@spfn/core 0.3.0-beta.31 → 0.3.0-beta.33

package/dist/{token-manager-Ckjt2-qq.d.ts → token-manager-CvOsAbnK.d.ts}

@@ -15,6 +15,11 @@
  * const subject = await manager.verify(token); // 'user-123'
  * const again = await manager.verify(token);   // null (already consumed)
  *
+ * // A token tagged with the device key it was minted for is refused at
+ * // consume once `verifyKey` says that key is gone
+ * const tagged = await manager.issue('user-123', { keyId: 'key-1' });
+ * const data = await manager.consume(tagged); // { subject, keyId, expiresAt } | null
+ *
  * // Cleanup on shutdown
  * manager.destroy();
  * ```
@@ -34,7 +39,14 @@ type CacheClient = {
 interface SSEToken {
     subject: string;
     expiresAt: number;
+    /** The device key the token was minted with; absent → an untagged token. */
+    keyId?: string;
 }
+/**
+ * Whether the device key a token was minted with still holds; `false` or a
+ * throw refuses the token.
+ */
+type SSEKeyVerifier = (keyId: string) => boolean | Promise<boolean>;
 /**
  * Token storage interface
  *
@@ -66,6 +78,14 @@ interface SSETokenManagerConfig {
      * @default 60000
      */
     cleanupInterval?: number;
+    /**
+     * Re-check, when a token is consumed, the device key it was minted with —
+     * a token minted before its key was revoked is then refused at open.
+     * Runs only for a token that carries a `keyId`; `false` or a throw
+     * refuses it. The token is consumed first, so a refused one is never
+     * retried. `@spfn/auth`'s one-time token manager supplies it.
+     */
+    verifyKey?: SSEKeyVerifier;
 }
 /**
  * Redis/Valkey-backed token store for multi-instance deployments.
@@ -95,6 +115,7 @@ declare class CacheTokenStore implements SSETokenStore {
 declare class SSETokenManager {
     private store;
     private ttl;
+    private verifyKey;
     private cleanupTimer;
     constructor(config?: SSETokenManagerConfig);
     /**
@@ -105,18 +126,41 @@ declare class SSETokenManager {
      */
     get ttlMs(): number;
     /**
-     * Issue a new one-time-use token for the given subject
+     * Issue a new one-time-use token for the given subject. `keyId` tags it
+     * with the device key it is minted for; an empty one leaves it untagged.
      */
-    issue(subject: string): Promise<string>;
+    issue(subject: string, options?: {
+        keyId?: string;
+    }): Promise<string>;
     /**
      * Verify and consume a token
      * @returns subject string if valid, null if invalid/expired/already consumed
      */
     verify(token: string): Promise<string | null>;
+    /**
+     * Consume a token and answer what it was minted with: `null` when it is
+     * unknown, expired, already consumed, or its key no longer holds
+     * (`verifyKey`). The token is gone either way. `take` + `checkKey`.
+     */
+    consume(token: string): Promise<SSEToken | null>;
+    /**
+     * The store half of `consume`: take the token out of the store and answer
+     * what it was minted with, `null` when it is unknown, expired or already
+     * consumed — its key is not checked yet (`checkKey`). For a caller that
+     * has to register the connection before the key check, so a revocation
+     * landing during the check reaches it.
+     */
+    take(token: string): Promise<SSEToken | null>;
+    /**
+     * The key half of `consume`: `verifyKey` on a tagged token; an untagged
+     * one, or no verifier, holds without a call. A throw refuses and is warned
+     * without its text — it may carry what the verifier read.
+     */
+    checkKey(data: SSEToken): Promise<boolean>;
     /**
      * Cleanup timer and resources
      */
     destroy(): void;
 }
 
-export { CacheTokenStore as C, SSETokenManager as S, type SSEToken as a, type SSETokenManagerConfig as b, type SSETokenStore as c };
+export { CacheTokenStore as C, SSETokenManager as S, type SSEKeyVerifier as a, type SSEToken as b, type SSETokenManagerConfig as c, type SSETokenStore as d };

package/dist/{types-CurMab2Q.d.ts → types-BrO7j6mR.d.ts}

@@ -1,6 +1,6 @@
 import { Context } from 'hono';
 import { E as EventRouterDef, I as InferEventNames, i as InferEventPayload, l as SubscribeRequest } from './router-CX5uVjmU.js';
-import { c as SSETokenStore, S as SSETokenManager } from './token-manager-Ckjt2-qq.js';
+import { d as SSETokenStore, S as SSETokenManager } from './token-manager-CvOsAbnK.js';
 
 /**
  * SSE Types
@@ -67,6 +67,14 @@ interface SSEHandlerAuthConfig {
      * @default (c) => c.get('auth')?.userId ?? null
      */
     getSubject?: (c: Context) => string | null;
+    /**
+     * Extract the device key the token is minted for, so that revoking the key
+     * closes the streams it opened (`closeSSEConnectionsByKey`) and refuses a
+     * token minted before the revocation (`SSETokenManagerConfig.verifyKey`).
+     * Empty, `null` or `undefined` → an untagged token, never closed by key.
