borgmcp-server 0.1.7 → 0.1.8

package/src/https-server.ts

@@ -39,7 +39,7 @@ export interface ServiceLimits {
 
 export const DEFAULT_SERVICE_LIMITS: ServiceLimits = {
   maxConnections: 100,
-  maxConnectionsPerAddress: 25,
+  maxConnectionsPerAddress: 30,
   maxRequestsPerWindow: 120,
   maxRequestsPerAddressWindow: 600,
   maxRequestsGlobalWindow: 5_000,
@@ -48,7 +48,7 @@ export const DEFAULT_SERVICE_LIMITS: ServiceLimits = {
   maxStreamsPerCredential: 8,
   maxHeaderBytes: 16_384,
   maxRequestBodyBytes: 65_536,
-  maxRequestsPerSocket: 100,
+  maxRequestsPerSocket: 0,
   requestTimeoutMs: 15_000,
   tlsHandshakeTimeoutMs: 10_000,
   headersTimeoutMs: 10_000,
@@ -63,7 +63,7 @@ export interface RequestHandlerContext {
   readonly authorizeCoordination?: (
     authorization: string | undefined,
     signal: AbortSignal,
-  ) => Promise<Principal | "missing" | "invalid" | "revoked" | "evicted">;
+  ) => Promise<Principal | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected">;
   readonly handleCoordination?: (request: CoordinationRequest) => Promise<CoordinationResponse>;
   readonly debugLogger: DebugLogger;
 }
@@ -82,6 +82,7 @@ export interface HttpsServerOptions {
   readonly debugLogger?: DebugLogger;
   readonly testHooks?: {
     readonly identifyRemoteAddress?: (socket: Socket) => string;
+    readonly identifyConnectionAddress?: (socket: Socket) => string;
   };
 }
 
@@ -100,6 +101,15 @@ export async function startHttpsServer(options: HttpsServerOptions): Promise<Run
   validateLimits(limits);
   validateTlsCertificate(options.tls.cert, bind.host, bind.mode, options.tls.ca);
   const handlerContext = createRequestHandlerContext(options);
+  const identifyRemoteAddress = options.testHooks?.identifyRemoteAddress ??
+    ((socket: Socket) => socket.remoteAddress ?? "unknown");
+  const identifyConnectionAddress = options.testHooks?.identifyConnectionAddress ??
+    ((socket: Socket) => socket.remoteAddress ?? "unknown");
+  const addressConnectionLimiter = new AddressConnectionLimiter(
+    limits.maxConnectionsPerAddress,
+    limits.maxConnections,
+    identifyConnectionAddress,
+  );
 
   const server = createServer(
     {
@@ -112,11 +122,19 @@ export async function startHttpsServer(options: HttpsServerOptions): Promise<Run
       headersTimeout: limits.headersTimeoutMs,
       keepAliveTimeout: limits.keepAliveTimeoutMs,
     },
-    createRequestListener(handlerContext, limits, options.testHooks?.identifyRemoteAddress),
+    createRequestListener(
+      handlerContext,
+      limits,
+      identifyRemoteAddress,
+      (socket) => addressConnectionLimiter.isRejected(socket),
+    ),
   );
 
