ccdeck 3.32.2 → 3.33.1

package/src/server/lan-engine.mjs

@@ -40,8 +40,8 @@
 // accounts all work talks to its peers every minute and never asks for
 // anything.
 import {
-  addTrusted, credentialAad, dropTrusted, identityFrom, open, peerWhy, plan, stillListed, transferChallenge,
-  trustedPeer,
+  addTrusted, ANNOUNCE_MS, credentialAad, dropTrusted, identityFrom, open, peerWhy, plan, PRESENT_MS,
+  stillListed, transferChallenge, trustedPeer,
 } from "./lan-sync.mjs";
 import { mintInvite, readInvite } from "./lan-invite.mjs";
 import { createInviteOffer } from "./lan-invite-offer.mjs";
@@ -81,6 +81,21 @@ const ROUND_MS = 10_000;
  *  lan-dials.mjs, which keeps the list and the cap. */
 export { MAX_AUTO_PEERS };
 
+/**
+ * The most pairings the accept switch may make on its own (#1737).
+ *
+ * It had no limit, and a pin is a line in prefs.json and a deck every round
+ * dials: one host handshaking with a fresh key each time made sixty of them in
+ * well under a second. Only pins a SWITCH made count (`auto`, see addTrusted);
+ * a person's accepts are theirs, as a person's typed addresses are.
+ *
+ * THE SAME NUMBER AS MAX_AUTO_PEERS, because every pin the switch makes brings
+ * a dial-back row out of that budget, so a pin past it is a deck this one
+ * mostly could not dial back anyway. Thirty-two machines is also well past one
+ * person's own fleet, which is who the switch is for.
+ */
+export const MAX_AUTO_PINS = MAX_AUTO_PEERS;
+
 /** What this machine calls itself when the user has not said. The hostname,
  *  because that is the word they already use for this machine everywhere else. */
 export function defaultName() {
@@ -133,9 +148,14 @@ export { anotherMachine };
  * came from the group and the group therefore has it, and a tailnet can reach
  * further than one person's own machines. Sharing there stays a decision
  * somebody makes rather than one an arrival makes for them.
+ *
+ * AND ONLY FROM A DECK SOMEBODY HERE CHOSE. "The group has it" is true of a
+ * group a person put together; a deck the accept switch paired (`pin.auto`,
+ * see addTrusted) is one nobody here chose, and what arrives from it is not
+ * passed on in this deck's name.
  */
-export function ticksOnArrival(step, via) {
-  return !!step?.key && step.action === "add" && via !== "tailscale";
+export function ticksOnArrival(step, via, pin = null) {
+  return !!step?.key && step.action === "add" && via !== "tailscale" && pin?.auto !== true;
 }
 
 /** The two permissions that answer for one route — see lan-requests.mjs,
@@ -373,9 +393,12 @@ export function createEngine({
    * or joined on an invite of its own — and take back any earlier unpair of
    * it, because choosing it again is the undo. The list, and whether the pin
    * is new.
+   *
+   * Or one the accept switch chose for them, which `auto` says and the pin
+   * keeps — see addTrusted, and roundWith for what such a deck may not do.
    */
-  const pin = ({ fp, pub, name }) => {
-    const { list, added } = addTrusted(cfg.trusted, { fp, pub, name, at: now() });
+  const pin = ({ fp, pub, name }, { auto = false } = {}) => {
+    const { list, added } = addTrusted(cfg.trusted, { fp, pub, name, at: now(), ...(auto ? { auto: true } : {}) });
     cfg = { ...cfg, trusted: list };
     markUnpaired(fp, false);
     return { list, added };
@@ -400,12 +423,35 @@ export function createEngine({
     about, now, myFp: () => identity.fp, settings: () => cfg,
   });
 
