@threadedstack/wmd-web 0.1.12 → 0.1.14

package/relay/hosted.ts

@@ -1,64 +1,42 @@
-// W59 S7: the `--hosted` profile (plan §15): what a public relay we run adds to the engine.
+// W59 §16: the `--hosted` profile's rules (plan §16, A-J). Every number names its source there.
 //
-// The governor holds every hosted-only limit and list, and nothing else: it does not touch sockets. The engine
-// (engine.ts, its `guard` hook) and the Wisp adapter (wisp.ts) ask it, at the points where a session is admitted,
-// a stream is opened or bytes move, and the relay (relay.ts) asks it for the state shown at /healthz and set by the
-// control socket. Clocks are injectable, so every limit is tested without waiting.
+// The governor holds the hosted rules and lists and touches no socket. The engine (its `guard` hook) and the Wisp
+// adapter ask it where a session is admitted, a stream is opened or bytes move; the relay asks it for /healthz and the
+// control socket, and gives it `reclaim` (rule G). Clocks and the host are injectable, so every rule is tested without
+// waiting.
 //
-// Keys: an "address group" is wisp.ts's `grp` (an IPv4 address, or an IPv6 /64: token.ts clientKey); a "coarse
-// group" is the IPv4 /24 or IPv6 /48 around it. Page origins are a fairness control for cooperating browsers only: any
-// script can send any Origin, so every origin budget is also bounded by the address's own share and caps.
-
-import { readFileSync, renameSync, writeFileSync } from 'node:fs'
-import { Bucket, type Session, type Shared, type Stream } from './engine.ts'
+// Abuse rules are keyed on the client address, never on the browser's instance id, which a page picks itself. An
+// "address group" is wisp.ts's `grp` (an IPv4 address, or an IPv6 /64: token.ts clientKey); a "network" is the IPv4 /24
+// or IPv6 /48 around it.
+
+import { spawnSync } from 'node:child_process'
+import { getServers } from 'node:dns'
+import { readFileSync, readdirSync, renameSync, writeFileSync } from 'node:fs'
+import { freemem } from 'node:os'
+import { join } from 'node:path'
+import { Bucket, type Session, type Stream } from './engine.ts'
 import { type Addr, type Cidr, addrString, cidrContains, hostedBlockedReason, parseCidr, parseIP } from './policy.ts'
 
-const MIB = 1 << 20
-const GIB = 2 ** 30
+const HOUR = 3_600_000
 
 export type HostedOptions = {
   abuseContact: string
   version?: string
   startStopped?: boolean // begin in stop-new: nothing is taken until `ctl resume` (a stop does not persist a restart otherwise)
   now?: () => number // ms since the epoch (tests)
-  // per address group
-  groupStreams?: number // streams open at once, all its sessions (128)
-  groupConnectsPerMin?: number // (300)
-  groupBytesPerHour?: number // both ways (2 GiB)
-  groupDnsPerMin?: number // (600)
-  // per coarse group (IPv4 /24, IPv6 /48)
-  coarseSessions?: number // (64)
-  coarseInstancesPerHour?: number // new instances (240)
-  coarseRateDown?: number // bytes/s, all its addresses together (16 MiB/s)
-  coarseRateUp?: number // (4 MiB/s)
-  // per page origin
-  originTable?: number // origins remembered (1000, LRU)
-  originSessions?: number // sessions of one origin (400)
-  originShare?: number // the most of an origin one address group may use, 0-1 (0.25)
-  otherOriginSessions?: number // "other origins" and `Origin: null`: one shared budget (200)
-  noOriginSessions?: number // requests without an Origin (16)
-  originsPerAddrPerHour?: number // distinct origins one address group may use before it falls into "other" (8)
-  originRateDown?: number // bytes/s of one origin (32 MiB/s)
-  originRateUp?: number // (8 MiB/s)
-  // the whole relay
-  maxStreams?: number // streams open at once, all sessions: a file-descriptor budget below the host's limit (20,000)
-  maxRateDown?: number // bytes/s (64 MiB/s)
-  maxRateUp?: number // (16 MiB/s)
-  maxBytesPerDay?: number // both ways; 0 = no ceiling
-  maxBytesPerMonth?: number
-  usageFile?: string // the day and month counters survive a restart here
-  ceilingGraceMs?: number // after a ceiling is reached, streams already open may run this long, then they end (60 s)
-  onCeilingGrace?: (words: string) => void // called when the grace is over and the ceiling is still in force: end the open streams
   warn?: (line: string) => void // one-line operator notices (stderr)
-  // against third parties
-  destConnectsPerMin?: number // per destination (host:port) per coarse group (600)
-  destStreams?: number // streams to one destination at once per coarse group (200)
-  distinctDests?: number // distinct destinations per address group per 10 minutes (100)
-  failedConnects?: number // refused, unreachable or timed-out dials per address group before it cools off (20)
-  failedWindowMs?: number // (5 min)
-  failedCoolMs?: number // (5 min)
+  sites?: string[] // A: page origin patterns served (required: none listed serves no page)
+  sitesPerAddrPerHour?: number // B: different sites per address group per hour (200: plan §16)
+  sitesPerNetPerHour?: number // B: per network (800)
+  monthBytes?: number // C: bytes relayed per UTC month (the operator's figure from the provider's free outbound data); 0 = no cap
+  usageFile?: string // C: the month's counter survives a restart here
+  dialLimitMs?: number // D, G: the engine's dial limit (connectTimeoutMs, 10 s)
+  fdLimit?: number // E: the open-file limit (read from the host when absent)
+  fdOpen?: number // E: descriptors open at start (read from the host when absent)
+  dnsServers?: number // E: resolvers the relay asks (each may hold a UDP and a TCP socket)
+  freeMem?: () => number // E: free memory in bytes (os.freemem)
+  linkBytesPerSec?: number // F: the host's link speed, from its network shape; absent = no bandwidth sharing
   denyCidrs?: string[] // dialled addresses refused besides the built-in ranges (the fleet's own neighbours)
-  tableMax?: number // address and coarse groups remembered per table (50000)
 }
 
 export type DenySpec = {
@@ -67,75 +45,32 @@ export type DenySpec = {
   destinations?: string[] // "name", "name:port", ".suffix" (and its apex), or a literal address
 }
 
-export type Refusal = { status: number; body: string }
+/** A refusal or slowdown, as the page hears it (wmd-reason): the rule's name, words, and when it lifts (ms, 0 = no time). */
+export type Why = { rule: string; words: string; until?: number }
+
+/** What the relay tells a live session (wmd-reason); kind 1 refused, 2 slowed, 3 cleared. */
+export type Tell = (kind: number, rule: string, until: number, words: string) => void
 
