diff --git a/assets/sai.js b/assets/sai.js
index 3f125d1..45259b5 100644
--- a/assets/sai.js
+++ b/assets/sai.js
@@ -1669,7 +1669,7 @@ function ws_open_sai()
 //						"Server Status (Disconnected)";
 //			lws_gray_out(true,{"zindex":"499"});
 			
-			myVar = setTimeout(ws_open_sai, 10000);
+			myVar = setTimeout(ws_open_sai, 1000);
 		};
 	} catch(exception) {
 		alert("<p>Error" + exception);  
diff --git a/src/server/s-websrv.c b/src/server/s-websrv.c
index dd3f057..325149a 100644
--- a/src/server/s-websrv.c
+++ b/src/server/s-websrv.c
@@ -200,12 +200,7 @@ sais_list_builders(struct vhd *vhd)
 
 			p += lws_snprintf((char *)p, lws_ptr_diff_size_t(end, p), "]}");
 
-			/*
-			 * This is the SERVER's WEB daemon server, broadcasting to all connected clients (the WEB daemons)...
-			 * 		the list of BUILDERS
-			 */
-
-			lwsl_ss_err(vhd->h_ss_websrv, "sai-server's WEB daemon server broadcasting to all WEB daemons: %s\n", vhd->json_builders);
+			lwsl_ss_notice(vhd->h_ss_websrv, "sai-server's WEB daemon server broadcasting to all WEB daemons: %s\n", vhd->json_builders);
 
 			sais_websrv_broadcast(vhd->h_ss_websrv,
 					      vhd->json_builders,
diff --git a/src/server/s-ws-builder.c b/src/server/s-ws-builder.c
index 6266a0d..7ff3ed0 100644
--- a/src/server/s-ws-builder.c
+++ b/src/server/s-ws-builder.c
@@ -329,7 +329,6 @@ handle:
 	switch (pss->a.top_schema_index) {
 	case SAIM_WSSCH_BUILDER_PLATS:
 
-		// lwsl_hexdump_notice(buf, bl);
 
 		/*
 		 * builder is sending us an array of platforms it provides us
@@ -337,7 +336,7 @@ handle:
 
 		pss->u.o = (sai_plat_owner_t *)pss->a.dest;
 
-		lwsl_notice("%s: seen platform list: count %d\n", __func__,
+		lwsl_notice("%s: SERVER: seen incoming platform list: count %d\n", __func__,
 				pss->u.o->plat_owner.count);
 
 		lws_start_foreach_dll(struct lws_dll2 *, pb,
@@ -520,7 +519,7 @@ bail:
 		break;
 
 	case SAIM_WSSCH_BUILDER_LOADREPORT:
-		lwsl_wsi_user(pss->wsi, "SAIM_WSSCH_BUILDER_LOADREPORT broadcasting\n");
+		// lwsl_wsi_user(pss->wsi, "SAIM_WSSCH_BUILDER_LOADREPORT broadcasting\n");
 		sais_websrv_broadcast(vhd->h_ss_websrv, (const char *)buf, bl);
 		break;
 
diff --git a/src/web/w-websrv.c b/src/web/w-websrv.c
index 803e557..2de152c 100644
--- a/src/web/w-websrv.c
+++ b/src/web/w-websrv.c
@@ -36,6 +36,7 @@ typedef struct saiw_websrv {
 	struct lejp_ctx			ctx;
 	//lws_dll2_t
 	struct lws_buflist		*bltx;
+	struct lwsac			*deprecated;
 
 } saiw_websrv_t;
 
@@ -70,6 +71,7 @@ saiw_lp_rx(void *userobj, const uint8_t *buf, size_t len, int flags)
 //	lwsl_hexdump_notice(buf, len);
 
 	if (flags & LWSSS_FLAG_SOM) {
+		m->deprecated = vhd->builders;
 		memset(&m->a, 0, sizeof(m->a));
 		m->a.map_st[0] = lsm_schema_json_map;
 		m->a.map_entries_st[0] = lsm_schema_json_map_array_size;
@@ -81,6 +83,7 @@ saiw_lp_rx(void *userobj, const uint8_t *buf, size_t len, int flags)
 
 	n = lejp_parse(&m->ctx, (uint8_t *)buf, (int)len);
 	if (n < LEJP_CONTINUE || (n >= 0 && !m->a.dest)) {
+		vhd->builders_owner = NULL;
 		lwsac_free(&m->a.ac);
 		lwsl_notice("%s: srv->web JSON decode failed '%s'\n",
 				__func__, lejp_error_to_string(n));
@@ -110,13 +113,20 @@ saiw_lp_rx(void *userobj, const uint8_t *buf, size_t len, int flags)
 		break;
 