+  /**
+   * WHERE EACH PAIRED DECK LAST ANSWERED: the address and port of the last
+   * round whose handshake with it completed against its pin, by fingerprint.
+   *
+   * A beacon carries a fingerprint and a port, and nothing binds either to the
+   * address it came from — so for a paired deck it may say where to try FIRST
+   * and nothing more. It used to be the whole answer: the heard row took the
+   * beacon's address, was dialled for a day, and a typed row for the same deck
+   * was skipped as dialled already. A deck reached by typed address, which is
+   * the usual reason to type one, sends no beacon that would ever correct it.
+   * This is what a round falls back to when a heard address fails, and what
+   * lets a heard address that did answer stay dialled after its beacons stop.
+   */
+  const lastGood = new Map();
+  const answeredThere = p => {
+    const g = lastGood.get(p.fp);
+    return !!g && g.addr === p.addr && g.port === p.port;
+  };
+  /** Whether a round dials this heard row: listed, and either answered at that
+   *  address or still being announced there. One that never answered is
+   *  dialled for as long as a deck stays present (PRESENT_MS), not a day. */
+  const dialsHeard = p => stillListed(p, now()) && (answeredThere(p) || now() - p.lastSeen < PRESENT_MS);
+
   /** Does this deck already hold an address it dials for `fp`? A beacon row it
-   *  still hears, or a typed/learned row that answered as that deck. When
+   *  still dials, or a typed/learned row that answered as that deck. When
    *  neither is true, the only way it ever reaches that deck is if the deck
    *  keeps calling — and a called deck is never pulled from. */
   const dialsAlready = fp => {
-    if (beacon && [...beacon.peers.values()].some(p => p.fp === fp && stillListed(p, now()))) return true;
+    if (beacon && [...beacon.peers.values()].some(p => p.fp === fp && dialsHeard(p))) return true;
     return dials.answersAs(fp);
   };
 
@@ -491,11 +537,58 @@ export function createEngine({
     onChange?.();
   };
 
-  /** Another deck is using this one's key. Take a new key and keep it. Two
-   *  decks with one identity are invisible to each other forever otherwise,
-   *  and the second one to notice moving is enough — whichever notices
-   *  first, moves. */
-  const idClash = () => {
+  /** The identity a key check is running for, or has already moved away from,
+   *  and when the last one started — see idClash. */
+  let clashFor = null;
+  let clashAt = -Infinity;
+
+  /**
+   * Another deck may be using this one's key. When it is, take a new key and
+   * keep it. Two decks with one identity are invisible to each other forever
+   * otherwise, and the second one to notice moving is enough — whichever
+   * notices first, moves.
+   *
+   * THE BEACON SAYS WHERE TO LOOK, NOT THAT IT IS SO. This deck's fingerprint
+   * is in every beacon it sends, so a beacon wearing it is no evidence that
+   * anybody else holds the key — and a new key is a stranger to every deck
+   * paired with this one, which an invite-only pairing does not recover from
+   * without a new invite. What only another holder of the key can do is finish
+   * a handshake against this deck's own pin, so the deck dials the address the
+   * beacon named and moves only if that handshake completes. Saying it is not
+   * asking to pair, so a deck from before its listener answered this is simply
+   * not a copy here — and it moves on its own when it hears this deck.
+   *
+   * NOT ITS OWN LISTENER, which holds the key too and would answer the same
+   * way: the challenge on that connection says which one answered.
+   *
+   * ONE CHECK AT A TIME, AT MOST ONE PER BEACON INTERVAL, AND NONE ONCE IT HAS
+   * MOVED. What arrives decides how often this dials, never how much; a real
+   * copy announces every ANNOUNCE_MS, so it is looked at by its next beacon at
+   * the latest; and after the new key is handed over nothing more is checked
+   * until the deck restarts on it.
+   */
+  const idClash = async ({ addr, port } = {}) => {
+    const mine = identity;
+    if (!mine || !server || typeof addr !== "string" || !addr || !port) return;
+    if (clashFor === mine || now() - clashAt < ANNOUNCE_MS) return;
+    clashFor = mine;
+    clashAt = now();
+    const startedIn = generation;
+    let copy = false;
+    let conn = null;
+    try {
+      conn = await connectToPeer({
+        host: addr, port, fp: mine.fp, pub: mine.pub, secret: mine.secret, name: cfg.name,
+        myPort: server?.port() ?? null, expectPub: mine.pub, ask: false, sealFrames, ephemeral,
+      });
+      copy = conn.peerFp === mine.fp && startedIn === generation && !server?.issued(conn.peerChallenge);
+    } catch { /* nothing there holds this key */ } finally {
+      conn?.sock?.destroy();
+    }
+    if (!copy || startedIn !== generation || identity !== mine) {
+      if (clashFor === mine) clashFor = null;
+      return;
+    }
     const fresh = identityFrom("");
     onIdentity?.(fresh.secret);
     onError?.("id-clash", new Error("another deck was using this one's key; taking a new one"));
@@ -514,8 +607,9 @@ export function createEngine({
     arrived.forEach((d, i) => { if (typeof found?.[i] === "string") d.why = found[i]; });
   };
 