-/** A live session, as the deny lists see it. */
-export type Handle = { ip: string; origin: string; end: (words: string) => void }
+/** A live session, as the deny lists and the slowdowns see it. */
+export type Handle = { ip: string; grp: string; origin: string; end: (why: Why) => void; tell?: Tell }
 
 /** What a session holds from the governor until it ends. */
 export type Admission = {
   grp: string
-  coarse: string
-  budget: OriginBudget
-  addrBucket: Shared
-  down: Bucket[]
-  up: Bucket[]
+  net: string
   handle: Handle
+  fair: Bucket | null
+  sent: number
+  waiting: boolean
   release: () => void
 }
 
-type OriginBudget = {
-  key: string
-  cap: number
-  sessions: number
-  perAddr: Map<string, { n: number; shared: Shared }>
-  shared: Shared
-}
-
-/** A sliding window of event times on an injectable clock. */
-class Hits {
-  times: number[] = []
-  constructor(public max: number, public ms: number) {}
-  prune(t: number) {
-    let i = 0
-    while (i < this.times.length && t - this.times[i] > this.ms) i++
-    if (i) this.times.splice(0, i)
-  }
-  hit(t: number): boolean {
-    this.prune(t)
-    if (this.times.length >= this.max) return false
-    this.times.push(t)
-    return true
-  }
-  last(): number {
-    return this.times.length ? this.times[this.times.length - 1] : 0
-  }
-}
-
-/** A table that forgets its least recently used entry past `max`. */
-class Lru<V> {
-  m = new Map<string, V>()
-  constructor(public max: number) {}
-  get(k: string): V | undefined {
-    const v = this.m.get(k)
-    if (v !== undefined) {
-      this.m.delete(k)
-      this.m.set(k, v)
-    }
-    return v
-  }
-  set(k: string, v: V) {
-    this.m.delete(k)
-    this.m.set(k, v)
-    while (this.m.size > this.max) this.m.delete(this.m.keys().next().value as string)
-  }
-  delete(k: string) {
-    this.m.delete(k)
-  }
-  get size() {
-    return this.m.size
-  }
-}
+// E: what one session and one stream held in the loopback load test (docs/relay-hosted.md, "Measured on this machine")
+const SESSION_MEM = 30 << 10
+const STREAM_MEM = 8 << 10
+// E: descriptors the relay opens for itself besides the resolvers: a log file being rotated, the usage file being
+// written, and a control socket connection
+const OWN_FDS = 3
 
 const ipv4Group = /^\d+\.\d+\.\d+\.\d+$/
 
@@ -195,41 +130,143 @@ function compact6(a: Addr): string {
   return best < 0 ? h(w) : `${h(w.slice(0, best))}::${h(w.slice(best + bestLen))}`
 }
 
