@byollm/relay 0.1.0-alpha.57 → 0.1.0-alpha.59

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.57`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.59`) — under active development. Don't use this yet.**
 >
 > This is a walking skeleton. It routes real jobs between real daemons and real
 > sites, and it is the fixture byollm_009 freezes against — but it keeps its
@@ -72,7 +72,7 @@
 > packages published and `@byollm/server` did not: a Sigstore
 > transparency-log 409 on its provenance attestation. The workflow's
 > "already published" guard correctly refuses to resume a partial publish,
-> so `0.1.0-alpha.57` is that release, whole.
+> so `0.1.0-alpha.59` is that release, whole.
 >
 > If you run the Supabase adapter, `alpha.21` needs
 > `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's
@@ -183,7 +183,7 @@ daemons pin at pairing, verified against the `sites` half of the projection.
 Nothing here trusts a `siteId` in a body or a query string.
 
 That is newer than the rest of this package. The site plane took the caller's
-word for who it was until `0.1.0-alpha.57`, which on a relay reachable from the
+word for who it was until `0.1.0-alpha.59`, which on a relay reachable from the
 internet is an open enqueue endpoint into consenting users' devices and an
 open read of who is online. It was blind the whole time — nothing could open a
 payload — and blind is not the same as safe.
@@ -191,7 +191,7 @@ payload — and blind is not the same as safe.
 If you are running this: the site plane is authenticated but this is still a
 single-tenant relay with in-memory state. One site, one replica.
 
-## Breaking in `0.1.0-alpha.57`: `RelayState` is async
+## Breaking in `0.1.0-alpha.59`: `RelayState` is async
 
 Every method on `RelayState` now returns a `Promise`, and `Relay.sweep()` and
 `debugPage()` with it. `RelayState.requeue` is private — it was only ever a

package/dist/{chunk-XLWNHHLS.js → chunk-C5GHCHAV.js}

@@ -1,8 +1,8 @@
 // src/state.ts
 import { randomUUID } from "crypto";
 var AWAITING_PAYLOAD_MS = 1e4;
+var RETRY_AFTER_MS = 3e4;
 var routeKey = (siteId, owner) => `${siteId}\0${owner}`;
-var serviceKey = (kind, service) => `${kind}\0${service}`;
 var keyOf = (siteId, jobId) => `${siteId}\0${jobId}`;
 var RelayState = class {
   /**
@@ -163,10 +163,9 @@ var RelayState = class {
       if (granted.length >= input.max) break;
       if (job.state !== "queued") continue;
       if (!input.routes.has(routeKey(job.siteId, job.stub.owner))) continue;
-      if (job.stub.service === void 0 ? !input.kinds.has(job.stub.kind) : !input.serves.has(serviceKey(job.stub.kind, job.stub.service))) {
-        continue;
-      }
+      if (!input.kinds.has(job.stub.kind)) continue;
       if (job.refusedBy.includes(input.runnerId)) continue;
+      if ((job.retryAfter?.[input.runnerId] ?? 0) > now) continue;
       if (job.cancelled) continue;
       if (job.stub.audience === "private" && job.stub.owner !== input.owner) {
         continue;
@@ -253,6 +252,12 @@ var RelayState = class {
       if (input.reason === "refused" && !job.refusedBy.includes(input.runnerId)) {
         job.refusedBy.push(input.runnerId);
       }
+      if (input.retryAfter !== void 0) {
+        job.retryAfter = {
+          ...job.retryAfter,
+          [input.runnerId]: input.retryAfter
+        };
+      }
       this.#requeue(job);
       released.push(jobId);
     }
@@ -392,8 +397,8 @@ var RelayState = class {
 
 export {
   AWAITING_PAYLOAD_MS,
+  RETRY_AFTER_MS,
   routeKey,
-  serviceKey,
   RelayState
 };
-//# sourceMappingURL=chunk-XLWNHHLS.js.map
+//# sourceMappingURL=chunk-C5GHCHAV.js.map

