clientIp(req)
+  // Without sign-in the limit is per address, and the message says so (as before).
+  const TOO_MANY = passKey ? 'too many new sessions; try again later' : 'too many new sessions from this address; try again later'
+  if (dataDir) fs.mkdirSync(dataDir, { recursive: true })
+  // The relay's git mirrors (relay-git.js): one bare repository per GitHub repository, one writer per branch.
+  const mirrors = mirrorManager({ dataDir, log, ...(cfg.pushGapMs !== undefined ? { pushGapMs: cfg.pushGapMs } : {}), ...(cfg.pushesPerHour !== undefined ? { pushesPerHour: cfg.pushesPerHour } : {}) })
+  // One live session per repository and branch (relay-lease.js): in the accounts API when this relay has one, else in this process.
+  const leases = leaseKeeper({ apiUrl: cfg.apiUrl, secret: cfg.relayApiSecret, fetch: opts.apiFetch || globalThis.fetch, dataDir, log, ...(cfg.leaseTtlMs ? { ttlMs: cfg.leaseTtlMs } : {}), ...(cfg.leaseMarginMs !== undefined ? { marginMs: cfg.leaseMarginMs } : {}), holder: `relay:${cc.machineId || os.hostname()}:${process.pid}`.slice(0, 100) })
+  // Whether the accounts API has workspaces on, for hosted agents' library tools: asked in
+  // the background (never holding up the start) and again every 10 minutes.
+  const apiFetch = opts.apiFetch || globalThis.fetch
+  {
+    const problems = clusterProblems(cc, cfg, { fileKey: relayFileKeyPair && relayFileKeyPair.shared ? 'shared' : '' })
+    if (problems.length) throw new Error(`QUILT_CLUSTER is on, but the relay is missing ${problems.join(', ')}`)
+  }
+  const cluster = cc.on ? new Cluster({ cc, apiUrl: cfg.apiUrl, secret: cfg.relayApiSecret, fetch: apiFetch, log, dataDir }) : null
+  const features = cfg.apiUrl ? watchFeatures({ apiUrl: cfg.apiUrl, fetch: apiFetch, log }) : null
+  // Who is in which session, for the dashboard (presence.js). Off unless both settings are set,
+  // and then only for connections with a pass. Visits a crash left open are ended now.
+  const presence = cfg.apiUrl && cfg.relayApiSecret
+    ? new PresenceReporter({ apiUrl: cfg.apiUrl, secret: cfg.relayApiSecret, file: dataDir ? path.join(dataDir, PRESENCE_FILE) : null, log, ...presenceOptions })
+    : null
+  // People's cloud AIs that are away (their machines suspend when idle) are woken through the API.
+  const cloudAis = cfg.apiUrl && cfg.relayApiSecret ? cloudAiWaker({ apiUrl: cfg.apiUrl, secret: cfg.relayApiSecret, fetch: apiFetch, log }) : null
+  if (presence) {
+    const ended = presence.load()
+    if (ended) log(`presence: ended ${ended} visit(s) left open by the last run`)
+    presence.start()
+  }
+  const rooms = new Map() // loaded rooms only
+  const ipConns = new Map()
+  // New sessions are rate-limited per account when sign-in is on, otherwise per address.
+  const newRooms = new Map() // starter -> creation timestamps in the last hour
+  const canCreate = (starter) => {
+    if (!cfg.maxNewRoomsPerHour) return true
+    const cutoff = Date.now() - 60 * 60 * 1000
+    const recent = (newRooms.get(starter) || []).filter((t) => t > cutoff)
+    if (recent.length) newRooms.set(starter, recent); else newRooms.delete(starter)
+    return recent.length < cfg.maxNewRoomsPerHour
+  }
+  const noteCreated = (starter) => newRooms.set(starter, [...(newRooms.get(starter) || []), Date.now()])
+
+  const tooBig = new Set() // stored rooms already reported as too big to load
+  /** A stored room far over the limit would run the relay out of memory while loading. */
+  const tooBigToLoad = (name) => {
+    if (!dataDir || rooms.has(name)) return false
+    let size = 0
+    try { size = fs.statSync(path.join(dataDir, `${name}.ydoc`)).size } catch { return false }
+    if (size <= cfg.maxRoomBytes * 2) return false
+    if (!tooBig.has(name)) { tooBig.add(name); log(`[${name}] too big to load (${Math.round(size / MB)} MB stored, limit ${Math.round(cfg.maxRoomBytes / MB)} MB); refusing it`) }
+    return true
+  }
+
+  const unreadable = new Set() // stored rooms whose files could not be read, until they can
+  /** Why getRoom gave null: the HTTP status and message to refuse with. */
+  const refused = (name) => cluster && !rooms.has(name) && !cluster.holds(name) ? [503, cluster.moving.has(name) ? MOVING : ELSEWHERE] : unreadable.has(name) ? [503, UNREADABLE] : [413, TOO_BIG]
+
+  /** The room, loading it if needed; null if it's too big to load, or its files can't be read. */
+  let webhooks = null // hosted agents' webhook subscriptions (set below, once `hosted` exists)
+  let adoptHosted = null // puts back hosted agents waiting on a room (set below, once `hosted` exists)
+  let endHostedVisits = null // ends the audit-trail visits of hosted agents in a room (set below)
+  let sweepHosted = null // ends the visits of hosted agents gone quiet (set below)
+  const getRoom = (name) => {
+    let room = rooms.get(name)
+    if (!room) {
+      // On many machines, only the machine the room is placed on may load (or start) it.
+      if (cluster && !cluster.holds(name)) return null
+      if (tooBigToLoad(name)) return null
+      try {
+        room = new Room(name, dataDir, cfg, log)
+        room.mirrors = mirrors
+        room.leases = leases
+        room.cluster = cluster
+        room.dataDirOf = dataDir
+        room.relayFileKey = relayFileKeyPair // large files on synced branches, once the owner agrees (plan §10)
+        room.blobStore = store
+        room.apiFetch = apiFetch // the API: credentials for agents' commits (relay-commit.js)
+        room.refreshPolicy() // what agents may commit, when its org or workspace says
+      } catch (err) {
+        if (!err.unreadable) throw err
+        // Logged once, not on every retry; tried again each time, in case the operator repaired it.
+        if (!unreadable.has(name)) { unreadable.add(name); log(`[${name}] ${err.message}; refusing it, and leaving its files alone`) }
+        return null
+      }
+      unreadable.delete(name)
+      rooms.set(name, room)
+      if (webhooks) webhooks.watch(room) // hosted agents' webhooks fire on its chat and board
+      if (cloudAis) { room.cloudAiWaker = cloudAis; cloudAis.watch(room) } // people's cloud AIs are woken from it
+      if (adoptHosted) adoptHosted(room)
+      room.presence = presence
+      if (opts.githubFetch) room.githubFetch = opts.githubFetch
+      // Idle rooms are saved and dropped from memory (only when they're on disk).
+      room.onEmpty = () => {
+        if (!dataDir || rooms.get(name) !== room) return
+        clearTimeout(room.unloadTimer)
+        room.unloadTimer = setTimeout(() => {
+          if (room.conns.size || rooms.get(name) !== room) return
+          collectStored(room)
+          room.destroy()
+          rooms.delete(name)
+          if (!room.exists) unplaceIfNothing(name)
+        }, cfg.idleUnloadMs)
+      }
+      room.onEnd = () => {
+        if (room.ended) return
+        room.ended = true
+        for (const ws of [...room.conns.keys(), ...room.pending.keys()]) if (!ws.hosted) { ws.endReason = 'session_ended'; ws.close(CLOSE_ENDED, 'The owner ended this session') }
+        // Hosted agents in it have no connection to close: their visits end here.
+        if (endHostedVisits) endHostedVisits(name, 'session_ended')
+        clearTimeout(room.unloadTimer)
+        room.store.discard(); room.guard.destroy(); room.awareness.destroy(); room.doc.destroy()
+        if (rooms.get(name) === room) rooms.delete(name)
+        removeRoomData(name)
+        // A tombstone keeps the room refused for good, instead of letting a new one start under the same name.
+        if (dataDir) {
+          const now = Date.now()
+          try {
+            fs.writeFileSync(path.join(dataDir, `${name}.json`), JSON.stringify({ ended: true, endedAt: now, lastActive: now }))
+          } catch (err) { log(`[${name}] could not write its tombstone: ${err.message}`) }
+        }
+        log(`[${name}] ended by its owner`)
+      }
+    }
+    return room
+  }
+  // A room that was probed but never created (bad secret / no key) shouldn't linger.
+  const dropIfUnused = (room) => {
+    if (!room.exists && !room.conns.size) { room.destroy(); rooms.delete(room.name); unplaceIfNothing(room.name) }
+  }
+  // On many machines: a session name someone tried that never became a session isn't kept placed.
