@intx/hub-sessions 0.3.0 → 0.4.0

package/dist/ws/sidecar-handler.js

@@ -4,19 +4,37 @@
 // table of agentAddress → sidecar connection, and dispatches frames between
 // sidecars and the hub's internal systems.
 import { getLogger } from "@intx/log";
-import { verifyEd25519 } from "@intx/crypto";
 import { chunkPack, createPackReceiver } from "@intx/pack-transport";
-import { base64Decode, deriveMessageId, deriveWorkflowRunId, hexDecode, hexEncode, isRunAddress, } from "@intx/types";
+import { base64Decode, deriveMessageId, deriveWorkflowRunId, isRunAddress, } from "@intx/types";
 import { deriveWorkflowRunRepoId } from "@intx/workflow-deploy";
 import { type } from "arktype";
-import { SidecarFrame, } from "@intx/types/sidecar";
+import { MAX_MAIL_OUTBOUND_BODY_BYTES, SidecarFrame, } from "@intx/types/sidecar";
 import { createSidecarEmitter, } from "./sidecar-events.js";
+import { PendingTracker, } from "./pending-tracker.js";
 const logger = getLogger(["hub", "ws", "sidecar"]);
+function deployFrameFailure(message, frameSent, cause) {
+    return Object.assign(new Error(message, { cause }), { frameSent });
+}
+export function isDeployFrameFailure(err) {
+    return (err instanceof Error &&
+        "frameSent" in err &&
+        typeof err.frameSent === "boolean");
+}
 /**
- * Whether this connection owns `address` for routing/lifecycle purposes --
- * as a challenged session address OR a hub-minted workflow-substrate address.
- * The two sets are kept physically distinct (they differ on the challenge /
- * re-add path), but ownership readers -- pack-transfer authorization,
+ * Identity validation failed or remained pending at the connection deadline.
+ * Readiness is unknown: the worker may be healthy behind the lookup, so
+ * callers must retry rather than treat this as a missed connection deadline.
+ */
+export class SidecarIdentityValidationError extends Error {
+    constructor(allocationId, generation, cause) {
+        super(`Cannot validate sidecar identity for allocation ${allocationId} generation ${String(generation)}`, { cause });
+        this.name = "SidecarIdentityValidationError";
+    }
+}
+/**
+ * Whether this connection owns `address` for routing/lifecycle purposes.
+ * The legacy and workflow sets remain physically distinct, but ownership
+ * readers -- pack-transfer authorization,
  * in-flight cancellation, disconnect teardown -- must see the union, or a
  * reconnected workflow deployment (which lives only in `workflowAddresses`)
  * is silently treated as unowned even though its mail routes.
@@ -31,12 +49,10 @@ function connOwnsAddress(conn, address) {
  * repository.
  */
 function connCanPushRepo(conn, agentAddress, repoId) {
-    if (conn.identity.kind === "allocated" &&
-        agentAddress !== conn.identity.workflowRunAddress) {
+    if (conn.identity.kind !== "allocated")
+        return false;
+    if (agentAddress !== conn.identity.workflowRunAddress) {
         return false;
-    }
-    if (repoId.kind === "agent-state") {
-        return conn.identity.kind === "shared" && repoId.id === agentAddress;
     }
     return (repoId.kind === "workflow-run" &&
         repoId.id === deriveWorkflowRunRepoId(agentAddress));
@@ -46,7 +62,6 @@ function ownedAddresses(conn) {
     return new Set([...conn.agentAddresses, ...conn.workflowAddresses]);
 }
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
-const DEFAULT_CHALLENGE_TIMEOUT_MS = 30_000;
 // A probe fetches a workflow's dependency closure from a registry and
 // evaluates it on the sidecar, so it runs longer than a routine request; its
 // default timeout is correspondingly wider than DEFAULT_REQUEST_TIMEOUT_MS.
@@ -56,8 +71,25 @@ const DEFAULT_DISCONNECT_QUEUE_TTL_MS = 5 * 60 * 1000;
 const DEFAULT_PING_TIMEOUT_MS = 60_000;
 const DEFAULT_MAIL_ACK_RETRY_INTERVAL_MS = 10_000;
 const DEFAULT_MAIL_ACK_MAX_RETRIES = 5;
+// The hub re-resolves and re-pushes a key for each rotatable sender a sidecar
+// reports on (re)connect. A legitimate sidecar caches keys for tens, maybe low
+// hundreds of distinct user senders, so this cap sits well above ten times that
+// ceiling: it NEVER truncates a real report -- dropping a genuine sender would
+// leave its key stale, the exact failure this refresh exists to prevent. It
+// bounds only a hostile or buggy sidecar, since a compromised authenticated
+// sidecar could otherwise report an unbounded set and drive that many sequential
+// DB resolves on every reconnect. The cap lives in the handler, not on the
+// arktype frame schema, on purpose: rejecting an over-cap frame at parse would
+// fail the whole reconnect (a hard outage) rather than degrade gracefully to a
+// bounded refresh.
