@serve.zone/dcrouter 18.9.2 → 18.9.4

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '18.9.2',
+    version: '18.9.4',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsc0JBQXNCO0lBQzVCLE9BQU8sRUFBRSxRQUFRO0lBQ2pCLFdBQVcsRUFBRSwwRUFBMEU7Q0FDeEYsQ0FBQSJ9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "18.9.2",
+  "version": "18.9.4",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {
@@ -18,12 +18,13 @@
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsbundle": "^2.13.0",
     "@git.zone/tsdeno": "^1.7.0",
-    "@git.zone/tsdocker": "^3.5.2",
+    "@git.zone/tsdocker": "^3.5.4",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "^4.0.0",
     "@git.zone/tswatch": "^3.3.5",
     "@push.rocks/smartdb-v2": "npm:@push.rocks/smartdb@2.14.6",
-    "@types/node": "26.3.0",
+    "@push.rocks/smartdb-v5.2": "npm:@push.rocks/smartdb@5.2.2",
+    "@types/node": "26.4.1",
     "@types/web-push": "3.6.4"
   },
   "dependencies": {
@@ -34,15 +35,15 @@
     "@apiclient.xyz/cloudflare": "^8.0.0",
     "@design.estate/dees-catalog": "^3.104.0",
     "@design.estate/dees-element": "^2.4.0",
-    "@idp.global/sdk": "^15.0.1",
+    "@idp.global/sdk": "^16.0.0",
     "@push.rocks/lik": "^6.4.1",
     "@push.rocks/projectinfo": "^5.1.0",
     "@push.rocks/qenv": "^6.1.4",
     "@push.rocks/smartacme": "^9.5.0",
     "@push.rocks/smartbucket": "^4.13.0",
     "@push.rocks/smartchallenge": "^1.1.0",
-    "@push.rocks/smartdata": "^7.4.0",
-    "@push.rocks/smartdb": "5.2.2",
+    "@push.rocks/smartdata": "^11.9.0",
+    "@push.rocks/smartdb": "5.5.2",
     "@push.rocks/smartdns": "^8.2.1",
     "@push.rocks/smartfs": "^1.7.0",
     "@push.rocks/smartguard": "^3.1.2",
@@ -55,7 +56,7 @@
     "@push.rocks/smartnetwork": "^4.10.1",
     "@push.rocks/smartpath": "^6.0.0",
     "@push.rocks/smartpromise": "^4.2.5",
-    "@push.rocks/smartproxy": "^27.20.0",
+    "@push.rocks/smartproxy": "^27.21.0",
     "@push.rocks/smartradius": "^1.3.0",
     "@push.rocks/smartrequest": "^5.0.4",
     "@push.rocks/smartrx": "^3.0.12",
@@ -66,7 +67,7 @@
     "@push.rocks/taskbuffer": "^8.0.2",
     "@serve.zone/catalog": "^2.21.1",
     "@serve.zone/interfaces": "^27.3.1",
-    "@serve.zone/remoteingress": "^5.2.4",
+    "@serve.zone/remoteingress": "^5.2.5",
     "@tsclass/tsclass": "^9.5.1",
     "@types/qrcode": "^1.5.6",
     "ipaddr.js": "^2.5.0",

