diff --git a/querki/build.sbt b/querki/build.sbt
index 8f2991089..51197c82e 100644
--- a/querki/build.sbt
+++ b/querki/build.sbt
@@ -5,7 +5,7 @@ import ByteConversions._
 lazy val clients = Seq(querkiClient)
 
 lazy val scalaV = "2.11.12"
-lazy val akkaV = "2.4.10"
+lazy val akkaV = "2.4.18"
 lazy val enumeratumV = "1.5.3"
 lazy val appV = "2.8.6"
 
@@ -47,11 +47,13 @@ lazy val querkiServer = (project in file("scalajvm")).settings(
       "com.lihaoyi" %% "utest" % "0.3.1",
       "org.querki" %% "requester" % "2.6",
       "com.github.mauricio" %% "mysql-async" % "0.2.16",
-      "org.scalatestplus.play" %% "scalatestplus-play" % "1.5.1" % "test",
+//      "org.scalatestplus.play" %% "scalatestplus-play" % "1.5.1" % "test",
+      "org.scalatestplus.play" %% "scalatestplus-play" % "2.0.1" % "test",
       "com.github.romix.akka" %% "akka-kryo-serialization" % "0.4.2",
 //      "com.typesafe.conductr" %% "play25-conductr-bundle-lib" % "1.4.4",
       "com.typesafe.akka" %% "akka-distributed-data-experimental" % akkaV,
-      "org.scalatest" %% "scalatest" % "2.2.6" % "test",
+//      "org.scalatest" %% "scalatest" % "2.2.6" % "test",
+      "org.scalatest" %% "scalatest" % "3.0.3" % "test",
       // Pretty-printer: http://www.lihaoyi.com/upickle-pprint/pprint/
       "com.lihaoyi" %% "pprint" % "0.4.1",
       "com.lihaoyi" %% "sourcecode" % "0.1.4",
diff --git a/querki/project/plugins.sbt b/querki/project/plugins.sbt
index b3b45aed5..5c984f99f 100644
--- a/querki/project/plugins.sbt
+++ b/querki/project/plugins.sbt
@@ -14,7 +14,7 @@ resolvers += "Sonatype OSS Snapshots" at "https://oss.sonatype.org/content/repos
 resolvers += "bintray/non" at "http://dl.bintray.com/non/maven"
 
 // Use the Play sbt plugin for Play projects
-addSbtPlugin("com.typesafe.play" % "sbt-plugin" % "2.5.3")
+addSbtPlugin("com.typesafe.play" % "sbt-plugin" % "2.5.16")
 
 addSbtPlugin("org.scala-js" % "sbt-scalajs" % "0.6.19")
 addSbtPlugin("com.vmunier" % "sbt-play-scalajs" % "0.3.0")
diff --git a/querki/scala/shared/src/main/scala/querki/api/ThingFunctions.scala b/querki/scala/shared/src/main/scala/querki/api/ThingFunctions.scala
index dbb11cb0c..2c97f3346 100644
--- a/querki/scala/shared/src/main/scala/querki/api/ThingFunctions.scala
+++ b/querki/scala/shared/src/main/scala/querki/api/ThingFunctions.scala
@@ -104,4 +104,7 @@ object ThingFunctions {
   case class TextV(vs: List[String]) extends PV {
     type TContent = String
   }
+  case class LinkV(vs: List[TID]) extends PV {
+    type TContent = TID
+  }
 }
diff --git a/querki/scalajvm/app/querki/conversations/SpaceConversationNotifier.scala b/querki/scalajvm/app/querki/conversations/SpaceConversationNotifier.scala
index 06030ad5f..15e407286 100644
--- a/querki/scalajvm/app/querki/conversations/SpaceConversationNotifier.scala
+++ b/querki/scalajvm/app/querki/conversations/SpaceConversationNotifier.scala
@@ -43,7 +43,7 @@ private [conversations] class SpaceConversationNotifier(e:Ecology, initState:Spa
   }
   
   def doReceive = {
-    case CurrentState(current) => {
+    case CurrentState(current, _) => {
       state = current
     }
     
diff --git a/querki/scalajvm/app/querki/conversations/SpaceConversationsActor.scala b/querki/scalajvm/app/querki/conversations/SpaceConversationsActor.scala
index 76d2d5a21..82fb31bb4 100644
--- a/querki/scalajvm/app/querki/conversations/SpaceConversationsActor.scala
+++ b/querki/scalajvm/app/querki/conversations/SpaceConversationsActor.scala
@@ -72,7 +72,7 @@ private [conversations] class SpaceConversationsActor(ecology:Ecology, persisten
     /**
      * This Actor can't become properly active until we receive the current state to work with:
      */
-    case CurrentState(current) => {
+    case CurrentState(current, _) => {
       // Only go through boot if this is the first time we get the state.
       val boot = (state == null)
       
@@ -204,7 +204,7 @@ private [conversations] class SpaceConversationsActor(ecology:Ecology, persisten
     /**
      * Update from the Space Actor that the state has been changed.
      */
-    case CurrentState(current) => {
+    case CurrentState(current, _) => {
       state = current
     }
     
diff --git a/querki/scalajvm/app/querki/conversations/SpaceConversationsManager.scala b/querki/scalajvm/app/querki/conversations/SpaceConversationsManager.scala
index 25de634fe..f6eb5d7f7 100644
--- a/querki/scalajvm/app/querki/conversations/SpaceConversationsManager.scala
+++ b/querki/scalajvm/app/querki/conversations/SpaceConversationsManager.scala
@@ -31,14 +31,14 @@ private [conversations] class SpaceConversationsManager(e:Ecology, router:ActorR
   def createChild(thingId:OID):ActorRef = context.actorOf(ThingConversationsActor.actorProps(state, thingId, notifier, ecology))
   
   def bootReceive:Receive = {
-    case CurrentState(current) => {
+    case CurrentState(current, _) => {
       _state = Some(current)
       doneBooting()
     }
   }
   
   def doReceive:Receive = {
-    case msg @ CurrentState(current) => {
+    case msg @ CurrentState(current, _) => {
       _state = Some(current)
       routeToAll(msg)
       notifier ! msg
diff --git a/querki/scalajvm/app/querki/conversations/ThingConversationsCore.scala b/querki/scalajvm/app/querki/conversations/ThingConversationsCore.scala
index 85d012d00..1803f0c00 100644
--- a/querki/scalajvm/app/querki/conversations/ThingConversationsCore.scala
+++ b/querki/scalajvm/app/querki/conversations/ThingConversationsCore.scala
@@ -214,7 +214,7 @@ abstract class ThingConversationsCore(initState:SpaceState, val thingId:OID)(imp
     /**
      * Update from the Space Actor that the state has been changed.
      */
-    case CurrentState(current) => {
+    case CurrentState(current, _) => {
       state = current
     }
         
diff --git a/querki/scalajvm/app/querki/session/OldUserSpaceSession.scala b/querki/scalajvm/app/querki/session/OldUserSpaceSession.scala
index a12a1f925..816c223ee 100644
--- a/querki/scalajvm/app/querki/session/OldUserSpaceSession.scala
+++ b/querki/scalajvm/app/querki/session/OldUserSpaceSession.scala
@@ -1,34 +1,30 @@
 package querki.session
 
 import scala.concurrent.Future
-import scala.util.{Failure, Success}
-
+import scala.util.{Success, Failure}
 import akka.actor._
 import akka.contrib.pattern.ReceivePipeline
 import akka.event.LoggingReceive
-
 import upickle.default._
 import autowire._
-
 import org.querki.requester._
-
 import models._
-
 import querki.globals._
-
 import querki.admin.SpaceTimingActor.MonitorMsg
 import querki.api._
 import querki.identity.{Identity, User}
 import querki.history.SpaceHistory._
 import querki.publication.CurrentPublicationState
 import querki.session.messages._
-import querki.spaces.messages.{ChangeProps, CurrentState, SpaceSubsystemRequest, SpacePluginMsg, ThingError, ThingFound}
+import querki.spaces.SpaceEvolution
+import querki.spaces.SpaceMessagePersistence.SpaceEvent
+import querki.spaces.messages.{SpaceSubsystemRequest, ThingError, CurrentState, SpacePluginMsg, ThingFound, ChangeProps}
 import querki.spaces.messages.SpaceError._
 import querki.time.DateTime
 import querki.uservalues.SummarizeChange
 import querki.uservalues.PersistMessages._
-import querki.util.{PublicException, QLog, TimeoutChild, UnexpectedPublicException}
-import querki.values.{QValue, RequestContext, SpaceState}
+import querki.util.{PublicException, UnexpectedPublicException, TimeoutChild, QLog}
+import querki.values.{SpaceState, RequestContext, QValue}
 
 /**
  * The Actor that controls an individual's relationship with a Space.
@@ -39,10 +35,15 @@ import querki.values.{QValue, RequestContext, SpaceState}
  * concerns.
  */
 private [session] class OldUserSpaceSession(e:Ecology, val spaceId:OID, val user:User, val spaceRouter:ActorRef, val persister:ActorRef, timeSpaceOps:Boolean)
-  extends Actor with Stash with Requester with EcologyMember with ReceivePipeline with TimeoutChild
+  extends Actor with Stash with Requester with EcologyMember with ReceivePipeline with TimeoutChild with SpaceEvolution
   with autowire.Server[String, Reader, Writer]
 {
   implicit val ecology = e
+
+  // Needed for SpacePure:
+  // TODO: gah. A fine example of the problems of the inheritance-based approach. Can/should we refactor SpacePure and
+  // SpaceEvolution to *actually* be pure?
+  val id: OID = spaceId
   
   lazy val AccessControl = interface[querki.security.AccessControl]
   lazy val ApiInvocation = interface[querki.api.ApiInvocation]
@@ -60,15 +61,15 @@ private [session] class OldUserSpaceSession(e:Ecology, val spaceId:OID, val user
     }
   }
   
