@volter/supercode-teams 0.3.159 → 0.3.161

package/mail/relay.mjs

@@ -2,10 +2,11 @@
 // its queue, receipts and runtime records in SQLite; Claude reads only its hook
 // configuration in a separate runtime directory. Native runtime start/input/
 // close doors retain their observed-result and unanswered-operation semantics.
-import { mkdirSync, rmdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { mkdirSync, writeFileSync } from 'node:fs';
 import { connect } from 'node:net';
 import { basename, dirname, join } from 'node:path';
 import { blake3Hex, shortId } from './envelope.mjs';
+import { beginRelayAttempt, settleRelayAttempt } from './relay-routing.mjs';
 
 /** Model name a relay's requests carry; the relay endpoint answers them without any model. */
 const RELAY_MODEL = 'haiku';
@@ -40,25 +41,13 @@ const answerLost = (error) => !error.notAsked && (!error.answered || /gave up af
 const SLOW_SEND_MS = 2000;
 /** Largest message relayed into a Claude session: the relay copies it into a model turn byte for byte. */
 export const MAX_RELAYED_BYTES = 100_000;
-/** How many relays run at once, the most recently used (a relay runtime is some hundreds of MB; 10 held 2.1 GB on one
- *  machine): beyond them a relay's runtime is closed (its folder kept: it starts again when next needed). */
-export const RELAYS_RUNNING = 4;
-/** How long a relay speaking for a sender on another machine is kept after its last send (it carries that sender's
- *  mail while it is in use; retired after every send, each message from it started a relay). */
-const REMOTE_RELAY_KEPT_MS = 60 * 60_000;
-/** How long a Codex sender's relay is kept unused at a start (a Codex session idle over a day leaves the map). */
-const CODEX_RELAY_KEPT_MS = 7 * 24 * 60 * 60_000;
-/** How long a relay whose runtime start lost its answer is looked at for a runtime that start left running. */
-const LOST_START_KEPT_MS = 5 * 60_000;
-
+/** One pool runtime per machine, serialized independently of sender identity. */
+export const RELAYS_RUNNING = 1;
 const alive = (pid) => { if (!Number.isInteger(pid) || pid <= 0) return false; try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; } };
 const shellQuote = (value) => `'${String(value).replaceAll("'", "'\\''")}'`;
 
-/** Registry name of the relay that represents `name` on `machine` (not `name@machine`: SendMessage refuses an `@`). */
-export function relayName(name, machine) {
-  const base = name.startsWith(RELAY_NAME_PREFIX) ? name.slice(RELAY_NAME_PREFIX.length) : name;
-  return `${RELAY_NAME_PREFIX}${base}-on-${machine}`;
-}
+/** Stable registry name of the machine's one relay pool. */
+export function relayName(machine) { return `${RELAY_NAME_PREFIX}mail-pool-on-${machine}`; }
 
