@byollm/relay 0.1.0-alpha.26 → 0.1.0-alpha.28

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.26`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.28`) — under active development. Don't use this yet.**
 >
 > This is a walking skeleton. It routes real jobs between real daemons and real
 > sites, and it is the fixture byollm_009 freezes against — but it keeps its
@@ -72,7 +72,7 @@
 > packages published and `@byollm/server` did not: a Sigstore
 > transparency-log 409 on its provenance attestation. The workflow's
 > "already published" guard correctly refuses to resume a partial publish,
-> so `0.1.0-alpha.26` is that release, whole.
+> so `0.1.0-alpha.28` is that release, whole.
 >
 > If you run the Supabase adapter, `alpha.21` needs
 > `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's
@@ -153,7 +153,7 @@ daemons pin at pairing, verified against the `sites` half of the projection.
 Nothing here trusts a `siteId` in a body or a query string.
 
 That is newer than the rest of this package. The site plane took the caller's
-word for who it was until `0.1.0-alpha.26`, which on a relay reachable from the
+word for who it was until `0.1.0-alpha.28`, which on a relay reachable from the
 internet is an open enqueue endpoint into consenting users' machines and an
 open read of who is online. It was blind the whole time — nothing could open a
 payload — and blind is not the same as safe.
@@ -161,7 +161,7 @@ payload — and blind is not the same as safe.
 If you are running this: the site plane is authenticated but this is still a
 single-tenant relay with in-memory state. One site, one replica.
 
-## Breaking in `0.1.0-alpha.26`: `RelayState` is async
+## Breaking in `0.1.0-alpha.28`: `RelayState` is async
 
 Every method on `RelayState` now returns a `Promise`, and `Relay.sweep()` and
 `debugPage()` with it. `RelayState.requeue` is private — it was only ever a

package/dist/{chunk-ZH2GB6FY.js → chunk-WQYO6NFP.js}

@@ -49,14 +49,24 @@ var RelayState = class {
    * The exact grant first, and **checked against the job the caller named**:
    * a lease id belonging to another job would otherwise hand over that job's
    * payload to somebody holding a valid-looking grant. Then the same job held
-   * by this runner under an older grant, which is what `stale-lease` is. Then
-   * any job with that id, which is what `not-holder` is.
+   * by this runner under an older grant, which is what `stale-lease` is.
+   *
+   * And then nothing — V1-8. There used to be a third step: any job with that
+   * id, which produced `not-holder` where an absent job produces `not-found`.
+   * Since job ids are chosen per site, a runner could name a bare id it had
+   * no relationship with and learn from the status code whether some *other*
+   * tenant had a job by that name. Finding 58's existence oracle, through the
+   * holder door.
+   *
+   * The distinction it bought was never acted on: a daemon abandons the work
+   * either way. So a caller now learns about jobs it holds or held, and about
+   * nothing else.
    */
   #grantFor(jobId, runnerId, leaseId) {
     const exact = this.#byLease.get(leaseId);
     if (exact?.id === jobId) return exact;
     const candidates = this.#byJobId.get(jobId) ?? [];
-    return candidates.find((job) => job.claimedBy?.runnerId === runnerId) ?? candidates[0];
+    return candidates.find((job) => job.claimedBy?.runnerId === runnerId);
   }
   #index(job) {
     const bare = this.#byJobId.get(job.id);
@@ -197,6 +207,9 @@ var RelayState = class {
       return Promise.resolve({ refused: "stale-lease" });
     }
     if (!job.payload) return Promise.resolve({ refused: "not-ready" });
+    if (job.state !== "ready" && job.state !== "running") {
+      return Promise.resolve({ refused: "terminal" });
+    }
     job.state = "running";
     return Promise.resolve({ envelope: job.payload });
   }
@@ -273,7 +286,10 @@ var RelayState = class {
     return Promise.resolve(
       [...this.#jobs.values()].filter(
         (job) => job.cancelled === true && job.claimedBy?.runnerId === runnerId
-      ).map((job) => job.id)
+      ).map((job) => ({
+        jobId: job.id,
+        leaseId: job.claimedBy?.leaseId ?? ""
+      })).filter((grant) => grant.leaseId !== "")
     );
   }
   /** {@link RoutingStore.renewLeases} — extend what is still held, name what is not. */
@@ -285,7 +301,7 @@ var RelayState = class {
       const job = this.#grantFor(jobId, input.runnerId, leaseId);
       const held = job?.claimedBy;
       if (!job || held?.leaseId !== leaseId || held.runnerId !== input.runnerId) {
-        lost.push(jobId);
+        lost.push({ jobId, leaseId });
         continue;
       }
       const expiresAt = now + input.leaseMs;
@@ -361,4 +377,4 @@ export {
   routeKey,
   RelayState
 };
-//# sourceMappingURL=chunk-ZH2GB6FY.js.map
+//# sourceMappingURL=chunk-WQYO6NFP.js.map

package/dist/chunk-WQYO6NFP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/state.ts"],"sourcesContent":["import type {\n  ClaimedStub,\n  JobStub,\n  PublicIdentity,\n  SealedEnvelope,\n} from \"@byollm/protocol\";\nimport { randomUUID } from \"node:crypto\";\nimport type { Grant, RoutingStore } from \"./store.js\";\n\n/**\n * The relay's routing state — byollm_009 §7, reachable at last.\n *\n * §7 described a state machine the direct plane could not produce. There, the\n * site and the upstream are the same party: it seals when it likes, and a job\n * is never claimed-but-unsealed. Here they are different parties, and the gap\n * between them is a state:\n *\n * ```\n * queued ──claim──▶ awaiting-payload ──sealed──▶ ready ──fetch──▶ running\n *    ▲                    │                                          │\n *    └────────────────────┘                                          ▼\n *      site never seals, or seals too late              ok | error | canceled\n * ```\n *\n * The relay cannot seal, so it cannot shortcut this. A payload is encrypted\n * to *the device that claimed it*, and nobody knows which device that is until\n * the claim happens — which is precisely why claim-then-fetch makes a blind\n * relay possible at all. The window is the price.\n *\n * ## What the relay holds, and what it cannot\n *\n * Stubs (metadata the site chose to publish), sealed envelopes it cannot open,\n * and public keys. There is no field on any type in this file that could hold\n * a private key or a plaintext, which is `RELAY_BLIND` expressed as a data\n * model rather than as a policy.\n */\n\n/** Where a routed job is. */\nexport type RoutedState =\n  \"queued\" | \"awaiting-payload\" | \"ready\" | \"running\" | \"done\";\n\n/**\n * How long a site has to seal after one of its jobs is claimed.\n *\n * **Distinct from the lease, and distinct from the job's TTL** — byollm_009\n * §7.1. Three clocks, three different questions:\n *\n * - the **TTL** asks how long the work is worth doing at all;\n * - the **lease** asks how long this device gets to run it;\n * - this asks how long we wait for a site that has gone away.