diff --git a/apps/spaces-demo-provider/README.md b/apps/spaces-demo-provider/README.md
index 5f121f0..12766e5 100644
--- a/apps/spaces-demo-provider/README.md
+++ b/apps/spaces-demo-provider/README.md
@@ -2,7 +2,9 @@
 
 Standalone Contrail Spaces-alpha provider at `https://spaces.atmo.garden` (`did:web:spaces.atmo.garden#spaces`).
 
-It indexes `garden.atmo.circle.note` and `garden.atmo.circle.reaction` from one deterministic `garden.atmo.circle/self` Space per owner. The managing-app policy allows the owner and reciprocal Bluesky followers. Policy failures deny access.
+It indexes `garden.atmo.circle.note`, `garden.atmo.circle.member`, and `garden.atmo.circle.reaction` from one deterministic `garden.atmo.circle/self` Space per owner. The managing-app policy allows the owner and DIDs in the Space's member collection. Only membership records signed in the authority's repo are projected, so members cannot grant access to others. Policy failures deny access.
+
+A hibernating Durable Object per Space fans out projection invalidations over one-time-ticket WebSockets. Events contain only the Space URI and timestamp; authorized clients refetch records through the private query API.
 
 ## Provision and deploy
 
@@ -33,4 +35,4 @@ curl https://spaces.atmo.garden/.well-known/did.json
 curl https://spaces.atmo.garden/.well-known/contrail-spaces-alpha
 ```
 
-The Worker initializes its extension-owned D1 schema idempotently. No separate migration command is needed for this first alpha schema.
+The Worker initializes its extension-owned D1 schema idempotently. No separate D1 migration command is needed for this first alpha schema. Wrangler applies the `SpaceSubscriptionHub` Durable Object migration declared in `wrangler.jsonc`.
diff --git a/apps/spaces-demo-provider/package.json b/apps/spaces-demo-provider/package.json
index a5e5f4b..c4402f1 100644
--- a/apps/spaces-demo-provider/package.json
+++ b/apps/spaces-demo-provider/package.json
@@ -6,6 +6,7 @@
   "scripts": {
     "dev": "wrangler dev",
     "deploy": "wrangler deploy",
+    "publish-lexicons": "tsx scripts/publish-lexicons.ts",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
@@ -14,6 +15,7 @@
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20260804.1",
+    "tsx": "^4.21.0",
     "typescript": "^6.0.3",
     "wrangler": "^4.118.0"
   }
diff --git a/apps/spaces-demo-provider/scripts/publish-lexicons.ts b/apps/spaces-demo-provider/scripts/publish-lexicons.ts
new file mode 100644
index 0000000..814613f
--- /dev/null
+++ b/apps/spaces-demo-provider/scripts/publish-lexicons.ts
@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+import { networkLexicons } from "../src/lexicons";
+
+const collection = "com.atproto.lexicon.schema";
+
+function required(name: string): string {
+  const value = process.env[name];
+  if (!value) throw new Error(`Missing ${name}`);
+  return value;
+}
+
+async function jsonRequest(
+  url: string | URL,
+  init?: RequestInit,
+): Promise<Record<string, unknown>> {
+  const response = await fetch(url, init);
+  if (!response.ok) {
+    throw new Error(`${url} failed (${response.status}): ${await response.text()}`);
+  }
+  return response.json() as Promise<Record<string, unknown>>;
+}
+
+function digest(value: unknown): string {
+  return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+
+const pds = required("LEXICON_AUTHORITY_PDS").replace(/\/$/, "");
+const identifier = required("LEXICON_AUTHORITY_IDENTIFIER");
+const password = required("LEXICON_AUTHORITY_PASSWORD");
+const expectedDid = process.env.LEXICON_AUTHORITY_DID;
+
+const session = await jsonRequest(`${pds}/xrpc/com.atproto.server.createSession`, {
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({ identifier, password }),
+});
+const accessJwt = String(session.accessJwt ?? "");
+const did = String(session.did ?? "");
+if (!accessJwt || !did.startsWith("did:")) throw new Error("Authority login returned no session");
+if (expectedDid && did !== expectedDid) {
+  throw new Error(`Authority DID mismatch: expected ${expectedDid}, received ${did}`);
+}
+
+for (const doc of networkLexicons) {
+  const existing = new URL(`${pds}/xrpc/com.atproto.repo.getRecord`);
+  existing.searchParams.set("repo", did);
+  existing.searchParams.set("collection", collection);
+  existing.searchParams.set("rkey", doc.id);
+  const current = await fetch(existing, {
+    headers: { authorization: `Bearer ${accessJwt}` },
+  });
+  if (current.ok) {
+    const body = await current.json() as { value?: unknown };
+    if (digest(body.value) === digest(doc)) {
+      console.log(`lexicon unchanged: ${doc.id}`);
+      continue;
+    }
+  } else if (current.status !== 400 && current.status !== 404) {
+    throw new Error(`${existing} failed (${current.status}): ${await current.text()}`);
+  }
+
+  await jsonRequest(`${pds}/xrpc/com.atproto.repo.putRecord`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${accessJwt}`,
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      repo: did,
+      collection,
+      rkey: doc.id,
+      record: doc,
+    }),
+  });
+  console.log(`published lexicon: ${doc.id}`);
+}
+
+console.log(`published ${networkLexicons.length} network Lexicons from ${did}`);
diff --git a/apps/spaces-demo-provider/src/constants.ts b/apps/spaces-demo-provider/src/constants.ts
index 6bbecbd..26aa1c2 100644
--- a/apps/spaces-demo-provider/src/constants.ts
+++ b/apps/spaces-demo-provider/src/constants.ts
@@ -1,6 +1,7 @@
 export const SPACE_TYPE = "garden.atmo.circle";
 export const SPACE_SKEY = "self";
 export const NOTE_COLLECTION = "garden.atmo.circle.note";
+export const MEMBER_COLLECTION = "garden.atmo.circle.member";
 export const REACTION_COLLECTION = "garden.atmo.circle.reaction";
 export const PROVIDER_ENDPOINT = "https://spaces.atmo.garden";
 export const PROVIDER_AUDIENCE = "did:web:spaces.atmo.garden#spaces";
diff --git a/apps/spaces-demo-provider/src/lexicons.ts b/apps/spaces-demo-provider/src/lexicons.ts
index 2f649f0..4536b8a 100644
--- a/apps/spaces-demo-provider/src/lexicons.ts
+++ b/apps/spaces-demo-provider/src/lexicons.ts
@@ -1,4 +1,24 @@
-import { NOTE_COLLECTION, REACTION_COLLECTION } from "./constants";
+import {
+  MEMBER_COLLECTION,
+  NOTE_COLLECTION,
+  REACTION_COLLECTION,
+  SPACE_SKEY,
+  SPACE_TYPE,
+} from "./constants";
+
+export const circleLexicon = {
+  lexicon: 1,
+  id: SPACE_TYPE,
+  defs: {
+    main: {
+      type: "space",
+      key: `literal:${SPACE_SKEY}`,
+      name: "Atmo Circle",
+      description: "A private multi-writer circle with an owner-managed member list.",
+      collections: [NOTE_COLLECTION, MEMBER_COLLECTION, REACTION_COLLECTION],
+    },
+  },
+} as const;
 
 export const noteLexicon = {
   lexicon: 1,
@@ -28,6 +48,26 @@ export const noteLexicon = {
   },
 } as const;
 
+export const memberLexicon = {
+  lexicon: 1,
+  id: MEMBER_COLLECTION,
+  defs: {
+    main: {
+      type: "record",
+      key: "any",
+      record: {
+        type: "object",
+        required: ["subject", "createdAt"],
+        properties: {
+          subject: { type: "string", format: "did" },
+          handle: { type: "string", format: "handle" },
+          createdAt: { type: "string", format: "datetime" },
+        },
+      },
+    },
+  },
+} as const;
+
 export const reactionLexicon = {
   lexicon: 1,
   id: REACTION_COLLECTION,
@@ -55,4 +95,5 @@ export const reactionLexicon = {
   },
 } as const;
 
-export const lexicons = [noteLexicon, reactionLexicon] as const;
+export const recordLexicons = [noteLexicon, memberLexicon, reactionLexicon] as const;
+export const networkLexicons = [circleLexicon, ...recordLexicons] as const;
diff --git a/apps/spaces-demo-provider/src/worker.ts b/apps/spaces-demo-provider/src/worker.ts
index da7b9a6..5267e21 100644
--- a/apps/spaces-demo-provider/src/worker.ts
+++ b/apps/spaces-demo-provider/src/worker.ts
@@ -1,7 +1,9 @@
 import type { ContrailConfig } from "@atmo-dev/contrail";
 import { createSpacesWorker } from "@atmo-dev/contrail-spaces-alpha/worker";
-import { parseSpaceUri } from "@atmo-dev/contrail-spaces-alpha";
+export { SpaceSubscriptionHub } from "@atmo-dev/contrail-spaces-alpha/worker";
+import { authorityRecordMembership } from "@atmo-dev/contrail-spaces-alpha";
 import {
+  MEMBER_COLLECTION,
   NOTE_COLLECTION,
   PROVIDER_AUDIENCE,
   PROVIDER_ENDPOINT,
@@ -9,14 +11,14 @@ import {
   SPACE_SKEY,
   SPACE_TYPE,
 } from "./constants";
-import { lexicons } from "./lexicons";
+import { recordLexicons } from "./lexicons";
 
 interface Env {
   [key: string]: unknown;
   DB: D1Database;
   SPACES_QUEUE: Queue;
   SPACES_CREDENTIAL_ENCRYPTION_KEY: string;
-  BSKY_APPVIEW_URL: string;
+  SPACE_SUBSCRIPTIONS: DurableObjectNamespace;
 }
 
 const projection: ContrailConfig = {
@@ -36,6 +38,11 @@ const projection: ContrailConfig = {
         reply: { collection: "note", field: "reply.uri" },
       },
     },
+    member: {
+      collection: MEMBER_COLLECTION,
+      validate: true,
+      queryable: { subject: {} },
+    },
     reaction: {
       collection: REACTION_COLLECTION,
       validate: true,
@@ -48,61 +55,24 @@ const projection: ContrailConfig = {
   constellation: false,
 };
 
-async function mutualAccess(
-  userDid: string,
-  ownerDid: string,
-  appview: string,
-): Promise<boolean> {
-  if (userDid === ownerDid) return true;
-  const url = new URL("/xrpc/app.bsky.graph.getRelationships", appview);
-  url.searchParams.set("actor", userDid);
-  url.searchParams.append("others", ownerDid);
-  const response = await fetch(url, {
-    headers: { accept: "application/json" },
-    signal: AbortSignal.timeout(3_000),
-  });
-  if (!response.ok) return false;
-  const body = await response.json() as {
-    relationships?: Array<{
-      $type?: string;
-      did?: string;
-      following?: unknown;
-      followedBy?: unknown;
-    }>;
-  };
-  const relation = body.relationships?.find((item) => item.did === ownerDid);
-  return Boolean(relation?.following && relation.followedBy);
-}
-
 export default createSpacesWorker<Env>({
   projection,
-  lexicons,
+  lexicons: recordLexicons,
   service: {
     endpoint: PROVIDER_ENDPOINT,
     audience: PROVIDER_AUDIENCE,
   },
   spaceTypes: {
     [SPACE_TYPE]: {
-      collections: [NOTE_COLLECTION, REACTION_COLLECTION],
+      collections: [NOTE_COLLECTION, MEMBER_COLLECTION, REACTION_COLLECTION],
+      access: authorityRecordMembership({
+        collection: MEMBER_COLLECTION,
+        principalField: "subject",
+      }),
       skey: SPACE_SKEY,
     },
   },
-  authorization: {
-    async authorize({ userDid, spaceUri }, { env }) {
-      const space = parseSpaceUri(spaceUri);
-      if (space.type !== SPACE_TYPE || space.skey !== SPACE_SKEY) return false;
-      try {
-        return await mutualAccess(
-          userDid,
-          space.authorityDid,
-          env.BSKY_APPVIEW_URL || "https://public.api.bsky.app",
-        );
-      } catch (error) {
-        console.warn("[circle] relationship policy failed closed", error);
-        return false;
-      }
-    },
-  },
+  subscriptions: { binding: "SPACE_SUBSCRIPTIONS" },
   accessLeaseMs: 15 * 60_000,
   reconcileIntervalMs: 5 * 60_000,
 });
diff --git a/apps/spaces-demo-provider/wrangler.jsonc b/apps/spaces-demo-provider/wrangler.jsonc
index 9c37540..94221f9 100644
--- a/apps/spaces-demo-provider/wrangler.jsonc
+++ b/apps/spaces-demo-provider/wrangler.jsonc
@@ -8,16 +8,21 @@
   "routes": [
     { "pattern": "spaces.atmo.garden", "custom_domain": true }
   ],
-  "vars": {
-    "BSKY_APPVIEW_URL": "https://public.api.bsky.app"
-  },
   "d1_databases": [
     {
       "binding": "DB",
       "database_name": "contrail-spaces-demo",
-      "database_id": "REPLACE_WITH_D1_DATABASE_ID"
+      "database_id": "4d0d01ba-8164-4fba-8526-472de88c5f19"
     }
   ],
+  "durable_objects": {
+    "bindings": [
+      { "name": "SPACE_SUBSCRIPTIONS", "class_name": "SpaceSubscriptionHub" }
+    ]
+  },
+  "migrations": [
+    { "tag": "spaces-subscriptions-v1", "new_sqlite_classes": ["SpaceSubscriptionHub"] }
+  ],
   "queues": {
     "producers": [
       { "binding": "SPACES_QUEUE", "queue": "contrail-spaces-demo" }
diff --git a/apps/spaces-demo/README.md b/apps/spaces-demo/README.md
index d9894f2..aed614d 100644
--- a/apps/spaces-demo/README.md
+++ b/apps/spaces-demo/README.md
@@ -1,14 +1,17 @@
 # Atmo Circle demo
 
-Small SvelteKit Cloudflare Worker demonstrating a separately deployed Contrail Spaces provider.
+Small SvelteKit Cloudflare Worker demonstrating a separately deployed Contrail Spaces provider with an owner-managed member list.
 
 - OAuth sessions stay in this consumer's KV namespaces through `@svelte-atproto/oauth`.
 - one-time delegation tokens are forwarded in authenticated request bodies;
 - service-auth JWTs are minted per exact provider method;
-- writes go directly to each user's permissioned PDS repo; and
-- reads come from `https://spaces.atmo.garden`.
+- owners add or remove members by handle using authority-signed membership records;
+- an authenticated provider query lists the active circles the viewer owns or can access;
+- writes go directly to each user's permissioned PDS repo;
+- reads come from `https://spaces.atmo.garden`; and
+- a short-lived provider ticket opens a WebSocket for projection invalidations, with a 30-second foreground refresh fallback.
 
-Only Spaces-compatible PDS accounts can use the alpha.
+Only Spaces-compatible PDS accounts can use the alpha. Clients refetch authorized query results after an invalidation; private records never travel in WebSocket events.
 
 ## Provision and deploy
 
diff --git a/apps/spaces-demo/src/lib/constants.ts b/apps/spaces-demo/src/lib/constants.ts
index 6161951..aa76212 100644
--- a/apps/spaces-demo/src/lib/constants.ts
+++ b/apps/spaces-demo/src/lib/constants.ts
@@ -1,7 +1,8 @@
 export const SPACE_TYPE = "garden.atmo.circle";
 export const SPACE_SKEY = "self";
 export const NOTE_COLLECTION = "garden.atmo.circle.note";
+export const MEMBER_COLLECTION = "garden.atmo.circle.member";
 export const REACTION_COLLECTION = "garden.atmo.circle.reaction";
-export const COLLECTIONS = [NOTE_COLLECTION, REACTION_COLLECTION] as const;
+export const COLLECTIONS = [NOTE_COLLECTION, MEMBER_COLLECTION, REACTION_COLLECTION] as const;
 export const PROVIDER_ENDPOINT = "https://spaces.atmo.garden";
 export const PROVIDER_AUDIENCE = "did:web:spaces.atmo.garden#spaces";
diff --git a/apps/spaces-demo/src/routes/+page.server.ts b/apps/spaces-demo/src/routes/+page.server.ts
index 8df2111..0432adf 100644
--- a/apps/spaces-demo/src/routes/+page.server.ts
+++ b/apps/spaces-demo/src/routes/+page.server.ts
@@ -3,9 +3,11 @@ import {
   SpacesProviderClient,
   createSpace,
   createSpaceRecord,
+  deleteSpaceRecord,
   formatSpaceUri,
 } from "@atmo-dev/contrail-spaces-alpha/consumer";
 import {
+  MEMBER_COLLECTION,
   NOTE_COLLECTION,
   PROVIDER_AUDIENCE,
   PROVIDER_ENDPOINT,
@@ -27,6 +29,18 @@ interface NoteRecord {
   };
 }
 
+interface MemberRecord {
+  uri: string;
+  rkey: string;
+  did: string;
+  cid: string;
+  value: {
+    subject: string;
+    handle?: string;
+    createdAt: string;
+  };
+}
+
 function circleUri(ownerDid: string): string {
   return formatSpaceUri({ authorityDid: ownerDid, type: SPACE_TYPE, skey: SPACE_SKEY });
 }
@@ -54,25 +68,79 @@ function ownerFrom(form: FormData, fallback: string): string {
   return validDid(owner) ? owner : fallback;
 }
 
+async function memberRkey(did: string): Promise<string> {
+  const digest = new Uint8Array(
+    await crypto.subtle.digest("SHA-256", new TextEncoder().encode(did)),
+  );
+  let binary = "";
+  for (const byte of digest) binary += String.fromCharCode(byte);
+  return `m-${btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "")}`;
+}
+
+async function resolveMember(value: unknown): Promise<{ did: string; handle?: string }> {
+  if (validDid(value)) return { did: value };
+  const handle = typeof value === "string"
+    ? value.trim().replace(/^@/, "").toLowerCase()
+    : "";
+  if (!handle || handle.length > 253) throw new Error("Enter a valid handle or DID");
+  const url = new URL(
+    "/xrpc/com.atproto.identity.resolveHandle",
+    "https://public.api.bsky.app",
+  );
+  url.searchParams.set("handle", handle);
+  const response = await fetch(url, {
+    headers: { accept: "application/json" },
+    redirect: "manual",
+    signal: AbortSignal.timeout(5_000),
+  });
+  if (!response.ok) throw new Error(`Could not resolve @${handle}`);
+  const result = await response.json() as { did?: unknown };
+  if (!validDid(result.did)) throw new Error(`Could not resolve @${handle}`);
+  return { did: result.did, handle };
+}
+
 export const load: PageServerLoad = async ({ locals, url }) => {
   if (!locals.session || !locals.did) {
-    return { signedIn: false as const, owner: null, space: null, notes: [] };
+    return {
+      signedIn: false as const,
+      owner: null,
+      space: null,
+      notes: [],
+      members: [],
+      circles: [],
+    };
   }
   const ownerParam = url.searchParams.get("owner");
   const owner = validDid(ownerParam) ? ownerParam : locals.did;
   const space = circleUri(owner);
+  const client = provider(locals.session);
+  const available = await client.listSpaces({ limit: 200 }).catch(() => ({
+    spaces: [] as Array<{ uri: string; authorityDid: string; type: string }>,
+    truncated: false,
+  }));
   try {
-    const result = await provider(locals.session).listSpaceRecords<NoteRecord>({
-      space,
-      collection: NOTE_COLLECTION,
-      limit: 100,
-      search: url.searchParams.get("search") ?? undefined,
-    });
+    const [notes, members] = await Promise.all([
+      client.listSpaceRecords<NoteRecord>({
+        space,
+        collection: NOTE_COLLECTION,
+        limit: 100,
+        search: url.searchParams.get("search") ?? undefined,
+      }),
+      client.listSpaceRecords<MemberRecord>({
+        space,
+        collection: MEMBER_COLLECTION,
+        did: owner,
+        limit: 200,
+      }),
+    ]);
     return {
       signedIn: true as const,
       owner,
       space,
-      notes: result.records,
+      notes: notes.records,
+      members: members.records,
+      circles: available.spaces,
