@byollm/relay 0.1.0-alpha.90 → 0.1.0-alpha.92

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.90`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.92`) — under active development. Don't use this yet.**
 >
 > This is a walking skeleton. It routes real jobs between real daemons and real
 > sites, and it is the fixture byollm_009 freezes against — but it keeps its

package/dist/{chunk-TOLKQRTU.js → chunk-4ISUXCIO.js}

@@ -1,9 +1,13 @@
 // src/state.ts
 import { randomUUID } from "crypto";
 var AWAITING_PAYLOAD_MS = 1e4;
+var UNSEALED_PER_PAIR = 2;
 var SEAL_ATTEMPTS_BEFORE_EVICTION = 3;
 var RETRY_AFTER_MS = 3e4;
 var routeKey = (siteId, owner) => `${siteId}\0${owner}`;
+var CHURN_EXPIRIES = 6;
+var CHURN_WINDOW_MS = 5 * 6e4;
+var CHURN_QUIET_MS = 60 * 6e4;
 var keyOf = (siteId, jobId) => `${siteId}\0${jobId}`;
 var RelayState = class {
   /**
@@ -78,6 +82,39 @@ var RelayState = class {
       this.#byJobId.set(job.id, [job]);
     }
   }
+  /**
+   * Record an unsealed grant expiring, and report a pair that keeps doing it.
+   *
+   * Reported at the crossing rather than on every expiry after it, and then
+   * quiet for {@link CHURN_QUIET_MS} — a walk produces one of these every ten
+   * seconds, and an alert per expiry is an alert somebody filters.
+   *
+   * The callback is never awaited and its throw is swallowed: a report is
+   * evidence ABOUT the sweep, not part of it, and a mail server being down
+   * must not stop jobs being requeued.
+   */
+  #noteChurn(siteId, owner, now) {
+    const report = this.#churnReport;
+    if (report === void 0) return;
+    const pair = routeKey(siteId, owner);
+    const seen = [...this.#churn.get(pair) ?? [], now].filter(
+      (at) => now - at <= CHURN_WINDOW_MS
+    );
+    this.#churn.set(pair, seen);
+    if (seen.length < CHURN_EXPIRIES) return;
+    const told = this.#churnReported.get(pair);
+    if (told !== void 0 && now - told < CHURN_QUIET_MS) return;
+    this.#churnReported.set(pair, now);
+    try {
+      report({
+        siteId,
+        owner,
+        expiries: seen.length,
+        windowMs: CHURN_WINDOW_MS
+      });
+    } catch {
+    }
+  }
   #forget(job) {
     this.#jobs.delete(keyOf(job.siteId, job.id));
     const bare = (this.#byJobId.get(job.id) ?? []).filter((it) => it !== job);
@@ -85,10 +122,23 @@ var RelayState = class {
     else this.#byJobId.set(job.id, bare);
     if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);
   }
+  /**
+   * When each pair's unsealed grants expired, and when it was last reported.
+   *
+   * Timestamps rather than a counter, because the threshold is "inside a
+   * window" — a counter would have to be reset by something, and whatever
+   * reset it would be the thing to get wrong. Trimmed on write, so it holds
+   * at most a window's worth per pair.
+   */
+  #churn = /* @__PURE__ */ new Map();
+  #churnReported = /* @__PURE__ */ new Map();
   #presence = /* @__PURE__ */ new Map();
   #now;
+  /** Kept whole rather than destructured: B187's report seam lives on it. */
+  #churnReport;
   constructor(options = {}) {
     this.#now = options.now ?? Date.now;
+    this.#churnReport = options.onUnsealedChurn;
   }
   /** The one clock every deadline in this store is stamped from. */
   async now() {
@@ -160,10 +210,21 @@ var RelayState = class {
     const now = await this.now();
     await this.sweep();
     const granted = [];
+    const unsealed = /* @__PURE__ */ new Map();
+    for (const job of this.#jobs.values()) {
+      if (job.state !== "awaiting-payload") continue;
+      const pair = routeKey(job.siteId, job.stub.owner);
+      unsealed.set(pair, (unsealed.get(pair) ?? 0) + 1);
+    }
     for (const job of this.#jobs.values()) {
       if (granted.length >= input.max) break;
       if (job.state !== "queued") continue;
       if (!input.routes.has(routeKey(job.siteId, job.stub.owner))) continue;
+      if (job.reofferTo !== void 0 && job.reofferTo !== input.runnerId) {
+        continue;
+      }
+      const pair = routeKey(job.siteId, job.stub.owner);
+      if ((unsealed.get(pair) ?? 0) >= UNSEALED_PER_PAIR) continue;
       if (!input.kinds.has(job.stub.kind)) continue;
       if (job.refusedBy.includes(input.runnerId)) continue;
       if ((job.retryAfter?.[input.runnerId] ?? 0) > now) continue;
@@ -181,6 +242,7 @@ var RelayState = class {
         leaseExpiresAt: now + input.leaseMs
       };
       job.awaitingUntil = now + AWAITING_PAYLOAD_MS;
+      unsealed.set(pair, (unsealed.get(pair) ?? 0) + 1);
       this.#byLease.set(leaseId, job);
       granted.push({
         ...job.stub,
@@ -385,6 +447,9 @@ var RelayState = class {
         continue;
       }
       if (job.state === "awaiting-payload" && (job.awaitingUntil ?? 0) <= now) {
+        this.#noteChurn(job.siteId, job.stub.owner, now);
+        const abandonedBy = job.claimedBy?.runnerId;
+        if (abandonedBy !== void 0) job.reofferTo ??= abandonedBy;
         const attempts = (job.sealAttempts ?? 0) + 1;
         if (attempts >= SEAL_ATTEMPTS_BEFORE_EVICTION) {
           this.#forget(job);
@@ -407,9 +472,13 @@ var RelayState = class {
 
 export {
   AWAITING_PAYLOAD_MS,
+  UNSEALED_PER_PAIR,
   SEAL_ATTEMPTS_BEFORE_EVICTION,
   RETRY_AFTER_MS,
   routeKey,
+  CHURN_EXPIRIES,
+  CHURN_WINDOW_MS,
+  CHURN_QUIET_MS,
   RelayState
 };
-//# sourceMappingURL=chunk-TOLKQRTU.js.map
+//# sourceMappingURL=chunk-4ISUXCIO.js.map

package/dist/chunk-4ISUXCIO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/state.ts"],"sourcesContent":["import type {\n  CapabilityMatrix,\n  ClaimedStub,\n  JobStub,\n  PublicIdentity,\n  SealedEnvelope,\n  WithheldKind,\n} from \"@byollm/protocol\";\nimport { randomUUID } from \"node:crypto\";\nimport type { Grant, RoutingStore } from \"./store.js\";\n\n/**\n * The relay's routing state — byollm_009 §7, reachable at last.\n *\n * §7 described a state machine the direct plane could not produce. There, the\n * site and the upstream are the same party: it seals when it likes, and a job\n * is never claimed-but-unsealed. Here they are different parties, and the gap\n * between them is a state:\n *\n * ```\n * queued ──claim──▶ awaiting-payload ──sealed──▶ ready ──fetch──▶ running\n *    ▲                    │                                          │\n *    └────────────────────┘                                          ▼\n *      site never seals, or seals too late              ok | error | canceled\n * ```\n *\n * The relay cannot seal, so it cannot shortcut this. A payload is encrypted\n * to *the device that claimed it*, and nobody knows which device that is until\n * the claim happens — which is precisely why claim-then-fetch makes a blind\n * relay possible at all. The window is the price.\n *\n * ## What the relay holds, and what it cannot\n *\n * Stubs (metadata the site chose to publish), sealed envelopes it cannot open,\n * and public keys. There is no field on any type in this file that could hold\n * a private key or a plaintext, which is `RELAY_BLIND` expressed as a data\n * model rather than as a policy.\n */\n\n/** Where a routed job is. */\nexport type RoutedState =\n  \"queued\" | \"awaiting-payload\" | \"ready\" | \"running\" | \"done\";\n\n/**\n * How long a site has to seal after one of its jobs is claimed.\n *\n * **Distinct from the lease, and distinct from the job's TTL** — byollm_009\n * §7.1. Three clocks, three different questions:\n *\n * - the **TTL** asks how long the work is worth doing at all;\n * - the **lease** asks how long this device gets to run it;\n * - this asks how long we wait for a site that has gone away.\n *\n * Collapsing any pair of them looks harmless until a site restarts during a\n * deploy: with only a lease, the device sits politely holding a job whose\n * payload will never arrive, and the lease's whole minute is spent waiting on\n * a party that is not coming back. Short, because a site that is up answers in\n * milliseconds and a site that is down will not answer sooner for waiting.\n */\nexport const AWAITING_PAYLOAD_MS = 10_000;\n\n/**\n * How many devices wait for a payload before the hub gives up on the job —\n * B042.\n *\n * Three, matching the daemon's own patience, and for the same reason: a site\n * that is slow, restarting, or briefly unreachable deserves more than one\n * chance, and a site that is gone should not cost the whole fleet a turn\n * each. At {@link AWAITING_PAYLOAD_MS} apiece this is thirty seconds of\n * waiting before a job that nobody can complete is dropped.\n *\n * Dropped rather than marked terminal, exactly as a passed deadline is: the\n * relay is a router, the site holds the authoritative record, and a stub\n * nobody may run is not routing state. A daemon mid-flight learns through\n * `renewLeases`, which reports a job the store no longer holds as `lost`.\n */\n/**\n * How many grants one (site, owner) pair may hold UNSEALED at once — B187,\n * ruled 09-16.\n *\n * A site must be told which device claimed its job, because it seals the\n * payload to that device's public key — that is what lets a blind relay\n * exist at all. **The leak is the ratio, not the key**: nothing required a\n * site to complete a single job, so one that enqueued a thousand and sealed\n * none read a thousand device identities inside one\n * {@link AWAITING_PAYLOAD_MS} window.