package/dist/chunk-C5GHCHAV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/state.ts"],"sourcesContent":["import type {\n  CapabilityMatrix,\n  ClaimedStub,\n  JobStub,\n  PublicIdentity,\n  SealedEnvelope,\n  WithheldKind,\n} from \"@byollm/protocol\";\nimport { randomUUID } from \"node:crypto\";\nimport type { Grant, RoutingStore } from \"./store.js\";\n\n/**\n * The relay's routing state — byollm_009 §7, reachable at last.\n *\n * §7 described a state machine the direct plane could not produce. There, the\n * site and the upstream are the same party: it seals when it likes, and a job\n * is never claimed-but-unsealed. Here they are different parties, and the gap\n * between them is a state:\n *\n * ```\n * queued ──claim──▶ awaiting-payload ──sealed──▶ ready ──fetch──▶ running\n *    ▲                    │                                          │\n *    └────────────────────┘                                          ▼\n *      site never seals, or seals too late              ok | error | canceled\n * ```\n *\n * The relay cannot seal, so it cannot shortcut this. A payload is encrypted\n * to *the device that claimed it*, and nobody knows which device that is until\n * the claim happens — which is precisely why claim-then-fetch makes a blind\n * relay possible at all. The window is the price.\n *\n * ## What the relay holds, and what it cannot\n *\n * Stubs (metadata the site chose to publish), sealed envelopes it cannot open,\n * and public keys. There is no field on any type in this file that could hold\n * a private key or a plaintext, which is `RELAY_BLIND` expressed as a data\n * model rather than as a policy.\n */\n\n/** Where a routed job is. */\nexport type RoutedState =\n  \"queued\" | \"awaiting-payload\" | \"ready\" | \"running\" | \"done\";\n\n/**\n * How long a site has to seal after one of its jobs is claimed.\n *\n * **Distinct from the lease, and distinct from the job's TTL** — byollm_009\n * §7.1. Three clocks, three different questions:\n *\n * - the **TTL** asks how long the work is worth doing at all;\n * - the **lease** asks how long this device gets to run it;\n * - this asks how long we wait for a site that has gone away.\n *\n * Collapsing any pair of them looks harmless until a site restarts during a\n * deploy: with only a lease, the device sits politely holding a job whose\n * payload will never arrive, and the lease's whole minute is spent waiting on\n * a party that is not coming back. Short, because a site that is up answers in\n * milliseconds and a site that is down will not answer sooner for waiting.\n */\nexport const AWAITING_PAYLOAD_MS = 10_000;\n\n/**\n * How long a device waits before asking about a job it could not run — the\n * rate every transient refusal needs.\n *\n * **A transient needs a rate; a retry without a not-before is a spin.** A\n * release that is not `refused` requeues immediately and stays claimable by\n * the same device, which is right for a daemon saying \"not now, I am\n * restarting\" and catastrophic for a control plane saying \"that mapping\n * resolves to another of your machines\": the device re-claims at once, is\n * declined again, and the pair loops. Measured before it could happen —\n * twelve ticks produced twelve control-plane reads, which in a deployment is\n * twelve database queries for a job that was never going to run there.\n *\n * Thirty seconds is chosen against the only thing it delays: a person who\n * fixes a mapping and has work already queued. Half a minute is a wait\n * nobody notices, and one read per device per thirty seconds per stuck job is\n * a cost nobody notices either.\n *\n * Distinct from the three durations above it, and for a fourth kind of\n * reason: the TTL asks whether the work is still worth doing, the lease how\n * long this device gets, {@link AWAITING_PAYLOAD_MS} how long we wait for the\n * site — and this asks how long before we ask *this device* again.\n */\nexport const RETRY_AFTER_MS = 30_000;\n\n/** A job the relay is routing. Metadata and ciphertext, nothing else. */\n/** Why a daemon gave a job back. Only `refused` means \"not me, ever\". */\nexport type ReleaseReason =\n  \"shutdown\" | \"pause\" | \"revoked\" | \"backend-down\" | \"refused\";\n\nexport interface RoutedJob {\n  readonly id: string;\n  /** Which site enqueued it — the party that will be asked to seal. */\n  readonly siteId: string;\n  /**\n   * Everything the relay knows about the work, which is everything the site\n   * chose to publish and not one field more (byollm_009 §6).\n   */\n  readonly stub: JobStub;\n  state: RoutedState;\n  /** Set from the claim; the site seals to these keys. */\n  claimedBy?: {\n    readonly runnerId: string;\n    readonly owner: string;\n    readonly device: PublicIdentity;\n    readonly leaseId: string;\n    readonly leaseExpiresAt: number;\n  };\n  /** When {@link AWAITING_PAYLOAD_MS} runs out for this claim. */\n  awaitingUntil?: number;\n  /**\n   * Runners that released this job with reason `refused` — cloud_008 §2.1.\n   *\n   * `REFUSAL_NOT_REOFFERED`, which the relay did not implement: it dropped\n   * `ReleaseRequest.reason` on the floor. The field's own docstring says why\n   * that is not cosmetic — an upstream cannot evaluate a daemon's *local*\n   * `named` allowlist, so it may legitimately offer work the daemon then\n   * declines, and without a record the two spin between claim and release\n   * forever. The direct plane has always kept this list.\n   */\n  refusedBy: string[];\n  /**\n   * Runners that may not be offered this job again *yet*, and from when.\n   *\n   * The middle ground {@link RoutingStore.releaseLeases} had no way to say.\n   * `refusedBy` is forever and a bare release is immediate; a control plane\n   * declining a job for a reason the world can change — an unfilled mapping\n   * slot, a resolution that named another machine, a store that was briefly\n   * unreachable — means neither. It means \"ask again later\", and later needs\n   * a number.\n   *\n   * Keyed by runner because it is a fact about a pairing, not about the job:\n   * the same job goes to another device immediately, which is the whole\n   * point of not marking it refused.\n   */\n  retryAfter?: Record<string, number>;\n  /**\n   * The site withdrew this job — cloud_008 §2.2.\n   *\n   * A flag rather than a state, because a cancelled job that a device is\n   * *running* is not finished: the daemon has to be told, abort its backend\n   * call and report `canceled`, and the ordinary `complete` path then closes\n   * it. Making it a state would strand the in-flight case between two\n   * machines' ideas of what happened.\n   */\n  cancelled?: boolean;\n  /** Sealed to the claiming device by the site. Opaque here. */\n  payload?: SealedEnvelope;\n  /** Sealed to the site by the device. Opaque here. */\n  result?: SealedEnvelope;\n  /**\n   * The result's clear-text discriminator — byollm_009 §6.1.\n   *\n   * The one outcome fact the relay is given, and the reason it is given:\n   * without it the relay cannot stop dispatching a finished job. A routing\n   * hint and never a fact — the *site* verifies it against the sealed\n   * outcome, because only the site can open the envelope. The relay acts on\n   * it and is entitled to be wrong; a lying daemon costs it a dispatch\n   * decision, not a security property.\n   */\n  disposition?: \"ok\" | \"error\" | \"canceled\";\n}\n\n/** A device the relay has seen recently. */\nexport interface Presence {\n  readonly runnerId: string;\n  readonly owner: string;\n  readonly device: PublicIdentity;\n  lastSeenAt: number;\n  /**\n   * What this machine last said it can run — cloud_009, 2026-08-24.\n   *\n   * **Capabilities are presence data.** They arrive on the same heartbeat as\n   * everything else here, they go stale at the same moment and for the same\n   * reason, and a machine that stops heartbeating has not stopped being able\n   * to run Llama — it has stopped being somewhere we can ask. Keeping them\n   * anywhere else would put capability truth outside the interface that owns\n   * presence, and every next consumer (a member's usable set, a dashboard's\n   * pulse, a degraded-state banner) would re-derive it from a different\n   * place. That is the two-owners shape this codebase keeps paying for.\n   *\n   * Empty is a real answer, not a missing one: it is a paired machine with no\n   * healthy backend, which is a legal state the whole connect-first ruling\n   * exists to make visible rather than refuse.\n   */\n  capabilities: CapabilityMatrix;\n  /**\n   * Kinds this machine is deliberately *not* advertising — byollm_016.\n   *\n   * Presence data for the same reason capabilities are, and stored beside\n   * them rather than derived: two services answering one kind with no\n   * `defaults` entry is a state only the daemon can see, and the hub cannot\n   * reconstruct it from the matrix — an absent kind and a withheld kind look\n   * identical there. Without this field the owner's page can say \"nothing\n   * serves llm.generate\", which is true and useless, instead of \"two services\n   * answer it and you have not chosen\", which is the sentence that ends with\n   * the owner doing something.\n   *\n   * Empty is the normal answer, and means every kind resolved.\n   */\n  withheld: readonly WithheldKind[];\n  // `revoked` is deliberately absent — cloud_008 §2.3.\n  //\n  // It was a boolean on the *runner*, written at heartbeat and read by\n  // nothing but the debug page. Enforcement had already moved to the\n  // projection, because enforcing on this flag made revocation depend on the\n  // client calling an endpoint: a daemon that simply never heartbeat went on\n  // claiming forever. What survived was the cache, which is a stored copy of\n  // a derived fact — this project's most-repeated bug, kept alive here as a\n  // display value.\n  //\n  // It is also a concept multi-tenancy cannot express. Revocation is a fact\n  // about an (owner, site) pair; a daemon serving two sites and revoked at\n  // one is not \"a revoked runner\", and a boolean on the device has nowhere to\n  // put the difference. Deleting it now is what stops cloud_009 inheriting a\n  // field it would have to contradict.\n}\n\n/**\n * What a routing store must do, expressed as operations — cloud_006 §3.2.\n *\n * Every method below is a **decision plus its write**, never a read the caller\n * follows with a mutation. That is the whole point, and it is the difference\n * between an interface a shared store can implement and one it cannot.\n *\n * `claim` is the specimen. It used to live in `DaemonPlane` as\n * `jobs()` → filter → mutate, which is atomic for exactly one reason: Node is\n * single-threaded and these Maps are local, so nothing runs between the read\n * and the write. Neither survives a store on a network, and\n * `packages/relay/test/two-replicas.test.ts` holds the resulting race as a\n * failing assertion.\n *\n * So the rule for anything added here: **if a caller has to read, decide, and\n * write back, the operation is in the wrong place.** Move the decision in.\n *\n * ## Why the projection does not come with it\n *\n * `claim` takes `owners: string[]` rather than a projection or a predicate.\n * A closure cannot travel to Valkey, and the projection replicates for free\n * from the control plane — so the caller collapses it with\n * `Projection.ownersRunnableBy` and hands over data the store can match on.\n * That keeps the store ignorant of consent, which is also what keeps it\n * replaceable.\n */\nexport interface ClaimInput {\n  readonly runnerId: string;\n  readonly owner: string;\n  readonly device: PublicIdentity;\n  /**\n   * The (site, owner) pairs this device may run work for — cloud_009 §3.\n   *\n   * **One set of pairs, not a set of sites and a set of owners.** Consent\n   * binds a user to a site, so the two cannot travel separately: a device\n   * whose owner consented to site A, serving a roster member who consented\n   * to site B, would have every element of both sets and no consented route\n   * between them. Two sets multiply; consent does not.\n   *\n   * Built by {@link Projection.routesFor} and matched with {@link routeKey},\n   * so the relay and a store in another repository agree on the encoding by\n   * calling the same function rather than by both spelling it out.\n   *\n   * This is the collapse that lets a claim stay one operation: a predicate\n   * cannot travel to a store over a network, and a set can.\n   */\n  readonly routes: ReadonlySet<string>;\n  /**\n   * Kinds this device can run — and that is now the whole of the match.\n   *\n   * A relay routes by kind and by consent; **which service answers is not its\n   * question**. A job names a purpose, a person's mapping names a service,\n   * and a control plane joins them at claim. A relay that filtered on the\n   * service would need the mapping, which is the one thing it is not supposed\n   * to hold.\n   *\n   * This carried a companion, `serves`, holding the (kind, service) pairs a\n   * device advertised, so a job naming a service reached only a device with\n   * it. Sites stopped naming services (Amendment L) and the field became wire\n   * nothing read — so it is gone rather than left for a reader to infer\n   * meaning from.\n   *\n   * The cost is stated plainly: a job may be offered to a device whose owner\n   * admits the person but whose machine their mapping did not name. The\n   * control plane declines it as not-here and it goes back with a\n   * {@link RETRY_AFTER_MS} wait, which is what that mechanism is for.\n   */\n  readonly kinds: ReadonlySet<string>;\n  readonly max: number;\n  readonly leaseMs: number;\n}\n\n/**\n * How a (site, owner) route is written, so two implementations agree.\n *\n * The same `\\u0000` the job key uses, for the same reason: it cannot appear\n * in a site id or an owner id, so this is a key rather than a parser.\n */\nexport const routeKey = (siteId: string, owner: string): string =>\n  `${siteId}\\u0000${owner}`;\n\n/**\n * Where the store's sense of time comes from — cloud_006 §3.4.\n *\n * **The store owns its clock; callers do not pass one.** Every deadline the\n * relay decides — a lease's expiry, the `awaiting-payload` window, what a\n * sweep considers due — is now stamped by one source, and it is the same\n * source that will later stamp them for every replica.\n *\n * It used to be a parameter. `claim` took `now`, `sweep` took `now`, and each\n * plane called its own `now()` before calling in — which is fine in one\n * process and is the recurring bug the moment there are two. A lease granted\n * by a pod whose clock runs fast is short; the same lease swept by a pod whose\n * clock runs slow outlives it. Nobody is wrong and the lease has no length.\n *\n * A Valkey-backed store returns `TIME` here, so the deadline and the sweep\n * that enforces it are read from the same server. The injected clock stays for\n * tests, which is what lets them move time instead of sleeping.\n *\n * **What deliberately does not use this**: request-signature freshness. That\n * is checked against the *local* clock on purpose — it is a question about the\n * caller's clock versus this process's, `MAX_CLOCK_SKEW_MS` already tolerates\n * two minutes of disagreement, and a network round trip to timestamp every\n * inbound request would be a cost with no property behind it.\n */\nexport interface RelayStateOptions {\n  readonly now?: () => number | Promise<number>;\n}\n\n/** Why a lease-scoped operation was refused, in the caller's vocabulary. */\nexport type HolderRefusal =\n  | \"not-found\"\n  | \"not-holder\"\n  | \"stale-lease\"\n  | \"not-ready\"\n  /** The job already ended — V1-6. A replay must not reopen it. */\n  | \"terminal\";\n\n/**\n * In-memory routing state.\n *\n * Deliberately not durable. The skeleton proves the protocol, and the\n * production hub replaces this with the closed multi-tenant router behind the\n * same shape (cloud_004 §9). Anything a restart loses here is a job that\n * returns to its site's queue — which is the behaviour a lapsed lease already\n * has to produce, so nothing new needs to be true for this to be safe.\n */\n/**\n * A job's key: the site that published it, and the id that site chose.\n *\n * `\\u0000` cannot appear in either half, so this is a key rather than a\n * parser — cloud_009 §3, and the reason the Valkey layout uses a distinct\n * prefix rather than a suffix on the old one.\n */\nconst keyOf = (siteId: string, jobId: string): string =>\n  `${siteId}\\u0000${jobId}`;\n\nexport class RelayState implements RoutingStore {\n  /**\n   * Jobs by **(site, id)** — cloud_009 §3.\n   *\n   * A job id is a site's to choose, so two sites can choose the same one.\n   * Keyed by the bare id, the second site's enqueue returned the first\n   * site's job (cloud_008 finding 58), and the refusal that fixed it was a\n   * cross-tenant existence oracle. Keyed by the pair, the collision does not\n   * exist and there is nothing to refuse.