+      circlesTruncated: available.truncated,
       viewer: locals.did,
       needsAuthorization: false,
     };
@@ -82,6 +150,9 @@ export const load: PageServerLoad = async ({ locals, url }) => {
       owner,
       space,
       notes: [] as NoteRecord[],
+      members: [] as MemberRecord[],
+      circles: available.spaces,
+      circlesTruncated: available.truncated,
       viewer: locals.did,
       needsAuthorization: true,
       error: error instanceof Error ? error.message : "Circle unavailable",
@@ -123,6 +194,79 @@ export const actions: Actions = {
     throw redirect(303, `/?owner=${encodeURIComponent(owner)}`);
   },
 
+  async addMember({ request, locals }) {
+    const { session, did } = signedIn(locals);
+    const form = await request.formData();
+    const owner = ownerFrom(form, did);
+    if (owner !== did) {
+      return fail(403, { action: "addMember", message: "Only the circle owner can add members" });
+    }
+    try {
+      const member = await resolveMember(form.get("member"));
+      if (member.did === owner) throw new Error("The owner already has access");
+      const space = circleUri(owner);
+      const client = provider(session);
+      const existing = await client.listSpaceRecords<MemberRecord>({
+        space,
+        collection: MEMBER_COLLECTION,
+        did: owner,
+        filters: { subject: member.did },
+        limit: 1,
+      });
+      if (existing.records.length === 0) {
+        await createSpaceRecord(session, {
+          space,
+          collection: MEMBER_COLLECTION,
+          rkey: await memberRkey(member.did),
+          record: {
+            $type: MEMBER_COLLECTION,
+            subject: member.did,
+            ...(member.handle ? { handle: member.handle } : {}),
+            createdAt: new Date().toISOString(),
+          },
+        });
+        await client.syncSpace(space, did);
+      }
+    } catch (error) {
+      return fail(400, {
+        action: "addMember",
+        message: error instanceof Error ? error.message : "Could not add member",
+      });
+    }
+    throw redirect(303, `/?owner=${encodeURIComponent(owner)}`);
+  },
+
+  async removeMember({ request, locals }) {
+    const { session, did } = signedIn(locals);
+    const form = await request.formData();
+    const owner = ownerFrom(form, did);
+    const rkey = form.get("rkey");
+    if (owner !== did) {
+      return fail(403, {
+        action: "removeMember",
+        message: "Only the circle owner can remove members",
+      });
+    }
+    if (typeof rkey !== "string" || !/^m-[A-Za-z0-9_-]{43}$/.test(rkey)) {
+      return fail(400, { action: "removeMember", message: "Invalid member record" });
+    }
+    try {
+      const space = circleUri(owner);
+      await deleteSpaceRecord(session, {
+        space,
+        collection: MEMBER_COLLECTION,
+        rkey,
+      });
+      await provider(session).syncSpace(space, did);
+    } catch (error) {
+      return fail(400, {
+        action: "removeMember",
+        message: error instanceof Error ? error.message : "Could not remove member",
+      });
+    }
+    throw redirect(303, `/?owner=${encodeURIComponent(owner)}`);
+  },
+
   async post({ request, locals }) {
     const { session, did } = signedIn(locals);
     const form = await request.formData();
diff --git a/apps/spaces-demo/src/routes/+page.svelte b/apps/spaces-demo/src/routes/+page.svelte
index df55f48..5c9c91a 100644
--- a/apps/spaces-demo/src/routes/+page.svelte
+++ b/apps/spaces-demo/src/routes/+page.svelte
@@ -1,10 +1,107 @@
 <script lang="ts">
+  import { enhance } from "$app/forms";
+  import { invalidateAll } from "$app/navigation";
+  import { onMount } from "svelte";
+
   let { data, form } = $props();
   let loginHandle = $state("");
   let loggingIn = $state(false);
   let loginError = $state("");
   let replyUri = $state("");
   let replyCid = $state("");
+  let refreshInFlight = false;
+  let liveConnected = $state(false);
+  let subscriptionOwner = $derived(
+    data.signedIn && !data.needsAuthorization ? data.owner : null,
+  );
+
+  async function refreshProjection() {
+    if (document.hidden || !data.signedIn || data.needsAuthorization || refreshInFlight) return;
+    refreshInFlight = true;
+    try {
+      await invalidateAll();
+    } finally {
+      refreshInFlight = false;
+    }
+  }
+
+  $effect(() => {
+    const owner = subscriptionOwner;
+    if (!owner) {
+      liveConnected = false;
+      return;
+    }
+    let disposed = false;
+    let socket: WebSocket | undefined;
+    let retryTimer: number | undefined;
+    let retryDelay = 1_000;
+
+    const scheduleReconnect = () => {
+      if (disposed || retryTimer !== undefined) return;
+      retryTimer = window.setTimeout(() => {
+        retryTimer = undefined;
+        void connect();
+      }, retryDelay);
+      retryDelay = Math.min(retryDelay * 2, 30_000);
+    };
+
+    const connect = async () => {
+      try {
+        const response = await fetch("/api/space-subscription", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ owner }),
+        });
+        const body = await response.json() as { url?: string };
+        if (!response.ok || !body.url) throw new Error("Live updates unavailable");
+        if (disposed) return;
+        socket = new WebSocket(body.url);
+        socket.onopen = () => {
+          liveConnected = true;
+          retryDelay = 1_000;
+        };
+        socket.onmessage = (event) => {
+          if (typeof event.data !== "string") return;
+          try {
+            const message = JSON.parse(event.data) as { type?: string };
+            if (message.type === "invalidate") void refreshProjection();
+          } catch {
+            // Ignore protocol keepalives or unknown messages.
+          }
+        };
+        socket.onclose = () => {
+          liveConnected = false;
+          scheduleReconnect();
+        };
+        socket.onerror = () => socket?.close();
+      } catch {
+        liveConnected = false;
+        scheduleReconnect();
+      }
+    };
+
+    void connect();
+    return () => {
+      disposed = true;
+      liveConnected = false;
+      if (retryTimer !== undefined) window.clearTimeout(retryTimer);
+      socket?.close();
+    };
+  });
+
+  onMount(() => {
+    // Slow reconciliation is a safety net for dropped notifications, sleep,
+    // and deployments rather than the primary update mechanism.
+    const interval = window.setInterval(() => void refreshProjection(), 30_000);
+    const onVisibility = () => {
+      if (!document.hidden) void refreshProjection();
+    };
+    document.addEventListener("visibilitychange", onVisibility);
+    return () => {
+      window.clearInterval(interval);
+      document.removeEventListener("visibilitychange", onVisibility);
+    };
+  });
 
   async function login() {
     loggingIn = true;
@@ -64,37 +161,102 @@
     <section class="card stack">
       <div class="row">
         <span class="badge">viewer</span><span class="meta">{data.viewer}</span>
+        {#if !data.needsAuthorization}
+          <span
+            class="badge"
+            title={liveConnected
+              ? "Subscribed to verified Space projection updates"
+              : "Reconnecting; periodic refresh remains active"}
+          >{liveConnected ? "live" : "reconnecting"}</span>
+        {/if}
       </div>
       <form method="GET" class="row">
         <input name="owner" value={data.owner} placeholder="Circle owner's DID" style="flex:1;min-width:18rem" />
         <button class="secondary">Open circle</button>
       </form>
+      {#if data.circles.length}
+        <div class="stack">
+          <div class="row">
+            <h2>Your circles</h2>
+            {#if data.circlesTruncated}<span class="badge">first 200</span>{/if}
+          </div>
+          {#each data.circles as circle (circle.uri)}
+            <div class="row">
+              <a href={`/?owner=${encodeURIComponent(circle.authorityDid)}`}>
+                {circle.authorityDid === data.viewer ? "Your circle" : circle.authorityDid}
+              </a>
+              {#if circle.authorityDid === data.owner}<span class="badge">open</span>{/if}
+            </div>
+          {/each}
+        </div>
+      {/if}
     </section>
 
     {#if data.owner === data.viewer && data.needsAuthorization}
       <section class="card stack">
         <h2>Create or reconnect your circle</h2>
-        <p class="subtle">Your mutual followers can read and write. Records stay in each writer's permissioned PDS repo.</p>
+        <p class="subtle">You control who can read and write through an owner-managed member list. Records stay in each writer's permissioned PDS repo.</p>
         <div class="row">
-          <form method="POST" action="?/create">
+          <form method="POST" action="?/create" use:enhance>
             <button>Create and connect</button>
           </form>
-          <form method="POST" action="?/authorize">
+          <form method="POST" action="?/authorize" use:enhance>
             <input type="hidden" name="owner" value={data.owner} />
             <button class="secondary">Connect an existing circle</button>
           </form>
         </div>
       </section>
     {:else if data.needsAuthorization}
-      <form method="POST" action="?/authorize" class="card stack">
+      <form method="POST" action="?/authorize" class="card stack" use:enhance>
         <input type="hidden" name="owner" value={data.owner} />
         <h2>Connect this circle</h2>
-        <p class="subtle">The provider needs a one-time delegation before it can verify and index this Space.</p>
+        <p class="subtle">Ask the circle owner to add your handle to the member list. After that, the provider uses a one-time delegation to verify the Space.</p>
         {#if data.error}<div class="error">{data.error}</div>{/if}
         <button>Authorize private reads</button>
       </form>
     {:else}
-      <form method="POST" action="?/post" class="card stack">
+      <section class="card stack" aria-label="Circle members">
+        <div class="row">
+          <h2>Members</h2>
+          <span class="badge">{data.members.length + 1}</span>
+        </div>
+        <div class="row">
+          <span class="badge">owner</span>
+          <span class="meta">{data.owner}</span>
+        </div>
+        {#each data.members as member (member.uri)}
+          <div class="row">
+            <span class="meta">
+              {member.value.handle ? `@${member.value.handle}` : member.value.subject}
+            </span>
+            {#if member.value.handle}
+              <span class="subtle">{member.value.subject}</span>
+            {/if}
+            {#if data.owner === data.viewer}
+              <form method="POST" action="?/removeMember" use:enhance>
+                <input type="hidden" name="owner" value={data.owner} />
+                <input type="hidden" name="rkey" value={member.rkey} />
+                <button class="secondary">Remove</button>
+              </form>
+            {/if}
+          </div>
+        {/each}
+        {#if data.owner === data.viewer}
+          <form method="POST" action="?/addMember" class="row" use:enhance>
+            <input type="hidden" name="owner" value={data.owner} />
+            <input
+              name="member"
+              required
+              placeholder="handle.example.com or did:plc:…"
+              aria-label="New member handle or DID"
+              style="flex:1;min-width:18rem"
+            />
+            <button>Add member</button>
+          </form>
+        {/if}
+      </section>
+
+      <form method="POST" action="?/post" class="card stack" use:enhance>
         <input type="hidden" name="owner" value={data.owner} />
         <input type="hidden" name="replyUri" value={replyUri} />
         <input type="hidden" name="replyCid" value={replyCid} />
@@ -114,7 +276,7 @@
             <div class="note">{note.value.text}</div>
             <div class="meta">{note.did} · {new Date(note.value.createdAt).toLocaleString()}</div>
             <div class="row">
-              <form method="POST" action="?/react">
+              <form method="POST" action="?/react" use:enhance>
                 <input type="hidden" name="owner" value={data.owner} />
                 <input type="hidden" name="uri" value={note.uri} />
                 <input type="hidden" name="cid" value={note.cid} />
diff --git a/apps/spaces-demo/src/routes/api/space-subscription/+server.ts b/apps/spaces-demo/src/routes/api/space-subscription/+server.ts
new file mode 100644
index 0000000..26e1ef3
--- /dev/null
+++ b/apps/spaces-demo/src/routes/api/space-subscription/+server.ts
@@ -0,0 +1,45 @@
+import { json } from "@sveltejs/kit";
+import {
+  SpacesProviderClient,
+  formatSpaceUri,
+} from "@atmo-dev/contrail-spaces-alpha/consumer";
+import {
+  PROVIDER_AUDIENCE,
+  PROVIDER_ENDPOINT,
+  SPACE_SKEY,
+  SPACE_TYPE,
+} from "$lib/constants";
+import type { RequestHandler } from "./$types";
+
+function validDid(value: unknown): value is string {
+  return typeof value === "string" && /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/.test(value);
+}
+
+export const POST: RequestHandler = async ({ locals, request }) => {
+  if (!locals.session || !locals.did) {
+    return json({ error: "Unauthorized" }, { status: 401 });
+  }
+  const body = await request.json().catch(() => null) as { owner?: unknown } | null;
+  if (!validDid(body?.owner)) {
+    return json({ error: "Invalid owner DID" }, { status: 400 });
+  }
+  const space = formatSpaceUri({
+    authorityDid: body.owner,
+    type: SPACE_TYPE,
+    skey: SPACE_SKEY,
+  });
+  try {
+    const subscription = await new SpacesProviderClient({
+      endpoint: PROVIDER_ENDPOINT,
+      audience: PROVIDER_AUDIENCE,
+      namespace: SPACE_TYPE,
+      session: locals.session,
+    }).subscribeSpace(space);
+    return json(subscription, {
+      headers: { "cache-control": "private, no-store" },
+    });
+  } catch (error) {
+    console.warn("Could not open Space subscription", error);
+    return json({ error: "Live updates unavailable" }, { status: 502 });
+  }
+};
diff --git a/docs/experimental-spaces-alpha.md b/docs/experimental-spaces-alpha.md
index 1a667e0..3898c83 100644
--- a/docs/experimental-spaces-alpha.md
+++ b/docs/experimental-spaces-alpha.md
@@ -24,12 +24,13 @@ A Space incarnation maps to one opaque projection scope. Each writer repo is sta
 - managing-app access checks;
 - signed write/deletion notifications;
 - Queue consumption;
-- scheduled bounded reconciliation; and
-- renewable, owner-fenced per-repo leases.
+- scheduled bounded reconciliation;
+- renewable, owner-fenced per-repo leases; and
+- optional hibernating Durable Object WebSocket invalidations.
 
-Consumer-triggered synchronization always reconciles the authority's complete `listRepos` result; only service-authenticated authority notifications use the targeted writer path. Rediscovery is accepted only for a watch already hidden by a verified deletion, so an ordinary read-authorized caller cannot rotate an active generation.
+Consumer-triggered synchronization always reconciles the authority's complete `listRepos` result; only service-authenticated authority notifications use the targeted writer path. Space types may declare an `authority-record-membership` policy. Its collection is automatically authority-only, and verified membership mutations maintain a generation-scoped entitlement index atomically with projection changes. Access checks and `listSpaces` use this index; full recovery switches records and entitlements through the same visible writer-generation pointer. Custom policy callbacks remain available and may provide an inverse `listSpaces` lookup. Rediscovery is accepted only for a watch already hidden by a verified deletion, so an ordinary read-authorized caller cannot rotate an active generation.
 
-Notifications only enqueue a target revision/hash. Record bodies always come from authenticated writer hosts and are accepted only after commit/LtHash or full-CAR verification. CAR bodies are size-limited while streaming, including responses without `Content-Length`. Relation-count columns use additive initialization migrations when projection configuration evolves.
+PDS notifications only enqueue a target revision/hash. Record bodies always come from authenticated writer hosts and are accepted only after commit/LtHash or full-CAR verification. After the verified projection commit, an optional per-Space Durable Object broadcasts an invalidation—not record contents—to browsers holding a short-lived, one-time ticket issued through an authorized exact-method XRPC call. CAR bodies are size-limited while streaming, including responses without `Content-Length`. Relation-count columns use additive initialization migrations when projection configuration evolves.
 
 ## Current limitations
 
diff --git a/packages/contrail-spaces-alpha/README.md b/packages/contrail-spaces-alpha/README.md
index eada4ee..3402592 100644
--- a/packages/contrail-spaces-alpha/README.md
+++ b/packages/contrail-spaces-alpha/README.md
@@ -19,8 +19,11 @@ Pinned compatibility tuple:
 - incremental repo operation synchronization;
 - signed notification routes, Queue jobs, leases, and scheduled reconciliation;
 - exact method-bound service authentication;
-- delegation access leases or an authoritative application callback; and
-- exact-Space list/get/search/reference/relation-count queries over Contrail's isolated projection seam.
+- delegation access leases or an authoritative application callback;
+- declarative authority-record membership with a materialized, generation-scoped entitlement index;
+- paginated discovery of active Spaces authorized for the calling principal;
+- exact-Space list/get/search/reference/relation-count queries over Contrail's isolated projection seam; and
+- optional one-time-ticket, hibernating Durable Object WebSocket invalidations.
 
 Public Contrail tables and anonymous methods are unchanged. Installing the package does not create isolated tables; `createSpacesWorker` initializes them only in a provider deployment.
 
@@ -28,6 +31,7 @@ Public Contrail tables and anonymous methods are unchanged. Installing the packa
 