\n *\n * Keyed on the PAIR rather than on the site, and that is load-bearing twice\n * over. A flat per-site cap would throttle a real product to two in-flight\n * jobs across all its users. And the pair is already how consent is modelled\n * here — `routeKey(siteId, owner)` — so the cap is bounded by the same unit\n * the permission is.\n *\n * **It buys time, not secrecy.** Which device claims is deliberately random\n * (B194: ties are luck), so a patient site still samples a small fleet over\n * minutes. That is the point: minutes leave a signature, and\n * {@link RelayStateOptions.onUnsealedChurn} is what reads it.\n */\nexport const UNSEALED_PER_PAIR = 2;\n\nexport const SEAL_ATTEMPTS_BEFORE_EVICTION = 3;\n\n/**\n * How long a device waits before asking about a job it could not run — the\n * rate every transient refusal needs.\n *\n * **A transient needs a rate; a retry without a not-before is a spin.** A\n * release that is not `refused` requeues immediately and stays claimable by\n * the same device, which is right for a daemon saying \"not now, I am\n * restarting\" and catastrophic for a control plane saying \"that mapping\n * resolves to another of your machines\": the device re-claims at once, is\n * declined again, and the pair loops. Measured before it could happen —\n * twelve ticks produced twelve control-plane reads, which in a deployment is\n * twelve database queries for a job that was never going to run there.\n *\n * Thirty seconds is chosen against the only thing it delays: a person who\n * fixes a mapping and has work already queued. Half a minute is a wait\n * nobody notices, and one read per device per thirty seconds per stuck job is\n * a cost nobody notices either.\n *\n * Distinct from the three durations above it, and for a fourth kind of\n * reason: the TTL asks whether the work is still worth doing, the lease how\n * long this device gets, {@link AWAITING_PAYLOAD_MS} how long we wait for the\n * site — and this asks how long before we ask *this device* again.\n */\nexport const RETRY_AFTER_MS = 30_000;\n\n/** A job the relay is routing. Metadata and ciphertext, nothing else. */\n/** Why a daemon gave a job back. Only `refused` means \"not me, ever\". */\nexport type ReleaseReason =\n  \"shutdown\" | \"pause\" | \"revoked\" | \"backend-down\" | \"refused\";\n\nexport interface RoutedJob {\n  readonly id: string;\n  /** Which site enqueued it — the party that will be asked to seal. */\n  readonly siteId: string;\n  /**\n   * Everything the relay knows about the work, which is everything the site\n   * chose to publish and not one field more (byollm_009 §6).\n   */\n  readonly stub: JobStub;\n  state: RoutedState;\n  /** Set from the claim; the site seals to these keys. */\n  claimedBy?: {\n    readonly runnerId: string;\n    readonly owner: string;\n    readonly device: PublicIdentity;\n    readonly leaseId: string;\n    readonly leaseExpiresAt: number;\n  };\n  /** When {@link AWAITING_PAYLOAD_MS} runs out for this claim. */\n  awaitingUntil?: number;\n  /**\n   * How many devices have waited for this payload and not received it — B042.\n   *\n   * A job whose site never seals is offered, waited on, requeued, and offered\n   * again — to a different device each time. Every one of them does the same\n   * ten seconds of nothing, and none of them can tell that the last one\n   * already tried: the daemon's own patience is per-device by construction,\n   * so the fleet works through itself one machine at a time until the job's\n   * deadline, which can be an hour away.\n   *\n   * That is the poison at its source. **The daemon-side breaker (B041) stops\n   * one device looping; only the hub can stop the job.** Counted here rather\n   * than inferred from `awaitingUntil`, because a requeue clears that clock\n   * and the count has to survive it.\n   */\n  sealAttempts?: number;\n  /**\n   * The device an ABANDONED grant goes back to — B187's sticky re-offer,\n   * ruled 09-16.\n   *\n   * Set when an unsealed grant lapses, not at claim: a job nobody abandoned\n   * is free work for whoever asks, and that is the routing this product\n   * wants. Once a site has taken a grant and let it rot, the job is offered\n   * only to the device that already answered for it.\n   *\n   * **This is what turns \"slower and visible\" into \"closed\".** The cap bounds\n   * the rate; the churn report makes a walk noticeable; this removes the walk\n   * itself, because abandoning the same job repeatedly now reveals ONE\n   * identity instead of a fresh sample each window.\n   *\n   * Survives `#requeue` for the same reason `sealAttempts` does — the requeue\n   * is the thing it has to outlive.\n   *\n   * **The accepted edge (Todd, 09-16): a device that never comes back takes\n   * the job with it.** It is still evicted after\n   * {@link SEAL_ATTEMPTS_BEFORE_EVICTION}, so the queue does not fill with\n   * work nobody can reach; the site simply has to enqueue it again.\n   */\n  reofferTo?: string;\n  /**\n   * Runners that released this job with reason `refused` — cloud_008 §2.1.\n   *\n   * `REFUSAL_NOT_REOFFERED`, which the relay did not implement: it dropped\n   * `ReleaseRequest.reason` on the floor. The field's own docstring says why\n   * that is not cosmetic — an upstream cannot evaluate a daemon's *local*\n   * `named` allowlist, so it may legitimately offer work the daemon then\n   * declines, and without a record the two spin between claim and release\n   * forever. The direct plane has always kept this list.\n   */\n  refusedBy: string[];\n  /**\n   * Runners that may not be offered this job again *yet*, and from when.\n   *\n   * The middle ground {@link RoutingStore.releaseLeases} had no way to say.\n   * `refusedBy` is forever and a bare release is immediate; a control plane\n   * declining a job for a reason the world can change — an unfilled mapping\n   * slot, a resolution that named another machine, a store that was briefly\n   * unreachable — means neither. It means \"ask again later\", and later needs\n   * a number.\n   *\n   * Keyed by runner because it is a fact about a pairing, not about the job:\n   * the same job goes to another device immediately, which is the whole\n   * point of not marking it refused.\n   */\n  retryAfter?: Record<string, number>;\n  /**\n   * The site withdrew this job — cloud_008 §2.2.\n   *\n   * A flag rather than a state, because a cancelled job that a device is\n   * *running* is not finished: the daemon has to be told, abort its backend\n   * call and report `canceled`, and the ordinary `complete` path then closes\n   * it. Making it a state would strand the in-flight case between two\n   * machines' ideas of what happened.\n   */\n  cancelled?: boolean;\n  /** Sealed to the claiming device by the site. Opaque here. */\n  payload?: SealedEnvelope;\n  /** Sealed to the site by the device. Opaque here. */\n  result?: SealedEnvelope;\n  /**\n   * The result's clear-text discriminator — byollm_009 §6.1.\n   *\n   * The one outcome fact the relay is given, and the reason it is given:\n   * without it the relay cannot stop dispatching a finished job. A routing\n   * hint and never a fact — the *site* verifies it against the sealed\n   * outcome, because only the site can open the envelope. The relay acts on\n   * it and is entitled to be wrong; a lying daemon costs it a dispatch\n   * decision, not a security property.\n   */\n  disposition?: \"ok\" | \"error\" | \"canceled\";\n}\n\n/** A device the relay has seen recently. */\nexport interface Presence {\n  readonly runnerId: string;\n  readonly owner: string;\n  readonly device: PublicIdentity;\n  lastSeenAt: number;\n  /**\n   * What this machine last said it can run — cloud_009, 2026-08-24.\n   *\n   * **Capabilities are presence data.** They arrive on the same heartbeat as\n   * everything else here, they go stale at the same moment and for the same\n   * reason, and a machine that stops heartbeating has not stopped being able\n   * to run Llama — it has stopped being somewhere we can ask. Keeping them\n   * anywhere else would put capability truth outside the interface that owns\n   * presence, and every next consumer (a member's usable set, a dashboard's\n   * pulse, a degraded-state banner) would re-derive it from a different\n   * place. That is the two-owners shape this codebase keeps paying for.\n   *\n   * Empty is a real answer, not a missing one: it is a paired machine with no\n   * healthy backend, which is a legal state the whole connect-first ruling\n   * exists to make visible rather than refuse.\n   */\n  capabilities: CapabilityMatrix;\n  /**\n   * Kinds this machine is deliberately *not* advertising — byollm_016.\n   *\n   * Presence data for the same reason capabilities are, and stored beside\n   * them rather than derived: two services answering one kind with no\n   * `defaults` entry is a state only the daemon can see, and the hub cannot\n   * reconstruct it from the matrix — an absent kind and a withheld kind look\n   * identical there. Without this field the owner's page can say \"nothing\n   * serves llm.generate\", which is true and useless, instead of \"two services\n   * answer it and you have not chosen\", which is the sentence that ends with\n   * the owner doing something.