@fitchmultz/pi-subagents 0.47.0 → 0.49.0

package/CHANGELOG.md

@@ -1,13 +1,39 @@
 # Changelog
 
-## [0.47.0] - 2026-10-13
+## Unreleased
+
+## [0.49.0] - 2026-10-14
+
+### Added
+
+- Event-driven remote inbox waits through optional `waitMs` (0–10000 ms) and CLI `inbox --wait-ms`, preserving immediate reads by default, durable cursor paging and explicit acknowledgement.
+- Native fallback wake two seconds after mailbox commit without intake acknowledgement, with durable shared admission of at most 20 attempts per sliding hour across all identities and URLs. Pending cold batches coalesce, retain retry deadlines across crashes and rotations, and recover automatically when allowance returns.
+- Stopped-helper audit preflight for preserving known remaining wake allowance during migration; unverified legacy usage conservatively reserves the first hour.
+
+### Fixed
+
+- Cancelling an inbox read no longer disconnects the certificate-bound native identity or interrupts unrelated requests. Revocation, expiry, broker disconnect and shutdown still cancel outstanding waits.
+
+## [0.48.0] - 2026-10-14
 
 ### Added
 
-- Unattended remote Intercom: private durable mailboxes with bounded cursor drains, persistent authenticated presence, and optional HTTPS fallback wake after two minutes without consumer acknowledgement. Helper crashes, idle leases and broker outages retain unread messages and unanswered asks. Consumer acknowledgement suppresses fallback without discarding reply obligations.
 - Remote live/saved session discovery, workspace-aware spawn with task/model selection, and resume by stable ID or unique name. Reuse discoverable live owners rather than reopening their journal; retain native model selection and history on resume. Owned cancellation preserves accepted queues, while owned stop observes actual process closure.
 - Certificate-authenticated native control and bounded recent transcripts for updated live Pi owners, plus read-only saved transcripts. Foreign cancellation/shutdown receipts describe the requested native stage and mode limitations; they do not claim process exit or terminate detached work.
-- Persistent named peer groups and broadcasts with per-recipient receipts, explicit partial outcomes and no automatic mutation retries. Client provisioning supports distinct bridge ports, configurable certificate lifetimes and same-CA server renewal for independent instances.
+- Persistent named peer groups and broadcasts with per-recipient receipts, explicit partial outcomes and no automatic mutation retries.
+
+### Fixed
+
+- Preserve confirmed, unknown and unattempted broadcast outcomes when the broker stalls or disconnects, without disclosing partial results after identity revocation or certificate expiry.
+- Inspect native resume identity before opening a writable journal so rejected requests cannot publish an incomplete tail. Saved transcripts tolerate interrupted malformed records while retaining structural limits.
+- Reduce archive lookup allocation churn with shared bounded scratch storage, and switch to header-only uniqueness checks after a verified exact native-ID match.
+
+## [0.47.0] - 2026-10-13
+
+### Added
+
+- Unattended remote Intercom: private durable mailboxes with bounded cursor drains, persistent authenticated presence, and optional HTTPS fallback wake after two minutes without consumer acknowledgement. Helper crashes, idle leases and broker outages retain unread messages and unanswered asks. Consumer acknowledgement suppresses fallback without discarding reply obligations.
+- Client provisioning supports distinct bridge ports, configurable certificate lifetimes and same-CA server renewal for independent instances.
 
 ### Fixed
 

package/dist/extension/build-info.js

@@ -1 +1 @@
-export const EXTENSION_BUILD = Object.freeze({"version":"0.47.0","sha256":"f190373e25edf9819e0980435d5aebcb696b5e8d4ce2c841e665192836767f09"});
+export const EXTENSION_BUILD = Object.freeze({"version":"0.49.0","sha256":"6cd61dacb62268abb87c7005b638048a141cd17ad6091e486146bbd5e1d01338"});