+  const unplaceIfNothing = (name) => { if (cluster && !rooms.has(name) && !cluster.onDisk(name)) cluster.forgetPlacement(name) }
+
+  const clientIp = (req) => {
+    if (cfg.trustProxy) {
+      const fwd = String(req.headers['x-forwarded-for'] || '').split(',')[0].trim()
+      if (fwd) return fwd
+    }
+    return req.socket.remoteAddress || 'unknown'
+  }
+
+  // AI links: a browser's token -> the session and name that browser is in now,
+  // so the person's AI can use /mcp/<token> (see relay-mcp.js). Tokens are stored hashed.
+  const linksFile = dataDir && path.join(dataDir, 'agent-links.json')
+  const links = new Map()
+  try { for (const [k, v] of Object.entries(JSON.parse(fs.readFileSync(linksFile, 'utf8')))) links.set(k, v) } catch {}
+  let linksTimer = null
+  const saveLinks = () => {
+    if (!linksFile || linksTimer) return
+    linksTimer = setTimeout(() => {
+      linksTimer = null
+      const cutoff = Date.now() - 30 * DAY
+      for (const [k, v] of links) if ((v.tabSeenAt || 0) < cutoff) links.delete(k)
+      try { fs.writeFileSync(linksFile, JSON.stringify(Object.fromEntries(links))) } catch {}
+    }, 2000)
+    linksTimer.unref()
+  }
+  const tokenKey = (t) => hash(t).toString('hex')
+  const TOKEN_RE = /^[A-Za-z0-9_-]{20,64}$/
+
+  // Hosted agents: which session each one (by pass id) is in, so every tool call over
+  // /mcp knows its room. Kept on disk so a relay restart doesn't drop them out.
+  // The newest Quilt this relay knows of (its own build, or GitHub's latest), so agents are told to update.
+  const updates = new UpdateCheck().start()
+  const hostedFile = dataDir && path.join(dataDir, 'hosted-agents.json')
+  const hosted = new Map()
+  try { for (const [k, v] of Object.entries(JSON.parse(fs.readFileSync(hostedFile, 'utf8')))) { const h = normalizeHosted(v); if (h) hosted.set(k, h) } } catch {}
+  let hostedTimer = null
+  const writeHosted = () => {
+    hostedTimer = null
+    const cutoff = Date.now() - 30 * DAY
+    for (const [k, v] of hosted) if ((v.seenAt || 0) < cutoff) hosted.delete(k)
+    try { fs.writeFileSync(hostedFile, JSON.stringify(Object.fromEntries(hosted))) } catch {}
+  }
+  const saveHosted = () => {
+    if (!hostedFile || hostedTimer) return
+    hostedTimer = setTimeout(writeHosted, 2000)
+    hostedTimer.unref()
+  }
+  webhooks = hostedWebhooks({ hosted, saveHosted, log, fetch: opts.webhookFetch, delays: opts.webhookDelays })
+  for (const room of rooms.values()) webhooks.watch(room)
+  // Hosted agents' visits, for the audit trail. With no connection to open and close, a
+  // visit starts at the first tool call it's let in for, and ends when it leaves, is
+  // removed, its session ends, or it goes quiet for HOSTED_ONLINE_MS (ended at its last call).
+  // An agent is in several sessions at once; each session's record (hosted-agents.js) holds its visit there.
+  const openVisit = (r) => (r && r.visit && presence && presence.open.has(r.visit.start) ? r.visit : null)
+  const hostedVisitStart = (id, room, { name, tool, owner }) => {
+    const r = hostedIn(hosted.get(id), room.name)
+    if (!r || !presence) return
+    if (openVisit(r)) return
+    r.visit = presence.visitStart({ room: room.name, account: id, name, owner: !!owner, via: 'hosted', tool })
+    saveHosted()
+  }
+  const hostedVisitEnd = (id, roomName, reason, at) => {
+    const r = hostedIn(hosted.get(id), roomName)
+    const open = openVisit(r)
+    if (!open) return
+    presence.visitEnd(open, reason, at)
+    delete r.visit
+    saveHosted()
+  }
+  endHostedVisits = (roomName, reason) => { for (const [id, h] of hosted) if (hostedIn(h, roomName)) hostedVisitEnd(id, roomName, reason) }
+  const sweepHostedVisits = () => {
+    const cutoff = Date.now() - HOSTED_ONLINE_MS
+    for (const [id, h] of hosted) for (const [roomName, r] of Object.entries(h.rooms || {})) if (openVisit(r) && (r.seenAt || 0) < cutoff) hostedVisitEnd(id, roomName, 'idle', r.seenAt)
+  }
+  sweepHosted = sweepHostedVisits
+  // Hosted agents waiting to be let in are back on the owner's list when their room loads,
+  // without having to call a tool first; one the owner turns away is told on its next call.
+  adoptHosted = (room) => {
+    if (cluster) for (const [id, h] of hosted) if (hostedIn(h, room.name)) syncHosted(id, room.name)
+    room.hostedVisit = (id) => openVisit(hostedIn(hosted.get(id), room.name))
+    room.onHostedGone = (id, reason) => { if (hostedIn(hosted.get(id), room.name)) hostedVisitEnd(id, room.name, reason) }
+    for (const [id, h] of hosted) { const r = hostedIn(h, room.name); if (r && r.pending && !r.denied) room.restoreHosted(id, r) }
+    room.onHostedDenied = (id) => {
+      const r = hostedIn(hosted.get(id), room.name)
+      if (r && r.pending) { r.denied = true; saveHosted() }
+    }
+  }
+  for (const room of rooms.values()) adoptHosted(room)
+  /**
+   * On many machines, an agent's one webhook is kept by the accounts API (relay-cluster.js) so every
+   * machine holding one of its sessions delivers to it: `off` there means it unsubscribed (on any
+   * machine); none there yet means this machine's own (from before) is the one, and is shared.
+   */
+  function applySharedWebhook (account, w) {
+    const h = hosted.get(account)
+    if (!h) return
+    const restock = () => { for (const r of Object.values(h.rooms || {})) delete r.webhookState }
+    if (w && w.off) {
+      if (h.webhook) { delete h.webhook; restock(); saveHosted() }
+    } else if (w && w.url) {
+      if (!h.webhook || h.webhook.url !== w.url || h.webhook.secret !== w.secret || h.webhook.bearer !== w.bearer || JSON.stringify(h.webhook.events) !== JSON.stringify(w.events)) { h.webhook = w; restock(); saveHosted() }
+    } else if (h.webhook) cluster.hostedWebhook(account, h.webhook)
+  }
+  /** The agent's webhook from the accounts API, and this session in its index (a record from before cluster mode is added). */
+  function syncHosted (account, roomName = '') {
+    cluster.hostedOf(account, { fresh: true }).then((idx) => {
+      if (!idx) return
+      applySharedWebhook(account, idx.webhook)
+      if (roomName && !idx.rooms.includes(roomName) && hostedIn(hosted.get(account), roomName)) cluster.hostedRoom(account, { add: roomName })
+    }).catch((err) => log(`cluster: ${account}'s webhook: ${err.message}`))
+  }
+
+  // Files shared in chat are stored on the relay, not in the synced project.
+  const filesDir = path.join(dataDir || fs.mkdtempSync(path.join(os.tmpdir(), 'quilt-relay-')), 'files')
+  // Large files, already encrypted by the apps. See blobstore.js.
+  const store = makeStore(cfg, path.join(path.dirname(filesDir), 'blobs'))
+  const storedBytes = (room) => Object.values(room.meta.blobs || {}).reduce((n, b) => n + (b.size || 0), 0)
+  /** Deletes everything a room left on the relay and in storage. */
+  const removeRoomData = (name) => {
+    try {
+      if (dataDir) {
+        fs.rmSync(path.join(dataDir, `${name}.ydoc`), { force: true })
+        fs.rmSync(path.join(dataDir, `${name}.json`), { force: true })
+        fs.rmSync(path.join(dataDir, `${name}.chat.jsonl`), { force: true })
+        fs.rmSync(path.join(dataDir, 'branches', name), { recursive: true, force: true })
+        dropCheckpoints(dataDir, name) // quilt sync's checkpoints (relay-turn-sync.js)
+      }
+      fs.rmSync(path.join(filesDir, name), { recursive: true, force: true })
+    } catch (err) { log(`[${name}] could not delete its files: ${err.message}`) }
+    store.removeRoom(name).catch((err) => log(`[${name}] could not delete stored files: ${err.message}`))
+  }
+  /** Deletes stored files nothing points at any more (a day's grace for uploads in flight, or apps still offline). */
+  const collectStored = (room) => {
+    const blobs = room.meta.blobs || {}
+    const used = room.storedIds()
+    const cutoff = Date.now() - DAY
+    const unused = Object.keys(blobs).filter((id) => !used.has(id) && (blobs[id].ts || 0) < cutoff)
+    if (!unused.length) return
+    for (const id of unused) delete blobs[id]
+    room.saveMeta()
+    store.remove(room.name, unused).catch((err) => log(`[${room.name}] could not delete stored files: ${err.message}`))
+  }
+  /** Refuses an ended room's tombstone without loading it into memory. */
+  const roomEnded = (name) => {
+    if (!dataDir) return false
+    try { return !!JSON.parse(fs.readFileSync(path.join(dataDir, `${name}.json`), 'utf8')).ended } catch { return false }
+  }
+
+  // Public: the app's relay check reads this. It says nothing about who's using the relay.