-  /**
-   * IMPORTANT: this must be set before we begin any serious work! This is why we start
-   * in a rudimentary state, and don't become useful until it is received.
-   */
-  var _rawState:Option[SpaceState] = None
-  def setRawState(s:SpaceState) = {
-    clearEnhancedState()
-    _rawState = Some(s)
-  }
+//  /**
+//   * IMPORTANT: this must be set before we begin any serious work! This is why we start
+//   * in a rudimentary state, and don't become useful until it is received.
+//   */
+//  var _rawState:Option[SpaceState] = None
+//  def setRawState(s:SpaceState) = {
+//    clearEnhancedState()
+//    _rawState = Some(s)
+//  }
   var _publicationState:Option[CurrentPublicationState] = None
   def setPublicationState(s:CurrentPublicationState) = {
     clearEnhancedState()
@@ -90,101 +91,70 @@ private [session] class OldUserSpaceSession(e:Ecology, val spaceId:OID, val user
   /**
    * This is the dumping ground for exceptions to the rule that your Space only contains Things you can
    * read. There should *not* be many of these.
+    *
+    * TODO: can be deleted once we lift it out to SpaceEvolution.
    */
   def isReadException(thingId:OID)(implicit state:SpaceState):Boolean = {
     // I always have access to my own Person record, so that _me always works:
     Person.hasPerson(user, thingId)
   }
 
-  var _enhancedState:Option[SpaceState] = None
+  /**
+    * The state as originally received from the Space Actor, with no filtering.
+    *
+    * USE THIS WITH EXTREME CARE! In general, stuff should be using the enhanced state instead.
+    */
+  var _rawState:Option[SpaceState] = None
+  /**
+    * The List of events received since we last recomputed, in *reverse* order for efficiency.
+    */
+  var _unprocessedEvents: List[SpaceEvent] = List.empty
+
+  /**
+    * The raw State, minus stuff that this user isn't allowed to see. This mostly gets evolved with events as they come in.
+    */
+  var _filteredState: Option[SpaceState] = None
+
+  /**
+    * The filtered state, plus publication and userValues if appropriate. Recomputed lazily when needed.
+    */
+  var _enhancedState: Option[SpaceState] = None
   def clearEnhancedState() = _enhancedState = None
-  def makeEnhancedState():SpaceState = {
-    _rawState match {
-      case Some(rs) => {
-        // Managers act as Owners for purposes of being able to read everything:
-        val isManager = AccessControl.isManager(user, rs)
-        val safeState =
-          if (isManager) {
-            monitor(s"makeEnhancedState() skipped -- it is a manager")
-            rs
-          } else {
-            monitor(s"makeEnhancedState() starting read filtering for User ${user.id}...")
-            // TODO: MAKE THIS MUCH FASTER! This is probably O(n**2), maybe worse. We need to do heavy
-            // caching, and do much more sensitive updating as things change.
-            val readFiltered = (rs /: rs.things) { (curState, thingPair) =>
-              val (thingId, thing) = thingPair
-              // Note that we need to pass rs into canRead(), not curState. That is because curState can
-              // be in an inconsistent state while we're in the middle of all this. For example, we may
-              // have already exised a Model from curState (because we don't have permission) when we get
-              // to an Instance of that Model. Things can then get horribly confused when we try to look
-              // at the Instance, try to examine its Model, and *boom*.
-              if (AccessControl.canRead(rs, user, thingId) || isReadException(thingId)(rs)) {
-                // Remove any SystemHidden Properties from this Thing, if there are any:
-                if (hiddenOIDs.exists(thing.props.contains(_))) {
-                  val newThing = thing.copy(pf = { (thing.props -- hiddenOIDs) })
-                  curState.copy(things = (curState.things + (newThing.id -> newThing)))
-                } else
-                  curState
-              } else
-                curState.copy(things = (curState.things - thingId))
-            }
-            monitor(s"... finished read filtering")
-            
-            if (AccessControl.canRead(readFiltered, user, rs.id))
-              readFiltered
-            else {
-              // This user isn't allowed to read the Root Page, so give them a stub instead.
-              // TODO: this is a fairly stupid hack, but we have to be careful -- filtering out
-              // bits of the Space while not breaking it entirely is tricky. Think about how to
-              // do this better.
-              readFiltered.copy(pf = readFiltered.props + 
-                  (Basic.DisplayTextProp("**You aren't allowed to read this Page; sorry.**")))
-            }
-          }
-        
-        val stateWithUV = (safeState /: userValues) { (curState, uv) =>
-          if (uv.thingId == curState.id) {
-            // We're enhancing the Space itself:
-            curState.copy(pf = (curState.props + (uv.propId -> uv.v)))
-          }
-          else curState.anything(uv.thingId) match {
-            case Some(thing:ThingState) => {
-              val newThing = thing.copy(pf = thing.props + (uv.propId -> uv.v))
-              curState.copy(things = curState.things + (newThing.id -> newThing))
-            }
-            // Yes, this looks like an error, but it isn't: it means that there was a UserValue
-            // for a deleted Thing.
-            case _ => curState
-          }
-        }
-        
-        // If there is a PublicationState, overlay that on top of the rest:
-        // TODO (QI.7w4g8n8): there is a known bug here, that if something is Publishable *and* has User Values, the
-        // Publishers currently won't see their User Values if there are changes to the Instance.
-        // TODO (QI.7w4g8nd): this will need rationalization, especially once we get to Experiments. But by and
-        // large, I expect to be bringing more stuff into here.
-        _publicationState.map { ps =>
-          Publication.enhanceState(stateWithUV, ps)
-        }.getOrElse(stateWithUV)
-      }
-      case None => throw new Exception("UserSpaceSession trying to enhance state before there is a rawState!")
-    }
+
+  def handleStateChange(stateChange: CurrentState) = {
+    clearEnhancedState()
+    _rawState = Some(stateChange.state)
+    _unprocessedEvents = stateChange.events.getOrElse(List.empty).reverse ++ _unprocessedEvents
   }
+
   /**
    * The underlying SpaceState, plus all of the UserValues for this Identity.
    * 
    * This is effectively a lazy val that gets recalculated after we get a new rawState.
    */
   def state = {
-    if (_enhancedState.isEmpty) {
-      _enhancedState = Some(makeEnhancedState())
-      whenStateReady(_enhancedState.get)
+    _rawState match {
+      case Some(rawState) => {
+        if (_enhancedState.isEmpty) {
+          _filteredState = Some(updateForUser(_filteredState)(user)(rawState, _unprocessedEvents))
+          _unprocessedEvents = List.empty
+          val withUV = enhanceWithUserValues(_filteredState.get, userValues)
+          _enhancedState = Some(enhanceWithPublication(withUV, _publicationState))
+        }
+        _enhancedState.get
+      }
+      case None => throw new Exception("UserSpaceSession trying to enhance state before there is a rawState!")
     }
-    _enhancedState.get
   }
   
   /**
    * This is executed each time we receive a new SpaceState.
+    *
+    * TODO: we're not currently calling this! Deal with this idiotic edge condition in some smarter way. At the
+    * least, deal with it at load time, not every time we get a new SpaceState as it previously had been doing,
+    * and maybe have an additional handler when I change my name that deals with all current Spaces of mine?
+    *
+    * *And* this seems to be redundant with checkDisplayName() below!!!
    */
   def whenStateReady(implicit state:SpaceState) = {
     // Do I have the right Display Name? If I've changed my Identity's Display Name (which is very common
@@ -268,6 +238,9 @@ private [session] class OldUserSpaceSession(e:Ecology, val spaceId:OID, val user
    * TODO: we're currently checking this on every SpaceSubsystemRequest, which is certainly overkill. Once we have a
    * real UserSession object, and it knows about the UserSpaceSessions, that should instead pro-actively notify
    * all of them about the change, so we don't have to hack around it.
+    *
+    * TODO: is this actually redundant with whenStateReady()?!? Do we have *two* different pathways doing this idiotic
+    * misfeature? It does strongly show just how bad the design is.
    * 
    * TBD: in general, the way we have denormalized the Display Name between Identity and Person is kind of suspicious.
    * There are good efficiency arguments for it, but I am suspicious.
@@ -297,8 +270,8 @@ private [session] class OldUserSpaceSession(e:Ecology, val spaceId:OID, val user
    * stay there for the rest of this actor's life.
    */
   def receive = LoggingReceive {
-    case CurrentState(s) => {
-      setRawState(s)
+    case change @ CurrentState(s, _) => {
+      handleStateChange(change)
       // Now, fetch the UserValues
       // In principle, we should probably parallelize waiting for the SpaceState and UserValues:
       // the current behaviour hits first-load latency slightly. OTOH, in the interest of not hammering
@@ -372,7 +345,7 @@ private [session] class OldUserSpaceSession(e:Ecology, val spaceId:OID, val user
   def mkParams(rc:RequestContext) = AutowireParams(user, Some(SpacePayload(state, spaceRouter)), rc, this, sender)
   
   def normalReceive:Receive = LoggingReceive {
-    case CurrentState(s) => setRawState(s)
+    case change @ CurrentState(s, _) => handleStateChange(change)
     
     case ps:CurrentPublicationState => setPublicationState(ps)
     
