@intx/hub-sessions 0.2.2 → 0.4.0

package/dist/ws/sidecar-handler.js

@@ -4,19 +4,37 @@
 // table of agentAddress → sidecar connection, and dispatches frames between
 // sidecars and the hub's internal systems.
 import { getLogger } from "@intx/log";
-import { verifyEd25519 } from "@intx/crypto";
 import { chunkPack, createPackReceiver } from "@intx/pack-transport";
-import { hexDecode, hexEncode } from "@intx/types";
-import { isWorkflowDerivedAddress } from "@intx/workflow-deploy";
+import { base64Decode, deriveMessageId, deriveWorkflowRunId, isRunAddress, } from "@intx/types";
+import { deriveWorkflowRunRepoId } from "@intx/workflow-deploy";
 import { type } from "arktype";
-import { SidecarFrame, } from "@intx/types/sidecar";
+import { MAX_MAIL_OUTBOUND_BODY_BYTES, SidecarFrame, } from "@intx/types/sidecar";
 import { createSidecarEmitter, } from "./sidecar-events.js";
+import { PendingTracker, } from "./pending-tracker.js";
 const logger = getLogger(["hub", "ws", "sidecar"]);
+function deployFrameFailure(message, frameSent, cause) {
+    return Object.assign(new Error(message, { cause }), { frameSent });
+}
+export function isDeployFrameFailure(err) {
+    return (err instanceof Error &&
+        "frameSent" in err &&
+        typeof err.frameSent === "boolean");
+}
+/**
+ * Identity validation failed or remained pending at the connection deadline.
+ * Readiness is unknown: the worker may be healthy behind the lookup, so
+ * callers must retry rather than treat this as a missed connection deadline.
+ */
+export class SidecarIdentityValidationError extends Error {
+    constructor(allocationId, generation, cause) {
+        super(`Cannot validate sidecar identity for allocation ${allocationId} generation ${String(generation)}`, { cause });
+        this.name = "SidecarIdentityValidationError";
+    }
+}
 /**
- * Whether this connection owns `address` for routing/lifecycle purposes --
- * as a challenged session address OR a hub-minted workflow-substrate address.
- * The two sets are kept physically distinct (they differ on the challenge /
- * re-add path), but ownership readers -- pack-transfer authorization,
+ * Whether this connection owns `address` for routing/lifecycle purposes.
+ * The legacy and workflow sets remain physically distinct, but ownership
+ * readers -- pack-transfer authorization,
  * in-flight cancellation, disconnect teardown -- must see the union, or a
  * reconnected workflow deployment (which lives only in `workflowAddresses`)
  * is silently treated as unowned even though its mail routes.
@@ -24,29 +42,88 @@ const logger = getLogger(["hub", "ws", "sidecar"]);
 function connOwnsAddress(conn, address) {
     return (conn.agentAddresses.has(address) || conn.workflowAddresses.has(address));
 }
+/**
+ * Bind pack writes to the repository implied by the authenticated address.
+ * An allocated credential is narrower still: it may only write its one
+ * deployment's workflow-run repository and never a standalone agent-state
+ * repository.
+ */
+function connCanPushRepo(conn, agentAddress, repoId) {
+    if (conn.identity.kind !== "allocated")
+        return false;
+    if (agentAddress !== conn.identity.workflowRunAddress) {
+        return false;
+    }
+    return (repoId.kind === "workflow-run" &&
+        repoId.id === deriveWorkflowRunRepoId(agentAddress));
+}
 /** The deduped set of every address this connection owns (session + workflow). */
 function ownedAddresses(conn) {
     return new Set([...conn.agentAddresses, ...conn.workflowAddresses]);
 }
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
-const DEFAULT_CHALLENGE_TIMEOUT_MS = 30_000;
+// A probe fetches a workflow's dependency closure from a registry and
+// evaluates it on the sidecar, so it runs longer than a routine request; its
+// default timeout is correspondingly wider than DEFAULT_REQUEST_TIMEOUT_MS.
+export const DEFAULT_PROBE_TIMEOUT_MS = 60_000;
 const DEFAULT_DISCONNECT_QUEUE_MAX_SIZE = 100;
 const DEFAULT_DISCONNECT_QUEUE_TTL_MS = 5 * 60 * 1000;
 const DEFAULT_PING_TIMEOUT_MS = 60_000;
+const DEFAULT_MAIL_ACK_RETRY_INTERVAL_MS = 10_000;
+const DEFAULT_MAIL_ACK_MAX_RETRIES = 5;
+// The hub re-resolves and re-pushes a key for each rotatable sender a sidecar
+// reports on (re)connect. A legitimate sidecar caches keys for tens, maybe low
+// hundreds of distinct user senders, so this cap sits well above ten times that
+// ceiling: it NEVER truncates a real report -- dropping a genuine sender would
+// leave its key stale, the exact failure this refresh exists to prevent. It
+// bounds only a hostile or buggy sidecar, since a compromised authenticated
+// sidecar could otherwise report an unbounded set and drive that many sequential
+// DB resolves on every reconnect. The cap lives in the handler, not on the
+// arktype frame schema, on purpose: rejecting an over-cap frame at parse would
+// fail the whole reconnect (a hard outage) rather than degrade gracefully to a
+// bounded refresh.
+export const MAX_RESYNC_SENDER_ADDRESSES = 2048;
 export function createSidecarRouter(config) {
-    const { requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS, challengeTimeoutMs = DEFAULT_CHALLENGE_TIMEOUT_MS, hubPublicKey: hubPublicKeyHex, authenticateSidecar, disconnectQueueMaxSize = DEFAULT_DISCONNECT_QUEUE_MAX_SIZE, disconnectQueueTTLMs = DEFAULT_DISCONNECT_QUEUE_TTL_MS, pingTimeoutMs = DEFAULT_PING_TIMEOUT_MS, lookups = {}, } = config;
+    const { requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS, probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS, hubPublicKey: hubPublicKeyHex, authenticateSidecar, validateSidecarIdentity, disconnectQueueMaxSize = DEFAULT_DISCONNECT_QUEUE_MAX_SIZE, disconnectQueueTTLMs = DEFAULT_DISCONNECT_QUEUE_TTL_MS, pingTimeoutMs = DEFAULT_PING_TIMEOUT_MS, mailAckRetryIntervalMs = DEFAULT_MAIL_ACK_RETRY_INTERVAL_MS, scheduleTimeout = (handler, ms) => {
+        const handle = setTimeout(handler, ms);
+        return () => {
+            clearTimeout(handle);
+        };
+    }, mailAckMaxRetries = DEFAULT_MAIL_ACK_MAX_RETRIES, lookups = {}, } = config;
     // Receiver-dispatch surface. Wire-layer callsites emit events here;
     // host code subscribes via `router.events`.
     const events = createSidecarEmitter();
     // ws handle → registered connection
     const connections = new Map();
+    const allocatedConnections = new Map();
+    const allocationFences = new Map();
+    const allocationWaiters = new Map();
     // agentAddress → ws handle (routing table)
     const addressIndex = new Map();
-    // requestId → pending promise
-    const pending = new Map();
-    const pendingDeploys = new Map();
-    const pendingChallenges = new Map();
+    // requestId → pending promise (resolved by session.ack, rejected by
+    // session.error). `PendingTracker` owns the register/timeout/settle/sweep
+    // lifecycle shared by all five pending round-trips below; each entry's
+    // resolve/reject closures carry the per-round-trip cleanup.
+    const pendingRequests = new PendingTracker();
+    // agentAddress → pending deploy promise (matched by agent.deploy.ack/agent.error)
+    const pendingDeploys = new PendingTracker();
+    // Run addresses whose ALLOCATED deploy is mid-flight -- key-record has been
+    // started but not yet committed. pendingDeploys clears at the deploy ack, but an
+    // allocated run's key is recorded LATER by session-service's anchor-key update,
+    // so pendingDeploys alone under-covers the allocated pre-ack window. session-
+    // service brackets this marker across its deploy try/catch: set before the
+    // deploy emit, cleared by noteSenderDeploySettled on record or failure.
+    const allocatedKeyRecordInFlight = new Map();
     const disconnectedAgents = new Map();
+    const pendingMail = new Map();
+    // agentAddress → retention TTL timer for un-acked pending mail held across a
+    // disconnect. On close the per-entry retry timers are cleared (the socket is
+    // gone) but the entries are RETAINED so a verified reconnect can redeliver
+    // them; this timer bounds that retention so a sidecar that never reconnects
+    // does not leak entries. Cleared when the address reconnects (redelivery) or
+    // its last pending entry is acked.
+    const pendingMailRetention = new Map();
+    const deferredSenderMail = new Map();
     // agentAddress → set of subscriber callbacks for agent events
     const agentSubscribers = new Map();
     // agentAddress → cached connector-thread state, populated by
@@ -66,9 +143,17 @@ export function createSidecarRouter(config) {
     // a single in-flight promise per ws (replaced each queued frame), cleared on
     // close.
     const messageChains = new Map();
-    const pendingPacks = new Map();
+    const pendingPacks = new PendingTracker();
     let packCounter = 0;
-    const pendingUndeploys = new Map();
+    // agentAddress → pending undeploy (resolved by agent.undeploy.ack)
+    const pendingUndeploys = new PendingTracker();
+    // requestId → pending workflow probe (resolved by workflow.probe.result,
+    // rejected by workflow.probe.error). Result-carrying, unlike the other
+    // trackers (which resolve void): a probe returns the sidecar's inert
+    // projection + grant set + wire hash. Keyed on requestId alone -- the
+    // probe runs in the sidecar's pre-deploy state and enters no address map,
+    // so `handleClose`'s ws-keyed sweep is its ONLY disconnect cleanup.
+    const pendingProbes = new PendingTracker();
     // Receives agent-state packs pushed from sidecars. The wire frames
     // (`repo.pack.push` / `repo.pack.done`) are shared with the
     // workflow-run flow; dispatch on `repoId.kind` picks which receiver
@@ -112,29 +197,303 @@ export function createSidecarRouter(config) {
         entry.queue.push(frame);
         return true;
     }
-    function flushDisconnectedQueue(agentAddress, conn) {
-        const entry = disconnectedAgents.get(agentAddress);
+    // Arm a redelivery-retry timer for a tracked pending mail. Wraps the async
+    // `retryPendingMail` so a rejection -- a socket write that throws once the
+    // sidecar is gone -- is logged rather than floating out of the timer as an
+    // unhandled rejection.
+    function scheduleMailRetry(agentAddress, messageId) {
+        return scheduleTimeout(() => {
+            void retryPendingMail(agentAddress, messageId).catch((err) => {
+                logger.warn `Redelivery retry for mail ${messageId} to ${agentAddress} failed: ${err instanceof Error ? err.message : String(err)}`;
+            });
+        }, mailAckRetryIntervalMs);
+    }
+    // Track a connected-window `mail.inbound` for redelivery until the sidecar
+    // acks its durable inbox write. Replaces any prior entry for the same
+    // (agentAddress, messageId) -- clearing its timer first so no timer leaks --
+    // which keeps a re-sent delivery from arming a second concurrent retry loop.
+    function trackPendingMail(agentAddress, messageId, frame, runGrants, allocatedTarget) {
+        let byId = pendingMail.get(agentAddress);
+        if (byId === undefined) {
+            byId = new Map();
+            pendingMail.set(agentAddress, byId);
+        }
+        const existing = byId.get(messageId);
+        if (existing !== undefined)
+            existing.cancelRetry();
+        byId.set(messageId, {
+            agentAddress,
+            messageId,
+            frame,
+            attempts: 0,
+            cancelRetry: scheduleMailRetry(agentAddress, messageId),
+            ...(runGrants !== undefined ? { runGrants } : {}),
+            ...(allocatedTarget !== undefined ? { allocatedTarget } : {}),
+        });
+    }
+    // Resolve the frame that must precede a redelivery of a trigger mail on the
+    // FIFO socket, re-resolving a keyless run sender's key so it still
+    // co-delivers. Returns:
+    //   - a `run.grants` frame when the entry carries run grants (the redelivered
+    //     run resolves its onRunStart barrier instead of failing closed on
+    //     missing grants);
+    //   - a bare `sender.key.refresh` frame when the entry carries NO run grants
+    //     but its run sender's key was never co-delivered, so the recipient still
+    //     caches the key ahead of the mail;
+    //   - `undefined` when nothing must precede the mail.
+    //
+    // The re-resolve is KIND-GATED to run-address senders only. A run's
+    // deployment key is immutable once acked, so the re-resolved key equals the
+    // signing-time key -- safe. A user (non-run) sender's key may have rotated
+    // since it signed, so re-resolving would check the fixed signed bytes against
+    // a newer key and turn a valid message into a false `invalid`; such a sender
+    // lacking a captured key stays keyless (an honest `unknown`). An entry that
+    // captured `senderIdentities` at track time replays that snapshot as-is: it
+    // holds the signing-time key and is never re-resolved.
+    //
+    // Awaits any key resolve so the caller sends the returned frame and the mail
+    // back-to-back with no await between them, keeping the co-delivered key ahead
+    // of the mail on the FIFO socket.
+    async function resolveReplayLeadFrame(entry) {
+        const authenticatedSender = entry.frame.type === "mail.inbound"
+            ? entry.frame.authenticatedSender
+            : undefined;
+        const senderIsRun = authenticatedSender !== undefined && isRunAddress(authenticatedSender);
+        if (entry.runGrants === undefined) {
+            if (authenticatedSender === undefined || !senderIsRun)
+                return undefined;
+            const key = await reresolveRunSenderKey(authenticatedSender);
+            if (key === null)
+                return undefined;
+            return {
+                type: "sender.key.refresh",
+                address: authenticatedSender,
+                publicKey: key,
+            };
+        }
+        let senderIdentities = entry.runGrants.senderIdentities;
+        if (senderIdentities === undefined &&
+            authenticatedSender !== undefined &&
+            senderIsRun) {
+            const key = await reresolveRunSenderKey(authenticatedSender);
+            senderIdentities = senderIdentitiesFromKey(authenticatedSender, key);
+        }
+        return {
+            type: "run.grants",
+            agentAddress: entry.agentAddress,
+            runId: entry.runGrants.runId,
+            stepGrants: entry.runGrants.stepGrants,
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+        };
+    }
+    // Best-effort re-resolve of a run sender's hub-held key at replay time. Only
+    // called for a run-address sender, whose deployment key is immutable once
+    // acked, so the current key equals the signing-time key. Returns null when no
+    // resolver is wired or the sender has no durable key.
+    //
+    // This relies on `lookups.resolveSenderKey` being the BEST-EFFORT,
+    // NEVER-THROWS resolver (the contract at sidecar-events.ts:274-279, wired to
+    // resolveFrameSenderKey, which swallows faults to null). That contract is
+    // load-bearing here: `redeliverPendingMail` clears the retention TTL up-front
+    // and re-arms each entry's per-entry timer only on a successful send, so a
+    // resolver that THREW would abort the redeliver loop and strand the
+    // not-yet-processed entries with no timer and no TTL until a process restart.
+    // A strict/throwing resolver must NOT be wired here. Do not add a try/catch:
+    // the boundary owns the never-throws contract; duplicating it here would
+    // violate that ownership. The dispatch-time resolveSenderKey call
+    // (sendWorkflowRunDispatchToAllocation path) carries the same dependency
+    // note.
+    async function reresolveRunSenderKey(authenticatedSender) {
+        const resolveSenderKey = lookups.resolveSenderKey;
+        if (resolveSenderKey === undefined)
+            return null;
+        return resolveSenderKey(authenticatedSender);
+    }
+    // Replay a pending mail's lead frame (its run grants or a re-resolved sender
+    // key) and then the mail itself over `conn`. Awaits the resolve FIRST, then
+    // sends the lead frame and the mail back-to-back with NO await between them,
+    // so the co-delivered key always precedes the mail on the FIFO socket.
+    // Returns whether the mail was (re)sent, so the caller re-arms the retry timer
+    // only for an entry it actually redelivered.
