Two correctness gaps found while chasing why a Bulletin board vanished after creation, both checked against the reference PDS, pds.js, and atproto-crates: - spacePolicyAllowsRequester now authorizes the space authority for its own space before any policy branch. Without it, a managing-app board (which is what Bulletin creates) required the managing app to be reachable and to authorize the owner via checkUserAccess for the owner to read their own data. The reference PDS (authorizeUser) and pds.js (handlers/auth.js) both short-circuit userDid == authority for exactly this reason ("must not be able to lock itself out"). atproto-crates instead always defers managing-app to checkUserAccess; Bulletin's self-follow authorizes the owner there anyway, so matching the reference is strictly safer. - createSpace on a previously deleted space returned 500 (the actor-state row left by the delete collided on its primary key, and the tombstone was never cleared). The lexicon says a deleted space may be created again; the reference upserts via ensureSpace and atproto-crates via ON CONFLICT DO UPDATE. Now createSpace refreshes the config, clears deleted_at, and reactivates the actor row. A live space still answers SpaceAlreadyExists. Smoke covers recreate-after-delete; unit test covers authority self-auth. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>