docs: a revoked token's tunnels end within 40 seconds

README.md

@@ -31,8 +31,9 @@ relay does not know is refused when it starts.
   start. There is no shell, no exec route, and no remote update.
 - It does not inspect or rewrite upstream responses. Give each upstream a
   read-only token.
-- Revoking the relay token in Perfloop Setup ends its tunnels within thirty
-  seconds, enforced by the Perfloop API.
+- Revoking the relay token in Perfloop Setup ends its tunnels within 40
+  seconds, enforced by the Perfloop API. Stopping the relay ends its tunnels
+  at once.
 
 The full model, with the code that enforces each point:
 [docs/security.md](docs/security.md).

SECURITY.md

@@ -8,5 +8,4 @@ public issue for a vulnerability.
 
 Supported: the `main` branch and the latest published image (`docs/image.md`).
 A fix lands on `main` and is published as a new image; you choose when to roll
-it, as with every relay change. This document makes no commitment beyond the
-address: no response time, embargo, or reward program is published here.
+it, as with every relay change.

docs/security.md

@@ -146,10 +146,11 @@ never a short body that looks complete.
   you own; Perfloop's own validation of each read happens before the read
   reaches the relay, and the relay does not repeat or replace it.
 - When the relay token is revoked in Perfloop Setup, the Perfloop API ends
-  its open tunnels within thirty seconds (the API checks each tunnel's key on
-  that schedule; the relay takes no part in it), and every reconnect after
-  that is refused with `401 Unauthorized`, which the relay logs as
+  its open tunnels within 40 seconds (the API checks each tunnel's key on a
+  schedule; the relay takes no part in it), and every reconnect after that
+  is refused with `401 Unauthorized`, which the relay logs as
   `perfloop refused tunnel`.
+  Stopping the relay ends its tunnels at once.
 
 ## The relay token
 
@@ -159,6 +160,6 @@ The plaintext is shown once; Perfloop stores only its hash. The token lets a
 relay answer that tenant's validated reads and nothing else: the Perfloop API
 refuses it as a bearer everywhere but the tunnel route, so a token held in
 your network reads no Perfloop data. More than one relay may run with the
-same token; the API uses any live tunnel of the tenant and holds at most eight
-tunnels per tenant on each replica, refusing a further one with status 429
-until one ends.
+same token; the API uses any live tunnel of the tenant and accepts a limited
+number of tunnels per tenant, refusing another with status 429 until one
+ends.

docs/setup.md

@@ -168,7 +168,7 @@ and Perfloop.
 | `-print-routes` exits non-zero | The file is invalid. | The last line names the field and the rule. |
 | No `tunnel open`; `tunnel ended` with a dial or TLS error | The relay cannot reach `app.perfloop.ai:443`. | Egress from the namespace, the NetworkPolicy, DNS, an egress proxy (`HTTPS_PROXY` must carry WebSockets), `api_ca` if TLS is re-signed. |
 | `perfloop refused tunnel: 401 Unauthorized` | The token is wrong or revoked. | Create a new token in Setup and replace the Secret's `token` key; the Deployment restarts on its own only if you roll it. |
-| `perfloop refused tunnel: 429` | This tenant already has the maximum tunnels on that API replica. | Another relay of yours is connected; stop the extra one or wait for it to end. |
+| `perfloop refused tunnel: 429` | This tenant already has the maximum number of open tunnels. | Another relay of yours is connected; stop the extra one or wait for it to end. |
 | Setup connection fails; relay log shows `"decision":"upstream-error"` | The relay reached the tunnel but not the upstream. | `url`, the upstream's TLS (`ca`), and network reachability from the namespace to the upstream. |
 | Setup connection fails; relay log shows `"status":404,"decision":"unknown-upstream"` | The endpoint name in Setup does not match `upstreams[].name`. | Use exactly `relay://<upstream-name>`. |
 | Setup connection fails; relay log shows no line at all | The read never reached this relay. | Confirm the tunnels are open; the tenant in Setup is the tenant the token belongs to. |
@@ -178,5 +178,6 @@ and Perfloop.
 
 Create the new token in Setup, update the Secret's `token` key, roll the
 Deployment, confirm two `tunnel open` lines, then revoke the old token in
-Setup. Tunnels on the old token end within thirty seconds of revocation, so
-do it in that order to avoid a gap.
+Setup. Tunnels on the old token end within 40 seconds of revocation, so do
+it in that order to avoid a gap. To end them at once, stop the relays that
+still use the old token.