-  const acceptedSockets = applyServerLimits(server, limits);
-  server.on("secureConnection", (socket) => socket.disableRenegotiation());
+  const acceptedSockets = applyServerLimits(server, limits, addressConnectionLimiter);
+  server.on("secureConnection", (socket) => {
+    socket.disableRenegotiation();
+    addressConnectionLimiter.admit(socket);
+  });
   server.on("tlsClientError", (_error, socket) => {
     handlerContext.debugLogger.emit({ event: "transport_rejection", reason: "tls_client_error" });
     socket.destroy();
@@ -173,6 +191,7 @@ function createRequestListener(
   context: RequestHandlerContext,
   limits: ServiceLimits,
   identifyRemoteAddress: (socket: Socket) => string = (socket) => socket.remoteAddress ?? "unknown",
+  isConnectionRejected: (socket: Socket) => boolean = () => false,
 ): (request: IncomingMessage, response: ServerResponse) => void {
   const admissionLimiter = new PreAuthAdmissionLimiter(limits);
   const credentialRateLimiter = new RequestRateLimiter(limits, limits.maxRequestsPerWindow);
@@ -204,6 +223,11 @@ function createRequestListener(
     };
     response.once("finish", emitDebug);
     response.once("close", emitDebug);
+    if (isConnectionRejected(request.socket)) {
+      request.resume();
+      sendRateLimited(response, 1);
+      return;
+    }
     const controller = new AbortController();
     response.once("close", () => controller.abort());
     let timer: NodeJS.Timeout | undefined;
@@ -343,16 +367,16 @@ async function handleRequest(
         sendJson(response, 410, protocolError(ErrorCode.DRONE_EVICTED, "Authentication failed."));
         return;
       }
-      const code = authentication === "revoked"
-        ? "SESSION_REVOKED"
+      const code = authentication === "expired"
+        ? ErrorCode.AUTH_EXPIRED
+        : authentication === "revoked" ? ErrorCode.SESSION_REVOKED
+        : authentication === "rejected" ? ErrorCode.SESSION_REJECTED
         : authentication === "missing" || authorization === undefined ? "AUTH_MISSING" : "AUTH_INVALID";
       sendJson(response, 401, protocolError(code, "Authentication failed."));
       return;
     }
     trace.principal = authentication;
-    const clientIdentity = `client:${authentication.kind === "drone-session"
-      ? authentication.clientId
-      : authentication.id}`;
+    const clientIdentity = credentialRateLimitIdentity(authentication, request.method, path);
     const credentialRetry = credentialRateLimiter.consume(clientIdentity);
     if (credentialRetry !== null) return sendRateLimited(response, credentialRetry);
     const query = parseCoordinationQuery(request.url, path);
@@ -393,7 +417,7 @@ async function handleRequest(
 interface RequestTrace {
   readonly route: DebugRoute;
   readonly method: string;
-  authentication: "not_required" | "missing" | "invalid" | "revoked" | "evicted" | "accepted";
+  authentication: "not_required" | "missing" | "invalid" | "expired" | "revoked" | "evicted" | "rejected" | "accepted";
   principal?: Principal;
 }
 
@@ -592,7 +616,24 @@ function isCoordinationPath(path: string | null): path is string {
     path?.startsWith("/api/cubes/") === true;
 }
 
-function applyServerLimits(server: HttpsServer, limits: ServiceLimits): Set<Socket> {
+function credentialRateLimitIdentity(
+  principal: Principal,
+  method: string | undefined,
+  path: string,
+): string {
+  const routineRead = (method === "GET" && !path.endsWith("/stream")) ||
+    (method === "PUT" && (path.endsWith("/logs") || path.endsWith("/decisions")));
+  if (principal.kind === "drone-session" && routineRead) {
+    return `drone-session:${principal.id}`;
+  }
+  return `client:${principal.kind === "drone-session" ? principal.clientId : principal.id}`;
+}
+
+function applyServerLimits(
+  server: HttpsServer,
+  limits: ServiceLimits,
+  addressConnectionLimiter: AddressConnectionLimiter,
+): Set<Socket> {
   server.maxConnections = limits.maxConnections;
   server.maxRequestsPerSocket = limits.maxRequestsPerSocket;
   server.requestTimeout = limits.requestTimeoutMs;
@@ -602,27 +643,63 @@ function applyServerLimits(server: HttpsServer, limits: ServiceLimits): Set<Sock
     Math.min(limits.handlerTimeoutMs * 2, 2_147_483_647),
     (socket) => socket.destroy(),
   );
-  const addressConnections = new ConcurrentQuota(limits.maxConnectionsPerAddress);
   const acceptedSockets = new Set<Socket>();
   server.on("connection", (socket) => {
     const tracked = socket as Socket;
     acceptedSockets.add(tracked);
     tracked.once("close", () => acceptedSockets.delete(tracked));
-    const identity = tracked.remoteAddress ?? "unknown";
-    const release = addressConnections.acquire(identity);
+    addressConnectionLimiter.admitRaw(tracked);
+  });
+  return acceptedSockets;
+}
+
+class AddressConnectionLimiter {
+  readonly #rawConnections: ConcurrentQuota;
+  readonly #connections: ConcurrentQuota;
+  readonly #rejected = new WeakSet<Socket>();
+  readonly #identifyRemoteAddress: (socket: Socket) => string;
+
+  constructor(
+    limit: number,
+    globalLimit: number,
+    identifyRemoteAddress: (socket: Socket) => string,
+  ) {
+    // Keep exactly one per-address raw socket available beyond normal secure
+    // admission so it can receive a controlled HTTP 429 after TLS. All later
+    // raw sockets are rejected before they can consume the global pool.
+    this.#rawConnections = new ConcurrentQuota(Math.min(limit + 1, globalLimit));
+    this.#connections = new ConcurrentQuota(limit);
+    this.#identifyRemoteAddress = identifyRemoteAddress;
+  }
+
+  admitRaw(socket: Socket): void {
+    const release = this.#rawConnections.acquire(this.#identifyRemoteAddress(socket));
     if (release === null) {
       socket.destroy();
       return;
     }
     socket.once("close", release);
-  });
-  return acceptedSockets;
+  }
+
+  admit(socket: Socket): void {
+    const release = this.#connections.acquire(this.#identifyRemoteAddress(socket));
+    if (release === null) {
+      this.#rejected.add(socket);
+      return;
+    }
+    socket.once("close", release);
+  }
+
+  isRejected(socket: Socket): boolean {
+    return this.#rejected.has(socket);
+  }
 }
 