+export const MAX_RESYNC_SENDER_ADDRESSES = 2048;
 export function createSidecarRouter(config) {
-    const { requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS, challengeTimeoutMs = DEFAULT_CHALLENGE_TIMEOUT_MS, probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS, hubPublicKey: hubPublicKeyHex, authenticateSidecar, validateSidecarIdentity = async () => true, disconnectQueueMaxSize = DEFAULT_DISCONNECT_QUEUE_MAX_SIZE, disconnectQueueTTLMs = DEFAULT_DISCONNECT_QUEUE_TTL_MS, pingTimeoutMs = DEFAULT_PING_TIMEOUT_MS, mailAckRetryIntervalMs = DEFAULT_MAIL_ACK_RETRY_INTERVAL_MS, mailAckMaxRetries = DEFAULT_MAIL_ACK_MAX_RETRIES, lookups = {}, } = config;
+    const { requestTimeoutMs = DEFAULT_REQUEST_TIMEOUT_MS, probeTimeoutMs = DEFAULT_PROBE_TIMEOUT_MS, hubPublicKey: hubPublicKeyHex, authenticateSidecar, validateSidecarIdentity, disconnectQueueMaxSize = DEFAULT_DISCONNECT_QUEUE_MAX_SIZE, disconnectQueueTTLMs = DEFAULT_DISCONNECT_QUEUE_TTL_MS, pingTimeoutMs = DEFAULT_PING_TIMEOUT_MS, mailAckRetryIntervalMs = DEFAULT_MAIL_ACK_RETRY_INTERVAL_MS, scheduleTimeout = (handler, ms) => {
+        const handle = setTimeout(handler, ms);
+        return () => {
+            clearTimeout(handle);
+        };
+    }, mailAckMaxRetries = DEFAULT_MAIL_ACK_MAX_RETRIES, lookups = {}, } = config;
     // Receiver-dispatch surface. Wire-layer callsites emit events here;
     // host code subscribes via `router.events`.
     const events = createSidecarEmitter();
@@ -68,10 +100,20 @@ export function createSidecarRouter(config) {
     const allocationWaiters = new Map();
     // agentAddress → ws handle (routing table)
     const addressIndex = new Map();
-    // requestId → pending promise
-    const pending = new Map();
-    const pendingDeploys = new Map();
-    const pendingChallenges = new Map();
+    // requestId → pending promise (resolved by session.ack, rejected by
+    // session.error). `PendingTracker` owns the register/timeout/settle/sweep
+    // lifecycle shared by all five pending round-trips below; each entry's
+    // resolve/reject closures carry the per-round-trip cleanup.
+    const pendingRequests = new PendingTracker();
+    // agentAddress → pending deploy promise (matched by agent.deploy.ack/agent.error)
+    const pendingDeploys = new PendingTracker();
+    // Run addresses whose ALLOCATED deploy is mid-flight -- key-record has been
+    // started but not yet committed. pendingDeploys clears at the deploy ack, but an
+    // allocated run's key is recorded LATER by session-service's anchor-key update,
+    // so pendingDeploys alone under-covers the allocated pre-ack window. session-
+    // service brackets this marker across its deploy try/catch: set before the
+    // deploy emit, cleared by noteSenderDeploySettled on record or failure.
+    const allocatedKeyRecordInFlight = new Map();
     const disconnectedAgents = new Map();
     const pendingMail = new Map();
     // agentAddress → retention TTL timer for un-acked pending mail held across a
@@ -81,6 +123,7 @@ export function createSidecarRouter(config) {
     // does not leak entries. Cleared when the address reconnects (redelivery) or
     // its last pending entry is acked.
     const pendingMailRetention = new Map();
+    const deferredSenderMail = new Map();
     // agentAddress → set of subscriber callbacks for agent events
     const agentSubscribers = new Map();
     // agentAddress → cached connector-thread state, populated by
@@ -100,10 +143,17 @@ export function createSidecarRouter(config) {
     // a single in-flight promise per ws (replaced each queued frame), cleared on
     // close.
     const messageChains = new Map();
-    const pendingPacks = new Map();
+    const pendingPacks = new PendingTracker();
     let packCounter = 0;
-    const pendingUndeploys = new Map();
-    const pendingProbes = new Map();
+    // agentAddress → pending undeploy (resolved by agent.undeploy.ack)
+    const pendingUndeploys = new PendingTracker();
+    // requestId → pending workflow probe (resolved by workflow.probe.result,
+    // rejected by workflow.probe.error). Result-carrying, unlike the other
+    // trackers (which resolve void): a probe returns the sidecar's inert
+    // projection + grant set + wire hash. Keyed on requestId alone -- the
+    // probe runs in the sidecar's pre-deploy state and enters no address map,
+    // so `handleClose`'s ws-keyed sweep is its ONLY disconnect cleanup.
+    const pendingProbes = new PendingTracker();
     // Receives agent-state packs pushed from sidecars. The wire frames
     // (`repo.pack.push` / `repo.pack.done`) are shared with the
     // workflow-run flow; dispatch on `repoId.kind` picks which receiver
@@ -147,18 +197,16 @@ export function createSidecarRouter(config) {
         entry.queue.push(frame);
         return true;
     }
-    function flushDisconnectedQueue(agentAddress, conn) {
-        const entry = disconnectedAgents.get(agentAddress);
-        if (entry === undefined)
-            return;
-        clearTimeout(entry.timer);
-        disconnectedAgents.delete(agentAddress);
-        for (const frame of entry.queue) {
-            conn.send(frame);
-        }
-        if (entry.queue.length > 0) {
-            logger.info `Flushed ${String(entry.queue.length)} queued message(s) to ${agentAddress}`;
-        }
+    // Arm a redelivery-retry timer for a tracked pending mail. Wraps the async
+    // `retryPendingMail` so a rejection -- a socket write that throws once the
+    // sidecar is gone -- is logged rather than floating out of the timer as an
+    // unhandled rejection.