@@ -409,7 +382,7 @@ private [session] class OldUserSpaceSession(e:Ecology, val spaceId:OID, val user
             
             // Fetch the state as of that point:
             for {
-              CurrentState(state) <- spaceRouter.request(GetHistoryVersion(v))
+              CurrentState(state, _) <- spaceRouter.request(GetHistoryVersion(v))
             }
             {
               val params = AutowireParams(user, Some(SpacePayload(state, spaceRouter)), rc, this, sender)
diff --git a/querki/scalajvm/app/querki/session/ThingFunctionsImpl.scala b/querki/scalajvm/app/querki/session/ThingFunctionsImpl.scala
index a9a85e742..5456cf513 100644
--- a/querki/scalajvm/app/querki/session/ThingFunctionsImpl.scala
+++ b/querki/scalajvm/app/querki/session/ThingFunctionsImpl.scala
@@ -122,7 +122,8 @@ class ThingFunctionsImpl(info:AutowireParams)(implicit e:Ecology) extends SpaceA
           
           tryType(Core.YesNoType)(BoolV) orElse
           tryType(Core.TextType) { vs => TextV(vs.map(_.text)) } orElse
-          tryType(Core.LargeTextType) { vs => TextV(vs.map(_.text)) } getOrElse {
+          tryType(Core.LargeTextType) { vs => TextV(vs.map(_.text)) } orElse
+          tryType(Core.LinkType) { vs => LinkV(vs.map(_.toTID)) } getOrElse {
             QLog.error(s"getPropertyValues() request for not-yet-implemented type ${pv.prop.pType.displayName}")
             m
           }
diff --git a/querki/scalajvm/app/querki/session/UserSpaceSessions.scala b/querki/scalajvm/app/querki/session/UserSpaceSessions.scala
index 1e6cf8d94..2cdd0907d 100644
--- a/querki/scalajvm/app/querki/session/UserSpaceSessions.scala
+++ b/querki/scalajvm/app/querki/session/UserSpaceSessions.scala
@@ -92,7 +92,7 @@ private [session] class UserSpaceSessions(e:Ecology, val spaceId:OID, val spaceR
    * We stay in Boot mode until we receive *both* the SpaceState and the CurrentPublicationState.
    */
   def bootReceive = {
-    case msg @ CurrentState(s) => {
+    case msg @ CurrentState(s, _) => {
       state = Some(s)
       bootIfReady()
     }
@@ -110,7 +110,7 @@ private [session] class UserSpaceSessions(e:Ecology, val spaceId:OID, val spaceR
     /**
      * The Space has sent an updated State, so tell everyone about it.
      */
-    case msg @ CurrentState(s) => {
+    case msg @ CurrentState(s, _) => {
       state = Some(s)
       children.foreach(session => session.forward(msg))
     }
diff --git a/querki/scalajvm/app/querki/spaces/PersistentSpaceActor.scala b/querki/scalajvm/app/querki/spaces/PersistentSpaceActor.scala
index 9548174c9..04cd01adb 100644
--- a/querki/scalajvm/app/querki/spaces/PersistentSpaceActor.scala
+++ b/querki/scalajvm/app/querki/spaces/PersistentSpaceActor.scala
@@ -96,8 +96,8 @@ class PersistentSpaceActor(e:Ecology, val id:OID, stateRouter:ActorRef, persiste
   /**
    * Tells any outside systems about the updated state.
    */
-  def notifyUpdateState():Unit = {
-    stateRouter ! CurrentState(currentState)
+  def notifyUpdateState(events: Option[List[SpaceEvent]]):Unit = {
+    stateRouter ! CurrentState(currentState, events)
   }
   
   /**
diff --git a/querki/scalajvm/app/querki/spaces/SpaceCore.scala b/querki/scalajvm/app/querki/spaces/SpaceCore.scala
index f5b557474..0ff020c73 100644
--- a/querki/scalajvm/app/querki/spaces/SpaceCore.scala
+++ b/querki/scalajvm/app/querki/spaces/SpaceCore.scala
@@ -126,7 +126,7 @@ abstract class SpaceCore[RM[_]](val rtc:RTCAble[RM])(implicit val ecology:Ecolog
   /**
    * Tells any outside systems about the updated state. Originally part of Space.updateState().
    */
-  def notifyUpdateState():Unit
+  def notifyUpdateState(events: Option[List[SpaceEvent]]):Unit
   
   /**
    * Sends a message to the MySQL side, telling it that this Space's name has changed.
@@ -212,9 +212,12 @@ abstract class SpaceCore[RM[_]](val rtc:RTCAble[RM])(implicit val ecology:Ecolog
    * 
    * This deals with updating caches, and updating the State's version number based on Akka Persistence.
    */
-  def updateStateCore(newState:SpaceState, evt:Option[SpaceMessage] = None):SpaceState = {
+  def updateStateCore(newState:SpaceState):SpaceState = {
+    // TODO: 4/21/19 -- note that we are never actually setting the commands in CacheUpdate. We used to pass this down,
+    // but it turned out it was always None, which makes the whole thing suspect. Re-examine, and think about whether
+    // CacheUpdate should be taking an Option[List[SpaceEvent]] instead, since that is where things have settled.
     val filledState = 
-      SpaceChangeManager.updateStateCache(CacheUpdate(evt, _currentState, newState)).
+      SpaceChangeManager.updateStateCache(CacheUpdate(None, _currentState, newState)).
       current.
       copy(version = SpaceVersion(lastSequenceNr))
     _currentState = Some(filledState)
@@ -225,9 +228,9 @@ abstract class SpaceCore[RM[_]](val rtc:RTCAble[RM])(implicit val ecology:Ecolog
   /**
    * Look up any external cache changes, record the new state, and send notifications about it.
    */
-  def updateState(newState:SpaceState, evt:Option[SpaceMessage] = None):SpaceState = {
-    updateStateCore(newState, evt)
-    notifyUpdateState()
+  def updateState(newState:SpaceState, events: Option[List[SpaceEvent]] = None):SpaceState = {
+    updateStateCore(newState)
+    notifyUpdateState(events)
     currentState
   }
   
@@ -499,7 +502,8 @@ abstract class SpaceCore[RM[_]](val rtc:RTCAble[RM])(implicit val ecology:Ecolog
     for {
       results <- run(funcs)(state)
       persistedState <- persistAllThenFinalState(results)
-      finalState = updateState(persistedState)
+      spaceEvents: List[SpaceEvent] = results.flatMap(_.events)
+      finalState = updateState(persistedState, Some(spaceEvents))
       _ = checkSnapshot()
     }
       yield (results, finalState)
@@ -594,7 +598,7 @@ abstract class SpaceCore[RM[_]](val rtc:RTCAble[RM])(implicit val ecology:Ecolog
       def readied() = {
         monitor("Space is readied -- notifying the State")
         initializing = false
-        notifyUpdateState()
+        notifyUpdateState(None)
         unstashAll() 
       }
       
diff --git a/querki/scalajvm/app/querki/spaces/SpaceEcot.scala b/querki/scalajvm/app/querki/spaces/SpaceEcot.scala
index 5db38c951..e87a4fcbf 100644
--- a/querki/scalajvm/app/querki/spaces/SpaceEcot.scala
+++ b/querki/scalajvm/app/querki/spaces/SpaceEcot.scala
@@ -13,8 +13,8 @@ import models._
 
 import querki.api.ClientRequest
 import querki.core.NameUtils
-import querki.ecology._
-import querki.globals._
+import querki.ecology.{CreateActorFunc, Ecology, EcotIds, QuerkiEcot}
+import querki.globals.{execContext, AnyProp, Future, _}
 import querki.ql._
 import querki.spaces.messages._
 import querki.util.PublicException
@@ -117,6 +117,14 @@ class SpaceEcot(e:Ecology) extends QuerkiEcot(e) with SpaceOps with querki.core.
     akka.pattern.ask(spaceRegion, msg).flatMap(cb)
   }
 