+
 type Dest = { name: string; port: number; suffix: boolean }
 
+/** A: origin patterns. `scheme://name[:port]`; a leading `*.` is any name under the domain, a `*` inside a label is
+    one or more of [a-z0-9-] (preview channels: `name--*.web.app`), `:*` is any port; no port is the default port. */
+export function compileSites(list: string[]): (origin: string) => boolean {
+  const res = list.map(p => {
+    const bad = new Error(`site list: '${p}' is not an origin pattern (https://name, https://*.domain, https://name--*.web.app, http://localhost:*)`)
+    const m = String(p).trim().toLowerCase().match(/^(https?):\/\/([a-z0-9*.-]+|\[::1\])(?::(\d{1,5}|\*))?$/)
+    if (!m) throw bad
+    let host = '\\[::1\\]'
+    if (m[2] !== '[::1]') {
+      const labels = m[2].split('.')
+      const any = labels[0] === '*'
+      const rest = any ? labels.slice(1) : labels
+      if (!rest.length || rest.some(l => !l || l === '*' || !/^[a-z0-9-]*(\*[a-z0-9-]*)?$/.test(l)) || rest[rest.length - 1].includes('*')) throw bad
+      host = (any ? '(?:[a-z0-9-]+\\.)+' : '') + rest.map(l => l.replace('*', '[a-z0-9-]+')).join('\\.')
+    }
+    const port = m[3] === '*' ? '(?::\\d{1,5})?' : m[3] ? `:${m[3]}` : ''
+    return new RegExp(`^${m[1]}://${host}${port}$`)
+  })
+  return (origin: string) => !!origin && res.some(r => r.test(origin.toLowerCase()))
+}
+
+/** E: the open-file limit and the descriptors open now. */
+export function hostLimits(): { fdLimit: number; fdOpen: number } {
+  const r = spawnSync('sh', ['-c', 'ulimit -n'], { encoding: 'utf8' })
+  const t = String(r.stdout || '').trim()
+  const fdLimit = t === 'unlimited' ? Number.MAX_SAFE_INTEGER : Number(t)
+  if (!Number.isFinite(fdLimit) || fdLimit <= 0) throw new Error(`cannot read the open-file limit (ulimit -n said '${t}')`)
+  let fdOpen: number
+  try {
+    fdOpen = readdirSync('/dev/fd').length - 1 // less the descriptor that lists the directory
+  } catch {
+    fdOpen = readdirSync('/proc/self/fd').length - 1
+  }
+  return { fdLimit, fdOpen }
+}
+
+/** E: free memory as the relay can use it: the host's free memory, or the room left under the service's own memory cap
+    (cgroup v2 memory.max less memory.current, as systemd's MemoryMax= sets it) when that is smaller. Read on each call. */
+export function memoryRoom(o: { procCgroup?: string; cgroupRoot?: string; hostFree?: () => number } = {}): () => number {
+  const hostFree = o.hostFree ?? freemem
+  const root = o.cgroupRoot ?? '/sys/fs/cgroup'
+  let dir: string | null = null
+  try {
+    const line = readFileSync(o.procCgroup ?? '/proc/self/cgroup', 'utf8').split('\n').find(l => l.startsWith('0::'))
+    if (line) dir = join(root, line.slice(3).trim())
+  } catch {
+    dir = null // no cgroup v2 here (macOS, or a v1 host): the host's free memory is all there is
+  }
+  return () => {
+    const free = hostFree()
+    if (!dir) return free
+    try {
+      const max = readFileSync(join(dir, 'memory.max'), 'utf8').trim()
+      if (max === 'max') return free
+      const room = Number(max) - Number(readFileSync(join(dir, 'memory.current'), 'utf8').trim())
+      return Number.isFinite(room) ? Math.min(free, Math.max(0, room)) : free
+    } catch {
+      return free
+    }
+  }
+}
+
+type Victim = { kind: 'handshake'; at: number } | { kind: 'stream'; net: string; addr: string; sid: string; last: number }
+
+/** G: what to close when sockets run out: the oldest unfinished handshake; else, of the streams idle for at least the
+    dial limit, the longest idle one of the network, then address, then session holding the most streams. */
+export function pickVictim<H extends { kind: 'handshake'; at: number }, S extends { kind: 'stream'; net: string; addr: string; sid: string; last: number }>(handshakes: H[], streams: S[], now: number, idleMs: number): H | S | null {
+  if (handshakes.length) return handshakes.reduce((a, b) => (b.at < a.at ? b : a))
+  const count = (key: (x: S) => string) => {
+    const m = new Map<string, number>()
+    for (const x of streams) m.set(key(x), (m.get(key(x)) || 0) + 1)
+    return m
+  }
+  let idle = streams.filter(x => now - x.last >= idleMs)
+  if (!idle.length) return null
+  for (const key of [(x: S) => x.net, (x: S) => `${x.net}|${x.addr}`, (x: S) => `${x.net}|${x.addr}|${x.sid}`]) {
+    const n = count(key)
+    const top = Math.max(...idle.map(x => n.get(key(x))!))
+    idle = idle.filter(x => n.get(key(x)) === top)
+  }
+  return idle.reduce((a, b) => (b.last < a.last ? b : a))
+}
+
+/** F: max-min shares of `capacity` over networks, then addresses, then sessions. Infinity for all when they want less. */
+export function maxMinShares(capacity: number, list: { net: string; addr: string; sid: string; want: number }[]): Map<string, number> {
+  const out = new Map<string, number>()
+  if (list.reduce((t, x) => t + x.want, 0) <= capacity) {
+    for (const x of list) out.set(x.sid, Infinity)
+    return out
+  }
+  type Node = { want: number; kids?: Map<string, Node>; sid?: string }
+  const root: Node = { want: 0, kids: new Map() }
+  for (const x of list) {
+    let n = root
+    for (const k of [x.net, x.addr]) {
+      let c = n.kids!.get(k)
+      if (!c) n.kids!.set(k, (c = { want: 0, kids: new Map() }))
+      n = c
+    }
+    n.kids!.set(x.sid, { want: x.want, sid: x.sid })
+  }
+  const total = (n: Node): number => (n.kids ? (n.want = [...n.kids.values()].reduce((t, c) => t + total(c), 0)) : n.want)
+  total(root)
+  const share = (n: Node, cap: number) => {
+    if (!n.kids) return void out.set(n.sid!, cap)
+    const kids = [...n.kids.values()].sort((a, b) => a.want - b.want)
+    let left = cap
+    for (let i = 0; i < kids.length; i++) {
+      const even = left / (kids.length - i)
+      const give = Math.min(kids[i].want, even)
+      share(kids[i], give)
+      left -= give
+    }
+  }
+  share(root, capacity)
+  return out
+}
+
 export function createGovernor(o: HostedOptions) {
   const now = o.now ?? Date.now
-  const tableMax = o.tableMax ?? 50_000
+  const warn = o.warn ?? ((m: string) => void process.stderr.write(`${m}\n`))
+  const host = o.fdLimit === undefined || o.fdOpen === undefined ? hostLimits() : null
   const c = {
-    groupStreams: o.groupStreams ?? 128,
-    groupConnectsPerMin: o.groupConnectsPerMin ?? 300,
-    groupBytesPerHour: o.groupBytesPerHour ?? 2 * GIB,
-    groupDnsPerMin: o.groupDnsPerMin ?? 600,
-    coarseSessions: o.coarseSessions ?? 64,
-    coarseInstancesPerHour: o.coarseInstancesPerHour ?? 240,
-    coarseRateDown: o.coarseRateDown ?? 16 * MIB,
-    coarseRateUp: o.coarseRateUp ?? 4 * MIB,
-    originTable: o.originTable ?? 1000,
-    originSessions: o.originSessions ?? 400,
-    originShare: o.originShare ?? 0.25,
-    otherOriginSessions: o.otherOriginSessions ?? 200,
-    noOriginSessions: o.noOriginSessions ?? 16,
-    originsPerAddrPerHour: o.originsPerAddrPerHour ?? 8,
-    originRateDown: o.originRateDown ?? 32 * MIB,
-    originRateUp: o.originRateUp ?? 8 * MIB,
-    maxStreams: o.maxStreams ?? 20_000,
-    maxRateDown: o.maxRateDown ?? 64 * MIB,
-    maxRateUp: o.maxRateUp ?? 16 * MIB,
-    maxBytesPerDay: o.maxBytesPerDay ?? 0,
-    maxBytesPerMonth: o.maxBytesPerMonth ?? 0,
-    destConnectsPerMin: o.destConnectsPerMin ?? 600,
-    destStreams: o.destStreams ?? 200,
-    distinctDests: o.distinctDests ?? 100,
-    failedConnects: o.failedConnects ?? 20,
-    failedWindowMs: o.failedWindowMs ?? 5 * 60_000,
-    failedCoolMs: o.failedCoolMs ?? 5 * 60_000,
-    ceilingGraceMs: o.ceilingGraceMs ?? 60_000,
-  }
+    sitesPerAddrPerHour: o.sitesPerAddrPerHour ?? 200,
+    sitesPerNetPerHour: o.sitesPerNetPerHour ?? 800,
+    monthBytes: o.monthBytes ?? 0,
+    dialLimitMs: o.dialLimitMs ?? 10_000,
+    fdLimit: o.fdLimit ?? host!.fdLimit,
+    fdOpen: o.fdOpen ?? host!.fdOpen,
+    dnsServers: o.dnsServers ?? getServers().length,
+    linkBytesPerSec: o.linkBytesPerSec ?? 0,
+  }
+  const freeMem = o.freeMem ?? memoryRoom()
+  const budget = Math.max(0, c.fdLimit - c.fdOpen - 2 * c.dnsServers - OWN_FDS)
   const denyCidrs = (o.denyCidrs ?? []).map(s => {
     const x = parseCidr(s)
     if (!x) throw new Error(`deny-cidr '${s}' is not an address or CIDR`)
@@ -238,38 +275,20 @@ export function createGovernor(o: HostedOptions) {
   const contact = o.abuseContact
   const contactLine = `abuse contact: ${contact}\n`
 
-  // ---- state set by the operator (control socket) and by the ceilings
   let stopped = !!o.startStopped
   let draining = false
 