+    function scheduleMailRetry(agentAddress, messageId) {
+        return scheduleTimeout(() => {
+            void retryPendingMail(agentAddress, messageId).catch((err) => {
+                logger.warn `Redelivery retry for mail ${messageId} to ${agentAddress} failed: ${err instanceof Error ? err.message : String(err)}`;
+            });
+        }, mailAckRetryIntervalMs);
     }
     // Track a connected-window `mail.inbound` for redelivery until the sidecar
     // acks its durable inbox write. Replaces any prior entry for the same
@@ -172,30 +220,129 @@ export function createSidecarRouter(config) {
         }
         const existing = byId.get(messageId);
         if (existing !== undefined)
-            clearTimeout(existing.timer);
+            existing.cancelRetry();
         byId.set(messageId, {
             agentAddress,
             messageId,
             frame,
             attempts: 0,
-            timer: setTimeout(() => retryPendingMail(agentAddress, messageId), mailAckRetryIntervalMs),
+            cancelRetry: scheduleMailRetry(agentAddress, messageId),
             ...(runGrants !== undefined ? { runGrants } : {}),
             ...(allocatedTarget !== undefined ? { allocatedTarget } : {}),
         });
     }
-    // Replay a mail-triggered run's grants ahead of a redelivery of its trigger
-    // mail. Same-connection FIFO lands the `run.grants` frame before the mail, so
-    // the redelivered run resolves its onRunStart barrier instead of failing
-    // closed on missing grants.
-    function replayRunGrantsAhead(conn, entry) {
-        if (entry.runGrants === undefined)
-            return;
-        conn.send({
+    // Resolve the frame that must precede a redelivery of a trigger mail on the
+    // FIFO socket, re-resolving a keyless run sender's key so it still
+    // co-delivers. Returns:
+    //   - a `run.grants` frame when the entry carries run grants (the redelivered
+    //     run resolves its onRunStart barrier instead of failing closed on
+    //     missing grants);
+    //   - a bare `sender.key.refresh` frame when the entry carries NO run grants
+    //     but its run sender's key was never co-delivered, so the recipient still
+    //     caches the key ahead of the mail;
+    //   - `undefined` when nothing must precede the mail.
+    //
+    // The re-resolve is KIND-GATED to run-address senders only. A run's
+    // deployment key is immutable once acked, so the re-resolved key equals the
+    // signing-time key -- safe. A user (non-run) sender's key may have rotated
+    // since it signed, so re-resolving would check the fixed signed bytes against
+    // a newer key and turn a valid message into a false `invalid`; such a sender
+    // lacking a captured key stays keyless (an honest `unknown`). An entry that
+    // captured `senderIdentities` at track time replays that snapshot as-is: it
+    // holds the signing-time key and is never re-resolved.
+    //
+    // Awaits any key resolve so the caller sends the returned frame and the mail
+    // back-to-back with no await between them, keeping the co-delivered key ahead
+    // of the mail on the FIFO socket.
+    async function resolveReplayLeadFrame(entry) {
+        const authenticatedSender = entry.frame.type === "mail.inbound"
+            ? entry.frame.authenticatedSender
+            : undefined;
+        const senderIsRun = authenticatedSender !== undefined && isRunAddress(authenticatedSender);
+        if (entry.runGrants === undefined) {
+            if (authenticatedSender === undefined || !senderIsRun)
+                return undefined;
+            const key = await reresolveRunSenderKey(authenticatedSender);
+            if (key === null)
+                return undefined;
+            return {
+                type: "sender.key.refresh",
+                address: authenticatedSender,
+                publicKey: key,
+            };
+        }
+        let senderIdentities = entry.runGrants.senderIdentities;
+        if (senderIdentities === undefined &&
+            authenticatedSender !== undefined &&
+            senderIsRun) {
+            const key = await reresolveRunSenderKey(authenticatedSender);
+            senderIdentities = senderIdentitiesFromKey(authenticatedSender, key);
+        }
+        return {
             type: "run.grants",
             agentAddress: entry.agentAddress,
             runId: entry.runGrants.runId,
             stepGrants: entry.runGrants.stepGrants,
-        });
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+        };
+    }
+    // Best-effort re-resolve of a run sender's hub-held key at replay time. Only
+    // called for a run-address sender, whose deployment key is immutable once
+    // acked, so the current key equals the signing-time key. Returns null when no
+    // resolver is wired or the sender has no durable key.
+    //
+    // This relies on `lookups.resolveSenderKey` being the BEST-EFFORT,
+    // NEVER-THROWS resolver (the contract at sidecar-events.ts:274-279, wired to
+    // resolveFrameSenderKey, which swallows faults to null). That contract is
+    // load-bearing here: `redeliverPendingMail` clears the retention TTL up-front
+    // and re-arms each entry's per-entry timer only on a successful send, so a
+    // resolver that THREW would abort the redeliver loop and strand the
+    // not-yet-processed entries with no timer and no TTL until a process restart.
+    // A strict/throwing resolver must NOT be wired here. Do not add a try/catch:
+    // the boundary owns the never-throws contract; duplicating it here would
+    // violate that ownership. The dispatch-time resolveSenderKey call
+    // (sendWorkflowRunDispatchToAllocation path) carries the same dependency
+    // note.
+    async function reresolveRunSenderKey(authenticatedSender) {
+        const resolveSenderKey = lookups.resolveSenderKey;
+        if (resolveSenderKey === undefined)
+            return null;
+        return resolveSenderKey(authenticatedSender);
+    }
+    // Replay a pending mail's lead frame (its run grants or a re-resolved sender
+    // key) and then the mail itself over `conn`. Awaits the resolve FIRST, then
+    // sends the lead frame and the mail back-to-back with NO await between them,
+    // so the co-delivered key always precedes the mail on the FIFO socket.
+    // Returns whether the mail was (re)sent, so the caller re-arms the retry timer
+    // only for an entry it actually redelivered.
+    async function replaySendPendingMail(conn, entry) {
+        const lead = await resolveReplayLeadFrame(entry);
+        // The resolve above may have awaited real I/O; during that gap a queued
+        // `mail.inbound.ack` can advance and run `resolvePendingMail` (delete +
+        // clearTimeout) on this entry. The window is opened by the timer-macrotask
+        // retry path, NOT by any bypass: `mail.inbound.ack` is a QUEUED frame
+        // (frameBypassesQueue returns false for it). It can interleave because the
+        // retry runs as an independent setTimeout macrotask (retryPendingMail), so
+        // the owning ws's message chain is free to advance the ack during the
+        // resolve await. On the reconnect/redeliver path the ack cannot interleave
+        // at all -- it queues behind the still-running reconnect handler on the
+        // same ws -- so here this guard is pure defense-in-depth. Re-confirm it is
+        // still the tracked entry before sending, or a post-ack redelivery would
+        // arm a retry timer on a detached entry.