\n *\n * Collapsing any pair of them looks harmless until a site restarts during a\n * deploy: with only a lease, the device sits politely holding a job whose\n * payload will never arrive, and the lease's whole minute is spent waiting on\n * a party that is not coming back. Short, because a site that is up answers in\n * milliseconds and a site that is down will not answer sooner for waiting.\n */\nexport const AWAITING_PAYLOAD_MS = 10_000;\n\n/** A job the relay is routing. Metadata and ciphertext, nothing else. */\n/** Why a daemon gave a job back. Only `refused` means \"not me, ever\". */\nexport type ReleaseReason =\n  \"shutdown\" | \"pause\" | \"revoked\" | \"backend-down\" | \"refused\";\n\nexport interface RoutedJob {\n  readonly id: string;\n  /** Which site enqueued it — the party that will be asked to seal. */\n  readonly siteId: string;\n  /**\n   * Everything the relay knows about the work, which is everything the site\n   * chose to publish and not one field more (byollm_009 §6).\n   */\n  readonly stub: JobStub;\n  state: RoutedState;\n  /** Set from the claim; the site seals to these keys. */\n  claimedBy?: {\n    readonly runnerId: string;\n    readonly owner: string;\n    readonly device: PublicIdentity;\n    readonly leaseId: string;\n    readonly leaseExpiresAt: number;\n  };\n  /** When {@link AWAITING_PAYLOAD_MS} runs out for this claim. */\n  awaitingUntil?: number;\n  /**\n   * Runners that released this job with reason `refused` — cloud_008 §2.1.\n   *\n   * `REFUSAL_NOT_REOFFERED`, which the relay did not implement: it dropped\n   * `ReleaseRequest.reason` on the floor. The field's own docstring says why\n   * that is not cosmetic — an upstream cannot evaluate a daemon's *local*\n   * `named` allowlist, so it may legitimately offer work the daemon then\n   * declines, and without a record the two spin between claim and release\n   * forever. The direct plane has always kept this list.\n   */\n  refusedBy: string[];\n  /**\n   * The site withdrew this job — cloud_008 §2.2.\n   *\n   * A flag rather than a state, because a cancelled job that a device is\n   * *running* is not finished: the daemon has to be told, abort its backend\n   * call and report `canceled`, and the ordinary `complete` path then closes\n   * it. Making it a state would strand the in-flight case between two\n   * machines' ideas of what happened.\n   */\n  cancelled?: boolean;\n  /** Sealed to the claiming device by the site. Opaque here. */\n  payload?: SealedEnvelope;\n  /** Sealed to the site by the device. Opaque here. */\n  result?: SealedEnvelope;\n  /**\n   * The result's clear-text discriminator — byollm_009 §6.1.\n   *\n   * The one outcome fact the relay is given, and the reason it is given:\n   * without it the relay cannot stop dispatching a finished job. A routing\n   * hint and never a fact — the *site* verifies it against the sealed\n   * outcome, because only the site can open the envelope. The relay acts on\n   * it and is entitled to be wrong; a lying daemon costs it a dispatch\n   * decision, not a security property.\n   */\n  disposition?: \"ok\" | \"error\" | \"canceled\";\n}\n\n/** A device the relay has seen recently. */\nexport interface Presence {\n  readonly runnerId: string;\n  readonly owner: string;\n  readonly device: PublicIdentity;\n  lastSeenAt: number;\n  // `revoked` is deliberately absent — cloud_008 §2.3.\n  //\n  // It was a boolean on the *runner*, written at heartbeat and read by\n  // nothing but the debug page. Enforcement had already moved to the\n  // projection, because enforcing on this flag made revocation depend on the\n  // client calling an endpoint: a daemon that simply never heartbeat went on\n  // claiming forever. What survived was the cache, which is a stored copy of\n  // a derived fact — this project's most-repeated bug, kept alive here as a\n  // display value.\n  //\n  // It is also a concept multi-tenancy cannot express. Revocation is a fact\n  // about an (owner, site) pair; a daemon serving two sites and revoked at\n  // one is not \"a revoked runner\", and a boolean on the device has nowhere to\n  // put the difference. Deleting it now is what stops cloud_009 inheriting a\n  // field it would have to contradict.\n}\n\n/**\n * What a routing store must do, expressed as operations — cloud_006 §3.2.\n *\n * Every method below is a **decision plus its write**, never a read the caller\n * follows with a mutation. That is the whole point, and it is the difference\n * between an interface a shared store can implement and one it cannot.\n *\n * `claim` is the specimen. It used to live in `DaemonPlane` as\n * `jobs()` → filter → mutate, which is atomic for exactly one reason: Node is\n * single-threaded and these Maps are local, so nothing runs between the read\n * and the write. Neither survives a store on a network, and\n * `packages/relay/test/two-replicas.test.ts` holds the resulting race as a\n * failing assertion.\n *\n * So the rule for anything added here: **if a caller has to read, decide, and\n * write back, the operation is in the wrong place.** Move the decision in.\n *\n * ## Why the projection does not come with it\n *\n * `claim` takes `owners: string[]` rather than a projection or a predicate.\n * A closure cannot travel to Valkey, and the projection replicates for free\n * from the control plane — so the caller collapses it with\n * `Projection.ownersRunnableBy` and hands over data the store can match on.\n * That keeps the store ignorant of consent, which is also what keeps it\n * replaceable.\n */\nexport interface ClaimInput {\n  readonly runnerId: string;\n  readonly owner: string;\n  readonly device: PublicIdentity;\n  /**\n   * The (site, owner) pairs this device may run work for — cloud_009 §3.\n   *\n   * **One set of pairs, not a set of sites and a set of owners.** Consent\n   * binds a user to a site, so the two cannot travel separately: a device\n   * whose owner consented to site A, serving a roster member who consented\n   * to site B, would have every element of both sets and no consented route\n   * between them. Two sets multiply; consent does not.\n   *\n   * Built by {@link Projection.routesFor} and matched with {@link routeKey},\n   * so the relay and a store in another repository agree on the encoding by\n   * calling the same function rather than by both spelling it out.\n   *\n   * This is the collapse that lets a claim stay one operation: a predicate\n   * cannot travel to a store over a network, and a set can.\n   */\n  readonly routes: ReadonlySet<string>;\n  readonly kinds: ReadonlySet<string>;\n  readonly max: number;\n  readonly leaseMs: number;\n}\n\n/**\n * How a (site, owner) route is written, so two implementations agree.\n *\n * The same `\\u0000` the job key uses, for the same reason: it cannot appear\n * in a site id or an owner id, so this is a key rather than a parser.