@serve.zone/interfaces 32.56.0 → 32.57.0

package/changelog.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 2026-10-14 - 32.57.0
+
+### Features
+
+- `runtimeSessionRefusalContract`, `IRuntimeSessionRefusal` and
+  `TRuntimeSessionMomentaryRefusalReason`: the `TypedResponseError.errorData` a controller or relay
+  answers a refused runtime session registration, read or report with, exactly
+  `{ code: 'runtime-session-report-refused', reason }` — the wire shape Cloudly ≥33.19.1 emits
+  for budget and stopping refusals and Pallet 36.3.14 reads, now owned here. `momentaryReasons`
+  (`controller-deadline`, `controller-unavailable`) are the controller's own momentary state,
+  after which a registering node offers again; every other reason, and an error without this
+  payload, is a verdict. The distinction governs only whether a node defers a registration;
+  report refusal reasons are unchanged. A reason is lowercase letter words joined by single
+  hyphens, at most 64 characters, so it names a check and never carries a value. The rule
+  producers adopt: Cloudly states `controller-unavailable` for every transient failure of its own
+  on a registration (today only when stopping), and a relay states only `controller-unavailable`,
+  only when it cannot carry.
+- `buildRuntimeSessionRefusal(reason)` (throws on a non-word reason),
+  `validateRuntimeSessionRefusal(value, path?)`, `readRuntimeSessionRefusal(value)` (exactly
+  `code` and `reason`, own data properties only) and `readMomentaryRuntimeSessionRefusal(value)`.
+  The readers refuse any extra member, so a producer gates a new member on the peer's interfaces
+  version.
+- `runtimeSessionRequestBounds`: Cloudly's 6 s `controllerBudgetMs` for every node request, a
+  relay's 9 s `relayRegistrationBudgetMs` from a registration's arrival to its answer (beyond
+  Cloudly's budget by more than a second, below TypedSocket's 10 s restore deadline) and its 8 s
+  `relaySessionForwardMs` for session reads and reports, so Cloudly's stated refusal reaches the
+  node before a relay gives up.
+
 ## 2026-10-13 - 32.56.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.56.0',
+    version: '32.57.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -65,6 +65,7 @@ export * from './runtimestorageclaim.js';
 export * from './runtimelocalstorageclaim.js';
 export * from './runtimelocalvolumearchive.js';
 export * from './runtimesession.js';
+export * from './runtimesessionrefusal.js';
 export * from './runtimeterminalreceipt.js';
 export * from './secret.js';
 export * from './baremetal.js';

package/dist_ts/data/index.js

@@ -61,6 +61,7 @@ export * from './runtimestorageclaim.js';
 export * from './runtimelocalstorageclaim.js';
 export * from './runtimelocalvolumearchive.js';
 export * from './runtimesession.js';
+export * from './runtimesessionrefusal.js';
 export * from './runtimeterminalreceipt.js';
 export * from './secret.js';
 export * from './baremetal.js';
@@ -83,4 +84,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBR3ZDLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRzlELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRXBGLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSwwQ0FBMEMsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBQzFJLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGtDQUFrQyxDQUFDO0FBQ2pELGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBR3ZDLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRzlELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRXBGLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSwwQ0FBMEMsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBQzFJLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9

package/dist_ts/data/runtimesessionrefusal.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The refusal a controller states when it does not take a node's runtime session request.
+ *
+ * It travels as `TypedResponseError.errorData` on `registerPalletRuntimeSession` and on every
+ * session-scoped read and report a node sends its controller. `code` is a frozen wire value.
+ * `momentaryReasons` are the controller's own momentary state, not a judgement of the node: a
+ * registering node waits and offers the same registration again, keeping everything it runs.