+  const health = () => ({ ok: true, version: 1, requiresKey: !!cfg.relayKey })
+  /** Whether a request carries the relay secret (the accounts API, or another relay machine). */
+  const fromApi = (req) => {
+    const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+    const want = cfg.relayApiSecret || ''
+    return !!want && auth.length === want.length && crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(want))
+  }
+  // A room's bytes on disk, worked out at most once a report (a minute): it walks the room's folders.
+  const diskBytes = new Map() // room -> { at, n }
+  const diskTtl = Math.max(0, Math.min(60 * 1000, cc.reportMs) - 100)
+  const diskOf = (name) => {
+    const c = diskBytes.get(name)
+    const t = Date.now()
+    if (c && t - c.at < diskTtl) return c.n
+    const n = roomDiskBytes(dataDir, name)
+    diskBytes.set(name, { at: t, n })
+    return n
+  }
+  /** How busy and how big a loaded room is (relay-metrics.js): for /stats and the accounts API's placement. */
+  const roomStats = (room) => ({ room: room.name, conns: room.conns.size, hosted: room.hostedSeen.size, ...room.meter.lastMinute(), docBytes: room.totalBytes(), diskBytes: diskOf(room.name) })
+  const machineStats = () => {
+    const mem = process.memoryUsage()
+    return { rooms: rooms.size, conns: wss.clients.size, rss: mem.rss, heapUsed: mem.heapUsed, load: os.loadavg()[0], uptime: Math.round(process.uptime()) }
+  }
+  const stats = () => {
+    for (const name of diskBytes.keys()) if (!rooms.has(name)) diskBytes.delete(name)
+    return { machine: machineStats(), rooms: [...rooms.values()].filter((r) => !r.ended).map(roomStats) }
+  }
+  /** Closes a loaded room on this machine without ending it: its people reconnect (to wherever it is now). */
+  const unloadForMove = (name) => {
+    const room = rooms.get(name)
+    if (!room) return
+    // Everyone on it, including sockets still proving who they are.
+    for (const ws of wss.clients) if (ws.roomName === name) { ws.endReason = 'relay_restart'; closeSoon(ws, 1012, 'This session is moving to another relay machine', 1000) }
+    if (endHostedVisits) endHostedVisits(name, 'relay_restart')
+    clearTimeout(room.unloadTimer)
+    room.destroy()
+    room.released = true // no save after this: the copy here is on its way to another machine
+    rooms.delete(name)
+  }
+  /** The room is leaving this machine: refused from now on, saved, unloaded; its leases are the next machine's. */
+  const letRoomGo = (name) => {
+    cluster.release(name)
+    unloadForMove(name)
+    leases.forget(name)
+    if (hostedTimer) { clearTimeout(hostedTimer); writeHosted() }
+    log(`cluster: letting ${name} go to another machine`)
+  }
+  /** The room lives on `to` now: this machine's copy goes (never its large files in shared storage). */
+  const forgetRoomHere = (name, to) => {
+    unloadForMove(name)
+    leases.forget(name)
+    removeLocalRoom(dataDir, name)
+    fs.rmSync(viewDir(dataDir, name), { recursive: true, force: true })
+    for (const h of hosted.values()) if (hostedIn(h, name)) delete h.rooms[name]
+    saveHosted()
+    cluster.forget(name, to)
+    log(`cluster: ${name} lives on ${to || 'another machine'} now; deleted its copy here`)
+  }
+  /** Hosted agents' records for a room, to go with it to its next machine. */
+  const hostedRecordsOf = (name) => {
+    const out = {}
+    for (const [account, h] of hosted) { const r = hostedIn(h, name); if (r) out[account] = { record: r, ...(h.webhook ? { webhook: h.webhook } : {}) } }
+    return out
+  }
+  const takeHostedRecords = (name, recs) => {
+    if (!recs || typeof recs !== 'object') return
+    for (const [account, x] of Object.entries(recs)) {
+      if (!/^(person|agent):[A-Za-z0-9_-]{1,64}$/.test(account) || !x || typeof x.record !== 'object') continue
+      const h = hosted.get(account) || newHosted()
+      h.rooms[name] = x.record
+      if (x.webhook && !h.webhook) h.webhook = x.webhook
+      h.seenAt = Math.max(h.seenAt || 0, x.record.seenAt || 0)
+      hosted.set(account, h)
+    }
+    saveHosted()
+  }
+
+  // A request for a room on another machine: Fly's proxy sends it there (fly-replay), or, with a
+  // body too big for that, this machine streams it there over the private network.
+  const sendAway = (req, res, machine, body = null) => {
+    if (canReplay(req, body)) {
+      res.writeHead(409, { 'fly-replay': `instance=${machine}`, 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })
+      return res.end(ELSEWHERE)
+    }
+    cluster.forward(req, res, machine, body)
+  }
+  /** Where a request for `room` goes: { here } | { machine } | { moving } | { error }; never back where it came from. */
+  const whereTo = async (room, req, pass = '') => {
+    const src = replaySource(req)
+    // Only someone signed in may have a new session placed (and so started); anyone else finds existing ones only.
+    const create = !!(passKey && pass && verifyPass(String(pass), passKey))
+    const w = await cluster.locate(room, { fresh: !!src, create })
+    return w.machine && w.machine === src ? { error: ELSEWHERE } : w
+  }
+  // Hosted agents' MCP over HTTP: the body says which session (src/mcp-room.js), else the pass, else the agent's only session.
+  const MAX_MCP_ROUTE_BODY = 8 * MB
+  const mcpRoom = async (req, body) => {
+    const named = joiningRoom(body) || sessionArg(body)
+    if (named) return named
+    const pass = httpPass(req)
+    if (!pass) return ''
+    if (pass.room) return pass.room
+    const h = await cluster.hostedOf(`${pass.kind}:${pass.sub}`)
+    return h && h.rooms.length === 1 ? h.rooms[0] : ''
+  }
+  const readRaw = (req, max) => new Promise((resolve, reject) => {
+    const chunks = []
+    let size = 0
+    req.on('data', (c) => { size += c.length; if (size > max) { reject(Object.assign(new Error('too large'), { code: 413 })); req.destroy() } else chunks.push(c) })
+    req.on('end', () => resolve(Buffer.concat(chunks)))
+    req.on('error', reject)
+  })
+  /** On many machines: the room a request is about decides which machine answers it. */
+  const route = async (req, res, url) => {
+    const plain = (code, msg, extra = {}) => { res.writeHead(code, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store', ...extra }); res.end(msg) }
+    let room = roomOfPath(url.pathname)
+    let body = null
+    if (!room && req.method === 'POST' && (url.pathname === '/mcp' || url.pathname === '/agent/link')) {
+      try { body = await readRaw(req, url.pathname === '/mcp' ? MAX_MCP_ROUTE_BODY : 4096) } catch (err) { return plain(err.code === 413 ? 413 : 400, err.code === 413 ? 'too large' : 'bad request') }
+      if (url.pathname === '/mcp') room = await mcpRoom(req, body)
+      else { try { const b = JSON.parse(body.toString('utf8')); room = typeof b.room === 'string' && ROOM_RE.test(b.room) ? b.room : '' } catch {} }
+    }
+    if (!room) return handle(req, res, url, body)
+    const basic = /^Basic\s+([A-Za-z0-9+/=]+)$/i.exec(String(req.headers.authorization || '')) // git sends the pass as its password
+    const w = await whereTo(room, req, req.headers['x-quilt-pass'] || (basic ? Buffer.from(basic[1], 'base64').toString('utf8').replace(/^[^:]*:/, '') : ''))
+    if (w.none) return plain(404, 'no such session')
+    if (w.here) {
+      const r = rooms.get(room)
+      if (r) r.meter.in(body ? body.length : Number(req.headers['content-length']) || 0)
+      return handle(req, res, url, body)
+    }
+    if (w.machine) return sendAway(req, res, w.machine, body)
+    plain(503, w.moving ? MOVING : w.error || ELSEWHERE, { 'retry-after': '5' })
+  }
+  const httpServer = http.createServer((req, res) => {
+    const url = new URL(req.url, 'http://x')
+    if (!cluster) return handle(req, res, url, null)
+    route(req, res, url).catch((err) => {
+      log(`cluster: routing ${url.pathname}: ${err.message}`)
+      if (!res.headersSent) { res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' }); res.end('the relay could not route this request') }
+    })
+  })
+  /** Every HTTP request, on the machine that holds its room. `pre`: its body, when routing read it already. */
+  function handle (req, res, url, pre) {
+    const text = (code, msg) => { res.writeHead(code, { 'content-type': 'text/plain; charset=utf-8' }); res.end(msg) }
+    const json = (code, body) => { res.writeHead(code, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(body)) }
+    if (pre) req.preBody = pre
+
+    if (url.pathname === '/healthz') {
+      res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' })
+      return res.end(JSON.stringify(health()))
+    }
+    // How busy and how big each loaded room is, and the machine: for the accounts API and operators, with the relay secret.