\n */\nexport const routeKey = (siteId: string, owner: string): string =>\n  `${siteId}\\u0000${owner}`;\n\n/**\n * Where the store's sense of time comes from — cloud_006 §3.4.\n *\n * **The store owns its clock; callers do not pass one.** Every deadline the\n * relay decides — a lease's expiry, the `awaiting-payload` window, what a\n * sweep considers due — is now stamped by one source, and it is the same\n * source that will later stamp them for every replica.\n *\n * It used to be a parameter. `claim` took `now`, `sweep` took `now`, and each\n * plane called its own `now()` before calling in — which is fine in one\n * process and is the recurring bug the moment there are two. A lease granted\n * by a pod whose clock runs fast is short; the same lease swept by a pod whose\n * clock runs slow outlives it. Nobody is wrong and the lease has no length.\n *\n * A Valkey-backed store returns `TIME` here, so the deadline and the sweep\n * that enforces it are read from the same server. The injected clock stays for\n * tests, which is what lets them move time instead of sleeping.\n *\n * **What deliberately does not use this**: request-signature freshness. That\n * is checked against the *local* clock on purpose — it is a question about the\n * caller's clock versus this process's, `MAX_CLOCK_SKEW_MS` already tolerates\n * two minutes of disagreement, and a network round trip to timestamp every\n * inbound request would be a cost with no property behind it.\n */\nexport interface RelayStateOptions {\n  readonly now?: () => number | Promise<number>;\n}\n\n/** Why a lease-scoped operation was refused, in the caller's vocabulary. */\nexport type HolderRefusal =\n  | \"not-found\"\n  | \"not-holder\"\n  | \"stale-lease\"\n  | \"not-ready\"\n  /** The job already ended — V1-6. A replay must not reopen it. */\n  | \"terminal\";\n\n/**\n * In-memory routing state.\n *\n * Deliberately not durable. The skeleton proves the protocol, and the\n * production hub replaces this with the closed multi-tenant router behind the\n * same shape (cloud_004 §9). Anything a restart loses here is a job that\n * returns to its site's queue — which is the behaviour a lapsed lease already\n * has to produce, so nothing new needs to be true for this to be safe.\n */\n/**\n * A job's key: the site that published it, and the id that site chose.\n *\n * `\\u0000` cannot appear in either half, so this is a key rather than a\n * parser — cloud_009 §3, and the reason the Valkey layout uses a distinct\n * prefix rather than a suffix on the old one.\n */\nconst keyOf = (siteId: string, jobId: string): string =>\n  `${siteId}\\u0000${jobId}`;\n\nexport class RelayState implements RoutingStore {\n  /**\n   * Jobs by **(site, id)** — cloud_009 §3.\n   *\n   * A job id is a site's to choose, so two sites can choose the same one.\n   * Keyed by the bare id, the second site's enqueue returned the first\n   * site's job (cloud_008 finding 58), and the refusal that fixed it was a\n   * cross-tenant existence oracle. Keyed by the pair, the collision does not\n   * exist and there is nothing to refuse.\n   *\n   * `\\u0000` as the separator, because a site id is a uuid and a job id is\n   * whatever a site chose — including, one day, a string with a colon in it.\n   * A separator that cannot appear in either half is the difference between\n   * a key and a parser.\n   */\n  readonly #jobs = new Map<string, RoutedJob>();\n\n  /**\n   * Grants by lease id, so a holder-scoped call needs no site — §3.\n   *\n   * `takePayload`, `complete`, `releaseLeases` and `renewLeases` carry a\n   * `leaseId` the relay minted, which is unique across every site. That is\n   * what lets those four signatures stay as they are: the caller names the\n   * grant, and the grant names the job. A daemon never has to know a site id\n   * to answer for work it holds.\n   */\n  readonly #byLease = new Map<string, RoutedJob>();\n\n  /**\n   * Jobs by bare id, across sites — the refusal path.\n   *\n   * The lease index alone answers the happy case and gets the refusals\n   * wrong: a **stale** lease finds nothing, so `LEASE_HONORED`'s \"your grant\n   * ended\" becomes \"no such job\", and a daemon that was slow is told\n   * something untrue about the work it was doing. Distinguishing\n   * `not-found`, `not-holder` and `stale-lease` needs the job even when the\n   * lease named is over, and that is what this is for.\n   *\n   * A list rather than a single value: two sites may choose one id, which is\n   * the whole reason `#jobs` is keyed by the pair.\n   */\n  readonly #byJobId = new Map<string, RoutedJob[]>();\n\n  /**\n   * The job a holder-scoped call is about, without a site id.\n   *\n   * The exact grant first, and **checked against the job the caller named**:\n   * a lease id belonging to another job would otherwise hand over that job's\n   * payload to somebody holding a valid-looking grant. Then the same job held\n   * by this runner under an older grant, which is what `stale-lease` is.\n   *\n   * And then nothing — V1-8. There used to be a third step: any job with that\n   * id, which produced `not-holder` where an absent job produces `not-found`.\n   * Since job ids are chosen per site, a runner could name a bare id it had\n   * no relationship with and learn from the status code whether some *other*\n   * tenant had a job by that name. Finding 58's existence oracle, through the\n   * holder door.\n   *\n   * The distinction it bought was never acted on: a daemon abandons the work\n   * either way. So a caller now learns about jobs it holds or held, and about\n   * nothing else.\n   */\n  #grantFor(\n    jobId: string,\n    runnerId: string,\n    leaseId: string,\n  ): RoutedJob | undefined {\n    const exact = this.#byLease.get(leaseId);\n    if (exact?.id === jobId) return exact;\n    const candidates = this.#byJobId.get(jobId) ?? [];\n    return candidates.find((job) => job.claimedBy?.runnerId === runnerId);\n  }\n\n  #index(job: RoutedJob): void {\n    const bare = this.#byJobId.get(job.id);\n    if (bare) {\n      if (!bare.includes(job)) bare.push(job);\n    } else {\n      this.#byJobId.set(job.id, [job]);\n    }\n  }\n\n  #forget(job: RoutedJob): void {\n    this.#jobs.delete(keyOf(job.siteId, job.id));\n    const bare = (this.#byJobId.get(job.id) ?? []).filter((it) => it !== job);\n    if (bare.length === 0) this.#byJobId.delete(job.id);\n    else this.#byJobId.set(job.id, bare);\n    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);\n  }\n  readonly #presence = new Map<string, Presence>();\n  readonly #now: () => number | Promise<number>;\n\n  constructor(options: RelayStateOptions = {}) {\n    this.#now = options.now ?? Date.now;\n  }\n\n  /** The one clock every deadline in this store is stamped from. */\n  async now(): Promise<number> {\n    return this.#now();\n  }\n\n  /**\n   * Take a stub for routing. The payload is not here and will not be.