-  /** Ask one peer what it has, and heal whatever it can heal. */
-  const roundWith = async peer => {
+  /** Ask one peer what it has, and heal whatever it can heal. `reached` is
+   *  told the deck's fingerprint once the handshake with it has held. */
+  const roundWith = async (peer, reached = null) => {
     let conn = null;
     const startedIn = session;
     // Out here, so a round that dies after some logins arrived still reports
@@ -539,6 +633,13 @@ export function createEngine({
       });
       const ask = frame => askOver(conn, frame);
 
+      // THIS DECK'S OWN KEY, ANSWERING — its own listener at an address
+      // somebody typed, or another machine holding a copy of the key, which a
+      // listener now answers (see idClash). Neither is a deck to pin, ask or
+      // take anything from, and a pin of this deck's own key would be one
+      // every handler here then trusted.
+      if (conn.peerFp === identity.fp) throw new Error("that address answers with this deck's own key");
+
       // WHO IS ACTUALLY THERE. A typed address is a row that says `192.168.1.5:54340`
       // and nothing else until somebody answers it — and once one has, the deck
       // on the other end has told us what it calls itself. The row says that
@@ -599,6 +700,12 @@ export function createEngine({
         if (added) { cfg = { ...cfg, trusted: list }; onTrust?.(list); }
       }
 