+  var _evolutionListener: Option[() => Unit] = None
+  def notifyFullEvolution(): Unit = {
+    _evolutionListener.map(_())
+  }
+  def registerFullEvolutionListener(f: () => Unit): Unit = {
+    _evolutionListener = Some(f)
+  }
+
   /***********************************************
    * FUNCTIONS
    ***********************************************/
diff --git a/querki/scalajvm/app/querki/spaces/SpaceEvolution.scala b/querki/scalajvm/app/querki/spaces/SpaceEvolution.scala
new file mode 100644
index 000000000..b86161a97
--- /dev/null
+++ b/querki/scalajvm/app/querki/spaces/SpaceEvolution.scala
@@ -0,0 +1,252 @@
+package querki.spaces
+
+import models.Kind.Kind
+import models.{Kind, OID, ModelPersistence, ThingState}
+import querki.basic.Basic
+import querki.ecology.{EcologyInterface, QuerkiEcot}
+import querki.globals.{SpaceState, Ecology}
+import querki.identity.{User, Person}
+import querki.publication.{Publication, CurrentPublicationState}
+import querki.security.AccessControl
+import querki.spaces.SpaceMessagePersistence._
+import querki.spaces.messages.CurrentState
+import querki.system.System
+import querki.uservalues.PersistMessages.OneUserValue
+import querki.util.QLog
+
+/**
+  * This is a home for pure functions that take a Space and some sort of events, and return an updated Space.
+  */
+trait SpaceEvolution extends SpacePure with ModelPersistence {
+  /**
+    * This combines the various streams of information about a Space, and figures out how to handle it for this
+    * specific user.
+    *
+    * TODO: update more efficiently, based on the given changes. Only do a full recompute for edge cases!
+    *
+    * @param oldState the previous filtered state for this User
+    * @param user who we are filtering for
+    * @param userValues the UserValues for this User
+    * @param pubState the current state of Publications, if any
+    * @param changes a new event that is changing the state of this Space
+    *
+    * @return the new state, appropriately filtered for this user
+    */
+  def updateForUser(
+    oldState: Option[SpaceState]
+  )(
+    user: User
+  )(
+    fullState: SpaceState, events: List[SpaceEvent]
+  )(implicit ecology: Ecology): SpaceState = {
+    val AccessControl = ecology.api[AccessControl]
+
+    // Managers act as Owners for purposes of being able to read everything:
+    val isManager = AccessControl.isManager(user, fullState)
+    if (isManager) {
+      fullState
+    } else {
+      val readFiltered =
+        oldState.flatMap(s => evolveForEvents(s, user, fullState, events, AccessControl))
+          .getOrElse(filterFully(user, fullState, AccessControl))
+
+      if (AccessControl.canRead(readFiltered, user, fullState.id))
+        readFiltered
+      else {
+        // This user isn't allowed to read the Root Page, so give them a stub instead.
+        // TODO: this is a fairly stupid hack, but we have to be careful -- filtering out
+        // bits of the Space while not breaking it entirely is tricky. Think about how to
+        // do this better.
+        readFiltered.copy(pf = readFiltered.props +
+          (ecology.api[Basic].DisplayTextProp("**You aren't allowed to read this Page; sorry.**")))
+      }
+    }
+  }
+
+  /**
+    * If we can evolve the given state changes intelligently, do so.
+    *
+    * This is basically how we avoid having to do the fairly evil [[filterFully()]] every time there is a change.
+    * Most world changes are simple, and require only tiny tweaks to the existing filtered state.
+    *
+    * TODO: in principle, we can make this even more efficient by scanning the events and pre-computing whether or not
+    * efficient evolution will be possible before we bother doing it. (Because sometimes we're going to evolve for a
+    * while and then hit an event that foils us and forces a full filter.) But in practice, getting this right is
+    * tricky (since later events depend on earlier ones), so we're not going to worry about that yet.
+    */
+  private def evolveForEvents(oldState: SpaceState, user: User, fullState: SpaceState, events: List[SpaceEvent], AccessControl: AccessControl): Option[SpaceState] = {
+    // Run through all of the events in changes. If all of the evolutions produce Some, we win:
+    (Option(oldState) /: events) { (curStateOpt, event) =>
+      curStateOpt.flatMap(curState => evolveForEvent(curState, user, fullState, event, AccessControl))
+    }
+  }
+
+  /**
+    * Given a single event, evolve for that if possible.
+    */
+  private def evolveForEvent(prevState: SpaceState, user: User, fullState: SpaceState, event: SpaceEvent, AccessControl: AccessControl): Option[SpaceState] = {
+    // Needed for some implicit conversions:
+    implicit val s = fullState
+    event match {
+      case DHCreateThing(requester, oid, kind, modelId, props, modTime, _) => {
+        def applyCreate(): Option[SpaceState] = {
+          Some(createPure(requester, kind, oid, modelId, props, modTime)(prevState))
+        }
+        // TODO: Kind really ought to be an ADT, not just an Int, and we should match here:
+        if (kind == Kind.Property) {
+          // Properties are always public, so this is always legit:
+          applyCreate()
+        } else if (kind == Kind.Thing) {
+          if (modelId == querki.security.MOIDs.InstancePermissionsModelOID) {
+            // Instance Permission objects can affect downstream instance visibility, so for now we're going to just
+            // re-filter instead of trying to be clever here:
+            None
+          } else if (AccessControl.canRead(fullState, user, oid)) {
+            // The common case, probably accounting for 99% of Creates:
+            applyCreate()
+          } else {
+            // If this person can't read it, this is a no-op:
+            Some(prevState)
+          }
+        } else if (kind == Kind.Type) {
+          // TODO: in principle, we ought to be able to deal with this if the Type Model is visible, right?
+          None
+        } else
+          // We might deal with Collection someday, and Space is just weird:
+          None
+      }
+      case DHModifyThing(req, id, modelIdOpt, propChanges, replaceAllProps, modTime) => {
+        fullState.anything(id) match {
+          case Some(thing) => {
+            def applyModify(): Option[SpaceState] = {
+              Some(modifyPure(id, thing, Some(thing.model), propChanges, replaceAllProps, modTime)(prevState))
+            }
+            val kind: Kind = thing.kind
+            if (kind == Kind.Property) {
+              // Same logic as in DHCreateThing:
+              applyModify()
+            } else if (kind == Kind.Thing) {
+              // This is subtle, because the visibility of the Thing could have been changed. So we need to check both
+              // before and after:
+              val couldReadBefore: Boolean = prevState.anything(id).isDefined
+              val canReadAfter: Boolean = AccessControl.canRead(fullState, user, id)
+              if (thing.model == querki.security.MOIDs.InstancePermissionsModelOID) {
+                // We modified an Instance Permissions Object. At least for now, we're not going to try to deal with
+                // this efficiently, since it potentially affects the visibility of this Model's Instances, so we
+                // might have to go add/remove instances from the view.
+                None
+              } else if (
+                (thing.model == querki.identity.MOIDs.PersonOID) &&
+                  (ecology.api[querki.identity.Person].localPerson(user).map(_.id == thing.id).getOrElse(false)))
+              {
+                // We modified this User's local Person record, which might mean we've changed their Roles, so do a
+                // full reload:
+                None
+              } else if (couldReadBefore && canReadAfter) {
+                // Still visible, so do the modification:
+                applyModify()
+              } else if (!couldReadBefore && !canReadAfter) {
+                // Wasn't and isn't visible, so this is a no-op
+                Some(prevState)
+              } else if (couldReadBefore && !canReadAfter) {
+                // It's been removed from our view
+                Some(deletePure(id, thing)(prevState))
+              } else if (!couldReadBefore && canReadAfter) {
+                // It has been added to our view
+                Some(createPure(req, kind, id, thing.model, thing.props, modTime)(prevState))
+              } else {
+                // This shouldn't be possible:
+                QLog.error(s"Logic error processing $event!")
+                None
+              }
+            } else
+              None
+          }
+          case None => {
+            QLog.error(s"Found a DHModifyThing for unknown Thing $id in Space ${fullState.displayName} (${fullState.id})!")
+            None
+          }
+        }
+      }
+
+      case DHDeleteThing(req, id, modTime) => {
+        // This one's easy: if we could see it before, delete it:
+        prevState.anything(id) match {
+          case Some(thing) => Some(deletePure(id, thing)(prevState))
+          case None => None
+        }
+      }
+
+      // This is too complex to analyze at this time:
+      case DHAddApp(req, modTime, appState, parentApps, shadowMap, afterExtraction) => None
+
+      // Should be a non-issue -- the Space should be nearly empty:
+      case DHInitState(req, display) => None
+
+      // All bets are off: this is slamming a totally new state, so we need to recalculate from scratch:
+      case DHSetState(state, modTime, reason, details) => None
+    }
+  }
+
+  /**
+    * When we can't do a smart evolution based on the event, filter the entire Space the hard way.
+    */
+  private def filterFully(user: User, rs: SpaceState, AccessControl: AccessControl)(implicit ecology: Ecology): SpaceState = {
+    // If we are unit-testing, notify the tests that we are doing a full evolution:
+    ecology.api[querki.spaces.SpaceOps].notifyFullEvolution()
+    // TODO: MAKE THIS MUCH FASTER! This is probably O(n**2), maybe worse. How can we make this better?
+    (rs /: rs.things) { (curState, thingPair) =>
+      val (thingId, thing) = thingPair
+      // Note that we need to pass rs into canRead(), not curState. That is because curState can
+      // be in an inconsistent state while we're in the middle of all this. For example, we may
+      // have already exised a Model from curState (because we don't have permission) when we get
+      // to an Instance of that Model. Things can then get horribly confused when we try to look
+      // at the Instance, try to examine its Model, and *boom*.
+      if (AccessControl.canRead(rs, user, thingId) || isReadException(thingId, user)(rs, ecology)) {
+        // Remove any SystemHidden Properties from this Thing, if there are any:
+        val hiddenOIDs = ecology.api[System].hiddenOIDs
+        if (hiddenOIDs.exists(thing.props.contains(_))) {
+          val newThing = thing.copy(pf = {
+            (thing.props -- hiddenOIDs)
+          })
+          curState.copy(things = (curState.things + (newThing.id -> newThing)))
+        } else
+          curState
+      } else
+        curState.copy(things = (curState.things - thingId))
+    }
+  }
+
+  def enhanceWithUserValues(state: SpaceState, userValues: Seq[OneUserValue]): SpaceState = {
+    (state /: userValues) { (curState, uv) =>
+      if (uv.thingId == curState.id) {
+        // We're enhancing the Space itself:
+        curState.copy(pf = (curState.props + (uv.propId -> uv.v)))
+      }
+      else curState.anything(uv.thingId) match {
+        case Some(thing:ThingState) => {
+          val newThing = thing.copy(pf = thing.props + (uv.propId -> uv.v))
+          curState.copy(things = curState.things + (newThing.id -> newThing))
+        }
+        // Yes, this looks like an error, but it isn't: it means that there was a UserValue
+        // for a deleted Thing.
+        case _ => curState
+      }
+    }
+  }
+
+  def enhanceWithPublication(state: SpaceState, pubState: Option[CurrentPublicationState])(implicit ecology: Ecology): SpaceState = {
+    pubState.map { ps =>
+      ecology.api[Publication].enhanceState(state, ps)
+    }.getOrElse(state)
+  }
+
+  /**
+    * This is the dumping ground for exceptions to the rule that your Space only contains Things you can
+    * read. There should *not* be many of these.
+    */
+  def isReadException(thingId:OID, user: User)(implicit state:SpaceState, ecology: Ecology):Boolean = {
+    // I always have access to my own Person record, so that _me always works:
+    ecology.api[Person].hasPerson(user, thingId)
+  }
+}
diff --git a/querki/scalajvm/app/querki/spaces/SpaceMembersActor.scala b/querki/scalajvm/app/querki/spaces/SpaceMembersActor.scala
index f04e19fd4..7b0386d74 100644
--- a/querki/scalajvm/app/querki/spaces/SpaceMembersActor.scala
+++ b/querki/scalajvm/app/querki/spaces/SpaceMembersActor.scala
@@ -23,7 +23,7 @@ private [spaces] class SpaceMembersActor(e:Ecology, val spaceId:OID, val spaceRo
   lazy val maxMembers = Config.getInt("querki.public.maxMembersPerSpace", 100)
 