\n   *\n   * **Idempotent by job id, and that is a security property rather than a\n   * convenience.** Site-plane calls are authenticated by signature, and\n   * byollm_009 §4.2's argument for signing the request instead of a\n   * server-issued nonce rests entirely on every write being idempotent per the\n   * instance it names. This one was not: re-enqueueing a known id built a\n   * fresh `queued` job over the top of the old one, discarding a live claim,\n   * its lease and any payload the site had already sealed to a device. A\n   * replayed enqueue inside the two-minute freshness window was therefore a\n   * way to yank a job back from the machine running it — the `release` bug of\n   * §4.2, rediscovered on the other plane.\n   *\n   * So a known id returns what is already routing, unchanged. A site that\n   * restarts and republishes its queue is the normal case, and it must not\n   * disturb work in flight.\n   */\n  enqueue(input: {\n    id: string;\n    siteId: string;\n    stub: JobStub;\n  }): Promise<RoutedJob> {\n    // Idempotent by (site, id). The refusal that used to live here went with\n    // the collision it refused — cloud_009 §3.\n    const existing = this.#jobs.get(keyOf(input.siteId, input.id));\n    if (existing) return Promise.resolve(existing);\n    const job: RoutedJob = {\n      id: input.id,\n      siteId: input.siteId,\n      stub: input.stub,\n      state: \"queued\",\n      refusedBy: [],\n    };\n    this.#jobs.set(keyOf(job.siteId, job.id), job);\n    this.#index(job);\n    return Promise.resolve(job);\n  }\n\n  job(siteId: string, jobId: string): Promise<RoutedJob | undefined> {\n    return Promise.resolve(this.#jobs.get(keyOf(siteId, jobId)));\n  }\n\n  jobs(): Promise<RoutedJob[]> {\n    return Promise.resolve([...this.#jobs.values()]);\n  }\n\n  /** Jobs a site must seal for, right now. */\n  async awaiting(siteId: string): Promise<RoutedJob[]> {\n    return (await this.jobs()).filter(\n      (j) => j.siteId === siteId && j.state === \"awaiting-payload\",\n    );\n  }\n\n  /** Sealed results waiting to go home. */\n  async finished(siteId: string): Promise<RoutedJob[]> {\n    return (await this.jobs()).filter(\n      (j) =>\n        j.siteId === siteId && j.state === \"done\" && j.result !== undefined,\n    );\n  }\n\n  /**\n   * Claim work — one operation, because it has to be.\n   *\n   * Moved here wholesale from `DaemonPlane`, where it was a scan followed by\n   * per-job mutation. Nothing about the *decision* changed; what changed is\n   * that a store can now implement it, because the filter and the write are\n   * one call rather than a loop the caller drives.\n   *\n   * The order of the guards is worth preserving as-is when this becomes a Lua\n   * script: cheapest first, and `owners` last because it is the only one that\n   * needed the projection.\n   */\n  async claim(input: ClaimInput): Promise<ClaimedStub[]> {\n    const now = await this.now();\n    await this.sweep();\n\n    const granted: ClaimedStub[] = [];\n    for (const job of this.#jobs.values()) {\n      if (granted.length >= input.max) break;\n      if (job.state !== \"queued\") continue;\n      // The route, as one lookup, because consent is about the pair — a\n      // device whose owner consented to site A, serving a roster member who\n      // consented to site B, is in both a set of sites and a set of owners\n      // and has no consented route between them.\n      if (!input.routes.has(routeKey(job.siteId, job.stub.owner))) continue;\n      if (!input.kinds.has(job.stub.kind)) continue;\n      // Already declined by this device — `REFUSAL_NOT_REOFFERED`, §2.1.\n      if (job.refusedBy.includes(input.runnerId)) continue;\n      // Withdrawn by the site — §2.2. Cheap, and before every other check.\n      if (job.cancelled) continue;\n      // The relay's half of AUDIENCE_BOTH_SIDES. The daemon re-checks its own\n      // allowlist and may still refuse — this only ever narrows.\n\n      // `self` means the owner's own machines, and the route set cannot\n      // express that — cloud_008 §2.1.\n      //\n      // The routes are every (site, owner) this device may run for, which for\n      // a Team owner's machine includes every roster member. Correct for\n      // `public` and `named`, and wrong for\n      // `self`: a roster member's private job was offered to the owner's\n      // daemon, which refused it locally and released it, and the relay\n      // offered it straight back. The ping-pong was the visible symptom; the\n      // invisible one is that `self` — the audience a user picks *because*\n      // they want their own machine — was the audience the relay ignored.\n      if (job.stub.audience === \"self\" && job.stub.owner !== input.owner) {\n        continue;\n      }\n\n      // A UUID, not a readable composite. The direct plane's lease ids are\n      // UUIDs and the Supabase adapter's `lease_id` column is typed `uuid`, so\n      // a relay minting `lease_<job>_<time>` would route perfectly against a\n      // memory store and fail the moment a real site adopted the lease.\n      const leaseId = randomUUID();\n      job.state = \"awaiting-payload\";\n      job.claimedBy = {\n        runnerId: input.runnerId,\n        owner: input.owner,\n        device: input.device,\n        leaseId,\n        leaseExpiresAt: now + input.leaseMs,\n      };\n      // Not the lease: this bounds how long we wait for a *site*, not how long\n      // the device may work. byollm_009 §7.1's third clock.\n      job.awaitingUntil = now + AWAITING_PAYLOAD_MS;\n      // The grant is findable by its own id, which is how a holder-scoped\n      // call needs no site — cloud_009 §3.\n      this.#byLease.set(leaseId, job);\n\n      granted.push({\n        ...job.stub,\n        lease: {\n          id: leaseId,\n          runnerId: input.runnerId,\n          expiresAt: job.claimedBy.leaseExpiresAt,\n        },\n      });\n    }\n    return granted;\n  }\n\n  /**\n   * Hand over the sealed payload to the device that holds the lease.\n   *\n   * The read and the state transition are one operation for the same reason\n   * `claim` is: `running` must be set by whoever was told the envelope, or two\n   * replicas can both hand out the same work and both believe they were first.\n   */\n  takePayload(input: {\n    jobId: string;\n    runnerId: string;\n    leaseId: string;\n  }): Promise<{ envelope: SealedEnvelope } | { refused: HolderRefusal }> {\n    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);\n    if (!job) return Promise.resolve({ refused: \"not-found\" });\n    if (job.claimedBy?.runnerId !== input.runnerId) {\n      return Promise.resolve({ refused: \"not-holder\" });\n    }\n    // LEASE_HONORED per *instance*: a stale lease id names a grant that is\n    // over, and answering it would hand work to a previous holder.\n    if (job.claimedBy.leaseId !