\n   *\n   * Empty is the normal answer, and means every kind resolved.\n   */\n  withheld: readonly WithheldKind[];\n  // `revoked` is deliberately absent — cloud_008 §2.3.\n  //\n  // It was a boolean on the *runner*, written at heartbeat and read by\n  // nothing but the debug page. Enforcement had already moved to the\n  // projection, because enforcing on this flag made revocation depend on the\n  // client calling an endpoint: a daemon that simply never heartbeat went on\n  // claiming forever. What survived was the cache, which is a stored copy of\n  // a derived fact — this project's most-repeated bug, kept alive here as a\n  // display value.\n  //\n  // It is also a concept multi-tenancy cannot express. Revocation is a fact\n  // about an (owner, site) pair; a daemon serving two sites and revoked at\n  // one is not \"a revoked runner\", and a boolean on the device has nowhere to\n  // put the difference. Deleting it now is what stops cloud_009 inheriting a\n  // field it would have to contradict.\n}\n\n/**\n * What a routing store must do, expressed as operations — cloud_006 §3.2.\n *\n * Every method below is a **decision plus its write**, never a read the caller\n * follows with a mutation. That is the whole point, and it is the difference\n * between an interface a shared store can implement and one it cannot.\n *\n * `claim` is the specimen. It used to live in `DaemonPlane` as\n * `jobs()` → filter → mutate, which is atomic for exactly one reason: Node is\n * single-threaded and these Maps are local, so nothing runs between the read\n * and the write. Neither survives a store on a network, and\n * `packages/relay/test/two-replicas.test.ts` holds the resulting race as a\n * failing assertion.\n *\n * So the rule for anything added here: **if a caller has to read, decide, and\n * write back, the operation is in the wrong place.** Move the decision in.\n *\n * ## Why the projection does not come with it\n *\n * `claim` takes `owners: string[]` rather than a projection or a predicate.\n * A closure cannot travel to Valkey, and the projection replicates for free\n * from the control plane — so the caller collapses it with\n * `Projection.ownersRunnableBy` and hands over data the store can match on.\n * That keeps the store ignorant of consent, which is also what keeps it\n * replaceable.\n */\nexport interface ClaimInput {\n  readonly runnerId: string;\n  readonly owner: string;\n  readonly device: PublicIdentity;\n  /**\n   * The (site, owner) pairs this device may run work for — cloud_009 §3.\n   *\n   * **One set of pairs, not a set of sites and a set of owners.** Consent\n   * binds a user to a site, so the two cannot travel separately: a device\n   * whose owner consented to site A, serving a roster member who consented\n   * to site B, would have every element of both sets and no consented route\n   * between them. Two sets multiply; consent does not.\n   *\n   * Built by {@link Projection.routesFor} and matched with {@link routeKey},\n   * so the relay and a store in another repository agree on the encoding by\n   * calling the same function rather than by both spelling it out.\n   *\n   * This is the collapse that lets a claim stay one operation: a predicate\n   * cannot travel to a store over a network, and a set can.\n   */\n  readonly routes: ReadonlySet<string>;\n  /**\n   * Kinds this device can run — and that is now the whole of the match.\n   *\n   * A relay routes by kind and by consent; **which service answers is not its\n   * question**. A job names a purpose, a person's mapping names a service,\n   * and a control plane joins them at claim. A relay that filtered on the\n   * service would need the mapping, which is the one thing it is not supposed\n   * to hold.\n   *\n   * This carried a companion, `serves`, holding the (kind, service) pairs a\n   * device advertised, so a job naming a service reached only a device with\n   * it. Sites stopped naming services (Amendment L) and the field became wire\n   * nothing read — so it is gone rather than left for a reader to infer\n   * meaning from.\n   *\n   * The cost is stated plainly: a job may be offered to a device whose owner\n   * admits the person but whose machine their mapping did not name. The\n   * control plane declines it as not-here and it goes back with a\n   * {@link RETRY_AFTER_MS} wait, which is what that mechanism is for.\n   */\n  readonly kinds: ReadonlySet<string>;\n  readonly max: number;\n  readonly leaseMs: number;\n}\n\n/**\n * How a (site, owner) route is written, so two implementations agree.\n *\n * The same `\\u0000` the job key uses, for the same reason: it cannot appear\n * in a site id or an owner id, so this is a key rather than a parser.\n */\nexport const routeKey = (siteId: string, owner: string): string =>\n  `${siteId}\\u0000${owner}`;\n\n/**\n * Where the store's sense of time comes from — cloud_006 §3.4.\n *\n * **The store owns its clock; callers do not pass one.** Every deadline the\n * relay decides — a lease's expiry, the `awaiting-payload` window, what a\n * sweep considers due — is now stamped by one source, and it is the same\n * source that will later stamp them for every replica.\n *\n * It used to be a parameter. `claim` took `now`, `sweep` took `now`, and each\n * plane called its own `now()` before calling in — which is fine in one\n * process and is the recurring bug the moment there are two. A lease granted\n * by a pod whose clock runs fast is short; the same lease swept by a pod whose\n * clock runs slow outlives it. Nobody is wrong and the lease has no length.\n *\n * A Valkey-backed store returns `TIME` here, so the deadline and the sweep\n * that enforces it are read from the same server. The injected clock stays for\n * tests, which is what lets them move time instead of sleeping.\n *\n * **What deliberately does not use this**: request-signature freshness. That\n * is checked against the *local* clock on purpose — it is a question about the\n * caller's clock versus this process's, `MAX_CLOCK_SKEW_MS` already tolerates\n * two minutes of disagreement, and a network round trip to timestamp every\n * inbound request would be a cost with no property behind it.\n */\n/**\n * How often a pair may burn unsealed grants before it is worth a human's\n * attention — B187's other half, ruled 09-16.\n *\n * **The cap buys time; it does not buy secrecy.** Which device claims is\n * deliberately random (B194: ties are luck), so a patient site still samples a\n * small fleet over minutes. You cannot cap your way out of a slow walk — but\n * you can notice one, and this is the shape to notice: **an honest site never\n * gets here at all**, because it seals in about a round trip and the grant\n * never reaches {@link AWAITING_PAYLOAD_MS}.\n *\n * Six in five minutes is comfortably above the noise a flaky network makes and\n * far below what a walk produces — a pair burning its {@link\n * UNSEALED_PER_PAIR} slots every ten seconds passes this inside a minute.\n */\nexport const CHURN_EXPIRIES = 6;\nexport const CHURN_WINDOW_MS = 5 * 60_000;\n/** One report per pair per hour. An alert that repeats is an alert nobody reads. */\nexport const CHURN_QUIET_MS = 60 * 60_000;\n\n/** A pair burning grants without sealing them — B187. */\nexport interface UnsealedChurn {\n  readonly siteId: string;\n  readonly owner: string;\n  /** How many unsealed grants expired inside the window. */\n  readonly expiries: number;\n  readonly windowMs: number;\n}\n\nexport interface RelayStateOptions {\n  readonly now?: () => number | Promise<number>;\n  /**\n   * Told when a pair keeps claiming and not sealing — B187.\n   *\n   * A callback rather than an email, because this package is the open-source\n   * relay: where a report GOES is a deployment's business, and `support@` is\n   * one deployment's address. The hub wires this to mail; a self-hoster wires\n   * it to whatever they read.\n   *\n   * Deliberately minimal — scaffolding until the signal system replaces it.\n   */\n  readonly onUnsealedChurn?: (churn: UnsealedChurn) => void;\n}\n\n/** Why a lease-scoped operation was refused, in the caller's vocabulary. */\nexport type HolderRefusal =\n  | \"not-found\"\n  | \"not-holder\"\n  | \"stale-lease\"\n  | \"not-ready\"\n  /** The job already ended — V1-6. A replay must not reopen it. */\n  | \"terminal\";\n\n/**\n * In-memory routing state.\n *\n * Deliberately not durable. The skeleton proves the protocol, and the\n * production hub replaces this with the closed multi-tenant router behind the\n * same shape (cloud_004 §9). Anything a restart loses here is a job that\n * returns to its site's queue — which is the behaviour a lapsed lease already\n * has to produce, so nothing new needs to be true for this to be safe.\n */\n/**\n * A job's key: the site that published it, and the id that site chose.\n *\n * `\\u0000` cannot appear in either half, so this is a key rather than a\n * parser — cloud_009 §3, and the reason the Valkey layout uses a distinct\n * prefix rather than a suffix on the old one.\n */\nconst keyOf = (siteId: string, jobId: string): string =>\n  `${siteId}\\u0000${jobId}`;\n\nexport class RelayState implements RoutingStore {\n  /**\n   * Jobs by **(site, id)** — cloud_009 §3.