 ```ts
 import { createSpacesWorker } from "@atmo-dev/contrail-spaces-alpha/worker";
+import { authorityRecordMembership } from "@atmo-dev/contrail-spaces-alpha";
 import {
   SpacesProviderClient,
   createSpace,
@@ -45,6 +49,7 @@ A Cloudflare deployment needs:
 - one D1 database;
 - a Queue producer/consumer (with `waitUntil` fallback for development);
 - a scheduled trigger;
+- a Durable Object binding when `subscriptions` is enabled;
 - the `nodejs_compat` compatibility flag; and
 - a 32-byte base64 `SPACES_CREDENTIAL_ENCRYPTION_KEY` secret.
 
diff --git a/packages/contrail-spaces-alpha/src/consumer.ts b/packages/contrail-spaces-alpha/src/consumer.ts
index baef5ad..c0200d7 100644
--- a/packages/contrail-spaces-alpha/src/consumer.ts
+++ b/packages/contrail-spaces-alpha/src/consumer.ts
@@ -45,6 +45,8 @@ export function spacesConsumerOAuthScopes(input: {
   const methods = [
     `${input.namespace}.authorizeSpace`,
     `${input.namespace}.syncSpace`,
+    `${input.namespace}.listSpaces`,
+    `${input.namespace}.subscribeSpace`,
     ...input.collections.flatMap((collection) => {
       const short = collection.split(".").at(-1)!;
       return [
@@ -183,6 +185,9 @@ export async function getServiceAuthToken(
   return result.token;
 }
 
+const runtimeFetch: typeof globalThis.fetch = (input, init) =>
+  globalThis.fetch(input, init);
+
 export interface SpacesProviderClientOptions {
   endpoint: string;
   audience: string;
@@ -195,7 +200,7 @@ export class SpacesProviderClient {
   private readonly fetchImpl: typeof globalThis.fetch;
 
   constructor(readonly options: SpacesProviderClientOptions) {
-    this.fetchImpl = options.fetch ?? globalThis.fetch;
+    this.fetchImpl = options.fetch ?? runtimeFetch;
   }
 
   private async call<T>(
@@ -235,6 +240,28 @@ export class SpacesProviderClient {
     });
   }
 
+  subscribeSpace(space: string): Promise<{ url: string; expiresAt: string }> {
+    return this.call(`${this.options.namespace}.subscribeSpace`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ space }),
+    });
+  }
+
+  listSpaces(options: { cursor?: string; limit?: number } = {}): Promise<{
+    spaces: Array<{ uri: string; authorityDid: string; type: string }>;
+    cursor?: string;
+    truncated: boolean;
+  }> {
+    const params = new URLSearchParams();
+    if (options.cursor) params.set("cursor", options.cursor);
+    if (options.limit) params.set("limit", String(options.limit));
+    return this.call(`${this.options.namespace}.listSpaces`, {
+      method: "GET",
+      params,
+    });
+  }
+
   listSpaceRecords<T = Record<string, unknown>>(input: {
     space: string;
     collection: string;
diff --git a/packages/contrail-spaces-alpha/src/index.ts b/packages/contrail-spaces-alpha/src/index.ts
index 0a9fc8f..fb89e5e 100644
--- a/packages/contrail-spaces-alpha/src/index.ts
+++ b/packages/contrail-spaces-alpha/src/index.ts
@@ -7,7 +7,10 @@ export {
   AUTHORIZE_SPACE_METHOD,
   GET_SPACE_RECORD_METHOD,
   LIST_SPACE_RECORDS_METHOD,
+  LIST_SPACES_METHOD,
+  SUBSCRIBE_SPACE_METHOD,
   SYNC_SPACE_METHOD,
+  SpaceSubscriptionHub,
   createSpacesWorker,
 } from "./worker";
 export type {
diff --git a/packages/contrail-spaces-alpha/src/protocol.ts b/packages/contrail-spaces-alpha/src/protocol.ts
index 5389948..2d8df01 100644
--- a/packages/contrail-spaces-alpha/src/protocol.ts
+++ b/packages/contrail-spaces-alpha/src/protocol.ts
@@ -1,5 +1,9 @@
-import { getPdsEndpoint } from "@atproto/common-web";
-import { IdResolver } from "@atproto/identity";
+import {
+  getPdsEndpoint,
+  getSigningDidKey,
+  isValidDidDoc,
+  type DidDocument,
+} from "@atproto/common-web";
 import { JoseKey } from "@atproto/jwk-jose";
 import { createDpopProof } from "@atproto/space";
 import { validateExternalUrl } from "@atmo-dev/contrail";
@@ -11,6 +15,11 @@ export interface ProtocolOptions {
   additionalAllowedHosts?: string[];
 }
 