+     * @default (c) => c.get('auth')?.keyId
+     */
+    getKeyId?: (c: Context) => string | null | undefined;
     /**
      * Subscription authorization hook (called once on connect)
      *
@@ -121,6 +129,7 @@ interface SSEAuthConfig<TRouter extends EventRouterDef<any>> {
     store?: SSETokenStore;
     tokenManager?: SSETokenManager | (() => SSETokenManager);
     getSubject?: (c: Context) => string | null;
+    getKeyId?: (c: Context) => string | null | undefined;
     authorize?: (subject: string, events: InferEventNames<TRouter>[]) => Promise<InferEventNames<TRouter>[]> | InferEventNames<TRouter>[];
     filter?: {
         [K in InferEventNames<TRouter>]?: (subject: string, payload: InferEventPayload<TRouter, K>) => boolean;
@@ -216,7 +225,9 @@ interface SSEClientConfig {
      * Acquire a one-time SSE token before connecting.
      *
      * Called on every (re)connect. The returned token is appended
-     * to the SSE URL as `?token=...`.
+     * to the SSE URL as `?token=...`. A rejection whose `statusCode` or
+     * `status` is 401 closes the subscription (`onClose('unauthorized')`)
+     * instead of reconnecting; any other rejection reconnects.
      *
      * For automatic token acquisition via RPC proxy, use `createAuthSSEClient` instead.
      *
@@ -283,8 +294,11 @@ interface SSESubscribeOptions<TRouter extends EventRouterDef<any>> {
      * - unsubscribe() is called
      * - client.close() is called
      * - Max reconnect attempts exceeded
+     * - `acquireToken` rejected with a 401 (`statusCode` or `status`): reason
+     *   `'unauthorized'`. The session that minted tokens is gone — e.g. its
+     *   device key was revoked — so the client stops instead of reconnecting.
      */
-    onClose?: () => void;
+    onClose?: (reason?: 'unauthorized') => void;
     /**
      * Called when reconnecting
      */

package/dist/{types-DncqXfWN.d.ts → types-DH6d2eOb.d.ts}

@@ -1,6 +1,6 @@
 import { Context } from 'hono';
 import { a as EventDef, o as EventRouterBase, I as InferEventNames, i as InferEventPayload } from './router-CX5uVjmU.js';
-import { c as SSETokenStore, S as SSETokenManager } from './token-manager-Ckjt2-qq.js';
+import { d as SSETokenStore, S as SSETokenManager } from './token-manager-CvOsAbnK.js';
 
 /**
  * WebSocket Types

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@spfn/core",
-    "version": "0.3.0-beta.31",
+    "version": "0.3.0-beta.33",
     "description": "Full-stack TypeScript backend for Next.js: file-based typed routes, Drizzle entities and repositories, PostgreSQL transactions and a generated end-to-end client, in one fixed vertical slice per feature",
     "type": "module",
     "exports": {

package/src/event/README.md

@@ -59,7 +59,9 @@ From `@spfn/core/event/sse`:
 
 - `createSSEHandler(router, config?, tokenManager?)` — Hono GET handler
 - `SSETokenManager` (class), `CacheTokenStore` (class)
-- Types: `SSEToken`, `SSETokenStore`, `SSETokenManagerConfig`, `SSEMessage`,
+- `closeSSEConnectionsByKey(keyId)` — close the streams a device key opened, on every pod
+  (see [Closing the streams of a revoked device key](#closing-the-streams-of-a-revoked-device-key))
+- Types: `SSEToken`, `SSETokenStore`, `SSETokenManagerConfig`, `SSEKeyVerifier`, `SSEMessage`,
   `SSEHandlerConfig`, `SSEHandlerAuthConfig`, `SSEAuthConfig`, `SSEClientConfig`,
   `SSEEventHandler`, `SSEEventHandlers`, `SSESubscribeOptions`, `SSESubscriptionChange`,
   `SSEConnectionState`, `SSEUnsubscribe`, `ConnectedPayload`
@@ -269,10 +271,10 @@ can't ride along on the stream request. SPFN uses a **token exchange**: an authe
 ```
 Client                              Server
   │  POST /events/token (Bearer JWT) │  ← protected by config.middlewares (e.g. authenticate)
-  │ ───────────────────────────────► │  getSubject(c) → issue one-time token
+  │ ───────────────────────────────► │  getSubject(c), getKeyId(c) → issue one-time token
   │  ◄─────────────────────────────  │  { token: "..." }   (default TTL 30s)
   │  GET /events/stream?token=…&events=…
-  │ ───────────────────────────────► │  verify+consume token (one-time)
+  │ ───────────────────────────────► │  consume token (one-time) → verifyKey(keyId) when tagged
   │                                   │  → authorize(subject, events)
   │                                   │  → resolvePrincipal(subject, request)   (once)
   │                                   │  → event.canSubscribe(ctx)              (once per event)
@@ -295,7 +297,7 @@ export default defineServerConfig()
         auth: { enabled: true },
     })
     .build();
-// → POST /events/token   (mints token; subject = c.get('auth').userId by default)
+// → POST /events/token   (mints token; subject = c.get('auth').userId, keyId = c.get('auth').keyId by default)
 // → GET  /events/stream?token=…&events=…
 ```
 
@@ -359,6 +361,54 @@ export default defineServerConfig()
 ```
 