\n   *\n   * A job id is a site's to choose, so two sites can choose the same one.\n   * Keyed by the bare id, the second site's enqueue returned the first\n   * site's job (cloud_008 finding 58), and the refusal that fixed it was a\n   * cross-tenant existence oracle. Keyed by the pair, the collision does not\n   * exist and there is nothing to refuse.\n   *\n   * `\\u0000` as the separator, because a site id is a uuid and a job id is\n   * whatever a site chose — including, one day, a string with a colon in it.\n   * A separator that cannot appear in either half is the difference between\n   * a key and a parser.\n   */\n  readonly #jobs = new Map<string, RoutedJob>();\n\n  /**\n   * Grants by lease id, so a holder-scoped call needs no site — §3.\n   *\n   * `takePayload`, `complete`, `releaseLeases` and `renewLeases` carry a\n   * `leaseId` the relay minted, which is unique across every site. That is\n   * what lets those four signatures stay as they are: the caller names the\n   * grant, and the grant names the job. A daemon never has to know a site id\n   * to answer for work it holds.\n   */\n  readonly #byLease = new Map<string, RoutedJob>();\n\n  /**\n   * Jobs by bare id, across sites — the refusal path.\n   *\n   * The lease index alone answers the happy case and gets the refusals\n   * wrong: a **stale** lease finds nothing, so `LEASE_HONORED`'s \"your grant\n   * ended\" becomes \"no such job\", and a daemon that was slow is told\n   * something untrue about the work it was doing. Distinguishing\n   * `not-found`, `not-holder` and `stale-lease` needs the job even when the\n   * lease named is over, and that is what this is for.\n   *\n   * A list rather than a single value: two sites may choose one id, which is\n   * the whole reason `#jobs` is keyed by the pair.\n   */\n  readonly #byJobId = new Map<string, RoutedJob[]>();\n\n  /**\n   * The job a holder-scoped call is about, without a site id.\n   *\n   * The exact grant first, and **checked against the job the caller named**:\n   * a lease id belonging to another job would otherwise hand over that job's\n   * payload to somebody holding a valid-looking grant. Then the same job held\n   * by this runner under an older grant, which is what `stale-lease` is.\n   *\n   * And then nothing — V1-8. There used to be a third step: any job with that\n   * id, which produced `not-holder` where an absent job produces `not-found`.\n   * Since job ids are chosen per site, a runner could name a bare id it had\n   * no relationship with and learn from the status code whether some *other*\n   * tenant had a job by that name. Finding 58's existence oracle, through the\n   * holder door.\n   *\n   * The distinction it bought was never acted on: a daemon abandons the work\n   * either way. So a caller now learns about jobs it holds or held, and about\n   * nothing else.\n   */\n  #grantFor(\n    jobId: string,\n    runnerId: string,\n    leaseId: string,\n  ): RoutedJob | undefined {\n    const exact = this.#byLease.get(leaseId);\n    if (exact?.id === jobId) return exact;\n    const candidates = this.#byJobId.get(jobId) ?? [];\n    return candidates.find((job) => job.claimedBy?.runnerId === runnerId);\n  }\n\n  #index(job: RoutedJob): void {\n    const bare = this.#byJobId.get(job.id);\n    if (bare) {\n      if (!bare.includes(job)) bare.push(job);\n    } else {\n      this.#byJobId.set(job.id, [job]);\n    }\n  }\n\n  /**\n   * Record an unsealed grant expiring, and report a pair that keeps doing it.\n   *\n   * Reported at the crossing rather than on every expiry after it, and then\n   * quiet for {@link CHURN_QUIET_MS} — a walk produces one of these every ten\n   * seconds, and an alert per expiry is an alert somebody filters.\n   *\n   * The callback is never awaited and its throw is swallowed: a report is\n   * evidence ABOUT the sweep, not part of it, and a mail server being down\n   * must not stop jobs being requeued.\n   */\n  #noteChurn(siteId: string, owner: string, now: number): void {\n    const report = this.#churnReport;\n    if (report === undefined) return;\n\n    const pair = routeKey(siteId, owner);\n    const seen = [...(this.#churn.get(pair) ?? []), now].filter(\n      (at) => now - at <= CHURN_WINDOW_MS,\n    );\n    this.#churn.set(pair, seen);\n    if (seen.length < CHURN_EXPIRIES) return;\n\n    const told = this.#churnReported.get(pair);\n    if (told !== undefined && now - told < CHURN_QUIET_MS) return;\n    this.#churnReported.set(pair, now);\n\n    try {\n      report({\n        siteId,\n        owner,\n        expiries: seen.length,\n        windowMs: CHURN_WINDOW_MS,\n      });\n    } catch {\n      /* A report that throws must not take the sweep with it. */\n    }\n  }\n\n  #forget(job: RoutedJob): void {\n    this.#jobs.delete(keyOf(job.siteId, job.id));\n    const bare = (this.#byJobId.get(job.id) ?? []).filter((it) => it !== job);\n    if (bare.length === 0) this.#byJobId.delete(job.id);\n    else this.#byJobId.set(job.id, bare);\n    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);\n  }\n  /**\n   * When each pair's unsealed grants expired, and when it was last reported.\n   *\n   * Timestamps rather than a counter, because the threshold is \"inside a\n   * window\" — a counter would have to be reset by something, and whatever\n   * reset it would be the thing to get wrong. Trimmed on write, so it holds\n   * at most a window's worth per pair.\n   */\n  readonly #churn = new Map<string, number[]>();\n  readonly #churnReported = new Map<string, number>();\n\n  readonly #presence = new Map<string, Presence>();\n  readonly #now: () => number | Promise<number>;\n  /** Kept whole rather than destructured: B187's report seam lives on it. */\n  readonly #churnReport: RelayStateOptions[\"onUnsealedChurn\"];\n\n  constructor(options: RelayStateOptions = {}) {\n    this.#now = options.now ?? Date.now;\n    this.#churnReport = options.onUnsealedChurn;\n  }\n\n  /** The one clock every deadline in this store is stamped from. */\n  async now(): Promise<number> {\n    return this.#now();\n  }\n\n  /**\n   * Take a stub for routing. The payload is not here and will not be.\n   *\n   * **Idempotent by job id, and that is a security property rather than a\n   * convenience.** Site-plane calls are authenticated by signature, and\n   * byollm_009 §4.2's argument for signing the request instead of a\n   * server-issued nonce rests entirely on every write being idempotent per the\n   * instance it names. This one was not: re-enqueueing a known id built a\n   * fresh `queued` job over the top of the old one, discarding a live claim,\n   * its lease and any payload the site had already sealed to a device. A\n   * replayed enqueue inside the two-minute freshness window was therefore a\n   * way to yank a job back from the machine running it — the `release` bug of\n   * §4.2, rediscovered on the other plane.\n   *\n   * So a known id returns what is already routing, unchanged. A site that\n   * restarts and republishes its queue is the normal case, and it must not\n   * disturb work in flight.\n   */\n  enqueue(input: {\n    id: string;\n    siteId: string;\n    stub: JobStub;\n  }): Promise<RoutedJob> {\n    // Idempotent by (site, id). The refusal that used to live here went with\n    // the collision it refused — cloud_009 §3.\n    const existing = this.#jobs.get(keyOf(input.siteId, input.id));\n    if (existing) return Promise.resolve(existing);\n    const job: RoutedJob = {\n      id: input.id,\n      siteId: input.siteId,\n      stub: input.stub,\n      state: \"queued\",\n      refusedBy: [],\n    };\n    this.#jobs.set(keyOf(job.siteId, job.id), job);\n    this.#index(job);\n    return Promise.resolve(job);\n  }\n\n  job(siteId: string, jobId: string): Promise<RoutedJob | undefined> {\n    return Promise.resolve(this.#jobs.get(keyOf(siteId, jobId)));\n  }\n\n  jobs(): Promise<RoutedJob[]> {\n    return Promise.resolve([...this.#jobs.values()]);\n  }\n\n  /** Jobs a site must seal for, right now. */\n  async awaiting(siteId: string): Promise<RoutedJob[]> {\n    return (await this.jobs()).filter(\n      (j) => j.siteId === siteId && j.state === \"awaiting-payload\",\n    );\n  }\n\n  /** Sealed results waiting to go home. */\n  async finished(siteId: string): Promise<RoutedJob[]> {\n    return (await this.jobs()).filter(\n      (j) =>\n        j.siteId === siteId && j.state === \"done\" && j.result !== undefined,\n    );\n  }\n\n  /**\n   * Claim work — one operation, because it has to be.\n   *\n   * Moved here wholesale from `DaemonPlane`, where it was a scan followed by\n   * per-job mutation. Nothing about the *decision* changed; what changed is\n   * that a store can now implement it, because the filter and the write are\n   * one call rather than a loop the caller drives.\n   *\n   * The order of the guards is worth preserving as-is when this becomes a Lua\n   * script: cheapest first, and `owners` last because it is the only one that\n   * needed the projection.\n   */\n  async claim(input: ClaimInput): Promise<ClaimedStub[]> {\n    const now = await this.now();\n    await this.sweep();\n\n    const granted: ClaimedStub[] = [];\n\n    /**\n     * How many grants each pair is already sitting on, unsealed — B187.