+    if (url.pathname === '/stats') {
+      if (!cfg.relayApiSecret) return text(404, 'not found')
+      if (!fromApi(req)) return json(401, { error: 'only the accounts API may ask this' })
+      return json(200, stats())
+    }
+    // GitHub said a branch moved (the API checked GitHub's signature; src/api/routes/github.js). Each
+    // session following that branch looks now: its folders fetch at once, and the relay brings the
+    // commits in itself where no folder can. Only a hint: everyone reads the truth from git.
+    if (url.pathname === '/github/push' && req.method === 'POST') {
+      const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+      const want = cfg.relayApiSecret || ''
+      const same = want && auth.length === want.length && crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(want))
+      if (!same) return json(401, { error: 'only the accounts API may say this' })
+      return readJson(req, 16 * 1024, (err, b) => {
+        if (err || !b || typeof b.repo !== 'string' || typeof b.ref !== 'string') return json(400, { error: 'give repo and ref' })
+        let told = 0
+        for (const room of rooms.values()) if (room.notePush && room.notePush({ repo: b.repo, ref: b.ref, sha: typeof b.sha === 'string' ? b.sha : '', after: typeof b.after === 'string' ? b.after : '', before: typeof b.before === 'string' ? b.before : '', forced: b.forced === true, deleted: b.deleted === true, created: b.created === true })) told++
+        json(200, { ok: true, rooms: told })
+      })
+    }
+    // A check suite finished on GitHub (the API relays the webhook): every session following that repository looks at the pull requests its tasks are in.
+    if (url.pathname === '/github/checks' && req.method === 'POST') {
+      const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+      const want = cfg.relayApiSecret || ''
+      const same = want && auth.length === want.length && crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(want))
+      if (!same) return json(401, { error: 'only the accounts API may say this' })
+      return readJson(req, 16 * 1024, (err, b) => {
+        if (err || !b || typeof b.repo !== 'string') return json(400, { error: 'give repo' })
+        let told = 0
+        for (const room of rooms.values()) if (room.noteChecks && room.noteChecks({ repo: b.repo, sha: typeof b.sha === 'string' ? b.sha : '', branch: typeof b.branch === 'string' ? b.branch : '', conclusion: typeof b.conclusion === 'string' ? b.conclusion : '' })) told++
+        json(200, { ok: true, rooms: told })
+      })
+    }
+    // A pull request changed on GitHub (the API relays the webhook): every session following that repository looks at the pull requests its tasks are in now.
+    if (url.pathname === '/github/pull' && req.method === 'POST') {
+      const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+      const want = cfg.relayApiSecret || ''
+      const same = want && auth.length === want.length && crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(want))
+      if (!same) return json(401, { error: 'only the accounts API may say this' })
+      return readJson(req, 16 * 1024, (err, b) => {
+        if (err || !b || typeof b.repo !== 'string' || !Number.isInteger(b.number)) return json(400, { error: 'give repo and number' })
+        let told = 0
+        for (const room of rooms.values()) if (room.notePull && room.notePull({ repo: b.repo, number: b.number, action: typeof b.action === 'string' ? b.action : '', merged: b.merged === true, head: typeof b.head === 'string' ? b.head : '', base: typeof b.base === 'string' ? b.base : '', sha: typeof b.sha === 'string' ? b.sha : '' })) told++
+        json(200, { ok: true, rooms: told })
+      })
+    }
+    // An org or workspace changed what agents may commit (the accounts API): every open session asks again now.
+    if (url.pathname === '/github/policy' && req.method === 'POST') {
+      const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+      const want = cfg.relayApiSecret || ''
+      const same = want && auth.length === want.length && crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(want))
+      if (!same) return json(401, { error: 'only the accounts API may say this' })
+      for (const room of rooms.values()) room.refreshPolicy()
+      return json(200, { ok: true, rooms: rooms.size })
+    }
+    // Someone connected GitHub (the API's callback): every session they are in checks its repository again now.
+    if (url.pathname === '/github/connected' && req.method === 'POST') {
+      const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+      const want = cfg.relayApiSecret || ''
+      const same = want && auth.length === want.length && crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(want))
+      if (!same) return json(401, { error: 'only the accounts API may say this' })
+      return readJson(req, 4 * 1024, (err, b) => {
+        if (err || !b || !/^person:[A-Za-z0-9_-]{1,64}$/.test(String(b.account || ''))) return json(400, { error: 'give the account' })
+        let n = 0
+        for (const room of rooms.values()) {
+          if (!room.meta || (room.meta.ownerSub !== b.account && !(room.meta.members && room.meta.members[b.account]))) continue
+          room.noteConnections({ force: true }); n++
+        }
+        json(200, { ok: true, rooms: n })
+      })
+    }
+    // Moving a room between machines (the accounts API runs it, src/api/relay-cluster.js): the source
+    // lets it go, the target copies it from the source, the source forgets its copy (or takes it back).
+    const cm = url.pathname.match(/^\/cluster\/rooms\/([A-Za-z0-9_-]{1,64})\/(release|export|fetch|forget|restore)$/)
+    if (cm) {
+      if (!cluster || !dataDir) return text(404, 'not found')
+      if (!fromApi(req)) return json(401, { error: 'only the accounts API may ask this' })
+      const [, name, action] = cm
+      if (action === 'export') {
+        if (req.method !== 'GET') return text(405, 'method not allowed')
+        if (!cluster.moving.has(name)) return json(409, { error: `${name} is not being moved off this machine` })
+        res.writeHead(200, { 'content-type': 'application/octet-stream', 'cache-control': 'no-store' })
+        return packRoom(dataDir, name, { hosted: hostedRecordsOf(name) }, res).then((r) => log(`cluster: sent ${name} (${r.files} files, ${r.bytes} bytes)`)).catch((err) => { log(`cluster: could not send ${name}: ${err.message}`); res.destroy() })
+      }
+      if (req.method !== 'POST') return text(405, 'method not allowed')
+      return readJson(req, 4096, (err, b) => {
+        if (err) return json(400, { error: err.message })
+        if (action === 'release') { letRoomGo(name); return json(200, { ok: true }) }
+        if (action === 'restore') { cluster.restore(name); log(`cluster: ${name} stays on this machine`); return json(200, { ok: true }) }
+        if (action === 'forget') { forgetRoomHere(name, String((b && b.to) || '')); return json(200, { ok: true }) }
+        // fetch
+        const from = String((b && b.from) || '')
+        if (!/^[A-Za-z0-9_-]{1,64}$/.test(from) || from === cluster.machineId) return json(400, { error: 'give the machine to copy from' })
+        if (rooms.has(name) || cluster.holds(name)) return json(409, { error: `${name} is on this machine already` })
+        const stage = path.join(dataDir, '.incoming', name)
+        cluster.fromPeer(from, `/cluster/rooms/${name}/export`)
+          .then((stream) => unpackRoom(stream, name, stage))
+          .then((got) => {
+            placeStaged(dataDir, name, stage)
+            takeHostedRecords(name, got.extras && got.extras.hosted)
+            cluster.elsewhere.delete(name)
+            log(`cluster: took ${name} from ${from} (${got.files} files, ${got.bytes} bytes)`)
+            json(200, { ok: true, files: got.files, bytes: got.bytes })
+          })
+          .catch((e) => {
+            fs.rmSync(stage, { recursive: true, force: true })
+            log(`cluster: could not take ${name} from ${from}: ${e.message}`)
+            json(502, { error: e.message })
+          })
+      })
+    }
+    if (url.pathname === '/logo.svg') {
+      res.writeHead(200, { 'content-type': 'image/svg+xml', 'cache-control': 'public, max-age=86400' })
+      return res.end(fs.readFileSync(LOGO))
+    }
+    const j = url.pathname.match(/^\/join\/([A-Za-z0-9_-]{1,64})\/?$/)
+    if (j) {
+      // Invites live on the website now. Browsers keep the #secret across the redirect.