package/dist/pi-intercom/bridge-broadcast.js

@@ -0,0 +1,60 @@
+import { randomUUID } from "node:crypto";
+import { Fault, BroadcastFault } from "./bridge-protocol.js";
+export async function broadcastTargets(session, targets, message, context) {
+    const receipts = [];
+    for (const peer of targets.peers) {
+        if (context.signal.aborted) {
+            receipts.push({
+                peer: peer.id,
+                attempted: false,
+                error: {
+                    code: "not_attempted",
+                    message: "Broadcast stopped before sending.",
+                    deliveryUnknown: false,
+                },
+            });
+            continue;
+        }
+        const id = randomUUID();
+        try {
+            // No hidden retries; sequential admission bounds broker pressure.
+            // oxlint-disable-next-line no-await-in-loop
+            const receipt = await session.send(peer.id, message, context, { messageId: id });
+            receipts.push({ peer: peer.id, attempted: true, ...receipt });
+        }
+        catch (error) {
+            const fault = error instanceof Fault
+                ? error
+                : new Fault(503, "send_unconfirmed", "Target delivery could not be confirmed.");
+            receipts.push({
+                peer: peer.id,
+                attempted: true,
+                error: {
+                    code: fault.code,
+                    message: fault.message,
+                    ...fault.details,
+                    id,
+                    deliveryUnknown: fault.details.accepted !== false,
+                },
+            });
+        }
+    }
+    const failed = receipts.filter((receipt) => receipt.accepted !== true).length + targets.errors.length;
+    const outcome = {
+        status: failed === 0 ? "complete" : "partial",
+        receipts,
+        errors: targets.errors,
+    };
+    // Transport closure must not erase outcomes, or disclose them after authorization is revoked.
+    session.authorize();
+    try {
+        session.guard(context.signal);
+    }
+    catch (error) {
+        if (error instanceof Fault) {
+            throw new BroadcastFault(error, outcome);
+        }
+        throw error;
+    }
+    return outcome;
+}

