Merge branch 'main' into wip/mobile

101 files changed, 1725 insertions, 598 deletions

diff --git a/.sqlx/query-0b1543ec93e02c48c5cbaafd391b5812dc2d1d4a52ea3072b5dd52d71637b33d.json b/.sqlx/query-0b1543ec93e02c48c5cbaafd391b5812dc2d1d4a52ea3072b5dd52d71637b33d.json
new file mode 100644
index 0000000..937b07e
--- /dev/null
+++ b/.sqlx/query-0b1543ec93e02c48c5cbaafd391b5812dc2d1d4a52ea3072b5dd52d71637b33d.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                delete\n                from token\n                where login = $1\n                returning id as \"id: Id\"\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id: Id",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "0b1543ec93e02c48c5cbaafd391b5812dc2d1d4a52ea3072b5dd52d71637b33d"
+}
diff --git a/.sqlx/query-0f3bfb1ad8fad5213f733b32d8eb2d9c2bb4de2fbbf0b2280973966ef02f72b1.json b/.sqlx/query-0f3bfb1ad8fad5213f733b32d8eb2d9c2bb4de2fbbf0b2280973966ef02f72b1.json
new file mode 100644
index 0000000..ffd81dc
--- /dev/null
+++ b/.sqlx/query-0f3bfb1ad8fad5213f733b32d8eb2d9c2bb4de2fbbf0b2280973966ef02f72b1.json
@@ -0,0 +1,50 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                select\n                    id as \"id: login::Id\",\n                    display_name as \"display_name: String\",\n                    canonical_name as \"canonical_name: String\",\n                    created_sequence as \"created_sequence: Sequence\",\n                    created_at as \"created_at: DateTime\",\n                    password_hash as \"password_hash: StoredHash\"\n                from login\n                where id = $1\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id: login::Id",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "display_name: String",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "canonical_name: String",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "created_sequence: Sequence",
+        "ordinal": 3,
+        "type_info": "Integer"
+      },
+      {
+        "name": "created_at: DateTime",
+        "ordinal": 4,
+        "type_info": "Text"
+      },
+      {
+        "name": "password_hash: StoredHash",
+        "ordinal": 5,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 1
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "0f3bfb1ad8fad5213f733b32d8eb2d9c2bb4de2fbbf0b2280973966ef02f72b1"
+}
diff --git a/.sqlx/query-ac7ab464e44e4412cd83744730699683e63ae1ea404418a17c6af60148f03fe8.json b/.sqlx/query-2c20c29d9adfed6201a6a69da95bc8271dfc8c6ec8ebf174ba8a57111b322291.json
index 7d9bbbc..ae546ad 100644
--- a/.sqlx/query-ac7ab464e44e4412cd83744730699683e63ae1ea404418a17c6af60148f03fe8.json
+++ b/.sqlx/query-2c20c29d9adfed6201a6a69da95bc8271dfc8c6ec8ebf174ba8a57111b322291.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                select\n                    id as \"id: Id\",\n                    display_name as \"display_name: String\",\n                    canonical_name as \"canonical_name: String\",\n                    created_sequence as \"created_sequence: Sequence\",\n                    created_at as \"created_at: DateTime\"\n                from login\n                where coalesce(login.created_sequence > $1, true)\n            ",
+  "query": "\n                select\n                    id as \"id: Id\",\n                    display_name as \"display_name: String\",\n                    canonical_name as \"canonical_name: String\",\n                    created_sequence as \"created_sequence: Sequence\",\n                    created_at as \"created_at: DateTime\"\n                from login\n                where login.created_sequence > $1\n            ",
   "describe": {
     "columns": [
       {
@@ -40,5 +40,5 @@
       false
     ]
   },
-  "hash": "ac7ab464e44e4412cd83744730699683e63ae1ea404418a17c6af60148f03fe8"
+  "hash": "2c20c29d9adfed6201a6a69da95bc8271dfc8c6ec8ebf174ba8a57111b322291"
 }
diff --git a/.sqlx/query-31e741181f0d09540063ef29117e7e70d3df2beaa1b1e2e081b0d362c07ceae8.json b/.sqlx/query-31e741181f0d09540063ef29117e7e70d3df2beaa1b1e2e081b0d362c07ceae8.json
deleted file mode 100644
index 1105391..0000000
--- a/.sqlx/query-31e741181f0d09540063ef29117e7e70d3df2beaa1b1e2e081b0d362c07ceae8.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                    update channel_name\n                    set canonical_name = $1\n                    where id = $2\n                ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "31e741181f0d09540063ef29117e7e70d3df2beaa1b1e2e081b0d362c07ceae8"
-}
diff --git a/.sqlx/query-4e39f27605dec811824fddae5559dda60c4b2a9c6746376a3552ce73b7d8ea38.json b/.sqlx/query-4e39f27605dec811824fddae5559dda60c4b2a9c6746376a3552ce73b7d8ea38.json
new file mode 100644
index 0000000..902b216
--- /dev/null
+++ b/.sqlx/query-4e39f27605dec811824fddae5559dda60c4b2a9c6746376a3552ce73b7d8ea38.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                update channel\n                set last_sequence = max(last_sequence, $1)\n                where id = $2\n                returning id as \"id: Id\"\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id: Id",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "4e39f27605dec811824fddae5559dda60c4b2a9c6746376a3552ce73b7d8ea38"
+}
diff --git a/.sqlx/query-24bc0257eff3357322481e1314f70d13e8b0ca22b7652f1063ec7796cf307269.json b/.sqlx/query-53b1f14d450a99f486bfd79075e71bd7e30dc93d32e1f273c878f18f2984860f.json
index 9f09a28..7ec6aac 100644
--- a/.sqlx/query-24bc0257eff3357322481e1314f70d13e8b0ca22b7652f1063ec7796cf307269.json
+++ b/.sqlx/query-53b1f14d450a99f486bfd79075e71bd7e30dc93d32e1f273c878f18f2984860f.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                select\n                    id as \"id: Id\",\n                    message.channel as \"channel: channel::Id\",\n                    message.sender as \"sender: login::Id\",\n                    message.sent_at as \"sent_at: DateTime\",\n                    message.sent_sequence as \"sent_sequence: Sequence\",\n                    message.body as \"body: Body\",\n                    deleted.deleted_at as \"deleted_at: DateTime\",\n                    deleted.deleted_sequence as \"deleted_sequence: Sequence\"\n                from message\n                left join message_deleted as deleted\n                    using (id)\n                where coalesce(message.sent_sequence > $1, true)\n            ",
+  "query": "\n                select\n                    id as \"id: Id\",\n                    message.channel as \"channel: channel::Id\",\n                    message.sender as \"sender: login::Id\",\n                    message.sent_at as \"sent_at: DateTime\",\n                    message.sent_sequence as \"sent_sequence: Sequence\",\n                    message.body as \"body: Body\",\n                    deleted.deleted_at as \"deleted_at?: DateTime\",\n                    deleted.deleted_sequence as \"deleted_sequence?: Sequence\"\n                from message\n                left join message_deleted as deleted\n                    using (id)\n                where message.last_sequence > $1\n            ",
   "describe": {
     "columns": [
       {
@@ -34,12 +34,12 @@
         "type_info": "Text"
       },
       {
-        "name": "deleted_at: DateTime",
+        "name": "deleted_at?: DateTime",
         "ordinal": 6,
         "type_info": "Text"
       },
       {
-        "name": "deleted_sequence: Sequence",
+        "name": "deleted_sequence?: Sequence",
         "ordinal": 7,
         "type_info": "Integer"
       }
@@ -54,9 +54,9 @@
       false,
       false,
       true,
-      true,
-      true
+      false,
+      false
     ]
   },
-  "hash": "24bc0257eff3357322481e1314f70d13e8b0ca22b7652f1063ec7796cf307269"
+  "hash": "53b1f14d450a99f486bfd79075e71bd7e30dc93d32e1f273c878f18f2984860f"
 }
diff --git a/.sqlx/query-642fb12657410a4bee58d316293ea1bcc4913987ee751951e9d2f31bf495f305.json b/.sqlx/query-642fb12657410a4bee58d316293ea1bcc4913987ee751951e9d2f31bf495f305.json
deleted file mode 100644
index 5442790..0000000
--- a/.sqlx/query-642fb12657410a4bee58d316293ea1bcc4913987ee751951e9d2f31bf495f305.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                select\n                    id as \"id: Id\",\n                    display_name as \"display_name: String\"\n                from channel_name\n            ",
-  "describe": {
-    "columns": [
-      {
-        "name": "id: Id",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "display_name: String",
-        "ordinal": 1,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 0
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "642fb12657410a4bee58d316293ea1bcc4913987ee751951e9d2f31bf495f305"
-}
diff --git a/.sqlx/query-64fb9bad4505c144578e393a7c0c7e8cf92e5ee6e3900fe9f94c75b5f8c9bfc4.json b/.sqlx/query-64fb9bad4505c144578e393a7c0c7e8cf92e5ee6e3900fe9f94c75b5f8c9bfc4.json
new file mode 100644
index 0000000..5179e74
--- /dev/null
+++ b/.sqlx/query-64fb9bad4505c144578e393a7c0c7e8cf92e5ee6e3900fe9f94c75b5f8c9bfc4.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                update message\n                set body = '', last_sequence = max(last_sequence, $1)\n                where id = $2\n                returning id as \"id: Id\"\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id: Id",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "64fb9bad4505c144578e393a7c0c7e8cf92e5ee6e3900fe9f94c75b5f8c9bfc4"
+}
diff --git a/.sqlx/query-676a7dda6314cae4d13ff51241dc35263ccfee9f3424111e7fa6014071f98a1e.json b/.sqlx/query-676a7dda6314cae4d13ff51241dc35263ccfee9f3424111e7fa6014071f98a1e.json
deleted file mode 100644
index fd601e9..0000000
--- a/.sqlx/query-676a7dda6314cae4d13ff51241dc35263ccfee9f3424111e7fa6014071f98a1e.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                select\n                    id as \"id: Id\",\n                    display_name as \"display_name: String\"\n                from login\n            ",
-  "describe": {
-    "columns": [
-      {
-        "name": "id: Id",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "display_name: String",
-        "ordinal": 1,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 0
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "676a7dda6314cae4d13ff51241dc35263ccfee9f3424111e7fa6014071f98a1e"
-}
diff --git a/.sqlx/query-0f0e4a6ac32b39f3bd7f4832389259b91bbffa182e32b224635031eead2fa82d.json b/.sqlx/query-72441293731853e9f0cc1141e4322f8026f9e2515b6bacaed81f6248c52a198a.json
index fd5a165..eb30352 100644
--- a/.sqlx/query-0f0e4a6ac32b39f3bd7f4832389259b91bbffa182e32b224635031eead2fa82d.json
+++ b/.sqlx/query-72441293731853e9f0cc1141e4322f8026f9e2515b6bacaed81f6248c52a198a.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                insert into message\n                    (id, channel, sender, sent_at, sent_sequence, body)\n                values ($1, $2, $3, $4, $5, $6)\n                returning\n                    id as \"id: Id\",\n                    channel as \"channel: channel::Id\",\n                    sender as \"sender: login::Id\",\n                    sent_at as \"sent_at: DateTime\",\n                    sent_sequence as \"sent_sequence: Sequence\",\n                    body as \"body: Body\"\n            ",
+  "query": "\n                insert into message\n                    (id, channel, sender, sent_at, sent_sequence, body, last_sequence)\n                values ($1, $2, $3, $4, $5, $6, $7)\n                returning\n                    id as \"id: Id\",\n                    channel as \"channel: channel::Id\",\n                    sender as \"sender: login::Id\",\n                    sent_at as \"sent_at: DateTime\",\n                    sent_sequence as \"sent_sequence: Sequence\",\n                    body as \"body: Body\"\n            ",
   "describe": {
     "columns": [
       {
@@ -35,7 +35,7 @@
       }
     ],
     "parameters": {
-      "Right": 6
+      "Right": 7
     },
     "nullable": [
       false,
@@ -46,5 +46,5 @@
       true
     ]
   },
-  "hash": "0f0e4a6ac32b39f3bd7f4832389259b91bbffa182e32b224635031eead2fa82d"
+  "hash": "72441293731853e9f0cc1141e4322f8026f9e2515b6bacaed81f6248c52a198a"
 }
diff --git a/.sqlx/query-b67d56f20dab413e31a64842bfc6c82b1464afa98845e537e850d05deb328f06.json b/.sqlx/query-b67d56f20dab413e31a64842bfc6c82b1464afa98845e537e850d05deb328f06.json
deleted file mode 100644
index 677495b..0000000
--- a/.sqlx/query-b67d56f20dab413e31a64842bfc6c82b1464afa98845e537e850d05deb328f06.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                    update login\n                    set canonical_name = $1\n                    where id = $2\n                ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "b67d56f20dab413e31a64842bfc6c82b1464afa98845e537e850d05deb328f06"
-}
diff --git a/.sqlx/query-c2b0ff7e2f27b6970a16fbc233ed32638e853e3b8b8f8de26b53f90c98b6ce11.json b/.sqlx/query-c2b0ff7e2f27b6970a16fbc233ed32638e853e3b8b8f8de26b53f90c98b6ce11.json
new file mode 100644
index 0000000..4c99c42
--- /dev/null
+++ b/.sqlx/query-c2b0ff7e2f27b6970a16fbc233ed32638e853e3b8b8f8de26b53f90c98b6ce11.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                update login\n                set password_hash = $1\n                where id = $2\n                returning id as \"id: Id\"\n            ",
+  "describe": {
+    "columns": [
+      {
+        "name": "id: Id",
+        "ordinal": 0,
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c2b0ff7e2f27b6970a16fbc233ed32638e853e3b8b8f8de26b53f90c98b6ce11"
+}
diff --git a/.sqlx/query-a40496319887752f5845c0c2e965e2294c1a6932d72a8b04d258d06d0f8938bd.json b/.sqlx/query-c44dbcc7f4c0257a991e1ae4a2679aaa4c3f28aa5436a9af067a754e46af5589.json
index 436e1dd..37d685a 100644
--- a/.sqlx/query-a40496319887752f5845c0c2e965e2294c1a6932d72a8b04d258d06d0f8938bd.json
+++ b/.sqlx/query-c44dbcc7f4c0257a991e1ae4a2679aaa4c3f28aa5436a9af067a754e46af5589.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                select\n                    id as \"id: Id\",\n                    name.display_name as \"display_name: String\",\n                    name.canonical_name as \"canonical_name: String\",\n                    channel.created_at as \"created_at: DateTime\",\n                    channel.created_sequence as \"created_sequence: Sequence\",\n                    deleted.deleted_at as \"deleted_at?: DateTime\",\n                    deleted.deleted_sequence as \"deleted_sequence?: Sequence\"\n                from channel\n                left join channel_name as name\n                    using (id)\n                left join channel_deleted as deleted\n                    using (id)\n                where coalesce(channel.created_sequence > $1, true)\n            ",
+  "query": "\n                select\n                    id as \"id: Id\",\n                    name.display_name as \"display_name?: String\",\n                    name.canonical_name as \"canonical_name?: String\",\n                    channel.created_at as \"created_at: DateTime\",\n                    channel.created_sequence as \"created_sequence: Sequence\",\n                    deleted.deleted_at as \"deleted_at?: DateTime\",\n                    deleted.deleted_sequence as \"deleted_sequence?: Sequence\"\n                from channel\n                left join channel_name as name\n                    using (id)\n                left join channel_deleted as deleted\n                    using (id)\n                where channel.last_sequence > $1\n            ",
   "describe": {
     "columns": [
       {
@@ -9,12 +9,12 @@
         "type_info": "Text"
       },
       {
-        "name": "display_name: String",
+        "name": "display_name?: String",
         "ordinal": 1,
         "type_info": "Null"
       },
       {
-        "name": "canonical_name: String",
+        "name": "canonical_name?: String",
         "ordinal": 2,
         "type_info": "Null"
       },
@@ -44,13 +44,13 @@
     },
     "nullable": [
       false,
-      true,
-      true,
       false,
       false,
-      true,
-      true
+      false,
+      false,
+      false,
+      false
     ]
   },
-  "hash": "a40496319887752f5845c0c2e965e2294c1a6932d72a8b04d258d06d0f8938bd"
+  "hash": "c44dbcc7f4c0257a991e1ae4a2679aaa4c3f28aa5436a9af067a754e46af5589"
 }
diff --git a/.sqlx/query-ca9146e92c3b3e724f4b58ad72529de7030a4863d3bf479bb19a6a2a76d1590b.json b/.sqlx/query-ca9146e92c3b3e724f4b58ad72529de7030a4863d3bf479bb19a6a2a76d1590b.json
new file mode 100644
index 0000000..0118249
--- /dev/null
+++ b/.sqlx/query-ca9146e92c3b3e724f4b58ad72529de7030a4863d3bf479bb19a6a2a76d1590b.json
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "\n                insert\n                into channel (id, created_at, created_sequence, last_sequence)\n                values ($1, $2, $3, $4)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 4
+    },
+    "nullable": []
+  },
+  "hash": "ca9146e92c3b3e724f4b58ad72529de7030a4863d3bf479bb19a6a2a76d1590b"
+}
diff --git a/.sqlx/query-9f611a3351f22ed16d67d41602b8befafe751e9caeb0d5f279731e04c6925f46.json b/.sqlx/query-cbf29fae3725bbb3d9e94d932ace995f53efd6c7800a7a1b42daec41d081b3d2.json
index 2d1f49e..9c3c10e 100644
--- a/.sqlx/query-9f611a3351f22ed16d67d41602b8befafe751e9caeb0d5f279731e04c6925f46.json
+++ b/.sqlx/query-cbf29fae3725bbb3d9e94d932ace995f53efd6c7800a7a1b42daec41d081b3d2.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                select\n                    id as \"id: Id\",\n                    display_name as \"display_name: String\",\n                    canonical_name as \"canonical_name: String\",\n                    created_sequence as \"created_sequence: Sequence\",\n                    created_at as \"created_at: DateTime\"\n                from login\n                    where coalesce(created_sequence <= $1, true)\n                    order by canonical_name\n            ",
+  "query": "\n                select\n                    id as \"id: Id\",\n                    display_name as \"display_name: String\",\n                    canonical_name as \"canonical_name: String\",\n                    created_sequence as \"created_sequence: Sequence\",\n                    created_at as \"created_at: DateTime\"\n                from login\n                    where created_sequence <= $1\n                    order by canonical_name\n            ",
   "describe": {
     "columns": [
       {
@@ -40,5 +40,5 @@
       false
     ]
   },
-  "hash": "9f611a3351f22ed16d67d41602b8befafe751e9caeb0d5f279731e04c6925f46"
+  "hash": "cbf29fae3725bbb3d9e94d932ace995f53efd6c7800a7a1b42daec41d081b3d2"
 }
diff --git a/.sqlx/query-d1c869c323d1ab45216279ae5ca13b72436960622863420d3f1d73a422fe5b42.json b/.sqlx/query-d1c869c323d1ab45216279ae5ca13b72436960622863420d3f1d73a422fe5b42.json
deleted file mode 100644
index 658728c..0000000
--- a/.sqlx/query-d1c869c323d1ab45216279ae5ca13b72436960622863420d3f1d73a422fe5b42.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                insert\n                into channel (id, created_at, created_sequence)\n                values ($1, $2, $3)\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "d1c869c323d1ab45216279ae5ca13b72436960622863420d3f1d73a422fe5b42"
-}
diff --git a/.sqlx/query-e718f4064cbb3d1b27049450121451dbcf01e8bec8a987b58c699b27b5d737af.json b/.sqlx/query-e718f4064cbb3d1b27049450121451dbcf01e8bec8a987b58c699b27b5d737af.json
deleted file mode 100644
index 0c21ec1..0000000
--- a/.sqlx/query-e718f4064cbb3d1b27049450121451dbcf01e8bec8a987b58c699b27b5d737af.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                update message\n                set body = ''\n                where id = $1\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": []
-  },
-  "hash": "e718f4064cbb3d1b27049450121451dbcf01e8bec8a987b58c699b27b5d737af"
-}
diff --git a/.sqlx/query-fce8f4fbd59a8b3b8531e10599914331682d58ace57214bfa26ccaa089592a24.json b/.sqlx/query-ff61ff22108f1e98bbfc9a84a27bdaefca99706a0c73c17f19cc537f3f669882.json
index 7aab764..f38f49c 100644
--- a/.sqlx/query-fce8f4fbd59a8b3b8531e10599914331682d58ace57214bfa26ccaa089592a24.json
+++ b/.sqlx/query-ff61ff22108f1e98bbfc9a84a27bdaefca99706a0c73c17f19cc537f3f669882.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n                select\n                    message.channel as \"channel: channel::Id\",\n                    message.sender as \"sender: login::Id\",\n                    id as \"id: Id\",\n                    message.body as \"body: Body\",\n                    message.sent_at as \"sent_at: DateTime\",\n                    message.sent_sequence as \"sent_sequence: Sequence\",\n                    deleted.deleted_at as \"deleted_at: DateTime\",\n                    deleted.deleted_sequence as \"deleted_sequence: Sequence\"\n                from message\n                left join message_deleted as deleted\n                    using (id)\n                where coalesce(message.sent_sequence <= $2, true)\n                order by message.sent_sequence\n            ",
+  "query": "\n                select\n                    message.channel as \"channel: channel::Id\",\n                    message.sender as \"sender: login::Id\",\n                    message.id as \"id: Id\",\n                    message.body as \"body: Body\",\n                    message.sent_at as \"sent_at: DateTime\",\n                    message.sent_sequence as \"sent_sequence: Sequence\",\n                    deleted.deleted_at as \"deleted_at?: DateTime\",\n                    deleted.deleted_sequence as \"deleted_sequence?: Sequence\"\n                from message\n                left join message_deleted as deleted\n                    using (id)\n                where message.sent_sequence <= $1\n                order by message.sent_sequence\n            ",
   "describe": {
     "columns": [
       {
@@ -34,12 +34,12 @@
         "type_info": "Integer"
       },
       {
-        "name": "deleted_at: DateTime",
+        "name": "deleted_at?: DateTime",
         "ordinal": 6,
         "type_info": "Text"
       },
       {
-        "name": "deleted_sequence: Sequence",
+        "name": "deleted_sequence?: Sequence",
         "ordinal": 7,
         "type_info": "Integer"
       }
@@ -54,9 +54,9 @@
       true,
       false,
       false,
-      true,
-      true
+      false,
+      false
     ]
   },
-  "hash": "fce8f4fbd59a8b3b8531e10599914331682d58ace57214bfa26ccaa089592a24"
+  "hash": "ff61ff22108f1e98bbfc9a84a27bdaefca99706a0c73c17f19cc537f3f669882"
 }
diff --git a/Cargo.lock b/Cargo.lock
index f5ba5ff..8e10aa1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -828,6 +828,7 @@ dependencies = [
  "tokio-stream",
  "unicode-casefold",
  "unicode-normalization",
+ "unicode-segmentation",
  "unix_path",
  "uuid",
 ]
@@ -2143,6 +2144,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e70f2a8b45122e719eb623c01822704c4e0907e7e426a05927e1a1cfff5b75d0"
 