   def receive = {
-    case CurrentState(state) => {
+    case CurrentState(state, _) => {
       unstashAll()
       context.become(normalReceive(state))
     }
@@ -33,7 +33,7 @@ private [spaces] class SpaceMembersActor(e:Ecology, val spaceId:OID, val spaceRo
   
   // Normal behavior -- at any given time, state is the current known SpaceState
   def normalReceive(state:SpaceState):Receive = {
-    case CurrentState(newState) => context.become(normalReceive(newState))
+    case CurrentState(newState, _) => context.become(normalReceive(newState))
     
     case SpaceSubsystemRequest(_, _, msg) => msg match {
   	  // Someone is attempting to join this Space:
diff --git a/querki/scalajvm/app/querki/spaces/SpaceMessagePersistence.scala b/querki/scalajvm/app/querki/spaces/SpaceMessagePersistence.scala
index 033f9613a..6af97957d 100644
--- a/querki/scalajvm/app/querki/spaces/SpaceMessagePersistence.scala
+++ b/querki/scalajvm/app/querki/spaces/SpaceMessagePersistence.scala
@@ -1,20 +1,14 @@
 package querki.spaces
 
-import akka.persistence.PersistentActor
-
-import models.{ModelPersistence, UnknownOID, ThingId}
+import models.ModelPersistence
 import models.Kind.Kind
 import ModelPersistence._
-
 import querki.globals._
-import querki.history.HistoryFunctions.SetStateReason
-import querki.identity.{User, IdentityPersistence}
+import querki.identity.IdentityPersistence
 import IdentityPersistence._
-import querki.persistence._
+import querki.persistence.{KryoTag, AddedField, UseKryo}
 import querki.time.DateTime
 
-import messages._
-
 /**
  * This defines the "dehydrated" serializable forms of the SpaceMessages. These are the commands we
  * actually process, with sufficient information to replay them at load time.
diff --git a/querki/scalajvm/app/querki/spaces/SpaceRouter.scala b/querki/scalajvm/app/querki/spaces/SpaceRouter.scala
index a9bbcb57d..5ead89972 100644
--- a/querki/scalajvm/app/querki/spaces/SpaceRouter.scala
+++ b/querki/scalajvm/app/querki/spaces/SpaceRouter.scala
@@ -9,7 +9,6 @@ import models.OID
 import querki.admin.SpaceTimingActor
 import querki.api.ClientRequest
 import querki.conversations.messages.{ActiveThings, GetActiveThings}
-import querki.ecology._
 import querki.globals._
 import querki.history.SpaceHistory
 import querki.photos.PhotoUploadActor
@@ -88,7 +87,7 @@ private[spaces] class SpaceRouter(e:Ecology)
     /**
      * The Space has sent an updated State, so tell everyone about it.
      */
-    case msg @ CurrentState(curState) => {
+    case msg @ CurrentState(curState, _) => {
       _state = Some(curState)
       conversations.forward(msg)
       sessions.forward(msg)
diff --git a/querki/scalajvm/app/querki/spaces/messages/SpaceMessages.scala b/querki/scalajvm/app/querki/spaces/messages/SpaceMessages.scala
index 6812783a8..51093b5cb 100644
--- a/querki/scalajvm/app/querki/spaces/messages/SpaceMessages.scala
+++ b/querki/scalajvm/app/querki/spaces/messages/SpaceMessages.scala
@@ -1,18 +1,17 @@
 package querki.spaces.messages
 
 import language.implicitConversions
-
 import models._
 import Kind._
 import MIMEType.MIMEType
-import models.{AsOID, OID, ThingId, UnknownOID}
-
+import models.{ThingId, UnknownOID, OID, AsOID}
 import querki.conversations.messages.ConversationMessage
 import querki.history.HistoryFunctions.SetStateReason
-import querki.identity.{IdentityId, PublicIdentity, User}
+import querki.identity.{IdentityId, User, PublicIdentity}
 import querki.session.messages.SessionMessage
-import querki.spaces.{SpaceStatusCode, StatusNormal}
-import querki.values.{RequestContext, SpaceState, SpaceVersion}
+import querki.spaces.SpaceMessagePersistence.SpaceEvent
+import querki.spaces.{StatusNormal, SpaceStatusCode}
+import querki.values.{SpaceVersion, SpaceState, RequestContext}
 import querki.util.PublicException
 
 sealed trait SpaceMgrMsg
@@ -150,7 +149,17 @@ import SpaceError._
 
 // General message published from a Space to its subscribers. Possibly still a bit half-baked, but is likely to become
 // important.
-case class CurrentState(state:SpaceState)
+
+/**
+  * The current or updated state of this Space.
+  *
+  * If `events` is present, it is the list of changes that led to this new State. Clients may use this list to
+  * evolve their own view of the state, instead of using the new raw State.
+  *
+  * @param state The updated state of this Space
+  * @param events The events that caused this update.
+  */
+case class CurrentState(state: SpaceState, events: Option[List[SpaceEvent]] = None)
 
 sealed trait SpaceMembersBase extends SpaceMessagePayload
 
diff --git a/querki/scalajvm/app/querki/spaces/package.scala b/querki/scalajvm/app/querki/spaces/package.scala
index fc5cceb69..04a02c182 100644
--- a/querki/scalajvm/app/querki/spaces/package.scala
+++ b/querki/scalajvm/app/querki/spaces/package.scala
@@ -92,6 +92,13 @@ package object spaces {
     
     def askSpace[A, B](msg:SpaceMessage)(cb: A => Future[B])(implicit m:Manifest[A]):Future[B]
     def askSpace2[B](msg:SpaceMessage)(cb: PartialFunction[Any, Future[B]]):Future[B]
+
+    /**
+      * This gets called when a SpaceState gets fully evolved, and sends out a notification to listeners. It exists
+      * *solely* for unit testing, and should not be used for anything else.
+      */
+    def notifyFullEvolution(): Unit
+    def registerFullEvolutionListener(f: () => Unit): Unit
   }
     
   trait SpacePersistence extends EcologyInterface {
diff --git a/querki/scalajvm/app/querki/system/SystemEcot.scala b/querki/scalajvm/app/querki/system/SystemEcot.scala
index 9bee47d1f..df8ad68d4 100644
--- a/querki/scalajvm/app/querki/system/SystemEcot.scala
+++ b/querki/scalajvm/app/querki/system/SystemEcot.scala
@@ -4,8 +4,8 @@ import akka.actor._
 import akka.cluster.Cluster
 import akka.cluster.sharding._
 import akka.cluster.singleton._
-
 import querki.ecology._
+import querki.globals.OID
 import querki.values.SpaceState
 
 /**
@@ -174,4 +174,21 @@ class SystemEcot(e:Ecology, val actorSystemOpt:Option[ActorSystem], val asyncIni
     }
 