-  // ---- tables
-  const groupStreams = new Map<string, number>()
-  const groupConnects = new Lru<Hits>(tableMax)
-  const groupDns = new Lru<Hits>(tableMax)
-  const groupBytes = new Lru<{ hour: number; n: number }>(tableMax)
-  const groupDests = new Lru<Map<string, number>>(tableMax)
-  const groupFails = new Lru<{ hits: Hits; cool: number }>(tableMax)
-  const coarseSessions = new Map<string, number>()
-  const coarseInstances = new Lru<Hits>(tableMax)
-  const coarseShared = new Lru<Shared>(tableMax)
-  const destConnects = new Lru<Hits>(tableMax)
-  const destLive = new Map<string, number>()
-  const addrOrigins = new Lru<Map<string, number>>(tableMax) // per address group: origin -> first seen (this hour)
-  const origins = new Lru<OriginBudget>(c.originTable) // by origin; entries with live sessions are never evicted
-  const mk = (key: string, cap: number): OriginBudget => ({
-    key, cap, sessions: 0, perAddr: new Map(),
-    shared: { down: new Bucket(c.originRateDown), up: new Bucket(c.originRateUp) },
-  })
-  const other = mk('other', c.otherOriginSessions)
-  const none = mk('none', c.noOriginSessions)
-  const globalShared: Shared = { down: new Bucket(c.maxRateDown), up: new Bucket(c.maxRateUp) }
-  const live = new Set<Handle>()
-  let liveStreams = 0
+  // ---- A
+  let siteOk = compileSites(o.sites ?? [])
+  function setSites(list: string[]) {
+    siteOk = compileSites(list)
+  }
 
   // ---- deny lists
   let denyAddr: Cidr[] = []
   let denyOrigin = new Set<string>()
   let denyDest: Dest[] = []
+  const live = new Set<Handle>()
 
   function reloadDeny(spec: DenySpec): { ended: number } {
     const addrs: Cidr[] = []
@@ -298,10 +317,10 @@ export function createGovernor(o: HostedOptions) {
     return { ended }
   }
 
-  function deniedClient(ip: string, origin: string): string | null {
+  function deniedClient(ip: string, origin: string): Why | null {
     const a = parseIP(ip)
-    if (a && denyAddr.some(x => cidrHas(x, unmap(a)))) return 'this address is blocked by the operator'
-    if (origin && denyOrigin.has(origin)) return 'this page origin is blocked by the operator'
+    if (a && denyAddr.some(x => cidrContains(x, unmap(a)))) return { rule: 'denied-address', words: 'this address is blocked by the operator' }
+    if (origin && denyOrigin.has(origin)) return { rule: 'denied-origin', words: 'this page origin is blocked by the operator' }
     return null
   }
 
@@ -310,11 +329,13 @@ export function createGovernor(o: HostedOptions) {
     return denyDest.some(d => (!d.port || d.port === port) && (h === d.name || (d.suffix && h.endsWith(`.${d.name}`))))
   }
 
-  // ---- ceilings
-  const day = (t: number) => new Date(t).toISOString().slice(0, 10)
-  const month = (t: number) => new Date(t).toISOString().slice(0, 7)
-  const warn = o.warn ?? ((m: string) => void process.stderr.write(`${m}\n`))
-  let usage = { day: day(now()), dayBytes: 0, month: month(now()), monthBytes: 0 }
+  // ---- C: the month
+  const monthOf = (t: number) => new Date(t).toISOString().slice(0, 7)
+  const dayOf = (t: number) => new Date(t).toISOString().slice(0, 10)
+  const monthStart = (t: number) => Date.UTC(new Date(t).getUTCFullYear(), new Date(t).getUTCMonth(), 1)
+  const monthEnd = (t: number) => Date.UTC(new Date(t).getUTCFullYear(), new Date(t).getUTCMonth() + 1, 1)
+  const dayEnd = (t: number) => Date.UTC(new Date(t).getUTCFullYear(), new Date(t).getUTCMonth(), new Date(t).getUTCDate() + 1)
+  let usage = { month: monthOf(now()), monthBytes: 0 }
   if (o.usageFile) {
     let raw: string | null = null
     try { raw = readFileSync(o.usageFile, 'utf8') } catch {}
@@ -322,64 +343,29 @@ export function createGovernor(o: HostedOptions) {
       let u: any = null
       try { u = JSON.parse(raw) } catch {}
       const t = now()
-      const dayOk = (v: unknown) => typeof v === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(v) && Number.isFinite(Date.parse(`${v}T00:00:00Z`)) && day(Date.parse(`${v}T00:00:00Z`)) === v && v <= day(t + 86_400_000)
-      const next = new Date(t)
-      const monthMax = month(Date.UTC(next.getUTCFullYear(), next.getUTCMonth() + 1, 1))
-      const monthOk = (v: unknown) => typeof v === 'string' && /^\d{4}-\d{2}$/.test(v) && Number.isFinite(Date.parse(`${v}-01T00:00:00Z`)) && month(Date.parse(`${v}-01T00:00:00Z`)) === v && v <= monthMax
-      // a counter that is not a finite, safe, non-negative number, or is far past its own ceiling, is corrupt
-      const sane = (v: unknown, ceil?: number) => typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= Number.MAX_SAFE_INTEGER && (!ceil || v <= ceil * 2)
-      const problems: string[] = []
-      if (!u || typeof u !== 'object') problems.push('not a JSON object')
-      else {
-        usage.day = dayOk(u.day) ? u.day : (u.day !== undefined && problems.push('day'), usage.day)
-        usage.month = monthOk(u.month) ? u.month : (u.month !== undefined && problems.push('month'), usage.month)
-        if (sane(u.dayBytes, c.maxBytesPerDay)) usage.dayBytes = u.dayBytes
-        else problems.push('dayBytes')
-        if (sane(u.monthBytes, c.maxBytesPerMonth)) usage.monthBytes = u.monthBytes
-        else problems.push('monthBytes')
-        // a date that was reset starts its counter at 0 too
-        if (usage.day !== u.day) usage.dayBytes = 0
-        if (usage.month !== u.month) usage.monthBytes = 0
-      }
-      if (problems.length) warn(`wmd-relay: ${o.usageFile} is damaged (${problems.join(', ')}); the affected counters and dates start again from 0 and today`)
+      const monthOk = (v: unknown) => typeof v === 'string' && /^\d{4}-\d{2}$/.test(v) && Number.isFinite(Date.parse(`${v}-01T00:00:00Z`)) && monthOf(Date.parse(`${v}-01T00:00:00Z`)) === v && v <= monthOf(monthEnd(t))
+      const sane = (v: unknown) => typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= Number.MAX_SAFE_INTEGER && Number.isInteger(v)
+      if (u && typeof u === 'object' && monthOk(u.month) && sane(u.monthBytes)) usage = { month: u.month, monthBytes: u.monthBytes }
+      else warn(`wmd-relay: ${o.usageFile} is damaged; the month's counter starts again from 0`)
     }
   }
+  let today = { day: dayOf(now()), per: new Map<string, number>() }
   /** The counters restart only when the date moves forward: a clock set back must not zero them. */
   function roll() {
     const t = now()
-    if (day(t) > usage.day) {
-      usage.day = day(t)
-      usage.dayBytes = 0
-    }
-    if (month(t) > usage.month) {
-      usage.month = month(t)
-      usage.monthBytes = 0
-    }
-  }
-  /** The ceiling in force, or null. The rollover lifts it: the counters restart with the day and the month. */
-  function ceiling(): 'day' | 'month' | null {
-    roll()
-    const k = c.maxBytesPerMonth && usage.monthBytes >= c.maxBytesPerMonth ? 'month' : c.maxBytesPerDay && usage.dayBytes >= c.maxBytesPerDay ? 'day' : null
-    if (!k) {
-      ceilingSince = 0
-      if (graceTimer) clearTimeout(graceTimer)
-      graceTimer = null
-    } else if (!ceilingSince) {
-      ceilingSince = now()
-      graceTimer = setTimeout(() => {
-        graceTimer = null
-        const w = ceiling()
-        if (w) o.onCeilingGrace?.(ceilingWords(w))
-      }, c.ceilingGraceMs)
-      ;(graceTimer as any).unref?.()
-    }
-    return k
+    if (monthOf(t) > usage.month) usage = { month: monthOf(t), monthBytes: 0 }
+    if (dayOf(t) > today.day) today = { day: dayOf(t), per: new Map() }
+  }
+  const atCap = () => (roll(), !!c.monthBytes && usage.monthBytes >= c.monthBytes)
+  const capWhy = (): Why => ({ rule: 'data-cap', words: 'the relay has used its data for this month', until: monthEnd(now()) })
+  /** An address group over its share of today: the day's even share of the cap, split among the groups active today. */
+  function overShare(grp: string): boolean {
+    if (!c.monthBytes) return false
+    const t = now()
+    const dayShare = c.monthBytes / Math.round((monthEnd(t) - monthStart(t)) / 86_400_000)
+    return (today.per.get(grp) || 0) > dayShare / Math.max(1, today.per.size)
   }
-  let ceilingSince = 0
-  let graceTimer: ReturnType<typeof setTimeout> | null = null
-  /** True once a ceiling has been in force longer than the grace: even streams that are open end. */
-  const pastGrace = () => !!ceiling() && now() - ceilingSince >= c.ceilingGraceMs
-  const ceilingWords = (k: 'day' | 'month') => `the relay has reached its traffic limit for ${k === 'day' ? 'today' : 'this month'}`
+  const slow = new Map<string, { rate: number; until: number; bucket: Bucket }>()
   function saveUsage() {
     if (!o.usageFile) return
     try {
@@ -388,195 +374,219 @@ export function createGovernor(o: HostedOptions) {
       renameSync(tmp, o.usageFile)
     } catch {}
   }
-  const saver = o.usageFile ? setInterval(saveUsage, 15_000) : null
-  saver?.unref?.()
 