 [[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
 name = "unicode_categories"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/Cargo.toml b/Cargo.toml
index 989f8cc..83c3aa4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,6 +4,23 @@ version = "0.1.0"
 edition = "2021"
 rust-version = "1.82"
 default-run = "hi"
+authors = [
+	"Owen Jacobson <hi@grimoire.ca>",
+	"Kit La Touche <kit@transneptune.net>",
+]
+
+[package.metadata.deb]
+maintainer = "Owen Jacobson <hi@grimoire.ca>"
+maintainer-scripts = "debian"
+assets = [
+	# Binaries
+	["target/release/hi", "/usr/bin/hi", "755"],
+
+	# Configuration
+	["debian/default", "/etc/default/hi", "644"],
+]
+
+[package.metadata.deb.systemd-units]
 
 [dependencies]
 argon2 = "0.5.3"
@@ -34,6 +51,7 @@ tokio = { version = "1.40.0", features = ["rt", "macros", "rt-multi-thread"] }
 tokio-stream = { version = "0.1.16", features = ["sync"] }
 unicode-casefold = "0.2.0"
 unicode-normalization = "0.1.24"
+unicode-segmentation = "1.12.0"
 unix_path = "1.0.1"
 uuid = { version = "1.11.0", features = ["v4"] }
 
diff --git a/Dockerfile.builder b/Dockerfile.builder
new file mode 100644
index 0000000..da80c69
--- /dev/null
+++ b/Dockerfile.builder
@@ -0,0 +1,7 @@
+FROM rust:1-slim-bookworm
+
+COPY builder /opt/hi-builder
+RUN /opt/hi-builder/image-setup
+
+RUN mkdir /app
+WORKDIR /app
diff --git a/builder/image-setup b/builder/image-setup
new file mode 100755
index 0000000..6b7895e
--- /dev/null
+++ b/builder/image-setup
@@ -0,0 +1,61 @@
+#!/bin/bash -e
+
+cd "$(dirname "$0")"
+
+apt-get update
+apt-get install -y \
+	apt-transport-https \
+	ca-certificates \
+	curl \
+	dpkg-dev \
+	gnupg \
+
+# Key from <https://github.com/nodesource/distributions>, specifically
+# <https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key>
+gpg --dearmor -o /usr/share/keyrings/nodesource.gpg <<'NODESOURCE_KEY'
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBFdDN1ABCADaNd/I3j3tn40deQNgz7hB2NvT+syXe6k4ZmdiEcOfBvFrkS8B
+hNS67t93etHsxEy7E0qwsZH32bKazMqe9zDwoa3aVImryjh6SHC9lMtW27JPHFeM
+Srkt9YmH1WMwWcRO6eSY9B3PpazquhnvbammLuUojXRIxkDroy6Fw4UKmUNSRr32
+9Ej87jRoR1B2/57Kfp2Y4+vFGGzSvh3AFQpBHq51qsNHALU6+8PjLfIt+5TPvaWR
+TB+kAZnQZkaIQM2nr1n3oj6ak2RATY/+kjLizgFWzgEfbCrbsyq68UoY5FPBnu4Z
+E3iDZpaIqwKr0seUC7iA1xM5eHi5kty1oB7HABEBAAG0Ik5Tb2xpZCA8bnNvbGlk
+LWdwZ0Bub2Rlc291cmNlLmNvbT6JATgEEwECACIFAldDN1ACGwMGCwkIBwMCBhUI
+AgkKCwQWAgMBAh4BAheAAAoJEC9ZtfmbG+C0y7wH/i4xnab36dtrYW7RZwL8i6Sc
+NjMx4j9+U1kr/F6YtqWd+JwCbBdar5zRghxPcYEq/qf7MbgAYcs1eSOuTOb7n7+o
+xUwdH2iCtHhKh3Jr2mRw1ks7BbFZPB5KmkxHaEBfLT4d+I91ZuUdPXJ+0SXs9gzk
+Dbz65Uhoz3W03aiF8HeL5JNARZFMbHHNVL05U1sTGTCOtu+1c/33f3TulQ/XZ3Y4
+hwGCpLe0Tv7g7Lp3iLMZMWYPEa0a7S4u8he5IEJQLd8bE8jltcQvrdr3Fm8kI2Jg
+BJmUmX4PSfhuTCFaR/yeCt3UoW883bs9LfbTzIx9DJGpRIu8Y0IL3b4sj/GoZVq5
+AQ0EV0M3UAEIAKrTaC62ayzqOIPa7nS90BHHck4Z33a2tZF/uof38xNOiyWGhT8u
+JeFoTTHn5SQq5Ftyu4K3K2fbbpuu/APQF05AaljzVkDGNMW4pSkgOasdysj831cu
+ssrHX2RYS22wg80k6C/Hwmh5F45faEuNxsV+bPx7oPUrt5n6GMx84vEP3i1+FDBi
+0pt/B/QnDFBXki1BGvJ35f5NwDefK8VaInxXP3ZN/WIbtn5dqxppkV/YkO7GiJlp
+Jlju9rf3kKUIQzKQWxFsbCAPIHoWv7rH9RSxgDithXtG6Yg5R1aeBbJaPNXL9wpJ
+YBJbiMjkAFaz4B95FOqZm3r7oHugiCGsHX0AEQEAAYkBHwQYAQIACQUCV0M3UAIb
+DAAKCRAvWbX5mxvgtE/OB/0VN88DR3Y3fuqy7lq/dthkn7Dqm9YXdorZl3L152eE
+IF882aG8FE3qZdaLGjQO4oShAyNWmRfSGuoH0XERXAI9n0r8m4mDMxE6rtP7tHet
+y/5M8x3CTyuMgx5GLDaEUvBusnTD+/v/fBMwRK/cZ9du5PSG4R50rtst+oYyC2ao
+x4I2SgjtF/cY7bECsZDplzatN3gv34PkcdIg8SLHAVlL4N5tzumDeizRspcSyoy2
+K2+hwKU4C4+dekLLTg8rjnRROvplV2KtaEk6rxKtIRFDCoQng8wfJuIMrDNKvqZw
+FRGt7cbvW5MCnuH8MhItOl9Uxp1wHp6gtav/h8Gp6MBa
+=MARt
+-----END PGP PUBLIC KEY BLOCK-----
+NODESOURCE_KEY
+
+cat > /etc/apt/sources.list.d/nodesource.list <<NODESOURCE_REPO
+deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main
+NODESOURCE_REPO
+
+cat > /etc/apt/preferences.d/nodejs <<'NODEJS_PIN'
+Package: nodejs
+Pin: origin deb.nodesource.com
+Pin-Priority: 600
+NODEJS_PIN
+
+apt-get update
+apt-get install -y \
+	nodejs
+
+cargo install cargo-deb
diff --git a/debian/default b/debian/default
new file mode 100644
index 0000000..3076699
--- /dev/null
+++ b/debian/default
@@ -0,0 +1,2 @@
+DATABASE_URL=sqlite:///var/lib/hi/hi.db
+BACKUP_DATABASE_URL=sqlite:///var/lib/hi/backup.db
diff --git a/debian/hi.service b/debian/hi.service
new file mode 100644
index 0000000..cc4a951
--- /dev/null
+++ b/debian/hi.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Hi chat service
+After=network-online.target
+
+[Service]
+EnvironmentFile=/etc/default/hi
+ExecStart=/usr/bin/hi
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/postinst b/debian/postinst
new file mode 100755
index 0000000..d88a7ad
--- /dev/null
+++ b/debian/postinst
@@ -0,0 +1,10 @@
+#!/bin/sh
+set -e
+
+adduser \
+	--system \
+	--group \
+	--home /var/lib/hi \
+	hi
+
+#DEBHELPER#
diff --git a/docs/api/authentication.md b/docs/api/authentication.md
index 135e91b..93a8e52 100644
--- a/docs/api/authentication.md
+++ b/docs/api/authentication.md
@@ -113,3 +113,50 @@ The request must be an empty JSON object.
 This endpoint will respond with a status of `204 No Content` when successful.
 
 The response will include a `Set-Cookie` header that clears the `identity` cookie. Regardless of whether the client clears the cookie, the service also invalidates the token.
+
+
+## `POST /api/password`
+
+Changes the current login's password, and invalidate all outstanding identity tokens.
+
+### Request
+
+```json
+{
+	"password": "my-old-password",
+	"to": "my-new-password"
+}
+```
+
+The request must have the following fields:
+
+| Field      | Type   | Description |
+|:-----------|:-------|:--|
+| `password` | string | The login's _current_ password, in plain text. |
+| `to`       | string | The login's _new_ password, in plain text. |
+
+### Success
+
+This endpoint will respond with a status of `200 Okay` when successful. The body of the response will be a JSON object describing the authenticated login:
+
+```json
+{
+	"id": "Labcd1234",
+	"name": "Andrea"
+}
+```
+
+The response will include the following fields:
+
+| Field       | Type   | Description |
+|:------------|:-------|:--|
+| `id`        | string | The authenticated login's ID. |
+| `name`      | string | The authenticated login's name. |
+
+The response will include a `Set-Cookie` header for the `identity` cookie, providing the client with a newly-minted identity token associated with the login identified in the request. This token's value must be kept confidential. All previously-created identity cookies will cease to be valid.
+
+The cookie will expire if it is not used regularly.
+
+### Authentication failure
+
+This endpoint will respond with a status of `400 Bad Request` if the `password` does not match the login's current password.
diff --git a/docs/api/channels-messages.md b/docs/api/channels-messages.md
index 9854d22..2aa8ac5 100644
--- a/docs/api/channels-messages.md
+++ b/docs/api/channels-messages.md
@@ -64,6 +64,14 @@ The request must have the following fields:
 |:-------|:-------|:--|
 | `name` | string | The channel's name. |
 
+The proposed `name` must be valid. The precise definition of valid is still up in the air, but, at minimum:
+
+* It must be non-empty.
+* It must not be "too long." (Currently, 64 characters is too long.)
+* It must begin with a printing character.
+* It must end with a printing character.
+* It must not contain runs of multiple whitespace characters.
+
 ### Success
 
 This endpoint will respond with a status of `202 Accepted` when successful. The body of the response will be a JSON object describing the new channel:
@@ -86,7 +94,11 @@ The returned name may not be identical to the name requested, as the name will b
 
 When completed, the service will emit a [channel created](events.md#channel-created) event with the channel's ID.
 
