git:20260930.c503a11 to git:20261003.9210e27

2 added, 2 removed. Audit A to A.

# Contents

- `convex/` is the xcb relay deployment: a thin instantiation of

`@hraness/relay` with namespace `xcb.relay.v1`, the xcb command union,

`daemon`/`controller` device classes, closed sign-up with a one-shot

bootstrap capability, and env-selected OTP email delivery.

# Guidelines

- The contract lives in `hraness/relay`; this directory only instantiates

it. Backend behavior changes belong upstream.

- Closed sign-up is deliberate: first admission goes through the

`XCB_RELAY_BOOTSTRAP` capability, later owners join by issued invite.

- Local development targets only the anonymous deployment selected by

`scripts/convex-local.ts`. Never commit deploy credentials or point the

directory at a production deployment from a dev shell.

- The command union (`xcb.relay.v1` kinds) is frozen in

`docs/plans/remote-access.md`; changing it is a contract change.

## Host availability

- - `hostStatus.ts` is separate, opt-in product telemetry. Its two fixed

- anonymous aliases, HTTP routes and `xcbHostStatus` table do not change

+ - `hostStatus.ts` is separate, opt-in product telemetry. Its two bounded

+ public aliases, HTTP routes and `xcbHostStatus` table do not change

relay authentication, commands, device presence or encrypted projections.

- Store only each alias's latest accepted receipt. Keep reads and writes

bounded to the two fixed ids, enforce the one-minute minimum write interval,

and never publish credentials, credential hashes, hostnames or task data.

- Credential rotation changes an existing row's sequence generation. Public

reads show `never` until the new credential supplies its first observation.