 /** The host turn asking a relay to make one send (claude_relay.rs `send_turn`). */
 const sendTurn = ({ to, message }) => `Send one message with SendMessage.\nto: ${to}\nmessage: the exact text between the markers, without the markers\n---BEGIN MESSAGE---\n${message}\n---END MESSAGE---`;
@@ -85,143 +74,78 @@ export class Relays {
    * id)` the live-runtime receipt the live-session map holds for a runtime id (its file read whole), or null;
    * `runtimeNamed(receiptId)` one receipt read by its own name.
    */
-  constructor({ mailRoot, store, machine, supercodeBin, serve, runtimeOf, runtimeNamed = () => null, runtimesIn = () => [], endpointOf = async () => null, arrived = async () => false, hooksServed = () => true, log = () => {} }) {
-    Object.assign(this, { mailRoot, store, machine, supercodeBin, serve, runtimeOf, runtimeNamed, runtimesIn, endpointOf, arrived, hooksServed, log });
+  constructor({ mailRoot, store, machine, supercodeBin, serve, runtimeOf, runtimeNamed = () => null, runtimesIn = () => [], endpointOf = async () => null, arrived = async () => false, hooksServed = () => true, inboundSettled = () => {}, log = () => {} }) {
+    Object.assign(this, { mailRoot, store, machine, supercodeBin, serve, runtimeOf, runtimeNamed, runtimesIn, endpointOf, arrived, hooksServed, inboundSettled, log });
     this.runtimeRoot = join(dirname(mailRoot), 'relays');
     this.stopped = false;
     this.receipts = new Set();
-    this.lost = new Map(); // relay folder → when a start of its runtime lost its answer (the runtime may run, unnamed)
-    this.remoteKept = new Map(); // relay folder of a sender on another machine → the timer that retires it
     this.sending = new Map(); // relay folder → the send in progress through it (one at a time per relay)
-    this.running = new Map(); // relay folder → { connection, runtime_id, usedAt }: the relays this daemon runs
+    // Pool identity outlives every runtime handle. Register the stable folder
+    // before any startup spool drain, including upgrades whose prior pool
+    // already retired without leaving a handle or whose next start is refused.
+    const pool = this.spec();
+    this.store.putRecord('relays', pool.identity, { pool: true, name: pool.name, represented: pool.represented }, { create: true });
   }
 
-  /** The relays beyond the RELAYS_RUNNING most recently used have their runtimes closed, none carrying a send: this
-   *  daemon starts every relay and holds every relay's send lock, so it alone closes one (a closer that did not hold the
-   *  lock closed relays mid-send, and every send after paid a relay's start). */
-  #cap() {
-    if (this.stopped) return;
-    const kept = [...this.running].sort(([, a], [, b]) => b.usedAt - a.usedAt);
-    for (const [directory, relay] of kept.slice(RELAYS_RUNNING)) {
-      if (this.sending.has(directory)) continue;
-      this.running.delete(directory);
-      // closed under the relay's own lock: a send to it that arrives meanwhile waits for the close, then starts it
-      // again, never handing its turn to a runtime that is closing
-      void this.#locked(directory, () => this.serve('harness.v1.runtimes.close', { connection: relay.connection, runtime_id: relay.runtime_id }, CLOSE_MS))
-        .catch((error) => {
-          // still running, so still counted: the next cap closes it again (unless a send started it anew meanwhile)
-          if (!this.running.has(directory)) this.running.set(directory, relay);
-          this.log(`relay ${directory.split(/[\\/]/).pop()} beyond the ${RELAYS_RUNNING} most recent was not closed: ${error.message}`);
