Function replay_pass 

pub(crate) async fn replay_pass(
    state: &AppState,
) -> Vec<(String, ReplayOutcome)>

One pass: drop expired rows, then deliver to every target that is now registered, oldest first, at most REPLAY_PER_PASS. A target that is still absent costs a map lookup — no rate-limit token, no audit entry.