-  function accepting(): boolean {
-    return !stopped && !draining && !ceiling()
+  function notAccepting(): Why | null {
+    if (draining) return { rule: 'draining', words: 'the relay is closed for maintenance' }
+    if (stopped) return { rule: 'stopped', words: 'the relay is not taking new connections now' }
+    return atCap() ? capWhy() : null
   }
 
-  /** Why new sessions are not taken now, or null. */
-  function notAccepting(): string | null {
-    if (draining) return 'the relay is closed for maintenance'
-    if (stopped) return 'the relay is not taking new connections now'
-    const k = ceiling()
-    return k ? ceilingWords(k) : null
+  // ---- E, G: sockets
+  let used = 0
+  let reclaim: () => boolean = () => false
+  const busy = (): Why => ({ rule: 'busy', words: 'the relay is full right now', until: now() + c.dialLimitMs })
+  /** One socket more, or why not. A full relay first asks the relay to free one (G). */
+  function claim(mem: number): Why | null {
+    if (freeMem() < mem) return busy()
+    if (used >= budget && !reclaim()) return busy()
+    if (used >= budget) return busy()
+    used++
+    return null
   }
+  const unclaim = () => void (used = Math.max(0, used - 1))
 
-  // ---- sessions
-  function pickBudget(grp: string, origin: string): OriginBudget {
-    if (!origin) return none
-    if (origin === 'null') return other
+  // ---- B
+  const addrSites = new Map<string, Map<string, number>>()
+  const netSites = new Map<string, Map<string, number>>()
+  const fresh = (m: Map<string, number>, t: number) => {
+    for (const [k, at] of m) if (t - at >= HOUR) m.delete(k)
+    return m
+  }
+  const oldest = (m: Map<string, number>) => Math.min(...m.values()) + HOUR
+  function sites(grp: string, host: string): Why | null {
     const t = now()
-    let seen = addrOrigins.get(grp)
-    if (!seen) addrOrigins.set(grp, (seen = new Map()))
-    for (const [k, at] of seen) if (t - at > 3_600_000) seen.delete(k)
-    if (!seen.has(origin)) {
-      if (seen.size >= c.originsPerAddrPerHour) return other // a ninth distinct origin from one address
-      seen.set(origin, t)
-    }
-    let b = origins.get(origin)
-    if (b) return b
-    if (origins.size >= c.originTable) {
-      // evict the least recently used origin that has no live session; none free: this one is "other"
-      let victim: string | null = null
-      for (const [k, v] of origins.m) if (!v.sessions) { victim = k; break }
-      if (victim === null) return other
-      origins.delete(victim)
+    const site = host.toLowerCase().replace(/\.$/, '')
+    const net = coarseKey(grp)
+    let a = addrSites.get(grp)
+    if (!a) addrSites.set(grp, (a = new Map()))
+    let n = netSites.get(net)
+    if (!n) netSites.set(net, (n = new Map()))
+    fresh(a, t)
+    fresh(n, t)
+    if (!a.has(site)) {
+      if (a.size >= c.sitesPerAddrPerHour) {
+        return { rule: 'too-many-sites', words: `${c.sitesPerAddrPerHour} different sites in an hour from this address: a new site waits until one ages out; sites already reached keep working`, until: oldest(a) }
+      }
+      if (!n.has(site) && n.size >= c.sitesPerNetPerHour) {
+        return { rule: 'too-many-sites', words: `${c.sitesPerNetPerHour} different sites in an hour from this network: a new site waits until one ages out; sites already reached keep working`, until: oldest(n) }
+      }
     }
-    b = mk(origin, c.originSessions)
-    origins.set(origin, b)
-    return b
+    a.set(site, t)
+    n.set(site, t)
+    return null
   }
 