+// Workerd requires platform methods to be invoked with the global object as
+// their receiver. Keep the wrapper rather than storing an unbound `fetch`.
+const runtimeFetch: typeof globalThis.fetch = (input, init) =>
+  globalThis.fetch(input, init);
+
 export class SpaceProtocolError extends Error {
   constructor(
     readonly status: number,
@@ -42,16 +51,52 @@ export class SpaceProtocolError extends Error {
 }
 
 export class SpaceIdentityResolver {
-  private readonly resolver: IdResolver;
+  private readonly cache = new Map<string, DidDocument>();
+
+  constructor(readonly options: ProtocolOptions = {}) {}
 
-  constructor(readonly options: ProtocolOptions = {}) {
-    this.resolver = new IdResolver({ plcUrl: options.plcUrl });
+  private async resolveDid(did: string, forceRefresh = false): Promise<DidDocument> {
+    if (!forceRefresh) {
+      const cached = this.cache.get(did);
+      if (cached) return cached;
+    }
+    let url: URL;
+    if (did.startsWith("did:plc:")) {
+      url = new URL(
+        `/${encodeURIComponent(did)}`,
+        this.options.plcUrl ?? "https://plc.directory",
+      );
+    } else if (did.startsWith("did:web:")) {
+      const parts = did.slice("did:web:".length).split(":").map(decodeURIComponent);
+      if (parts.length !== 1 || !parts[0]) {
+        throw new Error(`Unsupported did:web identifier: ${did}`);
+      }
+      url = new URL(`https://${parts[0]}/.well-known/did.json`);
+      if (url.hostname === "localhost") url.protocol = "http:";
+    } else {
+      throw new Error(`Unsupported DID method: ${did}`);
+    }
+    if (!validateExternalUrl(url.href, this.options.additionalAllowedHosts)) {
+      throw new Error(`${did} resolved through a disallowed identity endpoint`);
+    }
+    const response = await (this.options.fetch ?? runtimeFetch)(url, {
+      redirect: "manual",
+      headers: { accept: "application/did+ld+json,application/json" },
+      signal: AbortSignal.timeout(5_000),
+    });
+    if (!response.ok) {
+      throw new Error(`Could not resolve ${did} (${response.status})`);
+    }
+    const document: unknown = await response.json();
+    if (!isValidDidDoc(document) || document.id !== did) {
+      throw new Error(`Invalid DID document for ${did}`);
+    }
+    this.cache.set(did, document);
+    return document;
   }
 
   async resolvePds(did: string): Promise<string> {
-    const document = await this.resolver.did.resolve(did);
-    if (!document) throw new Error(`Could not resolve ${did}`);
-    const endpoint = getPdsEndpoint(document);
+    const endpoint = getPdsEndpoint(await this.resolveDid(did));
     if (!endpoint) throw new Error(`${did} has no PDS endpoint`);
     if (!validateExternalUrl(endpoint, this.options.additionalAllowedHosts)) {
       throw new Error(`${did} resolved to a disallowed PDS endpoint`);
@@ -60,7 +105,10 @@ export class SpaceIdentityResolver {
   }
 
   async resolveSigningKey(did: string, forceRefresh = false): Promise<string> {
-    return this.resolver.did.resolveAtprotoKey(did, forceRefresh);
+    if (did.startsWith("did:key:")) return did;
+    const key = getSigningDidKey(await this.resolveDid(did, forceRefresh));
+    if (!key) throw new Error(`${did} has no AT Protocol signing key`);
+    return key;
   }
 }
 
@@ -75,12 +123,12 @@ export class SpaceCredentialTransport {
     readonly token: string,
     readonly key: JoseKey,
     readonly expiresAt: number,
-    private readonly fetchImpl: typeof globalThis.fetch = globalThis.fetch,
+    private readonly fetchImpl: typeof globalThis.fetch = runtimeFetch,
   ) {}
 
   static async restore(
     value: StoredSpaceCredential,
-    fetchImpl: typeof globalThis.fetch = globalThis.fetch,
+    fetchImpl: typeof globalThis.fetch = runtimeFetch,
   ): Promise<SpaceCredentialTransport> {
     const key = await JoseKey.fromJWK(value.privateJwk);
     return new SpaceCredentialTransport(value.token, key, value.expiresAt, fetchImpl);
@@ -103,7 +151,9 @@ export class SpaceCredentialTransport {
     if (Date.now() >= this.expiresAt) {
       throw new SpaceProtocolError(401, "CredentialExpired");
     }
-    const request = new Request(input, { ...init, redirect: "error" });
+    // Cloudflare Workers support only follow/manual. Manual preserves the
+    // no-follow SSRF boundary while allowing callers to reject 3xx responses.
+    const request = new Request(input, { ...init, redirect: "manual" });
     request.headers.set("authorization", `DPoP ${this.token}`);
     request.headers.set(
       "dpop",
@@ -187,7 +237,7 @@ export async function exchangeSpaceCredential(input: {
     xrpcUrl(input.authorityPds, "com.atproto.space.getSpaceCredential"),
     {
       method: "POST",
-      redirect: "error",
+      redirect: "manual",
       headers: {
         accept: "application/json",
         authorization: `Bearer ${input.delegationToken}`,
@@ -205,7 +255,7 @@ export async function exchangeSpaceCredential(input: {
     "dpop",
     await createDpopProof(key, { htm: request.method, htu: request.url }),
   );
-  const response = await (input.fetch ?? globalThis.fetch)(request);
+  const response = await (input.fetch ?? runtimeFetch)(request);
   const body = await assertResponse<{ credential?: unknown }>(response);
   if (typeof body?.credential !== "string" || !body.credential) {
     throw new SpaceProtocolError(502, "InvalidResponse", "No Space credential returned");
@@ -220,7 +270,7 @@ export async function exchangeSpaceCredential(input: {
     body.credential,
     key,
     claims.exp * 1000,
-    input.fetch ?? globalThis.fetch,
+    input.fetch ?? runtimeFetch,
   );
 }
 
diff --git a/packages/contrail-spaces-alpha/src/storage.ts b/packages/contrail-spaces-alpha/src/storage.ts
index d10a122..3c26778 100644
--- a/packages/contrail-spaces-alpha/src/storage.ts
+++ b/packages/contrail-spaces-alpha/src/storage.ts
@@ -79,6 +79,30 @@ export async function initSpacesStorage(
     )`,
     `CREATE INDEX IF NOT EXISTS idx_spaces_access_expiry
       ON spaces_access_leases(expires_at)`,
+    `CREATE TABLE IF NOT EXISTS spaces_access_entries (
+      space_uri TEXT NOT NULL,
+      space_generation INTEGER NOT NULL,
+      scope_key TEXT NOT NULL,
+      partition_key TEXT NOT NULL,
+      partition_generation INTEGER NOT NULL,
+      principal_did TEXT NOT NULL,
+      role TEXT NOT NULL,
+      source_uri TEXT NOT NULL,
+      source_cid TEXT,
+      created_at ${bigint} NOT NULL,
+      PRIMARY KEY (scope_key, partition_key, partition_generation, source_uri)
+    )`,
+    `CREATE INDEX IF NOT EXISTS idx_spaces_access_principal
+      ON spaces_access_entries(principal_did, space_uri, space_generation)`,
+    `CREATE INDEX IF NOT EXISTS idx_spaces_access_partition
+      ON spaces_access_entries(scope_key, partition_key, partition_generation)`,
+    `CREATE TABLE IF NOT EXISTS spaces_access_index_state (
+      space_uri TEXT NOT NULL,
+      space_generation INTEGER NOT NULL,
+      policy_key TEXT NOT NULL,
+      indexed_at ${bigint} NOT NULL,
+      PRIMARY KEY (space_uri, space_generation)
+    )`,
     `CREATE TABLE IF NOT EXISTS spaces_credentials (
       space_uri TEXT NOT NULL,
       space_generation INTEGER NOT NULL,
@@ -198,6 +222,197 @@ export async function rediscoverSpace(
   return watch;
 }
 