+ * Every other reason, and an error that carries no such payload, is a verdict — on a registration
+ * it ends the node's session. Momentary against verdict governs only whether a node defers a
+ * registration: a node retries its session reads and reports regardless of the reason, so the
+ * reasons a report is refused with (`state-conflict`, `*-write-conflict`, a capacity limit such as
+ * `log-intake-saturated`) are unchanged by this contract.
+ *
+ * Who states which reason today, on a registration (Cloudly ≥33.19.1, `isBudgetRefusal`):
+ * - Cloudly states `controller-deadline` when the request ran out of
+ *   `runtimeSessionRequestBounds.controllerBudgetMs`, and `controller-unavailable` when it is
+ *   stopping. Every other failure, a transient one of its own included, is answered without a
+ *   payload and so reads as a verdict.
+ * - No relay states a refusal of its own yet.
+ *
+ * The rule producers adopt:
+ * - Cloudly states `controller-unavailable` on a registration for every transient failure of its
+ *   own: its database connection lost or unavailable, a registration write conflict, a race with a
+ *   credential being applied.
+ * - A relay states only `controller-unavailable`, and only when it cannot carry the request or its
+ *   answer: no Cloudly link, or its own bound (`runtimeSessionRequestBounds`) ran out. Every
+ *   answer Cloudly gave it forwards untouched; it never states a verdict or `controller-deadline`.
+ * - A verdict names the check that refused: a revoked or inactive credential, a deleted, retiring
+ *   or foreign node, an invalid body. It never carries a momentary reason.
+ *
+ * The payload is exactly `{ code, reason }`. Pallet 36.3.14 reads the two members and tolerates
+ * others, but every reader built on `readRuntimeSessionRefusal` refuses a payload with any other
+ * member, and a refused payload reads as no refusal — a momentary refusal would turn into a
+ * verdict. A producer therefore never adds a member without gating it on the peer's spoken
+ * interfaces version.
+ */
+export declare const runtimeSessionRefusalContract: Readonly<{
+    readonly code: 'runtime-session-report-refused';
+    readonly momentaryReasons: readonly ["controller-deadline", "controller-unavailable"];
+    /**
+     * A reason is one or more words of lowercase ASCII letters joined by single hyphens, at most
+     * this many characters. It names a check, never a value: no digit, case, dot, colon or other
+     * separator can carry an identifier, address, digest, count or credential across.
+     */
+    readonly maximumReasonLength: 64;
+}>;
+export type TRuntimeSessionMomentaryRefusalReason = typeof runtimeSessionRefusalContract.momentaryReasons[number];
+/**
+ * `TypedResponseError.errorData` of a refused runtime session request. `reason` is a word naming
+ * the check that refused (see `runtimeSessionRefusalContract`), never a value.
+ */
+export interface IRuntimeSessionRefusal {
+    code: typeof runtimeSessionRefusalContract.code;
+    reason: string;
+}
+/** Validates one runtime session refusal and names every reason it is refused. */
+export declare const validateRuntimeSessionRefusal: (valueArg: unknown, pathArg?: string) => string[];
+/** The payload a controller or relay answers a refused request with; throws on a non-word reason. */
+export declare const buildRuntimeSessionRefusal: (reasonArg: string) => IRuntimeSessionRefusal;
+/**
+ * The refusal inside an error payload, or `null` when the value is not exactly one.
+ *
+ * It reads a value that survived serialization, the way `protocol.readProtocolRefusal` does: own
+ * data properties only, exactly `code` and `reason`, nothing that runs.
+ */
+export declare const readRuntimeSessionRefusal: (valueArg: unknown) => IRuntimeSessionRefusal | null;
+/**
+ * The momentary reason an error payload states, or `null` when it is a verdict: any other reason,
+ * a payload that is not exactly a refusal, or no payload at all.
+ */
+export declare const readMomentaryRuntimeSessionRefusal: (valueArg: unknown) => TRuntimeSessionMomentaryRefusalReason | null;
+/**
+ * How long each hop may hold a node's runtime session request, so the hop nearest the decision
+ * answers first and the node always reads a stated refusal rather than its own timeout.