\n     *\n     * Counted in a pass rather than kept in a counter. The claim path is\n     * already O(jobs) — the loop below visits every one — so this is the same\n     * order for no new state; a maintained tally would need claim, seal,\n     * requeue, forget and lease-expiry to agree for ever, and **one missed\n     * decrement would throttle that pair permanently while looking exactly\n     * like a quiet site.**\n     */\n    const unsealed = new Map<string, number>();\n    for (const job of this.#jobs.values()) {\n      if (job.state !== \"awaiting-payload\") continue;\n      const pair = routeKey(job.siteId, job.stub.owner);\n      unsealed.set(pair, (unsealed.get(pair) ?? 0) + 1);\n    }\n\n    for (const job of this.#jobs.values()) {\n      if (granted.length >= input.max) break;\n      if (job.state !== \"queued\") continue;\n      // The route, as one lookup, because consent is about the pair — a\n      // device whose owner consented to site A, serving a roster member who\n      // consented to site B, is in both a set of sites and a set of owners\n      // and has no consented route between them.\n      if (!input.routes.has(routeKey(job.siteId, job.stub.owner))) continue;\n      /**\n       * Already holding its share unsealed — B187. Left queued rather than\n       * refused: the site has consented and the work is legitimate, it is the\n       * RATE of unsealed grants that is bounded. The moment it seals one, the\n       * next claim takes this job.\n       */\n      /**\n       * Abandoned once, so it goes back only to the device that answered for\n       * it — B187's sticky re-offer.\n       *\n       * Checked before the cap, because a job this device may not have should\n       * not spend that device's budget on the way to being skipped.\n       */\n      if (job.reofferTo !== undefined && job.reofferTo !== input.runnerId) {\n        continue;\n      }\n      const pair = routeKey(job.siteId, job.stub.owner);\n      if ((unsealed.get(pair) ?? 0) >= UNSEALED_PER_PAIR) continue;\n      // By kind, and only by kind — Amendment L. Which of the owner's\n      // services answers is the control plane's, resolved from this person's\n      // mapping at claim; a relay that matched on it would need to hold the\n      // mapping, and holding it is what a relay must not do.\n      if (!input.kinds.has(job.stub.kind)) continue;\n      // Already declined by this device — `REFUSAL_NOT_REOFFERED`, §2.1.\n      if (job.refusedBy.includes(input.runnerId)) continue;\n      // Declined for something that may have changed since, but not yet.\n      if ((job.retryAfter?.[input.runnerId] ?? 0) > now) continue;\n      // Withdrawn by the site — §2.2. Cheap, and before every other check.\n      if (job.cancelled) continue;\n      // The relay's half of AUDIENCE_BOTH_SIDES. The daemon re-checks its own\n      // allowlist and may still refuse — this only ever narrows.\n\n      // `self` means the owner's own machines, and the route set cannot\n      // express that — cloud_008 §2.1.\n      //\n      // The routes are every (site, owner) this device may run for, which for\n      // a Team owner's machine includes every roster member. Correct for\n      // `public` and `named`, and wrong for\n      // `self`: a roster member's private job was offered to the owner's\n      // daemon, which refused it locally and released it, and the relay\n      // offered it straight back. The ping-pong was the visible symptom; the\n      // invisible one is that `self` — the audience a user picks *because*\n      // they want their own machine — was the audience the relay ignored.\n      if (job.stub.audience === \"private\" && job.stub.owner !== input.owner) {\n        continue;\n      }\n\n      // A UUID, not a readable composite. The direct plane's lease ids are\n      // UUIDs and the Supabase adapter's `lease_id` column is typed `uuid`, so\n      // a relay minting `lease_<job>_<time>` would route perfectly against a\n      // memory store and fail the moment a real site adopted the lease.\n      const leaseId = randomUUID();\n      job.state = \"awaiting-payload\";\n      job.claimedBy = {\n        runnerId: input.runnerId,\n        owner: input.owner,\n        device: input.device,\n        leaseId,\n        leaseExpiresAt: now + input.leaseMs,\n      };\n      // Not the lease: this bounds how long we wait for a *site*, not how long\n      // the device may work. byollm_009 §7.1's third clock.\n      job.awaitingUntil = now + AWAITING_PAYLOAD_MS;\n      /* This pair now holds one more unsealed grant, so a later job in the\n         same batch sees the cap — B187. Without it `max: 10` would hand a\n         non-sealing site ten devices in one call. */\n      unsealed.set(pair, (unsealed.get(pair) ?? 0) + 1);\n      // The grant is findable by its own id, which is how a holder-scoped\n      // call needs no site — cloud_009 §3.\n      this.#byLease.set(leaseId, job);\n\n      granted.push({\n        ...job.stub,\n        lease: {\n          id: leaseId,\n          runnerId: input.runnerId,\n          expiresAt: job.claimedBy.leaseExpiresAt,\n        },\n      });\n    }\n    return granted;\n  }\n\n  /**\n   * Hand over the sealed payload to the device that holds the lease.\n   *\n   * The read and the state transition are one operation for the same reason\n   * `claim` is: `running` must be set by whoever was told the envelope, or two\n   * replicas can both hand out the same work and both believe they were first.\n   */\n  takePayload(input: {\n    jobId: string;\n    runnerId: string;\n    leaseId: string;\n  }): Promise<{ envelope: SealedEnvelope } | { refused: HolderRefusal }> {\n    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);\n    if (!job) return Promise.resolve({ refused: \"not-found\" });\n    if (job.claimedBy?.runnerId !== input.runnerId) {\n      return Promise.resolve({ refused: \"not-holder\" });\n    }\n    // LEASE_HONORED per *instance*: a stale lease id names a grant that is\n    // over, and answering it would hand work to a previous holder.\n    if (job.claimedBy.leaseId !== input.leaseId) {\n      return Promise.resolve({ refused: \"stale-lease\" });\n    }\n    if (!job.payload) return Promise.resolve({ refused: \"not-ready\" });\n    // Only a job that is still running gets handed its payload — V1-6.\n    //\n    // The holder and lease checks pass for a job this runner finished\n    // moments ago, because completing does not end the grant. A replayed\n    // fetch then set `state = 'running'` on a **done** job: `finished()`\n    // stopped returning its result to the site, and the sweep requeued\n    // completed work as though the device had died holding it. A duplicate\n    // request undoing a finished job is the shape `RESULT_IDEMPOTENT` exists\n    // to forbid, arriving through the other door.\n    if (job.state !== \"ready\" && job.state !== \"running\") {\n      return Promise.resolve({ refused: \"terminal\" });\n    }\n    job.state = \"running\";\n    return Promise.resolve({ envelope: job.payload });\n  }\n\n  /**\n   * Record a finished job.\n   *\n   * `RESULT_IDEMPOTENT` lives here rather than in the caller: a replayed\n   * result must be a no-op decided by the same operation that would have\n   * written it, or two replicas can both decide they were the first.\n   */\n  complete(input: {\n    jobId: string;\n    runnerId: string;\n    leaseId: string;\n    envelope: SealedEnvelope;\n    disposition: \"ok\" | \"error\" | \"canceled\";\n  }): Promise<\n    | { accepted: boolean; duplicate?: boolean; state: RoutedState }\n    | { refused: HolderRefusal }\n  > {\n    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);\n    if (!job) return Promise.resolve({ refused: \"not-found\" });\n    if (job.claimedBy?.runnerId !== input.runnerId) {\n      return Promise.resolve({ refused: \"not-holder\" });\n    }\n    // Terminal before holder — cloud_008 §3.6, and the same order in all four\n    // stores.\n    //\n    // This file argued the opposite two days ago: that a result under a grant\n    // that ended is a different device's work arriving late rather than a\n    // replay, so the lease check should win. That is right for a job which is\n    // **not** terminal, and the two orders only ever disagree about a *done*\n    // job asked about under a stale grant — where \"already recorded\" is the\n    // more useful of two true statements, and \"your lease is stale\" invents a\n    // worry about an answer that is safely stored.\n    //\n    // The deciding argument is not comfort. byollm_009 §4's case for signing\n    // requests rather than issuing nonces rests on every write being\n    // idempotent per the instance it names, and on the direct plane\n    // `RESULT_IDEMPOTENT` was holding only because `complete` nulls the lease\n    // and the holder check tripped first. A MUST another MUST's security\n    // argument leans on cannot hold by coincidence.\n    //\n    // Scoped to the device that finished it: anyone else falls through to the\n    // holder check and gets the refusal they would get for a job that is not\n    // terminal, so a job id is not a terminality probe.