+export async function listActiveSpaceWatches(
+  db: Database,
+  limit: number,
+  cursor?: string,
+): Promise<SpaceWatch[]> {
+  const boundedLimit = Math.max(1, Math.min(1_001, Math.trunc(limit)));
+  const rows = await db.prepare(
+    `SELECT space_uri, authority_did, space_type, generation, status,
+            registration_expires_at, next_reconcile_at, last_reconciled_at, last_error
+     FROM spaces_watches
+     WHERE status = 'active' AND space_uri > ?
+     ORDER BY space_uri LIMIT ?`,
+  ).bind(cursor ?? "", boundedLimit).all<Record<string, unknown>>();
+  return (rows.results ?? []).map(rowToWatch);
+}
+
+export interface SpaceAccessEntryInput {
+  spaceUri: string;
+  spaceGeneration: number;
+  scopeKey: string;
+  partitionKey: string;
+  partitionGeneration: number;
+  principalDid: string;
+  role?: string;
+  sourceUri: string;
+  sourceCid?: string | null;
+}
+
+export function upsertSpaceAccessEntryStatement(
+  db: Database,
+  input: SpaceAccessEntryInput,
+): Statement {
+  return db.prepare(
+    `INSERT INTO spaces_access_entries
+       (space_uri, space_generation, scope_key, partition_key,
+        partition_generation, principal_did, role, source_uri, source_cid, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(scope_key, partition_key, partition_generation, source_uri)
+     DO UPDATE SET principal_did = excluded.principal_did,
+       role = excluded.role, source_cid = excluded.source_cid,
+       created_at = excluded.created_at`,
+  ).bind(
+    input.spaceUri,
+    input.spaceGeneration,
+    input.scopeKey,
+    input.partitionKey,
+    input.partitionGeneration,
+    input.principalDid,
+    input.role ?? "member",
+    input.sourceUri,
+    input.sourceCid ?? null,
+    Date.now(),
+  );
+}
+
+export function deleteSpaceAccessEntryStatement(
+  db: Database,
+  input: Pick<SpaceAccessEntryInput,
+    "scopeKey" | "partitionKey" | "partitionGeneration" | "sourceUri">,
+): Statement {
+  return db.prepare(
+    `DELETE FROM spaces_access_entries
+     WHERE scope_key = ? AND partition_key = ?
+       AND partition_generation = ? AND source_uri = ?`,
+  ).bind(
+    input.scopeKey,
+    input.partitionKey,
+    input.partitionGeneration,
+    input.sourceUri,
+  );
+}
+
+export async function deleteSpaceAccessPartitionGeneration(
+  db: Database,
+  input: { scopeKey: string; partitionKey: string; partitionGeneration: number },
+): Promise<void> {
+  await db.prepare(
+    `DELETE FROM spaces_access_entries
+     WHERE scope_key = ? AND partition_key = ? AND partition_generation = ?`,
+  ).bind(input.scopeKey, input.partitionKey, input.partitionGeneration).run();
+}
+
+export async function getVisibleSpaceWriterGeneration(
+  db: Database,
+  input: { scopeKey: string; partitionKey: string },
+): Promise<number | null> {
+  const row = await db.prepare(
+    `SELECT visible_generation
+     FROM isolated_projection_partitions
+     WHERE scope_key = ? AND partition_key = ?`,
+  ).bind(input.scopeKey, input.partitionKey).first<{ visible_generation: unknown }>();
+  return row ? Number(row.visible_generation) : null;
+}
+
+export async function spaceAccessIndexPolicyKey(
+  db: Database,
+  input: { spaceUri: string; spaceGeneration: number },
+): Promise<string | null> {
+  const row = await db.prepare(
+    `SELECT policy_key FROM spaces_access_index_state
+     WHERE space_uri = ? AND space_generation = ?`,
+  ).bind(input.spaceUri, input.spaceGeneration).first<{ policy_key: unknown }>();
+  return row ? String(row.policy_key) : null;
+}
+
+export async function replaceSpaceAccessIndex(
+  db: Database,
+  input: {
+    spaceUri: string;
+    spaceGeneration: number;
+    policyKey: string;
+    entries: readonly SpaceAccessEntryInput[];
+  },
+): Promise<void> {
+  await db.prepare(
+    `DELETE FROM spaces_access_entries
+     WHERE space_uri = ? AND space_generation = ?`,
+  ).bind(input.spaceUri, input.spaceGeneration).run();
+  const chunkSize = 90;
+  for (let offset = 0; offset < input.entries.length; offset += chunkSize) {
+    await db.batch(input.entries.slice(offset, offset + chunkSize).map((entry) =>
+      upsertSpaceAccessEntryStatement(db, entry)
+    ));
+  }
+  await db.prepare(
+    `INSERT INTO spaces_access_index_state
+       (space_uri, space_generation, policy_key, indexed_at)
+     VALUES (?, ?, ?, ?)
+     ON CONFLICT(space_uri, space_generation) DO UPDATE SET
+       policy_key = excluded.policy_key, indexed_at = excluded.indexed_at`,
+  ).bind(
+    input.spaceUri,
+    input.spaceGeneration,
+    input.policyKey,
+    Date.now(),
+  ).run();
+}
+
+export async function hasProjectedSpaceAccess(
+  db: Database,
+  input: { spaceUri: string; spaceGeneration: number; principalDid: string },
+): Promise<boolean> {
+  const row = await db.prepare(
+    `SELECT 1 AS allowed
+     FROM spaces_access_entries access
+     JOIN isolated_projection_partitions visible
+       ON visible.scope_key = access.scope_key
+      AND visible.partition_key = access.partition_key
+      AND visible.visible_generation = access.partition_generation
+     WHERE access.space_uri = ? AND access.space_generation = ?
+       AND access.principal_did = ?
+     LIMIT 1`,
+  ).bind(input.spaceUri, input.spaceGeneration, input.principalDid).first();
+  return row !== null;
+}
+
+export async function listProjectedAccessibleSpaceWatches(
+  db: Database,
+  input: { principalDid: string; cursor?: string; limit: number },
+): Promise<SpaceWatch[]> {
+  const limit = Math.max(1, Math.min(201, Math.trunc(input.limit)));
+  const rows = await db.prepare(
+    `SELECT space_uri, authority_did, space_type, generation, status,
+            registration_expires_at, next_reconcile_at, last_reconciled_at, last_error
+     FROM spaces_watches watch
+     WHERE watch.status = 'active' AND watch.space_uri > ?
+       AND (
+         watch.authority_did = ?
+         OR EXISTS (
+           SELECT 1
+           FROM spaces_access_entries access
+           JOIN isolated_projection_partitions visible
+             ON visible.scope_key = access.scope_key
+            AND visible.partition_key = access.partition_key
+            AND visible.visible_generation = access.partition_generation
+           WHERE access.space_uri = watch.space_uri
+             AND access.space_generation = watch.generation
+             AND access.principal_did = ?
+         )
+       )
+     ORDER BY watch.space_uri
+     LIMIT ?`,
+  ).bind(
+    input.cursor ?? "",
+    input.principalDid,
+    input.principalDid,
+    limit,
+  ).all<Record<string, unknown>>();
+  return (rows.results ?? []).map(rowToWatch);
+}
+
 export async function listDueWatches(
   db: Database,
   now: number,
@@ -597,8 +812,18 @@ export async function purgeSpaceGeneration(
     kind: "isolated",
     key: spaceProjectionKey(watch.spaceUri, watch.generation),
   });
-  await db.prepare(
-    `DELETE FROM spaces_repo_state
-     WHERE space_uri = ? AND space_generation = ?`,
-  ).bind(watch.spaceUri, watch.generation).run();
+  await db.batch([
+    db.prepare(
+      `DELETE FROM spaces_repo_state
+       WHERE space_uri = ? AND space_generation = ?`,
+    ).bind(watch.spaceUri, watch.generation),
+    db.prepare(
+      `DELETE FROM spaces_access_entries
+       WHERE space_uri = ? AND space_generation = ?`,
+    ).bind(watch.spaceUri, watch.generation),
+    db.prepare(
+      `DELETE FROM spaces_access_index_state
+       WHERE space_uri = ? AND space_generation = ?`,
+    ).bind(watch.spaceUri, watch.generation),
+  ]);
 }
diff --git a/packages/contrail-spaces-alpha/src/sync.ts b/packages/contrail-spaces-alpha/src/sync.ts
index 826c4cc..8fec499 100644
--- a/packages/contrail-spaces-alpha/src/sync.ts
+++ b/packages/contrail-spaces-alpha/src/sync.ts
@@ -12,11 +12,13 @@ import {
   deleteIsolatedPartitionGeneration,
   hideIsolatedPartitionStatement,
   ingestRecords,
+  queryIsolatedRecords,
   rebuildIsolatedCountsStatements,
   recordTimeUs,
   type ContrailConfig,
   type Database,
   type IngestEvent,
+  type Statement,
 } from "@atmo-dev/contrail";
 import {
   getRepoCar,
@@ -33,9 +35,13 @@ import {
 import {
   acquireSyncLease,
   deleteRepoState,
+  deleteSpaceAccessEntryStatement,
+  deleteSpaceAccessPartitionGeneration,
   getRepoState,
   getSpaceWatch,
+  getVisibleSpaceWriterGeneration,
   hideDeletedSpace,
+  listActiveSpaceWatches,
   listDueWatches,
   listRepoStates,
   loadCredential,
@@ -43,16 +49,36 @@ import {
   purgeSpaceGeneration,
   releaseSyncLease,
   renewSyncLease,
+  replaceSpaceAccessIndex,
   saveRepoStateStatement,
+  spaceAccessIndexPolicyKey,
   updateWatch,
+  upsertSpaceAccessEntryStatement,
+  type SpaceAccessEntryInput,
   type SpaceRepoState,
   type SpaceWatch,
 } from "./storage";
 import { formatSpaceRecordUri, parseSpaceUri, spaceProjectionKey } from "./uri";
 
+export interface AuthorityRecordMembershipPolicy {
+  kind: "authority-record-membership";
+  collection: string;
+  principalField: string;
+}
+
+export function authorityRecordMembership(
+  input: Omit<AuthorityRecordMembershipPolicy, "kind">,
+): AuthorityRecordMembershipPolicy {
+  return { kind: "authority-record-membership", ...input };
+}
+
 export interface SpaceTypeConfig {
   collections: readonly string[];
   skey?: string;
+  /** Built-in, materialized access policy for owner-controlled membership. */
+  access?: AuthorityRecordMembershipPolicy;
+  /** Additional collections projected only from the Space authority's repo. */
+  authorityOnlyCollections?: readonly string[];
   /** Require this provider to be the managing app. Defaults to true. Set false
    * only for a deliberately supported upstream-owned policy. */
   requireManagingApp?: boolean;
@@ -102,8 +128,140 @@ function asSignedCommit(input: SignedCommitInput): SignedCommit {
   return input as SignedCommit;
 }
 
-function configuredCollections(config: SpacesSyncConfig, spaceType: string): Set<string> {
-  return new Set(config.spaceTypes[spaceType]?.collections ?? []);
+function collectionAllowed(
+  config: SpacesSyncConfig,
+  watch: SpaceWatch,
+  repoDid: string,
+  collection: string,
+): boolean {
+  const type = config.spaceTypes[watch.spaceType];
+  if (!type?.collections.includes(collection)) return false;
+  const authorityOnly = type.authorityOnlyCollections?.includes(collection) ||
+    type.access?.collection === collection;
+  return !authorityOnly || repoDid === watch.authorityDid;
+}
+
+const VALID_DID = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
+
+function recordField(record: string | null, field: string): unknown {
+  if (record === null) return undefined;
+  let value: unknown = JSON.parse(record);
+  for (const segment of field.split(".")) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+    value = (value as Record<string, unknown>)[segment];
+  }
+  return value;
+}
+
+function accessProjectionStatements(
+  db: Database,
+  config: SpacesSyncConfig,
+  watch: SpaceWatch,
+  partition: string,
+  partitionGeneration: number,
+  events: readonly IngestEvent[],
+): Statement[] {
+  const policy = config.spaceTypes[watch.spaceType]?.access;
+  if (!policy || partition !== watch.authorityDid) return [];
+  const scopeKey = spaceProjectionKey(watch.spaceUri, watch.generation);
+  return events
+    .filter((event) => event.collection === policy.collection)
+    .map((event) => {
+      const identity = {
+        scopeKey,
+        partitionKey: partition,
+        partitionGeneration,
+        sourceUri: event.uri,
+      };
+      if (event.operation === "delete") {
+        return deleteSpaceAccessEntryStatement(db, identity);
+      }
+      const principalDid = recordField(event.record, policy.principalField);
+      if (typeof principalDid !== "string" || !VALID_DID.test(principalDid)) {
+        throw new Error(
+          `Membership record ${event.uri} has an invalid ${policy.principalField}`,
+        );
+      }
+      return upsertSpaceAccessEntryStatement(db, {
+        ...identity,
+        spaceUri: watch.spaceUri,
+        spaceGeneration: watch.generation,
+        principalDid,
+        sourceCid: event.cid,
+      });
+    });
+}
+
+/** Additive migration for policies enabled after records were already
+ * projected. New incremental/full syncs maintain the index transactionally. */
+export async function initializeSpaceAccessPolicies(
+  db: Database,
+  config: Pick<SpacesSyncConfig, "projection" | "spaceTypes">,
+): Promise<void> {
+  let watchCursor: string | undefined;
+  while (true) {
+    const watches = await listActiveSpaceWatches(db, 200, watchCursor);
+    for (const watch of watches) {
+      const policy = config.spaceTypes[watch.spaceType]?.access;
+      if (!policy) continue;
+      const policyKey = JSON.stringify([policy.kind, policy.collection, policy.principalField]);
+      const existingKey = await spaceAccessIndexPolicyKey(db, {
+        spaceUri: watch.spaceUri,
+        spaceGeneration: watch.generation,
+      });
+      if (existingKey === policyKey) continue;
+      const short = Object.entries(config.projection.collections).find(
+        ([, collection]) => collection.collection === policy.collection,
+      )?.[0];
+      if (!short) throw new Error(`Unknown membership collection ${policy.collection}`);
+      const scopeKey = spaceProjectionKey(watch.spaceUri, watch.generation);
+      const partitionGeneration = await getVisibleSpaceWriterGeneration(db, {
+        scopeKey,
+        partitionKey: watch.authorityDid,
+      });
+      const entries: SpaceAccessEntryInput[] = [];
+      if (partitionGeneration !== null) {
+        let cursor: string | undefined;
+        do {
+          const page = await queryIsolatedRecords(db, config.projection, {
+            scope: { kind: "isolated", key: scopeKey },
+            collection: short,
+            did: watch.authorityDid,
+            limit: 200,
+            cursor,
+          });
+          for (const row of page.records) {
+            const principalDid = recordField(
+              typeof row.record === "string" ? row.record : JSON.stringify(row.record),
+              policy.principalField,
+            );
+            if (typeof principalDid !== "string" || !VALID_DID.test(principalDid)) {
+              throw new Error(`Membership record ${row.uri} has an invalid principal`);
+            }
+            entries.push({
+              spaceUri: watch.spaceUri,
+              spaceGeneration: watch.generation,
+              scopeKey,
+              partitionKey: watch.authorityDid,
+              partitionGeneration,
+              principalDid,
+              sourceUri: String(row.uri),
+              sourceCid: row.cid === null ? null : String(row.cid),
+            });
+          }
+          cursor = page.cursor;
+        } while (cursor);
+      }
+      await replaceSpaceAccessIndex(db, {
+        spaceUri: watch.spaceUri,
+        spaceGeneration: watch.generation,
+        policyKey,
+        entries,
+      });
+    }
+    if (watches.length < 200) break;
+    watchCursor = watches.at(-1)!.spaceUri;
+  }
 }
 
 export class SpacesSyncEngine {
@@ -373,7 +531,6 @@ export class SpacesSyncEngine {
     const events: IngestEvent[] = [];
     let cursor: string | undefined;
     let commit: SignedCommit | undefined;
-    const allowed = configuredCollections(this.config, watch.spaceType);
     do {
       const page = await listRepoOps(transport, writerPds, {
         space: watch.spaceUri,
@@ -389,7 +546,12 @@ export class SpacesSyncEngine {
           cid: operation.cid ? parseCid(operation.cid) : null,
           prev: operation.prev ? parseCid(operation.prev) : null,
         });
-        if (!allowed.has(operation.collection)) continue;
+        if (!collectionAllowed(
+          this.config,
+          watch,
+          local.repoDid,
+          operation.collection,
+        )) continue;
         if (operation.cid && operation.value === undefined) {
           throw new Error("Incremental operation omitted its record value");
         }
@@ -469,7 +631,17 @@ export class SpacesSyncEngine {
           partition: local.repoDid,
           generation: local.visibleWriterGeneration,
         }),
-        trailingStatements: [checkpoint],
+        trailingStatements: [
+          ...accessProjectionStatements(
+            this.db,
+            this.config,
+            watch,
+            local.repoDid,
+            local.visibleWriterGeneration,
+            events,
+          ),
+          checkpoint,
+        ],
         skipDiagnostics: true,
       });
     } else {
@@ -505,11 +677,10 @@ export class SpacesSyncEngine {
         { space: watch.spaceUri, author: repoDid, didKey: refreshed },
       );
     }
-    const allowed = configuredCollections(this.config, watch.spaceType);
     const events: IngestEvent[] = [];
     const observedAt = Date.now() * 1000;
     for (const record of recovered.records) {
-      if (!allowed.has(record.collection)) continue;
+      if (!collectionAllowed(this.config, watch, repoDid, record.collection)) continue;
       events.push(createIngestEvent({
         uri: formatSpaceRecordUri({
           spaceUri: watch.spaceUri,
@@ -545,16 +716,30 @@ export class SpacesSyncEngine {
     };
     await assertLease();
     await deleteIsolatedPartitionGeneration(this.db, this.config.projection, target);
+    await deleteSpaceAccessPartitionGeneration(this.db, {
+      scopeKey: target.scope.key,
+      partitionKey: target.partition,
+      partitionGeneration: target.generation,
+    });
     const chunkSize = this.config.maxAtomicMutations ?? 10;
     for (let offset = 0; offset < events.length; offset += chunkSize) {
       await assertLease();
+      const chunk = events.slice(offset, offset + chunkSize);
       await ingestRecords(
         this.db,
-        events.slice(offset, offset + chunkSize),
+        chunk,
         this.config.projection,
         {
           projection: createIsolatedProjection(target),
           authoritativeSourceObservation: true,
+          trailingStatements: accessProjectionStatements(
+            this.db,
+            this.config,
+            watch,
+            repoDid,
+            writerGeneration,
+            chunk,
+          ),
           skipDiagnostics: true,
         },
       );
@@ -588,6 +773,11 @@ export class SpacesSyncEngine {
         partition: repoDid,
         generation: prior.visibleWriterGeneration,
       });
+      await deleteSpaceAccessPartitionGeneration(this.db, {
+        scopeKey: this.scope(watch).key,
+        partitionKey: repoDid,
+        partitionGeneration: prior.visibleWriterGeneration,
+      });
     }
   }
 