package/readme.hints.md

@@ -1,5 +1,77 @@
 # Implementation Hints and Learnings
 
+## Bounded metrics and owned delegation probes (2026-09-05)
+
+`MetricsCache` has separate aggregate and snapshot LRU stores: 256 aggregate
+keys, 64 snapshot keys, and an 8 MiB estimated payload budget per store. The
+estimate includes keys and nested payloads; it is not a process heap limit.
+Idle entries expire without another request. Snapshot APIs retain their existing
+1,000-record page limit; an oversized page is returned without being cached.
+The facade admits at most 32 computations, including invalidated work that has
+not settled. Saturation uses the existing TypedRequest error envelope with
+`code: METRICS_CAPACITY` and `retryAfterMs: 500`. Callers retain the last displayed
+result and use their normal polling interval. Stop clears caches and awaits
+admitted work; stopped-generation completions cannot repopulate a cache.
+
+Authentication statistics share a separate one-second cache with eight keys
+and eight active computations. Recording an event only changes memory and
+invalidates derived results; it does not put database I/O on authentication's
+recording path. Event arrival, actual flushes, pruning, database availability
+changes, and reset invalidate the statistics cache. MetricsManager still owns
+the final durable flush during shutdown.
+
+AuthenticationEventDoc uses SmartData 11.9's bounded insert-if-absent batch API
+so a flush retry preserves the complete first event body and timestamps. Window
+statistics use one grouped count plus a sorted bounded page, both with five-second
+server/client deadlines; both queries drain before the computation settles.
+Buffered-ID checks and prune selection use bounded public offset pages. Pruning
+deletes at most 500 selected identities per request behind the same cutoff.
+The authentication and email-traffic model declarations use the exact index
+names already owned by the monitoring migration; no stored-data or index rename
+is required. SDK 16 accepts the same SmartData major for persisted admin accounts.
+
+SmartData 8 and later omit undefined values on save. Explicit settings clears
+therefore use model-owned atomic updates with `$unset`: staged DKIM promotion,
+domain edge pins, final email-port settings, hub performance, edge public
+identities, DNS provider errors, and VPN static-IP/VLAN settings. Reload tests
+cover these transitions. Legacy stored nulls remain readable as absent optional
+values. Omitted patch fields do not request removal.
+
+Delegation probes coalesce by canonical zone and admit at most 32 owned DNS
+clients. Every outcome awaits client termination. Failed termination retains
+ownership so shutdown can retry and report failure; stop never silently forgets
+a live helper. Probe clients use bounded DoH requests without fallback.
+
+## SmartDB 5.2.2 to 5.5.2 rollback qualification (2026-09-05)
+
+`test/test.smartdb-rollback.node.ts` runs both published engine versions in
+isolated processes through public SmartData and SmartDB maintenance APIs. It
+checks a clean 5.2.2 checkpoint, a 5.5.2 write, clean reopening with 5.2.2, and
+restoring the checkpoint followed by importing the post-upgrade canonical
+export. Document/index digests must match, including the new write. This does
+not qualify reopening an older engine after an unclean shutdown.
+
+Application startup targets the latest actual schema migration, currently
+18.8.0, independently of the package version. Existing bridge-only ledgers from
+18.8.0 through the already released 18.9.3 remain at their recorded version;
+unknown newer schemas fail closed. The rollback fixture seeds a production-like
+18.9.2 ledger and verifies that candidate startup preserves it and the old
+18.9.2 migration runner accepts the post-upgrade import. Advance the explicit
+schema target only when adding a real migration.
+
+Before a live upgrade, stop the owning process and verify its children exit,
+then preserve the complete configured data tree and the active pnpm installation.
+Never restore that checkpoint over mail/events accepted after the upgrade.
+Preserve post-upgrade data with the qualified export/import procedure and
+verify the canonical digest before reopening service. Restore storage-root
+contents while preserving its bound directory inode. Check the live export
+against the maintenance API's size limits before relying on that rollback path.
+
+SmartDB 5.5.2 applies a leading aggregate match before its materialization
+budget. A selective window can therefore remain below the query budget when
+the complete collection exceeds 10,000 documents. This does not turn timestamp
+range queries into indexed lookups or prove that production RSS will fall.
+
 ## Derived state must name its invalidation trigger (2026-07-25)
 
 Three separate production failures on one day had the same shape: **state was

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.9.2',
+  version: '18.9.4',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -21,8 +21,7 @@ import { CertProvisionScheduler } from './classes.cert-provision-scheduler.js';
 // Import unified database
 import { DcRouterDb, type IDcRouterDbConfig, CacheCleaner, ProxyCertDoc, AcmeCertDoc, CachedEmail } from './db/index.js';
 // Import migration runner and app version
-import { createMigrationRunner } from '../ts_migrations/index.js';
-import { commitinfo } from './00_commitinfo_data.js';
+import { createApplicationMigrationRunner } from '../ts_migrations/index.js';
 
 import { OpsServer } from './opsserver/index.js';
 import { MetricsManager, OpsEventManager } from './monitoring/index.js';
@@ -1121,6 +1120,7 @@ export class DcRouter {
   }
 
   public async start() {
+    this.authenticationEventManager.start();
     await this.checkSystemLimits();
     logger.log('info', 'Starting DcRouter Services');
     await this.serviceManager.start();
@@ -1273,7 +1273,7 @@ export class DcRouter {
 