\n    if (job.state === \"done\") {\n      const sameGrant = job.claimedBy.leaseId === input.leaseId;\n      return Promise.resolve(\n        sameGrant\n          ? { accepted: false, duplicate: true, state: job.state }\n          : { refused: \"stale-lease\" },\n      );\n    }\n    // LEASE_HONORED per instance — cloud_008 §1.4a.\n    if (job.claimedBy.leaseId !== input.leaseId) {\n      return Promise.resolve({ refused: \"stale-lease\" });\n    }\n    job.result = input.envelope;\n    job.disposition = input.disposition;\n    job.state = \"done\";\n    return Promise.resolve({ accepted: true, state: job.state });\n  }\n\n  /** Give back leases this runner holds, naming each grant it means. */\n  releaseLeases(input: {\n    runnerId: string;\n    leases: readonly { jobId: string; leaseId: string }[];\n    reason?: ReleaseReason;\n    retryAfter?: number;\n  }): Promise<string[]> {\n    const released: string[] = [];\n    for (const { jobId, leaseId } of input.leases) {\n      // Through the grant, like every other holder-scoped operation — the\n      // caller names a lease and this store no longer keys jobs by a bare id.\n      const job = this.#grantFor(jobId, input.runnerId, leaseId);\n      if (!job || job.claimedBy?.runnerId !== input.runnerId) continue;\n      if (job.claimedBy.leaseId !== leaseId) continue;\n      /**\n       * A finished job is finished — byollm-review 2026-08-27.\n       *\n       * Terminal **before** holder, the ordering `complete` already uses: a\n       * release naming a valid lease on a done job was flipping it back to\n       * `queued`. The recorded result survives on the row and becomes\n       * unreachable, because `finished()` filters on the state — so the site\n       * never collects it, the job is offered again, and somebody's hardware\n       * runs it a second time and overwrites the first answer.\n       *\n       * The daemon's own shutdown races exactly this. `shutdown()` snapshots\n       * the active leases while a job is finishing, the abort lands, and a\n       * release and a result for the same lease are in flight together. If\n       * the result wins, this used to undo it.\n       *\n       * `takePayload` got this guard at V1-6 and `complete` at cloud_008\n       * §3.6. This is the third holder-scoped door and it was the one left\n       * open — which is the argument for the contract case beside it: three\n       * doors, one rule, and the two that were shut were shut one at a time.\n       */\n      if (job.state === \"done\") continue;\n      // Recorded before the requeue, so the job goes back to the queue\n      // already knowing not to come back here. A daemon releasing for\n      // `shutdown` or `backend-down` is saying \"not now\"; `refused` is the\n      // only one that means \"not me, ever\" — the others must stay claimable\n      // by the same device or a restart would strand its own work.\n      if (\n        input.reason === \"refused\" &&\n        !job.refusedBy.includes(input.runnerId)\n      ) {\n        job.refusedBy.push(input.runnerId);\n      }\n      // Recorded before the requeue for the same reason the refusal is: the\n      // job goes back to the queue already knowing when it may come back\n      // here, rather than being claimable for the instant in between.\n      if (input.retryAfter !== undefined) {\n        job.retryAfter = {\n          ...job.retryAfter,\n          [input.runnerId]: input.retryAfter,\n        };\n      }\n      this.#requeue(job);\n      released.push(jobId);\n    }\n    return Promise.resolve(released);\n  }\n\n  /**\n   * Take a site's sealed payload for a claimed job.\n   *\n   * Refuses anything not `awaiting-payload`, which is what makes the timeout\n   * mean something: a late seal must not land on a claim that has moved.\n   */\n  seal(input: {\n    jobId: string;\n    siteId: string;\n    envelope: SealedEnvelope;\n  }): Promise<\n    | { state: RoutedState }\n    | { refused: \"not-found\" | \"too-late\"; was?: RoutedState }\n  > {\n    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));\n    if (job?.siteId !== input.siteId) {\n      return Promise.resolve({ refused: \"not-found\" });\n    }\n    if (job.state !== \"awaiting-payload\") {\n      return Promise.resolve({ refused: \"too-late\", was: job.state });\n    }\n    job.payload = input.envelope;\n    job.state = \"ready\";\n    delete job.awaitingUntil;\n    /* The site sealed, so the count of devices that waited in vain resets —\n       B042. It measures CONSECUTIVE failures to seal; without this it would\n       become a lifetime quota, and a job requeued twice for ordinary lease\n       lapses would be evicted for a payload problem it does not have. */\n    delete job.sealAttempts;\n    return Promise.resolve({ state: job.state });\n  }\n\n  /** {@link RoutingStore.cancel} — the site withdraws a job. */\n  cancel(input: { jobId: string; siteId: string }): Promise<boolean> {\n    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));\n    // Scoped to the caller's site for the same reason every other site-plane\n    // operation is: a site must not be able to cancel somebody else's work by\n    // guessing an id.\n    if (job?.siteId !== input.siteId) return Promise.resolve(false);\n    job.cancelled = true;\n    // Not deleted, and not requeued. If a device holds it, that device has to\n    // hear about it — which is what `cancelRequests` below is for.\n    return Promise.resolve(true);\n  }\n\n  /** {@link RoutingStore.cancelRequests} — cancelled jobs this runner holds. */\n  cancelRequests(runnerId: string): Promise<Grant[]> {\n    return Promise.resolve(\n      [...this.#jobs.values()]\n        .filter(\n          (job) =>\n            job.cancelled === true && job.claimedBy?.runnerId === runnerId,\n        )\n        // The grant, not the id — V1-3. Two sites may have chosen the same\n        // job id, and a daemon holding both cannot tell which of them a bare\n        // id means.\n        .map((job) => ({\n          jobId: job.id,\n          leaseId: job.claimedBy?.leaseId ?? \"\",\n        }))\n        .filter((grant) => grant.leaseId !== \"\"),\n    );\n  }\n\n  /** {@link RoutingStore.renewLeases} — extend what is still held, name what is not. */\n  async renewLeases(input: {\n    runnerId: string;\n    leases: readonly { jobId: string; leaseId: string }[];\n    leaseMs: number;\n  }): Promise<{\n    renewed: { jobId: string; expiresAt: number }[];\n    lost: Grant[];\n  }> {\n    // The store's clock, not the caller's — cloud_006 §3.4. A lease extended\n    // against one replica's `Date.now()` and swept against another's is a\n    // lease with no length.\n    const now = await this.now();\n    const renewed: { jobId: string; expiresAt: number }[] = [];\n    const lost: Grant[] = [];\n\n    for (const { jobId, leaseId } of input.leases) {\n      const job = this.#grantFor(jobId, input.runnerId, leaseId);\n      const held = job?.claimedBy;\n      // The lease id *and* the runner. A lease id is a UUID so the runner\n      // check is belt and braces, but \"this grant, held by you\" is the\n      // sentence every other operation in this file checks, and a renewal is\n      // the one that extends a hold rather than ending it.\n      if (\n        !job ||\n        held?.leaseId !== leaseId ||\n        held.runnerId !== input.runnerId\n      ) {\n        lost.push({ jobId, leaseId });\n        continue;\n      }\n      // Replaced rather than mutated: the grant is a readonly record, which\n      // is what stops any other operation here from quietly extending it.\n      const expiresAt = now + input.leaseMs;\n      job.claimedBy = { ...held, leaseExpiresAt: expiresAt };\n      renewed.push({ jobId, expiresAt });\n    }\n\n    // `awaitingUntil` is deliberately untouched. That clock bounds how long we\n    // wait for a *site* to seal, and a busy device has no bearing on it —\n    // byollm_009 §7.1's third clock stays third.\n    return { renewed, lost };\n  }\n\n  async seen(presence: Omit<Presence, \"lastSeenAt\">): Promise<Presence> {\n    const lastSeenAt = await this.now();\n    const existing = this.#presence.get(presence.runnerId);\n    if (existing) {\n      existing.lastSeenAt = lastSeenAt;\n      // Refreshed, not merged. The heartbeat re-sends the whole matrix every\n      // time precisely so a server never matches against a stale one, and a\n      // record that kept the union would keep advertising a backend the\n      // machine has since lost — which is worse than forgetting one it still\n      // has, because work would route to it.\n      existing.capabilities = presence.capabilities;\n      // Refreshed for the same reason and in the same breath: a kind that\n      // stopped being contended — because the owner chose a default, or one\n      // service went away — must stop being reported as withheld, or the page\n      // keeps asking for a decision that has already been made.\n      existing.withheld = presence.withheld;\n      return existing;\n    }\n    const fresh: Presence = { ...presence, lastSeenAt };\n    this.#presence.set(presence.runnerId, fresh);\n    return fresh;\n  }\n\n  presence(runnerId: string): Promise<Presence | undefined> {\n    return Promise.resolve(this.#presence.get(runnerId));\n  }\n\n  /**\n   * Lose a record, the way a real store does.