feat(directory): add a per-project Lobby cell beside the directory (#335)

* feat(directory): add a per-project Lobby cell beside the directory

The directory's Worker gains a Lobby Durable Object, one per project ID, at
GET /lobbies/<project> behind the same ACE_SECRET. Hosts hold one socket per
project: they replace their owner's presence, which lives only in hibernation
attachments, and send channel lifecycle events, which the lobby numbers with
one seq per project and keeps as a 30-day, 2,000-event resume buffer. A host
resuming from a pruned or unknown seq is told to read listings again. Pings
are auto-answered and an alarm evicts sockets silent for 90 s. The Directory
object and its contract are unchanged. Refs #17, #14.

Why: services/directory/src/lobby.ts#const MIGRATIONS | Durable Object SQLite refuses PRAGMA user_version, so the schema version lives in the kv `version` key; never edit a shipped migration
Why: services/directory/src/lobby.ts#method webSocketMessage | seq lives in kv apart from the rows so pruning every event never reuses a seq a host resumes from
Why: services/directory/src/lobby.ts#type Attachment | presence must never reach SQLite; it lives only in socket attachments

* lane: sync lobby-cell memory

* fix(directory): keep lobby sweeps, clocks, and attachments within bounds

Re-arm the 60 s sweep when a host joins a lobby whose alarm waits on the
oldest event, prune by the lobby's own receipt time, fit presence into the
2 KiB hibernation attachment, replace sockets only within one host
process, and answer a malformed project ID with 400.

Why: services/directory/src/lobby.ts#method fetch | a joining host must re-arm the sweep when the alarm is further than SWEEP away, or silent sockets stay here until the oldest event expires
Why: services/directory/src/lobby.ts#function fit | serializeAttachment throws above 2 KiB, so presence must be trimmed to fit before every serialize
Why: services/directory/src/lobby.ts#method webSocketMessage | the events.at column is the lobby's receipt time, never the host's clock, since retention and resync depend on it

* lane: sync lobby-cell memory

* lane: sync lobby-cell memory

* fix(directory): sweep lobbies every 5 minutes to bound alarm writes

Each sweep re-arms the alarm, which Durable Objects bill as one row write, so
a 60 s sweep cost 1,440 writes a day per project with a host connected. Every
5 minutes costs 288. Silent sockets still close after 90 s without a ping, now
within about 6.5 minutes.

Why: services/directory/src/lobby.ts#const SWEEP | the alarm re-arm is the lobby's only steady storage write; pings and presence must never write, and the sweep must not run more often than the write budget allows

* lane: sync lobby-cell memory

Author: iamnbutler

.lane/attic/services/directory/src/lobby.ts/01M4YSA7BQDTQ2QGZ23V3TEQDW-seq-lives-in-kv-apart-from-t.md

@@ -0,0 +1,8 @@
+---
+id: 01M4YSA7BQDTQ2QGZ23V3TEQDW
+anchor: 'method #latest'
+created: 2026-10-15T03:22:24Z
+norm: '1'
+---
+
+seq lives in kv apart from the rows so pruning every event never reuses a seq a host resumes from

.lane/attic/services/directory/src/lobby.ts/01M4YSABZQZVRXYFE3TQP1H1K8-seq-lives-in-the-kv-seq-key.md

@@ -0,0 +1,8 @@
+---
+id: 01M4YSABZQZVRXYFE3TQP1H1K8
+anchor: method webSocketMessage
+created: 2026-10-15T03:22:29Z
+norm: '1'
+---
+
+seq lives in the kv 'seq' key apart from the event rows, so pruning every event never reuses a seq a host resumes from

.lane/attic/services/directory/src/lobby.ts/01M4YSWBMHMXS6T8GZWWX71686-seq-lives-in-kv-apart-from-t.md

@@ -0,0 +1,8 @@
+---
+id: 01M4YSWBMHMXS6T8GZWWX71686
+anchor: 'method #latest'
+created: 2026-10-15T03:32:19Z
+norm: '1'
+---
+
+seq lives in kv apart from the rows so pruning every event never reuses a seq a host resumes from

.lane/memory/services/directory/src/lobby.ts/01M4YSA7B2JKQ12MX3B6DA66G1-durable-object-sqlite-refuse.md