@@ -615,6 +805,11 @@ export class SpacesSyncEngine {
       partition: state.repoDid,
       generation: state.visibleWriterGeneration,
     });
+    await deleteSpaceAccessPartitionGeneration(this.db, {
+      scopeKey: this.scope(watch).key,
+      partitionKey: state.repoDid,
+      partitionGeneration: state.visibleWriterGeneration,
+    });
     await this.config.onInvalidate?.(watch.spaceUri);
   }
 }
diff --git a/packages/contrail-spaces-alpha/src/worker.ts b/packages/contrail-spaces-alpha/src/worker.ts
index d516d77..e0ded61 100644
--- a/packages/contrail-spaces-alpha/src/worker.ts
+++ b/packages/contrail-spaces-alpha/src/worker.ts
@@ -17,8 +17,10 @@ import {
   ensureSpaceWatch,
   getSpaceWatch,
   hasAccessLease,
+  hasProjectedSpaceAccess,
   hideDeletedSpace,
   initSpacesStorage,
+  listProjectedAccessibleSpaceWatches,
   purgeSpaceGeneration,
   rediscoverSpace,
   saveAccessLease,
@@ -27,6 +29,7 @@ import {
   type SpaceWatch,
 } from "./storage";
 import {
+  initializeSpaceAccessPolicies,
   SpacesSyncEngine,
   type SpaceTypeConfig,
 } from "./sync";
@@ -34,6 +37,8 @@ import { parseSpaceUri, spaceProjectionKey } from "./uri";
 
 export const AUTHORIZE_SPACE_METHOD = "authorizeSpace";
 export const SYNC_SPACE_METHOD = "syncSpace";
+export const SUBSCRIBE_SPACE_METHOD = "subscribeSpace";
+export const LIST_SPACES_METHOD = "listSpaces";
 export const LIST_SPACE_RECORDS_METHOD = "listSpaceRecords";
 export const GET_SPACE_RECORD_METHOD = "getSpaceRecord";
 
@@ -68,6 +73,12 @@ export interface SpacesWorkerOptions<Env extends SpacesWorkerEnv = SpacesWorkerE
       input: SpaceAuthorizationInput,
       context: { env: Env; db: Database },
     ): boolean | Promise<boolean>;
+    /** Optional inverse lookup for custom policies. Built-in membership
+     * policies are enumerated from the materialized access index. */
+    listSpaces?(
+      userDid: string,
+      context: { env: Env; db: Database },
+    ): readonly string[] | Promise<readonly string[]>;
   };
   accessLeaseMs?: number;
   reconcileIntervalMs?: number;
@@ -78,6 +89,11 @@ export interface SpacesWorkerOptions<Env extends SpacesWorkerEnv = SpacesWorkerE
     additionalAllowedHosts?: string[];
     fetch?: typeof globalThis.fetch;
   };
+  /** Optional Cloudflare Durable Object fan-out for browser invalidations. */
+  subscriptions?: {
+    binding?: string;
+    ticketTtlMs?: number;
+  };
   onInvalidate?: (spaceUri: string, env: Env) => void | Promise<void>;
 }
 
@@ -103,6 +119,107 @@ function privateJson(value: unknown, status = 200): Response {
   return json(value, status, { "cache-control": "private, no-store" });
 }
 
+interface SubscriptionTicket {
+  expiresAt: number;
+}
+
+/** Hibernating Cloudflare WebSocket fan-out, keyed by Space URI through its
+ * Durable Object ID. Tickets are issued only by the authenticated Worker XRPC
+ * route and consumed once during the browser upgrade. */
+export class SpaceSubscriptionHub {
+  constructor(private readonly state: DurableObjectState) {}
+
+  async fetch(request: Request): Promise<Response> {
+    const url = new URL(request.url);
+    if (request.method === "POST" && url.pathname === "/issue") {
+      const body = await request.json() as { ticket?: unknown; expiresAt?: unknown };
+      if (typeof body.ticket !== "string" || body.ticket.length < 16 ||
+        typeof body.expiresAt !== "number" || body.expiresAt <= Date.now()) {
+        return json({ error: "InvalidTicket" }, 400);
+      }
+      await this.state.storage.put<SubscriptionTicket>(`ticket:${body.ticket}`, {
+        expiresAt: body.expiresAt,
+      });
+      const alarm = await this.state.storage.getAlarm();
+      if (alarm === null || alarm > body.expiresAt) {
+        await this.state.storage.setAlarm(body.expiresAt);
+      }
+      return json({ issued: true });
+    }
+    if (request.method === "POST" && url.pathname === "/broadcast") {
+      const payload = await request.text();
+      if (payload.length > 8 * 1024) return json({ error: "MessageTooLarge" }, 413);
+      for (const socket of this.state.getWebSockets()) {
+        try {
+          socket.send(payload);
+        } catch {
+          try {
+            socket.close(1011, "Delivery failed");
+          } catch {
+            // The socket is already gone.
+          }
+        }
+      }
+      return json({ delivered: this.state.getWebSockets().length });
+    }
+    if (request.method === "GET" && url.pathname === "/connect") {
+      if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") {
+        return json({ error: "UpgradeRequired" }, 426);
+      }
+      const ticket = url.searchParams.get("ticket");
+      if (!ticket) return json({ error: "InvalidTicket" }, 401);
+      const key = `ticket:${ticket}`;
+      const grant = await this.state.storage.get<SubscriptionTicket>(key);
+      await this.state.storage.delete(key);
+      if (!grant || grant.expiresAt <= Date.now()) {
+        return json({ error: "InvalidTicket" }, 401);
+      }
+      const pair = new WebSocketPair();
+      const client = pair[0];
+      const server = pair[1];
+      this.state.acceptWebSocket(server);
+      server.send(JSON.stringify({ type: "ready" }));
+      return new Response(null, { status: 101, webSocket: client });
+    }
+    return json({ error: "NotFound" }, 404);
+  }
+
+  webSocketMessage(socket: WebSocket, message: ArrayBuffer | string): void {
+    if (message === "ping") socket.send("pong");
+  }
+
+  webSocketClose(socket: WebSocket, code: number, reason: string): void {
+    try {
+      socket.close(code, reason);
+    } catch {
+      // Workerd may already have completed the close handshake.
+    }
+  }
+
+  webSocketError(socket: WebSocket): void {
+    try {
+      socket.close(1011, "WebSocket error");
+    } catch {
+      // The socket is already gone.
+    }
+  }
+
+  async alarm(): Promise<void> {
+    const now = Date.now();
+    const tickets = await this.state.storage.list<SubscriptionTicket>({
+      prefix: "ticket:",
+    });
+    const expired: string[] = [];
+    let next: number | undefined;
+    for (const [key, ticket] of tickets) {
+      if (ticket.expiresAt <= now) expired.push(key);
+      else next = Math.min(next ?? ticket.expiresAt, ticket.expiresAt);
+    }
+    if (expired.length) await this.state.storage.delete(expired);
+    if (next !== undefined) await this.state.storage.setAlarm(next);
+  }
+}
+
 async function boundedJsonBody<T>(request: Request, maximum = 64 * 1024): Promise<T> {
   const declaredHeader = request.headers.get("content-length");
   const declared = declaredHeader === null ? null : Number(declaredHeader);
@@ -233,7 +350,7 @@ function parsedRecord(row: Record<string, unknown>): Record<string, unknown> {
   };
 }
 
-function buildProviderLexicons(config: ContrailConfig): object[] {
+function buildProviderLexicons(config: ContrailConfig, subscriptions: boolean): object[] {
   const namespace = config.namespace;
   const recordOutput = {
     type: "object",
@@ -280,6 +397,44 @@ function buildProviderLexicons(config: ContrailConfig): object[] {
         } } },
       } },
     },
+    ...(subscriptions ? [{
+      lexicon: 1,
+      id: `${namespace}.${SUBSCRIBE_SPACE_METHOD}`,
+      defs: { main: {
+        type: "procedure",
+        input: { encoding: "application/json", schema: { type: "object", required: ["space"], properties: {
+          space: { type: "string", format: "uri" },
+        } } },
+        output: { encoding: "application/json", schema: { type: "object", required: ["url", "expiresAt"], properties: {
+          url: { type: "string", format: "uri" },
+          expiresAt: { type: "string", format: "datetime" },
+        } } },
+      } },
+    }] : []),
+    {
+      lexicon: 1,
+      id: `${namespace}.${LIST_SPACES_METHOD}`,
+      defs: { main: {
+        type: "query",
+        parameters: { type: "params", properties: {
+          cursor: { type: "string" },
+          limit: { type: "integer", minimum: 1, maximum: 200 },
+        } },
+        output: { encoding: "application/json", schema: {
+          type: "object",
+          required: ["spaces", "truncated"],
+          properties: {
+            spaces: { type: "array", items: { type: "object", required: ["uri", "authorityDid", "type"], properties: {
+              uri: { type: "string", format: "uri" },
+              authorityDid: { type: "string", format: "did" },
+              type: { type: "string", format: "nsid" },
+            } } },
+            cursor: { type: "string" },
+            truncated: { type: "boolean" },
+          },
+        } },
+      } },
+    },
     ...Object.entries(config.collections).flatMap(([short, collection]) => {
       const parameters: Record<string, unknown> = {
         space: { type: "string", format: "uri" },
@@ -363,17 +518,40 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
     (!Number.isSafeInteger(options.maxRepoCarBytes) || options.maxRepoCarBytes < 1)) {
     throw new TypeError("maxRepoCarBytes must be a positive integer");
   }
+  if (options.subscriptions?.ticketTtlMs !== undefined &&
+    (!Number.isSafeInteger(options.subscriptions.ticketTtlMs) ||
+      options.subscriptions.ticketTtlMs < 1_000 ||
+      options.subscriptions.ticketTtlMs > 5 * 60_000)) {
+    throw new TypeError("subscription ticketTtlMs must be from 1000 through 300000");
+  }
   if (!options.lexicons?.length) {
     throw new TypeError("Spaces providers require a pinned runtime Lexicon bundle");
   }
   bindRecordValidationLexicons(projection, options.lexicons);
   prepareRecordValidation(projection);
   for (const [spaceType, type] of Object.entries(options.spaceTypes)) {
-    if (type.requireManagingApp !== false && !options.authorization) {
+    if (type.requireManagingApp !== false && !type.access && !options.authorization) {
       throw new TypeError(
-        `Space type ${spaceType} requires an authoritative managing-app authorizer`,
+        `Space type ${spaceType} requires an authoritative managing-app access policy`,
       );
     }
+    if (type.access) {
+      if (!type.collections.includes(type.access.collection)) {
+        throw new TypeError(
+          `Membership collection ${type.access.collection} is not allowed by Space type ${spaceType}`,
+        );
+      }
+      if (!/^[a-zA-Z0-9_.]+$/.test(type.access.principalField)) {
+        throw new TypeError(`Invalid membership principal field ${type.access.principalField}`);
+      }
+    }
+    for (const nsid of type.authorityOnlyCollections ?? []) {
+      if (!type.collections.includes(nsid)) {
+        throw new TypeError(
+          `Authority-only collection ${nsid} is not allowed by Space type ${spaceType}`,
+        );
+      }
+    }
     for (const nsid of type.collections) {
       const collection = Object.values(projection.collections).find(
         (candidate) => candidate.collection === nsid,
@@ -393,10 +571,15 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
   const encryptionBinding =
     options.bindings?.credentialEncryptionKey ?? "SPACES_CREDENTIAL_ENCRYPTION_KEY";
   const queueBinding = options.bindings?.queue ?? "SPACES_QUEUE";
-  const providerLexicons = buildProviderLexicons(projection);
+  const subscriptionsEnabled = options.subscriptions !== undefined;
+  const subscriptionBinding = options.subscriptions?.binding ?? "SPACE_SUBSCRIPTIONS";
+  const subscriptionTicketTtlMs = options.subscriptions?.ticketTtlMs ?? 30_000;
+  const providerLexicons = buildProviderLexicons(projection, subscriptionsEnabled);
   const exactMethods = [
     `${namespace}.${AUTHORIZE_SPACE_METHOD}`,
     `${namespace}.${SYNC_SPACE_METHOD}`,
+    `${namespace}.${LIST_SPACES_METHOD}`,
+    ...(subscriptionsEnabled ? [`${namespace}.${SUBSCRIBE_SPACE_METHOD}`] : []),
     "com.atproto.space.notifyWrite",
     "com.atproto.space.notifySpaceDeleted",
     "com.atproto.simplespace.checkUserAccess",
@@ -413,11 +596,51 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
   });
   const initialized = new WeakMap<object, Promise<void>>();
 