+ */
+export declare const runtimeSessionRequestBounds: Readonly<{
+    /**
+     * Cloudly's budget for every node request, registration included. When it runs out Cloudly
+     * answers `controller-deadline`.
+     */
+    readonly controllerBudgetMs: 6000;
+    /**
+     * A relay's bound on a registration, from its arrival at the relay to the answer, including any
+     * wait for the relay's own Cloudly link. It exceeds `controllerBudgetMs` by more than a second so
+     * Cloudly's own `controller-deadline` reaches the node through the relay, and stays below
+     * TypedSocket's 10 s connection-restore deadline (`TYPEDSOCKET_MAX_CONNECTION_RESTORE_TIMEOUT_MS`,
+     * which a client can only lower) so the node reads an answer before its restore hook times out.
+     * When it runs out the relay answers `controller-unavailable`.
+     */
+    readonly relayRegistrationBudgetMs: 9000;
+    /**
+     * A relay's bound on forwarding a session read or report over its established Cloudly link.
+     * It exceeds `controllerBudgetMs` so Cloudly's answer arrives first; when it runs out the relay
+     * answers `controller-unavailable`.
+     */
+    readonly relaySessionForwardMs: 8000;
+}>;

package/dist_ts/data/runtimesessionrefusal.js

@@ -0,0 +1,127 @@
+import { readExactDataRecord } from '../private/dataproperties.js';
+/**
+ * The refusal a controller states when it does not take a node's runtime session request.
+ *
+ * It travels as `TypedResponseError.errorData` on `registerPalletRuntimeSession` and on every
+ * session-scoped read and report a node sends its controller. `code` is a frozen wire value.
+ * `momentaryReasons` are the controller's own momentary state, not a judgement of the node: a
+ * registering node waits and offers the same registration again, keeping everything it runs.
+ * Every other reason, and an error that carries no such payload, is a verdict — on a registration
+ * it ends the node's session. Momentary against verdict governs only whether a node defers a
+ * registration: a node retries its session reads and reports regardless of the reason, so the
+ * reasons a report is refused with (`state-conflict`, `*-write-conflict`, a capacity limit such as
+ * `log-intake-saturated`) are unchanged by this contract.
+ *
+ * Who states which reason today, on a registration (Cloudly ≥33.19.1, `isBudgetRefusal`):
+ * - Cloudly states `controller-deadline` when the request ran out of
+ *   `runtimeSessionRequestBounds.controllerBudgetMs`, and `controller-unavailable` when it is
+ *   stopping. Every other failure, a transient one of its own included, is answered without a
+ *   payload and so reads as a verdict.
+ * - No relay states a refusal of its own yet.
+ *
+ * The rule producers adopt:
+ * - Cloudly states `controller-unavailable` on a registration for every transient failure of its
+ *   own: its database connection lost or unavailable, a registration write conflict, a race with a
+ *   credential being applied.
+ * - A relay states only `controller-unavailable`, and only when it cannot carry the request or its
+ *   answer: no Cloudly link, or its own bound (`runtimeSessionRequestBounds`) ran out. Every
+ *   answer Cloudly gave it forwards untouched; it never states a verdict or `controller-deadline`.
+ * - A verdict names the check that refused: a revoked or inactive credential, a deleted, retiring
+ *   or foreign node, an invalid body. It never carries a momentary reason.
+ *
+ * The payload is exactly `{ code, reason }`. Pallet 36.3.14 reads the two members and tolerates
+ * others, but every reader built on `readRuntimeSessionRefusal` refuses a payload with any other
+ * member, and a refused payload reads as no refusal — a momentary refusal would turn into a
+ * verdict. A producer therefore never adds a member without gating it on the peer's spoken
+ * interfaces version.