package/dist/pi-intercom/bridge-catalog.js

@@ -0,0 +1,372 @@
+import { nativePeerId } from "./session-targets.js";
+import { closeSync, constants, lstatSync, opendirSync, openSync, readSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { setImmediate as yieldTurn } from "node:timers/promises";
+import { JournalFrames } from "../shared/journal-reader.js";
+import { loadNativeSession } from "../shared/native-session-loader.js";
+import { Fault, cancelled } from "./bridge-protocol.js";
+import { resolveIntercomPresenceName } from "./identity.js";
+import { within } from "./bridge-launch-policy.js";
+/** Reject links at every journal path component; ordinary owned 0644 journals are valid. */
+export function trustedJournal(policy, file) {
+    const root = [policy.sessionDir, ...policy.resumeDirs].find((dir) => within(dir, file));
+    if (root === undefined) {
+        throw new Fault(403, "journal_forbidden", "Session journal is outside trusted resumeDirs.");
+    }
+    let path = root;
+    for (const part of ["", ...relative(root, file).split(sep).filter(Boolean)]) {
+        path = join(path, part);
+        const stat = lstatSync(path);
+        if (stat.isSymbolicLink() ||
+            stat.uid !== process.getuid?.() ||
+            (!stat.isDirectory() && path !== file)) {
+            throw new Fault(403, "journal_forbidden", "Session journal must have an owned, link-free path.");
+        }
+    }
+    if (!lstatSync(file).isFile()) {
+        throw new Fault(403, "journal_forbidden", "Session journal must be an owned regular file.");
+    }
+}
+// Reads and projection input are consumed synchronously; prefix/UTF-8 carry never retains this view.
+const METADATA_BYTES = Buffer.allocUnsafe(1024 * 1024);
+const METADATA_FIELDS = new Set(["type", "id", "version", "timestamp", "cwd", "name", "parentId"]);
+// ponytail: fast-skip native type-first envelopes only; other key ordering
+// uses the bounded parser. Extend the fast path if native serialization changes.
+const BODY_ENTRY = /^\{"type":"(?:message|model_change|thinking_level_change|compaction|branch_summary|custom|custom_message|label|usage|context_edit)",/;
+class MetadataFrames {
+    prefix = Buffer.alloc(0);
+    skip;
+    frames;
+    nativeHeader;
+    constructor(frames, nativeHeader) {
+        this.frames = frames;
+        this.nativeHeader = nativeHeader;
+    }
+    part(bytes, complete) {
+        let remainder = bytes;
+        if (this.skip === undefined) {
+            const count = Math.min(64 - this.prefix.length, bytes.length);
+            this.prefix = Buffer.concat([this.prefix, bytes.subarray(0, count)]);
+            remainder = bytes.subarray(count);
+            if (this.prefix.length < 64 && !complete) {
+                return;
+            }
+            this.skip = this.nativeHeader() && BODY_ENTRY.test(this.prefix.toString("ascii"));
+            if (!this.skip) {
+                this.frames.write(this.prefix);
+            }
+            this.prefix = Buffer.alloc(0);
+        }
+        if (!this.skip) {
+            this.frames.write(remainder);
+        }
+    }
+    write(bytes) {
+        for (let from = 0; from < bytes.length;) {
+            const newline = bytes.indexOf(10, from);
+            const end = newline < 0 ? bytes.length : newline + 1;
+            this.part(bytes.subarray(from, end), newline >= 0);
+            if (newline >= 0) {
+                this.skip = undefined;
+            }
+            from = end;
+        }
+    }
+    finish() {
+        if (this.prefix.length > 0) {
+            this.part(Buffer.alloc(0), true);
+        }
+        this.frames.finish();
+    }
+}
+async function readMetadata(file, sdk, signal, mode) {
+    const headerOnly = mode === "header";
+    const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const metadata = [];
+        let first = true;
+        const frames = new JournalFrames((path) => path.length === 0 || (path.length === 1 && METADATA_FIELDS.has(String(path[0]))), ({ value }) => {
+            if (first &&
+                (value.type !== "session" ||
+                    typeof value.id !== "string" ||
+                    typeof value.cwd !== "string")) {
+                throw new Error("Not a native session journal");
+            }
+            first = false;
+            if (value.type === "session" && metadata.length === 0) {
+                metadata.push(value);
+            }
+            else if (value.type === "session_info") {
+                metadata[1] = value;
+            }
+        }, { policy: "inspect", requireNewline: mode !== "resume" });
+        const bytes = headerOnly ? METADATA_BYTES.subarray(0, 64 * 1024) : METADATA_BYTES;
+        const reader = new MetadataFrames(frames, () => !first);
+        for (;;) {
+            cancelled(signal);
+            // One shared file position/buffer: reads must be serial, and yield to cancellation.
+            // oxlint-disable-next-line no-await-in-loop
+            await yieldTurn(undefined, { signal });
+            const bytesRead = readSync(fd, bytes, 0, bytes.length, null);
+            if (bytesRead === 0) {
+                break;
+            }
+            reader.write(bytes.subarray(0, bytesRead));
+            if (headerOnly && metadata.length > 0) {
+                break;
+            }
+        }
+        reader.finish();
+        const header = metadata.at(0);
+        if (header?.type !== "session" ||
+            typeof header.id !== "string" ||
+            typeof header.cwd !== "string") {
+            throw new Error("Not a native session journal");
+        }
+        // Native naming and ID semantics, without opening/migrating a live journal or hydrating bodies.
+        const entries = sdk.parseSessionEntries(metadata.map((entry) => JSON.stringify(entry)).join("\n"));
+        const manager = sdk.SessionManager.inMemory(header.cwd, undefined, entries);
+        return {
+            sessionId: manager.getSessionId(),
+            peerId: nativePeerId(manager.getSessionId()),
+            name: manager.getSessionName(),
+            cwd: manager.getCwd(),
+            sessionFile: file,
+        };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Native open repairs EOF framing; inspect its identity before allowing that write. */
+export function inspectResumeIdentity(file, sdk, signal) {
+    return readMetadata(file, sdk, signal, "resume");
+}
+export function savedView(row, peer) {
+    return {
+        id: row.sessionId,
+        sessionId: row.sessionId,
+        peerId: peer?.id,
+        name: row.name,
+        cwd: row.cwd,
+        status: peer?.status ?? "saved",
+        lastSeen: peer?.lastSeen ?? row.lastSeen,
+        saved: true,
+        owned: false,
+    };
+}
+export function exactPeer(row, peers) {
+    const expectedName = resolveIntercomPresenceName(row.name, row.sessionId);
+    const peer = peers.find((candidate) => candidate.id === row.peerId);
+    if (peer && (peer.cwd !== row.cwd || peer.name !== expectedName)) {
+        throw new Fault(409, "active_session", "Native session has a live peer with changed identity; do not reopen its journal.");
+    }
+    if (!peer &&
+        peers.some((candidate) => !candidate.id.startsWith("pi-") &&
+            candidate.name === expectedName &&
+            candidate.cwd === row.cwd)) {
+        throw new Fault(409, "active_session", "A matching live peer has unproven native identity; refusing to reopen its possible journal.");
+    }
+    return peer;
+}
+function liveView(peer, state) {
+    return {
+        id: peer.id,
+        peerId: peer.id,
+        name: peer.name,
+        cwd: peer.cwd,
+        status: state ?? peer.status,
+        lastSeen: peer.lastSeen,
+        saved: false,
+        owned: state !== undefined,
+    };
+}
+export async function browseSessions(catalog, query, context) {