-  /** A session of an address group from `ip` with this page origin is about to open. */
-  function admitSession(i: { ip: string; grp: string; origin: string; fresh: boolean; end: (words: string) => void }): { ok: true; adm: Admission } | { ok: false; why: string } {
-    const coarse = coarseKey(i.grp)
+  // ---- D
+  const dials = new Map<string, { w: number; gate: number; told: boolean }>()
+  const dialOf = (grp: string) => {
+    let d = dials.get(grp)
+    if (!d) dials.set(grp, (d = { w: 0, gate: 0, told: false }))
+    return d
+  }
+  function dialGate(s: Session): Why | { waitMs: number } | null {
+    const d = dials.get(grpOf(s))
+    if (!d || !d.w) return null
     const t = now()
-    if ((coarseSessions.get(coarse) || 0) >= c.coarseSessions) return { ok: false, why: `more than ${c.coarseSessions} sessions from this network` }
-    if (i.fresh) {
-      let w = coarseInstances.get(coarse)
-      if (!w) coarseInstances.set(coarse, (w = new Hits(c.coarseInstancesPerHour, 3_600_000)))
-      if (!w.hit(t)) return { ok: false, why: `more than ${c.coarseInstancesPerHour} new instances an hour from this network` }
+    const start = Math.max(t, d.gate)
+    const wait = start + d.w - t
+    if (wait > c.dialLimitMs) return { rule: 'failed-dials', words: 'too many failed connections from this address: new connections wait', until: d.gate }
+    d.gate = start + d.w
+    if (!d.told) {
+      d.told = true
+      s.hx?.handle.tell?.(2, 'failed-dials', d.gate, 'failed connections from this address: new connections are slowed')
+    }
+    return { waitMs: wait }
+  }
+
+  // ---- sessions
+  const grpOf = (s: Session): string => s.hx?.grp ?? s.p.grp
+
+  /** A session from `ip` (address group `grp`) with this page origin is about to open. */
+  function admitSession(i: { ip: string; grp: string; origin: string; end: (why: Why) => void; tell?: Tell; claimed?: boolean }): { ok: true; adm: Admission } | ({ ok: false } & Why) {
+    const no = (w: Why) => ({ ok: false as const, ...w })
+    const denied = deniedClient(i.ip, i.origin)
+    if (denied) return no(denied)
+    const closed = notAccepting()
+    if (closed) return no(closed)
+    if (!siteOk(i.origin)) return no({ rule: 'not-allowed-site', words: `this page (${i.origin || 'no origin'}) is not one of the sites this relay serves` })
+    if (!i.claimed) {
+      const full = claim(SESSION_MEM)
+      if (full) return no(full)
     }
-    const budget = pickBudget(i.grp, i.origin)
-    const share = Math.max(1, Math.floor(budget.cap * c.originShare))
-    const mine = budget.perAddr.get(i.grp)
-    if (budget.sessions >= budget.cap) return { ok: false, why: `this page origin has no room for more sessions (${budget.cap})` }
-    if ((mine?.n ?? 0) >= share) return { ok: false, why: `more than ${share} sessions of this page origin from one address` }
-    let cs = coarseShared.get(coarse)
-    if (!cs) coarseShared.set(coarse, (cs = { down: new Bucket(c.coarseRateDown), up: new Bucket(c.coarseRateUp) }))
-    const entry = mine ?? { n: 0, shared: { down: new Bucket(Math.max(1, c.originRateDown * c.originShare)), up: new Bucket(Math.max(1, c.originRateUp * c.originShare)) } }
-    entry.n++
-    budget.perAddr.set(i.grp, entry)
-    budget.sessions++
-    coarseSessions.set(coarse, (coarseSessions.get(coarse) || 0) + 1)
-    const handle: Handle = { ip: i.ip, origin: i.origin, end: i.end }
+    const handle: Handle = { ip: i.ip, grp: i.grp, origin: i.origin, end: i.end, tell: i.tell }
     live.add(handle)
     let done = false
     const adm: Admission = {
-      grp: i.grp, coarse, budget, addrBucket: entry.shared,
-      down: [cs.down, entry.shared.down, budget.shared.down, globalShared.down],
-      up: [cs.up, entry.shared.up, budget.shared.up, globalShared.up],
-      handle,
+      grp: i.grp, net: coarseKey(i.grp), handle, fair: c.linkBytesPerSec ? new Bucket(Infinity) : null, sent: 0, waiting: false,
       release() {
         if (done) return
         done = true
         live.delete(handle)
-        budget.sessions--
-        const e = budget.perAddr.get(i.grp)
-        if (e && --e.n <= 0) budget.perAddr.delete(i.grp)
-        const n = (coarseSessions.get(coarse) || 1) - 1
-        if (n > 0) coarseSessions.set(coarse, n)
-        else coarseSessions.delete(coarse)
+        unclaim()
       },
     }
     return { ok: true, adm }
   }
 
-  // ---- streams (engine guard)
-  const grpOf = (s: Session): string => s.hx?.grp ?? s.p.grp
-  const destKey = (host: string, port: number) => `${host.toLowerCase().replace(/\.$/, '')}:${port}`
+  /** The socket of a WebSocket that has not finished its handshake (counted from the upgrade). */
+  function claimHandshake(): Why | null {
+    return claim(SESSION_MEM)
+  }
 
-  /** Before a connect is resolved: the cooling-off, the group's rate, the scan shape and the destination's rate. Null, or the words. */
-  function admitConnect(s: Session, host: string, port: number): string | null {
-    const t = now()
-    const grp = grpOf(s)
-    const closed = notAccepting() // stop-new, drain and a ceiling end new streams too: open streams run to their end
+  // ---- streams (engine guard)
+  /** Before a connect is resolved: the kill switch and the cap, then B and D. A refusal, a wait, or null. */
+  function admitConnect(s: Session, host: string, _port: number): Why | { waitMs: number } | null {
+    const closed = notAccepting()
     if (closed) return closed
-    const f = groupFails.get(grp)
-    if (f && f.cool > t) return `too many failed connections from this address; new connections wait ${Math.ceil((f.cool - t) / 1000)} s`
-    const h = bytesHour(grp)
-    if (h.n >= c.groupBytesPerHour) return 'this address has used its bytes for this hour'
-    let w = groupConnects.get(grp)
-    if (!w) groupConnects.set(grp, (w = new Hits(c.groupConnectsPerMin, 60_000)))
-    if (!w.hit(t)) return `more than ${c.groupConnectsPerMin} connections a minute from this address`
-    const key = destKey(host, port)
-    let seen = groupDests.get(grp)
-    if (!seen) groupDests.set(grp, (seen = new Map()))
-    for (const [k, at] of seen) if (t - at > 600_000) seen.delete(k)
-    if (!seen.has(key) && seen.size >= c.distinctDests) return `more than ${c.distinctDests} different destinations in 10 minutes from this address`
-    seen.set(key, t)
-    const ck = `${coarseKey(grp)}|${key}`
-    let dw = destConnects.get(ck)
-    if (!dw) destConnects.set(ck, (dw = new Hits(c.destConnectsPerMin, 60_000)))
-    if (!dw.hit(t)) return `more than ${c.destConnectsPerMin} connections a minute to ${key} from this network`
-    return null
+    const crawl = sites(grpOf(s), host)
+    if (crawl) return crawl
+    return dialGate(s)
   }
 