-### Duplicate channel name
+### Name not valid
+
+This endpoint will respond with a status of `400 Bad Request` if the proposed `name` is not valid.
+
+### Channel name in use
 
 This endpoint will respond with a status of `409 Conflict` if a channel with the requested name already exists.
 
@@ -152,7 +164,7 @@ This endpoint will respond with a status of `404 Not Found` if the channel ID is
 
 Deletes a channel.
 
-Deleting a channel prevents it from receiving any further messages, and deletes the messages it contains at that point.
+Deleting a channel prevents it from receiving any further messages. The channel must be empty; to delete a channel with messages in it, delete the messages first (or wait for them to expire).
 
 This endpoint requires the following path parameter:
 
@@ -178,6 +190,9 @@ The response will have the following fields:
 
 When completed, the service will emit a [message deleted](events.md#message-deleted) event for each message in the channel, followed by a [channel deleted](events.md#channel-deleted) event with the channel's ID.
 
+### Channel not empty
+
+This endpoint will respond with a status of `409 Conflict` if the channel contains messages.
 
 ### Invalid channel ID
 
@@ -215,3 +230,7 @@ When completed, the service will emit a [message deleted](events.md#message-dele
 ### Invalid message ID
 
 This endpoint will respond with a status of `404 Not Found` if the message ID is not valid.
+
+### Not the sender
+
+This endpoint will respond with a status of `403 Forbidden` if the message was sent by a different login.
diff --git a/docs/api/events.md b/docs/api/events.md
index b08e971..b23469c 100644
--- a/docs/api/events.md
+++ b/docs/api/events.md
@@ -46,7 +46,7 @@ This endpoint is designed for use with the [EventSource] DOM API, and supports s
 
 ### Query parameters
 
-This endpoint accepts an optional `resume_point` (integer) query parameter. When provided, the event stream will include events published after that point in time; the value must be the value obtained by calling the [`GET /api/boot`](./boot.md) method. If absent, the returned event stream includes all events.
+This endpoint requires a `resume_point` (integer) query parameter. The event stream will collect events published after that point in time. The value must be obtained by calling the [`GET /api/boot`](./boot.md) method.
 
 ### Request headers
 
diff --git a/docs/api/initial-setup.md b/docs/api/initial-setup.md
index 306d798..c2bdaec 100644
--- a/docs/api/initial-setup.md
+++ b/docs/api/initial-setup.md
@@ -51,6 +51,16 @@ The request must have the following fields:
 | `name`     | string | The initial login's name. |
 | `password` | string | The initial login's password, in plain text. |
 
+<!-- Reproduced in invitations.md. Edit in both places. -->
+
+The proposed `name` must be valid. The precise definition of valid is still up in the air, but, at minimum:
+
+* It must be non-empty.
+* It must not be "too long." (Currently, 64 characters is too long.)
+* It must begin with a printing character.
+* It must end with a printing character.
+* It must not contain runs of multiple whitespace characters.
+
 ### Success
 
 <!-- This prose is duplicated from authentication.md, with small changes for context. If you edit it here, edit it there, too. -->
@@ -79,6 +89,10 @@ The response will include a `Set-Cookie` header for the `identity` cookie, provi
 
 The cookie will expire if it is not used regularly.
 
+### Name not valid
+
+This endpoint will respond with a status of `400 Bad Request` if the proposed `name` is not valid.
+
 ### Setup previously completed
 
 Once completed, this operation cannot be performed a second time. Subsequent requests to this endpoint will respond with a status of `409 Conflict`.
diff --git a/docs/api/invitations.md b/docs/api/invitations.md
index ddbef8a..1839ef5 100644
--- a/docs/api/invitations.md
+++ b/docs/api/invitations.md
@@ -130,6 +130,15 @@ The request must have the following fields:
 | `name`     | string | The new login's name. |
 | `password` | string | The new login's password, in plain text. |
 
+<!-- Reproduced in initial-setup.md. Edit in both places. -->
+The proposed `name` must be valid. The precise definition of valid is still up in the air, but, at minimum:
+
+* It must be non-empty.
+* It must not be "too long." (Currently, 64 characters is too long.)
+* It must begin with a printing character.
+* It must end with a printing character.
+* It must not contain runs of multiple whitespace characters.
+
 ### Success
 
 <!-- This prose is duplicated from authentication.md, with small changes for context. If you edit it here, edit it there, too. -->
@@ -162,6 +171,10 @@ The cookie will expire if it is not used regularly.
 
 This endpoint will respond with a status of `404 Not Found` when the invitation ID either does not exist, or has already been accepted.
 
+### Name not valid
+
+This endpoint will respond with a status of `400 Bad Request` if the proposed `name` is not valid.
+
 ### Name in use
 
 This endpoint will respond with a status of `409 Conflict` if the requested login name has already been taken.
diff --git a/docs/debian-packaging.md b/docs/debian-packaging.md
new file mode 100644
index 0000000..f307536
--- /dev/null
+++ b/docs/debian-packaging.md
@@ -0,0 +1,8 @@
+# Building Debian packages
+
+You will need `docker` installed, and set up to use the `containerd` storage backend. The builder image is built as a multi-architecture image.
+
+1. Run `tools/build-builder`.
+2. Run `tools/build-debian`.
+
+Packages will be built in `target/debian`.
diff --git a/docs/internal-server-errors.md b/docs/internal-server-errors.md
index 4f679b7..16d61a2 100644
--- a/docs/internal-server-errors.md
+++ b/docs/internal-server-errors.md
@@ -9,22 +9,3 @@ The server attempted two write transactions at the same time, and encountered [s
 This error will almost always resolve itself if clients re-try their requests; no further action is needed.
 
 This is a known issue. If you are encountering this consistently (or if you can trigger it on demand), let us know. We are aware of sqlite's features for mitigating this issue but have been unsuccessful in applying them; we're working on it, but patches _are_ welcome, if you have the opportunity.
-
-## stored canonical form […] does not match computed canonical form […] for name […]
-
-When `hi` applies the `migrations/20241019191531_canonical_names.sql` migration (from commit `3f9648eed48cd8b6cd35d0ae2ee5bbe25fa735ac`), this can leave existing names in a state where the stored canonical form is not the correct canonicalization of the stored display names of channels and logins. `hi` will abort requests when it encounters this situation, to avoid incorrect behaviours such as duplicate channels or duplicate logins.
-
-As channel and login names may be presented during client startup, this can render the service unusable until repaired. Treat this as an immediate outage if you see it.
-
-You can verify that login names are unique by running the following commands as the user the `hi` server runs as:
-
-* `sqlite3 .hi 'select display_name from login'`
-* `sqlite3 .hi 'select display_name from channel_name'`
-
-Substitute `.hi` with the path to your `hi` database if it differs from the default.
-
-If the names are unique, you can repair the database:
-
-* Stop the `hi` server.
-* Run `hi-recanonicalize`, as the same user the `hi` server runs as, with the same database options.
-* Start the `hi` server.
diff --git a/migrations/20241030152013_channel_message_last_event_id.sql b/migrations/20241030152013_channel_message_last_event_id.sql
new file mode 100644
index 0000000..dd6e66b
--- /dev/null
+++ b/migrations/20241030152013_channel_message_last_event_id.sql
@@ -0,0 +1,141 @@
+alter table channel
+rename to old_channel;
+alter table channel_name
+rename to old_channel_name;
+alter table channel_deleted
+rename to old_channel_deleted;
+alter table message
+rename to old_message;
+alter table message_deleted
+rename to old_message_deleted;
+
+create table channel (
+	id text
+		not null
+		primary key,
+	created_sequence bigint
+		unique
+		not null,
+	created_at text
+		not null,
+	last_sequence bigint
+		not null
+);
+
+insert into channel (id, created_sequence, created_at, last_sequence)
+select
+	ch.id,
+	ch.created_sequence,
+	ch.created_at,
+	max(ch.created_sequence, coalesce(del.deleted_sequence, ch.created_sequence)) as last_seqeuence
+from old_channel as ch
+left join old_channel_deleted as del
+	using (id);
+
+create table channel_name (
+	id text
+		not null
+		primary key
+		references channel (id),
+	display_name
+		not null,
+	canonical_name
+		not null
+		unique
+);
+
+insert into channel_name (id, display_name, canonical_name)
+select id, display_name, canonical_name
+from old_channel_name;
+
+create table channel_deleted (
+	id text
+		not null
+		primary key
+		references channel (id),
+	deleted_sequence bigint
+		unique
+		not null,
+	deleted_at text
+		not null
+);
+
+insert into channel_deleted (id, deleted_sequence, deleted_at)
+select id, deleted_sequence, deleted_at
+from old_channel_deleted;
+
+create table message (
+	id text
+		not null
+		primary key,
+	channel text
+		not null
+		references channel (id),
+	sender text
+		not null
+		references login (id),
+	sent_sequence bigint
+		unique
+		not null,
+	sent_at text
+		not null,
+	body text
+		null,
+	last_sequence bigint
+		not null
+);
+
+insert into message (id, channel, sender, sent_sequence, sent_at, body, last_sequence)
+select
+	msg.id,
+	msg.channel,
+	msg.sender,
+	msg.sent_sequence,
+	msg.sent_at,
+	msg.body,
+	max(msg.sent_sequence, coalesce(del.deleted_sequence, msg.sent_sequence)) as last_sequence
+from
+	old_message as msg
+	left join old_message_deleted as del
+		using (id);
+
+create table message_deleted (
+	id text
+		not null
+		primary key
+		references message (id),
+	deleted_sequence bigint
+		unique
+		not null,
+	deleted_at text
+		not null
+);
+
+insert into message_deleted (id, deleted_sequence, deleted_at)
+select id, deleted_sequence, deleted_at
+from old_message_deleted;
+
+drop table old_message_deleted;
+drop table old_message;
+drop table old_channel_deleted;
+drop table old_channel_name;
+drop table old_channel;
+
+-- recreate existing indices
+create index message_sent_at
+on message (sent_at);
+create index message_deleted_deleted_at
+on message_deleted (deleted_at);
+create index message_channel
+on message(channel);
+create index channel_created_sequence
+on channel (created_sequence);
+create index channel_created_at
+on channel (created_at);
+
+-- new indices
+create index channel_last_sequence
+on channel (last_sequence);
+
+create index message_last_sequence
+on message (last_sequence);
diff --git a/src/app.rs b/src/app.rs
index bc1daa5..0dbf017 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -5,12 +5,14 @@ use crate::{
     channel::app::Channels,
     event::{self, app::Events},
     invite::app::Invites,
-    login::app::Logins,
     message::app::Messages,
     setup::app::Setup,
     token::{self, app::Tokens},
 };
 
+#[cfg(test)]
+use crate::login::app::Logins;
+
 #[derive(Clone)]
 pub struct App {
     db: SqlitePool,
@@ -47,11 +49,6 @@ impl App {
         Invites::new(&self.db, &self.events)
     }
 
-    #[cfg(not(test))]
-    pub const fn logins(&self) -> Logins {
-        Logins::new(&self.db)
-    }
-
     #[cfg(test)]
     pub const fn logins(&self) -> Logins {
         Logins::new(&self.db, &self.events)
diff --git a/src/bin/hi-recanonicalize.rs b/src/bin/hi-recanonicalize.rs
deleted file mode 100644
index 4081276..0000000
--- a/src/bin/hi-recanonicalize.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-use clap::Parser;
-
-use hi::cli;
-
-#[tokio::main]
-async fn main() -> Result<(), cli::recanonicalize::Error> {
-    let args = cli::recanonicalize::Args::parse();
-    args.run().await
-}
diff --git a/src/boot/app.rs b/src/boot/app.rs
index e716b58..909f7d8 100644
--- a/src/boot/app.rs
+++ b/src/boot/app.rs
@@ -22,9 +22,9 @@ impl<'a> Boot<'a> {
         let mut tx = self.db.begin().await?;
         let resume_point = tx.sequence().current().await?;
 
-        let logins = tx.logins().all(resume_point.into()).await?;
+        let logins = tx.logins().all(resume_point).await?;
         let channels = tx.channels().all(resume_point).await?;
-        let messages = tx.messages().all(resume_point.into()).await?;
+        let messages = tx.messages().all(resume_point).await?;
 
         tx.commit().await?;
 
diff --git a/src/boot/routes/test.rs b/src/boot/routes/test.rs
index 8808b70..202dcb9 100644
--- a/src/boot/routes/test.rs
+++ b/src/boot/routes/test.rs
@@ -85,7 +85,7 @@ async fn excludes_deleted_messages() {
     let deleted_message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
 
     app.messages()
-        .delete(&deleted_message.id, &fixtures::now())
+        .delete(&sender, &deleted_message.id, &fixtures::now())
         .await
         .expect("deleting valid message succeeds");
 
diff --git a/src/channel/app.rs b/src/channel/app.rs
index 8359277..21784e9 100644
--- a/src/channel/app.rs
+++ b/src/channel/app.rs
@@ -4,13 +4,13 @@ use sqlx::sqlite::SqlitePool;
 
 use super::{
     repo::{LoadError, Provider as _},
-    Channel, Id,
+    validate, Channel, Id,
 };
 use crate::{
     clock::DateTime,
     db::{Duplicate as _, NotFound as _},
     event::{repo::Provider as _, Broadcaster, Event, Sequence},
-    message::repo::Provider as _,
+    message::{self, repo::Provider as _},
     name::{self, Name},
 };
 
@@ -25,6 +25,10 @@ impl<'a> Channels<'a> {
     }
 
     pub async fn create(&self, name: &Name, created_at: &DateTime) -> Result<Channel, CreateError> {
+        if !validate::name(name) {
+            return Err(CreateError::InvalidName(name.clone()));
+        }
+
         let mut tx = self.db.begin().await?;
         let created = tx.sequence().next(created_at).await?;
         let channel = tx
@@ -44,38 +48,36 @@ impl<'a> Channels<'a> {
     // it exists in the specific moment when you call it.
     pub async fn get(&self, channel: &Id) -> Result<Channel, Error> {
         let not_found = || Error::NotFound(channel.clone());
+        let deleted = || Error::Deleted(channel.clone());
 
         let mut tx = self.db.begin().await?;
         let channel = tx.channels().by_id(channel).await.not_found(not_found)?;
         tx.commit().await?;
 
-        channel.as_snapshot().ok_or_else(not_found)
+        channel.as_snapshot().ok_or_else(deleted)
     }
 
-    pub async fn delete(&self, channel: &Id, deleted_at: &DateTime) -> Result<(), Error> {
+    pub async fn delete(&self, channel: &Id, deleted_at: &DateTime) -> Result<(), DeleteError> {
         let mut tx = self.db.begin().await?;
 
         let channel = tx
             .channels()
             .by_id(channel)
             .await
-            .not_found(|| Error::NotFound(channel.clone()))?;
+            .not_found(|| DeleteError::NotFound(channel.clone()))?;
         channel
             .as_snapshot()
-            .ok_or_else(|| Error::Deleted(channel.id().clone()))?;
+            .ok_or_else(|| DeleteError::Deleted(channel.id().clone()))?;
 
         let mut events = Vec::new();
 
         let messages = tx.messages().live(&channel).await?;
-        for message in messages {
-            let deleted = tx.sequence().next(deleted_at).await?;
-            let message = tx.messages().delete(&message, &deleted).await?;
-            events.extend(
-                message
-                    .events()
-                    .filter(Sequence::start_from(deleted.sequence))
-                    .map(Event::from),
-            );
+        let has_messages = messages
+            .iter()
+            .map(message::History::as_snapshot)
+            .any(|message| message.is_some());
+        if has_messages {
+            return Err(DeleteError::NotEmpty(channel.id().clone()));
         }
 
         let deleted = tx.sequence().next(deleted_at).await?;
@@ -135,20 +137,14 @@ impl<'a> Channels<'a> {
 
         Ok(())
     }
-
-    pub async fn recanonicalize(&self) -> Result<(), sqlx::Error> {
-        let mut tx = self.db.begin().await?;
-        tx.channels().recanonicalize().await?;
-        tx.commit().await?;
-
-        Ok(())
-    }
 }
 
 #[derive(Debug, thiserror::Error)]
 pub enum CreateError {
     #[error("channel named {0} already exists")]
     DuplicateName(Name),
+    #[error("invalid channel name: {0}")]
+    InvalidName(Name),
     #[error(transparent)]
     Database(#[from] sqlx::Error),
     #[error(transparent)]
@@ -186,6 +182,29 @@ impl From<LoadError> for Error {
 }
 