+    async function replaySendPendingMail(conn, entry) {
+        const lead = await resolveReplayLeadFrame(entry);
+        // The resolve above may have awaited real I/O; during that gap a queued
+        // `mail.inbound.ack` can advance and run `resolvePendingMail` (delete +
+        // clearTimeout) on this entry. The window is opened by the timer-macrotask
+        // retry path, NOT by any bypass: `mail.inbound.ack` is a QUEUED frame
+        // (frameBypassesQueue returns false for it). It can interleave because the
+        // retry runs as an independent setTimeout macrotask (retryPendingMail), so
+        // the owning ws's message chain is free to advance the ack during the
+        // resolve await. On the reconnect/redeliver path the ack cannot interleave
+        // at all -- it queues behind the still-running reconnect handler on the
+        // same ws -- so here this guard is pure defense-in-depth. Re-confirm it is
+        // still the tracked entry before sending, or a post-ack redelivery would
+        // arm a retry timer on a detached entry.
+        if (pendingMail.get(entry.agentAddress)?.get(entry.messageId) !== entry) {
+            return false;
+        }
+        // The same gap can span a disconnect or a takeover that moves the address
+        // off `conn`. Sending on the stale conn would write to a dead socket and
+        // re-arm a retry that later drops a still-retained entry. Skip so the entry
+        // survives for the reconnect redelivery.
+        const ws = addressIndex.get(entry.agentAddress);
+        if (ws === undefined || connections.get(ws) !== conn)
+            return false;
+        if (lead !== undefined)
+            conn.send(lead);
+        conn.send(entry.frame);
+        return true;
+    }
+    function deletePendingMail(byId, agentAddress, messageId) {
+        byId.delete(messageId);
+        if (byId.size === 0) {
+            pendingMail.delete(agentAddress);
+            // The retention TTL guards a non-empty pending set; drop it once the set
+            // is empty so it never outlives the entries it was bounding.
+            const retention = pendingMailRetention.get(agentAddress);
+            if (retention !== undefined) {
+                clearTimeout(retention);
+                pendingMailRetention.delete(agentAddress);
+            }
+        }
+    }
+    async function retryPendingMail(agentAddress, messageId) {
+        const byId = pendingMail.get(agentAddress);
+        if (byId === undefined)
+            return;
+        const entry = byId.get(messageId);
         if (entry === undefined)
             return;
-        clearTimeout(entry.timer);
-        disconnectedAgents.delete(agentAddress);
-        for (const frame of entry.queue) {
-            conn.send(frame);
+        if (entry.attempts >= mailAckMaxRetries) {
+            // The sidecar never acked within the retry budget. The ack is withheld
+            // precisely because the sidecar's durable inbox write failed, so the
+            // mail was NOT delivered: surface it as undelivered so the host can relay
+            // it onto an external transport, then drop the pending entry so its timer
+            // does not leak.
+            if (entry.frame.type === "mail.inbound") {
+                events.emit("mail.outbound.undelivered", {
+                    rawMessage: entry.frame.rawMessage,
+                    recipients: [agentAddress],
+                });
+            }
+            deletePendingMail(byId, agentAddress, messageId);
+            logger.warn `Gave up redelivering mail ${messageId} to ${agentAddress} after ${String(entry.attempts)} un-acked attempt(s)`;
+            return;
         }
-        if (entry.queue.length > 0) {
-            logger.info `Flushed ${String(entry.queue.length)} queued message(s) to ${agentAddress}`;
+        // Redeliver over the address's CURRENT owner: a verified reconnect may have
+        // moved the address to a new connection since the original delivery.
+        const ws = addressIndex.get(agentAddress);
+        const conn = ws !== undefined ? connections.get(ws) : undefined;
+        const allocated = entry.allocatedTarget === undefined
+            ? undefined
+            : allocatedConnections.get(entry.allocatedTarget.allocationId);
+        const targetStillOwnsAddress = entry.allocatedTarget === undefined ||
+            (allocated !== undefined &&
+                allocated.identity.generation === entry.allocatedTarget.generation &&
+                allocated.ws === ws);
+        if (conn === undefined || !targetStillOwnsAddress) {
+            // No live connection to recover into. Connected-window redelivery only
+            // applies while the address is routable; a disconnected address is not
+            // retried here.
+            deletePendingMail(byId, agentAddress, messageId);
+            logger.warn `Dropping un-acked mail ${messageId} for ${agentAddress}: no live connection to redeliver over`;
+            return;
         }
+        if (!(await replaySendPendingMail(conn, entry)))
+            return;
+        entry.attempts += 1;
+        entry.cancelRetry = scheduleMailRetry(agentAddress, messageId);
     }
-    function resetLivenessTimer(ws) {
-        const existing = livenessTimers.get(ws);
+    function resolvePendingMail(agentAddress, messageId) {
+        const byId = pendingMail.get(agentAddress);
+        if (byId === undefined)
+            return;
+        const entry = byId.get(messageId);
+        if (entry === undefined)
+            return;
+        entry.cancelRetry();
+        deletePendingMail(byId, agentAddress, messageId);
+    }
+    // Hold an address's un-acked pending mail across a disconnect. The per-entry
+    // retry timers are cleared -- retrying over the dead socket is pointless --
+    // but the entries are KEPT so a verified reconnect can redeliver them. A
+    // retention TTL (the disconnect-queue horizon) bounds the hold so a sidecar
+    // that never reconnects does not leak; on expiry the still-un-acked entries
+    // are surfaced as `mail.outbound.undelivered` so the host can relay them,
+    // since a withheld ack means the sidecar's durable write never landed.
+    function retainPendingMailForAddress(agentAddress) {
+        const byId = pendingMail.get(agentAddress);
+        if (byId === undefined)
+            return;
+        for (const entry of byId.values())
+            entry.cancelRetry();
+        const existing = pendingMailRetention.get(agentAddress);
         if (existing !== undefined)
             clearTimeout(existing);
         const timer = setTimeout(() => {
+            pendingMailRetention.delete(agentAddress);
+            const expired = pendingMail.get(agentAddress);
+            pendingMail.delete(agentAddress);
+            if (expired !== undefined && expired.size > 0) {
+                for (const entry of expired.values()) {
+                    if (entry.frame.type !== "mail.inbound")
+                        continue;
+                    events.emit("mail.outbound.undelivered", {
+                        rawMessage: entry.frame.rawMessage,
+                        recipients: [agentAddress],
+                    });
+                }
+                logger.warn `Dropping ${String(expired.size)} un-acked message(s) for ${agentAddress}: pending-mail retention TTL expired`;
+            }
+        }, disconnectQueueTTLMs);
+        pendingMailRetention.set(agentAddress, timer);
+    }
+    // Redeliver an address's retained un-acked pending mail on a verified
+    // reconnect. Replays identical bytes (same messageId) over the new
+    // connection, so the sidecar's inbox dedups a message it already wrote
+    // (effectively-once) and processes one it had dropped (no loss). Re-arms the
+    // connected-window retry over the new connection with a fresh per-generation
+    // budget, so a redelivery that is itself dropped before its ack is retried.
+    async function redeliverPendingMail(agentAddress, conn) {
+        const retention = pendingMailRetention.get(agentAddress);
+        if (retention !== undefined) {
+            clearTimeout(retention);
+            pendingMailRetention.delete(agentAddress);
+        }
+        const byId = pendingMail.get(agentAddress);
+        if (byId === undefined)
+            return;
+        for (const entry of [...byId.values()]) {
+            if (entry.allocatedTarget !== undefined &&
+                (conn.identity.kind !== "allocated" ||
+                    conn.identity.allocationId !== entry.allocatedTarget.allocationId ||
+                    conn.identity.generation !== entry.allocatedTarget.generation)) {
+                // The Hub-owned dispatch row survives generation replacement and will
+                // be requeued by the allocation-ready callback. Do not leak or replay
+                // this generation-local retry entry onto a different worker.
+                entry.cancelRetry();
+                deletePendingMail(byId, agentAddress, entry.messageId);
+                continue;
+            }
+            if (!(await replaySendPendingMail(conn, entry)))
+                continue;
+            entry.attempts = 0;
+            entry.cancelRetry = scheduleMailRetry(agentAddress, entry.messageId);
+        }
+        if (byId.size > 0) {
+            logger.info `Redelivered ${String(byId.size)} un-acked message(s) to ${agentAddress} on reconnect`;
+        }
+    }
+    function resetLivenessTimer(ws) {
+        const existing = livenessTimers.get(ws);
+        if (existing !== undefined)
+            existing();
+        const cancel = scheduleTimeout(() => {
             livenessTimers.delete(ws);
             logger.warn `Sidecar ping timeout, closing connection`;
             ws.close();
         }, pingTimeoutMs);
-        livenessTimers.set(ws, timer);
+        livenessTimers.set(ws, cancel);
     }
     function handlePing(ws) {
         resetLivenessTimer(ws);
@@ -197,11 +556,9 @@ export function createSidecarRouter(config) {
     // state. Such a frame has no ordering obligation against new inbound frames
     // (a response cannot resolve "too early" for a request that already went
     // out), and it is exactly what in-flight queued handlers block on, so it MUST
-    // run out of band or the challenge round-trip deadlocks (challenge.response
-    // -> agent.reconnected reaction -> sendSourcesUpdate awaits a later
-    // session.ack). Every other frame establishes or reads routing, or carries an
-    // inbound payload whose order matters, so it queues. The exhaustive switch +
-    // assertNever makes adding a SidecarFrame variant without classifying it a
+    // run out of band. Every other frame establishes or reads routing, or carries
+    // an inbound payload whose order matters, so it queues. The exhaustive switch
+    // + assertNever makes adding a SidecarFrame variant without classifying it a
     // compile error, not a latent deadlock or a silent bypass hole.
     function frameBypassesQueue(frame) {
         switch (frame.type) {
@@ -213,13 +570,16 @@ export function createSidecarRouter(config) {
             case "agent.undeploy.ack":
             case "repo.pack.ack":
             case "repo.pack.reject":
+            case "workflow.probe.result":
+            case "workflow.probe.error":
                 return true;
             case "register":
             case "reconnect":
-            case "challenge.response":
             case "mail.outbound":
             case "agent.event":
             case "connector.state.changed":
+            case "mail.inbound.ack":
+            case "signal.correlation.register":
             case "repo.pack.push":
             case "repo.pack.done":
                 return false;
@@ -229,50 +589,82 @@ export function createSidecarRouter(config) {
     }
     // Runs one frame's handler. Returns the handler's promise for async handlers
     // so the per-ws chain can await bounded completion; sync handlers return
-    // void. Never awaits a promise that resolves on a LATER same-ws frame -- the
-    // only such await (the challenge round-trip's session.ack) is reached via a
-    // bypass frame, which does not queue.
+    // void. Never awaits a promise that resolves on a later same-ws frame.
     function dispatchFrame(ws, frame) {
+        const registeredIdentity = connections.get(ws)?.identity;
+        if (registeredIdentity?.kind === "probe" &&
+            frame.type !== "register" &&
+            frame.type !== "reconnect" &&
+            frame.type !== "ping" &&
+            frame.type !== "workflow.probe.result" &&
+            frame.type !== "workflow.probe.error") {
+            logger.warn `Rejected ${frame.type} from probe sidecar ${registeredIdentity.sidecarId}`;
+            handleClose(ws);
+            ws.close();
+            return;
+        }
         switch (frame.type) {
             case "register": {
                 const agentAddresses = frame.agentAddresses;
-                return authenticateHandshake(ws, frame, (identity) => handleRegister(ws, identity, agentAddresses));
+                const cachedSenderAddresses = frame.cachedSenderAddresses ?? [];
+                return authenticateHandshake(ws, frame, (identity) => handleRegister(ws, identity, agentAddresses, cachedSenderAddresses));
             }
             case "reconnect": {
                 const agentAddresses = frame.agentAddresses;
-                const deployRefs = frame.deployRefs ?? {};
-                return authenticateHandshake(ws, frame, (identity) => handleReconnect(ws, identity, agentAddresses, deployRefs));
+                const cachedSenderAddresses = frame.cachedSenderAddresses ?? [];
+                return authenticateHandshake(ws, frame, (identity) => handleReconnect(ws, identity, agentAddresses, cachedSenderAddresses));
             }
-            case "challenge.response":
-                return handleChallengeResponse(ws, frame.responses);
             case "agent.deploy.ack":
-                return handleDeployAck(frame.agentAddress, frame.publicKey);
+                return handleDeployAck(ws, frame);
             case "agent.error":
-                rejectDeployPending(frame.agentAddress, frame.error);
-                rejectUndeployPending(frame.agentAddress, frame.error);
+                rejectDeployPendingFromFrame(ws, frame.agentAddress, frame.error);
+                rejectUndeployPending(ws, frame.agentAddress, frame.error);
                 return;
             case "agent.undeploy.ack":
-                resolveUndeployPending(frame.agentAddress);
+                resolveUndeployPending(ws, frame.agentAddress);
                 return;
             case "ping":
                 handlePing(ws);
                 return;
-            case "mail.outbound":
-                if (frame.delivered !== true) {
-                    handleMailOutbound(frame.rawMessage, frame.recipients);
+            case "mail.outbound": {
+                const conn = connections.get(ws);
+                if (conn === undefined)
+                    return;
+                if (!connOwnsAddress(conn, frame.senderAddress)) {
+                    logger.warn `Dropping mail.outbound from ${frame.senderAddress}: not registered to this sidecar`;
                     return;
                 }
-                if (lookups.persistMail && frame.senderAddress) {
-                    return handleMailPersist(lookups.persistMail, frame.rawMessage, frame.senderAddress, frame.recipients);
+                // The DoS backstop and the trust boundary for an untrusted sidecar's
+                // mail body: measure the true byte cost (a hostile sidecar can send
+                // multi-byte UTF-8, so `.length` would undercount) and drop an over-cap
+                // frame here before either delivery path allocates on it. The socket's
+                // maxPayloadLength has already closed the connection for a truly huge
+                // frame; this catches one between the mail cap and that ceiling.
+                const bodyBytes = Buffer.byteLength(frame.rawMessage, "utf8");
+                if (bodyBytes > MAX_MAIL_OUTBOUND_BODY_BYTES) {
+                    logger.warn `Dropping mail.outbound from ${frame.senderAddress}: rawMessage of ${String(bodyBytes)} bytes exceeds the ${String(MAX_MAIL_OUTBOUND_BODY_BYTES)}-byte cap`;
+                    return;
                 }
-                if (!frame.senderAddress) {
-                    logger.warn `Dropping delivered mail.outbound frame with no senderAddress`;
+                if (frame.delivered !== true) {
+                    // frame.senderAddress is the sender this connection was just gated
+                    // on by connOwnsAddress above -- a hub-verified value. Thread it so
+                    // the relayed inbound frame is stamped with it, not the MIME From.
+                    return handleMailOutbound(frame.rawMessage, frame.senderAddress, frame.recipients);
                 }
-                else {
-                    logger.warn `Dropping delivered mail.outbound frame: no persistMail lookup configured`;
+                if (lookups.persistMail) {
+                    return handleMailPersist(lookups.persistMail, frame.rawMessage, frame.senderAddress, frame.recipients);
                 }
+                logger.warn `Dropping delivered mail.outbound frame: no persistMail lookup configured`;
                 return;
-            case "agent.event":
+            }
+            case "agent.event": {
+                const conn = connections.get(ws);
+                if (conn === undefined)
+                    return;
+                if (!connOwnsAddress(conn, frame.agentAddress)) {
+                    logger.warn `Dropping agent.event for ${frame.agentAddress}: not registered to this sidecar`;
+                    return;
+                }
                 events.emit("agent.event", {
                     agentAddress: frame.agentAddress,
                     sessionId: frame.sessionId,
@@ -280,6 +672,7 @@ export function createSidecarRouter(config) {
                 });
                 dispatchToSubscribers(frame.agentAddress, frame.event);
                 return;
+            }
             case "connector.state.changed":
                 // Gate the cache write on the sending sidecar actually owning
                 // the named agent. A misbehaving sidecar that knows another
@@ -294,23 +687,66 @@ export function createSidecarRouter(config) {
                     connectorState: frame.connectorState,
                 });
                 return;
+            case "mail.inbound.ack": {
+                // Terminal receipt for a connected-window `mail.inbound`: the sidecar
+                // has durably written the message to its inbox. Gate on ownership --
+                // like connector.state.changed and signal.correlation.register -- so a
+                // sidecar cannot clear another sidecar's pending mail. The messageId is
+                // a hub-minted id only the owning sidecar ever received on the frame,
+                // so the ownership check is defense-in-depth, not the sole guard.