+        if (pendingMail.get(entry.agentAddress)?.get(entry.messageId) !== entry) {
+            return false;
+        }
+        // The same gap can span a disconnect or a takeover that moves the address
+        // off `conn`. Sending on the stale conn would write to a dead socket and
+        // re-arm a retry that later drops a still-retained entry. Skip so the entry
+        // survives for the reconnect redelivery.
+        const ws = addressIndex.get(entry.agentAddress);
+        if (ws === undefined || connections.get(ws) !== conn)
+            return false;
+        if (lead !== undefined)
+            conn.send(lead);
+        conn.send(entry.frame);
+        return true;
     }
     function deletePendingMail(byId, agentAddress, messageId) {
         byId.delete(messageId);
@@ -210,7 +357,7 @@ export function createSidecarRouter(config) {
             }
         }
     }
-    function retryPendingMail(agentAddress, messageId) {
+    async function retryPendingMail(agentAddress, messageId) {
         const byId = pendingMail.get(agentAddress);
         if (byId === undefined)
             return;
@@ -252,10 +399,10 @@ export function createSidecarRouter(config) {
             logger.warn `Dropping un-acked mail ${messageId} for ${agentAddress}: no live connection to redeliver over`;
             return;
         }
+        if (!(await replaySendPendingMail(conn, entry)))
+            return;
         entry.attempts += 1;
-        replayRunGrantsAhead(conn, entry);
-        conn.send(entry.frame);
-        entry.timer = setTimeout(() => retryPendingMail(agentAddress, messageId), mailAckRetryIntervalMs);
+        entry.cancelRetry = scheduleMailRetry(agentAddress, messageId);
     }
     function resolvePendingMail(agentAddress, messageId) {
         const byId = pendingMail.get(agentAddress);
@@ -264,7 +411,7 @@ export function createSidecarRouter(config) {
         const entry = byId.get(messageId);
         if (entry === undefined)
             return;
-        clearTimeout(entry.timer);
+        entry.cancelRetry();
         deletePendingMail(byId, agentAddress, messageId);
     }
     // Hold an address's un-acked pending mail across a disconnect. The per-entry
@@ -279,7 +426,7 @@ export function createSidecarRouter(config) {
         if (byId === undefined)
             return;
         for (const entry of byId.values())
-            clearTimeout(entry.timer);
+            entry.cancelRetry();
         const existing = pendingMailRetention.get(agentAddress);
         if (existing !== undefined)
             clearTimeout(existing);
@@ -307,7 +454,7 @@ export function createSidecarRouter(config) {
     // (effectively-once) and processes one it had dropped (no loss). Re-arms the
     // connected-window retry over the new connection with a fresh per-generation
     // budget, so a redelivery that is itself dropped before its ack is retried.
-    function redeliverPendingMail(agentAddress, conn) {
+    async function redeliverPendingMail(agentAddress, conn) {
         const retention = pendingMailRetention.get(agentAddress);
         if (retention !== undefined) {
             clearTimeout(retention);
@@ -324,14 +471,14 @@ export function createSidecarRouter(config) {
                 // The Hub-owned dispatch row survives generation replacement and will
                 // be requeued by the allocation-ready callback. Do not leak or replay
                 // this generation-local retry entry onto a different worker.
-                clearTimeout(entry.timer);
+                entry.cancelRetry();
                 deletePendingMail(byId, agentAddress, entry.messageId);
                 continue;
             }
-            replayRunGrantsAhead(conn, entry);
-            conn.send(entry.frame);
+            if (!(await replaySendPendingMail(conn, entry)))
+                continue;
             entry.attempts = 0;
-            entry.timer = setTimeout(() => retryPendingMail(agentAddress, entry.messageId), mailAckRetryIntervalMs);
+            entry.cancelRetry = scheduleMailRetry(agentAddress, entry.messageId);
         }
         if (byId.size > 0) {
             logger.info `Redelivered ${String(byId.size)} un-acked message(s) to ${agentAddress} on reconnect`;
@@ -340,13 +487,13 @@ export function createSidecarRouter(config) {
     function resetLivenessTimer(ws) {
         const existing = livenessTimers.get(ws);
         if (existing !== undefined)
-            clearTimeout(existing);
-        const timer = setTimeout(() => {
+            existing();
+        const cancel = scheduleTimeout(() => {
             livenessTimers.delete(ws);
             logger.warn `Sidecar ping timeout, closing connection`;
             ws.close();
         }, pingTimeoutMs);
-        livenessTimers.set(ws, timer);
+        livenessTimers.set(ws, cancel);
     }
     function handlePing(ws) {
         resetLivenessTimer(ws);
@@ -409,11 +556,9 @@ export function createSidecarRouter(config) {
     // state. Such a frame has no ordering obligation against new inbound frames
     // (a response cannot resolve "too early" for a request that already went
     // out), and it is exactly what in-flight queued handlers block on, so it MUST
-    // run out of band or the challenge round-trip deadlocks (challenge.response
-    // -> agent.reconnected reaction -> sendSourcesUpdate awaits a later
-    // session.ack). Every other frame establishes or reads routing, or carries an
-    // inbound payload whose order matters, so it queues. The exhaustive switch +
-    // assertNever makes adding a SidecarFrame variant without classifying it a
+    // run out of band. Every other frame establishes or reads routing, or carries
+    // an inbound payload whose order matters, so it queues. The exhaustive switch
+    // + assertNever makes adding a SidecarFrame variant without classifying it a
     // compile error, not a latent deadlock or a silent bypass hole.
     function frameBypassesQueue(frame) {
         switch (frame.type) {
@@ -430,7 +575,6 @@ export function createSidecarRouter(config) {
                 return true;
             case "register":
             case "reconnect":
-            case "challenge.response":
             case "mail.outbound":
             case "agent.event":
             case "connector.state.changed":
@@ -445,22 +589,31 @@ export function createSidecarRouter(config) {
     }
     // Runs one frame's handler. Returns the handler's promise for async handlers
     // so the per-ws chain can await bounded completion; sync handlers return
-    // void. Never awaits a promise that resolves on a LATER same-ws frame -- the
-    // only such await (the challenge round-trip's session.ack) is reached via a
-    // bypass frame, which does not queue.