-        });
+  /** A proven owner door must retire each predecessor before the pool can start.
+   * An absent live-map entry or an unanswered close never proves absence. */
+  async #closeRecord(key, record) {
+    if (this.stopped) throw new Error('the daemon is stopping; no relay close was submitted');
+    if (!record?.runtime_id) throw new Error(`relay ${key} has no proven runtime handle; the pool cannot start`);
+    const runtime = this.runtimeOf('claude-code', record.runtime_id);
+    const pid = runtime?.metadata?.child_pid ?? record.pid;
+    if (!(Number.isInteger(pid) && pid > 0 && !alive(pid))) {
+      const answer = await this.serve('harness.v1.runtimes.close', { connection: record.connection ?? '', runtime_id: record.runtime_id }, CLOSE_MS);
+      if (answer?.closed !== true || answer.killed === false) throw new Error(`relay ${key}'s owner did not confirm closure; no successor was started`);
     }
-    // a start whose answer was lost may have left a runtime running in its relay's folder that no record names: closed by
-    // its id once the live-session map holds it (looked for over five minutes: the start may finish after its answer)
-    for (const [directory, lostAt] of this.lost) {
-      if (Date.now() - lostAt > LOST_START_KEPT_MS) { this.lost.delete(directory); continue; }
-      if (this.sending.has(directory)) continue;
-      const named = this.store.record('relays', `${basename(directory)}/relay.json`)?.runtime_id;
-      for (const ids of this.runtimesIn('claude-code', directory)) {
-        if (ids.includes(named)) continue;
-        void this.#locked(directory, async () => {
-          for (const id of ids) { try { await this.serve('harness.v1.runtimes.close', { runtime_id: id }, CLOSE_MS); return; } catch { /* the other id */ } }
-          this.log(`relay ${directory.split(/[\\/]/).pop()}: a runtime its lost start left running was not closed`);
-        });
-      }
-    }
-  }
-
-  /**
-   * The relay that speaks for `represented` (known as `name`), retired: its runtime closed and its folder removed, under
-   * its own lock (as the native watch's minute sweep did, by event here: the session's end, or a remote
-   * sender's quiet hour). A board's or an operator's relay is kept: nothing ends it. Answers whether it was retired.
-   */
-  async retire(represented, name) {
-    const parsed = String(represented).split(':');
-    if (parsed[2] === 'board' || parsed[2] === 'operator') return false;
-    // a folder is named by its sender's name, not its address: it is retired only while it still represents this ended
-    // address (another live session of that name, or one renamed since, may hold it now)
-    return this.#retireFolder(this.spec(represented, name).directory, represented);
+    if (this.stopped) throw new Error('the daemon stopped during relay close; its records are retained');
+    this.store.transaction(() => {
+      const queue = this.store.record('relays', `${key}/queue.json`);
+      const receipt = this.store.record('relays', `${key}/receipt.json`);
+      settleRelayAttempt(this.store, queue, receipt ? readReceipt(receipt) : { unknown: true });
+      if (record.pool === true) this.store.putRecord('relays', `${key}/pool.json`, { pool: true }, { create: true });
+      this.store.removeRecord('relays', `${key}/relay.json`);
+      this.store.removeRecord('relays', `${key}/queue.json`);
+      this.store.removeRecord('relays', `${key}/receipt.json`);
+    });
   }
 