+                const conn = connections.get(ws);
+                if (conn === undefined)
+                    return;
+                if (!connOwnsAddress(conn, frame.agentAddress)) {
+                    logger.warn `Dropping mail.inbound.ack for ${frame.agentAddress}: not registered to this sidecar`;
+                    return;
+                }
+                resolvePendingMail(frame.agentAddress, frame.messageId);
+                events.emit("mail.inbound.acknowledged", {
+                    agentAddress: frame.agentAddress,
+                    messageId: frame.messageId,
+                    ...(conn.identity.kind === "allocated"
+                        ? {
+                            allocated: {
+                                allocationId: conn.identity.allocationId,
+                                anchorRunId: conn.identity.anchorRunId,
+                                generation: conn.identity.generation,
+                            },
+                        }
+                        : {}),
+                });
+                return;
+            }
+            case "signal.correlation.register":
+                return handleSignalCorrelationRegister(ws, frame);
             case "session.ack":
-                resolvePending(frame.requestId);
+                pendingRequests.resolve(frame.requestId);
                 return;
             case "session.error":
-                rejectPending(frame.requestId, frame.error);
+                pendingRequests.reject(frame.requestId, frame.error);
                 return;
             case "repo.pack.ack":
-                resolvePackPending(frame.transferId);
+                resolvePackPending(ws, frame);
                 return;
             case "repo.pack.reject":
-                rejectPackPending(frame.transferId, frame.reason);
+                rejectPackPending(ws, frame);
                 return;
             case "repo.pack.push":
                 handlePackPush(ws, frame);
                 return;
             case "repo.pack.done":
                 return handlePackDone(ws, frame);
+            case "workflow.probe.result":
+                resolveProbe(ws, frame.requestId, {
+                    projection: frame.projection,
+                    grants: frame.grants,
+                    grantWalkSnapshot: frame.grantWalkSnapshot,
+                    wireHash: frame.wireHash,
+                });
+                return;
+            case "workflow.probe.error":
+                rejectProbe(ws, frame.requestId, frame.error);
+                return;
             default:
                 return assertNever(frame);
         }
@@ -343,466 +779,454 @@ export function createSidecarRouter(config) {
         if (identity.sidecarId !== frame.sidecarId) {
             logger.warn `Sidecar ${frame.type} claimed id ${frame.sidecarId} but token verifies as ${identity.sidecarId}; keying off the verified id`;
         }
+        if (!(await validateSidecarIdentity(identity, "registration"))) {
+            logger.warn `Rejected ${frame.type} from sidecar ${identity.sidecarId}: credential identity is no longer current`;
+            ws.close();
+            return;
+        }
         await run(identity);
     }
-    async function handleRegister(ws, identity, agentAddresses) {
-        const sidecarId = identity.sidecarId;
-        // Key-existence gate. A register frame is token-authenticated but carries
-        // no per-address ownership proof, so it may route an address ONLY if that
-        // address has no stored key yet -- a genuine keyless first-deploy (the
-        // token-bounded first-deploy trust model). An address that already has a
-        // key must prove ownership through the challenged reconnect path; routing
-        // it here on token auth alone is the register-frame sibling of the
-        // reconnect hijack. The keyless-only set is computed up front, BEFORE the
-        // ghost-cleanup and every routing mutation below, so a rejected address
-        // touches nothing: no eviction of a live owner, hence no downgrade from
-        // hijack to denial-of-service on the victim.
-        const lookupKey = lookups.lookupPublicKey;
-        const routableAddresses = [];
-        for (const addr of agentAddresses) {
-            if (lookupKey === undefined) {
-                // Fail closed: without the ownership lookup a keyed address cannot be
-                // told apart from a first-deploy, so route nothing and surface the
-                // misconfiguration. Empty first-connect registers never reach here.
-                logger.error `Cannot gate register routing for ${addr}: lookupPublicKey is not configured; refusing to route (challenged reconnect required)`;
-                continue;
-            }
-            let existingKey;
-            try {
-                existingKey = await lookupKey(addr);
+    async function notifyAllocationWaiters(allocationId) {
+        const waiters = allocationWaiters.get(allocationId);
+        const current = allocatedConnections.get(allocationId);
+        if (waiters === undefined || current === undefined)
+            return;
+        const matchingWaiters = [...waiters].filter((waiter) => waiter.generation === current.identity.generation);
+        if (matchingWaiters.length === 0)
+            return;
+        const validation = Promise.resolve().then(() => validateSidecarIdentity(current.identity, "readiness"));
+        for (const waiter of matchingWaiters) {
+            waiter.validations.add(validation);
+            waiter.onValidation?.(validation);
+        }
+        let identityCurrent;
+        try {
+            identityCurrent = await validation;
+        }
+        catch (cause) {
+            // A failed revalidation leaves the waiters parked: a later register
+            // revalidates, and at expiry the wait reports the failure rather than a
+            // missed deadline. Registration itself was already gated, so this must
+            // not fail the connection that just registered.
+            const validationFailure = new SidecarIdentityValidationError(allocationId, current.identity.generation, cause);
+            for (const waiter of matchingWaiters) {
+                waiter.validationFailure = validationFailure;
             }
-            catch (err) {
-                // Fail closed on a lookup error (e.g. a transient DB failure): route
-                // nothing for this address and surface the failure, rather than let
-                // the rejection float out of this void-dispatched handler and take
-                // down the hub.
-                logger.error `Key lookup failed for ${addr} during register: ${err instanceof Error ? err.message : String(err)}; failing closed (challenged reconnect required)`;
-                continue;
+            return;
+        }
+        finally {
+            for (const waiter of matchingWaiters) {
+                waiter.validations.delete(validation);
             }
-            if (existingKey !== null) {
-                logger.warn `Refusing to route ${addr} via register: address already has a stored key; ownership must be proven via challenged reconnect`;
+        }
+        // A clean validation supersedes earlier failures: expiry must report the
+        // current reading, not a stale transient.
+        for (const waiter of matchingWaiters) {
+            delete waiter.validationFailure;
+        }
+        if (!identityCurrent || allocatedConnections.get(allocationId) !== current)
+            return;
+        for (const waiter of matchingWaiters) {
+            if (!waiters.delete(waiter))
                 continue;
-            }
-            routableAddresses.push(addr);
+            clearTimeout(waiter.timer);
+            waiter.resolve();
         }
-        // Additive re-register: inherit every address this ws already owns and ADD
-        // the frame's keyless first-deploys. Register never drops an owned route --
-        // an address proved via challenged reconnect stays routed, and removal
-        // happens via undeploy/disconnect, not register-omission.
-        //
-        // (Under the retired full-set model a register frame carried the sidecar's
-        // complete live set, so an omitted address meant "removed". Now the frame
-        // carries only keyless first-deploys the sidecar is adding -- keyed
-        // addresses arrive via reconnect -- so omission is meaningless, and a
-        // replace-on-register would wrongly drop an earlier first-deploy when a
-        // later one is registered, as well as any reconnect-verified keyed route.)
-        const existing = connections.get(ws);
-        const inheritedAgent = new Set(existing?.agentAddresses);
-        const inheritedWorkflow = new Set(existing?.workflowAddresses);
-        // Clean up ghost entries from OTHER connections for the newly-claimed
-        // addresses only. An inherited address is already owned by this ws
-        // (prevWs === ws), so it needs no eviction and its in-flight deploy must
-        // not be cancelled.
-        for (const addr of routableAddresses) {
-            const prevWs = addressIndex.get(addr);
-            if (prevWs !== undefined && prevWs !== ws) {
-                const prevConn = connections.get(prevWs);
-                if (prevConn !== undefined) {
-                    prevConn.agentAddresses.delete(addr);
-                }
-                // The new owner is about to take over; the prior owner's
-                // cached state must not survive into the new owner's window
-                // before its bootstrap frame arrives.
-                connectorStates.delete(addr);
-            }
-            // Cancel any in-flight deploy for this address since the
-            // reconnecting sidecar is taking ownership.
-            const staleDeployReq = pendingDeploys.get(addr);
-            if (staleDeployReq !== undefined) {
-                clearTimeout(staleDeployReq.timer);
-                pendingDeploys.delete(addr);
-                staleDeployReq.reject(`Sidecar ${sidecarId} reconnected and claimed address "${addr}"`);
+        if (waiters.size === 0 && allocationWaiters.get(allocationId) === waiters)
+            allocationWaiters.delete(allocationId);
+    }
+    async function handleAllocatedRegister(ws, identity, agentAddresses, cachedSenderAddresses) {
+        if (allocationFences.get(identity.allocationId) !== identity.generation) {
+            logger.warn `Rejected allocated sidecar ${identity.sidecarId}: allocation ${identity.allocationId} generation ${String(identity.generation)} is not fenced as current`;
+            ws.close();
+            return;
+        }
+        if (identity.kind === "probe" && agentAddresses.length > 0) {
+            logger.warn `Rejected probe sidecar ${identity.sidecarId}: probe ${identity.allocationId} claimed workflow addresses`;
+            ws.close();
+            return;
+        }
+        if (agentAddresses.length > 0 &&
+            !(await validateSidecarIdentity(identity, "routing"))) {
+            logger.warn `Rejected allocated sidecar ${identity.sidecarId}: allocation ${identity.allocationId} is not ready to reclaim routes`;
+            ws.close();
+            return;
+        }
+        const existingOnSocket = connections.get(ws);
+        const newlyRoutedAddresses = new Set();
+        for (const address of agentAddresses) {
+            const alreadyOwned = existingOnSocket?.identity.kind === "allocated" &&
+                existingOnSocket.identity.allocationId === identity.allocationId &&
+                addressIndex.get(address) === ws &&
+                connOwnsAddress(existingOnSocket, address);
+            if (identity.kind !== "allocated" ||
+                (!alreadyOwned && address !== identity.workflowRunAddress)) {
+                logger.warn `Rejected allocated sidecar ${identity.sidecarId}: allocation ${identity.allocationId} claimed unrelated address ${address}`;
+                ws.close();
+                return;
             }
+            if (!alreadyOwned)
+                newlyRoutedAddresses.add(address);
+        }
+        if (allocationFences.get(identity.allocationId) !== identity.generation) {
+            ws.close();
+            return;
         }
-        // New keyless first-deploys join the inherited session set; the workflow
-        // set is inherited unchanged (register never adds to it -- a
-        // workflow-derived address routes only through the challenged reconnect).
-        for (const addr of routableAddresses) {
-            inheritedAgent.add(addr);
-        }
-        const addrSet = inheritedAgent;
-        const workflowSet = inheritedWorkflow;
-        const conn = {
-            sidecarId,
-            agentAddresses: addrSet,
-            workflowAddresses: workflowSet,
+        const current = allocatedConnections.get(identity.allocationId);
+        if (current !== undefined && current.ws !== ws) {
+            // A current-generation takeover is a reconnect, not a capacity loss.
+            // Remove the old socket from the allocation index before closing it so
+            // handleClose does not emit a false allocated-disconnect event.
+            allocatedConnections.delete(identity.allocationId);
+            handleClose(current.ws);
+            current.ws.close();
+        }
+        const conn = existingOnSocket ?? {
+            sidecarId: identity.sidecarId,
+            identity,
+            agentAddresses: new Set(),
+            workflowAddresses: new Set(),
             send(frame) {
                 ws.send(JSON.stringify(frame));
             },
         };
-        connections.set(ws, conn);
-        // Only the newly-claimed addresses need a routing write + queue discard;
-        // inherited addresses already point at this ws in addressIndex.
-        for (const addr of routableAddresses) {
-            addressIndex.set(addr, ws);
-            // Discard any disconnect queue — register has no identity
-            // verification, so flushing to an unverified connection is unsafe.
-            // Use reconnect with challenge/response to preserve queued messages.
-            const staleQueue = disconnectedAgents.get(addr);
-            if (staleQueue !== undefined) {
-                clearTimeout(staleQueue.timer);
-                if (staleQueue.queue.length > 0) {
-                    logger.warn `Discarding ${String(staleQueue.queue.length)} queued message(s) for ${addr} on unverified register`;
-                }
-                disconnectedAgents.delete(addr);
-            }
-        }
-        // Only keyless first-deploy addresses reach `addressIndex` here; an
-        // address that already has a stored key was filtered out by the gate
-        // above and must re-enter routing through the challenged reconnect path.
-        // Because the gate runs before the ghost-cleanup, a rejected (keyed)
-        // address never evicts its prior owner -- register cannot reclaim or
-        // disrupt a victim's route on token auth alone.
-        logger.info `Sidecar ${sidecarId} registered; routed ${String(addrSet.size)} of ${String(agentAddresses.length)} address(es) (keyless first-deploy only)`;
-    }
-    async function handleReconnect(ws, identity, agentAddresses, deployRefs = {}) {
-        const sidecarId = identity.sidecarId;
-        const lookupKey = lookups.lookupPublicKey;
-        if (lookupKey === undefined) {
-            logger.error `Received reconnect frame but no lookupPublicKey is configured`;
+        if (conn.identity.kind !== identity.kind ||
+            conn.identity.allocationId !== identity.allocationId ||
+            conn.identity.generation !== identity.generation) {
+            logger.warn `Rejected allocated sidecar ${identity.sidecarId}: socket identity changed during registration`;
             ws.close();
             return;
         }
-        // Cancel any existing pending challenge for this ws before doing
-        // async work, so concurrent reconnect frames don't race.
-        const existingChallenge = pendingChallenges.get(ws);
-        if (existingChallenge !== undefined) {
-            clearTimeout(existingChallenge.timer);
-            pendingChallenges.delete(ws);
-        }
-        // Capture the addresses this live connection already owns. The
-        // internal register below clears them, but ones the reconnect is not
-        // re-challenging are still valid — an agent provisioned during the
-        // sidecar's restore window is routed into addressIndex by its deploy
-        // and is not part of the disk-restored set this reconnect carries.
-        // Without preserving them, the reconnect silently drops a
-        // freshly-deployed agent from routing.
-        const previouslyOwned = new Set(connections.get(ws)?.agentAddresses);
-        // Register the sidecar connection immediately (with no addresses) so it
-        // can receive frames while the ownership challenge is pending. Every
-        // reconnect address -- session and workflow-derived alike -- enters
-        // routing only through the verified path below, never unchallenged here.
-        // Empty address list, so the key-existence gate has nothing to await.
-        // The identity was already verified at the dispatch boundary, so the
-        // internal register does not re-authenticate.
-        await handleRegister(ws, identity, []);
-        const conn = connections.get(ws);
-        if (conn === undefined)
-            return;
-        // Re-add the still-owned addresses the register cleared but this
-        // reconnect is not re-challenging. The challenged addresses below
-        // re-enter addressIndex through the verified path instead.
-        const claimedAddresses = new Set(agentAddresses);
-        for (const addr of previouslyOwned) {
-            if (claimedAddresses.has(addr))
-                continue;
-            conn.agentAddresses.add(addr);
-            addressIndex.set(addr, ws);
-        }
-        // Look up stored public keys for all claimed addresses. Fail closed on a
-        // lookup error (e.g. a transient DB failure): treat the address as
-        // unverifiable so it fails its challenge and stays unrouted, rather than
-        // letting the rejection float out of this void-dispatched handler as an
-        // unhandled rejection that could take down the hub.
-        const keyLookups = await Promise.all(agentAddresses.map(async (addr) => {
-            try {
-                return { address: addr, publicKeyHex: await lookupKey(addr) };
-            }
-            catch (err) {
-                logger.error `Key lookup failed for ${addr} during reconnect: ${err instanceof Error ? err.message : String(err)}; failing closed`;
-                return { address: addr, publicKeyHex: null };
-            }
-        }));
-        // If the connection was closed or superseded while we were awaiting
-        // key lookups, bail out.