+    const peers = query.live ? await context.peers(context.signal) : [];
+    const { policy } = context;
+    if (query.saved && !policy) {
+        throw new Fault(403, "launch_disabled", "Saved sessions require local launch/resume policy.");
+    }
+    const page = policy && query.saved
+        ? await catalog.page(policy, query, context.signal)
+        : { sessions: [], nextOffset: undefined };
+    const rows = page.sessions.map((row) => {
+        const state = context.activeState(row.sessionId);
+        const peer = exactPeer(row, peers);
+        return {
+            ...savedView(row, peer),
+            status: state ?? peer?.status ?? "saved",
+            owned: state !== undefined,
+        };
+    });
+    const included = new Set(page.sessions.map((row) => row.peerId));
+    const live = peers.filter((peer) => !included.has(peer.id) &&
+        (query.q === undefined ||
+            `${peer.id} ${peer.name ?? ""} ${peer.cwd}`.toLowerCase().includes(query.q.toLowerCase())));
+    if (!query.saved) {
+        const end = query.offset + query.limit;
+        return {
+            sessions: live
+                .slice(query.offset, end)
+                .map((peer) => liveView(peer, context.activeState(peer.id))),
+            nextOffset: end < live.length ? end : undefined,
+        };
+    }
+    return {
+        sessions: [
+            ...rows,
+            ...live
+                .slice(0, query.limit - rows.length)
+                .map((peer) => liveView(peer, context.activeState(peer.id))),
+        ],
+        liveTruncated: rows.length + live.length > query.limit ? true : undefined,
+        nextOffset: page.nextOffset,
+    };
+}
+function uniqueSavedSession(matches) {
+    if (matches.length > 1) {
+        throw new Fault(409, "ambiguous_session", "Multiple saved sessions match; choose an exact unique native ID.");
+    }
+    const session = matches.at(0);
+    if (!session) {
+        throw new Fault(404, "unknown_session", "No saved native session matches within trusted resumeDirs.");
+    }
+    return session;
+}
+export class SessionCatalog {
+    cache = new Map();
+    headers = new Map();
+    async *walk(dir, signal) {
+        await yieldTurn(undefined, { signal });
+        const stat = lstatSync(dir);
+        if (!stat.isDirectory() || stat.uid !== process.getuid?.()) {
+            return;
+        }
+        const directory = opendirSync(dir);
+        let visited = 0;
+        try {
+            for (let row = directory.readSync(); row !== null; row = directory.readSync()) {
+                // Yield during offset skips and empty-directory traversal too.
+                if (visited++ % 32 === 0) {
+                    // Directory entries must be processed without retaining a corpus-sized array.
+                    // oxlint-disable-next-line no-await-in-loop
+                    await yieldTurn(undefined, { signal });
+                }
+                cancelled(signal);
+                const file = join(dir, row.name);
+                if (row.isDirectory()) {
+                    yield* this.walk(file, signal);
+                }
+                else if (row.isFile() && row.name.endsWith(".jsonl")) {
+                    yield file;
+                }
+            }
+        }
+        finally {
+            directory.closeSync();
+        }
+    }
+    async *files(policy, signal) {
+        const unique = [...new Set([policy.sessionDir, ...policy.resumeDirs])];
+        const roots = unique.filter((root) => !unique.some((other) => other !== root && within(other, root)));
+        for (const root of roots) {
+            yield* this.walk(root, signal);
+        }
+    }
+    async read(policy, file, signal, headerOnly = false) {
+        cancelled(signal);
+        try {
+            trustedJournal(policy, file);
+            const stat = lstatSync(file);
+            const stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+            const cache = headerOnly ? this.headers : this.cache;
+            const cached = this.cache.get(file) ?? cache.get(file);
+            if (cached?.stamp === stamp) {
+                return cached.session;
+            }
+            const sdk = await loadNativeSession(policy.packageRoot);
+            cancelled(signal);
+            const session = {
+                ...(await readMetadata(file, sdk, signal, headerOnly ? "header" : "published")),
+                lastSeen: stat.mtimeMs,
+            };
+            if (cache.size >= 100000) {
+                cache.clear();
+            }
+            cache.set(file, { stamp, session });
+            return session;
+        }
+        catch (error) {
+            cancelled(signal);
+            if (error instanceof Fault) {
+                throw error;
+            }
+            return undefined;
+        }
+    }
+    async resolve(policy, selector, signal) {
+        if (selector.target !== undefined) {
+            return this.resolveTarget(policy, selector.target, signal);
+        }
+        const matches = [];
+        for await (const file of this.files(policy, signal)) {
+            // Inspect native metadata, not a filename/prefix guess. Yield so request cancellation can run.
+            await yieldTurn(undefined, { signal });
+            const row = await this.read(policy, file, signal, selector.sessionId !== undefined);
+            if (row &&
+                (selector.sessionId === undefined
+                    ? row.name === selector.name
+                    : row.sessionId === selector.sessionId || row.peerId === selector.sessionId)) {
+                matches.push(row);
+            }
+            if (matches.length > 1) {
+                throw new Fault(409, "ambiguous_session", "Multiple saved sessions match; choose an exact unique native ID.");
+            }
+        }
+        const session = uniqueSavedSession(matches);
+        return (await this.read(policy, session.sessionFile, signal)) ?? session;
+    }
+    async resolveTarget(policy, target, signal) {
+        const ids = [];
+        const names = [];
+        for await (const file of this.files(policy, signal)) {
+            // Once an exact native ID is proven, only headers can affect its uniqueness.
+            const row = await this.read(policy, file, signal, ids.length > 0);
+            if (!row) {
+                continue;
+            }
+            if ((row.sessionId === target || row.peerId === target) && ids.length < 2) {
+                ids.push(row);
+            }
+            if (row.name === target && names.length < 2) {
+                names.push(row);
+            }
+        }
+        // Preserve exact-ID priority without paying for two complete archive scans.
+        const session = uniqueSavedSession(ids.length > 0 ? ids : names);
+        return (await this.read(policy, session.sessionFile, signal)) ?? session;
+    }
+    async page(policy, query, signal) {
+        const sessions = [];
+        let offset = 0;
+        let scanned = 0;
+        for await (const file of this.files(policy, signal)) {
+            if (offset++ < query.offset) {
+                continue;
+            }
+            if (scanned++ >= 1000 || sessions.length >= query.limit) {
+                return { sessions, nextOffset: offset - 1 };
+            }
+            // Each bounded metadata read yields to cancellation; no whole-corpus pathname array.
+            const row = await this.read(policy, file, signal);
+            if (row &&
+                (query.q === undefined ||
+                    `${row.sessionId} ${row.name ?? ""} ${row.cwd}`
+                        .toLowerCase()
+                        .includes(query.q.toLowerCase()))) {
+                sessions.push(row);
+            }
+        }
+        return { sessions };
+    }
+}