+  const subscriptionHub = (env: Env, spaceUri: string): DurableObjectStub => {
+    const binding = env[subscriptionBinding] as DurableObjectNamespace | undefined;
+    if (!binding || typeof binding.idFromName !== "function" ||
+      typeof binding.get !== "function") {
+      throw new Error(`Missing Durable Object binding ${subscriptionBinding}`);
+    }
+    return binding.get(binding.idFromName(spaceUri));
+  };
+
+  const invalidate = async (spaceUri: string, env: Env): Promise<void> => {
+    if (subscriptionsEnabled) {
+      try {
+        const response = await subscriptionHub(env, spaceUri).fetch(
+          new Request("https://subscriptions.internal/broadcast", {
+            method: "POST",
+            body: JSON.stringify({
+              type: "invalidate",
+              space: spaceUri,
+              at: new Date().toISOString(),
+            }),
+          }),
+        );
+        if (!response.ok) {
+          console.warn(`[spaces] subscription broadcast failed (${response.status})`);
+        }
+      } catch (error) {
+        // Projection commits must not roll back or be retried because a live
+        // browser invalidation could not be delivered.
+        console.warn("[spaces] subscription broadcast failed", error);
+      }
+    }
+    await options.onInvalidate?.(spaceUri, env);
+  };
+
   const runtime = (env: Env) => {
     const db = databaseFrom(env, dbBinding);
     let init = initialized.get(db as object);
     if (!init) {
-      init = initSpacesStorage(db, projection);
+      init = (async () => {
+        await initSpacesStorage(db, projection);
+        await initializeSpaceAccessPolicies(db, {
+          projection,
+          spaceTypes: options.spaceTypes,
+        });
+      })();
       initialized.set(db as object, init);
     }
     const engine = new SpacesSyncEngine(db, {
@@ -429,8 +652,8 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
       maxAtomicMutations: options.maxAtomicMutations,
       maxRepoCarBytes: options.maxRepoCarBytes,
       protocol: options.protocol,
-      onInvalidate: options.onInvalidate
-        ? (space) => options.onInvalidate!(space, env)
+      onInvalidate: subscriptionsEnabled || options.onInvalidate
+        ? (space) => invalidate(space, env)
         : undefined,
     });
     return { db, init, engine };
@@ -459,6 +682,15 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
     watch: SpaceWatch,
     input: SpaceAuthorizationInput,
   ): Promise<boolean> => {
+    if (input.userDid === watch.authorityDid) return true;
+    const policy = options.spaceTypes[watch.spaceType]?.access;
+    if (policy?.kind === "authority-record-membership") {
+      return hasProjectedSpaceAccess(db, {
+        principalDid: input.userDid,
+        spaceUri: input.spaceUri,
+        spaceGeneration: watch.generation,
+      });
+    }
     if (options.authorization) {
       return options.authorization.authorize(input, { env, db });
     }
@@ -476,6 +708,23 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
   ): Promise<Response> => {
     const url = new URL(request.url);
     if (url.href.length > 16 * 1024) return json({ error: "RequestUriTooLong" }, 414);
+    if (subscriptionsEnabled && url.pathname === "/subscribe" && request.method === "GET") {
+      try {
+        const parsed = parseSpaceUri(url.searchParams.get("space"));
+        const ticket = url.searchParams.get("ticket");
+        if (!ticket || !/^[A-Za-z0-9_-]{16,128}$/.test(ticket)) {
+          return json({ error: "InvalidTicket" }, 401);
+        }
+        const internal = new URL("https://subscriptions.internal/connect");
+        internal.searchParams.set("ticket", ticket);
+        return subscriptionHub(env, parsed.uri).fetch(new Request(internal, {
+          method: "GET",
+          headers: request.headers,
+        }));
+      } catch {
+        return json({ error: "InvalidSubscription" }, 400);
+      }
+    }
     if (url.pathname === "/.well-known/did.json" && request.method === "GET") {
       return json({
         "@context": ["https://www.w3.org/ns/did/v1"],
@@ -631,6 +880,93 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
       return privateJson({ queued: true }, 202);
     }
 
+    if (method === `${namespace}.${LIST_SPACES_METHOD}` && request.method === "GET") {
+      const verified = await authorizeRequest(request, method);
+      if (verified.response) return verified.response;
+      const requestedLimit = Number(url.searchParams.get("limit") ?? 100);
+      const cursor = url.searchParams.get("cursor") ?? undefined;
+      if (!Number.isInteger(requestedLimit) || requestedLimit < 1 ||
+        requestedLimit > 200 || (cursor?.length ?? 0) > 2_048) {
+        return privateJson({ error: "InvalidRequest" }, 400);
+      }
+      const indexed = await listProjectedAccessibleSpaceWatches(db, {
+        principalDid: verified.did!,
+        cursor,
+        limit: requestedLimit + 1,
+      });
+      const watches = new Map(indexed.map((watch) => [watch.spaceUri, watch]));
+      let customTruncated = false;
+      if (options.authorization?.listSpaces) {
+        const listed = await options.authorization.listSpaces(verified.did!, { env, db });
+        customTruncated = listed.length > 1_000;
+        for (const spaceUri of listed.slice(0, 1_000)) {
+          if (typeof spaceUri !== "string" || spaceUri <= (cursor ?? "")) continue;
+          try {
+            parseSpaceUri(spaceUri);
+          } catch {
+            continue;
+          }
+          const watch = await getSpaceWatch(db, spaceUri);
+          if (!watch || watch.status !== "active") continue;
+          if (await accessAllowed(env, db, watch, {
+            userDid: verified.did!,
+            spaceUri,
+            action: "read",
+            method,
+          })) watches.set(spaceUri, watch);
+        }
+      }
+      const ordered = [...watches.values()].sort((a, b) =>
+        a.spaceUri.localeCompare(b.spaceUri)
+      );
+      const truncated = customTruncated || ordered.length > requestedLimit;
+      const page = ordered.slice(0, requestedLimit);
+      const spaces = page.map((watch) => ({
+        uri: watch.spaceUri,
+        authorityDid: watch.authorityDid,
+        type: watch.spaceType,
+      }));
+      return privateJson({
+        spaces,
+        truncated,
+        ...(truncated && page.length ? { cursor: page.at(-1)!.spaceUri } : {}),
+      });
+    }
+
+    if (
+      subscriptionsEnabled &&
+      method === `${namespace}.${SUBSCRIBE_SPACE_METHOD}` &&
+      request.method === "POST"
+    ) {
+      const verified = await authorizeRequest(request, method);
+      if (verified.response) return verified.response;
+      const body = await boundedJsonBody<{ space?: unknown }>(request);
+      const parsed = parseSpaceUri(body.space);
+      const watch = await getSpaceWatch(db, parsed.uri);
+      if (!watch || watch.status === "hidden") return privateJson({ error: "SpaceNotFound" }, 404);
+      if (!await accessAllowed(env, db, watch, {
+        userDid: verified.did!, spaceUri: parsed.uri, action: "read", method,
+      })) return privateJson({ error: "Forbidden" }, 403);
+      const ticket = crypto.randomUUID().replaceAll("-", "");
+      const expiresAt = Date.now() + subscriptionTicketTtlMs;
+      const issued = await subscriptionHub(env, parsed.uri).fetch(
+        new Request("https://subscriptions.internal/issue", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ ticket, expiresAt }),
+        }),
+      );
+      if (!issued.ok) return privateJson({ error: "SubscriptionUnavailable" }, 503);
+      const socketUrl = new URL("/subscribe", options.service.endpoint);
+      socketUrl.protocol = socketUrl.protocol === "http:" ? "ws:" : "wss:";
+      socketUrl.searchParams.set("space", parsed.uri);
+      socketUrl.searchParams.set("ticket", ticket);
+      return privateJson({
+        url: socketUrl.href,
+        expiresAt: new Date(expiresAt).toISOString(),
+      });
+    }
+
     if (method === "com.atproto.space.notifyWrite" && request.method === "POST") {
       const verified = await authorizeRequest(request, method);
       if (verified.response) return verified.response;
@@ -681,7 +1017,7 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
         await hideDeletedSpace(db, watch);
         ctx.waitUntil((async () => {
           await purgeSpaceGeneration(db, projection, watch);
-          await options.onInvalidate?.(parsed.uri, env);
+          await invalidate(parsed.uri, env);
         })());
       }
       return json({}, 200);
@@ -698,23 +1034,23 @@ export function createSpacesWorker<Env extends SpacesWorkerEnv = SpacesWorkerEnv
       if (!userDid) return json({ error: "InvalidRequest" }, 400);
       if (verified.did !== parsed.authorityDid) return json({ error: "InvalidIssuer" }, 403);
       const watch = await getSpaceWatch(db, parsed.uri);
-      let authorized = false;
-      if (options.authorization) {
-        // Credential exchange may invoke policy before the first watch, or for
-        // a verified recreation while the old generation remains hidden.
-        authorized = await options.authorization.authorize({
+      let authorized = userDid === parsed.authorityDid;
+      if (!authorized && watch?.status === "active") {
+        authorized = await accessAllowed(env, db, watch, {
           userDid,
           spaceUri: parsed.uri,
           action: "read",
           method,
-        }, { env, db });
-      } else if (watch && watch.status !== "hidden") {
-        authorized = await accessAllowed(env, db, watch, {
+        });
+      } else if (!authorized && options.authorization) {
+        // A custom policy may authorize before the first watch, or for a
+        // verified recreation while the old generation remains hidden.
+        authorized = await options.authorization.authorize({
           userDid,
           spaceUri: parsed.uri,
           action: "read",
           method,
-        });
+        }, { env, db });
       }
       return json({ authorized });
     }
diff --git a/packages/contrail-spaces-alpha/tests/access.test.ts b/packages/contrail-spaces-alpha/tests/access.test.ts
new file mode 100644
index 0000000..b9b19c4
--- /dev/null
+++ b/packages/contrail-spaces-alpha/tests/access.test.ts
@@ -0,0 +1,107 @@
+import {
+  createIngestEvent,
+  createIsolatedProjection,
+  ingestRecords,
+  resolveConfig,
+} from "@atmo-dev/contrail";
+import { createSqliteDatabase } from "@atmo-dev/contrail/sqlite";
+import { describe, expect, it } from "vitest";
+import {
+  hasProjectedSpaceAccess,
+  initSpacesStorage,
+  ensureSpaceWatch,
+} from "../src/storage";
+import {
+  authorityRecordMembership,
+  initializeSpaceAccessPolicies,
+} from "../src/sync";
+import { spaceProjectionKey } from "../src/uri";
+
+const space = "at://did:plc:alice/space/garden.atmo.circle/self";
+const memberCollection = "garden.atmo.circle.member";
+const projection = resolveConfig({
+  namespace: "garden.atmo.circle",
+  profiles: [],
+  collections: {
+    member: {
+      collection: memberCollection,
+      queryable: { subject: {} },
+    },
+  },
+});
+
+function memberEvent(writer: string, rkey: string, subject: string) {
+  return createIngestEvent({
+    uri: `${space}/${writer}/${memberCollection}/${rkey}`,
+    did: writer,
+    collection: memberCollection,
+    rkey,
+    operation: "create",
+    cid: `bafy-${rkey}`,
+    value: {
+      $type: memberCollection,
+      subject,
+      createdAt: "2026-08-21T00:00:00Z",
+    },
+    timeUs: 1_000_000,
+    source: { id: "access-test", revision: "1", time_us: 1_000_000 },
+  });
+}
+
+describe("materialized Space access policy", () => {
+  it("backfills only authority-authored membership from the visible projection", async () => {
+    const db = createSqliteDatabase(":memory:");
+    await initSpacesStorage(db, projection);
+    const watch = await ensureSpaceWatch(db, { spaceUri: space });
+    const scope = {
+      kind: "isolated" as const,
+      key: spaceProjectionKey(space, watch.generation),
+    };
+    await ingestRecords(db, [
+      memberEvent("did:plc:alice", "owner-member", "did:plc:carol"),
+    ], projection, {
+      projection: createIsolatedProjection({
+        scope,
+        partition: "did:plc:alice",
+        generation: 1,
+        activate: true,
+      }),
+      skipDiagnostics: true,
+    });
+    await ingestRecords(db, [
+      memberEvent("did:plc:bob", "forged-member", "did:plc:dave"),
+    ], projection, {
+      projection: createIsolatedProjection({
+        scope,
+        partition: "did:plc:bob",
+        generation: 1,
+        activate: true,
+      }),
+      skipDiagnostics: true,
+    });
+
+    await initializeSpaceAccessPolicies(db, {
+      projection,
+      spaceTypes: {
+        "garden.atmo.circle": {
+          collections: [memberCollection],
+          access: authorityRecordMembership({
+            collection: memberCollection,
+            principalField: "subject",
+          }),
+        },
+      },
+    });
+
+    expect(await hasProjectedSpaceAccess(db, {
+      spaceUri: space,
+      spaceGeneration: 1,
+      principalDid: "did:plc:carol",
+    })).toBe(true);
+    expect(await hasProjectedSpaceAccess(db, {
+      spaceUri: space,
+      spaceGeneration: 1,
+      principalDid: "did:plc:dave",
+    })).toBe(false);
+  });
+});
diff --git a/packages/contrail-spaces-alpha/tests/consumer.test.ts b/packages/contrail-spaces-alpha/tests/consumer.test.ts
index 9a45a85..364c64c 100644
--- a/packages/contrail-spaces-alpha/tests/consumer.test.ts
+++ b/packages/contrail-spaces-alpha/tests/consumer.test.ts
@@ -22,6 +22,8 @@ describe("consumer scopes", () => {
     });
     expect(scopes[2]).toContain("aud=did:web:spaces.atmo.garden%23spaces");
     expect(scopes[2]).toContain("garden.atmo.circle.note.listSpaceRecords");
+    expect(scopes[2]).toContain("garden.atmo.circle.listSpaces");
+    expect(scopes[2]).toContain("garden.atmo.circle.subscribeSpace");
     expect(scopes[2]).not.toContain("notifyWrite");
   });
 });
diff --git a/packages/contrail-spaces-alpha/tests/protocol.test.ts b/packages/contrail-spaces-alpha/tests/protocol.test.ts
index 8dac3a8..f493b68 100644
--- a/packages/contrail-spaces-alpha/tests/protocol.test.ts
+++ b/packages/contrail-spaces-alpha/tests/protocol.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import {
   getRepoCar,
+  SpaceIdentityResolver,
   type SpaceCredentialTransport,
 } from "../src/protocol";
 