 #[derive(Debug, thiserror::Error)]
+pub enum DeleteError {
+    #[error("channel {0} not found")]
+    NotFound(Id),
+    #[error("channel {0} deleted")]
+    Deleted(Id),
+    #[error("channel {0} not empty")]
+    NotEmpty(Id),
+    #[error(transparent)]
+    Database(#[from] sqlx::Error),
+    #[error(transparent)]
+    Name(#[from] name::Error),
+}
+
+impl From<LoadError> for DeleteError {
+    fn from(error: LoadError) -> Self {
+        match error {
+            LoadError::Database(error) => error.into(),
+            LoadError::Name(error) => error.into(),
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
 pub enum ExpireError {
     #[error(transparent)]
     Database(#[from] sqlx::Error),
diff --git a/src/channel/history.rs b/src/channel/history.rs
index 4b9fcc7..ef2120d 100644
--- a/src/channel/history.rs
+++ b/src/channel/history.rs
@@ -1,8 +1,10 @@
+use itertools::Itertools as _;
+
 use super::{
     event::{Created, Deleted, Event},
     Channel, Id,
 };
-use crate::event::{Instant, ResumePoint, Sequence};
+use crate::event::{Instant, Sequence};
 
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct History {
@@ -26,9 +28,9 @@ impl History {
         self.channel.clone()
     }
 
-    pub fn as_of(&self, resume_point: impl Into<ResumePoint>) -> Option<Channel> {
+    pub fn as_of(&self, resume_point: Sequence) -> Option<Channel> {
         self.events()
-            .filter(Sequence::up_to(resume_point.into()))
+            .filter(Sequence::up_to(resume_point))
             .collect()
     }
 
@@ -41,7 +43,9 @@ impl History {
 // Event factories
 impl History {
     pub fn events(&self) -> impl Iterator<Item = Event> {
-        [self.created()].into_iter().chain(self.deleted())
+        [self.created()]
+            .into_iter()
+            .merge_by(self.deleted(), Sequence::merge)
     }
 
     fn created(&self) -> Event {
diff --git a/src/channel/mod.rs b/src/channel/mod.rs
index eb8200b..d5ba828 100644
--- a/src/channel/mod.rs
+++ b/src/channel/mod.rs
@@ -5,5 +5,6 @@ mod id;
 pub mod repo;
 mod routes;
 mod snapshot;
+mod validate;
 
 pub use self::{event::Event, history::History, id::Id, routes::router, snapshot::Channel};
diff --git a/src/channel/repo.rs b/src/channel/repo.rs
index a49db52..6612151 100644
--- a/src/channel/repo.rs
+++ b/src/channel/repo.rs
@@ -5,7 +5,7 @@ use crate::{
     channel::{Channel, History, Id},
     clock::DateTime,
     db::NotFound,
-    event::{Instant, ResumePoint, Sequence},
+    event::{Instant, Sequence},
     name::{self, Name},
 };
 
@@ -32,12 +32,13 @@ impl<'c> Channels<'c> {
         sqlx::query!(
             r#"
                 insert
-                into channel (id, created_at, created_sequence)
-                values ($1, $2, $3)
+                into channel (id, created_at, created_sequence, last_sequence)
+                values ($1, $2, $3, $4)
             "#,
             id,
             created.at,
             created.sequence,
+            created.sequence,
         )
         .execute(&mut *self.0)
         .await?;
@@ -144,13 +145,13 @@ impl<'c> Channels<'c> {
         Ok(channels)
     }
 
-    pub async fn replay(&mut self, resume_at: ResumePoint) -> Result<Vec<History>, LoadError> {
+    pub async fn replay(&mut self, resume_at: Sequence) -> Result<Vec<History>, LoadError> {
         let channels = sqlx::query!(
             r#"
                 select
                     id as "id: Id",
-                    name.display_name as "display_name: String",
-                    name.canonical_name as "canonical_name: String",
+                    name.display_name as "display_name?: String",
+                    name.canonical_name as "canonical_name?: String",
                     channel.created_at as "created_at: DateTime",
                     channel.created_sequence as "created_sequence: Sequence",
                     deleted.deleted_at as "deleted_at?: DateTime",
@@ -160,7 +161,7 @@ impl<'c> Channels<'c> {
                     using (id)
                 left join channel_deleted as deleted
                     using (id)
-                where coalesce(channel.created_sequence > $1, true)
+                where channel.last_sequence > $1
             "#,
             resume_at,
         )
@@ -191,6 +192,19 @@ impl<'c> Channels<'c> {
         let id = channel.id();
         sqlx::query!(
             r#"
+                update channel
+                set last_sequence = max(last_sequence, $1)
+                where id = $2
+                returning id as "id: Id"
+            "#,
+            deleted.sequence,
+            id,
+        )
+        .fetch_one(&mut *self.0)
+        .await?;
+
+        sqlx::query!(
+            r#"
                 insert into channel_deleted (id, deleted_at, deleted_sequence)
                 values ($1, $2, $3)
             "#,
@@ -300,38 +314,6 @@ impl<'c> Channels<'c> {
 
         Ok(channels)
     }
-
-    pub async fn recanonicalize(&mut self) -> Result<(), sqlx::Error> {
-        let channels = sqlx::query!(
-            r#"
-                select
-                    id as "id: Id",
-                    display_name as "display_name: String"
-                from channel_name
-            "#,
-        )
-        .fetch_all(&mut *self.0)
-        .await?;
-
-        for channel in channels {
-            let name = Name::from(channel.display_name);
-            let canonical_name = name.canonical();
-
-            sqlx::query!(
-                r#"
-                    update channel_name
-                    set canonical_name = $1
-                    where id = $2
-                "#,
-                canonical_name,
-                channel.id,
-            )
-            .execute(&mut *self.0)
-            .await?;
-        }
-
-        Ok(())
-    }
 }
 
 #[derive(Debug, thiserror::Error)]
diff --git a/src/channel/routes/channel/delete.rs b/src/channel/routes/channel/delete.rs
index 2d2b5f1..9c093c1 100644
--- a/src/channel/routes/channel/delete.rs
+++ b/src/channel/routes/channel/delete.rs
@@ -36,14 +36,19 @@ impl IntoResponse for Response {
 
 #[derive(Debug, thiserror::Error)]
 #[error(transparent)]
-pub struct Error(#[from] pub app::Error);
+pub struct Error(#[from] pub app::DeleteError);
 
 impl IntoResponse for Error {
     fn into_response(self) -> response::Response {
         let Self(error) = self;
         #[allow(clippy::match_wildcard_for_single_variants)]
         match error {
-            app::Error::NotFound(_) | app::Error::Deleted(_) => NotFound(error).into_response(),
+            app::DeleteError::NotFound(_) | app::DeleteError::Deleted(_) => {
+                NotFound(error).into_response()
+            }
+            app::DeleteError::NotEmpty(_) => {
+                (StatusCode::CONFLICT, error.to_string()).into_response()
+            }
             other => Internal::from(other).into_response(),
         }
     }
diff --git a/src/channel/routes/channel/test/delete.rs b/src/channel/routes/channel/test/delete.rs
index 0371b0a..77a0b03 100644
--- a/src/channel/routes/channel/test/delete.rs
+++ b/src/channel/routes/channel/test/delete.rs
@@ -55,7 +55,7 @@ pub async fn invalid_channel_id() {
 
     // Verify the response
 
-    assert!(matches!(error, app::Error::NotFound(id) if id == channel));
+    assert!(matches!(error, app::DeleteError::NotFound(id) if id == channel));
 }
 
 #[tokio::test]
@@ -84,7 +84,7 @@ pub async fn channel_deleted() {
 
     // Verify the response
 
-    assert!(matches!(error, app::Error::Deleted(id) if id == channel.id));
+    assert!(matches!(error, app::DeleteError::Deleted(id) if id == channel.id));
 }
 
 #[tokio::test]
@@ -113,7 +113,7 @@ pub async fn channel_expired() {
 
     // Verify the response
 
-    assert!(matches!(error, app::Error::Deleted(id) if id == channel.id));
+    assert!(matches!(error, app::DeleteError::Deleted(id) if id == channel.id));
 }
 
 #[tokio::test]
@@ -147,5 +147,31 @@ pub async fn channel_purged() {
 
     // Verify the response
 
-    assert!(matches!(error, app::Error::NotFound(id) if id == channel.id));
+    assert!(matches!(error, app::DeleteError::NotFound(id) if id == channel.id));
+}
+
+#[tokio::test]
+pub async fn channel_not_empty() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+    let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
+
+    // Send the request
+
+    let deleter = fixtures::identity::create(&app, &fixtures::now()).await;
+    let delete::Error(error) = delete::handler(
+        State(app.clone()),
+        Path(channel.id.clone()),
+        fixtures::now(),
+        deleter,
+    )
+    .await
+    .expect_err("deleting a channel with messages fails");
+
+    // Verify the response
+
+    assert!(matches!(error, app::DeleteError::NotEmpty(id) if id == channel.id));
 }
diff --git a/src/channel/routes/channel/test/post.rs b/src/channel/routes/channel/test/post.rs
index 111a703..bc0684b 100644
--- a/src/channel/routes/channel/test/post.rs
+++ b/src/channel/routes/channel/test/post.rs
@@ -15,6 +15,7 @@ async fn messages_in_order() {
     let app = fixtures::scratch_app().await;
     let sender = fixtures::identity::create(&app, &fixtures::now()).await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Call the endpoint (twice)
 
@@ -41,7 +42,7 @@ async fn messages_in_order() {
 
     let mut events = app
         .events()
-        .subscribe(None)
+        .subscribe(resume_point)
         .await
         .expect("subscribing to a valid channel succeeds")
         .filter_map(fixtures::event::message)
diff --git a/src/channel/routes/post.rs b/src/channel/routes/post.rs
index 810445c..2cf1cc0 100644
--- a/src/channel/routes/post.rs
+++ b/src/channel/routes/post.rs
@@ -54,6 +54,9 @@ impl IntoResponse for Error {
             app::CreateError::DuplicateName(_) => {
                 (StatusCode::CONFLICT, error.to_string()).into_response()
             }
+            app::CreateError::InvalidName(_) => {
+                (StatusCode::BAD_REQUEST, error.to_string()).into_response()
+            }
             other => Internal::from(other).into_response(),
         }
     }
diff --git a/src/channel/routes/test.rs b/src/channel/routes/test.rs
index 10b1e8d..cba8f2e 100644
--- a/src/channel/routes/test.rs
+++ b/src/channel/routes/test.rs
@@ -16,6 +16,7 @@ async fn new_channel() {
 
     let app = fixtures::scratch_app().await;
     let creator = fixtures::identity::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Call the endpoint
 
@@ -44,7 +45,7 @@ async fn new_channel() {
 
     let mut events = app
         .events()
-        .subscribe(None)
+        .subscribe(resume_point)
         .await
         .expect("subscribing never fails")
         .filter_map(fixtures::event::channel)
@@ -116,6 +117,30 @@ async fn conflicting_canonical_name() {
 }
 
 #[tokio::test]
+async fn invalid_name() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+    let creator = fixtures::identity::create(&app, &fixtures::now()).await;
+
+    // Call the endpoint
+
+    let name = fixtures::channel::propose_invalid_name();
+    let request = post::Request { name: name.clone() };
+    let post::Error(error) =
+        post::handler(State(app.clone()), creator, fixtures::now(), Json(request))
+            .await
+            .expect_err("invalid channel name should fail the request");
+
+    // Verify the structure of the response
+
+    assert!(matches!(
+        error,
+        app::CreateError::InvalidName(error_name) if name == error_name
+    ));
+}
+
+#[tokio::test]
 async fn name_reusable_after_delete() {
     // Set up the environment
 
diff --git a/src/channel/validate.rs b/src/channel/validate.rs
new file mode 100644
index 0000000..0c97293
--- /dev/null
+++ b/src/channel/validate.rs
@@ -0,0 +1,23 @@
+use unicode_segmentation::UnicodeSegmentation as _;
+
+use crate::name::Name;
+
+// Picked out of a hat. The power of two is not meaningful.
+const NAME_TOO_LONG: usize = 64;
+
+pub fn name(name: &Name) -> bool {
+    let display = name.display();
+
+    [
+        display.graphemes(true).count() < NAME_TOO_LONG,
+        display.chars().all(|ch| !ch.is_control()),
+        display.chars().next().is_some_and(|c| !c.is_whitespace()),
+        display.chars().last().is_some_and(|c| !c.is_whitespace()),
+        display
+            .chars()
+            .zip(display.chars().skip(1))
+            .all(|(a, b)| !(a.is_whitespace() && b.is_whitespace())),
+    ]
+    .into_iter()
+    .all(|value| value)
+}
diff --git a/src/cli/mod.rs b/src/cli.rs
index c75ce2b..0659851 100644
--- a/src/cli/mod.rs
+++ b/src/cli.rs
@@ -22,8 +22,6 @@ use crate::{
     ui,
 };
 
-pub mod recanonicalize;
-
 /// Command-line entry point for running the `hi` server.
 ///
 /// This is intended to be used as a Clap [Parser], to capture command-line
diff --git a/src/cli/recanonicalize.rs b/src/cli/recanonicalize.rs
deleted file mode 100644
index 9db5b77..0000000
--- a/src/cli/recanonicalize.rs
+++ /dev/null
@@ -1,86 +0,0 @@
-use sqlx::sqlite::SqlitePool;
-
-use crate::{app::App, db};
-
-/// Command-line entry point for repairing canonical names in the `hi` database.
-/// This command may be necessary after an upgrade, if the canonical forms of
-/// names has changed. It will re-calculate the canonical form of each name in
-/// the database, based on its display form, and store the results back to the
-/// database.
-///
-/// This is intended to be used as a Clap [Parser], to capture command-line
-/// arguments for the `hi-recanonicalize` command:
-///
-/// ```no_run
-/// # use hi::cli::recanonicalize::Error;
-/// #
-/// # #[tokio::main]
-/// # async fn main() -> Result<(), Error> {
-/// use clap::Parser;
-/// use hi::cli::recanonicalize::Args;
-///
-/// let args = Args::parse();
-/// args.run().await?;
-/// #   Ok(())
-/// # }
-/// ```
-#[derive(clap::Parser)]
-#[command(
-    version,
-    about = "Recanonicalize names in the `hi` database.",
-    long_about = r#"Recanonicalize names in the `hi` database.
-
-The `hi` server must not be running while this command is run.
-
-The database at `--database-url` will also be created, or upgraded, automatically."#
-)]
-pub struct Args {
-    /// Sqlite URL or path for the `hi` database
-    #[arg(short, long, env, default_value = "sqlite://.hi")]
-    database_url: String,
-
-    /// Sqlite URL or path for a backup of the `hi` database during upgrades
-    #[arg(short = 'D', long, env, default_value = "sqlite://.hi.backup")]
-    backup_database_url: String,
-}
-
-impl Args {
-    /// Recanonicalizes the `hi` database, using the parsed configuation in
-    /// `self`.
-    ///
-    /// This will perform the following tasks:
-    ///
-    /// * Migrate the `hi` database (at `--database-url`).
-    /// * Recanonicalize names in the `login` and `channel` tables.
-    ///
-    /// # Errors
-    ///
-    /// Will return `Err` if the canonicalization or database upgrade processes
-    /// fail. The specific [`Error`] variant will expose the cause
-    /// of the failure.
-    pub async fn run(self) -> Result<(), Error> {
-        let pool = self.pool().await?;
-
-        let app = App::from(pool);
-        app.logins().recanonicalize().await?;
-        app.channels().recanonicalize().await?;
-
-        Ok(())
-    }
-
-    async fn pool(&self) -> Result<SqlitePool, db::Error> {
-        db::prepare(&self.database_url, &self.backup_database_url).await
-    }
-}
-
-/// Errors that can be raised by [`Args::run`].
-#[derive(Debug, thiserror::Error)]
-#[error(transparent)]
-pub enum Error {
-    // /// Failure due to `io::Error`. See [`io::Error`].
-    // Io(#[from] io::Error),
-    /// Failure due to a database initialization error. See [`db::Error`].
-    Database(#[from] db::Error),
-    /// Failure due to a data manipulation error. See [`sqlx::Error`].
-    Sqlx(#[from] sqlx::Error),
-}
diff --git a/src/event/app.rs b/src/event/app.rs
index c754388..b309245 100644
--- a/src/event/app.rs
+++ b/src/event/app.rs
@@ -6,7 +6,7 @@ use futures::{
 use itertools::Itertools as _;
 use sqlx::sqlite::SqlitePool;
 
-use super::{broadcaster::Broadcaster, Event, ResumePoint, Sequence, Sequenced};
+use super::{broadcaster::Broadcaster, Event, Sequence, Sequenced};
 use crate::{
     channel::{self, repo::Provider as _},
     login::{self, repo::Provider as _},
@@ -26,9 +26,8 @@ impl<'a> Events<'a> {
 
     pub async fn subscribe(
         &self,
-        resume_at: impl Into<ResumePoint>,
+        resume_at: Sequence,
     ) -> Result<impl Stream<Item = Event> + std::fmt::Debug, Error> {
-        let resume_at = resume_at.into();
         // Subscribe before retrieving, to catch messages broadcast while we're
         // querying the DB. We'll prune out duplicates later.
         let live_messages = self.events.subscribe();
@@ -63,7 +62,7 @@ impl<'a> Events<'a> {
             .merge_by(channel_events, Sequence::merge)
             .merge_by(message_events, Sequence::merge)
             .collect::<Vec<_>>();
-        let resume_live_at = replay_events.last().map(Sequenced::sequence);
+        let resume_live_at = replay_events.last().map_or(resume_at, Sequenced::sequence);
 
         let replay = stream::iter(replay_events);
 