\n   *\n   * `\\u0000` as the separator, because a site id is a uuid and a job id is\n   * whatever a site chose — including, one day, a string with a colon in it.\n   * A separator that cannot appear in either half is the difference between\n   * a key and a parser.\n   */\n  readonly #jobs = new Map<string, RoutedJob>();\n\n  /**\n   * Grants by lease id, so a holder-scoped call needs no site — §3.\n   *\n   * `takePayload`, `complete`, `releaseLeases` and `renewLeases` carry a\n   * `leaseId` the relay minted, which is unique across every site. That is\n   * what lets those four signatures stay as they are: the caller names the\n   * grant, and the grant names the job. A daemon never has to know a site id\n   * to answer for work it holds.\n   */\n  readonly #byLease = new Map<string, RoutedJob>();\n\n  /**\n   * Jobs by bare id, across sites — the refusal path.\n   *\n   * The lease index alone answers the happy case and gets the refusals\n   * wrong: a **stale** lease finds nothing, so `LEASE_HONORED`'s \"your grant\n   * ended\" becomes \"no such job\", and a daemon that was slow is told\n   * something untrue about the work it was doing. Distinguishing\n   * `not-found`, `not-holder` and `stale-lease` needs the job even when the\n   * lease named is over, and that is what this is for.\n   *\n   * A list rather than a single value: two sites may choose one id, which is\n   * the whole reason `#jobs` is keyed by the pair.\n   */\n  readonly #byJobId = new Map<string, RoutedJob[]>();\n\n  /**\n   * The job a holder-scoped call is about, without a site id.\n   *\n   * The exact grant first, and **checked against the job the caller named**:\n   * a lease id belonging to another job would otherwise hand over that job's\n   * payload to somebody holding a valid-looking grant. Then the same job held\n   * by this runner under an older grant, which is what `stale-lease` is.\n   *\n   * And then nothing — V1-8. There used to be a third step: any job with that\n   * id, which produced `not-holder` where an absent job produces `not-found`.\n   * Since job ids are chosen per site, a runner could name a bare id it had\n   * no relationship with and learn from the status code whether some *other*\n   * tenant had a job by that name. Finding 58's existence oracle, through the\n   * holder door.\n   *\n   * The distinction it bought was never acted on: a daemon abandons the work\n   * either way. So a caller now learns about jobs it holds or held, and about\n   * nothing else.\n   */\n  #grantFor(\n    jobId: string,\n    runnerId: string,\n    leaseId: string,\n  ): RoutedJob | undefined {\n    const exact = this.#byLease.get(leaseId);\n    if (exact?.id === jobId) return exact;\n    const candidates = this.#byJobId.get(jobId) ?? [];\n    return candidates.find((job) => job.claimedBy?.runnerId === runnerId);\n  }\n\n  #index(job: RoutedJob): void {\n    const bare = this.#byJobId.get(job.id);\n    if (bare) {\n      if (!bare.includes(job)) bare.push(job);\n    } else {\n      this.#byJobId.set(job.id, [job]);\n    }\n  }\n\n  #forget(job: RoutedJob): void {\n    this.#jobs.delete(keyOf(job.siteId, job.id));\n    const bare = (this.#byJobId.get(job.id) ?? []).filter((it) => it !== job);\n    if (bare.length === 0) this.#byJobId.delete(job.id);\n    else this.#byJobId.set(job.id, bare);\n    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);\n  }\n  readonly #presence = new Map<string, Presence>();\n  readonly #now: () => number | Promise<number>;\n\n  constructor(options: RelayStateOptions = {}) {\n    this.#now = options.now ?? Date.now;\n  }\n\n  /** The one clock every deadline in this store is stamped from. */\n  async now(): Promise<number> {\n    return this.#now();\n  }\n\n  /**\n   * Take a stub for routing. The payload is not here and will not be.\n   *\n   * **Idempotent by job id, and that is a security property rather than a\n   * convenience.** Site-plane calls are authenticated by signature, and\n   * byollm_009 §4.2's argument for signing the request instead of a\n   * server-issued nonce rests entirely on every write being idempotent per the\n   * instance it names. This one was not: re-enqueueing a known id built a\n   * fresh `queued` job over the top of the old one, discarding a live claim,\n   * its lease and any payload the site had already sealed to a device. A\n   * replayed enqueue inside the two-minute freshness window was therefore a\n   * way to yank a job back from the machine running it — the `release` bug of\n   * §4.2, rediscovered on the other plane.\n   *\n   * So a known id returns what is already routing, unchanged. A site that\n   * restarts and republishes its queue is the normal case, and it must not\n   * disturb work in flight.\n   */\n  enqueue(input: {\n    id: string;\n    siteId: string;\n    stub: JobStub;\n  }): Promise<RoutedJob> {\n    // Idempotent by (site, id). The refusal that used to live here went with\n    // the collision it refused — cloud_009 §3.\n    const existing = this.#jobs.get(keyOf(input.siteId, input.id));\n    if (existing) return Promise.resolve(existing);\n    const job: RoutedJob = {\n      id: input.id,\n      siteId: input.siteId,\n      stub: input.stub,\n      state: \"queued\",\n      refusedBy: [],\n    };\n    this.#jobs.set(keyOf(job.siteId, job.id), job);\n    this.#index(job);\n    return Promise.resolve(job);\n  }\n\n  job(siteId: string, jobId: string): Promise<RoutedJob | undefined> {\n    return Promise.resolve(this.#jobs.get(keyOf(siteId, jobId)));\n  }\n\n  jobs(): Promise<RoutedJob[]> {\n    return Promise.resolve([...this.#jobs.values()]);\n  }\n\n  /** Jobs a site must seal for, right now. */\n  async awaiting(siteId: string): Promise<RoutedJob[]> {\n    return (await this.jobs()).filter(\n      (j) => j.siteId === siteId && j.state === \"awaiting-payload\",\n    );\n  }\n\n  /** Sealed results waiting to go home. */\n  async finished(siteId: string): Promise<RoutedJob[]> {\n    return (await this.jobs()).filter(\n      (j) =>\n        j.siteId === siteId && j.state === \"done\" && j.result !== undefined,\n    );\n  }\n\n  /**\n   * Claim work — one operation, because it has to be.\n   *\n   * Moved here wholesale from `DaemonPlane`, where it was a scan followed by\n   * per-job mutation. Nothing about the *decision* changed; what changed is\n   * that a store can now implement it, because the filter and the write are\n   * one call rather than a loop the caller drives.\n   *\n   * The order of the guards is worth preserving as-is when this becomes a Lua\n   * script: cheapest first, and `owners` last because it is the only one that\n   * needed the projection.\n   */\n  async claim(input: ClaimInput): Promise<ClaimedStub[]> {\n    const now = await this.now();\n    await this.sweep();\n\n    const granted: ClaimedStub[] = [];\n    for (const job of this.#jobs.values()) {\n      if (granted.length >= input.max) break;\n      if (job.state !== \"queued\") continue;\n      // The route, as one lookup, because consent is about the pair — a\n      // device whose owner consented to site A, serving a roster member who\n      // consented to site B, is in both a set of sites and a set of owners\n      // and has no consented route between them.\n      if (!input.routes.has(routeKey(job.siteId, job.stub.owner))) continue;\n      // By kind, and only by kind — Amendment L. Which of the owner's\n      // services answers is the control plane's, resolved from this person's\n      // mapping at claim; a relay that matched on it would need to hold the\n      // mapping, and holding it is what a relay must not do.\n      if (!input.kinds.has(job.stub.kind)) continue;\n      // Already declined by this device — `REFUSAL_NOT_REOFFERED`, §2.1.\n      if (job.refusedBy.includes(input.runnerId)) continue;\n      // Declined for something that may have changed since, but not yet.\n      if ((job.retryAfter?.[input.runnerId] ?? 0) > now) continue;\n      // Withdrawn by the site — §2.2. Cheap, and before every other check.\n      if (job.cancelled) continue;\n      // The relay's half of AUDIENCE_BOTH_SIDES. The daemon re-checks its own\n      // allowlist and may still refuse — this only ever narrows.\n\n      // `self` means the owner's own machines, and the route set cannot\n      // express that — cloud_008 §2.1.\n      //\n      // The routes are every (site, owner) this device may run for, which for\n      // a Team owner's machine includes every roster member. Correct for\n      // `public` and `named`, and wrong for\n      // `self`: a roster member's private job was offered to the owner's\n      // daemon, which refused it locally and released it, and the relay\n      // offered it straight back. The ping-pong was the visible symptom; the\n      // invisible one is that `self` — the audience a user picks *because*\n      // they want their own machine — was the audience the relay ignored.\n      if (job.stub.audience === \"private\" && job.stub.owner !== input.owner) {\n        continue;\n      }\n\n      // A UUID, not a readable composite. The direct plane's lease ids are\n      // UUIDs and the Supabase adapter's `lease_id` column is typed `uuid`, so\n      // a relay minting `lease_<job>_<time>` would route perfectly against a\n      // memory store and fail the moment a real site adopted the lease.\n      const leaseId = randomUUID();\n      job.state = \"awaiting-payload\";\n      job.claimedBy = {\n        runnerId: input.runnerId,\n        owner: input.owner,\n        device: input.device,\n        leaseId,\n        leaseExpiresAt: now + input.leaseMs,\n      };\n      // Not the lease: this bounds how long we wait for a *site*, not how long\n      // the device may work. byollm_009 §7.1's third clock.\n      job.awaitingUntil = now + AWAITING_PAYLOAD_MS;\n      // The grant is findable by its own id, which is how a holder-scoped\n      // call needs no site — cloud_009 §3.\n      this.#byLease.set(leaseId, job);\n\n      granted.push({\n        ...job.stub,\n        lease: {\n          id: leaseId,\n          runnerId: input.runnerId,\n          expiresAt: job.claimedBy.leaseExpiresAt,\n        },\n      });\n    }\n    return granted;\n  }\n\n  /**\n   * Hand over the sealed payload to the device that holds the lease.\n   *\n   * The read and the state transition are one operation for the same reason\n   * `claim` is: `running` must be set by whoever was told the envelope, or two\n   * replicas can both hand out the same work and both believe they were first.\n   */\n  takePayload(input: {\n    jobId: string;\n    runnerId: string;\n    leaseId: string;\n  }): Promise<{ envelope: SealedEnvelope } | { refused: HolderRefusal }> {\n    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);\n    if (!job) return Promise.resolve({ refused: \"not-found\" });\n    if (job.claimedBy?.runnerId !== input.runnerId) {\n      return Promise.resolve({ refused: \"not-holder\" });\n    }\n    // LEASE_HONORED per *instance*: a stale lease id names a grant that is\n    // over, and answering it would hand work to a previous holder.\n    if (job.claimedBy.leaseId !== input.leaseId) {\n      return Promise.resolve({ refused: \"stale-lease\" });\n    }\n    if (!job.payload) return Promise.resolve({ refused: \"not-ready\" });\n    // Only a job that is still running gets handed its payload — V1-6.\n    //\n    // The holder and lease checks pass for a job this runner finished\n    // moments ago, because completing does not end the grant. A replayed\n    // fetch then set `state = 'running'` on a **done** job: `finished()`\n    // stopped returning its result to the site, and the sweep requeued\n    // completed work as though the device had died holding it. A duplicate\n    // request undoing a finished job is the shape `RESULT_IDEMPOTENT` exists\n    // to forbid, arriving through the other door.\n    if (job.state !== \"ready\" && job.state !== \"running\") {\n      return Promise.resolve({ refused: \"terminal\" });\n    }\n    job.state = \"running\";\n    return Promise.resolve({ envelope: job.payload });\n  }\n\n  /**\n   * Record a finished job.\n   *\n   * `RESULT_IDEMPOTENT` lives here rather than in the caller: a replayed\n   * result must be a no-op decided by the same operation that would have\n   * written it, or two replicas can both decide they were the first.\n   */\n  complete(input: {\n    jobId: string;\n    runnerId: string;\n    leaseId: string;\n    envelope: SealedEnvelope;\n    disposition: \"ok\" | \"error\" | \"canceled\";\n  }): Promise<\n    | { accepted: boolean; duplicate?: boolean; state: RoutedState }\n    | { refused: HolderRefusal }\n  > {\n    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);\n    if (!job) return Promise.resolve({ refused: \"not-found\" });\n    if (job.claimedBy?.runnerId !== input.runnerId) {\n      return Promise.resolve({ refused: \"not-holder\" });\n    }\n    // Terminal before holder — cloud_008 §3.6, and the same order in all four\n    // stores.\n    //\n    // This file argued the opposite two days ago: that a result under a grant\n    // that ended is a different device's work arriving late rather than a\n    // replay, so the lease check should win. That is right for a job which is\n    // **not** terminal, and the two orders only ever disagree about a *done*\n    // job asked about under a stale grant — where \"already recorded\" is the\n    // more useful of two true statements, and \"your lease is stale\" invents a\n    // worry about an answer that is safely stored.\n    //\n    // The deciding argument is not comfort. byollm_009 §4's case for signing\n    // requests rather than issuing nonces rests on every write being\n    // idempotent per the instance it names, and on the direct plane\n    // `RESULT_IDEMPOTENT` was holding only because `complete` nulls the lease\n    // and the holder check tripped first. A MUST another MUST's security\n    // argument leans on cannot hold by coincidence.\n    //\n    // Scoped to the device that finished it: anyone else falls through to the\n    // holder check and gets the refusal they would get for a job that is not\n    // terminal, so a job id is not a terminality probe.\n    if (job.state === \"done\") {\n      const sameGrant = job.claimedBy.leaseId === input.leaseId;\n      return Promise.resolve(\n        sameGrant\n          ? { accepted: false, duplicate: true, state: job.state }\n          : { refused: \"stale-lease\" },\n      );\n    }\n    // LEASE_HONORED per instance — cloud_008 §1.4a.\n    if (job.claimedBy.leaseId !== input.leaseId) {\n      return Promise.resolve({ refused: \"stale-lease\" });\n    }\n    job.result = input.envelope;\n    job.disposition = input.disposition;\n    job.state = \"done\";\n    return Promise.resolve({ accepted: true, state: job.state });\n  }\n\n  /** Give back leases this runner holds, naming each grant it means. */\n  releaseLeases(input: {\n    runnerId: string;\n    leases: readonly { jobId: string; leaseId: string }[];\n    reason?: ReleaseReason;\n    retryAfter?: number;\n  }): Promise<string[]> {\n    const released: string[] = [];\n    for (const { jobId, leaseId } of input.leases) {\n      // Through the grant, like every other holder-scoped operation — the\n      // caller names a lease and this store no longer keys jobs by a bare id.\n      const job = this.#grantFor(jobId, input.runnerId, leaseId);\n      if (!job || job.claimedBy?.runnerId !== input.runnerId) continue;\n      if (job.claimedBy.leaseId !== leaseId) continue;\n      // Recorded before the requeue, so the job goes back to the queue\n      // already knowing not to come back here. A daemon releasing for\n      // `shutdown` or `backend-down` is saying \"not now\"; `refused` is the\n      // only one that means \"not me, ever\" — the others must stay claimable\n      // by the same device or a restart would strand its own work.\n      if (\n        input.reason === \"refused\" &&\n        !job.refusedBy.includes(input.runnerId)\n      ) {\n        job.refusedBy.push(input.runnerId);\n      }\n      // Recorded before the requeue for the same reason the refusal is: the\n      // job goes back to the queue already knowing when it may come back\n      // here, rather than being claimable for the instant in between.\n      if (input.retryAfter !== undefined) {\n        job.retryAfter = {\n          ...job.retryAfter,\n          [input.runnerId]: input.retryAfter,\n        };\n      }\n      this.#requeue(job);\n      released.push(jobId);\n    }\n    return Promise.resolve(released);\n  }\n\n  /**\n   * Take a site's sealed payload for a claimed job.\n   *\n   * Refuses anything not `awaiting-payload`, which is what makes the timeout\n   * mean something: a late seal must not land on a claim that has moved.\n   */\n  seal(input: {\n    jobId: string;\n    siteId: string;\n    envelope: SealedEnvelope;\n  }): Promise<\n    | { state: RoutedState }\n    | { refused: \"not-found\" | \"too-late\"; was?: RoutedState }\n  > {\n    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));\n    if (job?.siteId !