-  /** The address a relay folder speaks for, as its inbound hook names it (its settings), or null. */
-  #representedOf(directory) {
-    const settings = this.store.record('relays', `${basename(directory)}/settings.json`);
-    return /relay-inbound '([^']+)'/.exec(JSON.stringify(settings))?.[1] ?? null;
+  async #retireLegacy() {
+    const poolKey = basename(this.spec().directory);
+    const rows = this.store.records('relays');
+    for (const { key, value } of rows) {
+      if (!key.endsWith('/relay.json')) continue;
+      const folder = key.slice(0, -'/relay.json'.length);
+      if (folder === poolKey && value?.pool === true) continue;
+      await this.#closeRecord(folder, value);
+    }
+    // Only a recorded start/handle establishes ownership. A runtime in an old
+    // relay directory without that handle cannot be closed by a cwd guess.
+    for (const folder of new Set(rows.map(({ key }) => key.split('/')[0]))) {
+      if (folder === poolKey) continue;
+      if (this.runtimesIn('claude-code', join(this.runtimeRoot, folder)).length) throw new Error(`relay ${folder} still has a live receipt after retirement; the pool cannot start`);
+    }
   }
 
-  async #retireFolder(directory, expected = null) {
-    if (this.stopped) return false;
-    if (!this.store.relayKnown(basename(directory))) return false;
-    if (expected && this.#representedOf(directory) !== expected) return false;
-    return this.#locked(directory, async () => {
-      if (this.stopped) return false;
-      if (expected && this.#representedOf(directory) !== expected) return false;
-      const record = this.store.record('relays', `${basename(directory)}/relay.json`);
-      if (record?.runtime_id) {
-        try { await this.serve('harness.v1.runtimes.close', { connection: record.connection ?? '', runtime_id: record.runtime_id }, CLOSE_MS); }
-        catch (error) {
-          if (this.runtimeOf('claude-code', record.runtime_id)) { this.log(`relay ${basename(directory)} was not retired: ${error.message}`); return false; }
-        }
-      }
-      if (this.stopped) return false;
-      this.running.delete(directory); this.lost.delete(directory);
-      clearTimeout(this.remoteKept.get(directory)); this.remoteKept.delete(directory);
-      this.store.transaction(() => {
-        for (const file of ['relay.json', 'queue.json', 'receipt.json', 'sent.json', 'settings.json', 'turn.txt']) this.store.removeRecord('relays', `${basename(directory)}/${file}`);
+  /** Sender lifetimes do not retire a shared machine pool. */
+  async retire() { return false; }
+
+  async sweepAtStart() {
+    return this.#locked(this.spec().directory, async () => {
+      await this.#retireLegacy();
+      const spec = this.spec();
+      const queue = this.store.record('relays', spec.queue);
+      if (!queue) return;
+      const receipt = this.store.record('relays', spec.receipt);
+      if (receipt) this.store.transaction(() => {
+        settleRelayAttempt(this.store, queue, readReceipt(receipt));
+        this.store.removeRecord('relays', spec.queue);
       });
-      // Only the configuration this daemon materializes is removed. Other
-      // runtime files are retained; an old Maildir is handled by the importer.
-      if (dirname(directory) === this.runtimeRoot) {
-        try { unlinkSync(join(directory, 'settings.json')); } catch (error) { if (error.code !== 'ENOENT') this.log(`relay configuration retained: ${error.message}`); }
-        try { rmdirSync(directory); } catch (error) { if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(error.code)) this.log(`relay directory retained: ${error.message}`); }
-      }
-      return true;
+      else await this.#closeRecord(basename(spec.directory), this.store.record('relays', spec.record));
+      this.inboundSettled();
     });
   }
 
-  /** A relay speaking for a sender on another machine is retired REMOTE_RELAY_KEPT_MS after its last send. */
-  #keepRemote(directory, quietSinceMs = Date.now()) {
-    if (this.stopped) return;
-    clearTimeout(this.remoteKept.get(directory));
-    const timer = setTimeout(() => { this.remoteKept.delete(directory); void this.#retireFolder(directory); }, Math.max(0, quietSinceMs + REMOTE_RELAY_KEPT_MS - Date.now()));
-    timer.unref?.();
-    this.remoteKept.set(directory, timer);
-  }
-
-  /**
-   * At a daemon's start, once its live sessions are known: the relays whose sessions ended while no daemon ran are
-   * retired, and a remote sender's relay is kept for the rest of its hour (one read of the relays folder, at start only).
-   * `running(address)` says whether a session here runs.
-   */
-  async sweepAtStart(running) {
-    if (this.stopped) return;
-    const records = this.store.records('relays');
-    const folders = [...new Set(records.map(({ key }) => key.split('/')[0]))];
-    const times = new Map(records.map(({ key, updated_at_ms }) => [key, updated_at_ms]));
-    let retired = 0;
-    for (const folder of folders) {
-      if (this.stopped) return;
-      const directory = join(this.runtimeRoot, folder);
-      const represented = this.#representedOf(directory);
-      if (!represented) continue;
-      const [, machine, harness] = represented.split(':');
-      if (harness === 'board' || harness === 'operator') continue;
-      if (machine !== this.machine) {
-        const last = times.get(`${folder}/receipt.json`) ?? 0;
-        if (Date.now() - last < REMOTE_RELAY_KEPT_MS) { this.#keepRemote(directory, last); continue; }
-      } else if (running(represented)) continue;
-      else if (harness === 'codex') {
-        // a Codex session the map does not hold may be idle, not ended: its relay is kept until unused for a week
-        const last = Math.max(times.get(`${folder}/receipt.json`) ?? 0, times.get(`${folder}/relay.json`) ?? 0);
-        if (Date.now() - last < CODEX_RELAY_KEPT_MS) continue;
-      } else if (harness !== 'claude-code') continue;
-      // only a Claude session is provably ended when the map does not hold it (its registry lists every live Claude
-      // process); a sender of another harness the map may not see (Grok, Gemini, a Codex session idle a day) is kept
-      if (await this.#retireFolder(directory, represented)) retired++;
-    }
-    if (retired) this.log(`relays: ${retired} of sessions that ended while no daemon ran retired`);
-  }
-
   /** `work` run under the relay folder's lock: one send, or one close, at a time per relay, in arrival order. */
   async #locked(directory, work) {
     const previous = this.sending.get(directory) ?? Promise.resolve();
@@ -240,15 +164,15 @@ export class Relays {
     }
   }
 