+      res.writeHead(302, { location: `https://${JOIN_HOST}/${j[1]}`, 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' })
+      return res.end()
+    }
+    if (url.pathname === '/agent/link' && req.method === 'POST') {
+      const pass = httpPass(req)
+      if (!pass) return text(401, SIGN_IN)
+      return readJson(req, 4096, (err, body) => {
+        if (err) return text(400, err.message)
+        const { token, room: roomName, secret, name, tool } = body || {}
+        if (!TOKEN_RE.test(String(token)) || !ROOM_RE.test(String(roomName)) || typeof name !== 'string' || !name.trim()) return text(400, 'bad link')
+        if (pass.room && pass.room !== roomName) return text(401, SIGN_IN)
+        if (roomEnded(roomName)) return text(410, ENDED_MESSAGE)
+        const room = getRoom(roomName)
+        if (!room) return text(...refused(roomName))
+        if (!room.exists || room.authorize(String(secret || ''), '') !== 'editor') { dropIfUnused(room); return text(403, 'wrong room secret') }
+        if (!room.conns.size) room.onEmpty && room.onEmpty()
+        const k = tokenKey(token)
+        const prev = links.get(k) || {}
+        links.set(k, { room: roomName, name: (pass.name || name).trim().slice(0, 60), tool: String(tool || '').slice(0, 40), tabSeenAt: Date.now(), aiSeenAt: prev.aiSeenAt || 0 })
+        saveLinks()
+        res.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' })
+        res.end(JSON.stringify({ ok: true, aiSeenAt: prev.aiSeenAt || 0 }))
+      })
+    }
+    // Agents' folders use git through the relay (relay-githttp.js, plan §9): clone, fetch and push a session's
+    // branches at /git/<room>.git, signed in with the member's Quilt pass (git's password; quilt git-credential).
+    const gm = url.pathname.match(/^\/git\/([A-Za-z0-9_-]{1,64})\.git(\/info\/refs|\/git-upload-pack|\/git-receive-pack)$/)
+    if (gm) {
+      if (!cfg.gitSync || !passKey || !dataDir) return text(404, 'this relay serves no git')
+      const name = gm[1]
+      const basic = /^Basic\s+([A-Za-z0-9+/=]+)$/i.exec(String(req.headers.authorization || ''))
+      const decoded = basic ? Buffer.from(basic[1], 'base64').toString('utf8') : ''
+      const pass = decoded ? verifyPass(decoded.slice(decoded.indexOf(':') + 1), passKey) : null
+      if (!pass || (pass.room && pass.room !== name)) { res.writeHead(401, { 'www-authenticate': 'Basic realm="Quilt"', 'content-type': 'text/plain' }); return res.end('Sign in with your Quilt pass: git asks Quilt for it (quilt git-credential).\n') }
+      const room = rooms.get(name) || getRoom(name)
+      if (!room || !room.exists || room.ended) return text(404, 'no such session')
+      if (!room.letIn(pass)) return text(403, NOT_LET_IN)
+      const service = gm[2] === '/info/refs' ? url.searchParams.get('service') : gm[2].slice(1)
+      if (service === 'git-receive-pack') { const a = room.httpAccess(pass); if (a && a.role === 'viewer') return text(403, 'you can only view this session, so you can\'t push') }
+      const def = viewRepoOf(room)
+      if (!def) { log(`[${name}] git over http: no GitHub repository (default ${room.defaultKey}: ${JSON.stringify(upstreamsOf(room)[room.defaultKey] || null)})`); return text(404, 'this session follows no GitHub repository') }
+      const repo = parseRepo(`https://${def.repo}`)
+      ;(async () => {
+        const m = await room.mirrors.ensure(repo, { url: room.gitRemoteUrl(repo) })
+        if (!(await runGit(m.dir, ['rev-parse', '--verify', '-q', `refs/remotes/origin/${def.ref}`])).out.trim()) await room.mirrors.fetch(m.dir, def.ref, { token: await room.gitToken(repo, { access: 'read' }) }).catch(() => {})
+        const dir = await ensureView(dataDir, name, m.dir)
+        await syncViewRefs(room, dir, def.repo)
+        serveGit(req, res, { root: path.dirname(dir), pathInfo: `/${name}.git${gm[2]}`, query: url.search.slice(1), env: { QUILT_HOOK_URL: `http://127.0.0.1:${httpServer.address().port}/git-hook`, QUILT_HOOK_TOKEN: hookToken, QUILT_ROOM: name, QUILT_WHO: `${pass.kind}:${pass.sub}`, QUILT_WHO_NAME: String(pass.name || '') } })
+      })().catch((err) => { log(`[${name}] git over http: ${err.message}`); if (!res.headersSent) text(500, 'the relay could not serve git right now') })
+      return
+    }
+    // A push into a session's git view asks here, from git's hook on this machine (relay-githttp.js, git-hook.js).
+    if (url.pathname === '/git-hook' && req.method === 'POST') {
+      const auth = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+      if (auth.length !== hookToken.length || !crypto.timingSafeEqual(Buffer.from(auth), Buffer.from(hookToken))) return json(401, { ok: false, message: 'Quilt: not this relay\'s push' })
+      return readJson(req, 1024 * 1024, async (err, b) => {
+        try {
+          if (err || !b || typeof b.room !== 'string') return json(400, { ok: false, message: 'Quilt: a malformed push' })
+          const room = rooms.get(b.room) || getRoom(b.room)
+          if (!room || !room.exists) return json(404, { ok: false, message: 'Quilt: no such session' })
+          const updates = parseUpdates(b.updates)
+          if (b.phase === 'post') {
+            // The view's branches go back to what GitHub has (the push may have been replayed onto a newer head).
+            const published = (room.viewPublished && room.viewPublished.get(String(b.who))) || new Map()
+            const dir = viewDir(dataDir, b.room)
+            for (const u of updates) { const sha = published.get(u.ref); if (sha) await runGit(dir, ['update-ref', u.ref, sha]) }
+            const def = viewRepoOf(room)
+            if (def) await syncViewRefs(room, dir, def.repo)
+            return json(200, { ok: true })
+          }
+          const r = await receiveAgentPush(room, { who: String(b.who || ''), name: String(b.name || ''), updates, env: b.env || {} }, { log })
+          if (r.ok) { if (!room.viewPublished) room.viewPublished = new Map(); room.viewPublished.set(String(b.who), r.published) }
+          return json(200, { ok: r.ok, message: r.message })
+        } catch (e) { log(`[${b && b.room}] git push: ${e.message}`); return json(500, { ok: false, message: `Quilt: the relay couldn't take the push (${e.message})` }) }
+      })
+    }
+    if (url.pathname === '/mcp') {
+      // Hosted agents (and anyone with a pass): session tools over HTTP, no app needed.
+      if (!passKey) return text(404, 'this relay has sign-in off; hosted agents need it on')
+      const pass = httpPass(req)
+      if (!pass) return text(401, SIGN_IN)
+      const workspaces = features && features.on() && pass.kind === 'agent' ? { apiUrl: cfg.apiUrl, pass: String(req.headers['x-quilt-pass']), fetch: apiFetch } : null
+      let parsed
+      if (pre) { try { parsed = JSON.parse(pre.toString('utf8')) } catch { return json(400, { jsonrpc: '2.0', error: { code: -32700, message: 'Parse error' }, id: null }) } }
+      const account = `${pass.kind}:${pass.sub}`
+      // On many machines: the agent's sessions everywhere, and its webhook, from the accounts API.
+      const shared = cluster
+        ? cluster.hostedOf(account).then((idx) => {
+          if (!idx) return {}
+          applySharedWebhook(account, idx.webhook)
+          return { index: { rooms: [...idx.rooms] }, noteHosted: (o) => cluster.hostedRoom(account, o), shareWebhook: (w) => cluster.hostedWebhook(account, w || null) }
+        })
+        : Promise.resolve({})
+      return shared.then((more) => handleHostedMcp({ req, res, pass, workspaces, body: parsed, relay: { getRoom, roomEnded, refused, hosted, saveHosted, webhooks, log, endedMessage: ENDED_MESSAGE, updates, visitStart: hostedVisitStart, visitEnd: hostedVisitEnd, ...more } })
+        // Its first session on this machine: the webhook it set elsewhere applies here too.
+        .then(() => { if (more.index && cluster.hosted.get(account)) applySharedWebhook(account, cluster.hosted.get(account).webhook) }))
+        .catch((err) => { log(`mcp error: ${err.message}`); if (!res.headersSent) text(500, 'mcp error') })
+    }
+    const mm = url.pathname.match(/^\/mcp\/([A-Za-z0-9_-]{20,64})$/)
+    if (mm) {
+      // An AI link carries no pass, so with sign-in on it would get into a session without one.
+      // Agents join as their own members now; links saved before that stop working here.
+      if (passKey) return text(401, SIGN_IN)
+      const k = tokenKey(mm[1])
+      const link = links.get(k) || null
+      let room = null
+      if (link) {
+        room = getRoom(link.room)
+        if (!room) return text(...refused(link.room))
+        if (!room.exists) { dropIfUnused(room); room = null } else {
+          link.aiSeenAt = Date.now()
+          saveLinks()
+        }
+      }
+      handleAgentMcp({ req, res, room, link: room ? link : null, toolHint: url.searchParams.get('tool') || '', updates })
+        .catch((err) => { log(`mcp error: ${err.message}`); if (!res.headersSent) text(500, 'mcp error') })
+        .finally(() => { if (room && !room.conns.size && room.onEmpty) room.onEmpty() })
+      return
+    }
+    // Chat links: GET pages a chat-only AI opens to read and talk (chat-links.js).