 When `tokenManager` is provided, `store`/`tokenTtl` are ignored (the external manager owns them).
+`@spfn/auth`'s manager also checks the device key at consume (`verifyKey`, below), so sharing it
+is what makes a token minted before a sign-out useless after it.
+
+### Closing the streams of a revoked device key
+
+A stream outlives the token that opened it: the token is checked once, at open, and pings keep
+the stream alive. So the token carries the **device key** it was minted for, and revoking that
+key ends what it opened.
+
+- **The token is tagged.** The token endpoint passes `getKeyId(c)` (default
+  `c.get('auth')?.keyId`; an app without `auth` is fine) to `issue(subject, { keyId })`. An
+  empty, `null` or `undefined` key leaves the token untagged — such a stream is never closed by
+  key. A non-device value (`'service'`) is stored as given; nothing asks to close it.
+- **A token minted before the revocation is refused at open.** `SSETokenManagerConfig.verifyKey`
+  runs when a tagged token is consumed; `false` or a throw refuses it (`401`). The token is
+  consumed first, so a refused token is never retried. The throw is warned without its text.
+- **`closeSSEConnectionsByKey(keyId)` ends the open ones.** It closes, on this process, every
+  stream whose token carried `keyId` — every `createSSEHandler` of the process, not one — and a
+  connect of that key still in admission ends at open, with no `connected` frame and no
+  subscription. With a cache (resolved lazily from `getCache()`, so a pod serving no events
+  publishes too) it then publishes `{ kind: 'close', keyId }` on the same control channel as
+  `grant` / `revoke`, `<channelPrefix>$control`
+  ([Multi-instance broadcast](#multi-instance-broadcast-cross-pod-fan-out)), so every other pod
+  whose events are wired through the cache closes its own — whatever events it serves; a pod
+  skips its own echo, and a close without a string `keyId` is malformed and ignored. A failed publish is warned and swallowed: the promise
+  always resolves. A close this pod cannot publish while the transport's breaker is open, or
+  whose publish fails, closes this pod's streams at once and is re-sent when the breaker
+  cooldown ends and whenever the next publish succeeds; while it is pending, the key's streams on
+  other pods stay open. A held close is lost only when the Redis outage outlasts this pod (its
+  shutdown disposes held closes) or when more than 1000 closes are held (the oldest are dropped);
+  those streams then stay open until they disconnect, and their next token mint is refused. At most 1000 closes wait; past
+  that the oldest is dropped, with a warning that gives the count. The log says how many closed and why — never the key id.
+
+```typescript
+import { closeSSEConnectionsByKey } from '@spfn/core/event/sse';
+import { onAfterCommit } from '@spfn/core/db';
+
+// after your own revocation statement
+onAfterCommit(() => closeSSEConnectionsByKey(revokedKeyId));
+```
+
+`@spfn/auth` does this for every key revocation (sign out one device, sign out everywhere,
+logout, password change and reset, account deletion, rotation, renewal, re-login): an app on
+`tokenManager: () => getOneTimeTokenManager()` gets it with no configuration change. The client
+whose stream closed reconnects within `reconnectDelay`; its token mint then answers `401` and
+it stops (`onClose('unauthorized')`, see the [client](#createauthsseclientconfig--with-auth-recommended)).
+A device whose key was *replaced* (rotation, renewal) reconnects with the new key, which the
+response installed meanwhile.
 