+      // A PAIRED DECK, ANSWERING HERE against its pin — which is what makes
+      // this address one to fall back to, and a heard one worth dialling after
+      // its beacons stop. See lastGood.
+      lastGood.set(conn.peerFp, { addr: peer.addr, port: peer.port, via: viaOf(peer) });
+      reached?.(conn.peerFp);
+
       // Our card goes with the question and theirs comes back with the answer
       // — see lan-about.mjs for why it is here and nowhere earlier.
       // THE QUESTION CARRIES THIS DECK'S LIST TOO, and which of it this deck is
@@ -627,6 +734,14 @@ export function createEngine({
       // them, which is the whole of "I do not want to paste blobs any more".
       // What can reach this is what a deck somebody here pressed accept on
       // chose to offer.
+      //
+      // WHICH IS ONLY TRUE OF A DECK SOMEBODY CHOSE. The accept switch presses
+      // accept for the owner, so "somebody here pressed accept" is not a
+      // premise about a deck it paired: nobody here chose that deck, and the
+      // logins this store holds would be whatever it decided to offer. A deck
+      // the switch paired is treated as a heal is — what it offers comes in
+      // only for an account ticked here — and a person's own press or invite
+      // takes the mark off its pin (see addTrusted).
       // OVER `list`, NOT THE RAW ARRAY. `offered`, which keepManifest runs the
       // list through above (see lan-manifest.mjs), slices to 50 and type-
       // filters `key` and `email`; this line read `theirs.accounts` and got
@@ -637,13 +752,14 @@ export function createEngine({
       // the store lock, while the panel drew 50 and every other paired deck
       // waited behind it. `step.key` also reached transferChallenge and
       // importAccount untyped, which `offered`'s filter would have caught.
-      const wanted = plan(mine, list)
-        .filter(step => step.action === "add" || cfg.shared.includes(step.key));
+      const chosen = () => trustedPeer(cfg.trusted, conn.peerFp)?.auto !== true;
+      const takes = step => cfg.shared.includes(step.key) || (step.action === "add" && chosen());
+      const wanted = plan(mine, list).filter(takes);
       // TWO CHECKS, BECAUSE THEY END DIFFERENT THINGS. Losing the session —
       // LAN switched off, the peer unpaired (`stillPaired`, above) — ends the
       // round. A heal unticked mid-round ends only that heal: the adds behind
       // it need no tick, and the skipped row says why rather than vanishing.
-      const stillWanted = step => step.action !== "heal" || cfg.shared.includes(step.key);
+      const stillWanted = takes;
       /** One login, asked for and opened: a `want` carrying its own proof that
        *  names the account (see transferChallenge), and the `have` opened under
        *  the additional data it was sealed with. The login, or why there is
@@ -705,7 +821,7 @@ export function createEngine({
         // The store can finish an import after the owner disabled LAN or
         // revoked this peer. Keep the imported slot, but do not turn it into
         // a newly shared credential on behalf of an obsolete transfer.
-        if (ok && stillPaired() && ticksOnArrival(step, viaOf(peer))) {
+        if (ok && stillPaired() && ticksOnArrival(step, viaOf(peer), trustedPeer(cfg.trusted, conn.peerFp))) {
           try { await onShared?.(step.key); }
           catch { /* the account is here; the tick is retried the next time one arrives */ }
         }
@@ -761,40 +877,65 @@ export function createEngine({
     if (!beacon) return [];
     const startedIn = session;
     const all = [];
-    // Heard first, typed second, and a typed one is skipped when the beacon
-    // already found that address: otherwise a deck that is both would be dialled
-    // twice a round and its work counted twice.
+    // Heard first, typed second, and a typed one is skipped when this round
+    // already dialled that address: otherwise a deck that is both would be
+    // dialled twice a round and its work counted twice.
     // The same rule the list uses. A deck that has been silent for a day is not
-    // dialled once a minute forever on the chance it comes back.
+    // dialled once a minute forever on the chance it comes back — and one that
+    // never answered at the address it announced, not past PRESENT_MS (see
+    // dialsHeard).
     //
     // A deck heard over the tailnet is dialled only while that switch is on, and
     // so is a row the deck added itself from a tailnet beacon. An address a
     // person typed is theirs whatever the switch says — pairing by a typed
     // 100.x address worked before any of this.
     const heard = [...beacon.peers.values()]
-      .filter(p => stillListed(p, now()) && (cfg.tailscale || p.via !== "tailscale"));
-    const seen = new Set(heard.map(p => `${p.addr}:${p.port}`));
+      .filter(p => dialsHeard(p) && (cfg.tailscale || p.via !== "tailscale"));
+    /** Every address this round has dialled, and every paired deck it reached
+     *  by any of them. */
+    const tried = new Set();
+    const reached = new Set();
+    const dial = async peer => {
+      tried.add(`${peer.addr}:${peer.port}`);
+      all.push(...await roundWith(peer, fp => reached.add(fp)));
+    };
+    // Sequential rather than parallel. The store takes one mutation at a
+    // time anyway (the mutex in store-lock.mjs), and two peers healing the
+    // same account at once would race for a slot number claude-swap assigns
+    // as max+1 without a lock of its own.
+    //
+    // And given up when LAN is switched off under it: the rest of the list
+    // belongs to no session, and dialling it only delays the next round.
+    for (const peer of heard) {
+      if (session !== startedIn) return all;
+      await dial(peer);
+      // A HEARD ADDRESS THAT DID NOT ANSWER, for a deck that answered somewhere
+      // else before: that address, in the same round. A beacon says where a
+      // deck moved and cannot say it truly — see lastGood. One on the dial list
+      // is tried below with the rest of the list; one heard over the tailnet
+      // waits for that switch, as its beacon would.
+      const back = reached.has(peer.fp) ? null : lastGood.get(peer.fp);
+      if (!back || (back.via === "tailscale" && !cfg.tailscale)) continue;
+      const at = `${back.addr}:${back.port}`;
+      if (tried.has(at) || dials.rows().some(r => `${r.addr}:${r.port}` === at)) continue;
+      if (session !== startedIn) return all;
+      await dial({ fp: peer.fp, name: peer.name, addr: back.addr, port: back.port, via: back.via });
+    }
     // AND ONE DIAL PER DECK, not one per address. A row asked from a tailnet
     // beacon keeps that address after the same deck is heard on the local
     // network, and both used to be dialled every round — two handshakes, and
     // two lines of work for one machine. `dials.metAt` says which deck a row
-    // reached; the heard row already dials it by the better route.
-    const heardFps = new Set(heard.map(p => p.fp));
