Good ideas, Halls... but (you knew there had to be a 'but' coming, right?

)
1 - PvP: Since this game has travel - when you logged in and saw "X" had attacked you, he might be on the other side of the world by then, so retaliating would be difficult. I guess if there was no consequence to being killed (no item/money loss, and no experience loss) it might not be so bad to do it that way, but you'd log in to a corpse that you'd have to deal with
2 - PvE: my game has no experience, it's fully skill-based. So that method wouldn't work, but I see what you are saying - make some penalty once combat starts that is removed when combat concludes... interesting idea. I'll have to give that some thought.
Since the first post, I've been giving this some thought, and based on what others have posted, here's what I have come up with so far.
PvP: The only time you see other players is when you are in the same location as they are, and you are both active ('active' means you have done a page refresh/load in the last 15 minutes). If you AFK longer than 15 minutes, you no longer show as active and aren't listed as being in a location. If you close your browser without logging out, or go AFK, and you are within your 15 minute activity window, you are fair game to be attacked by the opposite faction. If you want to be safe after you logout, I could make the logout button do a "camp" procedure. This button logs you out of the world relatively safely, so you are only vulnerable for 10-15 seconds, instead of 15 minutes. But you can't log back in for 15 minutes, to prevent getting out of combat easily and logging right back in. Once you're attacked, combat runs until one of you is dead, or the attacker flees. Is there any way to let the victim flee? Maybe have an AI routine try to let them escape at near-death?
PvE: Since you are initiating combat, turn-based is much easier, but I still have the problem of multiple people fighting the same creature. Not sure how to handle that yet.