 ### Authorization hooks
 
@@ -553,6 +603,7 @@ client.subscribe({
 | `store` | `SSETokenStore` | auto (Cache → InMemory) | token storage backend |
 | `tokenManager` | `SSETokenManager \| () => SSETokenManager` | — | reuse an external manager (lazy resolver recommended); overrides `store`/`tokenTtl` |
 | `getSubject` | `(c: Context) => string \| null` | `c.get('auth')?.userId ?? null` | extract subject on the token endpoint |
+| `getKeyId` | `(c: Context) => string \| null \| undefined` | `c.get('auth')?.keyId` | the device key the token is tagged with; empty → untagged ([revoked keys](#closing-the-streams-of-a-revoked-device-key)) |
 | `authorize` | `(subject, events[]) => events[] \| Promise<…>` | — | subscription authorization (once on connect) |
 | `filter` | `{ [event]?: (subject, payload) => boolean }` | — | per-event payload filter |
 | `resolvePrincipal` | `(subject, request) => unknown \| Promise<unknown>` | — | principal for every `canSubscribe` (once per connection); a throw ⇒ `403` |
@@ -659,6 +710,13 @@ export const { GET, POST } = createRpcProxy({
 });
 ```
 
+**A `401` from the token mint is final.** When `acquireToken` rejects with an error whose
+`statusCode` (a registered class such as `UnauthorizedError`) or `status` (the api client's
+`ApiError`, and `createAuthSSEClient`'s own error) is `401`, the client closes the
+subscription and calls `onClose('unauthorized')` once, instead of reconnecting — the session
+is gone (its device key was revoked), and retrying would mint and fail every `reconnectDelay`
+forever. Any other rejection reconnects as before. `onClose` stays assignable from `() => void`.
+
 ### `subscribeToEvents(events, handlers, config?)` — one-shot helper
 
 ```typescript
@@ -742,7 +800,8 @@ payload can't serialize, the event is **still delivered to this pod's own subscr
 asymmetric case where the publish succeeds but **this pod's subscriber socket is down** (its
 echo — the only path to same-pod streams — wouldn't arrive). A sustained publish outage trips
 a short circuit breaker so emits fast-path to local instead of each paying the publish timeout.
-A publish never crashes `emit` or kills a stream. ioredis auto-reconnects and re-subscribes
+A publish never crashes `emit` or kills a stream. Events are not re-sent; a key close is (see
+`closeSSEConnectionsByKey`). ioredis auto-reconnects and re-subscribes
 (autoResubscribe, default true). A per-event SUBSCRIBE failure at
 startup degrades that event to in-process (logged) rather than aborting boot. Same-pod
 delivery costs one Redis round-trip — for a single-replica deploy with a cache, prefer
@@ -848,7 +907,8 @@ fully decoupled.
   this: on error with `acquireToken` set, it closes and reconnects through its own path to
   mint a fresh token. Don't disable `reconnect` expecting native retry to work with auth.
 - **Stream-time errors aren't subscription errors.** `authorize` returning `[]` ⇒ `403` at
-  connect; invalid event names ⇒ `400`; missing/expired token ⇒ `401`. `onError` on the
+  connect; invalid event names ⇒ `400`; missing/expired token, or one whose key `verifyKey`
+  refuses ⇒ `401`. `onError` on the
   client fires for transport-level drops, not for these HTTP rejections — check the network
   response when a connection never opens.
 - **Subject default.** Without a custom `getSubject`, the token endpoint reads