@@ -77,7 +76,7 @@ impl<'a> Events<'a> {
         Ok(replay.chain(live_messages))
     }
 
-    fn resume(resume_at: ResumePoint) -> impl for<'m> FnMut(&'m Event) -> future::Ready<bool> {
+    fn resume(resume_at: Sequence) -> impl for<'m> FnMut(&'m Event) -> future::Ready<bool> {
         let filter = Sequence::after(resume_at);
         move |event| future::ready(filter(event))
     }
diff --git a/src/event/mod.rs b/src/event/mod.rs
index 69c7a10..9996916 100644
--- a/src/event/mod.rs
+++ b/src/event/mod.rs
@@ -13,8 +13,6 @@ pub use self::{
     sequence::{Instant, Sequence, Sequenced},
 };
 
-pub type ResumePoint = Option<Sequence>;
-
 #[derive(Clone, Debug, Eq, PartialEq, serde::Serialize)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum Event {
diff --git a/src/event/routes/get.rs b/src/event/routes/get.rs
index 22e8762..ceebcc9 100644
--- a/src/event/routes/get.rs
+++ b/src/event/routes/get.rs
@@ -12,7 +12,7 @@ use futures::stream::{Stream, StreamExt as _};
 use crate::{
     app::App,
     error::{Internal, Unauthorized},
-    event::{app, extract::LastEventId, Event, ResumePoint, Sequence, Sequenced as _},
+    event::{app, extract::LastEventId, Event, Sequence, Sequenced as _},
     token::{app::ValidateError, extract::Identity},
 };
 
@@ -22,9 +22,7 @@ pub async fn handler(
     last_event_id: Option<LastEventId<Sequence>>,
     Query(query): Query<QueryParams>,
 ) -> Result<Response<impl Stream<Item = Event> + std::fmt::Debug>, Error> {
-    let resume_at = last_event_id
-        .map(LastEventId::into_inner)
-        .or(query.resume_point);
+    let resume_at = last_event_id.map_or(query.resume_point, LastEventId::into_inner);
 
     let stream = app.events().subscribe(resume_at).await?;
     let stream = app.tokens().limit_stream(identity.token, stream).await?;
@@ -32,9 +30,9 @@ pub async fn handler(
     Ok(Response(stream))
 }
 
-#[derive(Default, serde::Deserialize)]
+#[derive(serde::Deserialize)]
 pub struct QueryParams {
-    pub resume_point: ResumePoint,
+    pub resume_point: Sequence,
 }
 
 #[derive(Debug)]
diff --git a/src/event/routes/test/channel.rs b/src/event/routes/test/channel.rs
index 6a0a803..0695ab1 100644
--- a/src/event/routes/test/channel.rs
+++ b/src/event/routes/test/channel.rs
@@ -12,14 +12,19 @@ async fn creating() {
     // Set up the environment
 
     let app = fixtures::scratch_app().await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Create a channel
 
@@ -46,6 +51,7 @@ async fn previously_created() {
     // Set up the environment
 
     let app = fixtures::scratch_app().await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Create a channel
 
@@ -59,10 +65,14 @@ async fn previously_created() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Verify channel created event
 
@@ -81,14 +91,19 @@ async fn expiring() {
 
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::ancient()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Expire channels
 
@@ -113,6 +128,7 @@ async fn previously_expired() {
 
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::ancient()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Expire channels
 
@@ -124,10 +140,14 @@ async fn previously_expired() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Check for expiry event
     let _ = events
@@ -145,14 +165,19 @@ async fn deleting() {
 
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Delete the channel
 
@@ -177,6 +202,7 @@ async fn previously_deleted() {
 
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Delete the channel
 
@@ -188,10 +214,14 @@ async fn previously_deleted() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Check for expiry event
     let _ = events
@@ -209,6 +239,7 @@ async fn previously_purged() {
 
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::ancient()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Delete and purge the channel
 
@@ -225,10 +256,14 @@ async fn previously_purged() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Check for expiry event
     events
diff --git a/src/event/routes/test/invite.rs b/src/event/routes/test/invite.rs
index d24f474..73af62d 100644
--- a/src/event/routes/test/invite.rs
+++ b/src/event/routes/test/invite.rs
@@ -14,14 +14,19 @@ async fn accepting_invite() {
     let app = fixtures::scratch_app().await;
     let issuer = fixtures::login::create(&app, &fixtures::now()).await;
     let invite = fixtures::invite::issue(&app, &issuer, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Accept the invite
 
@@ -50,6 +55,7 @@ async fn previously_accepted_invite() {
     let app = fixtures::scratch_app().await;
     let issuer = fixtures::login::create(&app, &fixtures::now()).await;
     let invite = fixtures::invite::issue(&app, &issuer, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Accept the invite
 
@@ -63,10 +69,14 @@ async fn previously_accepted_invite() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Expect a login created event
 
diff --git a/src/event/routes/test/message.rs b/src/event/routes/test/message.rs
index 63a3f43..fafaeb3 100644
--- a/src/event/routes/test/message.rs
+++ b/src/event/routes/test/message.rs
@@ -16,14 +16,19 @@ async fn sending() {
 
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Call the endpoint
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Send a message
 
@@ -56,6 +61,7 @@ async fn previously_sent() {
 
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Send a message
 
@@ -74,10 +80,14 @@ async fn previously_sent() {
     // Call the endpoint
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Verify that an event is delivered
 
@@ -96,6 +106,7 @@ async fn sent_in_multiple_channels() {
 
     let app = fixtures::scratch_app().await;
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     let channels = [
         fixtures::channel::create(&app, &fixtures::now()).await,
@@ -115,9 +126,14 @@ async fn sent_in_multiple_channels() {
     // Call the endpoint
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) = get::handler(State(app), subscriber, None, Query::default())
-        .await
-        .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Verify the structure of the response.
 
@@ -141,6 +157,7 @@ async fn sent_sequentially() {
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     let messages = vec![
         fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await,
@@ -151,9 +168,14 @@ async fn sent_sequentially() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) = get::handler(State(app), subscriber, None, Query::default())
-        .await
-        .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Verify the expected events in the expected order
 
@@ -180,14 +202,19 @@ async fn expiring() {
     let channel = fixtures::channel::create(&app, &fixtures::ancient()).await;
     let sender = fixtures::login::create(&app, &fixtures::ancient()).await;
     let message = fixtures::message::send(&app, &channel, &sender, &fixtures::ancient()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Expire messages
 
@@ -214,6 +241,7 @@ async fn previously_expired() {
     let channel = fixtures::channel::create(&app, &fixtures::ancient()).await;
     let sender = fixtures::login::create(&app, &fixtures::ancient()).await;
     let message = fixtures::message::send(&app, &channel, &sender, &fixtures::ancient()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Expire messages
 
@@ -225,10 +253,14 @@ async fn previously_expired() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Check for expiry event
     let _ = events
@@ -248,19 +280,24 @@ async fn deleting() {
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
     let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Delete the message
 
     app.messages()
-        .delete(&message.id, &fixtures::now())
+        .delete(&sender, &message.id, &fixtures::now())
         .await
         .expect("deleting a valid message succeeds");
 
@@ -282,21 +319,26 @@ async fn previously_deleted() {
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
     let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Delete the message
 
     app.messages()
-        .delete(&message.id, &fixtures::now())
+        .delete(&sender, &message.id, &fixtures::now())
         .await
         .expect("deleting a valid message succeeds");
 
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Check for delete event
     let _ = events
@@ -316,11 +358,12 @@ async fn previously_purged() {
     let channel = fixtures::channel::create(&app, &fixtures::ancient()).await;
     let sender = fixtures::login::create(&app, &fixtures::ancient()).await;
     let message = fixtures::message::send(&app, &channel, &sender, &fixtures::ancient()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Purge the message
 
     app.messages()
-        .delete(&message.id, &fixtures::ancient())
+        .delete(&sender, &message.id, &fixtures::ancient())
         .await
         .expect("deleting a valid message succeeds");
 
@@ -332,10 +375,14 @@ async fn previously_purged() {
     // Subscribe
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Check for delete event
 
diff --git a/src/event/routes/test/resume.rs b/src/event/routes/test/resume.rs
index 62b9bad..fabda0c 100644
--- a/src/event/routes/test/resume.rs
+++ b/src/event/routes/test/resume.rs
@@ -16,6 +16,7 @@ async fn resume() {
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     let initial_message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
 
@@ -34,7 +35,7 @@ async fn resume() {
             State(app.clone()),
             subscriber.clone(),
             None,
-            Query::default(),
+            Query(get::QueryParams { resume_point }),
         )
         .await
         .expect("subscribe never fails");
@@ -55,7 +56,7 @@ async fn resume() {
         State(app),
         subscriber,
         Some(resume_at.into()),
-        Query::default(),
+        Query(get::QueryParams { resume_point }),
     )
     .await
     .expect("subscribe never fails");
@@ -98,6 +99,7 @@ async fn serial_resume() {
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
     let channel_a = fixtures::channel::create(&app, &fixtures::now()).await;
     let channel_b = fixtures::channel::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Call the endpoint
 
@@ -115,7 +117,7 @@ async fn serial_resume() {
             State(app.clone()),
             subscriber.clone(),
             None,
-            Query::default(),
+            Query(get::QueryParams { resume_point }),
         )
         .await
         .expect("subscribe never fails");
@@ -156,7 +158,7 @@ async fn serial_resume() {
             State(app.clone()),
             subscriber.clone(),
             Some(resume_at.into()),
-            Query::default(),
+            Query(get::QueryParams { resume_point }),
         )
         .await
         .expect("subscribe never fails");
@@ -197,7 +199,7 @@ async fn serial_resume() {
             State(app.clone()),
             subscriber.clone(),
             Some(resume_at.into()),
-            Query::default(),
+            Query(get::QueryParams { resume_point }),
         )
         .await
         .expect("subscribe never fails");
diff --git a/src/event/routes/test/setup.rs b/src/event/routes/test/setup.rs
index 007b03d..26b7ea7 100644
--- a/src/event/routes/test/setup.rs
+++ b/src/event/routes/test/setup.rs
@@ -15,6 +15,7 @@ async fn previously_completed() {
     // Set up the environment
 
     let app = fixtures::scratch_app().await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Complete initial setup
 
@@ -28,10 +29,14 @@ async fn previously_completed() {
     // Subscribe to events
 
     let subscriber = fixtures::identity::create(&app, &fixtures::now()).await;
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Expect a login created event
 
diff --git a/src/event/routes/test/token.rs b/src/event/routes/test/token.rs
index 2039d9b..fa76865 100644
--- a/src/event/routes/test/token.rs
+++ b/src/event/routes/test/token.rs
@@ -14,6 +14,7 @@ async fn terminates_on_token_expiry() {
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe via the endpoint
 
@@ -21,10 +22,14 @@ async fn terminates_on_token_expiry() {
     let subscriber =
         fixtures::identity::logged_in(&app, &subscriber_creds, &fixtures::ancient()).await;
 
-    let get::Response(events) =
-        get::handler(State(app.clone()), subscriber, None, Query::default())
-            .await
-            .expect("subscribe never fails");
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber,
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
 
     // Verify the resulting stream's behaviour
 
@@ -56,6 +61,7 @@ async fn terminates_on_logout() {
     let app = fixtures::scratch_app().await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
     let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
 
     // Subscribe via the endpoint
 
@@ -65,7 +71,7 @@ async fn terminates_on_logout() {
         State(app.clone()),
         subscriber.clone(),
         None,
-        Query::default(),
+        Query(get::QueryParams { resume_point }),
     )
     .await
     .expect("subscribe never fails");
@@ -93,3 +99,53 @@ async fn terminates_on_logout() {
         .expect_none("end of stream")
         .await;
 }
+
+#[tokio::test]
+async fn terminates_on_password_change() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+    let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let resume_point = fixtures::boot::resume_point(&app).await;
+
+    // Subscribe via the endpoint
+
+    let creds = fixtures::login::create_with_password(&app, &fixtures::now()).await;
+    let cookie = fixtures::cookie::logged_in(&app, &creds, &fixtures::now()).await;
+    let subscriber = fixtures::identity::from_cookie(&app, &cookie, &fixtures::now()).await;
+
+    let get::Response(events) = get::handler(
+        State(app.clone()),
+        subscriber.clone(),
+        None,
+        Query(get::QueryParams { resume_point }),
+    )
+    .await
+    .expect("subscribe never fails");
+
+    // Verify the resulting stream's behaviour
+
+    let (_, password) = creds;
+    let to = fixtures::login::propose_password();
+    app.tokens()
+        .change_password(&subscriber.login, &password, &to, &fixtures::now())
+        .await
+        .expect("expiring tokens succeeds");
+
+    // These should not be delivered.
+
+    let messages = [
+        fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await,
+        fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await,
+        fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await,
+    ];
+
+    events
+        .filter_map(fixtures::event::message)
+        .filter_map(fixtures::event::message::sent)
+        .filter(|event| future::ready(messages.iter().any(|message| &event.message == message)))
+        .next()
+        .expect_none("end of stream")
+        .await;
+}
diff --git a/src/event/sequence.rs b/src/event/sequence.rs
index 9bc399b..77281c2 100644
--- a/src/event/sequence.rs
+++ b/src/event/sequence.rs
@@ -1,6 +1,5 @@
 use std::fmt;
 
-use super::ResumePoint;
 use crate::clock::DateTime;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq, serde::Serialize)]
@@ -51,18 +50,18 @@ impl fmt::Display for Sequence {
 }
 
 impl Sequence {
-    pub fn up_to<E>(resume_point: ResumePoint) -> impl for<'e> Fn(&'e E) -> bool
+    pub fn up_to<E>(resume_point: Sequence) -> impl for<'e> Fn(&'e E) -> bool
     where
         E: Sequenced,
     {
-        move |event| resume_point.map_or(true, |resume_point| event.sequence() <= resume_point)
+        move |event| event.sequence() <= resume_point
     }
 
-    pub fn after<E>(resume_point: ResumePoint) -> impl for<'e> Fn(&'e E) -> bool
+    pub fn after<E>(resume_point: Sequence) -> impl for<'e> Fn(&'e E) -> bool
     where
         E: Sequenced,
     {
-        move |event| resume_point < Some(event.sequence())
+        move |event| resume_point < event.sequence()
     }
 
     pub fn start_from<E>(resume_point: Self) -> impl for<'e> Fn(&'e E) -> bool
diff --git a/src/invite/app.rs b/src/invite/app.rs
index 176075f..d4e877a 100644
--- a/src/invite/app.rs
+++ b/src/invite/app.rs
@@ -5,8 +5,11 @@ use super::{repo::Provider as _, Id, Invite, Summary};
 use crate::{
     clock::DateTime,
     db::{Duplicate as _, NotFound as _},
-    event::{repo::Provider as _, Broadcaster, Event},
-    login::{repo::Provider as _, Login, Password},
+    event::Broadcaster,
+    login::{
+        create::{self, Create},
+        Login, Password,
+    },
     name::Name,
     token::{repo::Provider as _, Secret},
 };
@@ -44,6 +47,8 @@ impl<'a> Invites<'a> {
         password: &Password,
         accepted_at: &DateTime,
     ) -> Result<(Login, Secret), AcceptError> {
+        let create = Create::begin(name, password, accepted_at);
+
         let mut tx = self.db.begin().await?;
         let invite = tx
             .invites()
@@ -55,23 +60,20 @@ impl<'a> Invites<'a> {
         // the invite. Final validation is in the next tx.
         tx.commit().await?;
 
-        let password_hash = password.hash()?;
+        let validated = create.validate()?;
 
         let mut tx = self.db.begin().await?;
         // If the invite has been deleted or accepted in the interim, this step will
         // catch it.
         tx.invites().accept(&invite).await?;
-        let created = tx.sequence().next(accepted_at).await?;
-        let login = tx
-            .logins()
-            .create(name, &password_hash, &created)
+        let stored = validated
+            .store(&mut tx)
             .await
             .duplicate(|| AcceptError::DuplicateLogin(name.clone()))?;
-        let secret = tx.tokens().issue(&login, accepted_at).await?;
+        let secret = tx.tokens().issue(stored.login(), accepted_at).await?;
         tx.commit().await?;
 
-        self.events
-            .broadcast(login.events().map(Event::from).collect::<Vec<_>>());
+        let login = stored.publish(self.events);
 