   }
+
+  // Since the value of hiddenOIDs is never expected to change, and is system-wide, we compute and cache it once, at
+  // first access:
+  var _hiddenOIDs: Option[List[OID]] = None
+  def hiddenOIDs: List[OID] = {
+    _hiddenOIDs.getOrElse {
+      _state match {
+        case Some(state) => {
+          val hiddenProps = state.spaceProps.values.filter(_.ifSet(Basic.SystemHiddenProp)(state))
+          val oids = hiddenProps.map(_.id).toList
+          _hiddenOIDs = Some(oids)
+          oids
+        }
+        case None => List.empty
+      }
+    }
+  }
 }
diff --git a/querki/scalajvm/app/querki/system/package.scala b/querki/scalajvm/app/querki/system/package.scala
index fe0afbab6..3da033001 100644
--- a/querki/scalajvm/app/querki/system/package.scala
+++ b/querki/scalajvm/app/querki/system/package.scala
@@ -1,9 +1,8 @@
 package querki
 
 import scala.concurrent.Future
-
 import querki.ecology._
-
+import querki.globals.OID
 import querki.identity.User
 import querki.session.UserFunctions.TOSState
 import querki.values.SpaceState
@@ -16,6 +15,11 @@ package object system {
      * so instead of using the old backdoor through SystemSpace.State, which will eventually go away.
      */
     def State:SpaceState
+
+    /**
+      * OIDs in the System Space that should *never* be shown to the users.
+      */
+    def hiddenOIDs: List[OID]
   }
   
   trait TermsOfService extends EcologyInterface {
diff --git a/querki/scalajvm/test/querki/collections/CollectionsTests.scala b/querki/scalajvm/test/querki/collections/CollectionsTests.scala
index 5f60f680a..982b05a38 100644
--- a/querki/scalajvm/test/querki/collections/CollectionsTests.scala
+++ b/querki/scalajvm/test/querki/collections/CollectionsTests.scala
@@ -27,7 +27,9 @@ class CollectionsTests extends QuerkiTests {
           favoriteGenresProp("Rock", "Weird"))
       }
       implicit val s = new TSpace
-      
+
+      // TODO: this is mysteriously flaky, sometimes returning the Func.generalWrongType warning instead. Maddening:
+      // fix this!
       pql("""[[More Favorites -> _concat(Favorite Artists, Favorite Genres)]]""") should
         equal (expectedWarning("Collections.concat.mismatchedTypes"))
     }
diff --git a/querki/scalajvm/test/querki/conversations/ConvCoreTests.scala b/querki/scalajvm/test/querki/conversations/ConvCoreTests.scala
index 5f1264962..fddbf971d 100644
--- a/querki/scalajvm/test/querki/conversations/ConvCoreTests.scala
+++ b/querki/scalajvm/test/querki/conversations/ConvCoreTests.scala
@@ -51,7 +51,7 @@ trait TestConversations extends EcologyMember { self:TestSpace =>
    */
   def routeToConv(rawMsg:AnyRef):Option[AnyRef] = {
     rawMsg match {
-      case msg @ CurrentState(current) => {
+      case msg @ CurrentState(current, _) => {
         thingConvs.values.foreach { _ ! msg }
         None
       }
diff --git a/querki/scalajvm/test/querki/security/SecurityMidFuncs.scala b/querki/scalajvm/test/querki/security/SecurityMidFuncs.scala
index 376c8879e..06f974749 100644
--- a/querki/scalajvm/test/querki/security/SecurityMidFuncs.scala
+++ b/querki/scalajvm/test/querki/security/SecurityMidFuncs.scala
@@ -2,10 +2,8 @@ package querki.security
 
 import autowire._
 
-import org.scalatest.Matchers._
-
 import querki.data._
-import querki.globals._
+import querki.globals.execContext
 import querki.test.mid._
 
 import SecurityFunctions._
@@ -55,6 +53,53 @@ trait SecurityMidFuncs {
 
   def getSharedLinkURL(link: TOID): TestOp[String] =
     TestOp.client { _[SecurityFunctions].getSharedLinkURL(link).call() }
+
+  // Higher-level functions
+
+  def createRole(name: String, perms: TID*): TestOp[TID] = {
+    for {
+      std <- getStd
+      role <- makeThing(std.security.customRoleModel, name, std.security.rolePermissionsProp :=> perms.toList)
+    }
+      yield role
+  }
+
+  def getPersonInfoFor(user: TestUser): TestOp[PersonInfo] = {
+    for {
+      std <- getStd
+      userId <- ClientState.userId(user)
+      // Note that we grant the role to the *Person*, not the *User*. So we need to fetch the Person records, and find
+      // the desired one:
+      membersAndInvitees <- getMembers
+      members = membersAndInvitees._1
+    }
+      // TODO: wow, we actually have no good way of finding this! We have the user, and are trying to find the right person.
+      // The connection is via Identity, but we don't have that on either side. Should we provide a way to get the
+      // current user's Person ID in the current Space, as a better way to do this, instead of comparing display names?
+      yield members.find(_.person.displayName == user.display).getOrElse(throw new Exception(s"Couldn't find Space member '${user.base}' to grant Role to!"))
+  }
+
+  def grantRoleTo(user: TestUser, role: TID): TestOp[Unit] = {
+    for {
+      std <- getStd
+      personInfo <- getPersonInfoFor(user)
+      roles = personInfo.roles
+      newRoles = (roles.toSet + role).toList
+      _ <- changeProp(personInfo.person.oid, std.security.personRolesProp :=> newRoles)
+    }
+      yield ()
+  }
+
+  def revokeRoleFrom(user: TestUser, role: TID): TestOp[Unit] = {
+    for {
+      std <- getStd
+      personInfo <- getPersonInfoFor(user)
+      roles = personInfo.roles
+      newRoles = (roles.toSet - role).toList
+      _ <- changeProp(personInfo.person.oid, std.security.personRolesProp :=> newRoles)
+    }
+      yield ()
+  }
 }
 
 object SecurityMidFuncs extends SecurityMidFuncs
diff --git a/querki/scalajvm/test/querki/security/SecurityMidTests.scala b/querki/scalajvm/test/querki/security/SecurityMidTests.scala
index 57a0acf59..1e656fba7 100644
--- a/querki/scalajvm/test/querki/security/SecurityMidTests.scala
+++ b/querki/scalajvm/test/querki/security/SecurityMidTests.scala
@@ -2,11 +2,12 @@ package querki.security
 
 import org.scalatest.tags.Slow
 import org.scalatest.Matchers._
-
 import querki.data.TID
 import querki.test.mid._
 import AllFuncs._
+import ClientState.withUser
 import SecurityMidFuncs._
+import org.scalactic.source.Position
 
 object SecurityMidTests {
   val securityTests: TestOp[Unit] = {
@@ -15,6 +16,22 @@ object SecurityMidTests {
     }
       yield ()
   }
+
+  /**
+    * This (and the two convenience functions after it) are the easiest way to check read visibility of a particular
+    * Thing for the specified user.
+    */
+  def checkNameRealityFor(shouldBeReal: Boolean, name: String, who: TestUser)(implicit position: Position): TestOp[Unit] = {
+    for {
+      check <- withUser(who) { getThingInfo(TID(name)) }
+      _ = assert(check.isTag != shouldBeReal, s"Expected $name to be ${if (shouldBeReal) "real" else "tag"}, and it wasn't!")
+    }
+      yield ()
+  }
+  def checkNameIsRealFor(name: String, who: TestUser)(implicit position: Position)=
+    checkNameRealityFor(true, name, who)
+  def checkNameIsMissingFor(name: String, who: TestUser)(implicit position: Position) =
+    checkNameRealityFor(false, name, who)
   
   lazy val regressionTestQIbu6oeej: TestOp[Unit] = {
     val ownerName = "bu6oeej Owner"
@@ -70,15 +87,65 @@ object SecurityMidTests {
     }
       yield ()
   }
+
+  lazy val regressionTestQIbu6of67: TestOp[Unit] = {
+    val ownerName = "bu6of67 Owner"
+    val owner = TestUser(ownerName)
+    val memberName = "bu6of67 Member"
+    val member = TestUser(memberName)
+    val spaceName = "bu6of67 Space"
+
+    for {
+      _ <- step("Regression test for QI.bu6of67")
+      std <- getStd
+      _ <- newUser(owner)
+      space <- createSpace(spaceName)
+
+      _ <- newUser(member)
+
+      // Set up the Space and members:
+      _ <- inviteIntoSpace(owner, space, member)
+
+      // Build the Things:
+      _ <- ClientState.switchToUser(owner)
+      model <- makeModel("The Model")
+      instanceName = "The Instance"
+      instance <- makeThing(model, instanceName)
+
+      // Check that the member can see them:
+      _ <- checkNameIsRealFor(instanceName, member)
+
+      // Prevent the member from seeing the instance:
+      perms <- permsFor(model)
+      instancePermThing = perms.instancePermThing.get
+      _ <- changeProp(instancePermThing, std.security.canReadPerm :=> std.security.owner)
+      _ <- checkNameIsMissingFor(instanceName, member)
+
+      // Create the role, and make the instance visible via the role, which should be enough to change anything:
+      role <- createRole("Visible Role", std.security.canReadPerm)
+      _ <- changeProp(instancePermThing, std.security.canReadPerm :=> role)
+      _ <- checkNameIsMissingFor(instanceName, member)
+
+      // Give the role to the member, which *should* make the instance visible. (This is failing, hence the bug.)
+      _ <- grantRoleTo(member, role)
+      _ <- checkNameIsRealFor(instanceName, member)
+
+      // And for good measure, let's make sure the reverse works as expected:
+      _ <- revokeRoleFrom(member, role)
+      _ <- checkNameIsMissingFor(instanceName, member)
+    }
+      yield ()
+  }
 }
 
 @Slow
 class SecurityMidTests extends MidTestBase {
   import SecurityMidTests._
   
-  "QI.bu6oeej" should {
+  "Regression tests" should {
     "pass" in {
       runTest(regressionTestQIbu6oeej)
+      runTest(regressionTestQIbu6of67)
     }
   }
 }
diff --git a/querki/scalajvm/test/querki/spaces/SpaceCoreTests.scala b/querki/scalajvm/test/querki/spaces/SpaceCoreTests.scala
index 467e01c97..606239c9a 100644
--- a/querki/scalajvm/test/querki/spaces/SpaceCoreTests.scala
+++ b/querki/scalajvm/test/querki/spaces/SpaceCoreTests.scala
@@ -51,7 +51,7 @@ class TestSpaceCore(
     TestRTCAble.successful(testSpace.world.oidBlock(nIds))
   }
   