+    if (url.pathname.startsWith('/c/') && handleChatLink(req, res, url, { getRoom, roomEnded, refused, dropIfUnused, endedMessage: ENDED_MESSAGE, fetchFile: opts.chatFetch || ((u) => fetchPublicFile(u)) })) return
+    const bm = url.pathname.match(/^\/blobs\/([A-Za-z0-9_-]{1,64})\/([a-f0-9]{32})\/(upload|download|data)$/)
+    if (bm) {
+      const [, name, id, action] = bm
+      if (roomEnded(name)) return text(410, ENDED_MESSAGE)
+      if (action === 'data') {
+        // The disk store's signed links: no secret needed, the signature is the permission.
+        if (!(store instanceof DiskStore)) return text(404, 'not found')
+        const method = req.method === 'PUT' ? 'PUT' : 'GET'
+        const n = url.searchParams.get('n')
+        if (url.searchParams.get('m') !== method || !store.verify(name, id, method, url.searchParams.get('exp'), url.searchParams.get('sig'), method === 'PUT' ? Number(n) : undefined)) return text(403, 'this link has expired')
+        const file = store.file(name, id)
+        if (method === 'GET') return streamFile(res, file, text)
+        return receiveBlob(req, file, Number(n), (err) => err ? text(err.code || 500, err.message) : text(201, 'stored'))
+      }
+      if (req.method !== 'POST') return text(405, 'method not allowed')
+      const pass = httpPass(req, name)
+      if (!pass) return text(401, SIGN_IN)
+      const starter = starterOf(pass, req)
+      const room = getRoom(name)
+      if (!room) return text(...refused(name))
+      const creating = !room.exists
+      if (creating && !canCreate(starter)) { dropIfUnused(room); return text(429, TOO_MANY) }
+      const auth = room.authorize(req.headers['x-quilt-secret'] || '', req.headers['x-quilt-key'] || '')
+      if (auth === 'need-key' || auth === 'bad-secret') {
+        dropIfUnused(room)
+        return text(auth === 'need-key' ? 403 : 401, auth === 'need-key' ? 'this relay needs a key to create rooms' : 'wrong room secret')
+      }
+      if (creating) noteCreated(starter)
+      const done = () => { if (!room.conns.size && room.onEmpty) room.onEmpty() }
+      if (passKey && !room.letIn(pass)) { done(); return text(403, NOT_LET_IN) }
+      return readJson(req, 1024, async (err, body) => {
+        try {
+          if (err) return text(400, err.message)
+          room.meta.blobs = room.meta.blobs || {}
+          if (action === 'download') {
+            if (!room.meta.blobs[id]) return text(404, 'no such file')
+            return json(200, await store.downloadTarget(name, id))
+          }
+          // The room secret and, with sign-in on, the person's own access: a view-only grant
+          // with the edit link may not use up the room's storage.
+          if (auth !== 'editor' || (passKey && room.httpAccess(pass)?.role === 'viewer')) return text(403, 'you can only view this session')
+          const size = Number(body && body.size)
+          if (!(size >= 0)) return text(400, 'size required')
+          if (size > cfg.maxStoredFileBytes) return text(413, `files over ${Math.round(cfg.maxStoredFileBytes / MB)} MB can't be shared`)
+          const others = storedBytes(room) - (room.meta.blobs[id]?.size || 0)
+          if (others + size + dirSize(path.join(filesDir, name)) > cfg.maxRoomFileBytes) return text(413, 'this room has used its file storage quota')
+          room.meta.blobs[id] = { size, ts: Date.now() }
+          room.startLargeFiles()
+          room.saveMeta()
+          json(200, await store.uploadTarget(name, id, size))
+        } catch (e) {
+          log(`[${name}] storage error: ${e.message}`)
+          if (!res.headersSent) text(502, 'file storage is unavailable right now')
+        } finally { done() }
+      })
+    }
+    const m = url.pathname.match(/^\/files\/([A-Za-z0-9_-]{1,64})(?:\/([a-f0-9]{32}))?$/)
+    if (!m) return text(404, 'not found')
+
+    const [, name, id] = m
+    if (roomEnded(name)) return text(410, ENDED_MESSAGE)
+    const pass = httpPass(req, name)
+    if (!pass) return text(401, SIGN_IN)
+    const starter = starterOf(pass, req)
+    const room = getRoom(name)
+    if (!room) return text(...refused(name))
+    const creating = !room.exists
+    if (creating && !canCreate(starter)) { dropIfUnused(room); return text(429, TOO_MANY) }
+    const auth = room.authorize(req.headers['x-quilt-secret'] || req.headers['x-cowove-secret'] || '', req.headers['x-quilt-key'] || req.headers['x-cowove-key'] || '')
+    if (creating && auth !== 'need-key' && auth !== 'bad-secret') noteCreated(starter)
+    if (auth === 'need-key' || auth === 'bad-secret') {
+      dropIfUnused(room)
+      return text(auth === 'need-key' ? 403 : 401, auth === 'need-key' ? 'this relay needs a key to create rooms' : 'wrong room secret')
+    }
+    if (passKey && !room.letIn(pass)) {
+      if (!room.conns.size && room.onEmpty) room.onEmpty()
+      return text(403, NOT_LET_IN)
+    }
+    const dir = path.join(filesDir, name)
+    if (req.method === 'POST' && !id) {
+      // A chat file is a post: someone who may not post may not send one.
+      if (passKey && room.httpAccess(pass)?.talk === false) {
+        if (!room.conns.size && room.onEmpty) room.onEmpty()
+        return text(403, TALK_REFUSED)
+      }
+      // Chat files and stored large files share one quota.
+      const used = dirSize(dir) + storedBytes(room)
+      const incoming = Number(req.headers['content-length'] || 0)
+      if (used + incoming > cfg.maxRoomFileBytes) return text(413, 'this room has used its file storage quota')
+      return receiveFile(req, dir, cfg.maxRoomFileBytes - used, (err, newId) => err ? text(err.code || 500, err.message) : text(201, newId))
+    }
+    if (req.method === 'GET' && id) return streamFile(res, path.join(dir, id), text)
+    text(405, 'method not allowed')
+  }
+  // One message can't be bigger than a whole room may be.
+  const wss = new WebSocketServer({ noServer: true, maxPayload: Math.max(MB, Math.min(64 * MB, cfg.maxRoomBytes)) })
+
+  httpServer.on('upgrade', (req, socket, head) => {
+    if (!cluster) return upgrade(req, socket, head)
+    // On many machines, the room's machine takes the connection: Fly's proxy replays it there.
+    let name
+    try { name = decodeURIComponent(new URL(req.url, 'http://x').pathname.slice(1)) } catch { return reject(socket, 400, 'Bad room name') }
+    if (!ROOM_RE.test(name)) return reject(socket, 400, 'Bad room name')
+    socket.on('error', () => {})
+    let passGiven = ''
+    try { passGiven = String(req.headers['x-quilt-pass'] || new URL(req.url, 'http://x').searchParams.get('pass') || '') } catch {}
+    whereTo(name, req, passGiven).then((w) => {
+      if (w.here) return upgrade(req, socket, head)
+      if (w.none) return reject(socket, 401, SIGN_IN)
+      if (w.machine) {
+        socket.write(`HTTP/1.1 409 Conflict\r\nfly-replay: instance=${w.machine}\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: ${Buffer.byteLength(ELSEWHERE)}\r\nConnection: close\r\n\r\n${ELSEWHERE}`)
+        return socket.destroy()
+      }
+      reject(socket, 503, w.moving ? MOVING : w.error || ELSEWHERE)
+    }).catch((err) => { log(`cluster: routing a connection to ${name}: ${err.message}`); reject(socket, 500, 'The relay could not route this connection') })
+  })
+  function upgrade (req, socket, head) {
+    let url, name
+    try {
+      url = new URL(req.url, 'http://x')
+      name = decodeURIComponent(url.pathname.slice(1))
+    } catch {
+      return reject(socket, 400, 'Bad room name')
+    }
+    // Secrets come in headers, which proxies don't log; the query string is only still read
+    // for clients from before 0.3.2, and goes away in the release after. Never log req.url.
+    const header = (n) => (req.headers[n] === undefined ? '' : String(req.headers[n]))
+    const secret = header('x-quilt-secret') || url.searchParams.get('secret') || ''
+    const publicKey = url.searchParams.get('key') || ''
+    const relayKey = header('x-quilt-key') || header('x-cowove-key') || url.searchParams.get('relayKey') || ''
+    const viewSecret = header('x-quilt-view-secret') || url.searchParams.get('viewSecret') || ''
+    if (!ROOM_RE.test(name)) return reject(socket, 400, 'Bad room name')
+    // With sign-in on, nobody gets further without a pass, and who they are comes from it.