package/dist/pi-intercom/bridge-config.js

@@ -5,7 +5,7 @@ import { parseEnv } from "node:util";
 import { isUnknownArray } from "../shared/unknown.js";
 import { BODY_LIMIT, object, label, fingerprint } from "./bridge-protocol.js";
 import { launchPolicy } from "./bridge-launch-policy.js";
-import { stateDirectory } from "./bridge-mailbox.js";
+import { stateDirectory } from "./bridge-storage.js";
 import { readBridgeFile } from "./bridge-files.js";
 const MAX_CLIENTS = 64;
 function wakePolicy(value) {
@@ -60,9 +60,21 @@ function identities(value) {
     }
     return clients;
 }
-export function loadConfig(path) {
+function configInput(path) {
     const raw = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBridgeFile(path, true, BODY_LIMIT)));
-    const input = object(raw, ["port", "ca", "cert", "key", "clients", "stateDir"]);
+    return object(raw, ["port", "ca", "cert", "key", "clients", "stateDir"]);
+}
+/** Recipient admission reads private policy and the public CA, never the server key. */
+export function loadControlPolicy(path) {
+    const input = configInput(path);
+    const ca = label(input.ca, "ca path", 4096);
+    if (!isAbsolute(ca)) {
+        throw new Error("CA path must be absolute.");
+    }
+    return { clients: identities(input.clients), ca: readBridgeFile(ca, false, 1024 * 1024) };
+}
+export function loadConfig(path) {
+    const input = configInput(path);
     const port = input.port === undefined ? 9443 : input.port;
     if (typeof port !== "number" || !Number.isInteger(port) || port < 0 || port > 65535) {
         throw new Error("Invalid HTTPS port.");