         Ok((login.as_created(), secret))
     }
@@ -92,6 +94,8 @@ impl<'a> Invites<'a> {
 pub enum AcceptError {
     #[error("invite not found: {0}")]
     NotFound(Id),
+    #[error("invalid login name: {0}")]
+    InvalidName(Name),
     #[error("name in use: {0}")]
     DuplicateLogin(Name),
     #[error(transparent)]
@@ -99,3 +103,12 @@ pub enum AcceptError {
     #[error(transparent)]
     PasswordHash(#[from] password_hash::Error),
 }
+
+impl From<create::Error> for AcceptError {
+    fn from(error: create::Error) -> Self {
+        match error {
+            create::Error::InvalidName(name) => Self::InvalidName(name),
+            create::Error::PasswordHash(error) => Self::PasswordHash(error),
+        }
+    }
+}
diff --git a/src/invite/routes/invite/post.rs b/src/invite/routes/invite/post.rs
index 0dd8dba..bb68e07 100644
--- a/src/invite/routes/invite/post.rs
+++ b/src/invite/routes/invite/post.rs
@@ -36,7 +36,8 @@ pub struct Request {
     pub password: Password,
 }
 
-#[derive(Debug)]
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
 pub struct Error(pub app::AcceptError);
 
 impl IntoResponse for Error {
@@ -44,6 +45,9 @@ impl IntoResponse for Error {
         let Self(error) = self;
         match error {
             app::AcceptError::NotFound(_) => NotFound(error).into_response(),
+            app::AcceptError::InvalidName(_) => {
+                (StatusCode::BAD_REQUEST, error.to_string()).into_response()
+            }
             app::AcceptError::DuplicateLogin(_) => {
                 (StatusCode::CONFLICT, error.to_string()).into_response()
             }
diff --git a/src/invite/routes/invite/test/post.rs b/src/invite/routes/invite/test/post.rs
index 65ab61e..40e0580 100644
--- a/src/invite/routes/invite/test/post.rs
+++ b/src/invite/routes/invite/test/post.rs
@@ -206,3 +206,35 @@ async fn conflicting_name() {
         matches!(error, AcceptError::DuplicateLogin(error_name) if error_name == conflicting_name)
     );
 }
+
+#[tokio::test]
+async fn invalid_name() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+    let issuer = fixtures::login::create(&app, &fixtures::now()).await;
+    let invite = fixtures::invite::issue(&app, &issuer, &fixtures::now()).await;
+
+    // Call the endpoint
+
+    let name = fixtures::login::propose_invalid_name();
+    let password = fixtures::login::propose_password();
+    let identity = fixtures::cookie::not_logged_in();
+    let request = post::Request {
+        name: name.clone(),
+        password: password.clone(),
+    };
+    let post::Error(error) = post::handler(
+        State(app.clone()),
+        fixtures::now(),
+        identity,
+        Path(invite.id),
+        Json(request),
+    )
+    .await
+    .expect_err("using an invalid name should fail");
+
+    // Verify the response
+
+    assert!(matches!(error, AcceptError::InvalidName(error_name) if name == error_name));
+}
diff --git a/src/login/app.rs b/src/login/app.rs
index 2f5896f..f458561 100644
--- a/src/login/app.rs
+++ b/src/login/app.rs
@@ -1,65 +1,56 @@
 use sqlx::sqlite::SqlitePool;
 
-use super::repo::Provider as _;
-
-#[cfg(test)]
-use super::{Login, Password};
-#[cfg(test)]
-use crate::{
-    clock::DateTime,
-    event::{repo::Provider as _, Broadcaster, Event},
-    name::Name,
+use super::{
+    create::{self, Create},
+    Login, Password,
 };
+use crate::{clock::DateTime, event::Broadcaster, name::Name};
 
 pub struct Logins<'a> {
     db: &'a SqlitePool,
-    #[cfg(test)]
     events: &'a Broadcaster,
 }
 
 impl<'a> Logins<'a> {
-    #[cfg(not(test))]
-    pub const fn new(db: &'a SqlitePool) -> Self {
-        Self { db }
-    }
-
-    #[cfg(test)]
     pub const fn new(db: &'a SqlitePool, events: &'a Broadcaster) -> Self {
         Self { db, events }
     }
 
-    #[cfg(test)]
     pub async fn create(
         &self,
         name: &Name,
         password: &Password,
         created_at: &DateTime,
     ) -> Result<Login, CreateError> {
-        let password_hash = password.hash()?;
+        let create = Create::begin(name, password, created_at);
+        let validated = create.validate()?;
 
         let mut tx = self.db.begin().await?;
-        let created = tx.sequence().next(created_at).await?;
-        let login = tx.logins().create(name, &password_hash, &created).await?;
+        let stored = validated.store(&mut tx).await?;
         tx.commit().await?;
 
-        self.events
-            .broadcast(login.events().map(Event::from).collect::<Vec<_>>());
+        let login = stored.publish(self.events);
 
         Ok(login.as_created())
     }
-
-    pub async fn recanonicalize(&self) -> Result<(), sqlx::Error> {
-        let mut tx = self.db.begin().await?;
-        tx.logins().recanonicalize().await?;
-        tx.commit().await?;
-
-        Ok(())
-    }
 }
 
 #[derive(Debug, thiserror::Error)]
-#[error(transparent)]
 pub enum CreateError {
-    Database(#[from] sqlx::Error),
+    #[error("invalid login name: {0}")]
+    InvalidName(Name),
+    #[error(transparent)]
     PasswordHash(#[from] password_hash::Error),
+    #[error(transparent)]
+    Database(#[from] sqlx::Error),
+}
+
+#[cfg(test)]
+impl From<create::Error> for CreateError {
+    fn from(error: create::Error) -> Self {
+        match error {
+            create::Error::InvalidName(name) => Self::InvalidName(name),
+            create::Error::PasswordHash(error) => Self::PasswordHash(error),
+        }
+    }
 }
diff --git a/src/login/create.rs b/src/login/create.rs
new file mode 100644
index 0000000..693daaf
--- /dev/null
+++ b/src/login/create.rs
@@ -0,0 +1,95 @@
+use sqlx::{sqlite::Sqlite, Transaction};
+
+use super::{password::StoredHash, repo::Provider as _, validate, History, Password};
+use crate::{
+    clock::DateTime,
+    event::{repo::Provider as _, Broadcaster, Event},
+    name::Name,
+};
+
+pub struct Create<'a> {
+    name: &'a Name,
+    password: &'a Password,
+    created_at: &'a DateTime,
+}
+
+impl<'a> Create<'a> {
+    #[must_use = "dropping a login creation attempt is likely a mistake"]
+    pub fn begin(name: &'a Name, password: &'a Password, created_at: &'a DateTime) -> Self {
+        Self {
+            name,
+            password,
+            created_at,
+        }
+    }
+
+    #[must_use = "dropping a login creation attempt is likely a mistake"]
+    pub fn validate(self) -> Result<Validated<'a>, Error> {
+        let Self {
+            name,
+            password,
+            created_at,
+        } = self;
+
+        if !validate::name(name) {
+            return Err(Error::InvalidName(name.clone()));
+        }
+
+        let password_hash = password.hash()?;
+
+        Ok(Validated {
+            name,
+            password_hash,
+            created_at,
+        })
+    }
+}
+
+pub struct Validated<'a> {
+    name: &'a Name,
+    password_hash: StoredHash,
+    created_at: &'a DateTime,
+}
+
+impl<'a> Validated<'a> {
+    #[must_use = "dropping a login creation attempt is likely a mistake"]
+    pub async fn store<'c>(self, tx: &mut Transaction<'c, Sqlite>) -> Result<Stored, sqlx::Error> {
+        let Self {
+            name,
+            password_hash,
+            created_at,
+        } = self;
+
+        let created = tx.sequence().next(created_at).await?;
+        let login = tx.logins().create(name, &password_hash, &created).await?;
+
+        Ok(Stored { login })
+    }
+}
+
+pub struct Stored {
+    login: History,
+}
+
+impl Stored {
+    #[must_use = "dropping a login creation attempt is likely a mistake"]
+    pub fn publish(self, events: &Broadcaster) -> History {
+        let Self { login } = self;
+
+        events.broadcast(login.events().map(Event::from).collect::<Vec<_>>());
+
+        login
+    }
+
+    pub fn login(&self) -> &History {
+        &self.login
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("invalid login name: {0}")]
+    InvalidName(Name),
+    #[error(transparent)]
+    PasswordHash(#[from] password_hash::Error),
+}
diff --git a/src/login/history.rs b/src/login/history.rs
index daad579..8161b0b 100644
--- a/src/login/history.rs
+++ b/src/login/history.rs
@@ -2,7 +2,7 @@ use super::{
     event::{Created, Event},
     Id, Login,
 };
-use crate::event::{Instant, ResumePoint, Sequence};
+use crate::event::{Instant, Sequence};
 
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct History {
@@ -24,9 +24,9 @@ impl History {
         self.login.clone()
     }
 
-    pub fn as_of(&self, resume_point: impl Into<ResumePoint>) -> Option<Login> {
+    pub fn as_of(&self, resume_point: Sequence) -> Option<Login> {
         self.events()
-            .filter(Sequence::up_to(resume_point.into()))
+            .filter(Sequence::up_to(resume_point))
             .collect()
     }
 
diff --git a/src/login/mod.rs b/src/login/mod.rs
index 279e9a6..006fa0c 100644
--- a/src/login/mod.rs
+++ b/src/login/mod.rs
@@ -1,4 +1,6 @@
+#[cfg(test)]
 pub mod app;
+pub mod create;
 pub mod event;
 mod history;
 mod id;
@@ -6,6 +8,7 @@ pub mod password;
 pub mod repo;
 mod routes;
 mod snapshot;
+mod validate;
 
 pub use self::{
     event::Event, history::History, id::Id, password::Password, routes::router, snapshot::Login,
diff --git a/src/login/repo.rs b/src/login/repo.rs
index 611edd6..1c63a4b 100644
--- a/src/login/repo.rs
+++ b/src/login/repo.rs
@@ -3,7 +3,7 @@ use sqlx::{sqlite::Sqlite, SqliteConnection, Transaction};
 
 use crate::{
     clock::DateTime,
-    event::{Instant, ResumePoint, Sequence},
+    event::{Instant, Sequence},
     login::{password::StoredHash, History, Id, Login},
     name::{self, Name},
 };
@@ -58,7 +58,30 @@ impl<'c> Logins<'c> {
         Ok(login)
     }
 
-    pub async fn all(&mut self, resume_at: ResumePoint) -> Result<Vec<History>, LoadError> {
+    pub async fn set_password(
+        &mut self,
+        login: &History,
+        to: &StoredHash,
+    ) -> Result<(), sqlx::Error> {
+        let login = login.id();
+
+        sqlx::query_scalar!(
+            r#"
+                update login
+                set password_hash = $1
+                where id = $2
+                returning id as "id: Id"
+            "#,
+            to,
+            login,
+        )
+        .fetch_one(&mut *self.0)
+        .await?;
+
+        Ok(())
+    }
+
+    pub async fn all(&mut self, resume_at: Sequence) -> Result<Vec<History>, LoadError> {
         let logins = sqlx::query!(
             r#"
                 select
@@ -68,7 +91,7 @@ impl<'c> Logins<'c> {
                     created_sequence as "created_sequence: Sequence",
                     created_at as "created_at: DateTime"
                 from login
-                    where coalesce(created_sequence <= $1, true)
+                    where created_sequence <= $1
                     order by canonical_name
             "#,
             resume_at,
@@ -90,7 +113,7 @@ impl<'c> Logins<'c> {
         Ok(logins)
     }
 
-    pub async fn replay(&mut self, resume_at: ResumePoint) -> Result<Vec<History>, LoadError> {
+    pub async fn replay(&mut self, resume_at: Sequence) -> Result<Vec<History>, LoadError> {
         let logins = sqlx::query!(
             r#"
                 select
@@ -100,7 +123,7 @@ impl<'c> Logins<'c> {
                     created_sequence as "created_sequence: Sequence",
                     created_at as "created_at: DateTime"
                 from login
-                where coalesce(login.created_sequence > $1, true)
+                where login.created_sequence > $1
             "#,
             resume_at,
         )
@@ -120,38 +143,6 @@ impl<'c> Logins<'c> {
 
         Ok(logins)
     }
-
-    pub async fn recanonicalize(&mut self) -> Result<(), sqlx::Error> {
-        let logins = sqlx::query!(
-            r#"
-                select
-                    id as "id: Id",
-                    display_name as "display_name: String"
-                from login
-            "#,
-        )
-        .fetch_all(&mut *self.0)
-        .await?;
-
-        for login in logins {
-            let name = Name::from(login.display_name);
-            let canonical_name = name.canonical();
-
-            sqlx::query!(
-                r#"
-                    update login
-                    set canonical_name = $1
-                    where id = $2
-                "#,
-                canonical_name,
-                login.id,
-            )
-            .execute(&mut *self.0)
-            .await?;
-        }
-
-        Ok(())
-    }
 }
 
 #[derive(Debug, thiserror::Error)]
diff --git a/src/login/routes/mod.rs b/src/login/routes/mod.rs
index 8cb8852..bbd0c3f 100644
--- a/src/login/routes/mod.rs
+++ b/src/login/routes/mod.rs
@@ -4,9 +4,11 @@ use crate::app::App;
 
 mod login;
 mod logout;
+mod password;
 
 pub fn router() -> Router<App> {
     Router::new()
+        .route("/api/password", post(password::post::handler))
         .route("/api/auth/login", post(login::post::handler))
         .route("/api/auth/logout", post(logout::post::handler))
 }
diff --git a/src/login/routes/password/mod.rs b/src/login/routes/password/mod.rs
new file mode 100644
index 0000000..36b384e
--- /dev/null
+++ b/src/login/routes/password/mod.rs
@@ -0,0 +1,4 @@
+pub mod post;
+
+#[cfg(test)]
+mod test;
diff --git a/src/login/routes/password/post.rs b/src/login/routes/password/post.rs
new file mode 100644
index 0000000..4723754
--- /dev/null
+++ b/src/login/routes/password/post.rs
@@ -0,0 +1,54 @@
+use axum::{
+    extract::{Json, State},
+    http::StatusCode,
+    response::{IntoResponse, Response},
+};
+
+use crate::{
+    app::App,
+    clock::RequestedAt,
+    error::Internal,
+    login::{Login, Password},
+    token::{
+        app,
+        extract::{Identity, IdentityCookie},
+    },
+};
+
+pub async fn handler(
+    State(app): State<App>,
+    RequestedAt(now): RequestedAt,
+    identity: Identity,
+    cookie: IdentityCookie,
+    Json(request): Json<Request>,
+) -> Result<(IdentityCookie, Json<Login>), Error> {
+    let (login, secret) = app
+        .tokens()
+        .change_password(&identity.login, &request.password, &request.to, &now)
+        .await
+        .map_err(Error)?;
+    let cookie = cookie.set(secret);
+    Ok((cookie, Json(login)))
+}
+
+#[derive(serde::Deserialize)]
+pub struct Request {
+    pub password: Password,
+    pub to: Password,
+}
+
+#[derive(Debug, thiserror::Error)]
+#[error(transparent)]
+pub struct Error(#[from] pub app::LoginError);
+
+impl IntoResponse for Error {
+    fn into_response(self) -> Response {
+        let Self(error) = self;
+        match error {
+            app::LoginError::Rejected => {
+                (StatusCode::BAD_REQUEST, "invalid name or password").into_response()
+            }
+            other => Internal::from(other).into_response(),
+        }
+    }
+}
diff --git a/src/login/routes/password/test.rs b/src/login/routes/password/test.rs
new file mode 100644
index 0000000..c1974bf
--- /dev/null
+++ b/src/login/routes/password/test.rs
@@ -0,0 +1,68 @@
+use axum::extract::{Json, State};
+
+use super::post;
+use crate::{
+    test::fixtures,
+    token::app::{LoginError, ValidateError},
+};
+
+#[tokio::test]
+async fn password_change() {
+    // Set up the environment
+    let app = fixtures::scratch_app().await;
+    let creds = fixtures::login::create_with_password(&app, &fixtures::now()).await;
+    let cookie = fixtures::cookie::logged_in(&app, &creds, &fixtures::now()).await;
+    let identity = fixtures::identity::from_cookie(&app, &cookie, &fixtures::now()).await;
+
+    // Call the endpoint
+    let (name, password) = creds;
+    let to = fixtures::login::propose_password();
+    let request = post::Request {
+        password: password.clone(),
+        to: to.clone(),
+    };
+    let (new_cookie, Json(response)) = post::handler(
+        State(app.clone()),
+        fixtures::now(),
+        identity.clone(),
+        cookie.clone(),
+        Json(request),
+    )
+    .await
+    .expect("changing passwords succeeds");
+
+    // Verify that we have a new session
+    assert_ne!(cookie.secret(), new_cookie.secret());
+
+    // Verify that we're still ourselves
+    assert_eq!(identity.login, response);
+
+    // Verify that our original token is no longer valid
+    let validate_err = app
+        .tokens()
+        .validate(
+            &cookie
+                .secret()
+                .expect("original identity cookie has a secret"),
+            &fixtures::now(),
+        )
+        .await
+        .expect_err("validating the original identity secret should fail");
+    assert!(matches!(validate_err, ValidateError::InvalidToken));
+
+    // Verify that our original password is no longer valid
+    let login_err = app
+        .tokens()
+        .login(&name, &password, &fixtures::now())
+        .await
+        .expect_err("logging in with the original password should fail");
+    assert!(matches!(login_err, LoginError::Rejected));
+
+    // Verify that our new password is valid
+    let (login, _) = app
+        .tokens()
+        .login(&name, &to, &fixtures::now())
+        .await
+        .expect("logging in with the new password should succeed");
+    assert_eq!(identity.login, login);
+}
diff --git a/src/login/validate.rs b/src/login/validate.rs
new file mode 100644
index 0000000..0c97293
--- /dev/null
+++ b/src/login/validate.rs
@@ -0,0 +1,23 @@
+use unicode_segmentation::UnicodeSegmentation as _;
+
+use crate::name::Name;
+
+// Picked out of a hat. The power of two is not meaningful.
+const NAME_TOO_LONG: usize = 64;
+
+pub fn name(name: &Name) -> bool {
+    let display = name.display();
+
+    [
+        display.graphemes(true).count() < NAME_TOO_LONG,
+        display.chars().all(|ch| !ch.is_control()),
+        display.chars().next().is_some_and(|c| !c.is_whitespace()),
+        display.chars().last().is_some_and(|c| !c.is_whitespace()),
+        display
+            .chars()
+            .zip(display.chars().skip(1))
+            .all(|(a, b)| !(a.is_whitespace() && b.is_whitespace())),
+    ]
+    .into_iter()
+    .all(|value| value)
+}
diff --git a/src/bin/hi.rs b/src/main.rs
index d0830ff..d0830ff 100644
--- a/src/bin/hi.rs
+++ b/src/main.rs
diff --git a/src/message/app.rs b/src/message/app.rs
index eed6ba4..137a27d 100644
--- a/src/message/app.rs
+++ b/src/message/app.rs
@@ -45,16 +45,24 @@ impl<'a> Messages<'a> {
         Ok(message.as_sent())
     }
 