-        if (!connections.has(ws))
-            return;
-        const challenges = new Map();
-        const challengeEntries = [];
-        for (const { address, publicKeyHex } of keyLookups) {
-            if (publicKeyHex === null) {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Unknown agent address",
-                });
-                continue;
-            }
-            let publicKey;
-            try {
-                publicKey = hexDecode(publicKeyHex);
+        connections.set(ws, conn);
+        for (const address of agentAddresses) {
+            conn.workflowAddresses.add(address);
+            addressIndex.set(address, ws);
+        }
+        allocatedConnections.set(identity.allocationId, { ws, identity });
+        for (const address of newlyRoutedAddresses) {
+            await redeliverPendingMail(address, conn);
+        }
+        // Reconcile a reconnecting deployment's credentials, closing the offline
+        // window: a credential revoked, deleted, or rotated while the sidecar was
+        // disconnected is applied to the child now. Fire-and-forget so
+        // registration is not blocked; the lookup no-ops for a run that persisted
+        // no credential refs.
+        const resyncCredentials = lookups.resyncCredentials;
+        if (resyncCredentials !== undefined) {
+            for (const address of newlyRoutedAddresses) {
+                if (!isRunAddress(address))
+                    continue;
+                resyncCredentials(address);
             }
-            catch {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Stored public key is corrupt",
-                });
-                logger.error `Corrupt stored public key for ${address}`;
-                continue;
+        }
+        // Reconcile the sidecar's cached sender keys, closing the offline window: a
+        // user-principal key that rotated while the sidecar was disconnected is
+        // re-resolved and re-pushed, and a sender whose principal was DELETED while
+        // the sidecar was disconnected is evicted, so the recipient stops verifying
+        // either against a key the hub no longer vouches for. Only allocated
+        // sidecars host a sender cache worth reconciling. Resolve and push
+        // SEQUENTIALLY in one detached task: registration is never blocked, and a
+        // large cache cannot fan out into one concurrent DB query per reported
+        // sender on every reconnect.
+        const resolveSenderKeyStrict = lookups.resolveSenderKeyStrict;
+        if (identity.kind === "allocated" && resolveSenderKeyStrict !== undefined) {
+            const rotatableSenders = new Set(cachedSenderAddresses);
+            // Resolve-don't-trust applied to input SIZE: bound the reported set before
+            // acting on it. Run addresses count toward the cap by design -- the
+            // isRunAddress skip below is inside the loop, so the iteration, and thus
+            // the DB resolves, can never exceed the cap regardless of the run/non-run
+            // mix. Over the cap, reconcile the first MAX_RESYNC_SENDER_ADDRESSES and
+            // log the overflow so a misbehaving sidecar is detectable.
+            let sendersToResync = [...rotatableSenders];
+            if (sendersToResync.length > MAX_RESYNC_SENDER_ADDRESSES) {
+                logger.warn `Sidecar ${identity.sidecarId} reported ${String(sendersToResync.length)} cached sender addresses on allocation ${identity.allocationId} generation ${String(identity.generation)}, over the ${String(MAX_RESYNC_SENDER_ADDRESSES)} resync cap; reconciling the first ${String(MAX_RESYNC_SENDER_ADDRESSES)} and ignoring the rest`;
+                sendersToResync = sendersToResync.slice(0, MAX_RESYNC_SENDER_ADDRESSES);
             }
-            const nonce = crypto.getRandomValues(new Uint8Array(32));
-            challenges.set(address, { nonce, publicKey });
-            challengeEntries.push({ address, nonce: hexEncode(nonce) });
+            void (async () => {
+                for (const address of sendersToResync) {
+                    // The sidecar already reports only non-run senders, but do not trust
+                    // the report: a run sender's key is the immutable
+                    // workflow_run.public_key and is never refreshed or evicted, so skip
+                    // it here too rather than couple correctness to the sidecar's filter.
+                    if (isRunAddress(address))
+                        continue;
+                    // Tri-state, deleted-vs-fault distinguished by the STRICT resolver:
+                    //   - resolves to a key -> refresh the sidecar's cached key;
+                    //   - CONFIRMED null (no matching principal = a deleted sender) ->
+                    //     evict it;
+                    //   - THROWS (fault: ambiguous address, keyless-principal invariant
+                    //     break, DB error) -> keep the stale key, evict nothing.
+                    // Never evicting on a fault is the load-bearing property: dropping a
+                    // live key on a transient DB fault would be worse than doing nothing.
+                    // Only the resolve is guarded here; conn.send stays outside so a
+                    // socket-gone throw propagates to the outer catch and stops the loop.
+                    let publicKey;
+                    try {
+                        publicKey = await resolveSenderKeyStrict(address);
+                    }
+                    catch (cause) {
+                        const message = cause instanceof Error ? cause.message : String(cause);
+                        logger.error `Keeping the stale cached key for ${address}: resolving it faulted (a fault, not a deleted sender): ${message}`;
+                        continue;
+                    }
+                    if (publicKey !== null) {
+                        conn.send({ type: "sender.key.refresh", address, publicKey });
+                    }
+                    else {
+                        conn.send({ type: "sender.key.evict", address });
+                    }
+                }
+            })().catch((cause) => {
+                // The per-address resolve is guarded above, so the only throw reaching
+                // here is conn.send (JSON.stringify + the socket write) once the sidecar
+                // is gone. That means the connection left, so stop -- the remaining
+                // sends would fail the same way.
+                const message = cause instanceof Error ? cause.message : String(cause);
+                logger.warn `Sender-key resync for sidecar ${identity.sidecarId} stopped: ${message}`;
+            });
         }
-        if (challenges.size === 0)
-            return;
-        // If another reconnect completed while we were building the
-        // challenge, it will have written its own entry. Don't overwrite.
-        if (pendingChallenges.has(ws))
-            return;
-        const timer = setTimeout(() => {
-            pendingChallenges.delete(ws);
-            logger.warn `Challenge timed out for sidecar ${sidecarId}`;
-        }, challengeTimeoutMs);
-        pendingChallenges.set(ws, {
-            sidecarId,
-            challenges,
-            deployRefs,
-            timer,
-        });
-        conn.send({ type: "challenge", challenges: challengeEntries });
-    }
-    async function handleChallengeResponse(ws, responses) {
-        const challenge = pendingChallenges.get(ws);
-        if (challenge === undefined) {
-            logger.warn `Received challenge.response with no pending challenge`;
-            return;
+        logger.info `Provisioned sidecar ${identity.sidecarId} registered for allocation ${identity.allocationId} generation ${String(identity.generation)}`;
+        await notifyAllocationWaiters(identity.allocationId);
+        if (identity.kind === "allocated") {
+            events.emit("sidecar.allocated.connected", {
+                allocationId: identity.allocationId,
+                generation: identity.generation,
+            });
         }
-        clearTimeout(challenge.timer);
-        pendingChallenges.delete(ws);
-        const conn = connections.get(ws);
-        if (conn === undefined)
-            return;
-        const verified = [];
-        const responded = new Set();
-        for (const { address, signature } of responses) {
-            responded.add(address);
-            const entry = challenge.challenges.get(address);
-            if (entry === undefined) {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Address was not challenged",
-                });
-                continue;
-            }
-            let valid = false;
-            try {
-                const nonceBytes = entry.nonce;
-                const addressBytes = new TextEncoder().encode(address);
-                const payload = new Uint8Array(nonceBytes.length + addressBytes.length);
-                payload.set(nonceBytes);
-                payload.set(addressBytes, nonceBytes.length);
-                const sigBytes = hexDecode(signature);
-                valid = await verifyEd25519(payload, sigBytes, entry.publicKey);
-            }
-            catch (err) {
-                logger.warn `Challenge failed for ${address}: ${err instanceof Error ? err.message : String(err)}`;
-            }
-            if (valid) {
-                verified.push(address);
-            }
-            else {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Signature verification failed",
+    }
+    async function handleRegister(ws, identity, agentAddresses, cachedSenderAddresses) {
+        await handleAllocatedRegister(ws, identity, agentAddresses, cachedSenderAddresses);
+    }
+    async function handleReconnect(ws, identity, agentAddresses, cachedSenderAddresses) {
+        await handleAllocatedRegister(ws, identity, agentAddresses, cachedSenderAddresses);
+    }
+    // Park a pre-ack sender's mail synchronously and return its entry. Registering
+    // the entry BEFORE the caller awaits `resolveSenderKey` is the interlock that
+    // guarantees a settle landing during the resolve has an entry to find: the
+    // event loop is single-threaded, so no settle can interleave between this
+    // synchronous registration and the caller's first await.
+    function parkDeferredSenderMail(authenticatedSender, rawMessage, recipients) {
+        let parked = deferredSenderMail.get(authenticatedSender);
+        if (parked === undefined) {
+            parked = new Set();
+            deferredSenderMail.set(authenticatedSender, parked);
+        }
+        const entry = {
+            authenticatedSender,
+            rawMessage,
+            recipients,
+            timer: setTimeout(() => {
+                // TTL backstop for the case where a settle never arrives (the sender's
+                // deploy never acked and never failed loudly). Claim the entry and
+                // surface it as undelivered so the mail is not held forever.
+                if (!claimDeferredSenderEntry(entry))
+                    return;
+                events.emit("mail.outbound.undelivered", {
+                    rawMessage: entry.rawMessage,
+                    recipients: entry.recipients,
                 });
-            }
+                logger.warn `Dropping mail from ${entry.authenticatedSender}: its sender key was not recorded before the deferred-mail TTL expired`;
+            }, disconnectQueueTTLMs),
+        };
+        parked.add(entry);
+        return entry;
+    }
+    // Remove one parked entry by identity, clearing its TTL timer. Returns whether
+    // THIS call removed it. The inline-deliver path, a settle, and the TTL all
+    // race to claim the same entry; only the claimer acts on it, so a claim that
+    // finds nothing (already claimed) is a no-op. This is the idempotent
+    // remove-by-key that keeps a settle and the inline non-null branch from both
+    // delivering the same message.
+    function claimDeferredSenderEntry(entry) {
+        const parked = deferredSenderMail.get(entry.authenticatedSender);
+        if (parked === undefined)
+            return false;
+        const claimed = parked.delete(entry);
+        if (!claimed)
+            return false;
+        clearTimeout(entry.timer);
+        if (parked.size === 0)
+            deferredSenderMail.delete(entry.authenticatedSender);
+        return true;
+    }
+    // Claim every entry parked for a sender, clearing their TTL timers. A later
+    // settle or TTL for the same sender then finds nothing.
+    function claimAllDeferredSenderMail(authenticatedSender) {
+        const parked = deferredSenderMail.get(authenticatedSender);
+        if (parked === undefined)
+            return [];
+        deferredSenderMail.delete(authenticatedSender);
+        const entries = [...parked];
+        for (const entry of entries)
+            clearTimeout(entry.timer);
+        return entries;
+    }
+    function drainDeferredSenderMail(authenticatedSender, reason) {
+        const entries = claimAllDeferredSenderMail(authenticatedSender);
+        if (entries.length === 0)
+            return;
+        for (const entry of entries) {
+            events.emit("mail.outbound.undelivered", {
+                rawMessage: entry.rawMessage,
+                recipients: entry.recipients,
+            });
         }
-        // Notify about challenged addresses that were omitted from the response.
-        for (const address of challenge.challenges.keys()) {
-            if (!responded.has(address)) {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "No response provided for challenged address",
-                });
-                logger.warn `Challenge failed for ${address}: no response provided`;
-            }
+        logger.warn `Dropping ${String(entries.length)} deferred message(s) from ${authenticatedSender}: ${reason}`;
+    }
+    function noteSenderDeployStarted(address, attempt) {
+        if (allocatedKeyRecordInFlight.has(address)) {
+            throw new Error(`Sender deployment ${address} has an unresolved attempt`);
         }
-        // Add verified addresses to the routing table immediately so that
-        // `agent.reconnected` subscribers can use sendRequest-based methods
-        // (e.g. sendSourcesUpdate). Addresses that fail governance are
-        // rolled back from the routing table afterward.
-        for (const addr of verified) {
-            // If a different ws still owns this address (live takeover via
-            // verified reconnect), evict its cached connector state before
-            // routing flips. The new owner's harness will bootstrap via
-            // restore-fires-callback.
-            const prevWs = addressIndex.get(addr);
-            if (prevWs !== undefined && prevWs !== ws) {
-                connectorStates.delete(addr);
-                // Evict the reclaimed address from the superseded connection's owned
-                // set. handleClose's cancelByAgent sweep iterates a connection's owned
-                // union WITHOUT an ownership guard, so if the stale connection still
-                // listed this address it would cancel THIS connection's in-flight pack
-                // transfer for it when it finally closes. Delete from both sets: a
-                // workflow-derived address lives on the workflow set, a launched agent
-                // on the session set, and delete is a no-op for the absent one.
-                const prevConn = connections.get(prevWs);
-                if (prevConn !== undefined) {
-                    prevConn.workflowAddresses.delete(addr);
-                    prevConn.agentAddresses.delete(addr);
+        allocatedKeyRecordInFlight.set(address, attempt);
+    }
+    function noteSenderDeploySettled(sender, outcome) {
+        if (typeof sender !== "string") {
+            for (const [address, attempt] of [...allocatedKeyRecordInFlight]) {
+                if (attempt.allocationId !== sender.allocationId ||
+                    attempt.generation !== sender.generation ||
+                    ("leaseId" in sender && attempt.leaseId !== sender.leaseId)) {
+                    continue;
                 }
+                allocatedKeyRecordInFlight.delete(address);
+                settleSenderMail(address, outcome);
             }
-            // Track the address on the set that matches its lifecycle so
-            // handleClose reclaims it correctly: a workflow-derived deployment
-            // address goes on the workflow set (no disconnect queue -- its
-            // in-flight state is reconstructed sidecar-locally on the next
-            // reconnect), a launched agent on the session set (queued for
-            // reconnect). The routing pointer is the same either way; only now
-            // it is written behind a passed challenge.
-            if (isWorkflowDerivedAddress(addr)) {
-                conn.workflowAddresses.add(addr);
-            }
-            else {
-                conn.agentAddresses.add(addr);
-            }
-            addressIndex.set(addr, ws);
-        }
-        const ready = [];
-        const failed = [];
-        for (const addr of verified) {
-            // The `agent.reconnected` reaction is session lifecycle -- instance
-            // status flip, event-collector restore -- owned by the agent_instance
-            // concept. A workflow-derived deployment address has no agent_instance
-            // row, so the reaction's `requireInstance` would throw and roll the
-            // just-verified address back out of routing. It needs routing + queue
-            // flush only, which the passed challenge has now made safe; skip the
-            // session reaction for it.
-            if (isWorkflowDerivedAddress(addr)) {
-                ready.push(addr);
-                continue;
-            }
-            if (events.listenerCount("agent.reconnected") === 0) {
-                ready.push(addr);
-                continue;
-            }
-            try {
-                await events.emitAndAwait("agent.reconnected", { agentAddress: addr });
-                ready.push(addr);
-            }
-            catch (err) {
-                logger.error `Failed to handle reconnection for ${addr}: ${err instanceof Error ? err.message : String(err)}`;
-                failed.push(addr);
-            }
+            return;
         }
-        // If a second reconnect arrived during the callback loop, our conn
-        // is orphaned — handleRegister already rebuilt the connection and
-        // cleared addressIndex. Bail out; the new reconnect flow will
-        // re-verify these addresses from scratch.
-        if (connections.get(ws) !== conn) {
-            logger.warn `Challenge response processing aborted: connection superseded by new reconnect`;
-            return;
-        }
-        // Roll back failed addresses from the routing table. Only the session set
-        // is touched: a workflow-derived address can never be in `failed` -- it
-        // early-`continue`s to `ready` above, before the reaction that populates
-        // `failed` -- so it is never on the workflow set at this point.
-        for (const addr of failed) {
-            conn.agentAddresses.delete(addr);
-            addressIndex.delete(addr);
-        }
-        // Flush queued messages only for ready addresses.
-        for (const addr of ready) {
-            flushDisconnectedQueue(addr, conn);
-        }
-        // Re-deploy agents whose deploy ref is stale or absent. Fire-and-forget
-        // so reconnect completion is not blocked on pack transfer. The
-        // wire layer owns the staleness comparison; the event fires only
-        // when staleness is confirmed.