+    // reached; when this round already reached that deck, by the heard route
+    // or any other, the row is skipped. When it did not, the row is the next
+    // way to it and is dialled — a heard address alone never stands in for it.
     const typed = dials.rows().filter(p => {
       const at = `${p.addr}:${p.port}`;
-      if (seen.has(at) || heardFps.has(dials.metAt(at)?.fp)) return false;
+      if (tried.has(at) || reached.has(dials.metAt(at)?.fp)) return false;
       return cfg.tailscale || p.typed || !routeTo(p.addr);
     });
-    for (const peer of [...heard, ...typed]) {
-      // Sequential rather than parallel. The store takes one mutation at a
-      // time anyway (the mutex in store-lock.mjs), and two peers healing the
-      // same account at once would race for a slot number claude-swap assigns
-      // as max+1 without a lock of its own.
-      //
-      // And given up when LAN is switched off under it: the rest of the list
-      // belongs to no session, and dialling it only delays the next round.
+    for (const peer of typed) {
       if (session !== startedIn) return all;
-      all.push(...await roundWith(peer));
+      await dial(peer);
     }
     if (session !== startedIn) return all;
     lastRound.finished();
@@ -845,12 +986,16 @@ export function createEngine({
     // heard half brings liveness, the dialled half brings the last round.
     const rows = [];
     const byId = new Map();
+    /** Of two records of asking one deck, the one written last. */
+    const later = (x, y) => (!x ? y : !y ? x : (y.at ?? 0) >= (x.at ?? 0) ? y : x);
     const put = row => {
       const had = byId.get(row.id);
       if (!had) { byId.set(row.id, row); rows.push(row); return; }
-      // Keep what each half is the authority on.
+      // Keep what each half is the authority on — and the LATER ask of the
+      // two, which is how the deck is now: a round that could not reach it by
+      // its heard address and reached it by the typed one wrote both.
       had.lastSeen = had.lastSeen ?? row.lastSeen;
-      had.last = had.last ?? row.last;
+      had.last = later(had.last, row.last);
       had.manual = had.manual || row.manual;
       had.met = had.met || row.met;
       if (row.name && !had.name) had.name = row.name;
@@ -862,6 +1007,9 @@ export function createEngine({
     const card = id => ({
       ...heardOf(id),
       pairedAt: trustedPeer(cfg.trusted, id)?.at ?? null,
+      // And whether a switch said that yes rather than a person, which is
+      // what the dialog needs to say which logins will not arrive from it.
+      ...(trustedPeer(cfg.trusted, id)?.auto ? { autoPaired: true } : {}),
     });
     for (const p of [...beacon.peers.values(), ...dials.rows()]) {
       if (!stillListed(p, now())) continue;
@@ -976,7 +1124,16 @@ export function createEngine({
       // From here the socket is accepting, so this is the moment the silence
       // starts being about the network rather than about a deck still starting.
       inbound.listening();
-      if (port !== cfg.port) onPort?.(port);
+      // AND THE NEXT RESTART PREFERS IT (#1740). The port is the engine's own
+      // field, as the key is: prefs hands it over once per boot (see
+      // lanApplyFields), so without this every later restart in the process
+      // preferred the boot's value — 0 on a first run, which is a fresh random
+      // port for each rename or off-and-on, and the old busy port after one
+      // that moved — and addresses saved on other decks stopped answering.
+      if (port !== cfg.port) {
+        cfg = { ...cfg, port };
+        onPort?.(port);
+      }
       const startingBeacon = createBeacon({
         port, name: cfg.name, fp: identity.fp,
         trusted: () => cfg.trusted,
@@ -1128,7 +1285,19 @@ export function createEngine({
         onChange?.();
         return { fp, name: seen.name, addr: seen.addr, port: seen.port, dialled: true };
       }
-      const { list, added } = pin({ fp, pub: seen.pub, name: seen.name });
+      // THE SWITCH HAS A BUDGET OF ITS OWN (#1737) — see MAX_AUTO_PINS.
+      //
+      // REFUSED RATHER THAN MAKING ROOM, which is the opposite of the dial
+      // list's choice and for a reason. Evicting a dial row the deck added
+      // undoes nothing anybody chose; evicting a pin is an unpair nobody asked
+      // for, of a deck that may be one of the owner's own machines — and which
+      // pins ever finished a round is known only in memory, so after a restart
+      // there is no telling. Past the cap the switch simply stops pressing,
+      // and the request waits in the panel for a person, as it would with the
+      // switch off.
+      const bySwitch = cfg.trusted.filter(t => t?.auto === true).length;
+      if (!byHand && !trustedPeer(cfg.trusted, fp) && bySwitch >= MAX_AUTO_PINS) return null;
+      const { list, added } = pin({ fp, pub: seen.pub, name: seen.name }, { auto: !byHand });
       requests.drop(fp);
       onTrust?.(list);
       onChange?.();
@@ -1140,9 +1309,16 @@ export function createEngine({
       // port it listens on for exactly this. AND KEPT, through onDial, as an
       // invite's is (#1643): `addPeer` alone lives in memory, and the next
       // settings write or restart made the pairing one-way again.
-      const back = seen.addr && seen.port && this.addPeer(seen.addr, seen.port)
+      //
+      // ONLY A PERSON'S ACCEPT IS KEPT, OR COUNTED AS TYPED (#1737). The row
+      // the switch leaves is one the deck added itself, the way a beacon's is:
+      // capped by MAX_AUTO_PEERS, in memory only, and never written into prefs
+      // as an address somebody named — the port in a hello is whatever the
+      // caller claimed. After a restart such a deck is reached as any paired
+      // deck is: by its beacon, or by calling in (see learnCaller).
+      const back = seen.addr && seen.port && this.addPeer(seen.addr, seen.port, { typed: byHand })
         ? (dials.meet(`${seen.addr}:${seen.port}`, { fp, name: seen.name || "" }),
-           onDial?.(`${seen.addr}:${seen.port}`),
+           byHand && onDial?.(`${seen.addr}:${seen.port}`),
            { addr: seen.addr, port: seen.port })
         : null;
       return added ? { fp, name: seen.name, addr: seen.addr, port: seen.port ?? null, dialBack: back } : null;
@@ -1157,6 +1333,7 @@ export function createEngine({
       const list = dropTrusted(cfg.trusted, fp);
       if (list.length === cfg.trusted.length) return false;
       cfg = { ...cfg, trusted: list };
+      lastGood.delete(fp);
       markUnpaired(fp, true);
       onTrust?.(list);
       onChange?.();
@@ -1207,7 +1384,7 @@ export function createEngine({
      */
     async roundOne(fp) {
       if (!beacon || typeof fp !== "string" || !fp) return null;
-      const heard = [...beacon.peers.values()].find(p => p.fp === fp && stillListed(p, now()));
+      const heard = [...beacon.peers.values()].find(p => p.fp === fp && dialsHeard(p));
       const typed = dials.rowAnswering(fp);
       const peer = heard ?? typed;
       if (!peer) return null;