package/src/state/README.md

@@ -602,13 +602,13 @@ export function Shell({ initial, workspaceId }: { initial: StateClientInitial<ty
 | Member | Behaviour |
 | --- | --- |
 | `get(id, key?)` | `GET` `get<Id>State`, key fields in the query. The answer is applied under the ordering rule and returned |
-| `snapshot(query?)` | `GET getStates`, by default with the stream's query. Each state in the answer is applied, and each subscribed state it omits is marked `'revoked'` (below); the snapshot is returned. A rejected fetch rejects and changes nothing |
+| `snapshot(query?)` | `GET getStates`, by default with the stream's query. Each state in the answer is applied, and each state it omits whose key the query carries — subscribed or not — is marked `'revoked'` (below); the snapshot is returned. A rejected fetch rejects and changes nothing |
 | `subscribe(id, key?, listener)` | Registers the listener for `(id, key)` and returns its unsubscribe (idempotent). The listener is called when the entry's `status`, `value` or `data` changes — never for an arrival that differs only by a newer `at` (Ordering, below). The client's first subscriber reads the snapshot, then opens the stream (below) |
 | `write(id, input, key?)` | `put<Id>State` with the input as the body, key fields in the query. The answer is applied at once — before the frame the write also sends — and returned. Typed only for a state with a write, and requires the key on a keyed one |
 | `current(id, key?)` | Synchronous: `{ at, value, data?, status }`, `{ status: 'revoked' }` for a state revoked before any value arrived, or `undefined`. The same frozen object until a change is applied |
 | `connection()` | Synchronous: the connection status ([Connection status](#connection-status)), a frozen object, the same reference until it changes |
 | `subscribeConnection(listener)` | Registers `listener(status)`, called with the new status on every change, after `connection()` returns it; returns its unsubscribe (idempotent). The same function subscribed twice is two subscriptions |
-| `retry()` | When `'failed'` or `'reconnecting'`: reads the first snapshot now (its retry count reset), or, once the manifest is known, reopens the stream now. A no-op when `'connected'`, while the first snapshot is in flight, and with nothing subscribed — after `close()` too, until a new `subscribe` |
+| `retry()` | When `'failed'`, `'reconnecting'` or `'closed'` (unauthorized — after the user signed in again): reads the first snapshot now (its retry count reset), or, once the manifest is known, reopens the stream now. A no-op when `'connected'`, while the first snapshot is in flight, and with nothing subscribed — after `close()` too, until a new `subscribe` |
 | `close()` | Closes the stream, drops every listener — connection listeners too — and stops listening to `online`; the status is back to `'reconnecting'` 0. Idempotent. A `subscribe` after it starts the client again, without `online`: `retry()` restarts it as before |
 
 `onError` receives a failure of something the client ran on its own — the first snapshot, the
@@ -635,7 +635,12 @@ entry, and compares each arrival against it.
 | `at` older than the stamp | dropped |
 | a snapshot older than one state's stamp | that state keeps its entry; the others take the snapshot |
 | a write answer | applied like a frame — its own frame, arriving later with the same `at` and value, changes nothing |
-| a frame for a key not subscribed here | dropped (the server already filters by the connect query; this is the second guard) |
+| a frame for a key the stream's query does not carry | dropped (the server already filters by the connect query; this is the second guard) |
+
+Frames for every state the stream's query carries — keyless, or keyed on the key the query carries
+— are applied whether or not anything here subscribes to them. A later subscribe that does not
+reopen the stream (a keyless state, or a key the query already carries) is then served the newest
+value — never the older snapshot, never nothing.
 