== input.leaseId) {\n      return Promise.resolve({ refused: \"stale-lease\" });\n    }\n    if (!job.payload) return Promise.resolve({ refused: \"not-ready\" });\n    // Only a job that is still running gets handed its payload — V1-6.\n    //\n    // The holder and lease checks pass for a job this runner finished\n    // moments ago, because completing does not end the grant. A replayed\n    // fetch then set `state = 'running'` on a **done** job: `finished()`\n    // stopped returning its result to the site, and the sweep requeued\n    // completed work as though the device had died holding it. A duplicate\n    // request undoing a finished job is the shape `RESULT_IDEMPOTENT` exists\n    // to forbid, arriving through the other door.\n    if (job.state !== \"ready\" && job.state !== \"running\") {\n      return Promise.resolve({ refused: \"terminal\" });\n    }\n    job.state = \"running\";\n    return Promise.resolve({ envelope: job.payload });\n  }\n\n  /**\n   * Record a finished job.\n   *\n   * `RESULT_IDEMPOTENT` lives here rather than in the caller: a replayed\n   * result must be a no-op decided by the same operation that would have\n   * written it, or two replicas can both decide they were the first.\n   */\n  complete(input: {\n    jobId: string;\n    runnerId: string;\n    leaseId: string;\n    envelope: SealedEnvelope;\n    disposition: \"ok\" | \"error\" | \"canceled\";\n  }): Promise<\n    | { accepted: boolean; duplicate?: boolean; state: RoutedState }\n    | { refused: HolderRefusal }\n  > {\n    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);\n    if (!job) return Promise.resolve({ refused: \"not-found\" });\n    if (job.claimedBy?.runnerId !== input.runnerId) {\n      return Promise.resolve({ refused: \"not-holder\" });\n    }\n    // Terminal before holder — cloud_008 §3.6, and the same order in all four\n    // stores.\n    //\n    // This file argued the opposite two days ago: that a result under a grant\n    // that ended is a different device's work arriving late rather than a\n    // replay, so the lease check should win. That is right for a job which is\n    // **not** terminal, and the two orders only ever disagree about a *done*\n    // job asked about under a stale grant — where \"already recorded\" is the\n    // more useful of two true statements, and \"your lease is stale\" invents a\n    // worry about an answer that is safely stored.\n    //\n    // The deciding argument is not comfort. byollm_009 §4's case for signing\n    // requests rather than issuing nonces rests on every write being\n    // idempotent per the instance it names, and on the direct plane\n    // `RESULT_IDEMPOTENT` was holding only because `complete` nulls the lease\n    // and the holder check tripped first. A MUST another MUST's security\n    // argument leans on cannot hold by coincidence.\n    //\n    // Scoped to the device that finished it: anyone else falls through to the\n    // holder check and gets the refusal they would get for a job that is not\n    // terminal, so a job id is not a terminality probe.\n    if (job.state === \"done\") {\n      const sameGrant = job.claimedBy.leaseId === input.leaseId;\n      return Promise.resolve(\n        sameGrant\n          ? { accepted: false, duplicate: true, state: job.state }\n          : { refused: \"stale-lease\" },\n      );\n    }\n    // LEASE_HONORED per instance — cloud_008 §1.4a.\n    if (job.claimedBy.leaseId !== input.leaseId) {\n      return Promise.resolve({ refused: \"stale-lease\" });\n    }\n    job.result = input.envelope;\n    job.disposition = input.disposition;\n    job.state = \"done\";\n    return Promise.resolve({ accepted: true, state: job.state });\n  }\n\n  /** Give back leases this runner holds, naming each grant it means. */\n  releaseLeases(input: {\n    runnerId: string;\n    leases: readonly { jobId: string; leaseId: string }[];\n    reason?: ReleaseReason;\n  }): Promise<string[]> {\n    const released: string[] = [];\n    for (const { jobId, leaseId } of input.leases) {\n      // Through the grant, like every other holder-scoped operation — the\n      // caller names a lease and this store no longer keys jobs by a bare id.\n      const job = this.#grantFor(jobId, input.runnerId, leaseId);\n      if (!job || job.claimedBy?.runnerId !== input.runnerId) continue;\n      if (job.claimedBy.leaseId !== leaseId) continue;\n      // Recorded before the requeue, so the job goes back to the queue\n      // already knowing not to come back here. A daemon releasing for\n      // `shutdown` or `backend-down` is saying \"not now\"; `refused` is the\n      // only one that means \"not me, ever\" — the others must stay claimable\n      // by the same device or a restart would strand its own work.\n      if (\n        input.reason === \"refused\" &&\n        !job.refusedBy.includes(input.runnerId)\n      ) {\n        job.refusedBy.push(input.runnerId);\n      }\n      this.#requeue(job);\n      released.push(jobId);\n    }\n    return Promise.resolve(released);\n  }\n\n  /**\n   * Take a site's sealed payload for a claimed job.\n   *\n   * Refuses anything not `awaiting-payload`, which is what makes the timeout\n   * mean something: a late seal must not land on a claim that has moved.\n   */\n  seal(input: {\n    jobId: string;\n    siteId: string;\n    envelope: SealedEnvelope;\n  }): Promise<\n    | { state: RoutedState }\n    | { refused: \"not-found\" | \"too-late\"; was?: RoutedState }\n  > {\n    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));\n    if (job?.siteId !== input.siteId) {\n      return Promise.resolve({ refused: \"not-found\" });\n    }\n    if (job.state !== \"awaiting-payload\") {\n      return Promise.resolve({ refused: \"too-late\", was: job.state });\n    }\n    job.payload = input.envelope;\n    job.state = \"ready\";\n    delete job.awaitingUntil;\n    return Promise.resolve({ state: job.state });\n  }\n\n  /** {@link RoutingStore.cancel} — the site withdraws a job. */\n  cancel(input: { jobId: string; siteId: string }): Promise<boolean> {\n    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));\n    // Scoped to the caller's site for the same reason every other site-plane\n    // operation is: a site must not be able to cancel somebody else's work by\n    // guessing an id.\n    if (job?.siteId !== input.siteId) return Promise.resolve(false);\n    job.cancelled = true;\n    // Not deleted, and not requeued. If a device holds it, that device has to\n    // hear about it — which is what `cancelRequests` below is for.\n    return Promise.resolve(true);\n  }\n\n  /** {@link RoutingStore.cancelRequests} — cancelled jobs this runner holds. */\n  cancelRequests(runnerId: string): Promise<Grant[]> {\n    return Promise.resolve(\n      [...this.#jobs.values()]\n        .filter(\n          (job) =>\n            job.cancelled === true && job.claimedBy?.runnerId === runnerId,\n        )\n        // The grant, not the id — V1-3. Two sites may have chosen the same\n        // job id, and a daemon holding both cannot tell which of them a bare\n        // id means.