-        const checkDeployRef = lookups.lookupDeployRef;
-        if (checkDeployRef !== undefined) {
-            for (const addr of ready) {
-                // Workflow deployments are pinned-forever: a deployment keeps its
-                // deploy-time definition until an explicit undeploy/redeploy, so the
-                // deploy-ref freshness catch-up is deliberately NOT run for a
-                // workflow-derived address. A definition edited on the hub while the
-                // sidecar was disconnected does not reconcile on reconnect; it affects
-                // only newly created deployments. The deployment's in-flight run state
-                // is reconstructed sidecar-locally at restore, not re-fetched here. Do
-                // NOT add a reconcile path for these addresses -- see the "Workflow
-                // Definition Versioning: Pinned-Forever" note under "Reconnect
-                // Sequencing" in docs/IMPLEMENTATION.md.
-                if (isWorkflowDerivedAddress(addr))
-                    continue;
-                void (async () => {
-                    try {
-                        const hubRef = await checkDeployRef(addr);
-                        if (hubRef === null)
-                            return;
-                        const sidecarRef = challenge.deployRefs[addr];
-                        if (sidecarRef === hubRef)
-                            return;
-                        logger.info `Re-deploying ${addr}: sidecar ref ${sidecarRef ?? "(none)"} != hub ref ${hubRef.slice(0, 8)}`;
-                        await events.emitAndAwait("deploy.ref.stale", {
-                            agentAddress: addr,
-                        });
-                    }
-                    catch (err) {
-                        logger.error `Failed to re-deploy ${addr} after reconnect: ${err instanceof Error ? err.message : String(err)}`;
-                    }
-                })();
-            }
+        if (allocatedKeyRecordInFlight.has(sender))
+            return;
+        settleSenderMail(sender, outcome);
+    }
+    function settleSenderMail(address, outcome) {
+        if ("failed" in outcome) {
+            drainDeferredSenderMail(address, `sender deploy failed: ${outcome.failed}`);
+            return;
         }
-        // Failed addresses: reset their queue TTL so messages survive until
-        // the next reconnect attempt, and notify the sidecar.
-        for (const addr of failed) {
-            const entry = disconnectedAgents.get(addr);
-            if (entry !== undefined) {
-                clearTimeout(entry.timer);
-                entry.timer = setTimeout(() => {
-                    const expired = disconnectedAgents.get(addr);
-                    disconnectedAgents.delete(addr);
-                    if (expired !== undefined) {
-                        surfaceDroppedFrames(addr, expired.queue, "disconnect queue TTL expired");
-                    }
-                }, disconnectQueueTTLMs);
-            }
-            conn.send({
-                type: "challenge.failed",
-                address: addr,
-                reason: "Reconnection rejected by governance",
+        for (const entry of claimAllDeferredSenderMail(address)) {
+            // Re-drive delivery as its OWN task, off the settle's stack, so delivery
+            // work never runs on the deploy-ack handler's stack. Carry the confirmed
+            // key: another attempt may start before this task runs, and must not
+            // capture this mail or change the key that authenticates it.
+            void Promise.resolve()
+                .then(() => handleMailOutbound(entry.rawMessage, entry.authenticatedSender, entry.recipients, outcome.recorded))
+                .catch((err) => {
+                logger.error `Re-driving deferred mail from ${entry.authenticatedSender} failed: ${err instanceof Error ? err.message : String(err)}`;
             });
         }
-        logger.info `Sidecar ${challenge.sidecarId} reconnected with ${String(ready.length)} verified agent(s)${failed.length > 0 ? `, ${String(failed.length)} rejected` : ""}`;
     }
-    function handleMailOutbound(rawMessage, recipients) {
+    function senderIdentitiesFromKey(address, publicKey) {
+        return publicKey !== null ? [{ address, publicKey }] : undefined;
+    }
+    // Resolve the co-delivered sender identities for a message, applying the
+    // register-before-read interlock for a pre-ack run sender. Returns either
+    // `deliver: true` with the resolved identities (undefined when there is no
+    // resolvable key), or `deliver: false` when the message is parked and will be
+    // driven later by a settle (`noteSenderDeploySettled`) or the TTL.
+    async function resolveSenderIdentitiesOrPark(rawMessage, authenticatedSender, recipients) {
+        const resolveSenderKey = lookups.resolveSenderKey;
+        if (resolveSenderKey === undefined)
+            return { deliver: true, senderIdentities: undefined };
+        // The co-delivered key is consumed only by a run recipient caching it from the
+        // run.grants frame. Purely external/federated mail never uses it and is never
+        // locally verified, so resolve nothing and never park it.
+        if (!recipients.some(isRunAddress))
+            return { deliver: true, senderIdentities: undefined };
+        // A stable-key (non-run) sender has no pre-ack window; resolve inline.
+        if (!isRunAddress(authenticatedSender)) {
+            const key = await resolveSenderKey(authenticatedSender);
+            return {
+                deliver: true,
+                senderIdentities: senderIdentitiesFromKey(authenticatedSender, key),
+            };
+        }
+        // Park a run sender ONLY while a key-record settle is guaranteed to arrive -- a
+        // deploy is in flight. Without one, a null resolve is a transient fault or a
+        // genuine absence on an already-settled run: no settle is coming, so parking
+        // would strand the mail to the TTL. Deliver on the normal path instead.
+        const settleGuaranteed = pendingDeploys.has(authenticatedSender) ||
+            allocatedKeyRecordInFlight.has(authenticatedSender);
+        if (!settleGuaranteed) {
+            const key = await resolveSenderKey(authenticatedSender);
+            return {
+                deliver: true,
+                senderIdentities: senderIdentitiesFromKey(authenticatedSender, key),
+            };
+        }
+        // Register-before-read: park a waiter entry synchronously (NO await) so a
+        // settle that lands while we resolve below has an entry to find, THEN
+        // resolve. The single-threaded event loop cannot interleave a settle between
+        // this registration and the await.
+        const entry = parkDeferredSenderMail(authenticatedSender, rawMessage, recipients);
+        const key = await resolveSenderKey(authenticatedSender);
+        if (key === null) {
+            // Not recorded yet. Leave the entry parked; a settle or the TTL drives it.
+            return { deliver: false };
+        }
+        // The key was already recorded before we parked. Claim our entry and deliver
+        // inline -- unless a concurrent settle already claimed it and is re-driving
+        // this message, in which case claiming fails and we must NOT deliver again.
+        if (!claimDeferredSenderEntry(entry)) {
+            return { deliver: false };
+        }
+        return {
+            deliver: true,
+            senderIdentities: senderIdentitiesFromKey(authenticatedSender, key),
+        };
+    }
+    async function handleMailOutbound(rawMessage, authenticatedSender, recipients, recordedSenderKey) {
+        // A mail addressed to more than one workflow deployment would birth a
+        // run per recipient from a single inbound mail. The stable runId
+        // removed the Message-ID collision that originally forced this guard --
+        // each recipient now derives its own per-deployment runId (its mail
+        // address), so it is no longer a runId-collision guard. It stays a
+        // deliberate one-workflow-recipient-per-mail restriction because the
+        // fan-out is not verified end-to-end: per-recipient grants
+        // materialization, consumed-tracking, and reply-addressing all assume a
+        // single workflow recipient today. Lifting it means proving those three
+        // hold per recipient, not just relaxing this check -- so fail loudly
+        // rather than materialize a partial set. The guard only applies when a
+        // materializer is wired -- absent one, no run is born from the mail, so
+        // there is nothing to restrict.
+        if (lookups.materializeMailTriggeredRunGrants !== undefined) {
+            // A workflow recipient is one this hub owns: its address parses as a run
+            // address. An external/federated address does not, and is not ours to
+            // materialize a run for.
+            const workflowRecipients = recipients.filter(isRunAddress);
+            if (workflowRecipients.length > 1) {
+                throw new Error(`mail addressed to multiple workflow-derived recipients (${workflowRecipients.join(", ")}); materializing a run for more than one workflow deployment from a single mail is unsupported`);
+            }
+        }
+        // Resolve the sender's hub-held key ONCE for the whole message, ahead of the
+        // recipient fan-out and any grant materialization, so every recipient in
+        // this fan-out binds the same key snapshot. A run-address sender may be
+        // pre-ack -- it minted its keypair locally and can send before the hub
+        // records its public key. The register-before-read interlock holds such mail
+        // until the key lands rather than delivering it keyless, which a strict
+        // recipient drops as an unknown sender. A parked message returns here and is
+        // re-driven later by a settle or the TTL.
+        const resolution = recordedSenderKey === undefined
+            ? await resolveSenderIdentitiesOrPark(rawMessage, authenticatedSender, recipients)
+            : {
+                deliver: true,
+                senderIdentities: senderIdentitiesFromKey(authenticatedSender, recordedSenderKey),
+            };
+        if (!resolution.deliver)
+            return;
+        const senderIdentities = resolution.senderIdentities;
         // Route to locally connected sidecars first, then try disconnect queues.
         const unrouted = [];
         for (const recipient of recipients) {
-            const targetWs = addressIndex.get(recipient);
-            if (targetWs !== undefined) {
-                const conn = connections.get(targetWs);
-                if (conn !== undefined) {
-                    conn.send({
-                        type: "mail.inbound",
-                        agentAddress: recipient,
-                        rawMessage,
-                    });
-                    continue;
-                }
+            // Each recipient is isolated: a materialization failure or a
+            // fail-closed rejection for one must not drop the mail for its
+            // co-recipients. The catch fails THIS recipient closed (its run never
+            // starts under-authorized) and continues to the rest.
+            try {
+                const outcome = await deliverMailToRecipient(recipient, rawMessage, authenticatedSender, senderIdentities);
+                if (outcome === "unrouted")
+                    unrouted.push(recipient);
+            }
+            catch (err) {
+                logger.error `Failed to deliver mail to ${recipient}: ${err instanceof Error ? err.message : String(err)}`;
             }
-            const frame = {
-                type: "mail.inbound",
-                agentAddress: recipient,
-                rawMessage,
-            };
-            if (enqueueForDisconnected(recipient, frame))
-                continue;
-            unrouted.push(recipient);
         }
         // Anything not routed locally is emitted as a notification. The
         // host decides whether to relay onto an external transport, log,
@@ -814,6 +1238,95 @@ export function createSidecarRouter(config) {
             });
         }
     }
+    // Deliver an inbound mail to one recipient, materializing a
+    // mail-triggered run's grants first when the recipient is a workflow
+    // deployment. Returns:
+    //   - `routed`: the mail reached a live connection or disconnect queue.
+    //   - `unrouted`: the mail was locally undeliverable and should be
+    //     relayed externally by the host.
+    //   - `failed-closed`: the run's grants could not be materialized safely,
+    //     so the mail is deliberately DROPPED for this recipient (not relayed)
+    //     to keep its run from starting under-authorized.
+    //
+    // A workflow deployment is the only recipient whose inbound mail can first
+    // fire its stable run. Its grants are reserved, and the `run.grants` frame is
+    // sent BEFORE the mail. Same-address FIFO guarantees it lands ahead of the
+    // mail that dispatches the run, so the run's `onRunStart` barrier resolves its
+    // grants rather than failing closed. Reservation happens before routing so
+    // concurrent first deliveries cannot send different snapshots; a routing
+    // failure leaves a grants-only, still-unfired run.
+    async function deliverMailToRecipient(recipient, rawMessage, authenticatedSender, senderIdentities) {
+        if (lookups.materializeMailTriggeredRunGrants !== undefined &&
+            isRunAddress(recipient)) {
+            const runId = deriveWorkflowRunId(recipient);
+            // This does NOT let mail mutate a run's authorization. First delivery
+            // reserves and commits the run's grants (the mail IS the trigger);
+            // every later delivery only RE-READS the current committed grants
+            // (`loadCommittedRunGrants`) and re-asserts them ahead of the dispatch.
+            // The committed rows already carry any standing-approval change (an
+            // approve/reject-with-`always` resolution mutates them through its own
+            // path), so this re-send is idempotent -- it re-establishes the run's
+            // current floor on the sidecar, self-healing a `grants.json` a sidecar
+            // may have lost, and never overwrites it with anything staler.
+            const result = await lookups.materializeMailTriggeredRunGrants({
+                agentAddress: recipient,
+                runId,
+            });
+            if (result.outcome === "rejected") {
+                // The run's grants could not be materialized with sufficient
+                // authority or it is already terminal. Fail the mail closed for this
+                // recipient: routing or external relay would bypass that decision.
+                logger.error `Refusing mail-triggered run ${runId} for ${recipient}: grant materialization rejected (${result.code}): ${result.message}`;
+                return "failed-closed";
+            }
+            if (result.outcome === "materialized") {
+                // The sender's hub-held key was resolved ONCE in handleMailOutbound,
+                // ahead of this fan-out, and threaded in as `senderIdentities`. Co-
+                // deliver it on the run's grants barrier so a recipient that caches from
+                // the `run.grants` frame binds the sender address to the key and can
+                // verify the sender's mail locally. A null key is never carried (the
+                // list is undefined then), so the "authorized-with-a-key implies key
+                // cached" invariant holds; a recipient with no cached key resolves such
+                // mail as `unknown`, which its admission policy rejects by default (a
+                // workflow may relax `unknown` to admit).
+                // Finish asynchronous preparation before sending the grants and mail
+                // together, keeping another delivery's key out of the gap between them.
+                const messageId = await deriveMessageId(base64Decode(rawMessage));
+                // Send the run's grants ahead of the mail. A `false` here means the
+                // deployment is unroutable. Do not route the mail that would dispatch
+                // it; the grants-only reservation remains the canonical snapshot for a
+                // later first-delivery attempt.
+                if (!sendRunGrants(recipient, runId, result.stepGrants, senderIdentities)) {
+                    logger.error `Deployment ${recipient} is not routable for run ${runId}; retaining the unfired run's grant reservation for retry`;
+                    return "unrouted";
+                }
+                // Route through the messageId handshake `routeMail` -- NOT a
+                // fire-and-forget send. This branch COMMITS a run, so a mail dropped in
+                // the connected window (a socket that half-dies before the sidecar's
+                // durable-write ack) would otherwise leave the run row "running"
+                // forever with no body and no error. `routeMail` tracks the delivery
+                // and redelivers identical bytes on reconnect, bringing the mail-relay
+                // run-trigger to parity with the HTTP-trigger path. The messageId is the
+                // mail's own id (derived over the same bytes the sidecar derives), so a
+                // redelivery replays identically and the downstream RunStarted /
+                // stable-runId dedup makes it effectively-once.
+                const outcome = routeMail(recipient, rawMessage, authenticatedSender, messageId, {
+                    runId,
+                    stepGrants: result.stepGrants,
+                    ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+                })
+                    ? "routed"
+                    : "unrouted";
+                return outcome;
+            }
+            // `skip`: the address named no deployed workflow deployment. Forward
+            // the mail without grants -- the run, if any, is not ours to
+            // authorize. No run is committed here, so no ack handshake is needed.
+        }
+        return routeMail(recipient, rawMessage, authenticatedSender)
+            ? "routed"
+            : "unrouted";
+    }
     async function handleMailPersist(persist, rawMessage, senderAddress, recipients) {
         let results;
         let raw;
@@ -835,15 +1348,60 @@ export function createSidecarRouter(config) {
                 raw,
                 createdAt: result.createdAt,
                 direction: result.direction,
-                instanceId: result.instanceId,
+                runId: result.runId,
                 address: result.address,
             });
         }
     }
+    async function handleSignalCorrelationRegister(ws, frame) {
+        // Gate the co-write on the sending sidecar actually owning the named
+        // deployment address, mirroring the connector.state.changed and pack
+        // handlers. A workflow deployment routes on the keyless workflow set, so
+        // ownership is the union check, not addressIndex identity alone. Without
+        // it a misbehaving sidecar that knows another deployment's address could
+        // register a spurious correlation against it.