package/src/server/lan-requests.mjs

@@ -5,7 +5,44 @@
 // key, or putting an address on the dial list — stays the engine's accept;
 // this decides who is on which list and when that accept is pressed.
 
-import { pairable } from "./lan-sync.mjs";
+import { pairable, PRESENT_MS } from "./lan-sync.mjs";
+
+/**
+ * The most decks the heard list keeps at once (#1738).
+ *
+ * A beacon is one UDP packet, its source address can be anything, and every
+ * new fingerprint used to be a row kept for as long as the process lived: 52 MB
+ * of heap for 200,000 forged ones, and every panel poll sorting all of them.
+ * The panel draws eight (see pairable) and collapses one machine's keys into
+ * one row, so a few hundred is room for an office of decks each restarted a
+ * few times inside the presence window, and small enough that the sort every
+ * poll does is nothing. The deck heard longest ago goes first; a real one is
+ * heard again within thirty seconds and comes straight back.
+ */
+export const MAX_STRANGERS = 256;
+
+/**
+ * The most requests kept at once (#1738).
+ *
+ * Each is a row in the panel with an accept on it, and all of them are drawn:
+ * one host handshaking with fresh keys put two hundred there in a second. The
+ * same thirty-two the accept switch may pin (MAX_AUTO_PINS in lan-engine.mjs),
+ * which is well past one person's own machines and still a list somebody can
+ * read. The request asked longest ago goes first — a deck that is really
+ * waiting asks again every round, so it is never the one that has.
+ */
+export const MAX_PENDING = 32;
+
+/**
+ * How long a request stands after its deck last asked (#1738).
+ *
+ * A deck waiting on an answer dials again every round — every few seconds while
+ * it waits (ASKING_MS), once a minute at the slowest (SYNC_MS) — and each dial
+ * that finds no pin here asks again. Ten minutes is ten of its slowest rounds
+ * without a word, which is a deck that stopped asking; if it starts again it
+ * is a request again on its next dial.
+ */
+export const REQUEST_MS = 10 * 60_000;
 