+ */
+export const runtimeSessionRefusalContract = Object.freeze({
+    code: 'runtime-session-report-refused',
+    momentaryReasons: Object.freeze(['controller-deadline', 'controller-unavailable']),
+    /**
+     * A reason is one or more words of lowercase ASCII letters joined by single hyphens, at most
+     * this many characters. It names a check, never a value: no digit, case, dot, colon or other
+     * separator can carry an identifier, address, digest, count or credential across.
+     */
+    maximumReasonLength: 64,
+});
+const isRefusalReason = (valueArg) => (typeof valueArg === 'string'
+    && valueArg.length <= runtimeSessionRefusalContract.maximumReasonLength
+    && /^[a-z]+(?:-[a-z]+)*$/.test(valueArg));
+const reasonRule = 'must be lowercase letter words joined by single hyphens, at most '
+    + `${runtimeSessionRefusalContract.maximumReasonLength} characters`;
+/** Validates one runtime session refusal and names every reason it is refused. */
+export const validateRuntimeSessionRefusal = (valueArg, pathArg = 'runtime session refusal') => {
+    const refusal = readExactDataRecord(valueArg, ['code', 'reason']);
+    if (refusal === null) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (refusal.code !== runtimeSessionRefusalContract.code) {
+        errors.push(`${pathArg} code must be ${runtimeSessionRefusalContract.code}`);
+    }
+    if (!isRefusalReason(refusal.reason)) {
+        errors.push(`${pathArg} reason ${reasonRule}`);
+    }
+    return errors;
+};
+/** The payload a controller or relay answers a refused request with; throws on a non-word reason. */
+export const buildRuntimeSessionRefusal = (reasonArg) => {
+    if (!isRefusalReason(reasonArg)) {
+        throw new Error(`runtime session refusal reason ${reasonRule}`);
+    }
+    return Object.freeze({ code: runtimeSessionRefusalContract.code, reason: reasonArg });
+};
+/**
+ * The refusal inside an error payload, or `null` when the value is not exactly one.
+ *
+ * It reads a value that survived serialization, the way `protocol.readProtocolRefusal` does: own
+ * data properties only, exactly `code` and `reason`, nothing that runs.
+ */
+export const readRuntimeSessionRefusal = (valueArg) => {
+    const refusal = readExactDataRecord(valueArg, ['code', 'reason']);
+    if (refusal === null || validateRuntimeSessionRefusal(refusal).length > 0) {
+        return null;
+    }
+    return Object.freeze({ code: runtimeSessionRefusalContract.code, reason: refusal.reason });
+};
+/**
+ * The momentary reason an error payload states, or `null` when it is a verdict: any other reason,
+ * a payload that is not exactly a refusal, or no payload at all.
+ */
+export const readMomentaryRuntimeSessionRefusal = (valueArg) => {
+    const refusal = readRuntimeSessionRefusal(valueArg);
+    if (refusal === null) {
+        return null;
+    }
+    const momentary = runtimeSessionRefusalContract.momentaryReasons
+        .find((reasonArg) => reasonArg === refusal.reason);
+    return momentary ?? null;
+};
+/**
+ * How long each hop may hold a node's runtime session request, so the hop nearest the decision
+ * answers first and the node always reads a stated refusal rather than its own timeout.
+ */
+export const runtimeSessionRequestBounds = Object.freeze({
+    /**
+     * Cloudly's budget for every node request, registration included. When it runs out Cloudly
+     * answers `controller-deadline`.
+     */
+    controllerBudgetMs: 6_000,
+    /**
+     * A relay's bound on a registration, from its arrival at the relay to the answer, including any
+     * wait for the relay's own Cloudly link. It exceeds `controllerBudgetMs` by more than a second so
+     * Cloudly's own `controller-deadline` reaches the node through the relay, and stays below
+     * TypedSocket's 10 s connection-restore deadline (`TYPEDSOCKET_MAX_CONNECTION_RESTORE_TIMEOUT_MS`,
+     * which a client can only lower) so the node reads an answer before its restore hook times out.