-  /** The relay that speaks for `represented`, known as `representedName`: its name and its files. */
-  spec(represented, representedName) {
-    const name = relayName(String(representedName).split('@')[0], String(represented).split(':')[1]);
+  /** Every sender uses this machine's one runtime and one serialized queue. */
+  spec() {
+    const name = relayName(this.machine);
     const key = blake3Hex(name).slice(0, 24);
     const directory = join(this.runtimeRoot, key);
     return {
-      represented, name, directory,
+      represented: `sc:${this.machine}:operator:mail-relay`, name, directory,
       queue: `${key}/queue.json`, receipt: `${key}/receipt.json`, settings: join(directory, 'settings.json'),
-      settingsKey: `${key}/settings.json`, record: `${key}/relay.json`, sent: `${key}/sent.json`,
+      settingsKey: `${key}/settings.json`, record: `${key}/relay.json`, start: `${key}/start.json`, identity: `${key}/pool.json`,
     };
   }
 
@@ -296,6 +220,8 @@ export class Relays {
     const settings = this.#settings(spec);
     this.store.putRecord('relays', spec.settingsKey, settings);
     writeFileSync(spec.settings, JSON.stringify(settings, null, 2), { mode: 0o600 });
+    await this.#retireLegacy();
+    if (this.store.record('relays', spec.start)) throw new Error('the pool has an unanswered runtime start; its absence is unproven, so no successor was started');
     const record = this.store.record('relays', spec.record);
     if (record?.runtime_id) {
       const runtime = this.runtimeOf('claude-code', record.runtime_id);
@@ -305,18 +231,8 @@ export class Relays {
       }
       // why it is not reused, said in the timing line: a relay that should have been warm and was not shows here
       step(`runtime not reused (${stale ? 'it held a stale turn' : !runtime ? 'no live receipt' : !alive(this.#pid(spec, runtime)) ? 'its process ended' : !record.connection ? 'no connection' : 'endpoint moved'})`);
-      // A possibly live predecessor is closed through its owner before this
-      // daemon starts a successor in the new runtime directory.
-      const close = this.serve('harness.v1.runtimes.close', { connection: record.connection, runtime_id: record.runtime_id }, CLOSE_MS);
-      const pid = runtime ? this.#pid(spec, runtime) : null;
-      if (runtime && !(Number.isInteger(pid) && !alive(pid))) {
-        try { await close; }
-        catch (error) { if (this.runtimeOf('claude-code', record.runtime_id)) throw new Error(`could not retire the old relay: ${error.message}`); }
-        step('old runtime closed (runtimes.close)');
-      } else {
-        close.catch(() => {});
-        step('old runtime let go (runtimes.close, not waited on)');
-      }
+      await this.#closeRecord(basename(spec.directory), record);
+      step('old runtime closed through its owner');
     }
     if (this.stopped) throw new Error('the daemon is stopping; no successor relay was started');
     const key = spec.directory.split(/[\\/]/).pop();
@@ -330,14 +246,16 @@ export class Relays {
       },
       cwd: spec.directory,
     }, 60_000);
+    if (this.stopped) throw new Error('the daemon stopped during pool start; its durable intent is retained');
     const runtimeId = started?.handle?.runtime_id;
     if (typeof runtimeId !== 'string') throw new Error(`the machine daemon did not start the relay: ${JSON.stringify(started)}`);
     const connection = typeof started.connection === 'string' ? started.connection : '';
     const pid = Number.isInteger(started?.handle?.endpoint?.pid) ? started.handle.endpoint.pid : null;
     step('runtime started (runtimes.start)');
-    this.store.putRecord('relays', spec.record, { runtime_id: runtimeId, pid, endpoint, connection, runtime_directory: spec.directory });
-    // the daemon's from its start: counted by the cap even when the rest of this start fails
-    this.running.set(spec.directory, { connection, runtime_id: runtimeId, usedAt: Date.now() });
+    this.store.transaction(() => {
+      this.store.putRecord('relays', spec.record, { pool: true, runtime_id: runtimeId, pid, endpoint, connection, runtime_directory: spec.directory });
+      this.store.removeRecord('relays', spec.start);
+    });
     // harness serve writes its receipt before it answers the start; the map learns it from its watch a moment later, so
     // one it does not hold yet is read by its own name (the receipt the runtime's terminal launch opens), never waited on
     const known = this.runtimeOf('claude-code', runtimeId);
@@ -353,12 +271,12 @@ export class Relays {
     for (const until = Date.now() + RECEIPT_WAIT_MS; !runtime && Date.now() < until; await new Promise((resolve) => setTimeout(resolve, 100))) {
       runtime = this.runtimeOf('claude-code', runtimeId) ?? (receiptId ? this.runtimeNamed(receiptId) : null);
     }
+    if (this.stopped) throw new Error('the daemon stopped while waiting for the pool receipt; its handle is retained');
     step('its receipt read');
     if (!runtime) {
       // a runtime no send can use is closed, never left running untracked
-      this.running.delete(spec.directory);
-      try { await this.serve('harness.v1.runtimes.close', { connection, runtime_id: runtimeId }, CLOSE_MS); } catch { /* said below */ }
-      throw new Error('the relay started but registered no live runtime; it was closed');
+      await this.#closeRecord(basename(spec.directory), this.store.record('relays', spec.record));
+      throw new Error('the pool started but registered no live runtime; its owner confirmed closure');
     }
     return { runtime, connection };
   }
@@ -391,8 +309,6 @@ export class Relays {
 