 	case SAIS_WS_WEBSRV_RX_SAI_BUILDERS:
-		lwsl_notice("%s: updated sai builder list (%d browsers)\n", __func__, vhd->browsers.count);
+
+		/* vhd holds a pointer to the active ac and a pointer to the owner (also lives in the ac) */
+
+		// lwsl_notice("%s: updated sai builder list\n", __func__);
 		if (vhd->builders)
 			lwsac_detach(&vhd->builders);
+
+		/* we take over ownership of the ac */
+
 		vhd->builders = m->a.ac;
 		m->a.ac = NULL;
-		vhd->builders_owner =
-				&((sai_plat_owner_t *)m->a.dest)->plat_owner;
+		vhd->builders_owner = &((sai_plat_owner_t *)m->a.dest)->plat_owner;
+		if (lwsac_assert_valid(vhd->builders, vhd->builders_owner, sizeof(lws_dll2_owner_t)))
+			break;
 		saiw_ws_broadcast_raw(vhd, buf, len, 0,
 				      lws_write_ws_flags(LWS_WRITE_TEXT, flags & LWSSS_FLAG_SOM, flags & LWSSS_FLAG_EOM));
 		break;
@@ -156,8 +166,8 @@ saiw_lp_rx(void *userobj, const uint8_t *buf, size_t len, int flags)
 		break;
 	}
 
-	if (flags & LWSSS_FLAG_EOM)
-		lwsac_free(&m->a.ac);
+//	if (flags & LWSSS_FLAG_EOM && m->deprecated)
+//		lwsac_free(&m->deprecated);
 
 	return 0;
 }
diff --git a/src/web/w-ws-browser.c b/src/web/w-ws-browser.c
index 46f05d6..63fc4b2 100644
--- a/src/web/w-ws-browser.c
+++ b/src/web/w-ws-browser.c
@@ -54,8 +54,7 @@ saiw_ws_broadcast_raw(struct vhd *vhd, const void *buf, size_t len, unsigned int
 		}
 	} lws_end_foreach_dll(p);
 
-	lwsl_notice("%s: broadcast to %d / %d browsers\n", __func__,
-		        eff, (int)vhd->browsers.count);	
+	// lwsl_notice("%s: broadcast to %d / %d browsers\n", __func__, eff, (int)vhd->browsers.count);	
 }
 
 extern const lws_struct_map_t lsm_load_report_members[2]; 
@@ -1033,7 +1032,20 @@ so_finish:
 		if (vhd && vhd->builders) {
 			lwsac_reference(vhd->builders);
 			sch->walk = lws_dll2_get_head(vhd->builders_owner);
+
+			/* builders_owner must be inside vhd->builders ac */
+			if (lwsac_assert_valid(vhd->builders, vhd->builders_owner, sizeof(lws_dll2_owner_t)))
+				break;
+			/* HEAD of the owner list must be also inside the vhd->builders ac */
+			if (sch->walk && lwsac_assert_valid(vhd->builders, sch->walk, sizeof(sai_plat_t)))
+				break;
+		} else {
+			lwsl_notice("%s: BUILDER_SUMMARY: can't start walk\n", __func__);
+			sch->walk = 0;
 		}
+
+//		sch->walk = 0;
+
 		sch->subsequent = 0;
 		pss->send_state = WSS_SEND_BUILDER_SUMMARY;
 		first = 1;
@@ -1053,12 +1065,20 @@ so_finish:
 		 * builders / platforms we feel are connected to us
 		 */
 
+		lwsl_notice("%s: WSS_SEND_BUILDER_SUMMARY outside write loop, walk %p\n", __func__, sch->walk);
+
 		while (end - p > 512 && sch->walk &&
 		       pss->send_state == WSS_SEND_BUILDER_SUMMARY) {
 
+			/* every builder must be also inside the vhd->builders ac */
+			if (lwsac_assert_valid(vhd->builders, sch->walk, sizeof(sai_plat_t)))
+				break;
+
 			sai_plat_t *b = lws_container_of(sch->walk, sai_plat_t,
 						     sai_plat_list);
 
+			lwsl_notice("%s: serializing inside %s\n", __func__, b->name);
+
 			js = lws_struct_json_serialize_create(
 				lsm_schema_map_plat_simple,
 				LWS_ARRAY_SIZE(lsm_schema_map_plat_simple),