+        const conn = connections.get(ws);
+        if (conn === undefined)
+            return;
+        if (!connOwnsAddress(conn, frame.agentAddress)) {
+            logger.warn `Dropping signal.correlation.register for ${frame.agentAddress}: not registered to this sidecar`;
+            return;
+        }
+        const register = lookups.registerSignalCorrelation;
+        if (register === undefined) {
+            logger.warn `Dropping signal.correlation.register for ${frame.agentAddress}: no registerSignalCorrelation lookup configured`;
+            return;
+        }
+        try {
+            await register({
+                correlationId: frame.correlationId,
+                runId: frame.runId,
+                anchorRunId: frame.anchorRunId,
+                agentAddress: frame.agentAddress,
+                kind: frame.kind,
+                approvalSnapshot: frame.snapshot,
+            });
+            // The co-write resolves only when a row exists -- freshly inserted or
+            // already present (both stores are idempotent on the correlationId). Ack
+            // so the sidecar's link stops retrying a register whose frame may have
+            // been lost on an open socket. A thrown co-write (undeployed deployment,
+            // id mismatch) means no row, so no ack: the sidecar keeps retrying and
+            // the reconnect re-emit remains the ultimate backstop.
+            conn.send({
+                type: "signal.correlation.register.ack",
+                agentAddress: frame.agentAddress,
+                correlationId: frame.correlationId,
+            });
+        }
+        catch (err) {
+            logger.error `Failed to register signal correlation ${frame.correlationId} for ${frame.agentAddress}: ${err instanceof Error ? err.message : String(err)}`;
+        }
+    }
     function handleClose(ws) {
         const conn = connections.get(ws);
         if (conn === undefined)
             return;
+        let allocated;
         for (const addr of conn.agentAddresses) {
             // Only remove routing and pending state if this connection still
             // owns the address. A reconnected sidecar may have already claimed it.
@@ -855,12 +1413,12 @@ export function createSidecarRouter(config) {
                 // reconnect re-bootstraps via the router's
                 // restore-fires-callback path.
                 connectorStates.delete(addr);
-                const deployReq = pendingDeploys.get(addr);
-                if (deployReq !== undefined && deployReq.ws === ws) {
-                    clearTimeout(deployReq.timer);
-                    pendingDeploys.delete(addr);
-                    deployReq.reject(`Sidecar ${conn.sidecarId} disconnected`);
-                }
+                // Retain this address's un-acked pending mail across the disconnect:
+                // its in-flight retry timers target a dead socket (cleared), but the
+                // entries are held so a verified reconnect redelivers them, closing the
+                // connected-window drop rather than losing the mail. Bounded by a
+                // retention TTL.
+                retainPendingMailForAddress(addr);
                 // Create a queue entry so messages can accumulate while the
                 // sidecar is disconnected. Skip if the agent is being undeployed --
                 // there is no point queuing messages for an agent being torn down.
@@ -885,47 +1443,52 @@ export function createSidecarRouter(config) {
         for (const addr of conn.workflowAddresses) {
             if (addressIndex.get(addr) === ws) {
                 addressIndex.delete(addr);
+                connectorStates.delete(addr);
+                // Retain un-acked workflow trigger mail across the disconnect for the
+                // same reason as the session loop above -- an authenticated reconnect
+                // redelivers it. This is un-acked TRIGGER mail, distinct from the
+                // deployment's in-flight run state (reconstructed sidecar-locally); the
+                // "no disconnect queue" note above is about that run state, not this.
+                retainPendingMailForAddress(addr);
+            }
+        }
+        const current = allocatedConnections.get(conn.identity.allocationId);
+        if (current?.ws === ws) {
+            allocatedConnections.delete(conn.identity.allocationId);
+            if (conn.identity.kind === "allocated") {
+                allocated = {
+                    allocationId: conn.identity.allocationId,
+                    generation: conn.identity.generation,
+                };
             }
         }
         connections.delete(ws);
         // Cancel the liveness timer for this connection.
-        const livenessTimer = livenessTimers.get(ws);
-        if (livenessTimer !== undefined) {
-            clearTimeout(livenessTimer);
+        const cancelLiveness = livenessTimers.get(ws);
+        if (cancelLiveness !== undefined) {
+            cancelLiveness();
             livenessTimers.delete(ws);
         }
         // Drop the per-ws serialization chain; no more frames will queue on it.
         messageChains.delete(ws);
-        // Cancel any pending challenge for this connection.
-        const challengeReq = pendingChallenges.get(ws);
-        if (challengeReq !== undefined) {
-            clearTimeout(challengeReq.timer);
-            pendingChallenges.delete(ws);
-        }
-        // Reject any in-flight requests that were sent to this sidecar.
-        for (const [requestId, req] of pending) {
-            if (req.ws !== ws)
-                continue;
-            clearTimeout(req.timer);
-            pending.delete(requestId);
-            req.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        // Reject any in-flight requests that were sent to this sidecar. Each
+        // entry's reject closure runs its own per-site cleanup (the deploy and
+        // undeploy closures roll routing back), exactly as a frame-error
+        // rejection would.
+        pendingRequests.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
+        // Reject every deploy issued on this socket, including allocated
+        // workflow deployments stored in `workflowAddresses` rather than
+        // `agentAddresses`.
+        pendingDeploys.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Reject any in-flight pack transfers for this sidecar.
-        for (const [transferId, pack] of pendingPacks) {
-            if (pack.ws !== ws)
-                continue;
-            clearTimeout(pack.timer);
-            pendingPacks.delete(transferId);
-            pack.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        pendingPacks.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Reject any in-flight undeploys for this sidecar.
-        for (const [addr, req] of pendingUndeploys) {
-            if (req.ws !== ws)
-                continue;
-            clearTimeout(req.timer);
-            pendingUndeploys.delete(addr);
-            req.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        pendingUndeploys.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
+        // Reject any in-flight probes sent to this sidecar. A probe never enters
+        // the address maps, so this ws-keyed sweep is its ONLY disconnect cleanup:
+        // without it a probe whose sidecar drops mid-flight would hang until its
+        // own timeout instead of failing fast on the disconnect.
+        pendingProbes.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Cancel any in-flight inbound pack transfers from this sidecar
         // across both receivers. The two receivers track their own in-
         // flight transferIds, so a pending workflow-run transfer for an
@@ -944,6 +1507,7 @@ export function createSidecarRouter(config) {
         }
         events.emit("sidecar.disconnect", {
             ownedAddresses: [...owned],
+            ...(allocated !== undefined ? { allocated } : {}),
         });
         logger.info `Sidecar ${conn.sidecarId} disconnected`;
     }
@@ -962,71 +1526,78 @@ export function createSidecarRouter(config) {
         const requestId = nextRequestId();
         const frame = buildFrame(requestId);
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pending.delete(requestId);
-                reject(new Error(`Request ${requestId} timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
-            pending.set(requestId, {
-                requestId,
-                ws,
+            pendingRequests.register(requestId, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Request ${requestId} timed out after ${requestTimeoutMs}ms`,
                 resolve,
                 reject(error) {
                     reject(new Error(error));
                 },
-                timer,
-            });
+            }, undefined);
             conn.send(frame);
         });
     }
-    function resolvePending(requestId) {
-        const req = pending.get(requestId);
-        if (req === undefined)
-            return;
-        clearTimeout(req.timer);
-        pending.delete(requestId);
-        req.resolve();
+    function packResponseMatches(entry, ws, frame) {
+        return (entry.ws === ws &&
+            entry.meta.agentAddress === frame.agentAddress &&
+            entry.meta.repoId.kind === frame.repoId.kind &&
+            entry.meta.repoId.id === frame.repoId.id);
     }
-    function rejectPending(requestId, error) {
-        const req = pending.get(requestId);
-        if (req === undefined)
-            return;
-        clearTimeout(req.timer);
-        pending.delete(requestId);
-        req.reject(error);
-    }
-    function resolvePackPending(transferId) {
-        const entry = pendingPacks.get(transferId);
+    function resolvePackPending(ws, frame) {
+        const entry = pendingPacks.get(frame.transferId);
         if (entry === undefined)
             return;
-        clearTimeout(entry.timer);
-        pendingPacks.delete(transferId);
-        entry.resolve();
+        if (!packResponseMatches(entry, ws, frame)) {
+            logger.warn `Ignoring repo.pack.ack for transfer ${frame.transferId} from a connection that does not own the pending transfer`;
+            return;
+        }
+        pendingPacks.resolve(frame.transferId);
     }
-    function rejectPackPending(transferId, reason) {
-        const entry = pendingPacks.get(transferId);
+    function rejectPackPending(ws, frame) {
+        const entry = pendingPacks.get(frame.transferId);
         if (entry === undefined)
             return;
-        clearTimeout(entry.timer);
-        pendingPacks.delete(transferId);
-        entry.reject(reason);
+        if (!packResponseMatches(entry, ws, frame)) {
+            logger.warn `Ignoring repo.pack.reject for transfer ${frame.transferId} from a connection that does not own the pending transfer`;
+            return;
+        }
+        // Surface the receiver's specific cause when it carried one, so the awaiting
+        // push sees "corrupt: <detail>" rather than only the coarse reason. The
+        // "Pack rejected:" prefix is applied here rather than in the entry's
+        // reject closure because a TIMEOUT rejection must not carry it.
+        pendingPacks.reject(frame.transferId, `Pack rejected: ${frame.detail !== undefined
+            ? `${frame.reason}: ${frame.detail}`
+            : frame.reason}`);
     }
-    function resolveUndeployPending(agentAddress) {
+    function resolveUndeployPending(ws, agentAddress) {
         const req = pendingUndeploys.get(agentAddress);
         if (req === undefined) {
             logger.warn `Received agent.undeploy.ack for "${agentAddress}" with no pending undeploy`;
             return;
         }
-        clearTimeout(req.timer);
-        pendingUndeploys.delete(agentAddress);
-        req.resolve();
+        if (req.ws !== ws)
+            return;
+        pendingUndeploys.resolve(agentAddress);
     }
-    function rejectUndeployPending(agentAddress, error) {
+    function rejectUndeployPending(ws, agentAddress, error) {
         const req = pendingUndeploys.get(agentAddress);
         if (req === undefined)
             return;
-        clearTimeout(req.timer);
-        pendingUndeploys.delete(agentAddress);
-        req.reject(error);
+        if (req.ws !== ws)
+            return;
+        pendingUndeploys.reject(agentAddress, error);
+    }
+    function resolveProbe(ws, requestId, result) {
+        const req = pendingProbes.get(requestId);
+        if (req === undefined || req.ws !== ws)
+            return;
+        pendingProbes.resolve(requestId, result);
+    }
+    function rejectProbe(ws, requestId, error) {
+        const req = pendingProbes.get(requestId);
+        if (req === undefined || req.ws !== ws)
+            return;
+        pendingProbes.reject(requestId, error);
     }
     // Routing rule: pick the receiver dedicated to the repoId.kind the
     // frame carries. The receivers' in-flight state is independent, so a
@@ -1048,6 +1619,8 @@ export function createSidecarRouter(config) {
     function pickReceivePackLookup(repoId) {
         switch (repoId.kind) {
             case "agent-state":
+                // The agent-state lookup ignores the `source` argument the workflow-run
+                // lookup takes; the two are otherwise the same contract.
                 return lookups.receiveAgentStatePack;
             case "workflow-run":
                 return lookups.receiveWorkflowRunPack;
@@ -1063,6 +1636,19 @@ export function createSidecarRouter(config) {
             logger.warn `Received repo.pack.push for unrouted agent ${frame.agentAddress}`;
             return;
         }
+        if (!connCanPushRepo(conn, frame.agentAddress, frame.repoId)) {
+            logger.warn `Rejected repo.pack.push outside sidecar ${conn.sidecarId}'s authenticated repository scope`;
+            conn.send({
+                type: "repo.pack.reject",
+                agentAddress: frame.agentAddress,
+                repoId: frame.repoId,
+                transferId: frame.transferId,
+                reason: "path_violation",
+            });
+            return;
+        }
+        if (conn.identity.kind !== "allocated")
+            return;
         const picked = pickPackReceiver(frame.repoId);
         if (picked === null) {
             logger.warn `Received repo.pack.push with unsupported repoId.kind ${frame.repoId.kind}`;
@@ -1094,6 +1680,20 @@ export function createSidecarRouter(config) {
             logger.warn `Received repo.pack.done for unrouted agent ${frame.agentAddress}`;
             return;
         }
+        if (!connCanPushRepo(conn, frame.agentAddress, frame.repoId)) {
+            logger.warn `Rejected repo.pack.done outside sidecar ${conn.sidecarId}'s authenticated repository scope`;
+            conn.send({
+                type: "repo.pack.reject",
+                agentAddress: frame.agentAddress,
+                repoId: frame.repoId,
+                transferId: frame.transferId,
+                reason: "path_violation",
+            });
+            return;
+        }
+        if (conn.identity.kind !== "allocated")
+            return;
+        const identity = conn.identity;
         const picked = pickPackReceiver(frame.repoId);
         if (picked === null) {
             logger.warn `Received repo.pack.done with unsupported repoId.kind ${frame.repoId.kind}`;
@@ -1127,7 +1727,13 @@ export function createSidecarRouter(config) {
             });
             return;
         }
-        const verdict = await receivePackLookup(frame.repoId, result.pack, result.ref, result.commitSha);
+        const verdict = await receivePackLookup(frame.repoId, result.pack, result.ref, result.commitSha, {
+            kind: "allocated",
+            agentAddress: frame.agentAddress,
+            allocationId: identity.allocationId,
+            anchorRunId: identity.anchorRunId,
+            generation: identity.generation,
+        });
         // Connection may have closed during async verification.
         const currentConn = connections.get(ws);
         if (currentConn === undefined)
@@ -1155,53 +1761,220 @@ export function createSidecarRouter(config) {
      * window of a multi-step deploy, so `sendPack` can route the step's deploy
      * and asset packs before the deployment-level frame spawns the child.
      *
-     * The address is hub-minted and workflow-derived (no per-address key), so
-     * it enters the keyless `workflowAddresses` set -- never the challenged
-     * `agentAddresses` set -- and is torn down by `unbindStepRoute` once the
+     * The address is Hub-minted and workflow-derived, so it enters the
+     * `workflowAddresses` set rather than the legacy `agentAddresses` set and is
+     * torn down by `unbindStepRoute` once the
      * step's packs land. `handleClose` reclaims it if the sidecar drops
      * mid-stage. Per-step addresses are not runtime-routed (mail, signals, and
      * drains use the deployment address), so the binding is transient: it is
      * never persisted into the reconnect set and never resurrected on
      * reconnect.
      */
-    function bindStepRoute(stepAddress) {
-        const ws = addressIndex.get(stepAddress) ?? findSidecarForNewAgent(stepAddress);
-        if (ws === undefined) {
-            throw new Error(`No sidecar available to stage workflow step "${stepAddress}"`);
+    function fenceAllocation(allocationId, generation) {
+        const existing = allocationFences.get(allocationId);
+        if (existing !== undefined && generation < existing) {
+            throw new Error(`Cannot move allocation ${allocationId} fence backward from ${String(existing)} to ${String(generation)}`);
+        }
+        allocationFences.set(allocationId, generation);
+        // A durable generation advance resolves unfinished initialization as failed.
+        // This also covers a cleanup transaction whose response was lost: the next
+        // reconciliation rebuilds this fence before it can start a replacement.
+        for (const attempt of [...allocatedKeyRecordInFlight.values()]) {
+            if (attempt.allocationId === allocationId &&
+                attempt.generation < generation) {
+                noteSenderDeploySettled(attempt, {
+                    failed: `Allocation ${allocationId} advanced beyond the deployment attempt`,
+                });
+            }
         }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            throw new Error(`No sidecar connected to stage workflow step "${stepAddress}"`);
+        const current = allocatedConnections.get(allocationId);
+        if (current !== undefined && current.identity.generation !== generation) {
+            handleClose(current.ws);
+            current.ws.close();
+        }
+        const waiters = allocationWaiters.get(allocationId);
+        if (waiters === undefined)
+            return;
+        for (const waiter of [...waiters]) {
+            if (waiter.generation === generation)
+                continue;
+            clearTimeout(waiter.timer);
+            waiters.delete(waiter);
+            waiter.reject(new Error(`Allocation ${allocationId} advanced to generation ${String(generation)}`));
+        }
+        if (waiters.size === 0)
+            allocationWaiters.delete(allocationId);
+    }
+    function retireAllocation(target) {
+        if (allocationFences.get(target.allocationId) !== target.generation)
+            return;
+        disconnectAllocation(target);
+        allocationFences.delete(target.allocationId);
+        // The fence is gone, so a lingering attempt can never settle normally.