package/dist/pi-intercom/bridge-control.js

@@ -0,0 +1,104 @@
+import { randomUUID } from "node:crypto";
+import { Fault, wait } from "./bridge-protocol.js";
+import { CONTROL_FALLBACK, CONTROL_SCHEMA, isControlResult, } from "./native-control-protocol.js";
+/** One bounded request owner; exact socket-derived peer, replyTo, version and verb correlation. */
+export class ControlReplies {
+    pending = new Map();
+    open(peer, verb, timeoutMs) {
+        if (this.pending.size >= 8) {
+            throw new Fault(429, "too_many_controls", "At most eight native controls may be in flight.");
+        }
+        const id = randomUUID();
+        const { promise: reply, resolve, reject } = Promise.withResolvers();
+        // A disconnect may reject while send is awaiting its broker receipt.
+        void reply.catch(() => {
+            /* Request owner observes rejection after its send receipt. */
+        });
+        const timer = setTimeout(() => reject(new Fault(504, "control_unconfirmed", "No correlated native response. Owner may be old/unavailable; execution is unknown. Do not automatically retry.", { id, deliveryUnknown: true })), timeoutMs);
+        const pending = { peer, verb, reply, resolve, reject, timer, disconnected: false };
+        this.pending.set(id, pending);
+        return {
+            id,
+            reply,
+            clear: () => this.clear(id),
+            get observedDisconnected() {
+                return pending.disconnected;
+            },
+        };
+    }
+    async request(client, operation, context) {
+        context.onPeer(operation.peer);
+        const waiting = this.open(operation.peer, operation.verb, operation.timeoutMs);
+        try {
+            context.guard();
+            const receipt = await wait(client.send(operation.peer, {
+                text: CONTROL_FALLBACK,
+                messageId: waiting.id,
+                delivery: "passive",
+                control: {
+                    schema: CONTROL_SCHEMA,
+                    kind: "request",
+                    verb: operation.verb,
+                    certificate: operation.certificate,
+                    options: operation.options,
+                },
+            }), context.signal).catch((error) => {
+                context.guard();
+                if (error instanceof Fault) {
+                    throw error;
+                }
+                throw new Fault(504, "control_unconfirmed", "Broker receipt was not received; native execution is unknown. Do not automatically retry.", { id: waiting.id, deliveryUnknown: true });
+            });
+            context.guard();
+            if (!receipt.accepted) {
+                throw new Fault(409, "delivery_failed", receipt.reason ?? "Broker rejected native control.", { id: receipt.id });
+            }
+            const result = await wait(waiting.reply, context.signal);
+            context.guard();
+            return {
+                ...receipt,
+                peer: operation.peer,
+                status: result.status,
+                native: result,
+                observedDisconnected: waiting.observedDisconnected,
+                processExited: false,
+            };
+        }
+        finally {
+            waiting.clear();
+        }
+    }
+    receive(peer, message) {
+        if (!Object.hasOwn(message, "control")) {
+            return false;
+        }
+        const pending = message.replyTo === undefined ? undefined : this.pending.get(message.replyTo);
+        if (pending &&
+            pending.peer === peer &&
+            message.delivery === "passive" &&
+            isControlResult(message.control) &&
+            message.control.verb === pending.verb) {
+            pending.resolve(message.control);
+        }
+        // Unsolicited/spoofed/malformed control results do not enter the remote mailbox.
+        return true;
+    }
+    peerLeft(peer) {
+        for (const [id, pending] of this.pending) {
+            if (pending.peer === peer) {
+                pending.disconnected = true;
+                pending.reject(new Fault(409, "peer_disconnected", "Native peer disconnected; this does not establish process exit.", { id, observedDisconnected: true, processExited: false, deliveryUnknown: true }));
+            }
+        }
+    }
+    close(error) {
+        for (const [id, pending] of this.pending) {
+            pending.reject(error);
+            this.clear(id);
+        }
+    }
+    clear(id) {
+        clearTimeout(this.pending.get(id)?.timer);
+        this.pending.delete(id);
+    }
+}