   stop() {
     this.stopped = true;
-    for (const timer of this.remoteKept.values()) clearTimeout(timer);
-    this.remoteKept.clear();
     for (const cancel of this.receipts) cancel();
   }
 
@@ -401,13 +317,9 @@ export class Relays {
    * (claude_relay.rs `send_through_relay`): the receiver is named by its own socket (`uds:<path>`), unique to it, never
    * by its name. One send at a time per relay; a relay whose process is proven dead is started again once.
    */
-  /** Whether `sender`'s relay still holds a send queued (its queue file, written within SEND_TIMEOUT_MS twice over): a
-   *  relay runtime outlives a daemon that ended mid-send and may still make it. (Not `sending`: that is the field of
-   *  sends in progress, which would shadow it.) */
-  queued(sender, senderName) {
-    const row = this.store.statement("SELECT updated_at_ms FROM mail_records WHERE collection = 'relays' AND key = ?").get(this.spec(sender, senderName).queue);
-    return Boolean(row && Date.now() - row.updated_at_ms < 2 * SEND_TIMEOUT_MS);
-  }
+  /** A queued native send is not forgotten by age. Startup settles its receipt
+   * or obtains predecessor closure before another turn can replace it. */
+  queued() { return Boolean(this.store.record('relays', this.spec().queue)); }
 
   /** Whether message `messageId` from `sender` landed in Claude session `sessionId`'s transcript, as a relay send reads
    *  an unconfirmed outcome (send.mjs handOver asks it of a hand-over the daemon did not live to settle). */
@@ -415,40 +327,43 @@ export class Relays {
     return this.arrived(sessionId, `cross-session-message id=\\"${shortId(messageId)}\\" from=\\"${sender}\\"`);
   }
 