-  /** Just before the dial: the concurrent counts. Sets `st.rel`, which the engine calls once when the stream is gone. */
-  function openStream(s: Session, st: Stream, host: string, port: number): string | null {
-    const grp = grpOf(s)
-    const ck = `${coarseKey(grp)}|${destKey(host, port)}`
-    if (liveStreams >= c.maxStreams) return `the relay has ${c.maxStreams} streams open; try again shortly`
-    if ((groupStreams.get(grp) || 0) >= c.groupStreams) return `more than ${c.groupStreams} streams open from this address`
-    if ((destLive.get(ck) || 0) >= c.destStreams) return `more than ${c.destStreams} streams open to ${destKey(host, port)} from this network`
-    liveStreams++
-    groupStreams.set(grp, (groupStreams.get(grp) || 0) + 1)
-    destLive.set(ck, (destLive.get(ck) || 0) + 1)
-    st.rel = () => {
-      liveStreams--
-      for (const [m, k] of [[groupStreams, grp], [destLive, ck]] as const) {
-        const n = (m.get(k) || 1) - 1
-        if (n > 0) m.set(k, n)
-        else m.delete(k)
-      }
-    }
+  /** Just before the dial: a socket (E, G). Sets `st.rel`, which the engine calls once when the stream is gone. */
+  function openStream(_s: Session, st: Stream, _host: string, _port: number): Why | null {
+    const full = claim(STREAM_MEM)
+    if (full) return full
+    st.rel = unclaim
     return null
   }
 
-  /** A dial the remote refused, that found no route or that timed out (or a name that did not resolve). */
-  function dialFailed(s: Session) {
-    const t = now()
-    const grp = grpOf(s)
-    let f = groupFails.get(grp)
-    if (!f) groupFails.set(grp, (f = { hits: new Hits(Infinity, c.failedWindowMs), cool: 0 }))
-    f.hits.prune(t)
-    f.hits.times.push(t)
-    if (f.hits.times.length >= c.failedConnects) {
-      f.cool = t + c.failedCoolMs
-      f.hits.times = []
-    }
+  /** D: a dial was refused, found no route, timed out or named a host that does not exist, after `ms`. */
+  function dialFailed(s: Session, ms: number) {
+    const d = dialOf(grpOf(s))
+    d.w = Math.min(c.dialLimitMs, Math.max(1, Math.round(ms), d.w * 2))
   }
-
-  /** DNS answers stop with new connections: stop-new, a drain and a ceiling (the same words). */
-  const dnsClosed = (): string | null => notAccepting()
-
-  function dnsAllowed(s: Session): boolean {
-    const grp = grpOf(s)
-    let w = groupDns.get(grp)
-    if (!w) groupDns.set(grp, (w = new Hits(c.groupDnsPerMin, 60_000)))
-    return w.hit(now())
+  function dialOk(s: Session) {
+    const d = dials.get(grpOf(s))
+    if (!d) return
+    d.w = Math.floor(d.w / 2)
+    if (!d.w) {
+      dials.delete(grpOf(s))
+      if (d.told) s.hx?.handle.tell?.(3, 'failed-dials', 0, '')
+    }
   }
+  const dialWait = (s: Session) => dials.get(grpOf(s))?.w ?? 0
 
-  function bytesHour(grp: string) {
-    const hour = Math.floor(now() / 3_600_000)
-    let b = groupBytes.get(grp)
-    if (!b || b.hour !== hour) groupBytes.set(grp, (b = { hour, n: 0 }))
-    return b
-  }
+  const dnsClosed = (): string | null => notAccepting()?.words ?? null
 
-  /** Bytes relayed for a session (either way). True while the group is within its hourly bytes. */
+  /** Bytes relayed for a session (either way: each leaves the host once). False when the month is at its cap and this
+      address group is over its share: its streams end. */
   function bytes(s: Session, n: number): boolean {
     roll()
-    usage.dayBytes += n
     usage.monthBytes += n
-    const b = bytesHour(grpOf(s))
-    b.n += n
-    ceiling() // starts the grace clock the moment the counter crosses
-    return b.n <= c.groupBytesPerHour && !pastGrace()
+    const grp = grpOf(s)
+    today.per.set(grp, (today.per.get(grp) || 0) + n)
+    if (s.hx) s.hx.sent += n
+    return !(atCap() && overShare(grp))
   }
+  const limitWhy = (): Why => capWhy()
 
-  /** Why `bytes` just said no. */
-  function limitWhy(): string {
-    const k = ceiling()
-    return k && pastGrace() ? ceilingWords(k) : 'this address has used its bytes for this hour'
+  /** C and F, once a second: who is slowed for the month's pace, and each session's share of a full link. */
+  function tick() {
+    roll()
+    const t = now()
+    const next = new Map<string, number>()
+    if (c.monthBytes && !atCap()) {
+      const pace = c.monthBytes * ((t - monthStart(t)) / (monthEnd(t) - monthStart(t)))
+      if (usage.monthBytes > pace) {
+        const over = [...today.per.keys()].filter(overShare)
+        const rate = (c.monthBytes - usage.monthBytes) / ((monthEnd(t) - t) / 1000) / Math.max(1, over.length)
+        for (const g of over) next.set(g, rate)
+      }
+    }
+    for (const [g, x] of slow) if (!next.has(g)) {
+      slow.delete(g)
+      for (const h of live) if (h.grp === g) h.tell?.(3, 'data-share', 0, '')
+    }
+    for (const [g, rate] of next) {
+      const x = slow.get(g)
+      if (x) {
+        x.bucket.rate = rate
+        x.until = dayEnd(t)
+        continue
+      }
+      slow.set(g, { rate, until: dayEnd(t), bucket: new Bucket(rate) })
+      for (const h of live) if (h.grp === g) h.tell?.(2, 'data-share', dayEnd(t), 'this address used more than its share of today\'s data while the month is over its pace: slowed until midnight UTC')
+    }
+    if (c.linkBytesPerSec) {
+      const list: { net: string; addr: string; sid: string; want: number; adm: Admission }[] = []
+      let i = 0
+      for (const adm of admissions) list.push({ net: adm.net, addr: adm.grp, sid: String(i++), want: adm.waiting ? Infinity : adm.sent, adm })
+      const shares = maxMinShares(c.linkBytesPerSec, list)
+      for (const x of list) {
+        x.adm.fair!.rate = shares.get(x.sid)!
+        x.adm.sent = 0
+        x.adm.waiting = false
+      }
+    }
+  }
+  const admissions = new Set<Admission>()
+  const slowed = (s: Session) => {
+    const x = slow.get(grpOf(s))
+    return x ? { rule: 'data-share', rate: x.rate, until: x.until } : null
   }
 