== input.siteId) {\n      return Promise.resolve({ refused: \"not-found\" });\n    }\n    if (job.state !== \"awaiting-payload\") {\n      return Promise.resolve({ refused: \"too-late\", was: job.state });\n    }\n    job.payload = input.envelope;\n    job.state = \"ready\";\n    delete job.awaitingUntil;\n    return Promise.resolve({ state: job.state });\n  }\n\n  /** {@link RoutingStore.cancel} — the site withdraws a job. */\n  cancel(input: { jobId: string; siteId: string }): Promise<boolean> {\n    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));\n    // Scoped to the caller's site for the same reason every other site-plane\n    // operation is: a site must not be able to cancel somebody else's work by\n    // guessing an id.\n    if (job?.siteId !== input.siteId) return Promise.resolve(false);\n    job.cancelled = true;\n    // Not deleted, and not requeued. If a device holds it, that device has to\n    // hear about it — which is what `cancelRequests` below is for.\n    return Promise.resolve(true);\n  }\n\n  /** {@link RoutingStore.cancelRequests} — cancelled jobs this runner holds. */\n  cancelRequests(runnerId: string): Promise<Grant[]> {\n    return Promise.resolve(\n      [...this.#jobs.values()]\n        .filter(\n          (job) =>\n            job.cancelled === true && job.claimedBy?.runnerId === runnerId,\n        )\n        // The grant, not the id — V1-3. Two sites may have chosen the same\n        // job id, and a daemon holding both cannot tell which of them a bare\n        // id means.\n        .map((job) => ({\n          jobId: job.id,\n          leaseId: job.claimedBy?.leaseId ?? \"\",\n        }))\n        .filter((grant) => grant.leaseId !== \"\"),\n    );\n  }\n\n  /** {@link RoutingStore.renewLeases} — extend what is still held, name what is not. */\n  async renewLeases(input: {\n    runnerId: string;\n    leases: readonly { jobId: string; leaseId: string }[];\n    leaseMs: number;\n  }): Promise<{\n    renewed: { jobId: string; expiresAt: number }[];\n    lost: Grant[];\n  }> {\n    // The store's clock, not the caller's — cloud_006 §3.4. A lease extended\n    // against one replica's `Date.now()` and swept against another's is a\n    // lease with no length.\n    const now = await this.now();\n    const renewed: { jobId: string; expiresAt: number }[] = [];\n    const lost: Grant[] = [];\n\n    for (const { jobId, leaseId } of input.leases) {\n      const job = this.#grantFor(jobId, input.runnerId, leaseId);\n      const held = job?.claimedBy;\n      // The lease id *and* the runner. A lease id is a UUID so the runner\n      // check is belt and braces, but \"this grant, held by you\" is the\n      // sentence every other operation in this file checks, and a renewal is\n      // the one that extends a hold rather than ending it.\n      if (\n        !job ||\n        held?.leaseId !== leaseId ||\n        held.runnerId !== input.runnerId\n      ) {\n        lost.push({ jobId, leaseId });\n        continue;\n      }\n      // Replaced rather than mutated: the grant is a readonly record, which\n      // is what stops any other operation here from quietly extending it.\n      const expiresAt = now + input.leaseMs;\n      job.claimedBy = { ...held, leaseExpiresAt: expiresAt };\n      renewed.push({ jobId, expiresAt });\n    }\n\n    // `awaitingUntil` is deliberately untouched. That clock bounds how long we\n    // wait for a *site* to seal, and a busy device has no bearing on it —\n    // byollm_009 §7.1's third clock stays third.\n    return { renewed, lost };\n  }\n\n  async seen(presence: Omit<Presence, \"lastSeenAt\">): Promise<Presence> {\n    const lastSeenAt = await this.now();\n    const existing = this.#presence.get(presence.runnerId);\n    if (existing) {\n      existing.lastSeenAt = lastSeenAt;\n      // Refreshed, not merged. The heartbeat re-sends the whole matrix every\n      // time precisely so a server never matches against a stale one, and a\n      // record that kept the union would keep advertising a backend the\n      // machine has since lost — which is worse than forgetting one it still\n      // has, because work would route to it.\n      existing.capabilities = presence.capabilities;\n      // Refreshed for the same reason and in the same breath: a kind that\n      // stopped being contended — because the owner chose a default, or one\n      // service went away — must stop being reported as withheld, or the page\n      // keeps asking for a decision that has already been made.\n      existing.withheld = presence.withheld;\n      return existing;\n    }\n    const fresh: Presence = { ...presence, lastSeenAt };\n    this.#presence.set(presence.runnerId, fresh);\n    return fresh;\n  }\n\n  presence(runnerId: string): Promise<Presence | undefined> {\n    return Promise.resolve(this.#presence.get(runnerId));\n  }\n\n  /**\n   * Lose a record, the way a real store does.\n   *\n   * A shared store drops presence for reasons this one never will — a TTL, a\n   * reschedule, a restart — and the interesting behaviour is what the relay\n   * does next. `ValkeyRoutingStore` has carried the same helper since\n   * finding 52; this is its memory twin, so the case can be written once\n   * against the implementation that is easy to reason about.\n   */\n  dropPresenceForTests(runnerId: string): Promise<void> {\n    this.#presence.delete(runnerId);\n    return Promise.resolve();\n  }\n\n  everyone(): Promise<Presence[]> {\n    return Promise.resolve([...this.#presence.values()]);\n  }\n\n  /**\n   * Return a job to the queue, forgetting the claim.\n   *\n   * The stub survives; nothing is lost. That is `LEASE_RECLAIMABLE` and it is\n   * why the awaiting-payload timeout is cheap to fire: the worst case is that\n   * a device did nothing for ten seconds and another one gets a turn.\n   */\n  #requeue(job: RoutedJob): void {\n    job.state = \"queued\";\n    // The grant ended; the index that names it must end with it, or a stale\n    // lease id resolves to a job it no longer holds.\n    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);\n    delete job.claimedBy;\n    delete job.awaitingUntil;\n    delete job.payload;\n  }\n\n  /**\n   * Fire whatever the clock says is due, and report it.\n   *\n   * Returns the jobs it requeued so a caller can log or surface them — a\n   * timeout that fires invisibly is indistinguishable from a job that was\n   * never claimed, and those want very different debugging.\n   */\n  async sweep(): Promise<RoutedJob[]> {\n    const now = await this.now();\n    const requeued: RoutedJob[] = [];\n    const expired: RoutedJob[] = [];\n    for (const job of this.#jobs.values()) {\n      // Past its deadline — cloud_008 §2.2, and `TTL_EXPIRY` on this plane.\n      //\n      // The relay never read `stub.deadlineAt`. Not \"read it and got the\n      // arithmetic wrong\": the field travelled on every stub, byollm_009 §6\n      // describes it as the bound on how long a ciphertext is worth carrying,\n      // and nothing here ever looked at it. A job whose deadline passed went\n      // on being offered to devices forever, and its sealed payload sat in\n      // the relay for as long as the process lived.\n      //\n      // Dropped rather than marked terminal. The relay is a router and the\n      // site holds the authoritative record; a stub nobody may run is not\n      // routing state, and keeping a tombstone would be keeping the ciphertext\n      // with it. A daemon mid-flight learns through `renewLeases`, which\n      // reports a job the store no longer holds as `lost` — the path that\n      // already exists for a lease that ended.\n      if (job.stub.deadlineAt <= now) {\n        this.#forget(job);\n        expired.push(job);\n        continue;\n      }\n      if (job.state === \"awaiting-payload\" && (job.awaitingUntil ?? 0) <= now) {\n        this.#requeue(job);\n        requeued.push(job);\n      }\n      const lease = job.claimedBy;\n      if (\n        lease &&\n        (job.state === \"ready\" || job.state === \"running\") &&\n        lease.leaseExpiresAt <= now\n      ) {\n        this.#requeue(job);\n        requeued.push(job);\n      }\n    }\n    // Both, because a caller that logs \"requeued\" and never mentions expiry\n    // would report a shrinking queue with no reason for it.\n    return [...requeued, ...expired];\n  }\n}\n"],"mappings":";AAQA,SAAS,kBAAkB;AAmDpB,IAAM,sBAAsB;AAyB5B,IAAM,iBAAiB;AAqNvB,IAAM,WAAW,CAAC,QAAgB,UACvC,GAAG,MAAM,KAAS,KAAK;AAuDzB,IAAM,QAAQ,CAAC,QAAgB,UAC7B,GAAG,MAAM,KAAS,KAAK;AAElB,IAAM,aAAN,MAAyC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAerC,QAAQ,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWnC,WAAW,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAetC,WAAW,oBAAI,IAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBjD,UACE,OACA,UACA,SACuB;AACvB,UAAM,QAAQ,KAAK,SAAS,IAAI,OAAO;AACvC,QAAI,OAAO,OAAO,MAAO,QAAO;AAChC,UAAM,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC;AAChD,WAAO,WAAW,KAAK,CAAC,QAAQ,IAAI,WAAW,aAAa,QAAQ;AAAA,EACtE;AAAA,EAEA,OAAO,KAAsB;AAC3B,UAAM,OAAO,KAAK,SAAS,IAAI,IAAI,EAAE;AACrC,QAAI,MAAM;AACR,UAAI,CAAC,KAAK,SAAS,GAAG,EAAG,MAAK,KAAK,GAAG;AAAA,IACxC,OAAO;AACL,WAAK,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,QAAQ,KAAsB;AAC5B,SAAK,MAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,EAAE,CAAC;AAC3C,UAAM,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,OAAO,GAAG;AACxE,QAAI,KAAK,WAAW,EAAG,MAAK,SAAS,OAAO,IAAI,EAAE;AAAA,QAC7C,MAAK,SAAS,IAAI,IAAI,IAAI,IAAI;AACnC,QAAI,IAAI,UAAW,MAAK,SAAS,OAAO,IAAI,UAAU,OAAO;AAAA,EAC/D;AAAA,EACS,YAAY,oBAAI,IAAsB;AAAA,EACtC;AAAA,EAET,YAAY,UAA6B,CAAC,GAAG;AAC3C,SAAK,OAAO,QAAQ,OAAO,KAAK;AAAA,EAClC;AAAA;AAAA,EAGA,MAAM,MAAuB;AAC3B,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAQ,OAIe;AAGrB,UAAM,WAAW,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC;AAC7D,QAAI,SAAU,QAAO,QAAQ,QAAQ,QAAQ;AAC7C,UAAM,MAAiB;AAAA,MACrB,IAAI,MAAM;AAAA,MACV,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,OAAO;AAAA,MACP,WAAW,CAAC;AAAA,IACd;AACA,SAAK,MAAM,IAAI,MAAM,IAAI,QAAQ,IAAI,EAAE,GAAG,GAAG;AAC7C,SAAK,OAAO,GAAG;AACf,WAAO,QAAQ,QAAQ,GAAG;AAAA,EAC5B;AAAA,EAEA,IAAI,QAAgB,OAA+C;AACjE,WAAO,QAAQ,QAAQ,KAAK,MAAM,IAAI,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAC7D;AAAA,EAEA,OAA6B;AAC3B,WAAO,QAAQ,QAAQ,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,CAAC;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,SAAS,QAAsC;AACnD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,MACzB,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,UAAU;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,QAAsC;AACnD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,MACzB,CAAC,MACC,EAAE,WAAW,UAAU,EAAE,UAAU,UAAU,EAAE,WAAW;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,MAAM,OAA2C;AACrD,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,KAAK,MAAM;AAEjB,UAAM,UAAyB,CAAC;AAChC,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AACrC,UAAI,QAAQ,UAAU,MAAM,IAAK;AACjC,UAAI,IAAI,UAAU,SAAU;AAK5B,UAAI,CAAC,MAAM,OAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAG;AAK7D,UAAI,CAAC,MAAM,MAAM,IAAI,IAAI,KAAK,IAAI,EAAG;AAErC,UAAI,IAAI,UAAU,SAAS,MAAM,QAAQ,EAAG;AAE5C,WAAK,IAAI,aAAa,MAAM,QAAQ,KAAK,KAAK,IAAK;AAEnD,UAAI,IAAI,UAAW;AAenB,UAAI,IAAI,KAAK,aAAa,aAAa,IAAI,KAAK,UAAU,MAAM,OAAO;AACrE;AAAA,MACF;AAMA,YAAM,UAAU,WAAW;AAC3B,UAAI,QAAQ;AACZ,UAAI,YAAY;AAAA,QACd,UAAU,MAAM;AAAA,QAChB,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,QACd;AAAA,QACA,gBAAgB,MAAM,MAAM;AAAA,MAC9B;AAGA,UAAI,gBAAgB,MAAM;AAG1B,WAAK,SAAS,IAAI,SAAS,GAAG;AAE9B,cAAQ,KAAK;AAAA,QACX,GAAG,IAAI;AAAA,QACP,OAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,MAAM;AAAA,UAChB,WAAW,IAAI,UAAU;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,OAI2D;AACrE,UAAM,MAAM,KAAK,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AACrE,QAAI,CAAC,IAAK,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AACzD,QAAI,IAAI,WAAW,aAAa,MAAM,UAAU;AAC9C,aAAO,QAAQ,QAAQ,EAAE,SAAS,aAAa,CAAC;AAAA,IAClD;AAGA,QAAI,IAAI,UAAU,YAAY,MAAM,SAAS;AAC3C,aAAO,QAAQ,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,IACnD;AACA,QAAI,CAAC,IAAI,QAAS,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AAUjE,QAAI,IAAI,UAAU,WAAW,IAAI,UAAU,WAAW;AACpD,aAAO,QAAQ,QAAQ,EAAE,SAAS,WAAW,CAAC;AAAA,IAChD;AACA,QAAI,QAAQ;AACZ,WAAO,QAAQ,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAS,OASP;AACA,UAAM,MAAM,KAAK,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AACrE,QAAI,CAAC,IAAK,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AACzD,QAAI,IAAI,WAAW,aAAa,MAAM,UAAU;AAC9C,aAAO,QAAQ,QAAQ,EAAE,SAAS,aAAa,CAAC;AAAA,IAClD;AAsBA,QAAI,IAAI,UAAU,QAAQ;AACxB,YAAM,YAAY,IAAI,UAAU,YAAY,MAAM;AAClD,aAAO,QAAQ;AAAA,QACb,YACI,EAAE,UAAU,OAAO,WAAW,MAAM,OAAO,IAAI,MAAM,IACrD,EAAE,SAAS,cAAc;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI,IAAI,UAAU,YAAY,MAAM,SAAS;AAC3C,aAAO,QAAQ,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,IACnD;AACA,QAAI,SAAS,MAAM;AACnB,QAAI,cAAc,MAAM;AACxB,QAAI,QAAQ;AACZ,WAAO,QAAQ,QAAQ,EAAE,UAAU,MAAM,OAAO,IAAI,MAAM,CAAC;AAAA,EAC7D;AAAA;AAAA,EAGA,cAAc,OAKQ;AACpB,UAAM,WAAqB,CAAC;AAC5B,eAAW,EAAE,OAAO,QAAQ,KAAK,MAAM,QAAQ;AAG7C,YAAM,MAAM,KAAK,UAAU,OAAO,MAAM,UAAU,OAAO;AACzD,UAAI,CAAC,OAAO,IAAI,WAAW,aAAa,MAAM,SAAU;AACxD,UAAI,IAAI,UAAU,YAAY,QAAS;AAMvC,UACE,MAAM,WAAW,aACjB,CAAC,IAAI,UAAU,SAAS,MAAM,QAAQ,GACtC;AACA,YAAI,UAAU,KAAK,MAAM,QAAQ;AAAA,MACnC;AAIA,UAAI,MAAM,eAAe,QAAW;AAClC,YAAI,aAAa;AAAA,UACf,GAAG,IAAI;AAAA,UACP,CAAC,MAAM,QAAQ,GAAG,MAAM;AAAA,QAC1B;AAAA,MACF;AACA,WAAK,SAAS,GAAG;AACjB,eAAS,KAAK,KAAK;AAAA,IACrB;AACA,WAAO,QAAQ,QAAQ,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAK,OAOH;AACA,UAAM,MAAM,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,KAAK,CAAC;AAC3D,QAAI,KAAK,WAAW,MAAM,QAAQ;AAChC,aAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AAAA,IACjD;AACA,QAAI,IAAI,UAAU,oBAAoB;AACpC,aAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,KAAK,IAAI,MAAM,CAAC;AAAA,IAChE;AACA,QAAI,UAAU,MAAM;AACpB,QAAI,QAAQ;AACZ,WAAO,IAAI;AACX,WAAO,QAAQ,QAAQ,EAAE,OAAO,IAAI,MAAM,CAAC;AAAA,EAC7C;AAAA;AAAA,EAGA,OAAO,OAA4D;AACjE,UAAM,MAAM,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,KAAK,CAAC;AAI3D,QAAI,KAAK,WAAW,MAAM,OAAQ,QAAO,QAAQ,QAAQ,KAAK;AAC9D,QAAI,YAAY;AAGhB,WAAO,QAAQ,QAAQ,IAAI;AAAA,EAC7B;AAAA;AAAA,EAGA,eAAe,UAAoC;AACjD,WAAO,QAAQ;AAAA,MACb,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,EACpB;AAAA,QACC,CAAC,QACC,IAAI,cAAc,QAAQ,IAAI,WAAW,aAAa;AAAA,MAC1D,EAIC,IAAI,CAAC,SAAS;AAAA,QACb,OAAO,IAAI;AAAA,QACX,SAAS,IAAI,WAAW,WAAW;AAAA,MACrC,EAAE,EACD,OAAO,CAAC,UAAU,MAAM,YAAY,EAAE;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAY,OAOf;AAID,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,UAAkD,CAAC;AACzD,UAAM,OAAgB,CAAC;AAEvB,eAAW,EAAE,OAAO,QAAQ,KAAK,MAAM,QAAQ;AAC7C,YAAM,MAAM,KAAK,UAAU,OAAO,MAAM,UAAU,OAAO;AACzD,YAAM,OAAO,KAAK;AAKlB,UACE,CAAC,OACD,MAAM,YAAY,WAClB,KAAK,aAAa,MAAM,UACxB;AACA,aAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAC5B;AAAA,MACF;AAGA,YAAM,YAAY,MAAM,MAAM;AAC9B,UAAI,YAAY,EAAE,GAAG,MAAM,gBAAgB,UAAU;AACrD,cAAQ,KAAK,EAAE,OAAO,UAAU,CAAC;AAAA,IACnC;AAKA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,KAAK,UAA2D;AACpE,UAAM,aAAa,MAAM,KAAK,IAAI;AAClC,UAAM,WAAW,KAAK,UAAU,IAAI,SAAS,QAAQ;AACrD,QAAI,UAAU;AACZ,eAAS,aAAa;AAMtB,eAAS,eAAe,SAAS;AAKjC,eAAS,WAAW,SAAS;AAC7B,aAAO;AAAA,IACT;AACA,UAAM,QAAkB,EAAE,GAAG,UAAU,WAAW;AAClD,SAAK,UAAU,IAAI,SAAS,UAAU,KAAK;AAC3C,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,UAAiD;AACxD,WAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,qBAAqB,UAAiC;AACpD,SAAK,UAAU,OAAO,QAAQ;AAC9B,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,WAAgC;AAC9B,WAAO,QAAQ,QAAQ,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAS,KAAsB;AAC7B,QAAI,QAAQ;AAGZ,QAAI,IAAI,UAAW,MAAK,SAAS,OAAO,IAAI,UAAU,OAAO;AAC7D,WAAO,IAAI;AACX,WAAO,IAAI;AACX,WAAO,IAAI;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAA8B;AAClC,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,WAAwB,CAAC;AAC/B,UAAM,UAAuB,CAAC;AAC9B,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AAgBrC,UAAI,IAAI,KAAK,cAAc,KAAK;AAC9B,aAAK,QAAQ,GAAG;AAChB,gBAAQ,KAAK,GAAG;AAChB;AAAA,MACF;AACA,UAAI,IAAI,UAAU,uBAAuB,IAAI,iBAAiB,MAAM,KAAK;AACvE,aAAK,SAAS,GAAG;AACjB,iBAAS,KAAK,GAAG;AAAA,MACnB;AACA,YAAM,QAAQ,IAAI;AAClB,UACE,UACC,IAAI,UAAU,WAAW,IAAI,UAAU,cACxC,MAAM,kBAAkB,KACxB;AACA,aAAK,SAAS,GAAG;AACjB,iBAAS,KAAK,GAAG;AAAA,MACnB;AAAA,IACF;AAGA,WAAO,CAAC,GAAG,UAAU,GAAG,OAAO;AAAA,EACjC;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,22 +1,8 @@
-import { R as RoutingStore } from './store-C7jG6b9m.js';
-export { A as AWAITING_PAYLOAD_MS, C as ClaimInput, G as Grant, H as HolderRefusal, P as Presence, a as RelayState, b as ReleaseReason, c as RoutedJob, d as RoutedState, r as routeKey } from './store-C7jG6b9m.js';
-import { SignedRoster, PublicIdentity, CapabilityMatrix } from '@byollm/protocol';
+import { PublicIdentity, CapabilityMatrix, ClaimedStub, SignedGrant } from '@byollm/protocol';
+import { R as RoutingStore } from './store-DPCLO12l.js';
+export { A as AWAITING_PAYLOAD_MS, C as ClaimInput, G as Grant, H as HolderRefusal, P as Presence, a as RelayState, b as ReleaseReason, c as RoutedJob, d as RoutedState, r as routeKey } from './store-DPCLO12l.js';
 import { z } from 'zod';
 