-  async send(sender, senderName, receiver, message, messageId) {
+  async send(sender, senderName, receiver, message, messageId, { expectsReply = true } = {}) {
     const spec = this.spec(sender, senderName);
     const asked = performance.now();
     // the message as its receiver's transcript holds it once delivered (envelope.mjs render, its tag escaped there)
     const landed = `cross-session-message id=\\"${shortId(messageId)}\\" from=\\"${sender}\\"`;
-    try { return await this.#locked(spec.directory, () => this.#send(spec, receiver, message, messageId, asked, landed)); }
-    finally {
-      if (String(sender).split(':')[1] !== this.machine) this.#keepRemote(spec.directory);
-      this.#cap();
-    }
+    return this.#locked(spec.directory, () => this.#send(spec, sender, senderName, receiver, message, messageId, expectsReply, asked, landed));
   }
 
-  async #send(spec, receiver, message, messageId, asked, landed) {
+  async #send(spec, sender, senderName, receiver, message, messageId, expectsReply, asked, landed) {
+    let queued = null, submitted = false;
     try {
       // made under its lock: a retire that held the lock meanwhile may have removed it
       if (this.stopped) return { delivered: false, detail: 'the machine daemon is stopping; no relay turn was submitted' };
       mkdirSync(spec.directory, { recursive: true, mode: 0o700 });
-      const queued = { to: receiver.socket ? `uds:${receiver.socket}` : receiver.name, message };
+      if (!receiver.socket) throw new Error("the pool requires the receiver's verified native socket; no name-addressed send was submitted");
+      queued = { pool: true, expects_reply: expectsReply, to: `uds:${receiver.socket}`, message, sender, sender_name: senderName, message_id: messageId, receiver: receiver.sessionId };
       const steps = [], began = asked;
       let mark = began;
       const step = (name) => { const now = performance.now(); steps.push(`${name} ${Math.round(now - mark)} ms`); mark = now; };
       step('lock');
-      let { runtime, connection } = await this.#ensure(spec, step);
-      this.#used(spec, connection);
-      this.store.removeRecord('relays', spec.receipt);
-      this.store.putRecord('relays', spec.queue, queued);
+      const unsettled = this.store.record('relays', spec.queue) && !this.store.record('relays', spec.receipt);
+      let { runtime, connection } = await this.#ensure(spec, step, { stale: Boolean(unsettled) });
+      this.store.transaction(() => {
+        beginRelayAttempt(this.store, queued);
+        this.store.removeRecord('relays', spec.receipt);
+        this.store.putRecord('relays', spec.queue, queued);
+      });
       let receipt;
       for (let attempt = 0; ; attempt++) {
         // A hand-in whose answer did not come (its bound passed, serve ended mid-call, serve's own deadline on the
         // runtime) may still have reached the relay, which then sends: its receipt is waited on as after any hand-in. A
         // hand-in refused (an answer that is an error) or never asked (no serve) did not reach it, and is said at once,
         // never held for a receipt that cannot come.
+        if (!this.store.record('relays', spec.queue)) this.store.transaction(() => { beginRelayAttempt(this.store, queued); this.store.putRecord('relays', spec.queue, queued); });
         let handed = true;
         const error = await this.#handIn(connection, queued, step);
+        submitted ||= !error || answerLost(error);
         if (!error) step('turn handed in (send_input)');
         else if (answerLost(error)) step(`turn handed in, its answer lost (send_input: ${error.message})`);
         else {
@@ -459,7 +374,6 @@ export class Relays {
           if (attempt === 0 && /already in progress/.test(error.message)) {
             step(`relay still in a turn after ${TURN_END_MS / 1000} s, closed (${error.message})`);
             ({ runtime, connection } = await this.#ensure(spec, step, { stale: true }));
-            this.#used(spec, connection);
             this.store.removeRecord('relays', spec.receipt);
             continue;
           }
@@ -472,32 +386,35 @@ export class Relays {
         const pid = this.#pid(spec, runtime);
         // only a relay proven dead is started again; one alive but slow may still deliver
         if (receipt.delivered || attempt === 1 || pid == null || alive(pid)) break;
-        try { ({ runtime, connection } = await this.#ensure(spec, step)); this.#used(spec, connection); } catch (error) { receipt = { delivered: false, detail: error.message }; break; }
+        try { ({ runtime, connection } = await this.#ensure(spec, step)); } catch (error) { receipt = { delivered: false, unknown: submitted, detail: error.message }; break; }
         this.store.removeRecord('relays', spec.receipt);
       }
-      this.store.removeRecord('relays', spec.queue);
-      // an outcome not confirmed is read where it would have landed: the relay can no longer send it (its queue is
-      // gone), so the receiver's transcript says whether it did
+      if (this.stopped) return { delivered: false, unknown: true, detail: 'the daemon stopped before settling the native send' };
+      // An unanswered outcome is read where it would have landed. Keep its
+      // queue and pending route together until that observation is committed.
       if (!receipt.delivered && receipt.unknown) {
         await new Promise((resolve) => setTimeout(resolve, LANDING_MS));
         let found = false;
         try { found = await this.arrived(receiver.sessionId, landed); } catch { /* unread: unknown */ }
+        if (this.stopped) return { delivered: false, unknown: true, detail: 'the daemon stopped while looking for native delivery' };
         step(found ? 'found in its receiver\'s transcript' : 'not in its receiver\'s transcript');
         if (found) receipt = { delivered: true };
         else receipt = { ...receipt, landed: false };
       }
-      if (receipt.delivered) {
-        const sent = this.store.record('relays', spec.sent) ?? {};
-        sent[receiver.sessionId] = messageId;
-        this.store.putRecord('relays', spec.sent, sent);
-      }
+      this.store.transaction(() => {
+        settleRelayAttempt(this.store, queued, receipt);
+        this.store.removeRecord('relays', spec.queue);
+      });
       // a slow relay send says where its time went, in the daemon's log (what a person reads of the connector)
       if (performance.now() - began > SLOW_SEND_MS) this.log(`relay send to ${receiver.name || receiver.sessionId} took ${Math.round(performance.now() - began)} ms: ${steps.join(', ')}`);
       return receipt;
     } catch (error) {
-      if (!this.stopped) this.store.removeRecord('relays', spec.queue);
-      return { delivered: false, ...(this.stopped ? { unknown: true } : {}), detail: error.message };
-    }
+      if (!this.stopped) this.store.transaction(() => {
+        settleRelayAttempt(this.store, queued, { unknown: submitted });
+        this.store.removeRecord('relays', spec.queue);
+      });
+      return { delivered: false, ...(this.stopped || submitted ? { unknown: true } : {}), detail: error.message };
+    } finally { if (!this.stopped) this.inboundSettled(); }
   }
 