+        // Fail it here rather than leaving a marker that blocks the address.
+        for (const attempt of [...allocatedKeyRecordInFlight.values()]) {
+            if (attempt.allocationId === target.allocationId &&
+                attempt.generation <= target.generation) {
+                noteSenderDeploySettled(attempt, {
+                    failed: `Allocation ${target.allocationId} generation ${String(target.generation)} retired`,
+                });
+            }
+        }
+        const waiters = allocationWaiters.get(target.allocationId);
+        if (waiters === undefined)
+            return;
+        allocationWaiters.delete(target.allocationId);
+        for (const waiter of waiters) {
+            clearTimeout(waiter.timer);
+            waiter.reject(new Error(`Allocation ${target.allocationId} generation ${String(target.generation)} retired`));
+        }
+    }
+    async function getProvisionedConnection(target, use) {
+        if (allocationFences.get(target.allocationId) !== target.generation) {
+            throw new Error(`Allocation ${target.allocationId} generation ${String(target.generation)} is not current`);
+        }
+        const current = allocatedConnections.get(target.allocationId);
+        if (current === undefined ||
+            current.identity.generation !== target.generation) {
+            throw new Error(`Allocated sidecar is not connected for allocation ${target.allocationId} generation ${String(target.generation)}`);
+        }
+        let identityCurrent;
+        try {
+            identityCurrent = await validateSidecarIdentity(current.identity, use);
+        }
+        catch (cause) {
+            throw new SidecarIdentityValidationError(target.allocationId, target.generation, cause);
+        }
+        if (!identityCurrent) {
+            if (allocatedConnections.get(target.allocationId) === current) {
+                handleClose(current.ws);
+                current.ws.close();
+            }
+            throw new Error(`Allocated sidecar identity is no longer current for allocation ${target.allocationId}`);
+        }
+        if (allocatedConnections.get(target.allocationId) !== current) {
+            throw new Error(`Allocated sidecar connection changed for allocation ${target.allocationId}`);
+        }
+        const conn = connections.get(current.ws);
+        if (conn === undefined ||
+            conn.identity.allocationId !== target.allocationId ||
+            conn.identity.generation !== target.generation) {
+            throw new Error(`Allocated sidecar is not connected for allocation ${target.allocationId}`);
+        }
+        return { ws: current.ws, conn };
+    }
+    async function getAllocatedConnection(target, use) {
+        const current = await getProvisionedConnection(target, use);
+        if (current.conn.identity.kind !== "allocated") {
+            throw new Error(`Allocation ${target.allocationId} is connected as probe capacity`);
+        }
+        return {
+            ws: current.ws,
+            conn: { ...current.conn, identity: current.conn.identity },
+        };
+    }
+    async function isAllocatedSidecarReady(target) {
+        try {
+            await getProvisionedConnection(target, "readiness");
+            return true;
+        }
+        catch (error) {
+            // A failed validation is unknown, not absent: the worker may be healthy
+            // behind a failed lookup, so report it distinctly instead of answering
+            // `false` and letting the caller release a live worker.
+            if (error instanceof SidecarIdentityValidationError)
+                throw error;
+            return false;
+        }
+    }
+    async function isAllocatedWorkflowActive(target) {
+        try {
+            const { conn } = await getAllocatedConnection(target, "readiness");
+            if (conn.identity.kind !== "allocated")
+                return false;
+            return conn.workflowAddresses.has(conn.identity.workflowRunAddress);
+        }
+        catch (error) {
+            if (error instanceof SidecarIdentityValidationError)
+                throw error;
+            return false;
+        }
+    }
+    async function waitForAllocatedSidecar(target, timeoutMs, onValidation) {
+        // An indeterminable worker waits out the unknown while time remains: only
+        // confirmed absence may surface as a connection timeout. At expiry the
+        // wait reports the validation failure rather than a missed deadline, so
+        // the caller retries instead of releasing a worker that may be healthy.
+        let validationFailure;
+        try {
+            if (await isAllocatedSidecarReady(target))
+                return;
+        }
+        catch (error) {
+            if (!(error instanceof SidecarIdentityValidationError))
+                throw error;
+            validationFailure = error;
+        }
+        if (allocationFences.get(target.allocationId) !== target.generation) {
+            throw new Error(`Allocation ${target.allocationId} generation ${String(target.generation)} is not current`);
+        }
+        if (timeoutMs <= 0) {
+            if (validationFailure !== undefined)
+                throw validationFailure;
+            throw new Error(`Timed out waiting for allocated sidecar ${target.allocationId}`);
+        }
+        await new Promise((resolve, reject) => {
+            const waiter = {
+                generation: target.generation,
+                validations: new Set(),
+                ...(onValidation !== undefined ? { onValidation } : {}),
+                resolve,
+                reject,
+                timer: setTimeout(() => {
+                    const current = allocationWaiters.get(target.allocationId);
+                    current?.delete(waiter);
+                    if (current?.size === 0) {
+                        allocationWaiters.delete(target.allocationId);
+                    }
+                    reject(waiter.validationFailure ??
+                        (waiter.validations.size > 0
+                            ? new SidecarIdentityValidationError(target.allocationId, target.generation)
+                            : new Error(`Timed out waiting for allocated sidecar ${target.allocationId} generation ${String(target.generation)}`)));
+                }, timeoutMs),
+                ...(validationFailure !== undefined ? { validationFailure } : {}),
+            };
+            let waiters = allocationWaiters.get(target.allocationId);
+            if (waiters === undefined) {
+                waiters = new Set();
+                allocationWaiters.set(target.allocationId, waiters);
+            }
+            waiters.add(waiter);
+            void notifyAllocationWaiters(target.allocationId);
+        });
+    }
+    async function bindAllocatedStepRoute(target, stepAddress) {
+        const { ws, conn } = await getAllocatedConnection(target, "routing");
+        const existing = addressIndex.get(stepAddress);
+        if (existing !== undefined && existing !== ws) {
+            throw new Error(`Workflow step ${stepAddress} is already routed to another sidecar`);
         }
         conn.workflowAddresses.add(stepAddress);
         addressIndex.set(stepAddress, ws);
     }
-    /**
-     * Remove a per-step route bound by `bindStepRoute` once the step's packs
-     * have landed. Idempotent: an address that was never bound (or already
-     * unbound, e.g. by a mid-stage `handleClose`) is a no-op.
-     */
-    function unbindStepRoute(stepAddress) {
-        const ws = addressIndex.get(stepAddress);
-        if (ws === undefined)
+    function unbindAllocatedStepRoute(target, stepAddress) {
+        const current = allocatedConnections.get(target.allocationId);
+        if (current === undefined ||
+            current.identity.generation !== target.generation) {
             return;
-        const conn = connections.get(ws);
-        if (conn !== undefined) {
-            conn.workflowAddresses.delete(stepAddress);
         }
+        if (addressIndex.get(stepAddress) !== current.ws)
+            return;
+        connections.get(current.ws)?.workflowAddresses.delete(stepAddress);
         addressIndex.delete(stepAddress);
     }
     // Pack transfers may take longer than session requests due to data volume.
     const PACK_TIMEOUT_MS = requestTimeoutMs * 4;
-    function sendPack(agentAddress, pack, ref, commitSha, options) {
-        const ws = addressIndex.get(agentAddress);
-        if (ws === undefined) {
-            return Promise.reject(new Error(`No sidecar connected for agent "${agentAddress}"`));
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            return Promise.reject(new Error(`No sidecar connected for agent "${agentAddress}"`));
-        }
+    function sendPackOnConnection(ws, conn, agentAddress, pack, ref, commitSha, options) {
         const transferId = `pack-${++packCounter}`;
         // For the agent-state flow the destination agent and the source repo
         // are the same entity, so `repoId.id === agentAddress`. Asset packs
@@ -1215,19 +1988,14 @@ export function createSidecarRouter(config) {
         // Register pending entry before sending frames so that a synchronous
         // repo.pack.ack (e.g. in tests or loopback transports) resolves correctly.
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingPacks.delete(transferId);
-                reject(new Error(`Pack transfer ${transferId} timed out after ${PACK_TIMEOUT_MS}ms`));
-            }, PACK_TIMEOUT_MS);
-            pendingPacks.set(transferId, {
-                transferId,
-                ws,
+            pendingPacks.register(transferId, ws, {
+                timeoutMs: PACK_TIMEOUT_MS,
+                timeoutMessage: `Pack transfer ${transferId} timed out after ${PACK_TIMEOUT_MS}ms`,
                 resolve,
                 reject(error) {
-                    reject(new Error(`Pack rejected: ${error}`));
+                    reject(new Error(error));
                 },
-                timer,
-            });
+            }, { agentAddress, repoId });
             // Send chunks
             for (const chunk of chunkPack(pack)) {
                 conn.send({
@@ -1251,128 +2019,291 @@ export function createSidecarRouter(config) {
             });
         });
     }
-    function routeMail(agentAddress, rawMessage) {
+    async function sendPackToAllocation(target, agentAddress, pack, ref, commitSha, options) {
+        const { ws, conn } = await getAllocatedConnection(target, "routing");
+        if (addressIndex.get(agentAddress) !== ws) {
+            throw new Error(`Address ${agentAddress} is not routed on allocation ${target.allocationId}`);
+        }
+        return sendPackOnConnection(ws, conn, agentAddress, pack, ref, commitSha, options);
+    }
+    async function sendWorkflowRunPackToAllocation(target, agentAddress, pack, ref, commitSha, signal) {
+        signal?.throwIfAborted();
+        const { ws, conn } = await getAllocatedConnection(target, "routing");
+        signal?.throwIfAborted();
+        if (agentAddress !== conn.identity.workflowRunAddress) {
+            throw new Error(`Allocation ${target.allocationId} cannot restore unrelated address ${agentAddress}`);
+        }
+        if (conn.workflowAddresses.has(agentAddress)) {
+            throw new Error(`Allocation ${target.allocationId} already hosts active workflow ${agentAddress}; refusing to overwrite its run history`);
+        }
+        return sendPackOnConnection(ws, conn, agentAddress, pack, ref, commitSha, {
+            repoId: {
+                kind: "workflow-run",
+                id: deriveWorkflowRunRepoId(agentAddress),
+            },
+        });
+    }
+    function routeMail(agentAddress, rawMessage, authenticatedSender, messageId, runGrants) {
+        // `authenticatedSender` is hub-assigned by the caller from a hub-verified
+        // value (the ownership-gated sender of a relayed mail, or the triggering
+        // principal's address) -- never the message's own MIME `From`. It rides
+        // the frame as the hub-verified sender of record, so a recipient can take
+        // the sender from it rather than the forgeable `From`. The recipient's
+        // signature check reads it as the sender of record -- resolving the
+        // sender's key from its local cache to verify the signature -- and its
+        // admission policy gates delivery on the verdict.
+        //
+        // Carry the hub-minted messageId on the frame so the sidecar's durable-
+        // receipt ack (`mail.inbound.ack`) keys on the same id the hub tracks, and
+        // a redelivery replays identical bytes for the downstream RunStarted dedup.
+        // Optional: the workflow-trigger and session-conversation callers supply
+        // it (they participate in the ack/retry handshake); a caller without a
+        // hub-minted id omits it and the delivery is not tracked for redelivery.
+        const frame = {
+            type: "mail.inbound",
+            agentAddress,
+            rawMessage,
+            authenticatedSender,
+            ...(messageId !== undefined ? { messageId } : {}),
+        };
         const ws = addressIndex.get(agentAddress);
         if (ws !== undefined) {
             const conn = connections.get(ws);
             if (conn !== undefined) {
-                conn.send({
-                    type: "mail.inbound",
-                    agentAddress,
-                    rawMessage,
-                });
+                conn.send(frame);
+                // Track the delivery for redelivery until the sidecar acks its durable
+                // inbox write. Only mail carrying a hub-minted messageId participates
+                // in the ack handshake; relayed agent-to-agent mail omits it and is
+                // delivered fire-and-forget as before. A mail that triggered a workflow
+                // run carries the run's grants so redelivery can replay them ahead of
+                // the mail.
+                if (messageId !== undefined) {
+                    trackPendingMail(agentAddress, messageId, frame, runGrants);
+                }
                 return true;
             }
         }
         // If the agent recently disconnected, queue for delivery on reconnect.
-        const frame = { type: "mail.inbound", agentAddress, rawMessage };
         return enqueueForDisconnected(agentAddress, frame);
     }
-    async function handleDeployAck(agentAddress, publicKey) {
-        if (!pendingDeploys.has(agentAddress)) {
-            logger.warn `Received agent.deploy.ack for "${agentAddress}" with no pending deploy`;
+    function sendRunGrants(agentAddress, runId, stepGrants, senderIdentities) {
+        const frame = {
+            type: "run.grants",
+            agentAddress,
+            runId,
+            stepGrants,
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+        };
+        const ws = addressIndex.get(agentAddress);
+        if (ws !== undefined) {
+            const conn = connections.get(ws);
+            if (conn !== undefined) {
+                conn.send(frame);
+                return true;
+            }
+        }
+        // Mirror routeMail: if the address has a live disconnect queue, ride it
+        // so a run.grants issued in the window between deploy and the first
+        // reconnect survives the same way the dispatching trigger mail does.
+        // A queue exists only while the deployment address is still on
+        // agentAddresses (pre-first-reconnect); after an authenticated reconnect it
+        // moves to workflowAddresses, which handleClose leaves unqueued because
+        // that generation's in-flight run state is reconstructed sidecar-locally.
+        // Returning without enqueueing there is correct; enqueueing is what keeps
+        // grants and mail from diverging in the pre-reconnect window.
+        return enqueueForDisconnected(agentAddress, frame);
+    }
+    async function sendWorkflowRunDispatchToAllocation(target, agentAddress, runId, stepGrants, rawMessage, authenticatedSender, messageId, signal) {
+        signal?.throwIfAborted();
+        const { ws, conn } = await getAllocatedConnection(target, "routing");
+        signal?.throwIfAborted();
+        if (addressIndex.get(agentAddress) !== ws) {
+            throw new Error(`Address ${agentAddress} is not routed on allocation ${target.allocationId}`);
+        }
+        // authenticatedSender is the sender persisted at enqueue on the dispatch
+        // row (the triggering principal's hub-verified address); the caller reads
+        // it from that row. It is never the message's MIME From.
+        //
+        // Resolve its key here, at dispatch (redelivery) time, from that persisted
+        // address, to co-deliver on the run's grants barrier so the recipient
+        // caches the sender's current hub-held key. A run sender's deployment key
+        // is immutable once acked; a user sender's key rotating mid-flight would
+        // leave the fixed signed bytes checked against the new key, which the
+        // recipient logs as unverifiable. Null when unresolvable (no resolver
+        // wired, or the sender has no durable key). The lookup contract (see
+        // SidecarLookups.resolveSenderKey) is best-effort and never throws, so
+        // resolving ahead of the run.grants send cannot block it.
+        const authenticatedSenderPublicKey = lookups.resolveSenderKey !== undefined
+            ? await lookups.resolveSenderKey(authenticatedSender)
+            : null;
+        signal?.throwIfAborted();
+        // Co-deliver the resolved key on the run's grants barrier, omitting a null
+        // key so it is never cached (see deliverMailToRecipient). The same list
+        // rides the pending-mail entry so the reconnect replay carries it too.