-  def notifyUpdateState() = {
+  def notifyUpdateState(events: Option[List[SpaceEvent]]) = {
     // TODO: hook and test this?
   }
   
@@ -113,7 +113,7 @@ abstract class SpaceCoreSpaceBase()(implicit val ecology:Ecology) extends TestSp
    */
   def !(msg:AnyRef):Option[AnyRef] = {
     msg match {
-      case msg @ CurrentState(curState) => {
+      case msg @ CurrentState(curState, _) => {
         routeToConv(msg)
       }
       case msg @ SpaceSubsystemRequest(_, _, payload:querki.conversations.messages.ConversationMessage) => routeToConv(msg)
diff --git a/querki/scalajvm/test/querki/test/QuerkiTests.scala b/querki/scalajvm/test/querki/test/QuerkiTests.scala
index 75c25dbdd..aabc85ee2 100644
--- a/querki/scalajvm/test/querki/test/QuerkiTests.scala
+++ b/querki/scalajvm/test/querki/test/QuerkiTests.scala
@@ -6,7 +6,7 @@ import org.scalatest.{BeforeAndAfterAll, Matchers, WordSpec}
 import models.{Thing, OID}
 import querki.core.QLText
 import querki.ecology._
-import querki.globals._
+import querki.globals.{awaitIntentionally, Ecology, EcologyMember, EcologyInterface, QLog, QuerkiEcot}
 import querki.identity.User
 import querki.time.{DateTime, TimeProvider}
 import querki.values.{SpaceState, QLContext, RequestContext}
diff --git a/querki/scalajvm/test/querki/test/functional/QuerkiFuncTests.scala b/querki/scalajvm/test/querki/test/functional/QuerkiFuncTests.scala
index 8c84fcdb8..8c13553ca 100644
--- a/querki/scalajvm/test/querki/test/functional/QuerkiFuncTests.scala
+++ b/querki/scalajvm/test/querki/test/functional/QuerkiFuncTests.scala
@@ -35,8 +35,12 @@ trait FuncMixin
  * The actual test runner. This defines the functional-test "cake", and the tests to run.
  * 
  * See package.scala for lots more details.
+  *
+  * Disabled for now, since it isn't working.
+  * TODO: replace this with a new suite that works better!
  */
-@Slow
+//@Slow
+@Ignore
 class QuerkiFuncTests 
   // Infrastructure mix-ins, from ScalaTest and Play:
   extends WordSpec
diff --git a/querki/scalajvm/test/querki/test/mid/BasicTests.scala b/querki/scalajvm/test/querki/test/mid/BasicTests.scala
index d4c39a5eb..4d6dba2bc 100644
--- a/querki/scalajvm/test/querki/test/mid/BasicTests.scala
+++ b/querki/scalajvm/test/querki/test/mid/BasicTests.scala
@@ -2,8 +2,10 @@ package querki.test.mid
 
 import org.scalatest.Matchers._
 import org.scalatest.tags.Slow
-
+import ClientState.{switchToUser, cache, withUser}
 import AllFuncs._
+import querki.api.UnknownThingException
+import querki.data.TID
 
 object BasicMidTests {
   /**
@@ -14,10 +16,14 @@ object BasicMidTests {
       _ <- step("Basic smoketest suite")
       std <- getStd
       basicUser = TestUser("Basic Test User")
+      member = TestUser("Member Test User")
       basicSpaceName = "Basic Test Space"
       
-      _ <- step("Setup the User")
+      _ <- step("Setup the Users")
       loginResults <- newUser(basicUser)
+      _ <- cache
+      _ <- newUser(member)
+      _ <- switchToUser(basicUser)
 
       _ <- step("Create the main Space for general testing")
       // mainSpace is the result of the createSpace() function...
@@ -28,12 +34,13 @@ object BasicMidTests {
       // ... and the Space is also now in the World State:
       createdInWorldOpt <- TestOp.fetch(_.world.spaces.get(mainSpace))
       _ = createdInWorldOpt.map(_.info.displayName) should be (Some(basicSpaceName))
+      _ <- inviteIntoSpace(basicUser, mainSpace, member)
       
       _ <- step("Create the first simple Thing")
       simpleThingId <- makeThing(std.basic.simpleThing, "First Thing")
       simpleThing <- WorldState.fetchThing(simpleThingId)
       _ = simpleThing.info.displayName should be ("First Thing")
-      
+
       _ <- step("Create the first simple Model")
       modelId <- makeModel("First Model")
       model <- WorldState.fetchThing(modelId)
@@ -47,8 +54,23 @@ object BasicMidTests {
       _ <- step(s"Create an Instance, and mess with it")
       instanceId <- makeThing(modelId, "First Instance")
       _ <- checkPropValue(instanceId, propId, "Default value of First Property")
+      _ <- expectingFullFiltering {
+             withUser(member) {
+               checkPropValue(instanceId, propId, "Default value of First Property") } }
       _ <- changeProp(instanceId, propId :=> "Instance value")
       _ <- checkPropValue(instanceId, propId, "Instance value")
+      _ <- expectingEfficientEvolution {
+             withUser(member) {
+               checkPropValue(instanceId, propId, "Instance value") } }
+
+      _ <- step(s"Destroy the first Instance")
+      _ <- deleteThing(instanceId)
+      _ <- TestOp.expectingError[UnknownThingException](getThingPage(instanceId, None))
+      deletedCheck <- expectingEfficientEvolution {
+                        withUser(member) {
+                          getThingInfo(TID("First Instance")) } }
+      _ = deletedCheck.isTag should be (true)
+
     }
       yield ()
   }
diff --git a/querki/scalajvm/test/querki/test/mid/ClientState.scala b/querki/scalajvm/test/querki/test/mid/ClientState.scala
index 8ec4b5650..7d4b9987a 100644
--- a/querki/scalajvm/test/querki/test/mid/ClientState.scala
+++ b/querki/scalajvm/test/querki/test/mid/ClientState.scala
@@ -1,11 +1,9 @@
 package querki.test.mid
 
 import play.api.mvc.{Result, Session}
-
 import monocle.Lens
 import monocle.macros.GenLens
-
-import querki.data.{SpaceInfo, UserInfo}
+import querki.data.{SpaceInfo, UserInfo, TID}
 
 /**
  * Describes the state of the "client" -- the current User, their session info, the Space they are looking at, and
@@ -44,4 +42,42 @@ object ClientState {
     }
       yield ()
   }
+
+  /**
+    * Performs the specified operation with the specified user, and then restores the current user.
+    */
+  def withUser[T](user: TestUser)(op: TestOp[T]): TestOp[T] = {
+    for {
+      originalUser <- TestOp.fetch(_.client.testUser)
+      _ <- switchToUser(user)
+      t <- op
+      _ <- switchToUser(originalUser)
+    }
+      yield t
+  }
+
+  /**
+    * Performs the specified operation, and then pop the original user back out at the end.
+    */
+  def cachingUser[T](op: TestOp[T]): TestOp[T] = {
+    for {
+      originalUser <- TestOp.fetch(_.client.testUser)
+      t <- op
+      _ <- switchToUser(originalUser)
+    }
+      yield t
+  }
+
+  /**
+    * Fetch the TID of a user who has previously been created in this test.
+    */
+  def userId(user: TestUser): TestOp[TID] = {
+    TestOp.fetch { state =>
+      val oid = TestState.clientL.get(state).userInfo
+        .orElse(TestState.clientCacheL.get(state).apply(user.base).userInfo)
+        .getOrElse(throw new Exception(s"Didn't find expected user $user!"))
+        .oid
+      TID(oid)
+    }
+  }
 }
diff --git a/querki/scalajvm/test/querki/test/mid/EditFuncs.scala b/querki/scalajvm/test/querki/test/mid/EditFuncs.scala
index a8a1a4d9e..b97b6126f 100644
--- a/querki/scalajvm/test/querki/test/mid/EditFuncs.scala
+++ b/querki/scalajvm/test/querki/test/mid/EditFuncs.scala
@@ -7,6 +7,7 @@ import autowire._
 import querki.data._
 import querki.editing._
 import querki.editing.EditFunctions._
+import querki.api.ThingFunctions
 import querki.globals._
 
 import AllFuncs._
diff --git a/querki/scalajvm/test/querki/test/mid/LoginFuncs.scala b/querki/scalajvm/test/querki/test/mid/LoginFuncs.scala
index cc958cfc4..d00caffa7 100644
--- a/querki/scalajvm/test/querki/test/mid/LoginFuncs.scala
+++ b/querki/scalajvm/test/querki/test/mid/LoginFuncs.scala
@@ -61,8 +61,17 @@ trait LoginFuncs {
     implicit val m = mat
     call(controller.signupStart(), request)
   }
-  
-  def signup: TestOp[LoginResults] = TestOp.fut { state =>
+
+  def storeLoginResults(loginResults: LoginResults): TestOp[Unit] = {
+    TestOp.update { state =>
+      val userName = state.client.testUser.base
+      val updatedClientState = state.client.copy(userInfo = Some(loginResults.userInfo))
+      val updatedInClient = TestState.clientL.set(updatedClientState)(state)
+      TestState.clientCacheL.modify(_ + (userName -> updatedClientState))(updatedInClient)
+    }
+  }
+
+  def doSignup: TestOp[LoginResults] = TestOp.fut { state =>
     implicit val app = state.harness.app
     implicit val m = mat
     val user = state.testUser
@@ -77,6 +86,14 @@ trait LoginFuncs {
       