\n        .map((job) => ({\n          jobId: job.id,\n          leaseId: job.claimedBy?.leaseId ?? \"\",\n        }))\n        .filter((grant) => grant.leaseId !== \"\"),\n    );\n  }\n\n  /** {@link RoutingStore.renewLeases} — extend what is still held, name what is not. */\n  async renewLeases(input: {\n    runnerId: string;\n    leases: readonly { jobId: string; leaseId: string }[];\n    leaseMs: number;\n  }): Promise<{\n    renewed: { jobId: string; expiresAt: number }[];\n    lost: Grant[];\n  }> {\n    // The store's clock, not the caller's — cloud_006 §3.4. A lease extended\n    // against one replica's `Date.now()` and swept against another's is a\n    // lease with no length.\n    const now = await this.now();\n    const renewed: { jobId: string; expiresAt: number }[] = [];\n    const lost: Grant[] = [];\n\n    for (const { jobId, leaseId } of input.leases) {\n      const job = this.#grantFor(jobId, input.runnerId, leaseId);\n      const held = job?.claimedBy;\n      // The lease id *and* the runner. A lease id is a UUID so the runner\n      // check is belt and braces, but \"this grant, held by you\" is the\n      // sentence every other operation in this file checks, and a renewal is\n      // the one that extends a hold rather than ending it.\n      if (\n        !job ||\n        held?.leaseId !== leaseId ||\n        held.runnerId !== input.runnerId\n      ) {\n        lost.push({ jobId, leaseId });\n        continue;\n      }\n      // Replaced rather than mutated: the grant is a readonly record, which\n      // is what stops any other operation here from quietly extending it.\n      const expiresAt = now + input.leaseMs;\n      job.claimedBy = { ...held, leaseExpiresAt: expiresAt };\n      renewed.push({ jobId, expiresAt });\n    }\n\n    // `awaitingUntil` is deliberately untouched. That clock bounds how long we\n    // wait for a *site* to seal, and a busy device has no bearing on it —\n    // byollm_009 §7.1's third clock stays third.\n    return { renewed, lost };\n  }\n\n  async seen(presence: Omit<Presence, \"lastSeenAt\">): Promise<Presence> {\n    const lastSeenAt = await this.now();\n    const existing = this.#presence.get(presence.runnerId);\n    if (existing) {\n      existing.lastSeenAt = lastSeenAt;\n      return existing;\n    }\n    const fresh: Presence = { ...presence, lastSeenAt };\n    this.#presence.set(presence.runnerId, fresh);\n    return fresh;\n  }\n\n  presence(runnerId: string): Promise<Presence | undefined> {\n    return Promise.resolve(this.#presence.get(runnerId));\n  }\n\n  everyone(): Promise<Presence[]> {\n    return Promise.resolve([...this.#presence.values()]);\n  }\n\n  /**\n   * Return a job to the queue, forgetting the claim.\n   *\n   * The stub survives; nothing is lost. That is `LEASE_RECLAIMABLE` and it is\n   * why the awaiting-payload timeout is cheap to fire: the worst case is that\n   * a device did nothing for ten seconds and another one gets a turn.\n   */\n  #requeue(job: RoutedJob): void {\n    job.state = \"queued\";\n    // The grant ended; the index that names it must end with it, or a stale\n    // lease id resolves to a job it no longer holds.\n    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);\n    delete job.claimedBy;\n    delete job.awaitingUntil;\n    delete job.payload;\n  }\n\n  /**\n   * Fire whatever the clock says is due, and report it.\n   *\n   * Returns the jobs it requeued so a caller can log or surface them — a\n   * timeout that fires invisibly is indistinguishable from a job that was\n   * never claimed, and those want very different debugging.\n   */\n  async sweep(): Promise<RoutedJob[]> {\n    const now = await this.now();\n    const requeued: RoutedJob[] = [];\n    const expired: RoutedJob[] = [];\n    for (const job of this.#jobs.values()) {\n      // Past its deadline — cloud_008 §2.2, and `TTL_EXPIRY` on this plane.\n      //\n      // The relay never read `stub.deadlineAt`. Not \"read it and got the\n      // arithmetic wrong\": the field travelled on every stub, byollm_009 §6\n      // describes it as the bound on how long a ciphertext is worth carrying,\n      // and nothing here ever looked at it. A job whose deadline passed went\n      // on being offered to devices forever, and its sealed payload sat in\n      // the relay for as long as the process lived.\n      //\n      // Dropped rather than marked terminal. The relay is a router and the\n      // site holds the authoritative record; a stub nobody may run is not\n      // routing state, and keeping a tombstone would be keeping the ciphertext\n      // with it. A daemon mid-flight learns through `renewLeases`, which\n      // reports a job the store no longer holds as `lost` — the path that\n      // already exists for a lease that ended.\n      if (job.stub.deadlineAt <= now) {\n        this.#forget(job);\n        expired.push(job);\n        continue;\n      }\n      if (job.state === \"awaiting-payload\" && (job.awaitingUntil ?? 0) <= now) {\n        this.#requeue(job);\n        requeued.push(job);\n      }\n      const lease = job.claimedBy;\n      if (\n        lease &&\n        (job.state === \"ready\" || job.state === \"running\") &&\n        lease.leaseExpiresAt <= now\n      ) {\n        this.#requeue(job);\n        requeued.push(job);\n      }\n    }\n    // Both, because a caller that logs \"requeued\" and never mentions expiry\n    // would report a shrinking queue with no reason for it.\n    return [...requeued, ...expired];\n  }\n}\n"],"mappings":";AAMA,SAAS,kBAAkB;AAmDpB,IAAM,sBAAsB;AAkJ5B,IAAM,WAAW,CAAC,QAAgB,UACvC,GAAG,MAAM,KAAS,KAAK;AAuDzB,IAAM,QAAQ,CAAC,QAAgB,UAC7B,GAAG,MAAM,KAAS,KAAK;AAElB,IAAM,aAAN,MAAyC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAerC,QAAQ,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWnC,WAAW,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAetC,WAAW,oBAAI,IAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBjD,UACE,OACA,UACA,SACuB;AACvB,UAAM,QAAQ,KAAK,SAAS,IAAI,OAAO;AACvC,QAAI,OAAO,OAAO,MAAO,QAAO;AAChC,UAAM,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC;AAChD,WAAO,WAAW,KAAK,CAAC,QAAQ,IAAI,WAAW,aAAa,QAAQ;AAAA,EACtE;AAAA,EAEA,OAAO,KAAsB;AAC3B,UAAM,OAAO,KAAK,SAAS,IAAI,IAAI,EAAE;AACrC,QAAI,MAAM;AACR,UAAI,CAAC,KAAK,SAAS,GAAG,EAAG,MAAK,KAAK,GAAG;AAAA,IACxC,OAAO;AACL,WAAK,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,QAAQ,KAAsB;AAC5B,SAAK,MAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,EAAE,CAAC;AAC3C,UAAM,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,OAAO,GAAG;AACxE,QAAI,KAAK,WAAW,EAAG,MAAK,SAAS,OAAO,IAAI,EAAE;AAAA,QAC7C,MAAK,SAAS,IAAI,IAAI,IAAI,IAAI;AACnC,QAAI,IAAI,UAAW,MAAK,SAAS,OAAO,IAAI,UAAU,OAAO;AAAA,EAC/D;AAAA,EACS,YAAY,oBAAI,IAAsB;AAAA,EACtC;AAAA,EAET,YAAY,UAA6B,CAAC,GAAG;AAC3C,SAAK,OAAO,QAAQ,OAAO,KAAK;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,MAAuB;AAC3B,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAQ,OAIe;AAGrB,