+    const pass = passKey ? verifyPass(header('x-quilt-pass') || url.searchParams.get('pass') || '', passKey) : null
+    if (passKey && (!pass || pass.key !== publicKey || (pass.room && pass.room !== name))) return reject(socket, 401, SIGN_IN)
+    const person = pass ? pass.name : (url.searchParams.get('name') || '').trim()
+    const kind = pass ? (pass.kind === 'agent' ? 'agent' : 'human') : (url.searchParams.get('kind') === 'agent' ? 'agent' : 'human')
+    // People and agents come from different id spaces, so the kind is part of who they are.
+    const account = pass ? `${pass.kind}:${pass.sub}` : ''
+    // Checked before the room is touched: a room's creator is recorded by this key (see authorize).
+    if (!publicKey) return reject(socket, 400, 'This relay needs a newer quilt; please update')
+    const key = parsePublicKey(publicKey)
+    if (!person || person.length > MAX_NAME || !key) return reject(socket, 400, 'Bad name or identity key')
+    // Every session keeps its files in branch documents: an app that can't sync them is told to update.
+    const features = String(url.searchParams.get('features') || '').split(',')
+    if (!features.includes('branches')) return reject(socket, 400, NEEDS_UPDATE)
+    if (roomEnded(name)) return reject(socket, 410, ENDED_MESSAGE)
+    const ip = clientIp(req)
+    const starter = pass ? account : ip
+    if ((ipConns.get(ip) || 0) >= cfg.maxConnsPerIp) return reject(socket, 429, 'Too many connections')
+    const room = getRoom(name)
+    if (!room) return reject(socket, ...refused(name))
+    const creating = !room.exists
+    if (creating && !canCreate(starter)) { dropIfUnused(room); return reject(socket, 429, 'Too many new sessions') }
+    const auth = room.authorize(secret, relayKey, viewSecret, publicKey)
+    if (creating && auth !== 'need-key' && auth !== 'bad-secret') noteCreated(starter)
+    if (auth === 'need-key' || auth === 'bad-secret') {
+      dropIfUnused(room)
+      return reject(socket, auth === 'need-key' ? 403 : 401, auth === 'need-key' ? 'Relay key required to create rooms' : 'Wrong room secret')
+    }
+    // Checked after the secret, so only members learn what the session needs.
+    if (room.meta.largeFiles && !features.includes('large-files')) {
+      if (!room.conns.size && room.onEmpty) room.onEmpty() // don't keep it in memory for nobody
+      return reject(socket, 400, NEEDS_UPDATE)
+    }
+    if (!pass && !room.keyMatches(person, publicKey)) return reject(socket, 403, nameTaken(person))
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      // A frame over maxPayload or a reset mid-frame is this socket's problem, not
+      // the relay's: ws closes the socket itself once the error has a listener.
+      ws.on('error', (err) => log(`[${name}] dropping ${person}: ${err.message}`))
+      ws.roomName = name
+      ws.features = features
+      // Which app or AI tool this is ("Quilt app", "Cursor"), for the audit trail; the app says so if it knows.
+      ws.tool = header('x-quilt-tool').replace(/[^\w .()/+-]/g, '').trim().slice(0, 40)
+      if (pass) { ws.passKey = passKey; trackPass(ws, pass) }
+      ipConns.set(ip, (ipConns.get(ip) || 0) + 1)
+      ws.isAlive = true
+      ws.on('pong', () => { ws.isAlive = true })
+      ws.on('close', () => {
+        clearTimeout(ws.passTimer)
+        const n = (ipConns.get(ip) || 1) - 1
+        if (n) ipConns.set(ip, n)
+        else ipConns.delete(ip)
+      })
+      room.admit(ws, person, publicKey, key, { kind, invitedAs: auth, account }, () => {
+        log(`[${name}] ${person} connected (${room.conns.size} online)`)
+        ws.on('close', () => log(`[${name}] ${person} left (${room.conns.size} online)`))
+        if (room.full) log(`[${name}] ${person} joined while over quota (read-only)`)
+      })
+    })
+  }
+
+  // Many machines: hello now (the rooms on this disk), then this machine's minute for the accounts API.
+  let reportTicker = null
+  if (cluster) {
+    cluster.start({
+      onDisplaced: (names) => {
+        for (const name of names) {
+          if (rooms.has(name)) continue
+          try { log(`cluster: ${name} is placed on another machine; its copy here was moved to ${displaceRoom(dataDir, name)}`) } catch (err) { log(`cluster: could not move ${name} aside: ${err.message}`) }
+        }
+      }
+    })
+    reportTicker = setInterval(() => {
+      cluster.report(machineStats(), [...rooms.values()].filter((r) => !r.ended).map(roomStats)).catch((err) => log(`cluster: could not report this machine's minute: ${err.message}`))
+      // Hosted agents in loaded rooms: a webhook set or removed on another machine reaches this one within a minute.
+      let n = 0
+      for (const [id, h] of hosted) if (n < 200 && h.rooms && Object.keys(h.rooms).some((r) => rooms.has(r))) { n++; syncHosted(id) }
+    }, cc.reportMs)
+    reportTicker.unref()
+  }
+
+  const heartbeat = setInterval(() => {
+    for (const ws of wss.clients) {
+      if (!ws.isAlive) { ws.endReason = 'disconnected'; ws.terminate(); continue }
+      ws.isAlive = false
+      ws.ping()
+    }
+    for (const room of rooms.values()) if (!room.ended) { room.sweepClaims(); room.sweepBoxes() }
+    if (sweepHosted) sweepHosted()
+  }, 30000)
+
+  // Delete rooms nobody has opened for a while (hosted relays shouldn't grow forever).
+  const sweep = () => {
+    mirrors.prune()
+    if (!dataDir || !cfg.roomTtlDays) return
+    const cutoff = Date.now() - cfg.roomTtlDays * DAY
+    let removed = 0
+    for (const f of fs.readdirSync(dataDir)) {
+      if (!f.endsWith('.json')) continue
+      const name = f.slice(0, -5)
+      if (!ROOM_RE.test(name) || NOT_ROOMS.has(name)) continue
+      if (rooms.has(name)) continue
+      let meta
+      try {
+        meta = JSON.parse(fs.readFileSync(path.join(dataDir, f), 'utf8'))
+      } catch (err) {
+        // Never delete what can't be read: it may be a session cut off mid-write, for the operator to repair.
+        log(`[${name}] could not read its metadata (${err.message}); leaving it alone`)
+        continue
+      }
+      if ((meta.lastActive || meta.createdAt || 0) > cutoff) continue
+      if (cluster && cluster.moving.has(name)) continue
+      removeRoomData(name)
+      if (cluster) cluster.forgetPlacement(name)
+      removed++
+    }
+    if (removed) log(`removed ${removed} room(s) idle for more than ${cfg.roomTtlDays} days`)
+  }
+  sweep()
+  const sweeper = setInterval(sweep, 6 * 60 * 60 * 1000)
+  sweeper.unref()
+  // Branches only hosted agents work on, with no folder online: the relay looks for new commits on GitHub itself.
+  const upstreamTicker = cfg.upstreamAuto && cfg.upstreamCheckMs > 0
+    ? setInterval(() => { for (const room of rooms.values()) if (!room.ended) { room.checkUpstreams().catch((err) => log(`[${room.name}] could not look for new commits: ${err.message}`)); room.reviewClashTick().catch((err) => log(`[${room.name}] could not look at the clashes: ${err.message}`)) } }, Math.min(cfg.gitSync ? 20 * 1000 : 60 * 1000, cfg.upstreamCheckMs)) // with the mirror, often enough that each branch's minute look isn't a tick late
+    : null
+  upstreamTicker?.unref()
+  // Live-sync leases renewed, and let go of for sessions that ended or sat idle for a day (relay-lease.js).
+  const leaseTicker = cfg.gitSync ? setInterval(() => {
+    leases.tick({ ended: (name) => { const r = rooms.get(name); return !!(r && r.ended) } }).then((lost) => {
+      for (const l of lost) { const r = rooms.get(l.room); if (r && !r.ended) { r.log(`[${r.name}] lost the live-sync lease of ${l.branch} to ${l.to || 'nobody (lapsed)'}`); r.broadcastBranches() } }
+    }).catch((err) => log(`lease tick: ${err.message}`))
+  }, cfg.leaseHeartbeatMs || LEASE_HEARTBEAT_MS) : null
+  leaseTicker?.unref()
+  // Agents with work not in git on GitHub are reminded to commit it (relay-commit.js), about every ten minutes.