     state.plus(resultFut) zip loginResultsFut
   }
+
+  def signup: TestOp[LoginResults] = {
+    for {
+      loginResults <- doSignup
+      _ <- storeLoginResults(loginResults)
+    }
+      yield loginResults
+  }
   
   def validateSignup: TestOp[Unit] = StateT { state =>
     implicit val ecology = state.harness.ecology
@@ -132,7 +149,7 @@ trait LoginFuncs {
   /**
    * Log in with the given credentials. Note that "name" may be either handle or email.
    */  
-  def login: TestOp[LoginResults] = TestOp.fut { state =>
+  def doLogin: TestOp[LoginResults] = TestOp.fut { state =>
     implicit val app = state.harness.app
     implicit val m = mat
     val user = state.testUser
@@ -148,6 +165,14 @@ trait LoginFuncs {
       
     state.plus(resultFut) zip loginResultsFut
   }
+
+  def login: TestOp[LoginResults] = {
+    for {
+      loginResults <- doLogin
+      _ <- storeLoginResults(loginResults)
+    }
+      yield loginResults
+  }
   
   def logout: TestOp[Session] = TestOp.fut { state =>
     implicit val app = state.harness.app
diff --git a/querki/scalajvm/test/querki/test/mid/PropFuncs.scala b/querki/scalajvm/test/querki/test/mid/PropFuncs.scala
index ead83cf31..347e9674a 100644
--- a/querki/scalajvm/test/querki/test/mid/PropFuncs.scala
+++ b/querki/scalajvm/test/querki/test/mid/PropFuncs.scala
@@ -1,18 +1,15 @@
 package querki.test.mid
 
 import org.scalatest.Matchers._
-
 import cats.effect.IO
-
 import autowire._
-
 import querki.api.ThingFunctions
 import querki.data._
 import querki.editing.EditFunctions
 import querki.editing.EditFunctions._
 import querki.globals._
-
 import AllFuncs._
+import org.scalactic.source.Position
 
 trait PropFuncs {
   /**
@@ -88,11 +85,11 @@ trait PropFuncs {
    * 
    * This needs a bit of generalization, to work with other value types.
    */
-  def checkPropValue(thingId: TID, propId: TID, expected: String): TestOp[Unit] = {
+  def checkPropValue(thingId: TID, propId: TID, expected: String)(implicit position: Position): TestOp[Unit] = {
     val propOid = TOID(propId.underlying)
     for {
       valueMap <- TestOp.client { _[ThingFunctions].getPropertyValues(thingId, List(propOid)).call() }
-      v = valueMap.get(propOid).getOrElse(throw new Exception(s"Failed to find a value for $thingId.$propId!"))
+      v = valueMap.get(propOid).getOrElse(fail(s"Failed to find a value for $thingId.$propId!"))
       _ = v.vs.head should be (expected)
     }
       yield ()
diff --git a/querki/scalajvm/test/querki/test/mid/SetupFuncs.scala b/querki/scalajvm/test/querki/test/mid/SetupFuncs.scala
index 89ccfb26e..c8409cce5 100644
--- a/querki/scalajvm/test/querki/test/mid/SetupFuncs.scala
+++ b/querki/scalajvm/test/querki/test/mid/SetupFuncs.scala
@@ -29,7 +29,7 @@ trait SetupFuncs {
   }
 
   def inviteIntoSpace(owner:TestUser, spaceId: TID, member: TestUser): TestOp[Unit] = {
-    for {
+    val doIt = for {
       _ <- ClientState.switchToUser(owner)
       // TODO: refactor this invite-to-space code into SetupFuncs:
       token <- EmailTesting.nextEmail
@@ -40,7 +40,10 @@ trait SetupFuncs {
       _ <- ClientState.switchToUser(member)
       inviteHash <- EmailTesting.extractInviteHash(token)
       _ <- acceptInvite(inviteHash, spaceInfo)
+      _ <- setClientSpace(spaceInfo)
     }
       yield ()
+
+    ClientState.cachingUser(doIt)
   }
 }
diff --git a/querki/scalajvm/test/querki/test/mid/SpaceFuncs.scala b/querki/scalajvm/test/querki/test/mid/SpaceFuncs.scala
index 135db5795..a139a499f 100644
--- a/querki/scalajvm/test/querki/test/mid/SpaceFuncs.scala
+++ b/querki/scalajvm/test/querki/test/mid/SpaceFuncs.scala
@@ -1,14 +1,14 @@
 package querki.test.mid
 
 import cats.effect.IO
-
 import autowire._
-
-import querki.data.{SpaceInfo, TID}
+import org.scalatest.Matchers._
+import org.scalactic.source.Position
+import querki.data.{TID, SpaceInfo}
 import querki.globals._
 import querki.session.UserFunctions
-
 import AllFuncs._
+import querki.spaces.SpaceOps
 
 /**
  * Provides functions for creating and manipulating Spaces.
@@ -30,6 +30,28 @@ trait SpaceFuncs {
     }
       yield spaceInfo.oid
   }
+
+  def expectingFullFiltering[R](op: TestOp[R])(implicit position: Position): TestOp[R] = {
+    // EVIL!!! Can we substitute in a cats-effect Var instead?
+    var gotEvolution = false
+    for {
+      _ <- TestOp.withState(_.harness.ecology.api[SpaceOps].registerFullEvolutionListener(() => gotEvolution = true))
+      result <- op
+      _ = assert(gotEvolution, "Expected this operation to do an expensive full filtering, but it didn't!")
+    }
+      yield result
+  }
+
+  def expectingEfficientEvolution[R](op: TestOp[R])(implicit position: Position): TestOp[R] = {
+    // EVIL!!! Can we substitute in a cats-effect Var instead?
+    var gotEvolution = false
+    for {
+      _ <- TestOp.withState(_.harness.ecology.api[SpaceOps].registerFullEvolutionListener(() => gotEvolution = true))
+      result <- op
+      _ = assert(!gotEvolution, "This operation did an unexpected (expensive) full filter!")
+    }
+      yield result
+  }
 }
 
 object SpaceFuncs extends SpaceFuncs
diff --git a/querki/scalajvm/test/querki/test/mid/TestOp.scala b/querki/scalajvm/test/querki/test/mid/TestOp.scala
index a2527d609..78b4df539 100644
--- a/querki/scalajvm/test/querki/test/mid/TestOp.scala
+++ b/querki/scalajvm/test/querki/test/mid/TestOp.scala
@@ -2,12 +2,16 @@ package querki.test.mid
 
 import scala.concurrent.Future
 import scala.concurrent.ExecutionContext.Implicits.global
-
 import cats._
 import cats.data._
 import cats.effect.IO
 import cats.implicits._
 
+import scala.reflect.ClassTag
+
+case class UnexpectedSuccessError[R](result: R) extends Exception(s"TestOp expected failure, but instead got result $result")
+case class WrongExceptionException(actual: Throwable) extends Exception(s"TestOp got the wrong error $actual")
+
 object TestOp {
   def apply[A](f: TestState => IO[(TestState, A)])(implicit F: Applicative[IO]): TestOp[A] = StateT[IO, TestState, A] { f }
   
@@ -27,7 +31,6 @@ object TestOp {
   def withState[R](f: TestState => R): TestOp[R] = TestOp { state =>
     IO.pure(state, f(state))
   }
-  
 
   /**
    * This wraps up the common pattern of a "test operation", which takes a ClientState, and does
@@ -56,4 +59,22 @@ object TestOp {
     val result = f(state) 
     IO.pure((state, result))
   }
+
+  // TODO: surely there is a more correct way to do this?
+  def expectingError[T <: Throwable](op: TestOp[_])(implicit tag: ClassTag[T]): TestOp[Unit] = {
+    op.attempt.map {
+      _ match {
+        case Left(error) => {
+          if (error.getClass == tag.runtimeClass) {
+            Right(())
+          } else {
+            throw new WrongExceptionException(error)
+          }
+        }
+        case Right(result) => {
+          throw new UnexpectedSuccessError(result)
+        }
+      }
+    }
+  }
 }
diff --git a/querki/scalajvm/test/querki/test/mid/TestPropVal.scala b/querki/scalajvm/test/querki/test/mid/TestPropVal.scala
index 9d041d119..094af5f4d 100644
--- a/querki/scalajvm/test/querki/test/mid/TestPropVal.scala
+++ b/querki/scalajvm/test/querki/test/mid/TestPropVal.scala
@@ -6,13 +6,17 @@ import querki.data.{ThingInfo, TID}
  * Describes a value that can be "saved" through the Client API.
  */
 trait SaveableVal {
-  def toSave: Seq[String]
+  def toSave: List[String]
 }
 
 case class SaveableText(str: String) extends SaveableVal {
   def toSave = List(str)
 }
 
+case class SaveableTextList(strs: List[String]) extends SaveableVal {
+  def toSave = strs
+}
+
 /**
  * Typeclass for creating a SaveablePropVal from another type.
  */
@@ -33,6 +37,12 @@ object Saveable {
   implicit object ThingInfoSaveable extends Saveable[ThingInfo] {
     def toSaveable(t: ThingInfo) = SaveableText(t.oid.underlying)
   }
+  implicit def ListSaveable[T: Saveable] = new Saveable[List[T]] {
+    def toSaveable(ts: List[T]) = {
+      val contents: List[String] = ts.map(_.toSaveable).map(_.toSave).flatten
+      SaveableTextList(contents)
+    }
+  }
   
   implicit class SaveableOps[T : Saveable](v: T) {
     def toSaveable: SaveableVal = implicitly[Saveable[T]].toSaveable(v)