- Convex returns the room as wss://; WebSocket clients refuse https://,
  so presence never connected.
- The Worker keeps passes out of logs (redact_query_string) and never
  forwards the query to the room.
- Rooms stop sending to a socket as soon as its pass runs out, and wake at
  the earliest expiry, so revoked access ends on time even for a silent
  socket.
- One person gets at most four sessions per room; renewals faster than one
  per ten seconds are ignored before any HMAC work; malformed passes are
  rejected with 401 instead of throwing.
- The presence provider auto-disposes, so leaving the editor any way
  (including browser back) leaves the room.
- The cursor is re-sent when the map moves under a still pointer: scroll
  zoom, page or side change, resize.
- Person colors use arithmetic that is exact on web and native, and the
  cursor shadows use the named card shadow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>