+  const remindTicker = cfg.upstreamAuto
+    ? setInterval(() => {
+      for (const room of rooms.values()) {
+        if (room.ended) continue
+        for (const key of new Set([...Object.keys(upstreamsOf(room)), ...Object.keys(room.meta.branches || {})].map((k) => room.resolveKey(k)))) remindUnpublished(room, key, { fetch: room.githubFetch }).catch((err) => log(`[${room.name}] ${key}: could not remind about uncommitted work: ${err.message}`))
+        reviewPulls(room, { fetch: room.githubFetch, log }).catch((err) => log(`[${room.name}] could not look at the tasks' pull requests: ${err.message}`))
+      }
+    }, 10 * 60 * 1000)
+    : null
+  remindTicker?.unref()
+
+  return new Promise((resolve, reject) => {
+    httpServer.once('error', (err) => { clearInterval(heartbeat); clearInterval(sweeper); clearInterval(upstreamTicker); clearInterval(remindTicker); features?.stop(); reject(err) })
+    httpServer.listen(port, host, () => {
+      const actualPort = httpServer.address().port
+      resolve({
+        port: actualPort,
+        config: cfg,
+        rooms, // exposed for tests
+        loadRoom: (name) => getRoom(name), // tests: a room from its disk, with nobody connected
+        store, // exposed for tests
+        presence, // exposed for tests
+        hosted, // exposed for tests
+        mirrors, // the git mirrors (exposed for tests)
+        leases, // the live-sync leases (exposed for tests)
+        sweepHosted: () => sweepHosted && sweepHosted(), // exposed for tests: ends quiet hosted agents' visits now
+        features, // exposed for tests
+        sweep,
+        // exposed for tests: the relay's look at GitHub for a loaded room now ({ force }: every branch it looks after, not only those due)
+        checkUpstreams: (name, o) => { const room = rooms.get(name); return room ? room.checkUpstreams(o) : Promise.resolve([]) },
+        cluster, // exposed for tests
+        close: async () => {
+          clearInterval(reportTicker)
+          if (cluster) cluster.stop()
+          clearInterval(leaseTicker)
+          clearInterval(heartbeat)
+          clearInterval(sweeper)
+          clearInterval(upstreamTicker)
+          clearInterval(remindTicker)
+          features?.stop()
+          updates.stop()
+          // A join or a denial in the last moments before a deploy is kept.
+          if (hostedTimer) { clearTimeout(hostedTimer); writeHosted() }
+          // Rooms are saved first, synchronously: Fly's kill timeout is about as long as
+          // presence gets to reach the accounts API, so a hung or slow API must never be
+          // able to delay saving a room's data.
+          for (const ws of wss.clients) { ws.endReason = 'relay_restart'; ws.terminate() }
+          for (const room of rooms.values()) room.destroy()
+          rooms.clear()
+          wss.close()
+          // Every open visit ends now (even ones no `leave` got to yet), and the queue
+          // gets one last, bounded try at the accounts API.
+          if (presence) await presence.close()
+          // An upload or download still in flight would otherwise hold close() open forever.
+          const closed = new Promise((resolve) => httpServer.close(() => resolve()))
+          httpServer.closeAllConnections()
+          await closed
+        }
+      })
+    })
+  })
+}
+
+function dirSize (dir) {
+  let total = 0
+  try { for (const f of fs.readdirSync(dir)) total += fs.statSync(path.join(dir, f)).size } catch {}
+  return total
+}
+
+function readJson (req, limit, done) {
+  // Read already, to see which machine it is for (relay-cluster.js).
+  if (req.preBody) {
+    if (req.preBody.length > limit) return done(new Error('too large'))
+    try { return done(null, JSON.parse(req.preBody.toString('utf8'))) } catch { return done(new Error('bad json')) }
+  }
+  let size = 0
+  const chunks = []
+  req.on('data', (c) => {
+    size += c.length
+    if (size > limit) { req.destroy(); done(new Error('too large')) } else chunks.push(c)
+  })
+  req.on('end', () => {
+    if (size > limit) return
+    try { done(null, JSON.parse(Buffer.concat(chunks).toString('utf8'))) } catch { done(new Error('bad json')) }
+  })
+}
+
+function receiveFile (req, dir, room, done) {
+  const id = crypto.randomBytes(16).toString('hex')
+  const file = path.join(dir, id)
+  let out
+  try {
+    fs.mkdirSync(dir, { recursive: true })
+    out = fs.createWriteStream(file)
+  } catch { req.resume(); return done(Object.assign(new Error('could not save the file'), { code: 500 })) }
+  const limit = Math.min(MAX_SHARED_FILE_BYTES, room)
+  let size = 0
+  let failed = false
+  const fail = (code, message) => {
+    if (failed) return
+    failed = true
+    out.destroy()
+    fs.rm(file, { force: true }, () => {})
+    done(Object.assign(new Error(message), { code }))
+  }
+  req.on('data', (chunk) => {
+    size += chunk.length
+    if (size > limit) { fail(413, limit < MAX_SHARED_FILE_BYTES ? 'this room has used its file storage quota' : 'file too large'); req.destroy() }
+  })
+  req.on('error', () => fail(400, 'upload interrupted'))
+  req.pipe(out)
+  out.on('finish', () => { if (!failed) done(null, id) })
+  out.on('error', (err) => fail(500, err.message))
+}
+
+/**
+ * Sends a stored file. The file can vanish at any moment (the room ended, or
+ * the sweep ran), so every step copes with that instead of throwing.
+ */
+function streamFile (res, file, text) {
+  const rs = fs.createReadStream(file)
+  rs.on('error', (err) => {
+    if (!res.headersSent) text(err.code === 'ENOENT' || err.code === 'EISDIR' ? 404 : 500, 'no such file')
+    else res.destroy()
+  })
+  rs.on('open', (fd) => {
+    let size
+    try { size = fs.fstatSync(fd).size } catch { rs.destroy(); return text(404, 'no such file') }
+    res.writeHead(200, { 'content-type': 'application/octet-stream', 'content-length': size })
+    rs.pipe(res)
+  })
+}
+
+/**
+ * Streams a request body to `file`, refusing anything over `limit` bytes.
+ * Stored files are written once: their ids come from their content, so one
+ * that's already there is refused with 409 and left as it is.
+ */
+function receiveBlob (req, file, limit, done) {
+  let size = 0
+  let failed = false
+  let drained = 0
+  let out = null
+  let tmp = null
+  const fail = (code, message) => {
+    if (failed) return
+    failed = true
+    if (out) { req.unpipe(out); out.destroy() }
+    if (tmp) fs.rm(tmp, { force: true }, () => {})
+    // Read what's left so the reply gets through, but not forever.
+    req.resume()
+    done(Object.assign(new Error(message), { code }))
+  }
+  req.on('data', (chunk) => {
+    if (failed) { drained += chunk.length; if (drained > MB) req.destroy(); return }
+    size += chunk.length
+    if (size > limit) fail(413, 'file too large')
+  })
+  req.on('error', () => fail(400, 'upload interrupted'))
+  if (fs.existsSync(file)) return fail(409, 'already stored')
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true })
+    tmp = `${file}.${crypto.randomBytes(4).toString('hex')}.tmp`
+    out = fs.createWriteStream(tmp)
+  } catch { return fail(500, 'could not save the file') }
+  out.on('error', () => fail(500, 'could not save the file'))
+  out.on('finish', () => {
+    if (failed) return
+    // link, unlike rename, never replaces a file that's already there. It
+    // also fails if the room's folder is gone by now (it ended, or was swept).
+    try {
+      fs.linkSync(tmp, file)
+    } catch (err) {
+      return err.code === 'EEXIST' ? fail(409, 'already stored') : fail(500, 'could not save the file')
+    }
+    fs.rm(tmp, { force: true }, () => {})
+    done(null)
+  })
+  req.pipe(out)
+}
+
+const TOO_BIG = 'Session over the size limit'
+const UNREADABLE = "This session's data can't be read on the relay right now"
+const ENDED_MESSAGE = 'The owner ended this session'
+const NEEDS_UPDATE = 'This session needs a newer version of Quilt. Update Quilt, then join again.'
+const SIGN_IN = 'Update Quilt and sign in to continue'
+const NOT_LET_IN = "The session owner hasn't let you in yet."
+const PASS_EXPIRED = 'Your sign-in expired. Reconnecting.'
+
+function reject (socket, code, message) {
+  socket.write(`HTTP/1.1 ${code} ${message}\r\nConnection: close\r\n\r\n`)
+  socket.destroy()
+}
+
+/**
+ * Why a pass's holder may be in the room, as the accounts API signed it ({ kind: 'grant' },
+ * { kind: 'workspace', via, workspace }, { kind: 'org', workspace, org }), trimmed to that
+ * shape for the member list; null when it says nothing.
+ */
+function cleanFrom (from) {
+  if (!from || typeof from !== 'object' || !['grant', 'workspace', 'org'].includes(from.kind)) return null
+  const text = (v) => typeof v === 'string' ? v.slice(0, 80) : ''
+  return {
+    kind: from.kind,
+    ...(from.kind === 'workspace' && ['owner', 'member', 'placed', 'global'].includes(from.via) ? { via: from.via } : {}),
+    ...(from.kind !== 'grant' && text(from.workspace) ? { workspace: text(from.workspace) } : {}),
+    ...(from.kind === 'org' && text(from.org) ? { org: text(from.org) } : {})
+  }
+}