 /**
  * The two permissions that answer for one route.
@@ -62,6 +99,26 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
    */
   const declined = new Map();
 
+  /**
+   * Take off both lists what has stopped being true (#1738): a heard deck quiet
+   * for longer than presence lasts — the window strangerRows already drew by,
+   * so this forgets only what nobody could see — and a request whose deck has
+   * not asked for REQUEST_MS. Run before each list is written or read, so what
+   * is kept and what is shown agree.
+   *
+   * The heard list is kept in the order decks were last heard (heardStranger
+   * moves a deck to the end each time), so its quiet ones are at the front and
+   * this stops at the first that is not. The requests are few enough to walk.
+   */
+  const forget = () => {
+    const t = now();
+    for (const [fp, p] of strangers) {
+      if (t - (p.at ?? 0) <= PRESENT_MS) break;
+      strangers.delete(fp);
+    }
+    for (const [fp, p] of pending) if (t - (p.lastAt ?? p.at ?? 0) > REQUEST_MS) pending.delete(fp);
+  };
+
   /**
    * A real deck nobody here has accepted: draw it as a row with an accept on it.
    *
@@ -85,7 +142,17 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
   const askToAccept = entry => {
     const cfg = settings();
     if (cfg.pairingMode === "invite" || declined.has(entry.fp)) return;
+    forget();
     const had = pending.get(entry.fp);
+    // A NEW ONE PAST THE CAP MAKES ROOM (#1738) — see MAX_PENDING. The one
+    // asked longest ago goes, not the newcomer: refusing new ones would let
+    // whoever filled the list first keep it, and a real deck asking later
+    // would never be drawn.
+    if (!had && pending.size >= MAX_PENDING) {
+      let oldest = null;
+      for (const [fp, p] of pending) if (!oldest || p.lastAt < oldest[1].lastAt) oldest = [fp, p];
+      if (oldest) pending.delete(oldest[0]);
+    }
     // WHICH SWITCH ANSWERS depends on where the deck is. A request from the
     // tailnet is answered by the Tailscale pair, and only for a machine on this
     // person's own Tailscale account; anything else on the tailnet waits for a
@@ -94,9 +161,11 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
     const via = route ? "tailscale" : "lan";
     const own = !!route?.own;
     pending.set(entry.fp, { ...entry, via, own, at: had?.at ?? now(), lastAt: now() });
+    // An accept the switch pressed that did not pin — the switch's own budget
+    // is spent, see MAX_AUTO_PINS in lan-engine.mjs — leaves the request as it
+    // would be with the switch off: a row, drawn, for somebody to answer.
     if (!wasUnpaired(entry.fp) && saysYesOn(cfg, via) && (via === "lan" || own)) {
-      engineNow()?.accept(entry.fp, { byHand: false });
-      return;
+      if (engineNow()?.accept(entry.fp, { byHand: false })) return;
     }
     if (!had) onChange?.();
   };
@@ -105,6 +174,7 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
    *  can accept, and — when the ask switch for its route is on — asked. */
   const heardStranger = entry => {
     const cfg = settings();
+    forget();
     const had = strangers.get(entry.fp);
     // KEYED BY MACHINE WHEN IT SAYS WHICH ONE IT IS. A computer that took
     // a fresh key — a second deck sharing one config directory does, by
@@ -112,7 +182,16 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
     // one of them drew a row offering to pair with the same machine.
     if (entry.host) for (const [fp, p] of strangers) if (p.host === entry.host && fp !== entry.fp) strangers.delete(fp);
     const own = entry.via === "tailscale" && !!routeTo(entry.addr)?.own;
+    // To the END, so the list stays in the order decks were last heard — which
+    // is what lets `forget` stop at the first one still present, and what
+    // makes the first one here the one to drop when the list is full.
+    strangers.delete(entry.fp);
     strangers.set(entry.fp, { ...entry, own });
+    // AND NEVER PAST ITS SIZE (#1738) — see MAX_STRANGERS.
+    for (const fp of strangers.keys()) {
+      if (strangers.size <= MAX_STRANGERS) break;
+      strangers.delete(fp);
+    }
     // ASK IT, which is what the `ask` verb on its row does and nothing
     // more: the address goes on the dial list and the next round sends a
     // request that somebody over there still has to answer. A beacon
@@ -171,6 +250,7 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
 