UAAM,WAAW,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC;AAC7D,QAAI,SAAU,QAAO,QAAQ,QAAQ,QAAQ;AAC7C,UAAM,MAAiB;AAAA,MACrB,IAAI,MAAM;AAAA,MACV,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,OAAO;AAAA,MACP,WAAW,CAAC;AAAA,IACd;AACA,SAAK,MAAM,IAAI,MAAM,IAAI,QAAQ,IAAI,EAAE,GAAG,GAAG;AAC7C,SAAK,OAAO,GAAG;AACf,WAAO,QAAQ,QAAQ,GAAG;AAAA,EAC5B;AAAA,EAEA,IAAI,QAAgB,OAA+C;AACjE,WAAO,QAAQ,QAAQ,KAAK,MAAM,IAAI,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAC7D;AAAA,EAEA,OAA6B;AAC3B,WAAO,QAAQ,QAAQ,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,CAAC;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,SAAS,QAAsC;AACnD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,MACzB,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,UAAU;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,QAAsC;AACnD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,MACzB,CAAC,MACC,EAAE,WAAW,UAAU,EAAE,UAAU,UAAU,EAAE,WAAW;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,MAAM,OAA2C;AACrD,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,KAAK,MAAM;AAEjB,UAAM,UAAyB,CAAC;AAChC,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AACrC,UAAI,QAAQ,UAAU,MAAM,IAAK;AACjC,UAAI,IAAI,UAAU,SAAU;AAK5B,UAAI,CAAC,MAAM,OAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAG;AAC7D,UAAI,CAAC,MAAM,MAAM,IAAI,IAAI,KAAK,IAAI,EAAG;AAErC,UAAI,IAAI,UAAU,SAAS,MAAM,QAAQ,EAAG;AAE5C,UAAI,IAAI,UAAW;AAenB,UAAI,IAAI,KAAK,aAAa,UAAU,IAAI,KAAK,UAAU,MAAM,OAAO;AAClE;AAAA,MACF;AAMA,YAAM,UAAU,WAAW;AAC3B,UAAI,QAAQ;AACZ,UAAI,YAAY;AAAA,QACd,UAAU,MAAM;AAAA,QAChB,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,QACd;AAAA,QACA,gBAAgB,MAAM,MAAM;AAAA,MAC9B;AAGA,UAAI,gBAAgB,MAAM;AAG1B,WAAK,SAAS,IAAI,SAAS,GAAG;AAE9B,cAAQ,KAAK;AAAA,QACX,GAAG,IAAI;AAAA,QACP,OAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,MAAM;AAAA,UAChB,WAAW,IAAI,UAAU;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,OAI2D;AACrE,UAAM,MAAM,KAAK,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AACrE,QAAI,CAAC,IAAK,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AACzD,QAAI,IAAI,WAAW,aAAa,MAAM,UAAU;AAC9C,aAAO,QAAQ,QAAQ,EAAE,SAAS,aAAa,CAAC;AAAA,IAClD;AAGA,QAAI,IAAI,UAAU,YAAY,MAAM,SAAS;AAC3C,aAAO,QAAQ,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,IACnD;AACA,QAAI,CAAC,IAAI,QAAS,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AAUjE,QAAI,IAAI,UAAU,WAAW,IAAI,UAAU,WAAW;AACpD,aAAO,QAAQ,QAAQ,EAAE,SAAS,WAAW,CAAC;AAAA,IAChD;AACA,QAAI,QAAQ;AACZ,WAAO,QAAQ,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAS,OASP;AACA,UAAM,MAAM,KAAK,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AACrE,QAAI,CAAC,IAAK,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AACzD,QAAI,IAAI,WAAW,aAAa,MAAM,UAAU;AAC9C,aAAO,QAAQ,QAAQ,EAAE,SAAS,aAAa,CAAC;AAAA,IAClD;AAsBA,QAAI,IAAI,UAAU,QAAQ;AACxB,YAAM,YAAY,IAAI,UAAU,YAAY,MAAM;AAClD,aAAO,QAAQ;AAAA,QACb,YACI,EAAE,UAAU,OAAO,WAAW,MAAM,OAAO,IAAI,MAAM,IACrD,EAAE,SAAS,cAAc;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI,IAAI,UAAU,YAAY,MAAM,SAAS;AAC3C,aAAO,QAAQ,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,IACnD;AACA,QAAI,SAAS,MAAM;AACnB,QAAI,cAAc,MAAM;AACxB,QAAI,QAAQ;AACZ,WAAO,QAAQ,QAAQ,EAAE,UAAU,MAAM,OAAO,IAAI,MAAM,CAAC;AAAA,EAC7D;AAAA;AAAA,EAGA,cAAc,OAIQ;AACpB,UAAM,WAAqB,CAAC;AAC5B,eAAW,EAAE,OAAO,QAAQ,KAAK,MAAM,QAAQ;AAG7C,YAAM,MAAM,KAAK,UAAU,OAAO,MAAM,UAAU,OAAO;AACzD,UAAI,CAAC,OAAO,IAAI,WAAW,aAAa,MAAM,SAAU;AACxD,UAAI,IAAI,UAAU,YAAY,QAAS;AAMvC,UACE,MAAM,WAAW,aACjB,CAAC,IAAI,UAAU,SAAS,MAAM,QAAQ,GACtC;AACA,YAAI,UAAU,KAAK,MAAM,QAAQ;AAAA,MACnC;AACA,WAAK,SAAS,GAAG;AACjB,eAAS,KAAK,KAAK;AAAA,IACrB;AACA,WAAO,QAAQ,QAAQ,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAK,OAOH;AACA,UAAM,MAAM,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,KAAK,CAAC;AAC3D,QAAI,KAAK,WAAW,MAAM,QAAQ;AAChC,aAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AAAA,IACjD;AACA,QAAI,IAAI,UAAU,oBAAoB;AACpC,aAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,KAAK,IAAI,MAAM,CAAC;AAAA,IAChE;AACA,QAAI,UAAU,MAAM;AACpB,QAAI,QAAQ;AACZ,WAAO,IAAI;AACX,WAAO,QAAQ,QAAQ,EAAE,OAAO,IAAI,MAAM,CAAC;AAAA,EAC7C;AAAA;AAAA,EAGA,OAAO,OAA4D;AACjE,UAAM,MAAM,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,KAAK,CAAC;AAI3D,QAAI,KAAK,WAAW,MAAM,OAAQ,QAAO,QAAQ,QAAQ,KAAK;AAC9D,QAAI,YAAY;AAGhB,WAAO,QAAQ,QAAQ,IAAI;AAAA,EAC7B;AAAA;AAAA,EAGA,eAAe,UAAoC;AACjD,WAAO,QAAQ;AAAA,MACb,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,EACpB;AAAA,QACC,CAAC,QACC,IAAI,cAAc,QAAQ,IAAI,WAAW,aAAa;AAAA,MAC1D,EAIC,IAAI,CAAC,SAAS;AAAA,QACb,OAAO,IAAI;AAAA,QACX,SAAS,IAAI,WAAW,WAAW;AAAA,MACrC,EAAE,EACD,OAAO,CAAC,UAAU,MAAM,YAAY,EAAE;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAY,OAOf;AAID,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,UAAkD,CAAC;AACzD,UAAM,OAAgB,CAAC;AAEvB,eAAW,EAAE,OAAO,QAAQ,KAAK,MAAM,QAAQ;AAC7C,YAAM,MAAM,KAAK,UAAU,OAAO,MAAM,UAAU,OAAO;AACzD,YAAM,OAAO,KAAK;AAKlB,UACE,CAAC,OACD,MAAM,YAAY,WAClB,KAAK,aAAa,MAAM,UACxB;AACA,aAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAC5B;AAAA,MACF;AAGA,YAAM,YAAY,MAAM,MAAM;AAC9B,UAAI,YAAY,EAAE,GAAG,MAAM,gBAAgB,UAAU;AACrD,cAAQ,KAAK,EAAE,OAAO,UAAU,CAAC;AAAA,IACnC;AAKA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,KAAK,UAA2D;AACpE,UAAM,aAAa,MAAM,KAAK,IAAI;AAClC,UAAM,WAAW,KAAK,UAAU,IAAI,SAAS,QAAQ;AACrD,QAAI,UAAU;AACZ,eAAS,aAAa;AACtB,aAAO;AAAA,IACT;AACA,UAAM,QAAkB,EAAE,GAAG,UAAU,WAAW;AAClD,SAAK,UAAU,IAAI,SAAS,UAAU,KAAK;AAC3C,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,UAAiD;AACxD,WAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC;AAAA,EACrD;AAAA,EAEA,WAAgC;AAC9B,WAAO,QAAQ,QAAQ,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAS,KAAsB;AAC7B,QAAI,QAAQ;AAGZ,QAAI,IAAI,UAAW,MAAK,SAAS,OAAO,IAAI,UAAU,OAAO;AAC7D,WAAO,IAAI;AACX,WAAO,IAAI;AACX,WAAO,IAAI;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAA8B;AAClC,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,WAAwB,CAAC;AAC/B,UAAM,UAAuB,CAAC;AAC9B,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AAgBrC,UAAI,IAAI,KAAK,cAAc,KAAK;AAC9B,aAAK,QAAQ,GAAG;AAChB,gBAAQ,KAAK,GAAG;AAChB;AAAA,MACF;AACA,UAAI,IAAI,UAAU,uBAAuB,IAAI,iBAAiB,MAAM,KAAK;AACvE,aAAK,SAAS,GAAG;AACjB,iBAAS,KAAK,GAAG;AAAA,MACnB;AACA,YAAM,QAAQ,IAAI;AAClB,UACE,UACC,IAAI,UAAU,WAAW,IAAI,UAAU,cACxC,MAAM,kBAAkB,KACxB;AACA,aAAK,SAAS,GAAG;AACjB,iBAAS,KAAK,GAAG;AAAA,MACnB;AAAA,IACF;AAGA,WAAO,CAAC,GAAG,UAAU,GAAG,OAAO;AAAA,EACjC;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RoutingStore } from './store-DgzTq29P.js';
-export { A as AWAITING_PAYLOAD_MS, C as ClaimInput, H as HolderRefusal, P as Presence, a as RelayState, b as ReleaseReason, c as RoutedJob, d as RoutedState, r as routeKey } from './store-DgzTq29P.js';
+import { R as RoutingStore } from './store-CJOoBOeD.js';
+export { A as AWAITING_PAYLOAD_MS, C as ClaimInput, H as HolderRefusal, P as Presence, a as RelayState, b as ReleaseReason, c as RoutedJob, d as RoutedState, r as routeKey } from './store-CJOoBOeD.js';
 import { z } from 'zod';
 import '@byollm/protocol';
 
@@ -241,6 +241,27 @@ declare class Projection {
      * caller has to pick which it means.