+    // void. Never awaits a promise that resolves on a later same-ws frame.
     function dispatchFrame(ws, frame) {
+        const registeredIdentity = connections.get(ws)?.identity;
+        if (registeredIdentity?.kind === "probe" &&
+            frame.type !== "register" &&
+            frame.type !== "reconnect" &&
+            frame.type !== "ping" &&
+            frame.type !== "workflow.probe.result" &&
+            frame.type !== "workflow.probe.error") {
+            logger.warn `Rejected ${frame.type} from probe sidecar ${registeredIdentity.sidecarId}`;
+            handleClose(ws);
+            ws.close();
+            return;
+        }
         switch (frame.type) {
             case "register": {
                 const agentAddresses = frame.agentAddresses;
-                return authenticateHandshake(ws, frame, (identity) => handleRegister(ws, identity, agentAddresses));
+                const cachedSenderAddresses = frame.cachedSenderAddresses ?? [];
+                return authenticateHandshake(ws, frame, (identity) => handleRegister(ws, identity, agentAddresses, cachedSenderAddresses));
             }
             case "reconnect": {
                 const agentAddresses = frame.agentAddresses;
-                const deployRefs = frame.deployRefs ?? {};
-                return authenticateHandshake(ws, frame, (identity) => handleReconnect(ws, identity, agentAddresses, deployRefs));
+                const cachedSenderAddresses = frame.cachedSenderAddresses ?? [];
+                return authenticateHandshake(ws, frame, (identity) => handleReconnect(ws, identity, agentAddresses, cachedSenderAddresses));
             }
-            case "challenge.response":
-                return handleChallengeResponse(ws, frame.responses);
             case "agent.deploy.ack":
                 return handleDeployAck(ws, frame);
             case "agent.error":
@@ -473,21 +626,45 @@ export function createSidecarRouter(config) {
             case "ping":
                 handlePing(ws);
                 return;
-            case "mail.outbound":
-                if (frame.delivered !== true) {
-                    return handleMailOutbound(frame.rawMessage, frame.recipients);
+            case "mail.outbound": {
+                const conn = connections.get(ws);
+                if (conn === undefined)
+                    return;
+                if (!connOwnsAddress(conn, frame.senderAddress)) {
+                    logger.warn `Dropping mail.outbound from ${frame.senderAddress}: not registered to this sidecar`;
+                    return;
                 }
-                if (lookups.persistMail && frame.senderAddress) {
-                    return handleMailPersist(lookups.persistMail, frame.rawMessage, frame.senderAddress, frame.recipients);
+                // The DoS backstop and the trust boundary for an untrusted sidecar's
+                // mail body: measure the true byte cost (a hostile sidecar can send
+                // multi-byte UTF-8, so `.length` would undercount) and drop an over-cap
+                // frame here before either delivery path allocates on it. The socket's
+                // maxPayloadLength has already closed the connection for a truly huge
+                // frame; this catches one between the mail cap and that ceiling.
+                const bodyBytes = Buffer.byteLength(frame.rawMessage, "utf8");
+                if (bodyBytes > MAX_MAIL_OUTBOUND_BODY_BYTES) {
+                    logger.warn `Dropping mail.outbound from ${frame.senderAddress}: rawMessage of ${String(bodyBytes)} bytes exceeds the ${String(MAX_MAIL_OUTBOUND_BODY_BYTES)}-byte cap`;
+                    return;
                 }
-                if (!frame.senderAddress) {
-                    logger.warn `Dropping delivered mail.outbound frame with no senderAddress`;
+                if (frame.delivered !== true) {
+                    // frame.senderAddress is the sender this connection was just gated
+                    // on by connOwnsAddress above -- a hub-verified value. Thread it so
+                    // the relayed inbound frame is stamped with it, not the MIME From.
