* fix(relay): stop the retired exit record from double-broadcasting pty.exit
Retiring the publication record at cancel or grace-expiry time routed the pending
exit through pty-handler's unconditional broadcast, so subscribers that already
received the exit from the record's legacy projection got a second copy (which
fans out to a whole-provider teardown on the consumer side).
- Track the legacy exit projection in a RelayPtySourceLegacyExitIndex keyed by
pty incarnation so it outlives the delivery record; the handler's fallback now
re-targets only source-owner clients when subscribers already have the exit.
- Cover the previously untested defense layers: B2 same-client re-attach healing,
B3 deferred retire-on-append-failure (retire plus the microtask deferral), and
publishPendingExit's `accepts(id) &&` sub-guard.
- Harden layer D's capacity fan-out (it sits outside the catch it depends on),
route cancelExact's bare-timer probe through snapshotIfKnown, and keep
appendDenied counting cancel-induced append rejections.
* test(relay): pin the retired-record exit dedup and stop its index leaking
The legacy-exit dedup layer shipped with zero coverage: deleting pty-handler's
`publishExitAfterRetire` wiring left the whole relay suite green, because the
send scheduler's partial-progress branch keeps a projected record alive so B1
handles the common case and the fallback is never reached.
- Cover `RelayPtySourceLegacyExitIndex` directly, pin pty-handler's fallback
(a retired record re-targets its own exit instead of broadcasting a duplicate
to subscribers that already have it, and still broadcasts when nothing was
projected), and drive the reachable retire path: B2's re-attach retires a
record whose projection only the index remembers.
- Forget the index entry when `exitPublicationSettled` prunes a healthy exit.
`remember()` only re-ran from the exit path, which B0 short-circuits after a
settled exit, so every source-mode PTY exit leaked one Map row for the
daemon's lifetime and would re-publish on any later fallback for that id.
* fix(relay): contain retired exit publication faults
* fix(relay): retain projected exits across owner faults
* fix(relay): retire faulted exit deliveries
Neil
886fa7b438