-    pub async fn delete(&self, message: &Id, deleted_at: &DateTime) -> Result<(), DeleteError> {
+    pub async fn delete(
+        &self,
+        deleted_by: &Login,
+        message: &Id,
+        deleted_at: &DateTime,
+    ) -> Result<(), DeleteError> {
         let mut tx = self.db.begin().await?;
         let message = tx
             .messages()
             .by_id(message)
             .await
             .not_found(|| DeleteError::NotFound(message.clone()))?;
-        message
+        let snapshot = message
             .as_snapshot()
             .ok_or_else(|| DeleteError::Deleted(message.id().clone()))?;
+        if snapshot.sender != deleted_by.id {
+            return Err(DeleteError::NotSender(deleted_by.clone()));
+        }
 
         let deleted = tx.sequence().next(deleted_at).await?;
         let message = tx.messages().delete(&message, &deleted).await?;
@@ -138,6 +146,8 @@ impl From<channel::repo::LoadError> for SendError {
 pub enum DeleteError {
     #[error("message {0} not found")]
     NotFound(Id),
+    #[error("login {} not the message's sender", .0.id)]
+    NotSender(Login),
     #[error("message {0} deleted")]
     Deleted(Id),
     #[error(transparent)]
diff --git a/src/message/history.rs b/src/message/history.rs
index 0424d0d..ed8f5df 100644
--- a/src/message/history.rs
+++ b/src/message/history.rs
@@ -1,8 +1,10 @@
+use itertools::Itertools as _;
+
 use super::{
     event::{Deleted, Event, Sent},
     Id, Message,
 };
-use crate::event::{Instant, ResumePoint, Sequence};
+use crate::event::{Instant, Sequence};
 
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct History {
@@ -25,9 +27,9 @@ impl History {
         self.message.clone()
     }
 
-    pub fn as_of(&self, resume_point: impl Into<ResumePoint>) -> Option<Message> {
+    pub fn as_of(&self, resume_point: Sequence) -> Option<Message> {
         self.events()
-            .filter(Sequence::up_to(resume_point.into()))
+            .filter(Sequence::up_to(resume_point))
             .collect()
     }
 
@@ -57,6 +59,8 @@ impl History {
     }
 
     pub fn events(&self) -> impl Iterator<Item = Event> {
-        [self.sent()].into_iter().chain(self.deleted())
+        [self.sent()]
+            .into_iter()
+            .merge_by(self.deleted(), Sequence::merge)
     }
 }
diff --git a/src/message/repo.rs b/src/message/repo.rs
index c8ceceb..14f8eaf 100644
--- a/src/message/repo.rs
+++ b/src/message/repo.rs
@@ -4,7 +4,7 @@ use super::{snapshot::Message, Body, History, Id};
 use crate::{
     channel,
     clock::DateTime,
-    event::{Instant, ResumePoint, Sequence},
+    event::{Instant, Sequence},
     login::{self, Login},
 };
 
@@ -34,8 +34,8 @@ impl<'c> Messages<'c> {
         let message = sqlx::query!(
             r#"
                 insert into message
-                    (id, channel, sender, sent_at, sent_sequence, body)
-                values ($1, $2, $3, $4, $5, $6)
+                    (id, channel, sender, sent_at, sent_sequence, body, last_sequence)
+                values ($1, $2, $3, $4, $5, $6, $7)
                 returning
                     id as "id: Id",
                     channel as "channel: channel::Id",
@@ -50,6 +50,7 @@ impl<'c> Messages<'c> {
             sent.at,
             sent.sequence,
             body,
+            sent.sequence,
         )
         .map(|row| History {
             message: Message {
@@ -106,22 +107,22 @@ impl<'c> Messages<'c> {
         Ok(messages)
     }
 
-    pub async fn all(&mut self, resume_at: ResumePoint) -> Result<Vec<History>, sqlx::Error> {
+    pub async fn all(&mut self, resume_at: Sequence) -> Result<Vec<History>, sqlx::Error> {
         let messages = sqlx::query!(
             r#"
                 select
                     message.channel as "channel: channel::Id",
                     message.sender as "sender: login::Id",
-                    id as "id: Id",
+                    message.id as "id: Id",
                     message.body as "body: Body",
                     message.sent_at as "sent_at: DateTime",
                     message.sent_sequence as "sent_sequence: Sequence",
-                    deleted.deleted_at as "deleted_at: DateTime",
-                    deleted.deleted_sequence as "deleted_sequence: Sequence"
+                    deleted.deleted_at as "deleted_at?: DateTime",
+                    deleted.deleted_sequence as "deleted_sequence?: Sequence"
                 from message
                 left join message_deleted as deleted
                     using (id)
-                where coalesce(message.sent_sequence <= $2, true)
+                where message.sent_sequence <= $1
                 order by message.sent_sequence
             "#,
             resume_at,
@@ -205,12 +206,14 @@ impl<'c> Messages<'c> {
         sqlx::query!(
             r#"
                 update message
-                set body = ''
-                where id = $1
+                set body = '', last_sequence = max(last_sequence, $1)
+                where id = $2
+                returning id as "id: Id"
             "#,
+            deleted.sequence,
             id,
         )
-        .execute(&mut *self.0)
+        .fetch_one(&mut *self.0)
         .await?;
 
         let message = self.by_id(id).await?;
@@ -282,7 +285,7 @@ impl<'c> Messages<'c> {
         Ok(messages)
     }
 
-    pub async fn replay(&mut self, resume_at: ResumePoint) -> Result<Vec<History>, sqlx::Error> {
+    pub async fn replay(&mut self, resume_at: Sequence) -> Result<Vec<History>, sqlx::Error> {
         let messages = sqlx::query!(
             r#"
                 select
@@ -292,12 +295,12 @@ impl<'c> Messages<'c> {
                     message.sent_at as "sent_at: DateTime",
                     message.sent_sequence as "sent_sequence: Sequence",
                     message.body as "body: Body",
-                    deleted.deleted_at as "deleted_at: DateTime",
-                    deleted.deleted_sequence as "deleted_sequence: Sequence"
+                    deleted.deleted_at as "deleted_at?: DateTime",
+                    deleted.deleted_sequence as "deleted_sequence?: Sequence"
                 from message
                 left join message_deleted as deleted
                     using (id)
-                where coalesce(message.sent_sequence > $1, true)
+                where message.last_sequence > $1
             "#,
             resume_at,
         )
diff --git a/src/message/routes/message/mod.rs b/src/message/routes/message/mod.rs
index 45a7e9d..e92f556 100644
--- a/src/message/routes/message/mod.rs
+++ b/src/message/routes/message/mod.rs
@@ -20,9 +20,11 @@ pub mod delete {
         State(app): State<App>,
         Path(message): Path<message::Id>,
         RequestedAt(deleted_at): RequestedAt,
-        _: Identity,
+        identity: Identity,
     ) -> Result<Response, Error> {
-        app.messages().delete(&message, &deleted_at).await?;
+        app.messages()
+            .delete(&identity.login, &message, &deleted_at)
+            .await?;
 
         Ok(Response { id: message })
     }
@@ -47,6 +49,9 @@ pub mod delete {
             let Self(error) = self;
             #[allow(clippy::match_wildcard_for_single_variants)]
             match error {
+                DeleteError::NotSender(_) => {
+                    (StatusCode::FORBIDDEN, error.to_string()).into_response()
+                }
                 DeleteError::NotFound(_) | DeleteError::Deleted(_) => {
                     NotFound(error).into_response()
                 }
diff --git a/src/message/routes/message/test.rs b/src/message/routes/message/test.rs
index ae89506..5178ab5 100644
--- a/src/message/routes/message/test.rs
+++ b/src/message/routes/message/test.rs
@@ -8,18 +8,17 @@ pub async fn delete_message() {
     // Set up the environment
 
     let app = fixtures::scratch_app().await;
-    let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let sender = fixtures::identity::create(&app, &fixtures::now()).await;
     let channel = fixtures::channel::create(&app, &fixtures::now()).await;
-    let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
+    let message = fixtures::message::send(&app, &channel, &sender.login, &fixtures::now()).await;
 
     // Send the request
 
-    let deleter = fixtures::identity::create(&app, &fixtures::now()).await;
     let response = delete::handler(
         State(app.clone()),
         Path(message.id.clone()),
         fixtures::now(),
-        deleter,
+        sender,
     )
     .await
     .expect("deleting a valid message succeeds");
@@ -68,7 +67,7 @@ pub async fn delete_deleted() {
     let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
 
     app.messages()
-        .delete(&message.id, &fixtures::now())
+        .delete(&sender, &message.id, &fixtures::now())
         .await
         .expect("deleting a recently-sent message succeeds");
 
@@ -155,3 +154,31 @@ pub async fn delete_purged() {
 
     assert!(matches!(error, app::DeleteError::NotFound(id) if id == message.id));
 }
+
+#[tokio::test]
+pub async fn delete_not_sender() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+    let sender = fixtures::login::create(&app, &fixtures::now()).await;
+    let channel = fixtures::channel::create(&app, &fixtures::now()).await;
+    let message = fixtures::message::send(&app, &channel, &sender, &fixtures::now()).await;
+
+    // Send the request
+
+    let deleter = fixtures::identity::create(&app, &fixtures::now()).await;
+    let delete::Error(error) = delete::handler(
+        State(app.clone()),
+        Path(message.id.clone()),
+        fixtures::now(),
+        deleter.clone(),
+    )
+    .await
+    .expect_err("deleting a message someone else sent fails");
+
+    // Verify the response
+
+    assert!(
+        matches!(error, app::DeleteError::NotSender(error_sender) if deleter.login == error_sender)
+    );
+}
diff --git a/src/setup/app.rs b/src/setup/app.rs
index 030b5f6..c1f7b69 100644
--- a/src/setup/app.rs
+++ b/src/setup/app.rs
@@ -3,8 +3,11 @@ use sqlx::sqlite::SqlitePool;
 use super::repo::Provider as _;
 use crate::{
     clock::DateTime,
-    event::{repo::Provider as _, Broadcaster, Event},
-    login::{repo::Provider as _, Login, Password},
+    event::Broadcaster,
+    login::{
+        create::{self, Create},
+        Login, Password,
+    },
     name::Name,
     token::{repo::Provider as _, Secret},
 };
@@ -25,20 +28,20 @@ impl<'a> Setup<'a> {
         password: &Password,
         created_at: &DateTime,
     ) -> Result<(Login, Secret), Error> {
-        let password_hash = password.hash()?;
+        let create = Create::begin(name, password, created_at);
+
+        let validated = create.validate()?;
 
         let mut tx = self.db.begin().await?;
-        let login = if tx.setup().completed().await? {
+        let stored = if tx.setup().completed().await? {
             Err(Error::SetupCompleted)?
         } else {
-            let created = tx.sequence().next(created_at).await?;
-            tx.logins().create(name, &password_hash, &created).await?
+            validated.store(&mut tx).await?
         };
-        let secret = tx.tokens().issue(&login, created_at).await?;
+        let secret = tx.tokens().issue(stored.login(), created_at).await?;
         tx.commit().await?;
 
-        self.events
-            .broadcast(login.events().map(Event::from).collect::<Vec<_>>());
+        let login = stored.publish(self.events);
 
         Ok((login.as_created(), secret))
     }
@@ -56,8 +59,19 @@ impl<'a> Setup<'a> {
 pub enum Error {
     #[error("initial setup previously completed")]
     SetupCompleted,
+    #[error("invalid login name: {0}")]
+    InvalidName(Name),
     #[error(transparent)]
     Database(#[from] sqlx::Error),
     #[error(transparent)]
     PasswordHash(#[from] password_hash::Error),
 }
+
+impl From<create::Error> for Error {
+    fn from(error: create::Error) -> Self {
+        match error {
+            create::Error::InvalidName(name) => Self::InvalidName(name),
+            create::Error::PasswordHash(error) => Self::PasswordHash(error),
+        }
+    }
+}
diff --git a/src/setup/routes/post.rs b/src/setup/routes/post.rs
index f7b256e..2a46b04 100644
--- a/src/setup/routes/post.rs
+++ b/src/setup/routes/post.rs
@@ -42,6 +42,9 @@ impl IntoResponse for Error {
     fn into_response(self) -> Response {
         let Self(error) = self;
         match error {
+            app::Error::InvalidName(_) => {
+                (StatusCode::BAD_REQUEST, error.to_string()).into_response()
+            }
             app::Error::SetupCompleted => (StatusCode::CONFLICT, error.to_string()).into_response(),
             other => Internal::from(other).into_response(),
         }
diff --git a/src/setup/routes/test.rs b/src/setup/routes/test.rs
index f7562ae..5794b78 100644
--- a/src/setup/routes/test.rs
+++ b/src/setup/routes/test.rs
@@ -67,3 +67,28 @@ async fn login_exists() {
 
     assert!(matches!(error, app::Error::SetupCompleted));
 }
+
+#[tokio::test]
+async fn invalid_name() {
+    // Set up the environment
+
+    let app = fixtures::scratch_app().await;
+
+    // Call the endpoint
+
+    let name = fixtures::login::propose_invalid_name();
+    let password = fixtures::login::propose_password();
+    let identity = fixtures::cookie::not_logged_in();
+    let request = post::Request {
+        name: name.clone(),
+        password: password.clone(),
+    };
+    let post::Error(error) =
+        post::handler(State(app.clone()), fixtures::now(), identity, Json(request))
+            .await
+            .expect_err("setup with an invalid name fails");
+
+    // Verify the response
+
+    assert!(matches!(error, app::Error::InvalidName(error_name) if name == error_name));
+}
diff --git a/src/test/fixtures/boot.rs b/src/test/fixtures/boot.rs
new file mode 100644
index 0000000..120726f
--- /dev/null
+++ b/src/test/fixtures/boot.rs
@@ -0,0 +1,9 @@
+use crate::{app::App, event::Sequence};
+
+pub async fn resume_point(app: &App) -> Sequence {
+    app.boot()
+        .snapshot()
+        .await
+        .expect("boot always succeeds")
+        .resume_point
+}
diff --git a/src/test/fixtures/channel.rs b/src/test/fixtures/channel.rs
index 0c6480b..98048f2 100644
--- a/src/test/fixtures/channel.rs
+++ b/src/test/fixtures/channel.rs
@@ -1,6 +1,7 @@
 use faker_rand::{
     en_us::{addresses::CityName, names::FullName},
     faker_impl_from_templates,
+    lorem::Paragraphs,
 };
 use rand;
 
@@ -23,6 +24,10 @@ pub fn propose() -> Name {
     rand::random::<NameTemplate>().to_string().into()
 }
 