+        const senderIdentities = authenticatedSenderPublicKey !== null
+            ? [
+                {
+                    address: authenticatedSender,
+                    publicKey: authenticatedSenderPublicKey,
+                },
+            ]
+            : undefined;
+        const runGrants = {
+            runId,
+            stepGrants,
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+        };
+        conn.send({
+            type: "run.grants",
+            agentAddress,
+            runId,
+            stepGrants,
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+        });
+        const frame = {
+            type: "mail.inbound",
+            agentAddress,
+            rawMessage,
+            authenticatedSender,
+            messageId,
+        };
+        conn.send(frame);
+        trackPendingMail(agentAddress, messageId, frame, runGrants, target);
+    }
+    async function handleDeployAck(ws, frame) {
+        const req = pendingDeploys.get(frame.agentAddress);
+        if (req === undefined) {
+            logger.warn `Received agent.deploy.ack for "${frame.agentAddress}" with no pending deploy`;
             return;
         }
+        if (req.ws !== ws)
+            return;
         if (events.listenerCount("agent.deploy.ack") > 0) {
             try {
+                const identity = connections.get(ws)?.identity;
                 await events.emitAndAwait("agent.deploy.ack", {
-                    agentAddress,
-                    publicKey,
+                    agentAddress: frame.agentAddress,
+                    publicKey: frame.publicKey,
+                    ...(identity?.kind === "allocated"
+                        ? {
+                            allocated: {
+                                allocationId: identity.allocationId,
+                                anchorRunId: identity.anchorRunId,
+                                generation: identity.generation,
+                            },
+                        }
+                        : {}),
                 });
             }
             catch (err) {
-                rejectDeployPending(agentAddress, `Failed to store public key: ${err instanceof Error ? err.message : String(err)}`);
+                pendingDeploys.reject(frame.agentAddress, `Failed to store public key: ${err instanceof Error ? err.message : String(err)}`);
                 return;
             }
         }
-        resolveDeployPending(agentAddress);
-    }
-    function resolveDeployPending(agentAddress) {
-        const req = pendingDeploys.get(agentAddress);
-        if (req === undefined)
-            return;
-        clearTimeout(req.timer);
-        pendingDeploys.delete(agentAddress);
-        req.resolve();
+        pendingDeploys.resolve(frame.agentAddress, frame.publicKey);
     }
-    function rejectDeployPending(agentAddress, error) {
+    function rejectDeployPendingFromFrame(ws, agentAddress, error) {
         const req = pendingDeploys.get(agentAddress);
-        if (req === undefined)
+        if (req === undefined || req.ws !== ws)
             return;
-        clearTimeout(req.timer);
-        pendingDeploys.delete(agentAddress);
-        req.reject(error);
+        // Settle by key, not by the `req` object: a key lookup observes the
+        // CURRENT entry, so a stale handle cannot settle a replaced round-trip.
+        pendingDeploys.reject(agentAddress, error);
     }
-    async function sendAgentDeploy(agentAddress, harnessConfig, workflow) {
+    function sendAgentDeployOnConnection(ws, conn, agentAddress, harnessConfig, workflow) {
         if (hubPublicKeyHex === undefined) {
-            throw new Error("Hub signing key is required for agent deployment");
+            throw deployFrameFailure("Hub signing key is required for agent deployment", false);
         }
         if (pendingDeploys.has(agentAddress)) {
-            throw new Error(`Deploy already in progress for agent "${agentAddress}"`);
-        }
-        const ws = addressIndex.get(agentAddress) ?? findSidecarForNewAgent(agentAddress);
-        if (ws === undefined) {
-            throw new Error(`No sidecar available for agent "${agentAddress}"`);
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            throw new Error(`No sidecar connected for agent "${agentAddress}"`);
+            throw deployFrameFailure(`Deploy already in progress for agent "${agentAddress}"`, false);
         }
-        conn.agentAddresses.add(agentAddress);
+        const addressSet = conn.identity.kind === "allocated"
+            ? conn.workflowAddresses
+            : conn.agentAddresses;
+        addressSet.add(agentAddress);
         addressIndex.set(agentAddress, ws);
         return new Promise((resolve, reject) => {
-            // The deploy-ack handler does not currently thread the
-            // sidecar-reported public key back through the pending-deploy
-            // resolver; it only fires `agent.deploy.ack` listeners and then
-            // resolves the pending deploy. Capture the key via a one-shot
-            // listener so the return value carries it without a wire-shape
-            // change to `agent.deploy.ack`.
-            let capturedPublicKey;
-            const detachListener = events.on("agent.deploy.ack", (payload) => {
-                if (payload.agentAddress === agentAddress) {
-                    capturedPublicKey = payload.publicKey;
-                }
-            });
-            const timer = setTimeout(() => {
-                detachListener();
-                pendingDeploys.delete(agentAddress);
-                if (addressIndex.get(agentAddress) === ws) {
-                    conn.agentAddresses.delete(agentAddress);
-                    addressIndex.delete(agentAddress);
-                }
-                reject(new Error(`Deploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
-            pendingDeploys.set(agentAddress, {
-                agentAddress,
-                ws,
-                resolve() {
-                    detachListener();
-                    if (capturedPublicKey === undefined) {
-                        reject(new Error(`Deploy of "${agentAddress}" resolved without an agent.deploy.ack publicKey payload`));
-                        return;
-                    }
-                    resolve({ publicKey: capturedPublicKey });
+            // Timeout and frame-error rejections share this closure, so the routing
+            // rollback and the `frameSent: true` tag live in one place.
+            pendingDeploys.register(agentAddress, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Deploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`,
+                resolve(publicKey) {
+                    resolve({ publicKey });
                 },
                 reject(error) {
-                    detachListener();
                     if (addressIndex.get(agentAddress) === ws) {
-                        conn.agentAddresses.delete(agentAddress);
+                        addressSet.delete(agentAddress);
                         addressIndex.delete(agentAddress);
                     }
-                    reject(new Error(error));
+                    // A non-allocated deployment's key is recorded by the deploy-ack
+                    // projection, whose failure (reject/timeout/agent.error/disconnect)
+                    // is observed only here. Drain any pre-ack sender mail parked on
+                    // this address so it surfaces as undelivered rather than waiting out
+                    // the TTL. An allocated deployment's failure is drained by its
+                    // session-service owner instead, so skip it here to keep one owner
+                    // per case.
+                    if (conn.identity.kind !== "allocated") {
+                        drainDeferredSenderMail(agentAddress, `deploy failed: ${error}`);
+                    }
+                    reject(deployFrameFailure(error, true));
                 },
-                timer,
-            });
-            conn.send({
-                type: "agent.deploy",
-                agentAddress,
-                agentId: harnessConfig.agentId,
-                config: harnessConfig,
-                hubPublicKey: hubPublicKeyHex,
-                ...(workflow !== undefined ? { workflow } : {}),
-            });
+            }, undefined);
+            try {
+                conn.send({
+                    type: "agent.deploy",
+                    agentAddress,
+                    agentId: harnessConfig.agentId,
+                    config: harnessConfig,
+                    hubPublicKey: hubPublicKeyHex,
+                    ...(workflow !== undefined ? { workflow } : {}),
+                });
+            }
+            catch (err) {
+                // A synchronous send failure means the frame never reached the wire.
+                // Drop the pending entry (and its armed timer) and reject as not-sent
+                // so a caller may safely roll back what it staged. The drop bypasses
+                // the entry's reject closure: this failure must report
+                // `frameSent: false`, and the timer must not fire later and
+                // double-reject.
+                pendingDeploys.delete(agentAddress);
+                if (addressIndex.get(agentAddress) === ws) {
+                    addressSet.delete(agentAddress);
+                    addressIndex.delete(agentAddress);
+                }
+                reject(deployFrameFailure(`Deploy of "${agentAddress}" failed to send: ${err instanceof Error ? err.message : String(err)}`, false));
+            }
         });
     }
+    async function sendAgentDeployToAllocation(target, agentAddress, harnessConfig, workflow, signal, beforeSend) {
+        try {
+            signal?.throwIfAborted();
+            const { ws, conn } = await getAllocatedConnection(target, "routing");
+            signal?.throwIfAborted();
+            if (agentAddress !== conn.identity.workflowRunAddress) {
+                throw new Error(`Allocation ${target.allocationId} cannot deploy unrelated address ${agentAddress}`);
+            }
+            const existing = addressIndex.get(agentAddress);
+            if (existing !== undefined && existing !== ws) {
+                throw new Error(`Deployment ${agentAddress} is already routed to another sidecar`);
+            }
+            if (hubPublicKeyHex === undefined)
+                throw new Error("Hub signing key is required for agent deployment");
+            if (pendingDeploys.has(agentAddress))
+                throw new Error(`Deploy already in progress for agent "${agentAddress}"`);
+            await beforeSend?.();
+            signal?.throwIfAborted();
+            if (allocatedConnections.get(target.allocationId)?.ws !== ws ||
+                allocationFences.get(target.allocationId) !== target.generation) {
+                throw new Error(`Allocated sidecar connection changed for allocation ${target.allocationId}`);
+            }
+            // Return without awaiting: only pre-send failures belong to this catch.
+            return sendAgentDeployOnConnection(ws, conn, agentAddress, harnessConfig, workflow);
+        }
+        catch (cause) {
+            throw deployFrameFailure(cause instanceof Error ? cause.message : String(cause), false, cause);
+        }
+    }
     /**
      * Provision one step of a multi-step deploy on the sidecar WITHOUT
      * spawning: the sidecar initializes the step's agent-state repo and
@@ -1387,42 +2318,29 @@ export function createSidecarRouter(config) {
      * so the caller can safely deliver the deploy pack afterward. On failure
      * the caller owns tearing the route down via `unbindStepRoute`.
      */
-    function sendProvisionStep(agentAddress, harnessConfig) {
+    function sendProvisionStepOnConnection(ws, conn, agentAddress, harnessConfig) {
         if (hubPublicKeyHex === undefined) {
             throw new Error("Hub signing key is required for step provisioning");
         }
         if (pendingDeploys.has(agentAddress)) {
             throw new Error(`Deploy already in progress for agent "${agentAddress}"`);
         }
-        const ws = addressIndex.get(agentAddress);
-        if (ws === undefined) {
-            throw new Error(`Step route for "${agentAddress}" is not bound; call bindStepRoute before provisioning`);
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            throw new Error(`No sidecar connected for agent "${agentAddress}"`);
-        }
         const hubKey = hubPublicKeyHex;
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingDeploys.delete(agentAddress);
-                reject(new Error(`Step provision of "${agentAddress}" timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
             // The sidecar's `agent.deploy.ack` resolves this through
-            // `resolveDeployPending` -> `req.resolve()`. The per-step address is
-            // workflow-derived and records no hub-side key, so the ack's public
-            // key is not needed and this resolves void.
-            pendingDeploys.set(agentAddress, {
-                agentAddress,
-                ws,
-                resolve() {
+            // `pendingDeploys.resolve`. The per-step address is workflow-derived
+            // and records no hub-side key, so the ack's public key is not needed
+            // and this resolves void.
+            pendingDeploys.register(agentAddress, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Step provision of "${agentAddress}" timed out after ${requestTimeoutMs}ms`,
+                resolve(_publicKey) {
                     resolve();
                 },
                 reject(error) {
                     reject(new Error(error));
                 },
-                timer,
-            });
+            }, undefined);
             conn.send({
                 type: "agent.deploy",
                 agentAddress,
@@ -1433,11 +2351,46 @@ export function createSidecarRouter(config) {
             });
         });
     }
-    function findSidecarForNewAgent(_agentAddress) {
-        const first = connections.entries().next();
-        if (first.done)
-            return undefined;
-        return first.value[0];
+    async function sendProvisionStepToAllocation(target, agentAddress, harnessConfig) {
+        const { ws, conn } = await getAllocatedConnection(target, "routing");
+        if (addressIndex.get(agentAddress) !== ws) {
+            throw new Error(`Step route ${agentAddress} is not bound to allocation ${target.allocationId}`);
+        }
+        return sendProvisionStepOnConnection(ws, conn, agentAddress, harnessConfig);
+    }
+    function sendProbeOnConnection(ws, conn, args) {
+        const requestId = nextRequestId();
+        return new Promise((resolve, reject) => {
+            pendingProbes.register(requestId, ws, {
+                timeoutMs: probeTimeoutMs,
+                timeoutMessage: `Probe ${requestId} timed out after ${probeTimeoutMs}ms`,
+                resolve,
+                reject(error) {
+                    reject(new Error(error));
+                },
+            }, undefined);
+            conn.send({
+                type: "workflow.probe.request",
+                requestId,
+                source: args.source,
+                closure: args.closure,
+                entry: args.entry,
+                ...(args.assets !== undefined ? { assets: args.assets } : {}),
+            });
+        });
+    }
+    async function sendProbeToAllocation(target, args) {
+        const { ws, conn } = await getProvisionedConnection(target, "routing");
+        return sendProbeOnConnection(ws, conn, args);
+    }
+    function disconnectAllocation(target) {
+        const current = allocatedConnections.get(target.allocationId);
+        if (current === undefined ||
+            current.identity.generation !== target.generation) {
+            return;
+        }
+        handleClose(current.ws);
+        current.ws.close();
     }
     function sendAgentUndeploy(agentAddress, reason) {
         const ws = addressIndex.get(agentAddress);
@@ -1449,14 +2402,11 @@ export function createSidecarRouter(config) {
             return Promise.reject(new Error(`No sidecar connected for agent "${agentAddress}"`));
         }
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingUndeploys.delete(agentAddress);
-                removeAgentAddress(ws, agentAddress);
-                reject(new Error(`Undeploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
-            pendingUndeploys.set(agentAddress, {
-                agentAddress,
-                ws,
+            // Timeout, ack, and error rejection share one closure so the routing
+            // teardown runs exactly once no matter how the round-trip settles.
+            pendingUndeploys.register(agentAddress, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Undeploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`,
                 resolve() {
                     removeAgentAddress(ws, agentAddress);
                     resolve();
@@ -1465,8 +2415,7 @@ export function createSidecarRouter(config) {
                     removeAgentAddress(ws, agentAddress);
                     reject(new Error(error));
                 },
-                timer,
-            });
+            }, undefined);
             conn.send({
                 type: "agent.undeploy",
                 agentAddress,
@@ -1529,6 +2478,15 @@ export function createSidecarRouter(config) {
             defaultSource,
         }));
     }
+    async function sendCredentialsUpdate(agentAddress, delivery, revoke) {
+        await sendRequest(agentAddress, (requestId) => ({
+            type: "credentials.update",
+            requestId,
+            agentAddress,
+            delivery,
+            ...(revoke !== undefined ? { revoke } : {}),
+        }));
+    }
     function sendSyncRequest(agentAddress) {
         const ws = addressIndex.get(agentAddress);
         if (ws === undefined) {
@@ -1563,6 +2521,15 @@ export function createSidecarRouter(config) {
             payload: opts.payload,
         });
     }
+    async function sendSignalDeliverToAllocation(target, opts, signal) {
+        signal?.throwIfAborted();
+        const { ws, conn } = await getAllocatedConnection(target, "routing");
+        signal?.throwIfAborted();
+        if (addressIndex.get(opts.agentAddress) !== ws) {
+            throw new Error(`Address ${opts.agentAddress} is not routed on allocation ${target.allocationId}`);
+        }
+        conn.send({ type: "signal.deliver", ...opts });
+    }
     function sendDrain(opts) {
         const ws = addressIndex.get(opts.agentAddress);
         if (ws === undefined) {
@@ -1583,15 +2550,29 @@ export function createSidecarRouter(config) {
         handleMessage,
         handleClose,
         routeMail,
-        sendAgentDeploy,
+        sendRunGrants,
+        noteSenderDeployStarted,
+        noteSenderDeploySettled,
+        sendProbeToAllocation,
+        disconnectAllocation,
         sendAgentUndeploy,
         sendSourcesUpdate,
-        sendPack,
-        bindStepRoute,
-        unbindStepRoute,
-        sendProvisionStep,
+        sendCredentialsUpdate,
+        sendPackToAllocation,
+        sendWorkflowRunPackToAllocation,
+        fenceAllocation,
+        retireAllocation,
+        waitForAllocatedSidecar,
+        isAllocatedSidecarReady,
+        isAllocatedWorkflowActive,
+        sendAgentDeployToAllocation,
+        bindAllocatedStepRoute,
+        unbindAllocatedStepRoute,
+        sendProvisionStepToAllocation,
+        sendWorkflowRunDispatchToAllocation,
         sendSyncRequest,
         sendSignalDeliver,
+        sendSignalDeliverToAllocation,
         sendDrain,
         subscribeAgent,
         dispatchAgentEvent: dispatchToSubscribers,