 function validateLimits(limits: ServiceLimits): void {
   for (const [name, value] of Object.entries(limits)) {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new Error(`${name} must be a positive safe integer.`);
+    if (!Number.isSafeInteger(value) || value < 0 || (value === 0 && name !== "maxRequestsPerSocket")) {
+      const range = name === "maxRequestsPerSocket" ? "non-negative" : "positive";
+      throw new Error(`${name} must be a ${range} safe integer.`);
     }
   }
   if (limits.headersTimeoutMs > limits.requestTimeoutMs) {

package/src/migrations.ts

@@ -378,6 +378,29 @@ export const STORE_MIGRATIONS: readonly Migration[] = Object.freeze([
       ) STRICT;
     `,
   },
+  {
+    version: 12,
+    name: "drone_session_supersession",
+    sql: `
+      ALTER TABLE drone_sessions ADD COLUMN superseded_at TEXT;
+
+      WITH lineage AS (
+        SELECT rowid AS session_rowid,
+               LEAD(created_at) OVER (
+                 PARTITION BY client_id, cube_id, drone_id
+                 ORDER BY created_at, rowid
+               ) AS successor_at
+        FROM drone_sessions
+      )
+      UPDATE drone_sessions
+      SET superseded_at = (
+        SELECT successor_at FROM lineage WHERE session_rowid = drone_sessions.rowid
+      )
+      WHERE rowid IN (
+        SELECT session_rowid FROM lineage WHERE successor_at IS NOT NULL
+      );
+    `,
+  },
 ]);
 
 interface AppliedMigrationRow {

package/src/store.ts

@@ -65,7 +65,6 @@ export type ActivityNotificationRecord = EnrichedActivityRecord & (
     readonly claimant_drone_id?: string;
     readonly claimant_role?: string | null;
   }
-  | { readonly kind: "heartbeat_ping" }
 );
 
 export type ActivityStreamRecord = EnrichedActivityRecord | ActivityNotificationRecord;
@@ -180,11 +179,7 @@ export interface StoreRuntime {
 }
 
 export interface LivenessStore {
-  readonly scan: (options?: {
-    readonly silentMs?: number;
-    readonly cooldownMs?: number;
-    readonly limit?: number;
-  }) => ActivityNotificationRecord[];
+  readonly scan: () => ActivityNotificationRecord[];
 }
 
 export interface DigestPair {
@@ -237,6 +232,7 @@ export interface StoredDroneSessionDigest extends StoredSecretDigest {
   readonly droneId: string;
   readonly expiresAt: string;
   readonly evictedAt: string | null;
+  readonly takenOver: boolean;
 }
 
 export interface CredentialStore {
@@ -362,6 +358,7 @@ export interface SeatAttachInput {
   readonly credentialId: string;
   readonly credentialDigest: DigestPair;
   readonly expiresAt: string;
+  readonly renewIfExpiresAtOrBefore: string;
 }
 
 export interface SeatAttachRecord {
@@ -527,6 +524,33 @@ export class AttachSessionRejectedError extends Error {
   }
 }
 