-  /** Up to n bytes from the coarse, origin and relay-wide buckets of the session (what the group's own bucket let through). */
-  function take(s: Session, dir: 'down' | 'up', n: number): number {
-    const list: Bucket[] | undefined = s.hx?.[dir]
-    if (!list) return n
+  function bucketsOf(s: Session): Bucket[] {
+    const b: Bucket[] = []
+    const x = slow.get(grpOf(s))
+    if (x) b.push(x.bucket)
+    if (s.hx?.fair && Number.isFinite(s.hx.fair.rate)) b.push(s.hx.fair)
+    return b
+  }
+  /** Of n bytes the session's own bucket let through, how many the slowdown (C) and the link share (F) allow. */
+  function take(s: Session, _dir: 'down' | 'up', n: number): number {
+    const list = bucketsOf(s)
+    if (!list.length) return n
     const got: number[] = []
     let k = n
     for (const b of list) {
@@ -586,33 +596,51 @@ export function createGovernor(o: HostedOptions) {
     }
     const last = got[got.length - 1]
     for (let i = 0; i < got.length; i++) if (got[i] > last) list[i].tokens = Math.min(list[i].rate, list[i].tokens + got[i] - last)
+    if (last < n && s.hx) s.hx.waiting = true
     return last
   }
-  function waitMs(s: Session, dir: 'down' | 'up', n: number): number {
-    const list: Bucket[] | undefined = s.hx?.[dir]
-    return list ? Math.max(1, ...list.map(b => b.waitMs(n))) : 1
+  function waitMs(s: Session, _dir: 'down' | 'up', n: number): number {
+    const list = bucketsOf(s)
+    return list.length ? Math.max(1, ...list.map(b => b.waitMs(n))) : 1
+  }
+  /** The session's WebSocket is backed up (its bytes wait): it wants more than it got (F). */
+  function backpressure(s: Session) {
+    if (s.hx) s.hx.waiting = true
   }
 
   function blockedAddr(a: Addr): string | null {
     return hostedBlockedReason(a, denyCidrs)
   }
 
-  // ---- housekeeping
+  const ticker = setInterval(tick, 1000)
+  ticker.unref?.()
+  const saver = o.usageFile ? setInterval(saveUsage, 15_000) : null
+  saver?.unref?.()
   const sweep = setInterval(() => {
     const t = now()
-    for (const m of [groupConnects, groupDns, coarseInstances]) for (const [k, w] of m.m) { w.prune(t); if (!w.times.length) m.delete(k) }
-    for (const [k, w] of destConnects.m) { w.prune(t); if (!w.times.length && !destLive.has(k)) destConnects.delete(k) }
-    for (const [k, f] of groupFails.m) { f.hits.prune(t); if (!f.hits.times.length && f.cool < t) groupFails.delete(k) }
-    for (const [k, b] of groupBytes.m) if (b.hour !== Math.floor(t / 3_600_000)) groupBytes.delete(k)
+    for (const m of [addrSites, netSites]) for (const [k, x] of m) if (!fresh(x, t).size) m.delete(k)
+    for (const [k, d] of dials) if (d.gate + HOUR < t) dials.delete(k)
   }, 60_000)
   sweep.unref?.()
 
+  const state = () => {
+    roll()
+    const full: string[] = []
+    if (used >= budget) full.push('sockets')
+    if (freeMem() < SESSION_MEM) full.push('memory')
+    if (atCap()) full.push('month')
+    return {
+      full,
+      sockets: { used, budget },
+      month: { month: usage.month, bytes: usage.monthBytes, cap: c.monthBytes || null, slowed: slow.size },
+    }
+  }
+
   return {
     options: c,
     contact,
     contactLine,
     version: o.version,
-    // operator state
     stopNew: () => void (stopped = true),
     resume() {
       stopped = false
@@ -621,35 +649,52 @@ export function createGovernor(o: HostedOptions) {
     startDrain: () => void ((draining = true), (stopped = true)),
     isStopped: () => stopped,
     isDraining: () => draining,
-    accepting,
+    accepting: () => !notAccepting(),
     notAccepting,
-    ceiling,
-    ceilingWords,
     usage: () => (roll(), { ...usage }),
     saveUsage,
-    // deny lists
+    state,
+    setSites,
+    siteAllowed: (origin: string) => siteOk(origin),
     reloadDeny,
     deniedClient,
     isDeniedDest: deniedDestination,
-    // admission
-    admitSession,
+    admitSession(i: Parameters<typeof admitSession>[0]) {
+      const r = admitSession(i)
+      if (r.ok) {
+        admissions.add(r.adm)
+        const rel = r.adm.release
+        r.adm.release = () => {
+          admissions.delete(r.adm)
+          rel()
+        }
+      }
+      return r
+    },
+    claimHandshake,
+    unclaim,
+    setReclaim: (fn: () => boolean) => void (reclaim = fn),
+    socketBudget: () => budget,
     admitConnect,
     openStream,
     dialFailed,
-    dnsAllowed,
+    dialOk,
+    dialWait,
     dnsClosed,
     bytes,
     limitWhy,
+    tick,
+    slowed,
     take,
     waitMs,
+    backpressure,
     blockedAddr,
-    /** Sessions per origin class, for tests and status (counts only). */
-    liveStreams: () => liveStreams,
-    originStats: () => ({ table: origins.size, other: other.sessions, none: none.sessions }),
+    liveStreams: () => used,
     limitsLine: () =>
-      `${c.groupStreams} streams, ${c.groupConnectsPerMin} connects a minute, ${Math.round(c.groupBytesPerHour / MIB)} MiB an hour per address`,
+      `only listed sites; ${c.sitesPerAddrPerHour} different sites an hour per address, ${c.sitesPerNetPerHour} per network; failed dials slow the sender` +
+      (c.monthBytes ? `; ${Math.round(c.monthBytes / 1e9)} GB a month, heavy users slowed first when the month runs ahead` : ''),
     stop() {
-      if (graceTimer) clearTimeout(graceTimer)
+      clearInterval(ticker)
       clearInterval(sweep)
       if (saver) clearInterval(saver)
       saveUsage()