-declare function debugPage(state: RoutingStore, now: number, 
-/**
- * Asked whether each device's owner still consents — cloud_008 §2.3.
- *
- * The page used to read a `revoked` boolean off presence. That flag was a
- * stored copy of a fact the projection owns, and it is gone; the page asks
- * the authority instead, which is also the only thing that stays correct
- * when one daemon serves several sites.
- */
-routesFor?: {
-    siteId: string;
-    consents: (owner: string) => boolean;
-}): Promise<string>;
-
 /**
  * What the relay is told about the world — cloud_004 §14.
  *
@@ -177,15 +163,6 @@ declare const RelayFixture: z.ZodObject<{
         owner: z.ZodString;
         members: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>>;
-    signedRosters: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        owner: z.ZodString;
-        roster: z.ZodObject<{
-            owner: z.ZodString;
-            members: z.ZodArray<z.ZodString>;
-            issuedAt: z.ZodNumber;
-            signature: z.ZodString;
-        }, z.core.$strict>;
-    }, z.core.$strict>>>;
     revoked: z.ZodDefault<z.ZodArray<z.ZodObject<{
         owner: z.ZodString;
         siteId: z.ZodString;
@@ -261,14 +238,18 @@ declare class Projection {
      */
     sitesFor(owner: string): SiteRecord[];
     /**
-     * The signed roster for this owner, to hand over untouched — Amendment G.
+     * Which registered site owns this identity key id?
+     *
+     * A stub names its site by *key id* (Amendment A §A.3) so a daemon can
+     * check it against a pinned key without a lookup. A control plane knows
+     * sites by their account id. This is the one place that holds both, so it
+     * is the one place that joins them — a control plane asked to accept key
+     * ids would need its own copy of the registry.
      *
-     * Returned exactly as it arrived. There is no filtering, narrowing or
-     * merging here on purpose: any of those would be this relay having an
-     * opinion about membership, and the daemon would have no way to tell the
-     * opinion from the control plane's own words.
+     * `null` for a key id no registered site carries, which is a projection
+     * that is behind rather than a job that is wrong.
      */
-    signedRosterFor(owner: string): SignedRoster | undefined;
+    siteIdForKey(keyId: string): string | null;
     /**
      * May this owner's work move for this site, right now?
      *
@@ -487,6 +468,46 @@ declare class MemoryPairingCodes implements PairingCodes {
     drop(deviceCode: string): Promise<void>;
 }
 