+pub fn propose_invalid_name() -> Name {
+    rand::random::<Paragraphs>().to_string().into()
+}
+
 struct NameTemplate(String);
 faker_impl_from_templates! {
     NameTemplate; "{} {}", CityName, FullName;
diff --git a/src/test/fixtures/identity.rs b/src/test/fixtures/identity.rs
index e438f2b..ffc44c6 100644
--- a/src/test/fixtures/identity.rs
+++ b/src/test/fixtures/identity.rs
@@ -15,11 +15,15 @@ pub async fn create(app: &App, created_at: &RequestedAt) -> Identity {
     logged_in(app, &credentials, created_at).await
 }
 
-pub async fn from_cookie(app: &App, token: &IdentityCookie, issued_at: &RequestedAt) -> Identity {
-    let secret = token.secret().expect("identity token has a secret");
+pub async fn from_cookie(
+    app: &App,
+    cookie: &IdentityCookie,
+    validated_at: &RequestedAt,
+) -> Identity {
+    let secret = cookie.secret().expect("identity token has a secret");
     let (token, login) = app
         .tokens()
-        .validate(&secret, issued_at)
+        .validate(&secret, validated_at)
         .await
         .expect("always validates newly-issued secret");
 
diff --git a/src/test/fixtures/login.rs b/src/test/fixtures/login.rs
index e308289..86e3e39 100644
--- a/src/test/fixtures/login.rs
+++ b/src/test/fixtures/login.rs
@@ -1,4 +1,4 @@
-use faker_rand::en_us::internet;
+use faker_rand::{en_us::internet, lorem::Paragraphs};
 use uuid::Uuid;
 
 use crate::{
@@ -38,6 +38,10 @@ pub fn propose() -> (Name, Password) {
     (propose_name(), propose_password())
 }
 
+pub fn propose_invalid_name() -> Name {
+    rand::random::<Paragraphs>().to_string().into()
+}
+
 fn propose_name() -> Name {
     rand::random::<internet::Username>().to_string().into()
 }
diff --git a/src/test/fixtures/mod.rs b/src/test/fixtures/mod.rs
index 2b7b6af..470b31a 100644
--- a/src/test/fixtures/mod.rs
+++ b/src/test/fixtures/mod.rs
@@ -2,6 +2,7 @@ use chrono::{TimeDelta, Utc};
 
 use crate::{app::App, clock::RequestedAt, db};
 
+pub mod boot;
 pub mod channel;
 pub mod cookie;
 pub mod event;
diff --git a/src/token/app.rs b/src/token/app.rs
index c19d6a0..5c0aeb0 100644
--- a/src/token/app.rs
+++ b/src/token/app.rs
@@ -13,7 +13,7 @@ use super::{
 use crate::{
     clock::DateTime,
     db::NotFound as _,
-    login::{Login, Password},
+    login::{repo::Provider as _, Login, Password},
     name::{self, Name},
 };
 
@@ -61,6 +61,47 @@ impl<'a> Tokens<'a> {
         Ok((snapshot, token))
     }
 
+    pub async fn change_password(
+        &self,
+        login: &Login,
+        password: &Password,
+        to: &Password,
+        changed_at: &DateTime,
+    ) -> Result<(Login, Secret), LoginError> {
+        let mut tx = self.db.begin().await?;
+        let (login, stored_hash) = tx
+            .auth()
+            .for_login(login)
+            .await
+            .optional()?
+            .ok_or(LoginError::Rejected)?;
+        // Split the transaction here to avoid holding the tx open (potentially blocking
+        // other writes) while we do the fairly expensive task of verifying the
+        // password. It's okay if the token issuance transaction happens some notional
+        // amount of time after retrieving the login, as inserting the token will fail
+        // if the account is deleted during that time.
+        tx.commit().await?;
+
+        if !stored_hash.verify(password)? {
+            return Err(LoginError::Rejected);
+        }
+
+        let snapshot = login.as_snapshot().ok_or(LoginError::Rejected)?;
+        let to_hash = to.hash()?;
+
+        let mut tx = self.db.begin().await?;
+        let tokens = tx.tokens().revoke_all(&login).await?;
+        tx.logins().set_password(&login, &to_hash).await?;
+        let secret = tx.tokens().issue(&login, changed_at).await?;
+        tx.commit().await?;
+
+        for event in tokens.into_iter().map(TokenEvent::Revoked) {
+            self.token_events.broadcast(event);
+        }
+
+        Ok((snapshot, secret))
+    }
+
     pub async fn validate(
         &self,
         secret: &Secret,
diff --git a/src/token/repo/auth.rs b/src/token/repo/auth.rs
index bdc4c33..b51db8c 100644
--- a/src/token/repo/auth.rs
+++ b/src/token/repo/auth.rs
@@ -50,6 +50,35 @@ impl<'t> Auth<'t> {
 
         Ok((login, row.password_hash))
     }
+
+    pub async fn for_login(&mut self, login: &Login) -> Result<(History, StoredHash), LoadError> {
+        let row = sqlx::query!(
+            r#"
+                select
+                    id as "id: login::Id",
+                    display_name as "display_name: String",
+                    canonical_name as "canonical_name: String",
+                    created_sequence as "created_sequence: Sequence",
+                    created_at as "created_at: DateTime",
+                    password_hash as "password_hash: StoredHash"
+                from login
+                where id = $1
+            "#,
+            login.id,
+        )
+        .fetch_one(&mut *self.0)
+        .await?;
+
+        let login = History {
+            login: Login {
+                id: row.id,
+                name: Name::new(row.display_name, row.canonical_name)?,
+            },
+            created: Instant::new(row.created_at, row.created_sequence),
+        };
+
+        Ok((login, row.password_hash))
+    }
 }
 
 #[derive(Debug, thiserror::Error)]
diff --git a/src/token/repo/token.rs b/src/token/repo/token.rs
index 35ea385..33b89d5 100644
--- a/src/token/repo/token.rs
+++ b/src/token/repo/token.rs
@@ -84,6 +84,24 @@ impl<'c> Tokens<'c> {
         Ok(())
     }
 
+    // Revoke tokens for a login
+    pub async fn revoke_all(&mut self, login: &login::History) -> Result<Vec<Id>, sqlx::Error> {
+        let login = login.id();
+        let tokens = sqlx::query_scalar!(
+            r#"
+                delete
+                from token
+                where login = $1
+                returning id as "id: Id"
+            "#,
+            login,
+        )
+        .fetch_all(&mut *self.0)
+        .await?;
+
+        Ok(tokens)
+    }
+
     // Expire and delete all tokens that haven't been used more recently than
     // `expire_at`.
     pub async fn expire(&mut self, expire_at: &DateTime) -> Result<Vec<Id>, sqlx::Error> {
diff --git a/src/token/secret.rs b/src/token/secret.rs
index 28c93bb..8f70646 100644
--- a/src/token/secret.rs
+++ b/src/token/secret.rs
@@ -1,6 +1,6 @@
 use std::fmt;
 
-#[derive(sqlx::Type)]
+#[derive(PartialEq, Eq, sqlx::Type)]
 #[sqlx(transparent)]
 pub struct Secret(String);
 
diff --git a/src/ui/routes/me.rs b/src/ui/routes/me.rs
new file mode 100644
index 0000000..f1f118f
--- /dev/null
+++ b/src/ui/routes/me.rs
@@ -0,0 +1,32 @@
+pub mod get {
+    use axum::response::{self, IntoResponse, Redirect};
+
+    use crate::{
+        error::Internal,
+        token::extract::Identity,
+        ui::assets::{Asset, Assets},
+    };
+
+    pub async fn handler(identity: Option<Identity>) -> Result<Asset, Error> {
+        let _ = identity.ok_or(Error::NotLoggedIn)?;
+
+        Assets::index().map_err(Error::Internal)
+    }
+
+    #[derive(Debug, thiserror::Error)]
+    pub enum Error {
+        #[error("not logged in")]
+        NotLoggedIn,
+        #[error("{0}")]
+        Internal(Internal),
+    }
+
+    impl IntoResponse for Error {
+        fn into_response(self) -> response::Response {
+            match self {
+                Self::NotLoggedIn => Redirect::temporary("/login").into_response(),
+                Self::Internal(error) => error.into_response(),
+            }
+        }
+    }
+}
diff --git a/src/ui/routes/mod.rs b/src/ui/routes/mod.rs
index 72d9a4a..48b3f90 100644
--- a/src/ui/routes/mod.rs
+++ b/src/ui/routes/mod.rs
@@ -6,6 +6,7 @@ mod ch;
 mod get;
 mod invite;
 mod login;
+mod me;
 mod path;
 mod setup;
 
@@ -16,6 +17,7 @@ pub fn router(app: &App) -> Router<App> {
             .route("/setup", get(setup::get::handler)),
         Router::new()
             .route("/", get(get::handler))
+            .route("/me", get(me::get::handler))
             .route("/login", get(login::get::handler))
             .route("/ch/:channel", get(ch::channel::get::handler))
             .route("/invite/:invite", get(invite::invite::get::handler))
diff --git a/tools/build-builder b/tools/build-builder
new file mode 100755
index 0000000..fcb1e84
--- /dev/null
+++ b/tools/build-builder
@@ -0,0 +1,14 @@
+#!/bin/bash -e
+
+## tools/build-builder
+##
+## Builds a Docker image containing the Debian package builder.
+
+cd "$(dirname "$0")/.."
+
+docker build \
+	--platform "linux/arm64,linux/amd64" \
+	--tag "hi-debian-builder:$(tools/version)" \
+	--tag "hi-debian-builder:latest" \
+	--file Dockerfile.builder \
+	.
diff --git a/tools/build-debian b/tools/build-debian
new file mode 100755
index 0000000..c64fc78
--- /dev/null
+++ b/tools/build-debian
@@ -0,0 +1,20 @@
+#!/bin/bash -e
+
+## tools/build-builder
+##
+## Builds a Debian package for the current tree. Output in ./target/debian.
+##
+## Requires the Debian builder (see tools/build-builder).
+
+cd "$(dirname "$0")/.."
+
+for platform in linux/arm64 linux/amd64; do
+	docker run \
+		--platform "$platform" \
+		--rm \
+		--interactive \
+		--tty \
+		--volume "$PWD:/app" \
+		"hi-debian-builder:$(tools/version)" \
+			cargo deb
+done
diff --git a/tools/version b/tools/version
new file mode 100755
index 0000000..8e47a7c
--- /dev/null
+++ b/tools/version
@@ -0,0 +1,11 @@
+#!/bin/bash -e
+
+## tools/version
+##
+## Print the current version of the project to stdout. Data comes from Cargo.
+
+cd "$(dirname "$0")/.."
+
+cargo metadata \
+	--format-version 1 |
+jq -r '.packages[] | select(.name == "hi") | .version'
diff --git a/ui/lib/apiServer.js b/ui/lib/apiServer.js
index db554e2..19dcf60 100644
--- a/ui/lib/apiServer.js
+++ b/ui/lib/apiServer.js
@@ -30,6 +30,10 @@ export async function logOut() {
   return apiServer.post('/auth/logout', {});
 }
 
+export async function changePassword(password, to) {
+  return apiServer.post('/password', { password, to });
+}
+
 export async function createChannel(name) {
   return apiServer.post('/channels', { name });
 }
diff --git a/ui/lib/components/LogOut.svelte b/ui/lib/components/CurrentUser.svelte
index ba0861a..4b1b974 100644
--- a/ui/lib/components/LogOut.svelte
+++ b/ui/lib/components/CurrentUser.svelte
@@ -14,7 +14,7 @@
 
 <form on:submit|preventDefault={handleLogout}>
     {#if $currentUser}
-        @{$currentUser.username}
+        <a href="/me">@{$currentUser.username}</a>
     {/if}
     <button
         class="border-slate-500 border-solid border-2 font-bold p-1 rounded"
diff --git a/ui/lib/components/Invite.svelte b/ui/lib/components/Invite.svelte
index f4babad..7fdc753 100644
--- a/ui/lib/components/Invite.svelte
+++ b/ui/lib/components/Invite.svelte
@@ -1,40 +1,13 @@
 <script>
-	import { base } from '$app/paths';
-	import { createInvite } from '$lib/apiServer';
 	import { clipboard } from '@skeletonlabs/skeleton';
 
-	let invite = null;
-	$: inviteUrl = invite ? new URL(`/invite/${invite.id}`, document.location) : null;
-	$: inviteUrl, console.log("invite url", inviteUrl);
+	export let id;
+	$: inviteUrl = new URL(`/invite/${id}`, document.location);
+</script>
 
-	async function onSubmit() {
-		let response = await createInvite();
-		if (response.status == 200) {
-			invite = response.data;
-		}
-		console.log("base url", base);
-	}
+<button
+	class="border-slate-500 border-solid border-2 font-bold p-1 rounded"
+	use:clipboard={inviteUrl}>Copy</button>
+<span data-clipboard="inviteUrl">{inviteUrl}</span>
 
-	async function onReset() {
-		invite = null;
-	}
-</script>
 
-<form
-	on:submit|preventDefault={onSubmit}
-	on:reset|preventDefault={onReset}>
-	{#if inviteUrl}
-	<button
-		class="border-slate-500 border-solid border-2 font-bold p-1 rounded"
-		use:clipboard={inviteUrl}
-		type="reset">
-		Copy Invite
-	</button>
-	{:else}
-	<button
-		class="border-slate-500 border-solid border-2 font-bold p-1 rounded"
-		type="submit">
-		Invite
-	</button>
-	{/if}
-</form>
diff --git a/ui/lib/components/Invites.svelte b/ui/lib/components/Invites.svelte
new file mode 100644
index 0000000..df51afb
--- /dev/null
+++ b/ui/lib/components/Invites.svelte
@@ -0,0 +1,28 @@
+<script>
+	import { writable } from 'svelte/store';
+	import { createInvite } from '$lib/apiServer';
+	import Invite from '$lib/components/Invite.svelte';
+
+	let invites = writable([]);
+	$: $invites, console.log("invites", $invites);
+
+	async function onSubmit() {
+		let response = await createInvite();
+		if (response.status == 200) {
+			invites.update(val => [...val, response.data]);
+		}
+	}
+</script>
+
+<ul>
+	{#each $invites as invite}
+	<li><Invite id={invite.id} /></li>
+	{/each}
+</ul>
+<form on:submit|preventDefault={onSubmit}>
+	<button
+		class="btn variant-filled"
+		type="submit">
+		Create Invitation
+	</button>
+</form>
diff --git a/ui/routes/(app)/me/+page.svelte b/ui/routes/(app)/me/+page.svelte
new file mode 100644
index 0000000..7559dbe
--- /dev/null
+++ b/ui/routes/(app)/me/+page.svelte
@@ -0,0 +1,41 @@
+<script>
+	import { changePassword } from '$lib/apiServer.js';
+
+	import Invites from '$lib/components/Invites.svelte';
+
+	let currentPassword, newPassword, confirmPassword, passwordForm;
+	let pending = false;
+	$: valid = (newPassword === confirmPassword) && (newPassword !== currentPassword);
+	$: disabled = pending || !valid;
+
+	async function onPasswordChange() {
+		pending = true;
+		let response = await changePassword(currentPassword, newPassword);
+		switch (response.status) {
+			case 200:
+				passwordForm.reset();
+				break;
+		}
+		pending = false;
+	}
+</script>
+
+<form on:submit|preventDefault={onPasswordChange} bind:this={passwordForm} >
+	<label>current password
+		<input class="input" name="currentPassword" type="password" placeholder="password" bind:value={currentPassword}>
+	</label>
+
+	<label>new password
+		<input class="input" name="newPassword" type="password" placeholder="password" bind:value={newPassword}>
+	</label>
+
+	<label>confirm new password
+		<input class="input" name="confirmPassword" type="password" placeholder="password" bind:value={confirmPassword}>
+	</label>
+
+	<button class="btn variant-filled" type="submit" disabled={disabled}>
+		change password
+	</button>
+</form>
+
+<Invites />
diff --git a/ui/routes/+layout.svelte b/ui/routes/+layout.svelte
index b7ed746..4133ff3 100644
--- a/ui/routes/+layout.svelte
+++ b/ui/routes/+layout.svelte
@@ -1,12 +1,13 @@
 <script>
-    import { AppBar } from '@skeletonlabs/skeleton';
     import "../app.css";
-
     import logo from '$lib/assets/logo.png';
 
+    import { AppBar } from '@skeletonlabs/skeleton';
     import { showMenu, currentUser } from '$lib/store';
-    import LogOut from '$lib/components/LogOut.svelte';
+
+    import CurrentUser from '$lib/components/CurrentUser.svelte';
     import Invite from '$lib/components/Invite.svelte';
+    import LogOut from '$lib/components/LogOut.svelte';
 
     function toggleMenu() {
         showMenu.update((value) => !value);