+                    return handleMailOutbound(frame.rawMessage, frame.senderAddress, frame.recipients);
                 }
-                else {
-                    logger.warn `Dropping delivered mail.outbound frame: no persistMail lookup configured`;
+                if (lookups.persistMail) {
+                    return handleMailPersist(lookups.persistMail, frame.rawMessage, frame.senderAddress, frame.recipients);
                 }
+                logger.warn `Dropping delivered mail.outbound frame: no persistMail lookup configured`;
                 return;
-            case "agent.event":
+            }
+            case "agent.event": {
+                const conn = connections.get(ws);
+                if (conn === undefined)
+                    return;
+                if (!connOwnsAddress(conn, frame.agentAddress)) {
+                    logger.warn `Dropping agent.event for ${frame.agentAddress}: not registered to this sidecar`;
+                    return;
+                }
                 events.emit("agent.event", {
                     agentAddress: frame.agentAddress,
                     sessionId: frame.sessionId,
@@ -495,6 +672,7 @@ export function createSidecarRouter(config) {
                 });
                 dispatchToSubscribers(frame.agentAddress, frame.event);
                 return;
+            }
             case "connector.state.changed":
                 // Gate the cache write on the sending sidecar actually owning
                 // the named agent. A misbehaving sidecar that knows another
@@ -542,10 +720,10 @@ export function createSidecarRouter(config) {
             case "signal.correlation.register":
                 return handleSignalCorrelationRegister(ws, frame);
             case "session.ack":
-                resolvePending(frame.requestId);
+                pendingRequests.resolve(frame.requestId);
                 return;
             case "session.error":
-                rejectPending(frame.requestId, frame.error);
+                pendingRequests.reject(frame.requestId, frame.error);
                 return;
             case "repo.pack.ack":
                 resolvePackPending(ws, frame);
@@ -559,7 +737,7 @@ export function createSidecarRouter(config) {
             case "repo.pack.done":
                 return handlePackDone(ws, frame);
             case "workflow.probe.result":
-                resolveProbe(frame.requestId, {
+                resolveProbe(ws, frame.requestId, {
                     projection: frame.projection,
                     grants: frame.grants,
                     grantWalkSnapshot: frame.grantWalkSnapshot,
@@ -567,7 +745,7 @@ export function createSidecarRouter(config) {
                 });
                 return;
             case "workflow.probe.error":
-                rejectProbe(frame.requestId, frame.error);
+                rejectProbe(ws, frame.requestId, frame.error);
                 return;
             default:
                 return assertNever(frame);
@@ -613,24 +791,61 @@ export function createSidecarRouter(config) {
         const current = allocatedConnections.get(allocationId);
         if (waiters === undefined || current === undefined)
             return;
-        if (!(await validateSidecarIdentity(current.identity, "readiness")))
+        const matchingWaiters = [...waiters].filter((waiter) => waiter.generation === current.identity.generation);
+        if (matchingWaiters.length === 0)
             return;
-        for (const waiter of [...waiters]) {
-            if (waiter.generation !== current.identity.generation)
+        const validation = Promise.resolve().then(() => validateSidecarIdentity(current.identity, "readiness"));
+        for (const waiter of matchingWaiters) {
+            waiter.validations.add(validation);
+            waiter.onValidation?.(validation);
+        }
+        let identityCurrent;
+        try {
+            identityCurrent = await validation;
+        }
+        catch (cause) {
+            // A failed revalidation leaves the waiters parked: a later register
+            // revalidates, and at expiry the wait reports the failure rather than a
+            // missed deadline. Registration itself was already gated, so this must
+            // not fail the connection that just registered.
+            const validationFailure = new SidecarIdentityValidationError(allocationId, current.identity.generation, cause);
+            for (const waiter of matchingWaiters) {
+                waiter.validationFailure = validationFailure;
+            }
+            return;
+        }
+        finally {
+            for (const waiter of matchingWaiters) {
+                waiter.validations.delete(validation);
+            }
+        }
+        // A clean validation supersedes earlier failures: expiry must report the
+        // current reading, not a stale transient.
+        for (const waiter of matchingWaiters) {
+            delete waiter.validationFailure;
+        }
+        if (!identityCurrent || allocatedConnections.get(allocationId) !== current)
+            return;
+        for (const waiter of matchingWaiters) {
+            if (!waiters.delete(waiter))
                 continue;
             clearTimeout(waiter.timer);
-            waiters.delete(waiter);
             waiter.resolve();
         }
-        if (waiters.size === 0)
+        if (waiters.size === 0 && allocationWaiters.get(allocationId) === waiters)
             allocationWaiters.delete(allocationId);
     }
-    async function handleAllocatedRegister(ws, identity, agentAddresses) {
+    async function handleAllocatedRegister(ws, identity, agentAddresses, cachedSenderAddresses) {
         if (allocationFences.get(identity.allocationId) !== identity.generation) {
             logger.warn `Rejected allocated sidecar ${identity.sidecarId}: allocation ${identity.allocationId} generation ${String(identity.generation)} is not fenced as current`;
             ws.close();
             return;
         }
+        if (identity.kind === "probe" && agentAddresses.length > 0) {
+            logger.warn `Rejected probe sidecar ${identity.sidecarId}: probe ${identity.allocationId} claimed workflow addresses`;
+            ws.close();
+            return;
+        }
         if (agentAddresses.length > 0 &&
             !(await validateSidecarIdentity(identity, "routing"))) {
             logger.warn `Rejected allocated sidecar ${identity.sidecarId}: allocation ${identity.allocationId} is not ready to reclaim routes`;
@@ -644,7 +859,8 @@ export function createSidecarRouter(config) {
                 existingOnSocket.identity.allocationId === identity.allocationId &&
                 addressIndex.get(address) === ws &&
                 connOwnsAddress(existingOnSocket, address);
-            if (!alreadyOwned && address !== identity.workflowRunAddress) {
+            if (identity.kind !== "allocated" ||
+                (!alreadyOwned && address !== identity.workflowRunAddress)) {
                 logger.warn `Rejected allocated sidecar ${identity.sidecarId}: allocation ${identity.allocationId} claimed unrelated address ${address}`;
                 ws.close();
                 return;
@@ -674,7 +890,7 @@ export function createSidecarRouter(config) {
                 ws.send(JSON.stringify(frame));
             },
         };
-        if (conn.identity.kind !== "allocated" ||
+        if (conn.identity.kind !== identity.kind ||
             conn.identity.allocationId !== identity.allocationId ||
             conn.identity.generation !== identity.generation) {
             logger.warn `Rejected allocated sidecar ${identity.sidecarId}: socket identity changed during registration`;
@@ -688,472 +904,275 @@ export function createSidecarRouter(config) {
         }
         allocatedConnections.set(identity.allocationId, { ws, identity });
         for (const address of newlyRoutedAddresses) {
-            redeliverPendingMail(address, conn);
-        }
-        logger.info `Allocated sidecar ${identity.sidecarId} registered for allocation ${identity.allocationId} generation ${String(identity.generation)}`;
-        await notifyAllocationWaiters(identity.allocationId);
-        events.emit("sidecar.allocated.connected", {
-            allocationId: identity.allocationId,
-            generation: identity.generation,
-        });
-    }
-    async function handleRegister(ws, identity, agentAddresses) {
-        if (identity.kind === "allocated") {
-            await handleAllocatedRegister(ws, identity, agentAddresses);
-            return;
-        }
-        const sidecarId = identity.sidecarId;
-        // Key-existence gate. A register frame is token-authenticated but carries
-        // no per-address ownership proof, so it may route an address ONLY if that
-        // address has no stored key yet -- a genuine keyless first-deploy (the
-        // token-bounded first-deploy trust model). An address that already has a
-        // key must prove ownership through the challenged reconnect path; routing
-        // it here on token auth alone is the register-frame sibling of the
-        // reconnect hijack. The keyless-only set is computed up front, BEFORE the
-        // ghost-cleanup and every routing mutation below, so a rejected address
-        // touches nothing: no eviction of a live owner, hence no downgrade from
-        // hijack to denial-of-service on the victim.