       // Run any pending data migrations before anything else reads from the DB.
       // This must complete before ConfigManagers loads profiles.
-      const migration = await createMigrationRunner(this.dcRouterDb.getDb(), commitinfo.version, {
+      const migration = await createApplicationMigrationRunner(this.dcRouterDb.getDb(), {
         remoteIngressHubSettings: this.getRemoteIngressHubSettingsMigrationSeed(),
         emailServerSettings: this.getEmailSettingsMigrationSeed(),
         legacySmartMtaStoragePath: plugins.path.join(
@@ -1929,6 +1929,7 @@ export class DcRouter {
     // Stop accepting authenticated requests before MetricsManager performs its
     // final durable authentication-event and email-traffic drain.
     await this.stopOpsServer();
+    await this.authenticationEventManager.stop();
 
     // Mail DNS reconciliation may legitimately outlive ServiceManager's
     // non-cancelling per-service timeout. Drain it before dependency teardown.

package/ts/db/documents/classes.authentication-event.doc.ts

@@ -11,34 +11,24 @@ const DB_OPERATION_TIMEOUT_MS = 5_000;
 
 const getDb = () => DcRouterDb.getInstance().getDb();
 
-@plugins.smartdata.Collection(() => getDb())
 export class AuthenticationEventDoc extends plugins.smartdata.SmartDataDbDoc<
   AuthenticationEventDoc,
   AuthenticationEventDoc
 > implements IAuthenticationEvent {
-  @plugins.smartdata.unI()
-  @plugins.smartdata.svDb()
   public id!: string;
 
-  @plugins.smartdata.svDb()
   public timestamp!: number;
 
-  @plugins.smartdata.svDb()
   public username!: string;
 
-  @plugins.smartdata.svDb()
   public userId?: string;
 
-  @plugins.smartdata.svDb()
   public success!: boolean;
 
-  @plugins.smartdata.svDb()
   public requestedAuthSource!: TAuthenticationSource;
 
-  @plugins.smartdata.svDb()
   public resolvedAuthSource?: TResolvedAuthenticationSource;
 
-  @plugins.smartdata.svDb()
   public failureReason?: TAuthenticationFailureReason;
 
   constructor() {
@@ -58,17 +48,6 @@ export class AuthenticationEventDoc extends plugins.smartdata.SmartDataDbDoc<
     };
   }
 
-  private static async getNativeCollection() {
-    const smartdataCollection = (AuthenticationEventDoc as typeof AuthenticationEventDoc & {
-      collection: plugins.smartdata.SmartdataCollection<AuthenticationEventDoc>;
-    }).collection;
-    await smartdataCollection.init();
-    const probe = new AuthenticationEventDoc();
-    await smartdataCollection.markUniqueIndexes(probe.uniqueIndexes || []);
-    await smartdataCollection.createRegularIndexes(probe.regularIndexes || []);
-    return smartdataCollection.mongoDbCollection;
-  }
-
   private static toPersistedFields(eventArg: IAuthenticationEvent): IAuthenticationEvent {
     return {
       id: eventArg.id,
@@ -137,27 +116,19 @@ export class AuthenticationEventDoc extends plugins.smartdata.SmartDataDbDoc<
     for (const event of eventsArg) {
       AuthenticationEventDoc.validateEvent(event);
     }
-    const collection = await AuthenticationEventDoc.getNativeCollection();
-    await collection.bulkWrite(
-      eventsArg.map((event) => {
-        const timestamp = new Date(event.timestamp).toISOString();
-        const persistedEvent = AuthenticationEventDoc.toPersistedFields(event);
-        return {
-          updateOne: {
-            filter: { id: event.id },
-            update: {
-              $setOnInsert: {
-                ...persistedEvent,
-                _createdAt: timestamp,
-                _updatedAt: timestamp,
-              },
-            },
-            upsert: true,
-          },
-        };
-      }),
-      { ordered: false, timeoutMS: DB_OPERATION_TIMEOUT_MS },
-    );
+    const documents = new Map<string, AuthenticationEventDoc>();
+    for (const event of eventsArg) {
+      if (documents.has(event.id)) continue;
+      const timestamp = new Date(event.timestamp).toISOString();
+      documents.set(event.id, Object.assign(new AuthenticationEventDoc(), {
+        ...AuthenticationEventDoc.toPersistedFields(event),
+        _createdAt: timestamp,
+        _updatedAt: timestamp,
+      }));
+    }
+    await AuthenticationEventDoc.insertManyIfAbsent([...documents.values()], {
+      identityField: 'id', timeoutMS: DB_OPERATION_TIMEOUT_MS,
+    });
   }
 