   /** The heard decks status() offers to pair with — see its `strangers`. */
   const strangerRows = () => {
+    forget();
     // A deck that was told no is not somebody to offer pairing with. It
     // has its own row, with the one control that undoes the decision.
     const heard = [...strangers.values()].filter(p => !declined.has(p.fp));
@@ -193,7 +273,7 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
     isDeclined: fp => declined.has(fp),
     /** The row a deck is waiting on: its request when it asked, its beacon
      *  when it was only heard, or null. */
-    seen: fp => (pending.get(fp) ?? null) ?? (strangers.get(fp) ?? null),
+    seen: fp => { forget(); return (pending.get(fp) ?? null) ?? (strangers.get(fp) ?? null); },
     /** It was answered: off both lists. */
     drop(fp) {
       pending.delete(fp);
@@ -242,7 +322,10 @@ export function createRequests({ now, settings, routeTo, wasUnpaired, engineNow,
       return had;
     },
     /** The rows status() draws for each list. */
-    pendingRows: () => [...pending.values()].map(p => ({ fp: p.fp, name: p.name, addr: p.addr, at: p.at, via: p.via ?? "lan", own: !!p.own })),
+    pendingRows: () => {
+      forget();
+      return [...pending.values()].map(p => ({ fp: p.fp, name: p.name, addr: p.addr, at: p.at, via: p.via ?? "lan", own: !!p.own }));
+    },
     strangerRows,
     declinedRows: () => [...declined.values()].map(p => ({ fp: p.fp, name: p.name, addr: p.addr, at: p.at })),
   };

package/src/server/lan-round-record.mjs

@@ -15,6 +15,11 @@ export function createRoundRecord({ now }) {
    *  pressed it wants to know it happened, and a reader who did not wants to
    *  know the list is not a photograph of an hour ago. */
   let roundAt = null;
+  /** The rows the last whole round asked, and the rows asked since it — the
+   *  only ones whose line still says anything about who is deciding. See
+   *  waitingOnSomebody. */
+  let asked = new Set();
+  let asking = new Set();
 
   /**
    * Is anybody on the other end still deciding?
@@ -22,9 +27,17 @@ export function createRoundRecord({ now }) {
    * The exact sentence lan-call.mjs gives for "a real deck, not yet
    * accepted", which is the one state where dialling again in a few seconds
    * does something a minute later would not.
+   *
+   * AND ONLY OF A ROW A ROUND STILL ASKS (#1742). A line stays here after its
+   * row is gone — removed in the panel, dropped by a settings write, evicted
+   * by the cap, or no longer dialled at all — and nothing asks that row again
+   * to overwrite it, so one that said "waiting" kept every round eight seconds
+   * apart until the deck restarted. What the last whole round asked is the
+   * list the next one dials, give or take the row somebody just changed; a
+   * row taken off costs one more quick round, never the rest of the process.
    */
   const waitingOnSomebody = () =>
-    [...lastRound.values()].some(r => r?.error === "waiting for the other deck to accept this one");
+    [...asked, ...asking].some(fp => lastRound.get(fp)?.error === "waiting for the other deck to accept this one");
 
   return {
     /** What the last ask of a row did, or undefined. Keyed by the ROW the
@@ -34,11 +47,15 @@ export function createRoundRecord({ now }) {
     /** An ask of that row finished, well or not, and this is what it did. The
      *  record is kept as it is handed over, so the same object before and
      *  after a wait means nothing asked that row in between — see roundOne. */
-    keep(fp, record) { lastRound.set(fp, record); },
+    keep(fp, record) { lastRound.set(fp, record); asking.add(fp); },
     /** Nothing of that row is drawn any more: a dial-back taken away. */
     drop(fp) { lastRound.delete(fp); },
-    /** A whole round finished — see roundAt. */
-    finished() { roundAt = now(); },
+    /** A whole round finished — see roundAt, and asked. */
+    finished() {
+      roundAt = now();
+      asked = asking;
+      asking = new Set();
+    },
     checkedAt: () => roundAt,
     waitingOnSomebody,
   };