+     * When it runs out the relay answers `controller-unavailable`.
+     */
+    relayRegistrationBudgetMs: 9_000,
+    /**
+     * A relay's bound on forwarding a session read or report over its established Cloudly link.
+     * It exceeds `controllerBudgetMs` so Cloudly's answer arrives first; when it runs out the relay
+     * answers `controller-unavailable`.
+     */
+    relaySessionForwardMs: 8_000,
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXNlc3Npb25yZWZ1c2FsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9ydW50aW1lc2Vzc2lvbnJlZnVzYWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFbkU7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBbUNHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN6RCxJQUFJLEVBQUUsZ0NBQWdDO0lBQ3RDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxxQkFBcUIsRUFBRSx3QkFBd0IsQ0FBVSxDQUFDO0lBQzNGOzs7O09BSUc7SUFDSCxtQkFBbUIsRUFBRSxFQUFFO0NBQ2YsQ0FBQyxDQUFDO0FBY1osTUFBTSxlQUFlLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDakUsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN6QixRQUFRLENBQUMsTUFBTSxJQUFJLDZCQUE2QixDQUFDLG1CQUFtQjtPQUNwRSxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3pDLENBQUM7QUFFRixNQUFNLFVBQVUsR0FBRyxtRUFBbUU7TUFDbEYsR0FBRyw2QkFBNkIsQ0FBQyxtQkFBbUIsYUFBYSxDQUFDO0FBRXRFLGtGQUFrRjtBQUNsRixNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUMzQyxRQUFpQixFQUNqQixPQUFPLEdBQUcseUJBQXlCLEVBQ3pCLEVBQUU7SUFDWixNQUFNLE9BQU8sR0FBRyxtQkFBbUIsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRSxJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNyQixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssNkJBQTZCLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8saUJBQWlCLDZCQUE2QixDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELElBQUksQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDckMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sV0FBVyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixxR0FBcUc7QUFDckcsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxTQUFpQixFQUEwQixFQUFFO0lBQ3RGLElBQUksQ0FBQyxlQUFlLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUNoQyxNQUFNLElBQUksS0FBSyxDQUFDLGtDQUFrQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxJQUFJLEVBQUUsNkJBQTZCLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0FBQ3hGLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxRQUFpQixFQUFpQyxFQUFFO0lBQzVGLE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLElBQUksT0FBTyxLQUFLLElBQUksSUFBSSw2QkFBNkIsQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUUsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxFQUFFLDZCQUE2QixDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQWdCLEVBQUUsQ0FBQyxDQUFDO0FBQ3ZHLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELFFBQWlCLEVBQzZCLEVBQUU7SUFDaEQsTUFBTSxPQUFPLEdBQUcseUJBQXlCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEQsSUFBSSxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsNkJBQTZCLENBQUMsZ0JBQWdCO1NBQzdELElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxLQUFLLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNyRCxPQUFPLFNBQVMsSUFBSSxJQUFJLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RDs7O09BR0c7SUFDSCxrQkFBa0IsRUFBRSxLQUFLO0lBQ3pCOzs7Ozs7O09BT0c7SUFDSCx5QkFBeUIsRUFBRSxLQUFLO0lBQ2hDOzs7O09BSUc7SUFDSCxxQkFBcUIsRUFBRSxLQUFLO0NBQ3BCLENBQUMsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.56.0",
+  "version": "32.57.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -1452,6 +1452,64 @@ carries the same offer, judged in the same order before the JWT, and answers wit
 the server's own offer. Both registration methods reject HTTP transport. Sensitive requests and registry
 responses must be excluded from hooks, logs, diagnostics and durable journals.