   public static async getWindowSummary(
@@ -174,34 +145,31 @@ export class AuthenticationEventDoc extends plugins.smartdata.SmartDataDbDoc<
     if (!Number.isSafeInteger(limitArg) || limitArg <= 0 || limitArg > 500) {
       throw new Error('AuthenticationEventDoc.getWindowSummary requires a limit from 1 to 500');
     }
-    const collection = await AuthenticationEventDoc.getNativeCollection();
+    await AuthenticationEventDoc.ensureInitialized();
     const selector = { timestamp: { $gte: cutoffArg } };
-    const cursor = collection
-      .find(selector, { timeoutMS: DB_OPERATION_TIMEOUT_MS })
-      .sort({ timestamp: -1, id: -1 })
-      .limit(limitArg);
-    try {
-      const [successes, failures, rows] = await Promise.all([
-        collection.countDocuments(
-          { ...selector, success: true },
-          { timeoutMS: DB_OPERATION_TIMEOUT_MS },
-        ),
-        collection.countDocuments(
-          { ...selector, success: false },
-          { timeoutMS: DB_OPERATION_TIMEOUT_MS },
-        ),
-        cursor.toArray(),
-      ]);
-      return {
-        successes,
-        failures,
-        events: rows.map((row) => AuthenticationEventDoc
-          .createInstanceFromMongoDbNativeDoc(row as any)
-          .toApiObject()),
-      };
-    } finally {
-      await cursor.close({ timeoutMS: DB_OPERATION_TIMEOUT_MS });
+    const [totalsResult, rowsResult] = await Promise.allSettled([
+      AuthenticationEventDoc.getGroupedTotals({
+        filter: selector, groupBy: ['success'], limit: 3,
+        maxTimeMS: DB_OPERATION_TIMEOUT_MS, timeoutMS: DB_OPERATION_TIMEOUT_MS,
+      }),
+      AuthenticationEventDoc.getOffsetPage(selector, {
+        skip: 0, limit: limitArg, sort: { timestamp: -1, id: -1 },
+        maxTimeMS: DB_OPERATION_TIMEOUT_MS, timeoutMS: DB_OPERATION_TIMEOUT_MS,
+      }),
+    ]);
+    // Both public queries own a cursor; drain both before releasing this computation.
+    if (totalsResult.status === 'rejected') throw totalsResult.reason;
+    if (rowsResult.status === 'rejected') throw rowsResult.reason;
+    const totals = totalsResult.value;
+    const rows = rowsResult.value;
+    let successes = 0;
+    let failures = 0;
+    for (const total of totals) {
+      if (total.group.success === true) successes = total.count;
+      else if (total.group.success === false) failures = total.count;
+      else throw new Error('Authentication events contain an invalid success value');
     }
+    return { successes, failures, events: rows.map((row) => row.toApiObject()) };
   }
 
   public static async findExistingIds(idsArg: string[]): Promise<Set<string>> {
@@ -210,34 +178,28 @@ export class AuthenticationEventDoc extends plugins.smartdata.SmartDataDbDoc<
     if (ids.length > 500) {
       throw new Error('AuthenticationEventDoc.findExistingIds accepts at most 500 ids');
     }
-    const collection = await AuthenticationEventDoc.getNativeCollection();
-    const rows = await collection
-      .find(
-        { id: { $in: ids } },
-        { projection: { id: 1 }, timeoutMS: DB_OPERATION_TIMEOUT_MS },
-      )
-      .toArray();
-    return new Set(rows.map((row) => String(row.id)));
+    await AuthenticationEventDoc.ensureInitialized();
+    const rows = await AuthenticationEventDoc.getOffsetPage({ id: { $in: ids } }, {
+      skip: 0, limit: ids.length, sort: { id: 1 }, projection: { id: 1, _id: 0 },
+      maxTimeMS: DB_OPERATION_TIMEOUT_MS, timeoutMS: DB_OPERATION_TIMEOUT_MS,
+    });
+    return new Set(rows.map((row) => row.id));
   }
 