+/**
+ * What the relay asks a control plane, as one named shape.
+ *
+ * Spelled out twice — here and on `RelayOptions` — until adding `siteKey`
+ * made one of them wrong and the build caught it. That was luck: the two are
+ * structurally compared, so a field added to the *caller's* copy alone would
+ * have been accepted silently and the grant would have carried nothing.
+ */
+type GrantAuthor = (input: {
+    readonly job: ClaimedStub;
+    /** The site's id in the control plane's namespace, for its policy read. */
+    readonly siteId: string;
+    /**
+     * The same site as the stub names it — the key id the device pinned.
+     *
+     * Carried, never derived. This is the value that gets signed, and the one a
+     * device can compare against `stub.site` without a lookup and without
+     * trusting the party that routed it.
+     */
+    readonly siteKey: string;
+    readonly purpose?: string;
+    readonly owner: string;
+    readonly runnerId: string;
+    readonly capabilities: CapabilityMatrix;
+}) => Promise<GrantDecision> | GrantDecision;
+
+declare function debugPage(state: RoutingStore, now: number, 
+/**
+ * Asked whether each device's owner still consents — cloud_008 §2.3.
+ *
+ * The page used to read a `revoked` boolean off presence. That flag was a
+ * stored copy of a fact the projection owns, and it is gone; the page asks
+ * the authority instead, which is also the only thing that stays correct
+ * when one daemon serves several sites.
+ */
+routesFor?: {
+    siteId: string;
+    consents: (owner: string) => boolean;
+}): Promise<string>;
+
 /**
  * `@byollm/relay` — the reference relay (cloud_004 §14).
  *
@@ -512,6 +533,30 @@ declare class MemoryPairingCodes implements PairingCodes {
  * able to read a payload is to change its types, which is a review someone
  * would have to justify rather than a line someone could slip in.
  */
+/**
+ * What a control plane answers when a relay asks about one job.
+ *
+ * Declared here rather than imported, and deliberately narrower than what
+ * `@byollm/control-plane` returns: a relay needs to know whether it got a
+ * grant and whether a refusal is forever, and nothing else. Stating only that
+ * keeps the two packages independent — a relay can be wired to any control
+ * plane, and the reference engine satisfies this by having more, not less.
+ *
+ * `reason` is for the log. The relay never branches on it, because a relay
+ * that acted differently per reason would be a second implementation of a
+ * policy it does not own.
+ */
+type GrantDecision = {
+    readonly granted: SignedGrant;
+    readonly declined?: undefined;
+} | {
+    readonly granted?: undefined;
+    readonly declined: {
+        /** Never offer this job to this device again. */
+        readonly permanent: boolean;
+        readonly reason?: string;
+    };
+};
 interface RelayOptions {
     /**
      * Which site this relay routes for.
@@ -519,15 +564,43 @@ interface RelayOptions {
      * One, in the skeleton. Multi-tenant routing is the closed piece
      * (cloud_004 §9), and it replaces this field rather than extending it.
      */
-    /** Consent and rosters, projected from the control plane. */
+    /** Consent and routing, projected from the control plane. */
     readonly fixture?: RelayFixture;
     /**
-     * The control plane's roster-signing public key — Amendment G.
+     * The control plane's grant-signing public key — Amendment J.
      *
-     * Handed to daemons at pairing. Public half only: this relay cannot sign a
-     * roster, which is what makes carrying one safe.
+     * Handed to daemons at pairing, and the thing every grant is checked
+     * against. Configuring it without {@link RelayOptions.authorGrant} is
+     * refused at construction: a device told to expect signed grants and then
+     * sent none refuses every job, and it would do so with no signal here.
      */
     readonly controlPlanePublic?: string | undefined;
+    /**
+     * Author a grant for one claimed job — Amendment J.
+     *
+     * **The relay asks; it does not decide.** Everything a grant asserts —
+     * whose job this is, whether they are still a member, which of the owner's
+     * services their mapping resolves to — is the control plane's knowledge,
+     * and this callback is the seam between the two. A relay wired to a
+     * deployment that has no control plane simply has no callback, and its
+     * devices serve their owners alone.
+     *
+     * Declining says whether the refusal is **permanent**, and that is the
+     * whole reason this returns a shape rather than `SignedGrant | undefined`.
+     * A relay releases a declined job, and a release can carry `refused`, which
+     * means never offer this job to this device again. "This person was removed
+     * from the team" is forever — removal stops queued claims, per hole 1.
+     * "Their mapping resolved to another of your machines" is emphatically not:
+     * marking that permanently would mean the job could never reach the device
+     * it was always meant for, and nothing would ever report it.
+     *
+     * The capability matrix is passed because resolution needs it — the control
+     * plane chooses from what this device actually advertised, never from a
+     * name it invented. Until byollm_016 Amendment L lands, "resolution" is the
+     * job's own selection or the device's default; after it, the user's
+     * per-purpose mapping. The seam does not change.
+     */
+    readonly authorGrant?: GrantAuthor;
     /** How long a claim is good for. */
     readonly leaseMs?: number;
     /** Injectable clock, so tests move time instead of sleeping. */
@@ -613,4 +686,4 @@ declare class Relay {
     handle(request: Request): Promise<Response>;
 }
 