-        const lookupKey = lookups.lookupPublicKey;
-        const routableAddresses = [];
-        for (const addr of agentAddresses) {
-            if (lookupKey === undefined) {
-                // Fail closed: without the ownership lookup a keyed address cannot be
-                // told apart from a first-deploy, so route nothing and surface the
-                // misconfiguration. Empty first-connect registers never reach here.
-                logger.error `Cannot gate register routing for ${addr}: lookupPublicKey is not configured; refusing to route (challenged reconnect required)`;
-                continue;
-            }
-            let existingKey;
-            try {
-                existingKey = await lookupKey(addr);
-            }
-            catch (err) {
-                // Fail closed on a lookup error (e.g. a transient DB failure): route
-                // nothing for this address and surface the failure, rather than let
-                // the rejection float out of this void-dispatched handler and take
-                // down the hub.
-                logger.error `Key lookup failed for ${addr} during register: ${err instanceof Error ? err.message : String(err)}; failing closed (challenged reconnect required)`;
-                continue;
-            }
-            if (existingKey !== null) {
-                logger.warn `Refusing to route ${addr} via register: address already has a stored key; ownership must be proven via challenged reconnect`;
-                continue;
+            await redeliverPendingMail(address, conn);
+        }
+        // Reconcile a reconnecting deployment's credentials, closing the offline
+        // window: a credential revoked, deleted, or rotated while the sidecar was
+        // disconnected is applied to the child now. Fire-and-forget so
+        // registration is not blocked; the lookup no-ops for a run that persisted
+        // no credential refs.
+        const resyncCredentials = lookups.resyncCredentials;
+        if (resyncCredentials !== undefined) {
+            for (const address of newlyRoutedAddresses) {
+                if (!isRunAddress(address))
+                    continue;
+                resyncCredentials(address);
             }
-            routableAddresses.push(addr);
         }
-        // Additive re-register: inherit every address this ws already owns and ADD
-        // the frame's keyless first-deploys. Register never drops an owned route --
-        // an address proved via challenged reconnect stays routed, and removal
-        // happens via undeploy/disconnect, not register-omission.
-        //
-        // (Under the retired full-set model a register frame carried the sidecar's
-        // complete live set, so an omitted address meant "removed". Now the frame
-        // carries only keyless first-deploys the sidecar is adding -- keyed
-        // addresses arrive via reconnect -- so omission is meaningless, and a
-        // replace-on-register would wrongly drop an earlier first-deploy when a
-        // later one is registered, as well as any reconnect-verified keyed route.)
-        const existing = connections.get(ws);
-        const inheritedAgent = new Set(existing?.agentAddresses);
-        const inheritedWorkflow = new Set(existing?.workflowAddresses);
-        // Clean up ghost entries from OTHER connections for the newly-claimed
-        // addresses only. An inherited address is already owned by this ws
-        // (prevWs === ws), so it needs no eviction and its in-flight deploy must
-        // not be cancelled.
-        for (const addr of routableAddresses) {
-            const prevWs = addressIndex.get(addr);
-            if (prevWs !== undefined && prevWs !== ws) {
-                const prevConn = connections.get(prevWs);
-                if (prevConn !== undefined) {
-                    prevConn.agentAddresses.delete(addr);
-                }
-                // The new owner is about to take over; the prior owner's
-                // cached state must not survive into the new owner's window
-                // before its bootstrap frame arrives.
-                connectorStates.delete(addr);
+        // Reconcile the sidecar's cached sender keys, closing the offline window: a
+        // user-principal key that rotated while the sidecar was disconnected is
+        // re-resolved and re-pushed, and a sender whose principal was DELETED while
+        // the sidecar was disconnected is evicted, so the recipient stops verifying
+        // either against a key the hub no longer vouches for. Only allocated
+        // sidecars host a sender cache worth reconciling. Resolve and push
+        // SEQUENTIALLY in one detached task: registration is never blocked, and a
+        // large cache cannot fan out into one concurrent DB query per reported
+        // sender on every reconnect.
+        const resolveSenderKeyStrict = lookups.resolveSenderKeyStrict;
+        if (identity.kind === "allocated" && resolveSenderKeyStrict !== undefined) {
+            const rotatableSenders = new Set(cachedSenderAddresses);
+            // Resolve-don't-trust applied to input SIZE: bound the reported set before
+            // acting on it. Run addresses count toward the cap by design -- the
+            // isRunAddress skip below is inside the loop, so the iteration, and thus
+            // the DB resolves, can never exceed the cap regardless of the run/non-run
+            // mix. Over the cap, reconcile the first MAX_RESYNC_SENDER_ADDRESSES and
+            // log the overflow so a misbehaving sidecar is detectable.