 
+### Runtime Session Refusals
+
+A controller that does not take a node's registration, session read or report
+answers `TypedResponseError` with `data.IRuntimeSessionRefusal` as its
+`errorData`: exactly `{ code: 'runtime-session-report-refused', reason }`
+(`data.runtimeSessionRefusalContract.code`, a frozen wire value). The reason is a
+word naming the check that refused, never a value: lowercase ASCII letter words
+joined by single hyphens, at most 64 characters
+(`runtimeSessionRefusalContract.maximumReasonLength`), so no identifier, address,
+digest, count or credential can cross in it.
+
+Two reasons are the controller's own momentary state
+(`runtimeSessionRefusalContract.momentaryReasons`): a registering node waits and
+offers the same registration again, keeping what it runs. Every other reason,
+and an error without this payload, is a verdict; on a registration it ends the
+node's session. Momentary against verdict governs only whether a node defers a
+registration: a node retries its session reads and reports regardless of the
+reason, so the reasons a report is refused with (`state-conflict`,
+`*-write-conflict`, a capacity limit such as `log-intake-saturated`) are
+unchanged by this contract.
+
+On a registration today (Cloudly ≥33.19.1), Cloudly attaches the payload only
+when the refusal is no judgement of the node: its budget ran out
+(`controller-deadline`) or it is stopping (`controller-unavailable`). Every
+other failure, a transient one of its own included, is answered without a
+payload and so reads as a verdict. No relay states a refusal of its own yet.
+
+The rule producers adopt:
+
+| Reason | Stated by | When |
+| --- | --- | --- |
+| `controller-deadline` | Cloudly | the request ran out of `controllerBudgetMs` (stated today) |
+| `controller-unavailable` | Cloudly | it is stopping (stated today); any other transient failure of its own on a registration: database connection lost or unavailable, a registration write conflict, a race with a credential being applied |
+| `controller-unavailable` | relay | only when it cannot carry the request or its answer: no Cloudly link, or its own bound ran out |
+| any other word | Cloudly | a verdict: revoked or inactive credential, deleted, retiring or foreign node, invalid body |
+
+A relay forwards every answer Cloudly gave untouched and states nothing but
+`controller-unavailable` itself. `data.buildRuntimeSessionRefusal(reason)` builds
+the payload and throws on a reason that is not a word;
+`data.validateRuntimeSessionRefusal` names every violation;
+`data.readRuntimeSessionRefusal(errorData)` answers the refusal or `null`, and
+`data.readMomentaryRuntimeSessionRefusal(errorData)` answers the momentary reason
+or `null` for a verdict.
+
+The readers are exact-key. Pallet 36.3.14 reads `code` and `reason` and tolerates
+other members, but a reader built on this contract refuses a payload carrying
+any other member, and a refused payload reads as no refusal, which turns a
+momentary refusal into a verdict. A producer never adds a member without gating
+it on the peer's spoken interfaces version.
+
+`data.runtimeSessionRequestBounds` orders the hops so the one nearest the
+decision answers first and a node always reads a stated refusal rather than its
+own timeout: Cloudly's `controllerBudgetMs` (6 s, every node request including
+registration); a relay's `relayRegistrationBudgetMs` (9 s from arrival to
+answer, more than a second beyond Cloudly's budget and below TypedSocket's 10 s
+connection-restore deadline); and a relay's `relaySessionForwardMs` (8 s) for a
+session read or report forwarded over its established Cloudly link.
+
 ### Assignment-Bound Runtime Secrets
 
 `@serve.zone/interfaces/runtime` exports the Pallet assignment-secret contract.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.56.0',
+  version: '32.57.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -66,6 +66,7 @@ export * from './runtimestorageclaim.js';
 export * from './runtimelocalstorageclaim.js';
 export * from './runtimelocalvolumearchive.js';
 export * from './runtimesession.js';
+export * from './runtimesessionrefusal.js';
 export * from './runtimeterminalreceipt.js';
 export * from './secret.js';
 export * from './baremetal.js';

package/ts/data/runtimesessionrefusal.ts

@@ -0,0 +1,153 @@
+import { readExactDataRecord } from '../private/dataproperties.js';
+
+/**
+ * The refusal a controller states when it does not take a node's runtime session request.