\n   *\n   * A shared store drops presence for reasons this one never will — a TTL, a\n   * reschedule, a restart — and the interesting behaviour is what the relay\n   * does next. `ValkeyRoutingStore` has carried the same helper since\n   * finding 52; this is its memory twin, so the case can be written once\n   * against the implementation that is easy to reason about.\n   */\n  dropPresenceForTests(runnerId: string): Promise<void> {\n    this.#presence.delete(runnerId);\n    return Promise.resolve();\n  }\n\n  everyone(): Promise<Presence[]> {\n    return Promise.resolve([...this.#presence.values()]);\n  }\n\n  /**\n   * Return a job to the queue, forgetting the claim.\n   *\n   * The stub survives; nothing is lost. That is `LEASE_RECLAIMABLE` and it is\n   * why the awaiting-payload timeout is cheap to fire: the worst case is that\n   * a device did nothing for ten seconds and another one gets a turn.\n   */\n  #requeue(job: RoutedJob): void {\n    job.state = \"queued\";\n    // The grant ended; the index that names it must end with it, or a stale\n    // lease id resolves to a job it no longer holds.\n    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);\n    delete job.claimedBy;\n    delete job.awaitingUntil;\n    delete job.payload;\n    /* `sealAttempts` is deliberately NOT cleared. It counts how many devices\n       have waited on this job, and a requeue is exactly the event it counts —\n       clearing it here would reset the counter on every tick and the job\n       would be handed round forever, which is the bug B042 is about. */\n  }\n\n  /**\n   * Fire whatever the clock says is due, and report it.\n   *\n   * Returns the jobs it requeued so a caller can log or surface them — a\n   * timeout that fires invisibly is indistinguishable from a job that was\n   * never claimed, and those want very different debugging.\n   */\n  async sweep(): Promise<RoutedJob[]> {\n    const now = await this.now();\n    const requeued: RoutedJob[] = [];\n    const expired: RoutedJob[] = [];\n    for (const job of this.#jobs.values()) {\n      // Past its deadline — cloud_008 §2.2, and `TTL_EXPIRY` on this plane.\n      //\n      // The relay never read `stub.deadlineAt`. Not \"read it and got the\n      // arithmetic wrong\": the field travelled on every stub, byollm_009 §6\n      // describes it as the bound on how long a ciphertext is worth carrying,\n      // and nothing here ever looked at it. A job whose deadline passed went\n      // on being offered to devices forever, and its sealed payload sat in\n      // the relay for as long as the process lived.\n      //\n      // Dropped rather than marked terminal. The relay is a router and the\n      // site holds the authoritative record; a stub nobody may run is not\n      // routing state, and keeping a tombstone would be keeping the ciphertext\n      // with it. A daemon mid-flight learns through `renewLeases`, which\n      // reports a job the store no longer holds as `lost` — the path that\n      // already exists for a lease that ended.\n      if (job.stub.deadlineAt <= now) {\n        this.#forget(job);\n        expired.push(job);\n        continue;\n      }\n      if (job.state === \"awaiting-payload\" && (job.awaitingUntil ?? 0) <= now) {\n        /**\n         * Counted before it is requeued, and evicted once the count is spent\n         * — B042.\n         *\n         * The requeue is what makes this a fleet-wide problem rather than\n         * one device's: it puts the job back for somebody else to wait on.\n         * After three that is no longer patience, it is a queue handing the\n         * same dead job around.\n         */\n        /* A grant this pair took and did not seal — B187's signature. */\n        this.#noteChurn(job.siteId, job.stub.owner, now);\n        /* And from here it is that device's job or nobody's — the sticky\n           re-offer. Set before the requeue, which clears `claimedBy`. */\n        const abandonedBy = job.claimedBy?.runnerId;\n        if (abandonedBy !== undefined) job.reofferTo ??= abandonedBy;\n        const attempts = (job.sealAttempts ?? 0) + 1;\n        if (attempts >= SEAL_ATTEMPTS_BEFORE_EVICTION) {\n          this.#forget(job);\n          expired.push(job);\n          continue;\n        }\n        job.sealAttempts = attempts;\n        this.#requeue(job);\n        requeued.push(job);\n      }\n      const lease = job.claimedBy;\n      if (\n        lease &&\n        (job.state === \"ready\" || job.state === \"running\") &&\n        lease.leaseExpiresAt <= now\n      ) {\n        this.#requeue(job);\n        requeued.push(job);\n      }\n    }\n    // Both, because a caller that logs \"requeued\" and never mentions expiry\n    // would report a shrinking queue with no reason for it.\n    return [...requeued, ...expired];\n  }\n}\n"],"mappings":";AAQA,SAAS,kBAAkB;AAmDpB,IAAM,sBAAsB;AAuC5B,IAAM,oBAAoB;AAE1B,IAAM,gCAAgC;AAyBtC,IAAM,iBAAiB;AA4PvB,IAAM,WAAW,CAAC,QAAgB,UACvC,GAAG,MAAM,KAAS,KAAK;AAyClB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB,IAAI;AAE5B,IAAM,iBAAiB,KAAK;AAmDnC,IAAM,QAAQ,CAAC,QAAgB,UAC7B,GAAG,MAAM,KAAS,KAAK;AAElB,IAAM,aAAN,MAAyC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAerC,QAAQ,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWnC,WAAW,oBAAI,IAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAetC,WAAW,oBAAI,IAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBjD,UACE,OACA,UACA,SACuB;AACvB,UAAM,QAAQ,KAAK,SAAS,IAAI,OAAO;AACvC,QAAI,OAAO,OAAO,MAAO,QAAO;AAChC,UAAM,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC;AAChD,WAAO,WAAW,KAAK,CAAC,QAAQ,IAAI,WAAW,aAAa,QAAQ;AAAA,EACtE;AAAA,EAEA,OAAO,KAAsB;AAC3B,UAAM,OAAO,KAAK,SAAS,IAAI,IAAI,EAAE;AACrC,QAAI,MAAM;AACR,UAAI,CAAC,KAAK,SAAS,GAAG,EAAG,MAAK,KAAK,GAAG;AAAA,IACxC,OAAO;AACL,WAAK,SAAS,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;AAAA,IACjC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,WAAW,QAAgB,OAAe,KAAmB;AAC3D,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,OAAW;AAE1B,UAAM,OAAO,SAAS,QAAQ,KAAK;AACnC,UAAM,OAAO,CAAC,GAAI,KAAK,OAAO,IAAI,IAAI,KAAK,CAAC,GAAI,GAAG,EAAE;AAAA,MACnD,CAAC,OAAO,MAAM,MAAM;AAAA,IACtB;AACA,SAAK,OAAO,IAAI,MAAM,IAAI;AAC1B,QAAI,KAAK,SAAS,eAAgB;AAElC,UAAM,OAAO,KAAK,eAAe,IAAI,IAAI;AACzC,QAAI,SAAS,UAAa,MAAM,OAAO,eAAgB;AACvD,SAAK,eAAe,IAAI,MAAM,GAAG;AAEjC,QAAI;AACF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,UAAU,KAAK;AAAA,QACf,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,QAAQ,KAAsB;AAC5B,SAAK,MAAM,OAAO,MAAM,IAAI,QAAQ,IAAI,EAAE,CAAC;AAC3C,UAAM,QAAQ,KAAK,SAAS,IAAI,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,OAAO,GAAG;AACxE,QAAI,KAAK,WAAW,EAAG,MAAK,SAAS,OAAO,IAAI,EAAE;AAAA,QAC7C,MAAK,SAAS,IAAI,IAAI,IAAI,IAAI;AACnC,QAAI,IAAI,UAAW,MAAK,SAAS,OAAO,IAAI,UAAU,OAAO;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASS,SAAS,oBAAI,IAAsB;AAAA,EACnC,iBAAiB,oBAAI,IAAoB;AAAA,EAEzC,YAAY,oBAAI,IAAsB;AAAA,EACtC;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,UAA6B,CAAC,GAAG;AAC3C,SAAK,OAAO,QAAQ,OAAO,KAAK;AAChC,SAAK,eAAe,QAAQ;AAAA,EAC9B;AAAA;AAAA,EAGA,MAAM,MAAuB;AAC3B,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,QAAQ,OAIe;AAGrB,UAAM,WAAW,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC;AAC7D,QAAI,SAAU,QAAO,QAAQ,QAAQ,QAAQ;AAC7C,UAAM,MAAiB;AAAA,MACrB,IAAI,MAAM;AAAA,MACV,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM;AAAA,MACZ,OAAO;AAAA,MACP,WAAW,CAAC;AAAA,IACd;AACA,SAAK,MAAM,IAAI,MAAM,IAAI,QAAQ,IAAI,EAAE,GAAG,GAAG;AAC7C,SAAK,OAAO,GAAG;AACf,WAAO,QAAQ,QAAQ,GAAG;AAAA,EAC5B;AAAA,EAEA,IAAI,QAAgB,OAA+C;AACjE,WAAO,QAAQ,QAAQ,KAAK,MAAM,IAAI,MAAM,QAAQ,KAAK,CAAC,CAAC;AAAA,EAC7D;AAAA,EAEA,OAA6B;AAC3B,WAAO,QAAQ,QAAQ,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,CAAC;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,SAAS,QAAsC;AACnD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,MACzB,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,UAAU;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,SAAS,QAAsC;AACnD,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,MACzB,CAAC,MACC,EAAE,WAAW,UAAU,EAAE,UAAU,UAAU,EAAE,WAAW;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,MAAM,OAA2C;AACrD,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,KAAK,MAAM;AAEjB,UAAM,UAAyB,CAAC;AAYhC,UAAM,WAAW,oBAAI,IAAoB;AACzC,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AACrC,UAAI,IAAI,UAAU,mBAAoB;AACtC,YAAM,OAAO,SAAS,IAAI,QAAQ,IAAI,KAAK,KAAK;AAChD,eAAS,IAAI,OAAO,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,IAClD;AAEA,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AACrC,UAAI,QAAQ,UAAU,MAAM,IAAK;AACjC,UAAI,IAAI,UAAU,SAAU;AAK5B,UAAI,CAAC,MAAM,OAAO,IAAI,SAAS,IAAI,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAG;AAc7D,UAAI,IAAI,cAAc,UAAa,IAAI,cAAc,MAAM,UAAU;AACnE;AAAA,MACF;AACA,YAAM,OAAO,SAAS,IAAI,QAAQ,IAAI,KAAK,KAAK;AAChD,WAAK,SAAS,IAAI,IAAI,KAAK,MAAM,kBAAmB;AAKpD,UAAI,CAAC,MAAM,MAAM,IAAI,IAAI,KAAK,IAAI,EAAG;AAErC,UAAI,IAAI,UAAU,SAAS,MAAM,QAAQ,EAAG;AAE5C,WAAK,IAAI,aAAa,MAAM,QAAQ,KAAK,KAAK,IAAK;AAEnD,UAAI,IAAI,UAAW;AAenB,UAAI,IAAI,KAAK,aAAa,aAAa,IAAI,KAAK,UAAU,MAAM,OAAO;AACrE;AAAA,MACF;AAMA,YAAM,UAAU,WAAW;AAC3B,UAAI,QAAQ;AACZ,UAAI,YAAY;AAAA,QACd,UAAU,MAAM;AAAA,QAChB,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,QACd;AAAA,QACA,gBAAgB,MAAM,MAAM;AAAA,MAC9B;AAGA,UAAI,gBAAgB,MAAM;AAI1B,eAAS,IAAI,OAAO,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC;AAGhD,WAAK,SAAS,IAAI,SAAS,GAAG;AAE9B,cAAQ,KAAK;AAAA,QACX,GAAG,IAAI;AAAA,QACP,OAAO;AAAA,UACL,IAAI;AAAA,UACJ,UAAU,MAAM;AAAA,UAChB,WAAW,IAAI,UAAU;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,OAI2D;AACrE,UAAM,MAAM,KAAK,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AACrE,QAAI,CAAC,IAAK,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AACzD,QAAI,IAAI,WAAW,aAAa,MAAM,UAAU;AAC9C,aAAO,QAAQ,QAAQ,EAAE,SAAS,aAAa,CAAC;AAAA,IAClD;AAGA,QAAI,IAAI,UAAU,YAAY,MAAM,SAAS;AAC3C,aAAO,QAAQ,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,IACnD;AACA,QAAI,CAAC,IAAI,QAAS,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AAUjE,QAAI,IAAI,UAAU,WAAW,IAAI,UAAU,WAAW;AACpD,aAAO,QAAQ,QAAQ,EAAE,SAAS,WAAW,CAAC;AAAA,IAChD;AACA,QAAI,QAAQ;AACZ,WAAO,QAAQ,QAAQ,EAAE,UAAU,IAAI,QAAQ,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAS,OASP;AACA,UAAM,MAAM,KAAK,UAAU,MAAM,OAAO,MAAM,UAAU,MAAM,OAAO;AACrE,QAAI,CAAC,IAAK,QAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AACzD,QAAI,IAAI,WAAW,aAAa,MAAM,UAAU;AAC9C,aAAO,QAAQ,QAAQ,EAAE,SAAS,aAAa,CAAC;AAAA,IAClD;AAsBA,QAAI,IAAI,UAAU,QAAQ;AACxB,YAAM,YAAY,IAAI,UAAU,YAAY,MAAM;AAClD,aAAO,QAAQ;AAAA,QACb,YACI,EAAE,UAAU,OAAO,WAAW,MAAM,OAAO,IAAI,MAAM,IACrD,EAAE,SAAS,cAAc;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI,IAAI,UAAU,YAAY,MAAM,SAAS;AAC3C,aAAO,QAAQ,QAAQ,EAAE,SAAS,cAAc,CAAC;AAAA,IACnD;AACA,QAAI,SAAS,MAAM;AACnB,QAAI,cAAc,MAAM;AACxB,QAAI,QAAQ;AACZ,WAAO,QAAQ,QAAQ,EAAE,UAAU,MAAM,OAAO,IAAI,MAAM,CAAC;AAAA,EAC7D;AAAA;AAAA,EAGA,cAAc,OAKQ;AACpB,UAAM,WAAqB,CAAC;AAC5B,eAAW,EAAE,OAAO,QAAQ,KAAK,MAAM,QAAQ;AAG7C,YAAM,MAAM,KAAK,UAAU,OAAO,MAAM,UAAU,OAAO;AACzD,UAAI,CAAC,OAAO,IAAI,WAAW,aAAa,MAAM,SAAU;AACxD,UAAI,IAAI,UAAU,YAAY,QAAS;AAqBvC,UAAI,IAAI,UAAU,OAAQ;AAM1B,UACE,MAAM,WAAW,aACjB,CAAC,IAAI,UAAU,SAAS,MAAM,QAAQ,GACtC;AACA,YAAI,UAAU,KAAK,MAAM,QAAQ;AAAA,MACnC;AAIA,UAAI,MAAM,eAAe,QAAW;AAClC,YAAI,aAAa;AAAA,UACf,GAAG,IAAI;AAAA,UACP,CAAC,MAAM,QAAQ,GAAG,MAAM;AAAA,QAC1B;AAAA,MACF;AACA,WAAK,SAAS,GAAG;AACjB,eAAS,KAAK,KAAK;AAAA,IACrB;AACA,WAAO,QAAQ,QAAQ,QAAQ;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAK,OAOH;AACA,UAAM,MAAM,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,KAAK,CAAC;AAC3D,QAAI,KAAK,WAAW,MAAM,QAAQ;AAChC,aAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,CAAC;AAAA,IACjD;AACA,QAAI,IAAI,UAAU,oBAAoB;AACpC,aAAO,QAAQ,QAAQ,EAAE,SAAS,YAAY,KAAK,IAAI,MAAM,CAAC;AAAA,IAChE;AACA,QAAI,UAAU,MAAM;AACpB,QAAI,QAAQ;AACZ,WAAO,IAAI;AAKX,WAAO,IAAI;AACX,WAAO,QAAQ,QAAQ,EAAE,OAAO,IAAI,MAAM,CAAC;AAAA,EAC7C;AAAA;AAAA,EAGA,OAAO,OAA4D;AACjE,UAAM,MAAM,KAAK,MAAM,IAAI,MAAM,MAAM,QAAQ,MAAM,KAAK,CAAC;AAI3D,QAAI,KAAK,WAAW,MAAM,OAAQ,QAAO,QAAQ,QAAQ,KAAK;AAC9D,QAAI,YAAY;AAGhB,WAAO,QAAQ,QAAQ,IAAI;AAAA,EAC7B;AAAA;AAAA,EAGA,eAAe,UAAoC;AACjD,WAAO,QAAQ;AAAA,MACb,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC,EACpB;AAAA,QACC,CAAC,QACC,IAAI,cAAc,QAAQ,IAAI,WAAW,aAAa;AAAA,MAC1D,EAIC,IAAI,CAAC,SAAS;AAAA,QACb,OAAO,IAAI;AAAA,QACX,SAAS,IAAI,WAAW,WAAW;AAAA,MACrC,EAAE,EACD,OAAO,CAAC,UAAU,MAAM,YAAY,EAAE;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,YAAY,OAOf;AAID,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,UAAkD,CAAC;AACzD,UAAM,OAAgB,CAAC;AAEvB,eAAW,EAAE,OAAO,QAAQ,KAAK,MAAM,QAAQ;AAC7C,YAAM,MAAM,KAAK,UAAU,OAAO,MAAM,UAAU,OAAO;AACzD,YAAM,OAAO,KAAK;AAKlB,UACE,CAAC,OACD,MAAM,YAAY,WAClB,KAAK,aAAa,MAAM,UACxB;AACA,aAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAC5B;AAAA,MACF;AAGA,YAAM,YAAY,MAAM,MAAM;AAC9B,UAAI,YAAY,EAAE,GAAG,MAAM,gBAAgB,UAAU;AACrD,cAAQ,KAAK,EAAE,OAAO,UAAU,CAAC;AAAA,IACnC;AAKA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAAA,EAEA,MAAM,KAAK,UAA2D;AACpE,UAAM,aAAa,MAAM,KAAK,IAAI;AAClC,UAAM,WAAW,KAAK,UAAU,IAAI,SAAS,QAAQ;AACrD,QAAI,UAAU;AACZ,eAAS,aAAa;AAMtB,eAAS,eAAe,SAAS;AAKjC,eAAS,WAAW,SAAS;AAC7B,aAAO;AAAA,IACT;AACA,UAAM,QAAkB,EAAE,GAAG,UAAU,WAAW;AAClD,SAAK,UAAU,IAAI,SAAS,UAAU,KAAK;AAC3C,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,UAAiD;AACxD,WAAO,QAAQ,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,qBAAqB,UAAiC;AACpD,SAAK,UAAU,OAAO,QAAQ;AAC9B,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAAA,EAEA,WAAgC;AAC9B,WAAO,QAAQ,QAAQ,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,SAAS,KAAsB;AAC7B,QAAI,QAAQ;AAGZ,QAAI,IAAI,UAAW,MAAK,SAAS,OAAO,IAAI,UAAU,OAAO;AAC7D,WAAO,IAAI;AACX,WAAO,IAAI;AACX,WAAO,IAAI;AAAA,EAKb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAA8B;AAClC,UAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,UAAM,WAAwB,CAAC;AAC/B,UAAM,UAAuB,CAAC;AAC9B,eAAW,OAAO,KAAK,MAAM,OAAO,GAAG;AAgBrC,UAAI,IAAI,KAAK,cAAc,KAAK;AAC9B,aAAK,QAAQ,GAAG;AAChB,gBAAQ,KAAK,GAAG;AAChB;AAAA,MACF;AACA,UAAI,IAAI,UAAU,uBAAuB,IAAI,iBAAiB,MAAM,KAAK;AAWvE,aAAK,WAAW,IAAI,QAAQ,IAAI,KAAK,OAAO,GAAG;AAG/C,cAAM,cAAc,IAAI,WAAW;AACnC,YAAI,gBAAgB,OAAW,KAAI,cAAc;AACjD,cAAM,YAAY,IAAI,gBAAgB,KAAK;AAC3C,YAAI,YAAY,+BAA+B;AAC7C,eAAK,QAAQ,GAAG;AAChB,kBAAQ,KAAK,GAAG;AAChB;AAAA,QACF;AACA,YAAI,eAAe;AACnB,aAAK,SAAS,GAAG;AACjB,iBAAS,KAAK,GAAG;AAAA,MACnB;AACA,YAAM,QAAQ,IAAI;AAClB,UACE,UACC,IAAI,UAAU,WAAW,IAAI,UAAU,cACxC,MAAM,kBAAkB,KACxB;AACA,aAAK,SAAS,GAAG;AACjB,iBAAS,KAAK,GAAG;AAAA,MACnB;AAAA,IACF;AAGA,WAAO,CAAC,GAAG,UAAU,GAAG,OAAO;AAAA,EACjC;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { PublicIdentity, CapabilityMatrix, ClaimedStub, SignedGrant } from '@byollm/protocol';
-import { R as RoutingStore } from './store-DLf0gPOY.js';
-export { A as AWAITING_PAYLOAD_MS, C as ClaimInput, G as Grant, H as HolderRefusal, P as Presence, a as RelayState, b as ReleaseReason, c as RoutedJob, d as RoutedState, S as SEAL_ATTEMPTS_BEFORE_EVICTION, r as routeKey } from './store-DLf0gPOY.js';
+import { R as RoutingStore, U as UnsealedChurn } from './store-BNhCedHZ.js';
+export { A as AWAITING_PAYLOAD_MS, C as CHURN_EXPIRIES, a as CHURN_QUIET_MS, b as CHURN_WINDOW_MS, c as ClaimInput, G as Grant, H as HolderRefusal, P as Presence, d as RelayState, e as ReleaseReason, f as RoutedJob, g as RoutedState, S as SEAL_ATTEMPTS_BEFORE_EVICTION, h as UNSEALED_PER_PAIR, r as routeKey } from './store-BNhCedHZ.js';
 import { z } from 'zod';
 
 /**
@@ -657,6 +657,20 @@ interface RelayOptions {
      * per-purpose mapping. The seam does not change.
      */
     readonly authorGrant?: GrantAuthor;
+    /**
+     * Told when a site keeps claiming grants and never sealing them — B187.
+     *
+     * The cap bounds how fast a site can be handed device identities; this is
+     * how anybody finds out it is trying. **An honest site never produces this
+     * shape** — it seals in about a round trip, long before a grant lapses —
+     * so the signal is worth waking somebody for.
+     *
+     * A callback, not an address: where a report goes is a deployment's
+     * business. The hosted hub mails it; a self-hoster wires whatever they
+     * read. Only consulted when this relay owns its own store — a deployment
+     * passing `store` wires the report on that store instead.
+     */
+    readonly onUnsealedChurn?: (churn: UnsealedChurn) => void;
     /** How long a claim is good for. */
     readonly leaseMs?: number;
     /** Injectable clock, so tests move time instead of sleeping. */
@@ -742,4 +756,4 @@ declare class Relay {
     handle(request: Request): Promise<Response>;
 }
 
-export { ConsentRecord, DeviceRecord, EMPTY_FIXTURE, type GrantDecision, MAX_OUTSTANDING_PAIRINGS, MemoryPairingCodes, PAIRING_BUSY_MESSAGE, PAIRING_CODE_TTL_MS, type PairingCodes, type PendingPairing, Projection, type PutResult, Relay, RelayFixture, RelayFixture as RelayFixtureSchema, type RelayOptions, RevocationRecord, RosterRecord, RoutingStore, SiteRecord, debugPage, newDeviceCode, newUserCode };
+export { ConsentRecord, DeviceRecord, EMPTY_FIXTURE, type GrantDecision, MAX_OUTSTANDING_PAIRINGS, MemoryPairingCodes, PAIRING_BUSY_MESSAGE, PAIRING_CODE_TTL_MS, type PairingCodes, type PendingPairing, Projection, type PutResult, Relay, RelayFixture, RelayFixture as RelayFixtureSchema, type RelayOptions, RevocationRecord, RosterRecord, RoutingStore, SiteRecord, UnsealedChurn, debugPage, newDeviceCode, newUserCode };

package/dist/index.js

@@ -1,10 +1,14 @@
 import {
   AWAITING_PAYLOAD_MS,
+  CHURN_EXPIRIES,
+  CHURN_QUIET_MS,
+  CHURN_WINDOW_MS,
   RETRY_AFTER_MS,
   RelayState,
   SEAL_ATTEMPTS_BEFORE_EVICTION,
+  UNSEALED_PER_PAIR,
   routeKey
-} from "./chunk-TOLKQRTU.js";
+} from "./chunk-4ISUXCIO.js";
 
 // src/index.ts
 import {
@@ -1401,7 +1405,10 @@ var Relay = class {
   #basePath;
   #debug;
   constructor(options) {
-    this.state = options.store ?? new RelayState({ now: options.now ?? Date.now });
+    this.state = options.store ?? new RelayState({
+      now: options.now ?? Date.now,
+      ...options.onUnsealedChurn === void 0 ? {} : { onUnsealedChurn: options.onUnsealedChurn }
+    });
     this.projection = new Projection(options.fixture);
     this.#now = options.now ?? Date.now;
     this.#basePath = (options.basePath ?? "/byollm").replace(/\/+$/, "");
@@ -1560,6 +1567,9 @@ var json = (result) => new Response(JSON.stringify(result.body), {
 });
 export {
   AWAITING_PAYLOAD_MS,
+  CHURN_EXPIRIES,
+  CHURN_QUIET_MS,
+  CHURN_WINDOW_MS,
   ConsentRecord,
   DeviceRecord,
   EMPTY_FIXTURE,
@@ -1575,6 +1585,7 @@ export {
   RosterRecord,
   SEAL_ATTEMPTS_BEFORE_EVICTION,
   SiteRecord,
+  UNSEALED_PER_PAIR,
   debugPage,
   newDeviceCode,
   newUserCode,