Hosted Relay sockets: one Durable Object per account

[nedtwigg]

Third of the Hosted persistent stack, on #868. It adds the Hosted Relay's sockets: /ws/burrow and /ws/client on relay.dormouse.sh, routed through one RelayRoom Durable Object per account.

Why per account, not per Burrow (decided 2026-09-30): Pocket keeps one relay socket for every Burrow it talks to and binds with init. An account-keyed object keeps that wire and Pocket unchanged. It also means an object only ever holds one account's sockets, so a cross-tenant binding can't happen.

The object:

• Routing: reproduces the self-host RelayHub exactly: bind on init, client-gone, burrow-gone, and close codes 4000, 4001, 1008, 1009, 1013. The frame layer (guards, error strings, field-by-field envelopes) is now one shared module, remote-lib-common/src/remote/relay-routing.ts. One parity suite runs against both Relays.
• Hibernation: WebSocket hibernation, with routing rebuilt from each socket's attachment and tags. Durable storage holds only the account id, which the object checks on every socket it accepts.
• Frames: bounded in UTF-8 bytes before parsing. The object never reads ct; scripts/e2e-lint.mjs holds that textually, with self-test mutations.
• Upgrades:
  • The Worker authenticates each upgrade and hands the object a fresh request carrying only the verified fields.
  • A Client upgrade requires the exact Origin; a Burrow upgrade refuses any Origin.
  • The object re-reads the Burrow's row before accepting, which closes the race with Remove.
• Revocation: Remove at hosted.dormouse.sh closes the live socket through an RPC with no public route. A backstop alarm rechecks every held Burrow's row and its owner's entitlement hourly.
• Liveness without waking the object: both ends send RELAY_PING every 30 s to the object's auto-response. Each end enforces its pong deadline only once a first pong has arrived, so an older self-host Relay costs nothing. The self-host Relay now answers the ping too.

Not verified against Cloudflare: the object reads Postgres through a RelayRows entrypoint via ctx.exports. In Miniflare, an object that opens a Hyperdrive connection itself can never hibernate again. The ctx.exports path works in Miniflare and wrangler deploy --dry-run, but hasn't been tried in production.

Test plan

• Root pnpm test green. The Hosted Docker suite passed 128/129 just before a one-line rebase fix in a Docker-free test, and its runs before the rebase were green. It covers parity cases, hibernation eviction mid-routing, the alarm and sweep, tenant isolation, revocation, and a never-waking ping.
• Manual (with the client PR): pair a phone against a preview and connect; hide the phone for a minute and return; remove the computer at the account page and see the phone lose it.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	f07045c
Status:	✅  Deploy successful!
Preview URL:	https://462e1895.mouseterm.pages.dev
Branch Preview URL:	https://remote-network-hosted-do.mouseterm.pages.dev

View logs

[dormouse-bot]

This is early feedback on a draft, not a merge verdict. Mark the PR ready when you want the full review.

There's one inline point: the object holds blockConcurrencyWhile while it waits on the row read through RelayRows, so a stalled database read could reset the whole account's object rather than fail only the one upgrade.

[dormouse-bot]

I found nothing to change in the diff. The row read the draft review raised now gives up at RELAY_ROW_READ_TIMEOUT_MS and answers 503, and the stalled-read test covers that.

I'm leaving this as a comment rather than an approval because the Argos checks are red (argos/storybook-chromium, argos/storybook-webkit: 33 changed, waiting for a decision). The same 33-screenshot diff is on #867 and #868, and this PR touches no UI, so the diff most likely comes from the base of the stack. Accepting or rejecting it in Argos is up to a maintainer.

[nedtwigg]

@dormouse-bot The maintainer has explicitly instructed us to IGNORE ARGOS for this stack and will handle the visual decisions separately. All other CI must pass, and we need your approval before merging. Please review current head f07045c and approve if no findings remain; please do not merge, since I am handling the stack bottom to top.

The account object's row read remains bounded by RELAY_ROW_READ_TIMEOUT_MS, with the stalled-read regression test. Your previous full review found no remaining code issue and withheld approval only for Argos; that gate is explicitly waived by the maintainer.