   public static async pruneBefore(cutoffArg: number): Promise<number> {
     if (!Number.isSafeInteger(cutoffArg) || cutoffArg < 0) {
       throw new Error('AuthenticationEventDoc.pruneBefore requires a valid cutoff');
     }
-    const collection = await AuthenticationEventDoc.getNativeCollection();
+    await AuthenticationEventDoc.ensureInitialized();
     let deletedCount = 0;
     while (true) {
-      const rows = await collection
-        .find(
-          { timestamp: { $lt: cutoffArg } },
-          { projection: { _id: 1 }, timeoutMS: DB_OPERATION_TIMEOUT_MS },
-        )
-        .sort({ timestamp: 1, _id: 1 })
-        .limit(500)
-        .toArray();
+      const rows = await AuthenticationEventDoc.getOffsetPage({ timestamp: { $lt: cutoffArg } }, {
+        skip: 0, limit: 500, sort: { timestamp: 1, id: 1 }, projection: { id: 1, _id: 0 },
+        maxTimeMS: DB_OPERATION_TIMEOUT_MS, timeoutMS: DB_OPERATION_TIMEOUT_MS,
+      });
       if (rows.length === 0) break;
-      const result = await collection.deleteMany(
-        { _id: { $in: rows.map((row) => row._id) } },
+      const result = await AuthenticationEventDoc.atomicDeleteMany(
+        { timestamp: { $lt: cutoffArg }, $or: rows.map((row) => ({ id: row.id })) },
         { timeoutMS: DB_OPERATION_TIMEOUT_MS },
       );
       deletedCount += result.deletedCount;
@@ -246,3 +208,18 @@ export class AuthenticationEventDoc extends plugins.smartdata.SmartDataDbDoc<
     return deletedCount;
   }
 }
+
+// Match the names installed by create-monitoring-event-indexes on existing hubs.
+plugins.smartdata.defineCollectionModel(AuthenticationEventDoc, getDb, {
+  collectionName: 'AuthenticationEventDoc',
+  persistedFields: [
+    'id', 'timestamp', 'username', 'userId', 'success',
+    'requestedAuthSource', 'resolvedAuthSource', 'failureReason',
+  ],
+  identityFields: ['id'],
+  indexes: [
+    { name: 'authentication_event_id_unique', key: { id: 1 }, options: { unique: true } },
+    { name: 'authentication_event_timestamp', key: { timestamp: -1 } },
+    { name: 'authentication_event_success_timestamp', key: { success: 1, timestamp: -1 } },
+  ],
+});

package/ts/db/documents/classes.email-traffic-bucket.doc.ts

@@ -15,31 +15,22 @@ export interface IEmailTrafficBucketSnapshot extends IEmailTrafficBucketCounts {
   bucketStart: number;
 }
 
-@plugins.smartdata.Collection(() => getDb())
 export class EmailTrafficBucketDoc extends plugins.smartdata.SmartDataDbDoc<
   EmailTrafficBucketDoc,
   EmailTrafficBucketDoc
 > implements IEmailTrafficBucketSnapshot {
-  @plugins.smartdata.unI()
-  @plugins.smartdata.svDb()
   public id!: string;
 
-  @plugins.smartdata.svDb()
   public bucketStart!: number;
 
-  @plugins.smartdata.svDb()
   public sent: number = 0;
 
-  @plugins.smartdata.svDb()
   public received: number = 0;
 
-  @plugins.smartdata.svDb()
   public failed: number = 0;
 
-  @plugins.smartdata.svDb()
   public createdAt!: number;
 