-export { ConsentRecord, DeviceRecord, EMPTY_FIXTURE, MAX_OUTSTANDING_PAIRINGS, MemoryPairingCodes, PAIRING_BUSY_MESSAGE, PAIRING_CODE_TTL_MS, type PairingCodes, type PendingPairing, Projection, type PutResult, Relay, RelayFixture, RelayFixture as RelayFixtureSchema, type RelayOptions, RevocationRecord, RosterRecord, RoutingStore, SiteRecord, debugPage, newDeviceCode, newUserCode };
+export { ConsentRecord, DeviceRecord, EMPTY_FIXTURE, type GrantDecision, MAX_OUTSTANDING_PAIRINGS, MemoryPairingCodes, PAIRING_BUSY_MESSAGE, PAIRING_CODE_TTL_MS, type PairingCodes, type PendingPairing, Projection, type PutResult, Relay, RelayFixture, RelayFixture as RelayFixtureSchema, type RelayOptions, RevocationRecord, RosterRecord, RoutingStore, SiteRecord, debugPage, newDeviceCode, newUserCode };

package/dist/index.js

@@ -1,12 +1,15 @@
 import {
   AWAITING_PAYLOAD_MS,
+  RETRY_AFTER_MS,
   RelayState,
-  routeKey,
-  serviceKey
-} from "./chunk-XLWNHHLS.js";
+  routeKey
+} from "./chunk-C5GHCHAV.js";
 
 // src/index.ts
-import { checkProtocolVersion, declaredVersion } from "@byollm/protocol";
+import {
+  checkProtocolVersion,
+  declaredVersion
+} from "@byollm/protocol";
 
