git:20260925.317d2f7 to git:20260930.c503a11

11 added, 0 removed. Audit A to A.

# Contents

- `convex/` is the xcb relay deployment: a thin instantiation of

`@hraness/relay` with namespace `xcb.relay.v1`, the xcb command union,

`daemon`/`controller` device classes, closed sign-up with a one-shot

bootstrap capability, and env-selected OTP email delivery.

# Guidelines

- The contract lives in `hraness/relay`; this directory only instantiates

it. Backend behavior changes belong upstream.

- Closed sign-up is deliberate: first admission goes through the

`XCB_RELAY_BOOTSTRAP` capability, later owners join by issued invite.

- Local development targets only the anonymous deployment selected by

`scripts/convex-local.ts`. Never commit deploy credentials or point the

directory at a production deployment from a dev shell.

- The command union (`xcb.relay.v1` kinds) is frozen in

`docs/plans/remote-access.md`; changing it is a contract change.

+ ## Host availability

+ - `hostStatus.ts` is separate, opt-in product telemetry. Its two fixed

+ anonymous aliases, HTTP routes and `xcbHostStatus` table do not change

+ relay authentication, commands, device presence or encrypted projections.

+ - Store only each alias's latest accepted receipt. Keep reads and writes

+ bounded to the two fixed ids, enforce the one-minute minimum write interval,

+ and never publish credentials, credential hashes, hostnames or task data.

+ - Credential rotation changes an existing row's sequence generation. Public

+ reads show `never` until the new credential supplies its first observation.