@@ -8,42 +9,61 @@ function transportFor(response: Response): SpaceCredentialTransport {
   return { fetch: async () => response } as unknown as SpaceCredentialTransport;
 }
 
-describe("bounded Space CAR download", () => {
-  it("assembles a streamed CAR within the configured limit", async () => {
-    const response = new Response(new ReadableStream<Uint8Array>({
-      start(controller) {
-        controller.enqueue(Uint8Array.of(1, 2, 3));
-        controller.enqueue(Uint8Array.of(4, 5));
-        controller.close();
+describe("Space protocol transport", () => {
+  it("resolves identities without unsupported redirect:error requests", async () => {
+    const resolver = new SpaceIdentityResolver({
+      fetch: async (_input, init) => {
+        expect(init?.redirect).toBe("manual");
+        return new Response(JSON.stringify({
+          id: "did:plc:alice",
+          service: [{
+            id: "#atproto_pds",
+            type: "AtprotoPersonalDataServer",
+            serviceEndpoint: "https://pds.example",
+          }],
+        }), { headers: { "content-type": "application/json" } });
       },
-    }));
-    const bytes = await getRepoCar(transportFor(response), "https://pds.example", {
-      space: "at://did:plc:alice/space/garden.atmo.circle/self",
-      repo: "did:plc:alice",
-      maxBytes: 5,
     });
-    expect([...bytes]).toEqual([1, 2, 3, 4, 5]);
+    expect(await resolver.resolvePds("did:plc:alice")).toBe("https://pds.example");
   });
 
-  it("cancels a chunked response as soon as it exceeds the limit", async () => {
-    let cancelled = false;
-    const response = new Response(new ReadableStream<Uint8Array>({
-      start(controller) {
-        controller.enqueue(Uint8Array.of(1, 2, 3, 4));
-        controller.enqueue(Uint8Array.of(5, 6, 7, 8));
-      },
-      cancel() {
-        cancelled = true;
-      },
-    }));
-    await expect(getRepoCar(transportFor(response), "https://pds.example", {
-      space: "at://did:plc:alice/space/garden.atmo.circle/self",
-      repo: "did:plc:alice",
-      maxBytes: 6,
-    })).rejects.toMatchObject({
-      status: 413,
-      code: "RepoTooLarge",
+  describe("bounded CAR download", () => {
+    it("assembles a streamed CAR within the configured limit", async () => {
+      const response = new Response(new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(Uint8Array.of(1, 2, 3));
+          controller.enqueue(Uint8Array.of(4, 5));
+          controller.close();
+        },
+      }));
+      const bytes = await getRepoCar(transportFor(response), "https://pds.example", {
+        space: "at://did:plc:alice/space/garden.atmo.circle/self",
+        repo: "did:plc:alice",
+        maxBytes: 5,
+      });
+      expect([...bytes]).toEqual([1, 2, 3, 4, 5]);
+    });
+
+    it("cancels a chunked response as soon as it exceeds the limit", async () => {
+      let cancelled = false;
+      const response = new Response(new ReadableStream<Uint8Array>({
+        start(controller) {
+          controller.enqueue(Uint8Array.of(1, 2, 3, 4));
+          controller.enqueue(Uint8Array.of(5, 6, 7, 8));
+        },
+        cancel() {
+          cancelled = true;
+        },
+      }));
+      await expect(getRepoCar(transportFor(response), "https://pds.example", {
+        space: "at://did:plc:alice/space/garden.atmo.circle/self",
+        repo: "did:plc:alice",
+        maxBytes: 6,
+      })).rejects.toMatchObject({
+        status: 413,
+        code: "RepoTooLarge",
+      });
+      expect(cancelled).toBe(true);
     });
-    expect(cancelled).toBe(true);
   });
 });
diff --git a/packages/contrail-spaces-alpha/tests/storage.test.ts b/packages/contrail-spaces-alpha/tests/storage.test.ts
index 2c8035f..3168902 100644
--- a/packages/contrail-spaces-alpha/tests/storage.test.ts
+++ b/packages/contrail-spaces-alpha/tests/storage.test.ts
@@ -7,13 +7,16 @@ import {
   ensureSpaceWatch,
   getSpaceWatch,
   hasAccessLease,
+  hasProjectedSpaceAccess,
   hideDeletedSpace,
   initSpacesStorage,
+  listProjectedAccessibleSpaceWatches,
   loadCredential,
   rediscoverSpace,
   renewSyncLease,
   saveAccessLease,
   saveCredential,
+  upsertSpaceAccessEntryStatement,
 } from "../src/storage";
 
 const projection = resolveConfig({
@@ -79,6 +82,66 @@ describe("Spaces storage boundaries", () => {
     })).toBe(false);
   });
 
+  it("cuts membership discovery over with the visible writer generation", async () => {
+    const db = createSqliteDatabase(":memory:");
+    await initSpacesStorage(db, projection);
+    await ensureSpaceWatch(db, { spaceUri: space });
+    const scopeKey = `${space}\u00001`;
+    const entry = (principalDid: string, generation: number, sourceUri: string) =>
+      upsertSpaceAccessEntryStatement(db, {
+        spaceUri: space,
+        spaceGeneration: 1,
+        scopeKey,
+        partitionKey: "did:plc:alice",
+        partitionGeneration: generation,
+        principalDid,
+        sourceUri,
+      });
+
+    await entry("did:plc:bob", 2, `${space}/did:plc:alice/member/bob`).run();
+    expect(await hasProjectedSpaceAccess(db, {
+      spaceUri: space,
+      spaceGeneration: 1,
+      principalDid: "did:plc:bob",
+    })).toBe(false);
+
+    await db.prepare(
+      `INSERT INTO isolated_projection_partitions
+         (scope_key, partition_key, visible_generation, updated_at)
+       VALUES (?, ?, 2, 1)`,
+    ).bind(scopeKey, "did:plc:alice").run();
+    expect(await hasProjectedSpaceAccess(db, {
+      spaceUri: space,
+      spaceGeneration: 1,
+      principalDid: "did:plc:bob",
+    })).toBe(true);
+    expect((await listProjectedAccessibleSpaceWatches(db, {
+      principalDid: "did:plc:bob",
+      limit: 10,
+    })).map((watch) => watch.spaceUri)).toEqual([space]);
+
+    await entry("did:plc:carol", 3, `${space}/did:plc:alice/member/carol`).run();
+    expect(await hasProjectedSpaceAccess(db, {
+      spaceUri: space,
+      spaceGeneration: 1,
+      principalDid: "did:plc:carol",
+    })).toBe(false);
+    await db.prepare(
+      `UPDATE isolated_projection_partitions SET visible_generation = 3
+       WHERE scope_key = ? AND partition_key = ?`,
+    ).bind(scopeKey, "did:plc:alice").run();
+    expect(await hasProjectedSpaceAccess(db, {
+      spaceUri: space,
+      spaceGeneration: 1,
+      principalDid: "did:plc:bob",
+    })).toBe(false);
+    expect(await hasProjectedSpaceAccess(db, {
+      spaceUri: space,
+      spaceGeneration: 1,
+      principalDid: "did:plc:carol",
+    })).toBe(true);
+  });
+
   it("allows only one unexpired sync-lease owner and fences stale owners", async () => {
     const db = createSqliteDatabase(":memory:");
     await initSpacesStorage(db, projection);
diff --git a/packages/contrail-spaces-alpha/tests/subscriptions.test.ts b/packages/contrail-spaces-alpha/tests/subscriptions.test.ts
new file mode 100644
index 0000000..601b67e
--- /dev/null
+++ b/packages/contrail-spaces-alpha/tests/subscriptions.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it, vi } from "vitest";
+import { SpaceSubscriptionHub } from "../src/worker";
+
+function stateFor(sockets: Array<{ send: (value: string) => void }> = []) {
+  const values = new Map<string, unknown>();
+  let alarm: number | null = null;
+  return {
+    values,
+    state: {
+      storage: {
+        put: async (key: string, value: unknown) => void values.set(key, value),
+        get: async (key: string) => values.get(key),
+        delete: async (key: string | string[]) => {
+          for (const item of Array.isArray(key) ? key : [key]) values.delete(item);
+          return true;
+        },
+        list: async ({ prefix }: { prefix: string }) => new Map(
+          [...values].filter(([key]) => key.startsWith(prefix)),
+        ),
+        getAlarm: async () => alarm,
+        setAlarm: async (value: number) => void (alarm = value),
+      },
+      getWebSockets: () => sockets,
+    } as unknown as DurableObjectState,
+  };
+}
+
+describe("Space subscription hub", () => {
+  it("stores short-lived one-time connection tickets", async () => {
+    const { state, values } = stateFor();
+    const hub = new SpaceSubscriptionHub(state);
+    const expiresAt = Date.now() + 30_000;
+    const response = await hub.fetch(new Request("https://internal/issue", {
+      method: "POST",
+      body: JSON.stringify({ ticket: "ticket-abcdefghijkl", expiresAt }),
+    }));
+    expect(response.status).toBe(200);
+    expect(values.get("ticket:ticket-abcdefghijkl")).toEqual({ expiresAt });
+  });
+
+  it("broadcasts only an invalidation payload to connected clients", async () => {
+    const send = vi.fn();
+    const { state } = stateFor([{ send }]);
+    const hub = new SpaceSubscriptionHub(state);
+    const payload = JSON.stringify({ type: "invalidate", space: "at://did:plc:a/space/x/self" });
+    const response = await hub.fetch(new Request("https://internal/broadcast", {
+      method: "POST",
+      body: payload,
+    }));
+    expect(response.status).toBe(200);
+    expect(send).toHaveBeenCalledWith(payload);
+  });
+});
diff --git a/packages/contrail-spaces-alpha/tests/worker-query.test.ts b/packages/contrail-spaces-alpha/tests/worker-query.test.ts
index af7d2fe..e14c7ad 100644
--- a/packages/contrail-spaces-alpha/tests/worker-query.test.ts
+++ b/packages/contrail-spaces-alpha/tests/worker-query.test.ts
@@ -15,7 +15,7 @@ import { spaceProjectionKey } from "../src/uri";
 
 const issuer = "did:plc:aaaaaaaaaaaaaaaaaaaaaaaa";
 const audience = "did:web:spaces.atmo.garden#spaces";
-const space = `${"at://did:plc:alice"}/space/garden.atmo.circle/self`;
+const space = `at://${issuer}/space/garden.atmo.circle/self`;
 const collection = "garden.atmo.circle.note";
 let keypair: Secp256k1PrivateKeyExportable;
 
@@ -145,6 +145,21 @@ describe("Spaces Worker private query boundary", () => {
     const body = await response.json() as { records: Array<{ value: { text: string } }> };
     expect(body.records.map((record) => record.value.text)).toEqual(["private hello"]);
 
+    const listSpacesMethod = "garden.atmo.circle.listSpaces";
+    const listSpaces = await worker.fetch!(new Request(
+      `https://spaces.atmo.garden/xrpc/${listSpacesMethod}`,
+      { headers: { authorization: `Bearer ${await token(listSpacesMethod)}` } },
+    ) as never, env, context());
+    expect(listSpaces.status).toBe(200);
+    expect(await listSpaces.json()).toEqual({
+      spaces: [{
+        uri: space,
+        authorityDid: issuer,
+        type: "garden.atmo.circle",
+      }],
+      truncated: false,
+    });
+
     const wrongMethod = new Request(url, {
       headers: {
         authorization: `Bearer ${await token("garden.atmo.circle.syncSpace")}`,
@@ -168,4 +183,22 @@ describe("Spaces Worker private query boundary", () => {
       preferredRepo: "did:plc:unadvertised",
     }]);
   });
+
+  it("rejects authority-only collections outside the Space allow-list", () => {
+    expect(() => createSpacesWorker({
+      projection,
+      lexicons,
+      service: {
+        endpoint: "https://spaces.atmo.garden",
+        audience,
+      },
+      spaceTypes: {
+        "garden.atmo.circle": {
+          collections: [collection],
+          authorityOnlyCollections: ["garden.atmo.circle.member"],
+        },
+      },
+      authorization: { authorize: () => true },
+    })).toThrow(/Authority-only collection/);
+  });
 });
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2e0db38..1a6393f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -149,6 +149,9 @@ importers:
       '@cloudflare/workers-types':
         specifier: ^5.20260804.1
         version: 5.20260804.1
+      tsx:
+        specifier: ^4.21.0
+        version: 4.23.6
       typescript:
         specifier: ^6.0.3
         version: 6.0.3