      */
     mayRouteFor(owner: string, siteId: string): boolean;
+    /**
+     * Has this owner's relationship *ended* — V1-2?
+     *
+     * Not "is there nothing to serve". Those were one question until the pre-v1
+     * review pulled them apart, and the difference is a machine's pinned keys:
+     * an empty answer made the daemon stop, cancel everything and **delete its
+     * pairings file**, so a projection that arrived empty or half-written — one
+     * bad control-plane push — cost every daemon its pins and every user a
+     * re-pair they never asked for.
+     *
+     * Revocation is a thing somebody did, and this asks for the evidence of it:
+     * a revocation record for this owner, and nothing left standing. A
+     * projection that simply knows nothing says nothing — the relay answers
+     * normally, the daemon serves nobody, and the pairing survives to be
+     * correct again when the next push lands.
+     *
+     * The `revoked` list exists precisely for this and was consulted by
+     * nothing. Its own doc said why: "the row is gone" and "the row was
+     * revoked" are different answers, and only one of them is a decision.
+     */
+    revokedOutright(owner: string): boolean;
     /** Whether this pair is consented and paused — what heartbeat reports. */
     pausedFor(owner: string, siteId: string): boolean;
     /**

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   AWAITING_PAYLOAD_MS,
   RelayState,
   routeKey
-} from "./chunk-ZH2GB6FY.js";
+} from "./chunk-WQYO6NFP.js";
 
 // src/daemon-plane.ts
 import {
@@ -44,16 +44,22 @@ var REFUSALS = {
     status: 404,
     body: { error: "not-found", message: "unknown job" }
   },
+  // `forbidden`, not `unauthorized` — V1-13. Both of these are an
+  // *identified* caller being refused, which is what 403 means and what the
+  // table says `forbidden` is for; `unauthorized` is 401 and means "we do not
+  // know who you are". Served as 403 with a 401's code, a revoked daemon and
+  // an unsigned one looked alike in every log and every client branch, and
+  // "check your keys" is the wrong advice for both in opposite directions.
   "not-holder": {
     status: 403,
     body: {
-      error: "unauthorized",
+      error: "forbidden",
       message: "this runner does not hold the job"
     }
   },
   "stale-lease": {
     status: 403,
-    body: { error: "unauthorized", message: "that lease is no longer current" }
+    body: { error: "forbidden", message: "that lease is no longer current" }
   },
   "not-ready": {
     status: 409,
@@ -61,6 +67,13 @@ var REFUSALS = {
       error: "not-ready",
       message: "the site has not sealed this job yet"
     }
+  },
+  // Also a 409, and deliberately a different code: `not-ready` means keep
+  // asking and this means stop. A daemon that read them as one would poll a
+  // finished job until its lease ran out.
+  terminal: {
+    status: 409,
+    body: { error: "too-late", message: "this job has already finished" }
   }
 };
 var fail = (status, error, message) => ({
@@ -100,7 +113,7 @@ var DaemonPlane = class {
     if (!approved) {
       return fail(
         403,
-        "unauthorized",
+        "forbidden",
         "this device has not been approved by its owner"
       );
     }
@@ -148,7 +161,7 @@ var DaemonPlane = class {
     });
     if (failure === "stale") return this.#clockSkew();
     if (failure) return fail(401, "unauthorized", "signature check failed");
-    const revoked = this.#deps.projection.sitesFor(known.owner).length === 0;
+    const revoked = this.#deps.projection.revokedOutright(known.owner);
     if (revoked && options.allowRevoked !== true) {
       return fail(403, "revoked", "routing for this runner has been revoked");
     }
@@ -178,7 +191,7 @@ var DaemonPlane = class {
   claim(auth, body) {
     return this.#authed(auth, body, ClaimRequest, async (request, device) => {
       if (request.runnerId !== device.runnerId) {
-        return fail(401, "unauthorized", "runner id does not match the key");
+        return fail(403, "forbidden", "runner id does not match the key");
       }
       const granted = await this.#deps.state.claim({
         runnerId: device.runnerId,
@@ -263,7 +276,10 @@ var DaemonPlane = class {
             sites,
             awaitingConsent,
             cancel: [],
-            lost: request.activeLeases.map((lease) => lease.jobId),
+            lost: request.activeLeases.map((lease) => ({
+              jobId: lease.jobId,
+              leaseId: lease.leaseId
+            })),
             serverTime: now
           });
         }
@@ -280,8 +296,7 @@ var DaemonPlane = class {
           lost,
           serverTime: now
         });
-      },
-      { allowRevoked: true }
+      }
     );
   }
   release(auth, body) {
@@ -559,6 +574,30 @@ var Projection = class {
     const consent = this.consentFor(owner, siteId);
     return consent !== null && !consent.paused;
   }
+  /**
+   * Has this owner's relationship *ended* — V1-2?
+   *
+   * Not "is there nothing to serve". Those were one question until the pre-v1
+   * review pulled them apart, and the difference is a machine's pinned keys:
+   * an empty answer made the daemon stop, cancel everything and **delete its
+   * pairings file**, so a projection that arrived empty or half-written — one
+   * bad control-plane push — cost every daemon its pins and every user a
+   * re-pair they never asked for.
+   *
+   * Revocation is a thing somebody did, and this asks for the evidence of it:
+   * a revocation record for this owner, and nothing left standing. A
+   * projection that simply knows nothing says nothing — the relay answers
+   * normally, the daemon serves nobody, and the pairing survives to be
+   * correct again when the next push lands.
+   *
+   * The `revoked` list exists precisely for this and was consulted by
+   * nothing. Its own doc said why: "the row is gone" and "the row was
+   * revoked" are different answers, and only one of them is a decision.
+   */
+  revokedOutright(owner) {
+    if (this.sitesFor(owner).length > 0) return false;
+    return this.#fixture.revoked.some((record) => record.owner === owner);
+  }
   /** Whether this pair is consented and paused — what heartbeat reports. */
   pausedFor(owner, siteId) {
     return this.consentFor(owner, siteId)?.paused === true;
@@ -723,9 +762,6 @@ var SitePlane = class {
     if (siteIdOf(parsed.data) !== siteId) {
       return fail2(403, "forbidden", "that is not your site");
     }
-    if (this.#deps.projection.siteFor(siteId) === null) {
-      return fail2(403, "forbidden", "this relay does not route for you");
-    }
     return run(parsed.data, siteId);
   }
   enqueue(auth, body) {
@@ -739,7 +775,9 @@ var SitePlane = class {
         if (!registered || keyId2(registered.site.identity) !== request.stub.site) {
           return fail2(
             403,
-            "unauthorized",
+            // V1-13, and one of the five the ruling itself named: an
+            // identified site claiming another site's stub is `forbidden`.
+            "forbidden",
             "that stub does not name the site that signed it"
           );
         }