 Every stream open — the first, a reconnect, a reopen on a key change — brings each state's
 current value with a newer `at`: the stream's initial frame, or the snapshot re-read when the
@@ -671,7 +676,7 @@ changed.
   ordering rule, so whatever changed between the render and the open arrives as a newer `at`.
   The client reads the snapshot only when a state it requested is neither in `initial` nor in
   `deniedEvents` — a state whose read threw on the server — or when `initial` is absent (a
-  server before it); a state in `deniedEvents` it watches on the carried key is `'revoked'`.
+  server before it); a state in `deniedEvents` is `'revoked'` on the carried key, watched or not.
   (It all runs on the stream's `connected`, not at `onReconnect`: a read before the new stream
   is live would leave the same gap.)
 - **One value per key field per connection.** A connect query carries one `workspaceId`; when
@@ -690,6 +695,7 @@ first snapshot — so it says where they stand. `connection()` is one of:
 | `{ status: 'connected' }` | a stream is open (the SSE `onOpen`) |
 | `{ status: 'reconnecting', attempt }` | no stream open — not yet, or nothing subscribed — or the SSE client retrying a dropped one: `attempt` is its count (`onReconnect`), reset when a stream opens; `0` before the first stream opens, while the first snapshot is read or retried, and after `retry()` |
 | `{ status: 'failed' }` | the retries are exhausted: the SSE client's `maxReconnectAttempts` (its `onClose`, the attempts spent), or `maxRetries` for the first snapshot. Nothing more is tried until a restart (below) or, with the manifest unknown, a `get`, `write` or `snapshot` that brings it |
+| `{ status: 'closed', reason: 'unauthorized' }` | the stream's token mint answered `401` (the SSE client's `onClose('unauthorized')`): the session is gone — its device key was revoked, e.g. "sign out this device" from another one. No retry is set, and neither `online` nor a `subscribe` reopens it; only the app's own `retry()`, once the user signed in again, does |
 
 - **Start value** `{ status: 'reconnecting', attempt: 0 }`, a client built with `initial` too:
   its entries are ready, its stream is not.
@@ -710,10 +716,17 @@ first snapshot — so it says where they stand. `connection()` is one of:
 - **`close()`** sets `'reconnecting'` 0, drops the connection listeners and removes the
   `online` listener; its own teardown is not `'failed'`. A `subscribe` after it starts the
   client again, and `retry()` restarts it; `online` is not listened to again.
+- **`'closed'` / `'unauthorized'`** is not a network failure, so nothing restarts it on its
+  own: not `online`, not a `subscribe`. `retry()` reopens the stream (`'reconnecting'` 0); the
+  last unsubscribe resets the client to the start value, as from any status.
 
 ```tsx
 const connection = useConnectionStatus(state);
 
+if (connection.status === 'closed')
+{
+    return <Banner>You were signed out on this device.</Banner>;   // connection.reason === 'unauthorized'
+}
 if (connection.status === 'failed')
 {
     return <Banner action={() => state.retry()}>The server has a problem.</Banner>;
@@ -737,8 +750,8 @@ value has arrived yet.
 | Arrival | Client |
 | --- | --- |
 | `subscription.revoked` for `state.<id>.changed` | the entry of `id` for **the key the connection carries** (keyless: its one entry) gets `status: 'revoked'`, value kept, listeners notified. The server scopes a revoke by the connect query, so a shadowed key of the same state is untouched |
-| `connected.deniedEvents` names a subscribed state — keyless, or keyed on the key the connection carries | `'revoked'`, value kept, listeners notified: the connect check (`canRead` false, or the key absent) denied it. A shadowed key of the same state is untouched |
-| a snapshot that omits a subscribed state — keyless, or keyed with its key in the query | `'revoked'`, value kept if one exists, listeners notified. This is also a state denied at connect (`canRead` false, absent from the snapshot), and a reconnect after access was lost while the stream was down, when no revoke could arrive. A keyed state whose key the query did not carry is not marked |
+| `connected.deniedEvents` names a state — keyless, or keyed on the key the connection carries — subscribed or not | `'revoked'`, value kept, listeners notified: the connect check (`canRead` false) denied it. A state denied because the query lacks one of its key fields is not marked under any key; a shadowed key of the same state is untouched |
+| a snapshot that omits a state — keyless, or keyed with its key in the query — subscribed or not | `'revoked'`, value kept if one exists, listeners notified. This is also a state denied at connect (`canRead` false, absent from the snapshot), and a reconnect after access was lost while the stream was down, when no revoke could arrive. A keyed state whose key the query did not carry is not marked |
 | a frame, a read or a snapshot started before the revoke | supplies its value under the ordering rule; the status stays `'revoked'` |
 | `subscription.granted` for it | clears the mark for the carried key and reads it once (`get`); the server also sends a frame, before or after the control frame. Both arrive `'ready'`, and either order ends at the latest value |
 | a frame — the initial one included — or the snapshot of a connection opened after the revoke, holding the state | clears the mark: that connection's own connect check served it |