+export class AttachSessionExpiredError extends Error {
+  readonly code = "AUTH_EXPIRED";
+
+  constructor() {
+    super("Authentication failed.");
+    this.name = "AttachSessionExpiredError";
+  }
+}
+
+export class AttachSessionRevokedError extends Error {
+  readonly code = "SESSION_REVOKED";
+
+  constructor() {
+    super("Authentication failed.");
+    this.name = "AttachSessionRevokedError";
+  }
+}
+
+export class AttachDroneEvictedError extends Error {
+  readonly code = "DRONE_EVICTED";
+
+  constructor() {
+    super("Authentication failed.");
+    this.name = "AttachDroneEvictedError";
+  }
+}
+
 export class StorageCapacityError extends Error {
   readonly code = "CAPACITY_EXCEEDED";
 
@@ -645,7 +669,7 @@ export async function openStore(options: OpenStoreOptions): Promise<StoreRuntime
   );
   const activityHub = new ActivityHub();
   const maintenance = new SqliteMaintenanceStore(database, clock);
-  const liveness = new SqliteLivenessStore(database, clock, activityHub, capacityGuard);
+  const liveness = new IdleLivenessStore();
   const credentials = new SqliteCredentialStore(database, clock, capacityGuard, options.mutationHook);
   return Object.freeze({
     forPrincipal: (principal: Principal) => {
@@ -1283,7 +1307,6 @@ class SqliteScopedStore implements ScopedStore {
         this.#database.prepare(`
           UPDATE drones SET last_seen = ? WHERE id = ? AND cube_id = ? AND evicted_at IS NULL
         `).run(createdAt, droneId, cubeId);
-        this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
       }
       if (recipients.length > 0) {
         const valid = this.#database.prepare(`
@@ -1470,6 +1493,7 @@ class SqliteScopedStore implements ScopedStore {
     assertCanonicalUuid(input.credentialId, "Drone session credential id");
     validateDigest(input.credentialDigest);
     validateTimestamp(input.expiresAt);
+    validateTimestamp(input.renewIfExpiresAtOrBefore);
     const scope = this.#scope("read");
     const authorizedRole = this.#database.prepare(`
       SELECT 1 FROM cubes AS c JOIN roles AS role ON role.cube_id = c.id
@@ -1492,7 +1516,7 @@ class SqliteScopedStore implements ScopedStore {
         SELECT credential.verifier_digest, credential.revoked_at AS credential_revoked_at,
                session.id AS session_id, session.client_id, session.cube_id, session.drone_id,
                session.expires_at, session.revoked_at AS session_revoked_at,
-               drone.role_id, drone.label, drone.evicted_at
+               session.superseded_at, drone.role_id, drone.label, drone.evicted_at
         FROM drone_session_credentials AS credential
         JOIN drone_sessions AS session ON session.id = credential.session_id
         JOIN drones AS drone ON drone.id = session.drone_id
@@ -1502,10 +1526,6 @@ class SqliteScopedStore implements ScopedStore {
       if (bound !== undefined) {
         const verifier = requiredBuffer(bound, "verifier_digest");
         if (!timingSafeEqual(verifier, input.credentialDigest.verifier) ||
-            optionalText(bound, "credential_revoked_at") !== null ||
-            optionalText(bound, "session_revoked_at") !== null ||
-            optionalText(bound, "evicted_at") !== null ||
-            requiredText(bound, "expires_at") <= now ||
             requiredText(bound, "client_id") !== this.#principal.id ||
             requiredText(bound, "cube_id") !== input.cubeId ||
             requiredText(bound, "role_id") !== input.roleId ||
@@ -1513,9 +1533,27 @@ class SqliteScopedStore implements ScopedStore {
               requiredText(bound, "drone_id") !== input.priorDroneId)) {
           throw new AttachSessionRejectedError();
         }
+        if (optionalText(bound, "evicted_at") !== null) throw new AttachDroneEvictedError();
+        if (optionalText(bound, "credential_revoked_at") !== null ||
+            optionalText(bound, "session_revoked_at") !== null) {
+          throw new AttachSessionRevokedError();
+        }
+        if (optionalText(bound, "superseded_at") !== null) {
+          throw new AttachSessionRejectedError();
+        }
+        if (requiredText(bound, "expires_at") <= now) throw new AttachSessionExpiredError();
         const droneId = requiredText(bound, "drone_id");
+        const sessionId = requiredText(bound, "session_id");
+        const previousExpiry = requiredText(bound, "expires_at");
+        const committedExpiry = input.expiresAt > previousExpiry &&
+            previousExpiry <= input.renewIfExpiresAtOrBefore
+          ? input.expiresAt
+          : previousExpiry;
+        if (committedExpiry !== previousExpiry) {
+          this.#database.prepare("UPDATE drone_sessions SET expires_at = ? WHERE id = ?")
+            .run(committedExpiry, sessionId);
+        }
         this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
-        this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
         const attachedRoleRow = this.#database.prepare(`
           SELECT id AS role_id, name AS role_name, role_class, is_human_seat
           FROM roles WHERE id = ? AND cube_id = ?
@@ -1538,33 +1576,53 @@ class SqliteScopedStore implements ScopedStore {
             is_human_seat: requiredInteger(attachedRoleRow, "is_human_seat") === 1,
           },
           drone: { id: droneId, label: requiredText(bound, "label") },
-          sessionId: requiredText(bound, "session_id"),
-          expiresAt: requiredText(bound, "expires_at"),
+          sessionId,
+          expiresAt: committedExpiry,
           result: "reused",
         };
       }
 