   /**
@@ -520,18 +437,17 @@ export class Relays {
     }
   }
 
-  /** `runtimes.start` for a relay: a start that fails (its answer lost, or late past its bound) may still have left a
-   *  runtime running, so its folder is looked at by the next caps (#cap). */
+  /** Commit intent before asking. An unanswered start remains a durable barrier
+   * across restarts; time and a directory scan cannot prove that it never ran. */
   async #start(spec, params, timeoutMs) {
+    this.store.putRecord('relays', spec.start, { at_ms: Date.now(), name: spec.name, directory: spec.directory }, { create: true });
     try { return await this.serve('harness.v1.runtimes.start', params, timeoutMs); }
-    catch (error) { this.lost.set(spec.directory, Date.now()); throw error; }
+    catch (error) {
+      if (error.notAsked && !this.stopped) this.store.removeRecord('relays', spec.start);
+      throw error;
+    }
   }
 
-  /** A relay this daemon runs, used now. */
-  #used(spec, connection) {
-    const runtimeId = this.store.record('relays', spec.record)?.runtime_id;
-    if (typeof runtimeId === 'string') this.running.set(spec.directory, { connection, runtime_id: runtimeId, usedAt: Date.now() });
-  }
 }
 
 /** Whether a local port answers a connection within 300 ms. */