@@ -0,0 +1,12 @@
+---
+id: 01M4YSA7B2JKQ12MX3B6DA66G1
+anchor: const MIGRATIONS
+created: 2026-10-15T03:22:24Z
+norm: '1'
+sig: 106ab0bf742bac08
+body_hash: 22e53bc349d0c6f1
+raw_hash: 7a63f5f5162b5252
+lines: 18-25
+---
+
+Durable Object SQLite refuses PRAGMA user_version, so the schema version lives in the kv `version` key; never edit a shipped migration

.lane/memory/services/directory/src/lobby.ts/01M4YSA7C9D4AD1GN5TQP2JYZ7-presence-must-never-reach-sq.md

@@ -0,0 +1,13 @@
+---
+id: 01M4YSA7C9D4AD1GN5TQP2JYZ7
+anchor: type Attachment
+created: 2026-10-15T03:22:25Z
+norm: '1'
+sig: 1b055bbb637ab6c2
+body_hash: e3b0c44298fc1c14
+raw_hash: 0a365dc77261089b
+vouched: 2026-10-15T04:07:57Z
+lines: 28-28
+---
+
+presence must never reach SQLite; it lives only in socket attachments

.lane/memory/services/directory/src/lobby.ts/01M4YSWEM54B8WRTBBHRP331GE-seq-lives-in-kv-apart-from-t.md

@@ -0,0 +1,13 @@
+---
+id: 01M4YSWEM54B8WRTBBHRP331GE
+anchor: method webSocketMessage
+created: 2026-10-15T03:32:22Z
+norm: '1'
+sig: ba8d2f921d2933e4
+body_hash: ed970d004b996e65
+raw_hash: e8f7fe94b6c60eb8
+vouched: 2026-10-15T04:07:57Z
+lines: 63-98
+---
+
+seq lives in kv apart from the rows so pruning every event never reuses a seq a host resumes from

.lane/memory/services/directory/src/lobby.ts/01M4YVXHY7HPE7NG8FJ3HY2291-a-joining-host-must-re-arm-t.md

@@ -0,0 +1,12 @@
+---
+id: 01M4YVXHY7HPE7NG8FJ3HY2291
+anchor: method fetch
+created: 2026-10-15T04:07:55Z
+norm: '1'
+sig: 34a9c2419f926c50
+body_hash: 640988774703d52e
+raw_hash: c970c77cfaff901e
+lines: 76-87
+---
+
+a joining host must re-arm the sweep when the alarm is further than SWEEP away, or silent sockets stay here until the oldest event expires

.lane/memory/services/directory/src/lobby.ts/01M4YVXHYES1JA1G03YKYBV47S-serializeattachment-throws-a.md

@@ -0,0 +1,12 @@
+---
+id: 01M4YVXHYES1JA1G03YKYBV47S
+anchor: function fit
+created: 2026-10-15T04:07:55Z
+norm: '1'
+sig: 1e227ead5527c329
+body_hash: c9ad6fbf34e09ff9
+raw_hash: e3e43b6c5e9c565b
+lines: 43-52
+---
+
+serializeAttachment throws above 2 KiB, so presence must be trimmed to fit before every serialize

.lane/memory/services/directory/src/lobby.ts/01M4YVXHYN15MPDM4TPR658TT7-the-events-at-column-is-the.md

@@ -0,0 +1,12 @@
+---
+id: 01M4YVXHYN15MPDM4TPR658TT7
+anchor: method webSocketMessage
+created: 2026-10-15T04:07:55Z
+norm: '1'
+sig: ba8d2f921d2933e4
+body_hash: ed970d004b996e65
+raw_hash: e8f7fe94b6c60eb8
+lines: 89-131
+---
+
+the events.at column is the lobby's receipt time, never the host's clock, since retention and resync depend on it

.lane/memory/services/directory/src/lobby.ts/01M4ZGW2CM5CC9W0QZGSYF3R35-the-alarm-re-arm-is-the-lobb.md

@@ -0,0 +1,12 @@
+---
+id: 01M4ZGW2CM5CC9W0QZGSYF3R35
+anchor: const SWEEP
+created: 2026-10-15T10:14:06Z
+norm: '1'
+sig: b3fc1afe94e7106a
+body_hash: e3b0c44298fc1c14
+raw_hash: 5cffbee4659df889
+lines: 16-16
+---
+
+the alarm re-arm is the lobby's only steady storage write; pings and presence must never write, and the sweep must not run more often than the write budget allows