-  @plugins.smartdata.svDb()
   public updatedAt!: number;
 
   constructor() {
@@ -159,3 +150,13 @@ export class EmailTrafficBucketDoc extends plugins.smartdata.SmartDataDbDoc<
     return deletedCount;
   }
 }
+
+plugins.smartdata.defineCollectionModel(EmailTrafficBucketDoc, getDb, {
+  collectionName: 'EmailTrafficBucketDoc',
+  persistedFields: ['id', 'bucketStart', 'sent', 'received', 'failed', 'createdAt', 'updatedAt'],
+  identityFields: ['id'],
+  indexes: [
+    { name: 'email_traffic_bucket_id_unique', key: { id: 1 }, options: { unique: true } },
+    { name: 'email_traffic_bucket_start_unique', key: { bucketStart: 1 }, options: { unique: true } },
+  ],
+});

package/ts/dns/manager.dns-authority.ts

@@ -99,6 +99,9 @@ export class DnsAuthorityManager {
   private updatedBy = '';
   private state: TDnsAuthorityState = 'unavailable';
   private reconciler?: TDnsAuthorityReconciler;
+  private stopped = false;
+  private activeProbes = new Map<string, Promise<IDnsDelegationProbe>>();
+  private ownedProbeClients = new Set<plugins.smartdns.dnsClientMod.Smartdns>();
 
   constructor(
     private getExpectedNameservers: () => string[],
@@ -109,6 +112,8 @@ export class DnsAuthorityManager {
   // ==========================================================================
 
   public async start(): Promise<void> {
+    if (this.ownedProbeClients.size > 0) throw new Error('DNS probe cleanup must complete before restart');
+    this.stopped = false;
     let doc: DnsAuthorityDoc | null;
     try {
       doc = await DnsAuthorityDoc.load();
@@ -154,9 +159,17 @@ export class DnsAuthorityManager {
   }
 
   public async stop(): Promise<void> {
+    this.stopped = true;
+    await Promise.allSettled(this.activeProbes.values());
+    const cleanup = await Promise.allSettled([...this.ownedProbeClients].map(async (client) => {
+      await client.terminate();
+      this.ownedProbeClients.delete(client);
+    }));
     this.verifiedZones = [];
     this.state = 'unavailable';
     this.reconciler = undefined;
+    const failures = cleanup.filter((result): result is PromiseRejectedResult => result.status === 'rejected');
+    if (failures.length) throw new AggregateError(failures.map((result) => result.reason), 'DNS probe cleanup failed');
   }
 
   /**
@@ -223,7 +236,28 @@ export class DnsAuthorityManager {
    * that a zone is not ours; collapsing 'undeterminable' into 'not-delegated'
    * would let a transient resolver fault revoke authority.
    */
-  public async probeDelegation(zoneArg: string): Promise<IDnsDelegationProbe> {
+  public probeDelegation(zoneArg: string): Promise<IDnsDelegationProbe> {
+    if (this.stopped) return Promise.reject(new Error('DNS authority manager is stopped'));
+    const zone = normalizeZone(zoneArg);
+    const existing = this.activeProbes.get(zone);
+    if (existing) return existing;
+    if (this.ownedProbeClients.size >= 32) return Promise.reject(new Error('DNS probe capacity reached'));
+    const run = this.probeDelegationUnlocked(zoneArg).finally(() => {
+      if (this.activeProbes.get(zone) === run) this.activeProbes.delete(zone);
+    });
+    this.activeProbes.set(zone, run);
+    return run;
+  }
+
+  private createProbeClient(): plugins.smartdns.dnsClientMod.Smartdns {
+    return new plugins.smartdns.dnsClientMod.Smartdns({
+      strategy: 'doh',
+      allowDohFallback: false,
+      timeoutMs: 10_000,
+    });
+  }
+
+  private async probeDelegationUnlocked(zoneArg: string): Promise<IDnsDelegationProbe> {
     const zone = normalizeZone(zoneArg);
     const expectedNameservers = this.getExpectedNameservers()
       .map(normalizeNameserver)
@@ -248,69 +282,72 @@ export class DnsAuthorityManager {
       };
     }
 
