git:20261003.9210e27 to git:20261003.066c7a0

7 added, 5 removed. Audit A to A.

# Contents

- `convex/` is the xcb relay deployment: a thin instantiation of

`@hraness/relay` with namespace `xcb.relay.v1`, the xcb command union,

`daemon`/`controller` device classes, closed sign-up with a one-shot

bootstrap capability, and env-selected OTP email delivery.

# Guidelines

- The contract lives in `hraness/relay`; this directory only instantiates

it. Backend behavior changes belong upstream.

- Closed sign-up is deliberate: first admission goes through the

`XCB_RELAY_BOOTSTRAP` capability, later owners join by issued invite.

- Local development targets only the anonymous deployment selected by

`scripts/convex-local.ts`. Never commit deploy credentials or point the

directory at a production deployment from a dev shell.

- The command union (`xcb.relay.v1` kinds) is frozen in

`docs/plans/remote-access.md`; changing it is a contract change.

## Host availability

- - `hostStatus.ts` is separate, opt-in product telemetry. Its two bounded

- public aliases, HTTP routes and `xcbHostStatus` table do not change

+ - `hostStatus.ts` is separate, opt-in product telemetry. Its bounded

+ configured fleet, HTTP routes and `xcbHostStatus` tables do not change

relay authentication, commands, device presence or encrypted projections.

- - Store only each alias's latest accepted receipt. Keep reads and writes

- bounded to the two fixed ids, enforce the one-minute minimum write interval,

- and never publish credentials, credential hashes, hostnames or task data.

+ - Store only each machine's latest accepted receipt. Keep reads and writes

+ bounded to the configured ids (at most 100 slug ids), share one activity

+ point budget across the fleet, enforce the one-minute minimum write

+ interval, and never publish credentials, credential hashes, hostnames or

+ task data. Machine ids and labels are operator-chosen public text.

- Credential rotation changes an existing row's sequence generation. Public

reads show `never` until the new credential supplies its first observation.