       const priorSeat = input.priorDroneId === undefined ? undefined : this.#database.prepare(`
-        SELECT id, role_id, label FROM drones
-        WHERE id = ? AND client_id = ? AND cube_id = ? AND evicted_at IS NULL
+        SELECT id, role_id, label, evicted_at FROM drones
+        WHERE id = ? AND client_id = ? AND cube_id = ?
       `).get(input.priorDroneId, this.#principal.id, input.cubeId);
       let droneId: string;
       let droneLabel: string;
-      if (priorSeat !== undefined) {
+      if (input.priorDroneId !== undefined) {
+        if (priorSeat === undefined) throw new AttachSessionRejectedError();
+        if (optionalText(priorSeat, "evicted_at") !== null) throw new AttachDroneEvictedError();
         const priorSeatId = requiredText(priorSeat, "id");
         if (requiredText(priorSeat, "role_id") !== input.roleId) {
           throw new AttachSessionRejectedError();
         }
-        const occupied = this.#database.prepare(`
-          SELECT 1 FROM drone_sessions AS session
+        const latestSession = this.#database.prepare(`
+          SELECT session.id, session.expires_at, session.revoked_at AS session_revoked_at,
+                 MAX(CASE WHEN credential.revoked_at IS NOT NULL THEN 1 ELSE 0 END)
+                   AS credential_revoked
+          FROM drone_sessions AS session
           JOIN drone_session_credentials AS credential ON credential.session_id = session.id
           WHERE session.drone_id = ? AND session.client_id = ? AND session.cube_id = ?
-            AND session.revoked_at IS NULL AND credential.revoked_at IS NULL
-            AND session.expires_at > ?
-        `).get(priorSeatId, this.#principal.id, input.cubeId, now);
-        if (occupied !== undefined) throw new AttachSessionRejectedError();
+            AND session.superseded_at IS NULL
+          GROUP BY session.id
+          LIMIT 1
+        `).get(priorSeatId, this.#principal.id, input.cubeId);
+        if (latestSession === undefined) throw new AttachSessionRejectedError();
+        if (optionalText(latestSession, "session_revoked_at") !== null ||
+            requiredInteger(latestSession, "credential_revoked") === 1) {
+          throw new AttachSessionRevokedError();
+        }
+        if (requiredText(latestSession, "expires_at") > now) {
+          throw new AttachSessionRejectedError();
+        }
         droneId = priorSeatId;
         droneLabel = requiredText(priorSeat, "label");
+        const superseded = this.#database.prepare(`
+          UPDATE drone_sessions SET superseded_at = ?
+          WHERE id = ? AND superseded_at IS NULL
+        `).run(now, requiredText(latestSession, "id"));
+        if (Number(superseded.changes) !== 1) {
+          throw new Error("Expired session supersession was not atomic.");
+        }
         this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
       } else {
         droneId = input.droneId;
@@ -1576,8 +1634,6 @@ class SqliteScopedStore implements ScopedStore {
           droneId, input.cubeId, input.roleId, this.#principal.id, droneLabel, now, now,
         );
       }
-      this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
-
       this.#database.prepare(`
         INSERT INTO drone_sessions (
           id, client_id, cube_id, drone_id, created_at, expires_at
@@ -2194,61 +2250,11 @@ class ActivityHub {
   }
 }
 