-    const smartdnsClient = new plugins.smartdns.dnsClientMod.Smartdns({
-      strategy: 'doh',
-      allowDohFallback: false,
-      timeoutMs: 10_000,
-    });
-
-    let result: Awaited<ReturnType<typeof smartdnsClient.queryRecords>>;
+    const smartdnsClient = this.createProbeClient();
+    this.ownedProbeClients.add(smartdnsClient);
     try {
-      result = await smartdnsClient.queryRecords(zone, 'NS');
-    } catch (error: unknown) {
-      return {
-        zone,
-        verdict: 'undeterminable',
-        observedNameservers: [],
-        expectedNameservers,
-        detail: `delegation lookup threw: ${(error as Error).message}`,
-      };
-    }
 
-    if (result.status === 'error') {
-      return {
-        zone,
-        verdict: 'undeterminable',
-        observedNameservers: [],
-        expectedNameservers,
-        detail: `delegation lookup failed (${result.error.kind}/${result.error.code}): ${result.error.message}`,
-      };
-    }
+      let result: Awaited<ReturnType<typeof smartdnsClient.queryRecords>>;
+      try {
+        result = await smartdnsClient.queryRecords(zone, 'NS');
+      } catch (error: unknown) {
+        return {
+          zone,
+          verdict: 'undeterminable',
+          observedNameservers: [],
+          expectedNameservers,
+          detail: `delegation lookup threw: ${(error as Error).message}`,
+        };
+      }
 
-    if (result.status === 'missing') {
-      return {
-        zone,
-        verdict: 'not-delegated',
-        observedNameservers: [],
-        expectedNameservers,
-        detail: result.missingReason === 'nxdomain'
-          ? `${zone} does not exist in public DNS`
-          : `${zone} has no NS records in public DNS`,
-      };
-    }
+      if (result.status === 'error') {
+        return {
+          zone,
+          verdict: 'undeterminable',
+          observedNameservers: [],
+          expectedNameservers,
+          detail: `delegation lookup failed (${result.error.kind}/${result.error.code}): ${result.error.message}`,
+        };
+      }
+
+      if (result.status === 'missing') {
+        return {
+          zone,
+          verdict: 'not-delegated',
+          observedNameservers: [],
+          expectedNameservers,
+          detail: result.missingReason === 'nxdomain'
+            ? `${zone} does not exist in public DNS`
+            : `${zone} has no NS records in public DNS`,
+        };
+      }
 
-    const observedNameservers: string[] = [...new Set<string>(
-      result.records
-        .map((record): string => normalizeNameserver(String(record.value ?? '')))
-        .filter((nameserver): nameserver is string => Boolean(nameserver)),
-    )];
-    const matches = observedNameservers.filter((observed) => expectedNameservers.includes(observed));
-    if (matches.length === 0) {
+      const observedNameservers: string[] = [...new Set<string>(
+        result.records
+          .map((record): string => normalizeNameserver(String(record.value ?? '')))
+          .filter((nameserver): nameserver is string => Boolean(nameserver)),
+      )];
+      const matches = observedNameservers.filter((observed) => expectedNameservers.includes(observed));
+      if (matches.length === 0) {
+        return {
+          zone,
+          verdict: 'not-delegated',
+          observedNameservers,
+          expectedNameservers,
+          detail: `${zone} is delegated to ${observedNameservers.join(', ') || 'nothing'}, which does not include any of our nameservers (${expectedNameservers.join(', ')})`,
+        };
+      }
       return {
         zone,
-        verdict: 'not-delegated',
+        verdict: 'delegated',
         observedNameservers,
         expectedNameservers,
-        detail: `${zone} is delegated to ${observedNameservers.join(', ') || 'nothing'}, which does not include any of our nameservers (${expectedNameservers.join(', ')})`,
+        detail: `${zone} is delegated to ${matches.join(', ')}`,
       };
+    } finally {
+      // Keep ownership if confirmed termination fails; stop() can retry it.
+      await smartdnsClient.terminate();
+      this.ownedProbeClients.delete(smartdnsClient);
     }
-    return {
-      zone,
-      verdict: 'delegated',
-      observedNameservers,
-      expectedNameservers,
-      detail: `${zone} is delegated to ${matches.join(', ')}`,
-    };
   }
 
   // ==========================================================================
@@ -328,6 +365,7 @@ export class DnsAuthorityManager {
     }
 
     const probe = await this.probeDelegation(zone);
+    if (this.stopped) return { success: false, message: 'DNS authority manager is stopped', probe };
     if (probe.verdict !== 'delegated') {
       return {
         success: false,