 // src/daemon-plane.ts
 import {
@@ -213,7 +216,7 @@ var DaemonPlane = class {
       sites: Object.fromEntries(
         sites.map((record) => [keyId(record.site.identity), record.site])
       ),
-      // The key every later roster is checked against — Amendment G. Sent
+      // The key every later grant is checked against — Amendment J. Sent
       // here and nowhere else: pairing is the ceremony where a human is
       // already deciding whether to trust this upstream, so a key learned
       // here rides a decision that has been made rather than inventing one.
@@ -312,7 +315,7 @@ var DaemonPlane = class {
       sites: Object.fromEntries(
         sites.map((record) => [keyId(record.site.identity), record.site])
       ),
-      // The key every later roster is checked against — Amendment G. Sent
+      // The key every later grant is checked against — Amendment J. Sent
       // here and nowhere else: pairing is the ceremony where a human is
       // already deciding whether to trust this upstream, so a key learned
       // here rides a decision that has been made rather than inventing one.
@@ -399,20 +402,15 @@ var DaemonPlane = class {
         runnerId: device.runnerId,
         owner: device.owner,
         device: device.device,
-        // Only the defaults. byollm_016 Phase B advertises every selectable
-        // service per kind — the menu — so a device may send several rows for
-        // one kind, and exactly one of them is the one an *unselected* job
-        // should reach. Taking every row here would put an unselected job on
-        // whichever service happened to sort first, which is the guess the
-        // whole withheld mechanism exists to refuse.
-        kinds: new Set(
-          request.capabilities.filter((c) => c.isDefault).map((c) => c.kind)
-        ),
-        // The whole menu, as pairs. A job that named a service reaches only a
-        // device advertising that exact (kind, service) — never a fallback.
-        serves: new Set(
-          request.capabilities.map((c) => serviceKey(c.kind, c.service))
-        ),
+        // Every kind this device can run, from any of its services.
+        //
+        // This used to send only the *defaults* — the rows an unselected job
+        // should reach — beside the whole menu as (kind, service) pairs. A
+        // job names no service now, so there is no menu to match against and
+        // no unselected case for a default to catch: a device answering a
+        // kind at all is a candidate, and which of its services runs the work
+        // is resolved from the person's mapping when the grant is signed.
+        kinds: new Set(request.capabilities.map((c) => c.kind)),
         // The projection, collapsed to data the store can match on — a
         // predicate does not travel, and a set of (site, owner) pairs is
         // what a route is (cloud_009 §3).
@@ -425,7 +423,58 @@ var DaemonPlane = class {
         max: request.max,
         leaseMs: this.#deps.leaseMs
       });
-      return ok({ jobs: granted, leaseMs: this.#deps.leaseMs });
+      const author = this.#deps.authorGrant;
+      if (author === void 0) {
+        return ok({ jobs: granted, leaseMs: this.#deps.leaseMs });
+      }
+      const withGrants = [];
+      const refused = [];
+      const returned = [];
+      for (const job of granted) {
+        const siteId = this.#deps.projection.siteIdForKey(job.site);
+        const decision = siteId === null ? (
+          // A stub naming a site this projection cannot place. Transient
+          // rather than permanent: the projection is what is behind, not
+          // the job.
+          { declined: { permanent: false, reason: "unknown-site" } }
+        ) : await author({
+          job,
+          siteId,
+          // Straight off the stub. A relay that computed this would be
+          // choosing which site a grant says it is for, which is the
+          // one thing the signature exists to take out of its hands.
+          siteKey: job.site,
+          // The site's own purpose, straight off the stub. A relay does
+          // not interpret it — it does not hold the manifest and does
+          // not hold the mapping; it carries the site's word to the one
+          // party that can join them.
+          ...job.purpose === void 0 ? {} : { purpose: job.purpose },
+          owner: device.owner,
+          runnerId: device.runnerId,
+          capabilities: request.capabilities
+        });
+        if (decision.granted === void 0) {
+          const lease = { jobId: job.id, leaseId: job.lease.id };
+          (decision.declined.permanent ? refused : returned).push(lease);
+          continue;
+        }
+        withGrants.push({ ...job, grant: decision.granted });
+      }
+      if (refused.length > 0) {
+        await this.#deps.state.releaseLeases({
+          runnerId: device.runnerId,
+          leases: refused,
+          reason: "refused"
+        });
+      }
+      if (returned.length > 0) {
+        await this.#deps.state.releaseLeases({
+          runnerId: device.runnerId,
+          leases: returned,
+          retryAfter: this.#deps.now() + RETRY_AFTER_MS
+        });
+      }
+      return ok({ jobs: withGrants, leaseMs: this.#deps.leaseMs });
     });
   }
   /**
@@ -503,7 +552,6 @@ var DaemonPlane = class {
           ])
         );
         const rotations = Object.keys(successions).length > 0 ? { successions } : {};
-        const roster = this.#deps.projection.signedRosterFor(device.owner);
         const awaitingConsent = pinned.filter(
           (record) => !this.#deps.projection.mayRouteFor(device.owner, record.siteId)
         ).map((record) => keyId(record.site.identity));
@@ -512,7 +560,6 @@ var DaemonPlane = class {
             sites,
             ...rotations,
             awaitingConsent,
-            ...roster === void 0 ? {} : { roster },
             cancel: [],
             lost: request.activeLeases.map((lease) => ({
               jobId: lease.jobId,
@@ -531,7 +578,6 @@ var DaemonPlane = class {
           sites,
           ...rotations,
           awaitingConsent,
-          ...roster === void 0 ? {} : { roster },
           cancel,
           lost,
           serverTime: now
@@ -640,7 +686,7 @@ import {
   MAX_SUCCESSION_CHAIN,
   Succession,
   PublicIdentity as PublicIdentity2,
-  SignedRoster
+  keyId as keyIdOf
 } from "@byollm/protocol";
 import { z as z2 } from "zod";
 var SiteRecord = z2.object({
@@ -717,10 +763,6 @@ var RosterRecord = z2.object({
   /** Members who may route to it. The owner is not implicitly a member. */
   members: z2.array(z2.string().min(1))
 }).strict();
-var SignedRosterRecord = z2.object({
-  owner: z2.string().min(1),
-  roster: SignedRoster
-}).strict();
 var DeviceRecord = z2.object({
   /** Who approved it. */
   owner: z2.string().min(1),
@@ -736,22 +778,6 @@ var RelayFixture = z2.object({
   consents: z2.array(ConsentRecord),
   devices: z2.array(DeviceRecord).default([]),
   rosters: z2.array(RosterRecord).default([]),
-  /**
-   * The same memberships, signed by the control plane — Amendment G.
-   *
-   * Carried, never read for a routing decision and never assembled here.
-   * `rosters` above is the relay's own advisory copy, which it uses to
-   * filter what a device may claim; this is a document the relay hands to a
-   * daemon untouched, and the daemon checks it against a key pinned at
-   * pairing.
-   *
-   * The two coexisting is the point of the ruling: **non-authorship, not
-   * opacity.** The relay may go on knowing who is on a roster — it needs to,
-   * to route — and simply stops being the party anybody trusts about it. A
-   * relay that edited this would be caught at the device; a relay that
-   * withholds it narrows the device, which is the denial it always had.
-   */
-  signedRosters: z2.array(SignedRosterRecord).default([]),
   /**
    * Routes that were revoked, as structured pairs.
    *
@@ -772,7 +798,6 @@ var EMPTY_FIXTURE = {
   consents: [],
   devices: [],
   rosters: [],
-  signedRosters: [],
   revoked: []
 };
 var Projection = class {
@@ -854,15 +879,21 @@ var Projection = class {
     return this.#fixture.sites.filter((site) => this.consentFor(owner, site.siteId) !== null).sort((a, b) => a.siteId < b.siteId ? -1 : 1);
   }
   /**
-   * The signed roster for this owner, to hand over untouched — Amendment G.
+   * Which registered site owns this identity key id?
    *
-   * Returned exactly as it arrived. There is no filtering, narrowing or
-   * merging here on purpose: any of those would be this relay having an
-   * opinion about membership, and the daemon would have no way to tell the
-   * opinion from the control plane's own words.
+   * A stub names its site by *key id* (Amendment A §A.3) so a daemon can
+   * check it against a pinned key without a lookup. A control plane knows
+   * sites by their account id. This is the one place that holds both, so it
+   * is the one place that joins them — a control plane asked to accept key
+   * ids would need its own copy of the registry.
+   *
+   * `null` for a key id no registered site carries, which is a projection
+   * that is behind rather than a job that is wrong.
    */
-  signedRosterFor(owner) {
-    return this.#fixture.signedRosters.find((row) => row.owner === owner)?.roster;
+  siteIdForKey(keyId3) {
+    return this.#fixture.sites.find(
+      (record) => keyIdOf(record.site.identity) === keyId3
+    )?.siteId ?? null;
   }
   /**
    * May this owner's work move for this site, right now?
@@ -1259,8 +1290,14 @@ var Relay = class {
       leaseMs: options.leaseMs ?? 6e4,
       pairingCodes: options.pairingCodes ?? new MemoryPairingCodes(() => this.#now()),
       ...options.verificationUrl === void 0 ? {} : { verificationUrl: options.verificationUrl },
-      ...options.controlPlanePublic === void 0 ? {} : { controlPlanePublic: options.controlPlanePublic }
+      ...options.controlPlanePublic === void 0 ? {} : { controlPlanePublic: options.controlPlanePublic },
+      ...options.authorGrant === void 0 ? {} : { authorGrant: options.authorGrant }
     });
+    if (options.controlPlanePublic !== void 0 && options.authorGrant === void 0) {
+      throw new Error(
+        "controlPlanePublic is set but authorGrant is not: devices would be told to expect signed grants that nothing here can produce, and would refuse every job"
+      );
+    }
     this.#site = new SitePlane({
       state: this.state,
       projection: this.projection,