+ *
+ * It travels as `TypedResponseError.errorData` on `registerPalletRuntimeSession` and on every
+ * session-scoped read and report a node sends its controller. `code` is a frozen wire value.
+ * `momentaryReasons` are the controller's own momentary state, not a judgement of the node: a
+ * registering node waits and offers the same registration again, keeping everything it runs.
+ * Every other reason, and an error that carries no such payload, is a verdict — on a registration
+ * it ends the node's session. Momentary against verdict governs only whether a node defers a
+ * registration: a node retries its session reads and reports regardless of the reason, so the
+ * reasons a report is refused with (`state-conflict`, `*-write-conflict`, a capacity limit such as
+ * `log-intake-saturated`) are unchanged by this contract.
+ *
+ * Who states which reason today, on a registration (Cloudly ≥33.19.1, `isBudgetRefusal`):
+ * - Cloudly states `controller-deadline` when the request ran out of
+ *   `runtimeSessionRequestBounds.controllerBudgetMs`, and `controller-unavailable` when it is
+ *   stopping. Every other failure, a transient one of its own included, is answered without a
+ *   payload and so reads as a verdict.
+ * - No relay states a refusal of its own yet.
+ *
+ * The rule producers adopt:
+ * - Cloudly states `controller-unavailable` on a registration for every transient failure of its
+ *   own: its database connection lost or unavailable, a registration write conflict, a race with a
+ *   credential being applied.
+ * - A relay states only `controller-unavailable`, and only when it cannot carry the request or its
+ *   answer: no Cloudly link, or its own bound (`runtimeSessionRequestBounds`) ran out. Every
+ *   answer Cloudly gave it forwards untouched; it never states a verdict or `controller-deadline`.
+ * - A verdict names the check that refused: a revoked or inactive credential, a deleted, retiring
+ *   or foreign node, an invalid body. It never carries a momentary reason.
+ *
+ * The payload is exactly `{ code, reason }`. Pallet 36.3.14 reads the two members and tolerates
+ * others, but every reader built on `readRuntimeSessionRefusal` refuses a payload with any other
+ * member, and a refused payload reads as no refusal — a momentary refusal would turn into a
+ * verdict. A producer therefore never adds a member without gating it on the peer's spoken
+ * interfaces version.
+ */
+export const runtimeSessionRefusalContract = Object.freeze({
+  code: 'runtime-session-report-refused',
+  momentaryReasons: Object.freeze(['controller-deadline', 'controller-unavailable'] as const),
+  /**
+   * A reason is one or more words of lowercase ASCII letters joined by single hyphens, at most
+   * this many characters. It names a check, never a value: no digit, case, dot, colon or other
+   * separator can carry an identifier, address, digest, count or credential across.
+   */
+  maximumReasonLength: 64,
+} as const);
+
+export type TRuntimeSessionMomentaryRefusalReason =
+  typeof runtimeSessionRefusalContract.momentaryReasons[number];
+
+/**
+ * `TypedResponseError.errorData` of a refused runtime session request. `reason` is a word naming
+ * the check that refused (see `runtimeSessionRefusalContract`), never a value.