-class SqliteLivenessStore implements LivenessStore {
-  constructor(
-    readonly database: DatabaseSync,
-    readonly clock: () => Date,
-    readonly hub: ActivityHub,
-    readonly capacityGuard: StorageCapacityGuard,
-  ) {}
-
-  scan(options: { silentMs?: number; cooldownMs?: number; limit?: number } = {}): ActivityNotificationRecord[] {
-    const now = this.clock();
-    const silentBefore = new Date(now.getTime() - (options.silentMs ?? 600_000)).toISOString();
-    const cooldownBefore = new Date(now.getTime() - (options.cooldownMs ?? 600_000)).toISOString();
-    const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 25), 25));
-    const candidates = this.database.prepare(`
-      SELECT drone.id AS drone_id, drone.cube_id, COALESCE(state.attempts, 0) AS attempts
-      FROM drones AS drone
-      JOIN clients AS client ON client.id = drone.client_id AND client.revoked_at IS NULL
-      JOIN client_cube_grants AS grant_row ON grant_row.client_id = drone.client_id
-        AND grant_row.cube_id = drone.cube_id AND grant_row.access IN ('write', 'manage')
-      LEFT JOIN silent_seat_ping_state AS state ON state.drone_id = drone.id
-      WHERE drone.evicted_at IS NULL AND COALESCE(drone.last_seen, drone.created_at) < ?
-        AND COALESCE(state.attempts, 0) < 3
-        AND (state.last_ping_at IS NULL OR state.last_ping_at < ?)
-        AND EXISTS (SELECT 1 FROM drone_sessions AS session
-          WHERE session.drone_id = drone.id AND session.revoked_at IS NULL AND session.expires_at > ?)
-      ORDER BY COALESCE(drone.last_seen, drone.created_at), drone.id LIMIT ?
-    `).all(silentBefore, cooldownBefore, now.toISOString(), limit);
-    const published: ActivityNotificationRecord[] = [];
-    for (const candidate of candidates) {
-      const droneId = requiredText(candidate, "drone_id");
-      const cubeId = requiredText(candidate, "cube_id");
-      const message = "[HEARTBEAT-PING] No recent activity; confirm this seat is responsive.";
-      this.capacityGuard.assertCanGrow(256);
-      const id = randomUUID();
-      const createdAt = now.toISOString();
-      this.database.exec("BEGIN IMMEDIATE");
-      try {
-        this.database.prepare(`INSERT INTO silent_seat_ping_state (drone_id, attempts, last_ping_at)
-          VALUES (?, 1, ?) ON CONFLICT(drone_id) DO UPDATE
-          SET attempts = attempts + 1, last_ping_at = excluded.last_ping_at
-        `).run(droneId, now.toISOString());
-        this.database.exec("COMMIT");
-      } catch (error) {
-        try { this.database.exec("ROLLBACK"); } catch { /* Preserve original failure. */ }
-        throw error;
-      }
-      const entry: ActivityNotificationRecord = {
-        kind: "heartbeat_ping",
-        id, cube_id: cubeId, drone_id: null, message, visibility: "direct", created_at: createdAt,
-        drone_label: null, role_name: null, recipient_drone_ids: [droneId],
-      };
-      this.hub.publish(cubeId, entry);
-      published.push(entry);
-    }
-    return published;
+class IdleLivenessStore implements LivenessStore {
+  scan(): ActivityNotificationRecord[] {
+    // Silence is not a delivery failure. Keep the scheduler's lifecycle seam without
+    // creating a directed event that crosses the client/model wake boundary.
+    return [];
   }
 }
 
@@ -2577,7 +2583,7 @@ class SqliteCredentialStore implements CredentialStore {
              credential.session_id, session.client_id, session.cube_id, session.drone_id,
              session.expires_at,
              COALESCE(credential.revoked_at, session.revoked_at, client.revoked_at) AS revoked_at,
-             drone.evicted_at
+             drone.evicted_at, session.superseded_at
       FROM drone_session_credentials AS credential
       JOIN drone_sessions AS session ON session.id = credential.session_id
       JOIN clients AS client ON client.id = session.client_id
@@ -3055,6 +3061,7 @@ function storedDroneSessionDigest(row: Record<string, unknown>): StoredDroneSess
     droneId: requiredText(row, "drone_id"),
     expiresAt: requiredText(row, "expires_at"),
     evictedAt: nullableText(row, "evicted_at"),
+    takenOver: nullableText(row, "superseded_at") !== null,
   };
 }