+ */
+export interface IRuntimeSessionRefusal {
+  code: typeof runtimeSessionRefusalContract.code;
+  reason: string;
+}
+
+const isRefusalReason = (valueArg: unknown): valueArg is string => (
+  typeof valueArg === 'string'
+  && valueArg.length <= runtimeSessionRefusalContract.maximumReasonLength
+  && /^[a-z]+(?:-[a-z]+)*$/.test(valueArg)
+);
+
+const reasonRule = 'must be lowercase letter words joined by single hyphens, at most '
+  + `${runtimeSessionRefusalContract.maximumReasonLength} characters`;
+
+/** Validates one runtime session refusal and names every reason it is refused. */
+export const validateRuntimeSessionRefusal = (
+  valueArg: unknown,
+  pathArg = 'runtime session refusal',
+): string[] => {
+  const refusal = readExactDataRecord(valueArg, ['code', 'reason']);
+  if (refusal === null) {
+    return [`${pathArg} must use its exact schema`];
+  }
+  const errors: string[] = [];
+  if (refusal.code !== runtimeSessionRefusalContract.code) {
+    errors.push(`${pathArg} code must be ${runtimeSessionRefusalContract.code}`);
+  }
+  if (!isRefusalReason(refusal.reason)) {
+    errors.push(`${pathArg} reason ${reasonRule}`);
+  }
+  return errors;
+};
+
+/** The payload a controller or relay answers a refused request with; throws on a non-word reason. */
+export const buildRuntimeSessionRefusal = (reasonArg: string): IRuntimeSessionRefusal => {
+  if (!isRefusalReason(reasonArg)) {
+    throw new Error(`runtime session refusal reason ${reasonRule}`);
+  }
+  return Object.freeze({ code: runtimeSessionRefusalContract.code, reason: reasonArg });
+};
+
+/**
+ * The refusal inside an error payload, or `null` when the value is not exactly one.
+ *
+ * It reads a value that survived serialization, the way `protocol.readProtocolRefusal` does: own
+ * data properties only, exactly `code` and `reason`, nothing that runs.
+ */
+export const readRuntimeSessionRefusal = (valueArg: unknown): IRuntimeSessionRefusal | null => {
+  const refusal = readExactDataRecord(valueArg, ['code', 'reason']);
+  if (refusal === null || validateRuntimeSessionRefusal(refusal).length > 0) {
+    return null;
+  }
+  return Object.freeze({ code: runtimeSessionRefusalContract.code, reason: refusal.reason as string });
+};
+
+/**
+ * The momentary reason an error payload states, or `null` when it is a verdict: any other reason,
+ * a payload that is not exactly a refusal, or no payload at all.
+ */
+export const readMomentaryRuntimeSessionRefusal = (
+  valueArg: unknown,
+): TRuntimeSessionMomentaryRefusalReason | null => {
+  const refusal = readRuntimeSessionRefusal(valueArg);
+  if (refusal === null) {
+    return null;
+  }
+  const momentary = runtimeSessionRefusalContract.momentaryReasons
+    .find((reasonArg) => reasonArg === refusal.reason);
+  return momentary ?? null;
+};
+
+/**
+ * How long each hop may hold a node's runtime session request, so the hop nearest the decision
+ * answers first and the node always reads a stated refusal rather than its own timeout.
+ */
+export const runtimeSessionRequestBounds = Object.freeze({
+  /**
+   * Cloudly's budget for every node request, registration included. When it runs out Cloudly
+   * answers `controller-deadline`.
+   */
+  controllerBudgetMs: 6_000,
+  /**
+   * A relay's bound on a registration, from its arrival at the relay to the answer, including any
+   * wait for the relay's own Cloudly link. It exceeds `controllerBudgetMs` by more than a second so
+   * Cloudly's own `controller-deadline` reaches the node through the relay, and stays below
+   * TypedSocket's 10 s connection-restore deadline (`TYPEDSOCKET_MAX_CONNECTION_RESTORE_TIMEOUT_MS`,
+   * which a client can only lower) so the node reads an answer before its restore hook times out.
+   * When it runs out the relay answers `controller-unavailable`.
+   */
+  relayRegistrationBudgetMs: 9_000,
+  /**
+   * A relay's bound on forwarding a session read or report over its established Cloudly link.
+   * It exceeds `controllerBudgetMs` so Cloudly's answer arrives first; when it runs out the relay
+   * answers `controller-unavailable`.
+   */
+  relaySessionForwardMs: 8_000,
+} as const);