+            let sendersToResync = [...rotatableSenders];
+            if (sendersToResync.length > MAX_RESYNC_SENDER_ADDRESSES) {
+                logger.warn `Sidecar ${identity.sidecarId} reported ${String(sendersToResync.length)} cached sender addresses on allocation ${identity.allocationId} generation ${String(identity.generation)}, over the ${String(MAX_RESYNC_SENDER_ADDRESSES)} resync cap; reconciling the first ${String(MAX_RESYNC_SENDER_ADDRESSES)} and ignoring the rest`;
+                sendersToResync = sendersToResync.slice(0, MAX_RESYNC_SENDER_ADDRESSES);
             }
-            // Cancel any in-flight deploy for this address since the
-            // reconnecting sidecar is taking ownership.
-            const staleDeployReq = pendingDeploys.get(addr);
-            if (staleDeployReq !== undefined) {
-                clearTimeout(staleDeployReq.timer);
-                pendingDeploys.delete(addr);
-                staleDeployReq.reject(`Sidecar ${sidecarId} reconnected and claimed address "${addr}"`);
-            }
-        }
-        // New keyless first-deploys join the inherited session set; the workflow
-        // set is inherited unchanged (register never adds to it -- a
-        // workflow-derived address routes only through the challenged reconnect).
-        for (const addr of routableAddresses) {
-            inheritedAgent.add(addr);
-        }
-        const addrSet = inheritedAgent;
-        const workflowSet = inheritedWorkflow;
-        const conn = {
-            sidecarId,
-            identity,
-            agentAddresses: addrSet,
-            workflowAddresses: workflowSet,
-            send(frame) {
-                ws.send(JSON.stringify(frame));
-            },
-        };
-        connections.set(ws, conn);
-        // Only the newly-claimed addresses need a routing write + queue discard;
-        // inherited addresses already point at this ws in addressIndex.
-        for (const addr of routableAddresses) {
-            addressIndex.set(addr, ws);
-            // Discard any disconnect queue — register has no identity
-            // verification, so flushing to an unverified connection is unsafe.
-            // Use reconnect with challenge/response to preserve queued messages.
-            const staleQueue = disconnectedAgents.get(addr);
-            if (staleQueue !== undefined) {
-                clearTimeout(staleQueue.timer);
-                if (staleQueue.queue.length > 0) {
-                    logger.warn `Discarding ${String(staleQueue.queue.length)} queued message(s) for ${addr} on unverified register`;
+            void (async () => {
+                for (const address of sendersToResync) {
+                    // The sidecar already reports only non-run senders, but do not trust
+                    // the report: a run sender's key is the immutable
+                    // workflow_run.public_key and is never refreshed or evicted, so skip
+                    // it here too rather than couple correctness to the sidecar's filter.
+                    if (isRunAddress(address))
+                        continue;
+                    // Tri-state, deleted-vs-fault distinguished by the STRICT resolver:
+                    //   - resolves to a key -> refresh the sidecar's cached key;
+                    //   - CONFIRMED null (no matching principal = a deleted sender) ->
+                    //     evict it;
+                    //   - THROWS (fault: ambiguous address, keyless-principal invariant
+                    //     break, DB error) -> keep the stale key, evict nothing.
+                    // Never evicting on a fault is the load-bearing property: dropping a
+                    // live key on a transient DB fault would be worse than doing nothing.
+                    // Only the resolve is guarded here; conn.send stays outside so a
+                    // socket-gone throw propagates to the outer catch and stops the loop.
+                    let publicKey;
+                    try {
+                        publicKey = await resolveSenderKeyStrict(address);
+                    }
+                    catch (cause) {
+                        const message = cause instanceof Error ? cause.message : String(cause);
+                        logger.error `Keeping the stale cached key for ${address}: resolving it faulted (a fault, not a deleted sender): ${message}`;
+                        continue;
+                    }
+                    if (publicKey !== null) {
+                        conn.send({ type: "sender.key.refresh", address, publicKey });
+                    }
+                    else {
+                        conn.send({ type: "sender.key.evict", address });
+                    }
                 }
-                disconnectedAgents.delete(addr);
-            }
+            })().catch((cause) => {
+                // The per-address resolve is guarded above, so the only throw reaching
+                // here is conn.send (JSON.stringify + the socket write) once the sidecar
+                // is gone. That means the connection left, so stop -- the remaining
+                // sends would fail the same way.
+                const message = cause instanceof Error ? cause.message : String(cause);
+                logger.warn `Sender-key resync for sidecar ${identity.sidecarId} stopped: ${message}`;
+            });
         }
-        // Only keyless first-deploy addresses reach `addressIndex` here; an
-        // address that already has a stored key was filtered out by the gate
-        // above and must re-enter routing through the challenged reconnect path.
-        // Because the gate runs before the ghost-cleanup, a rejected (keyed)
-        // address never evicts its prior owner -- register cannot reclaim or
-        // disrupt a victim's route on token auth alone.
-        logger.info `Sidecar ${sidecarId} registered; routed ${String(addrSet.size)} of ${String(agentAddresses.length)} address(es) (keyless first-deploy only)`;
-    }
-    async function handleReconnect(ws, identity, agentAddresses, deployRefs = {}) {
+        logger.info `Provisioned sidecar ${identity.sidecarId} registered for allocation ${identity.allocationId} generation ${String(identity.generation)}`;
+        await notifyAllocationWaiters(identity.allocationId);
         if (identity.kind === "allocated") {
-            await handleAllocatedRegister(ws, identity, agentAddresses);
-            return;
+            events.emit("sidecar.allocated.connected", {
+                allocationId: identity.allocationId,
+                generation: identity.generation,
+            });
         }
-        const sidecarId = identity.sidecarId;
-        const lookupKey = lookups.lookupPublicKey;
-        if (lookupKey === undefined) {
-            logger.error `Received reconnect frame but no lookupPublicKey is configured`;
-            ws.close();
-            return;
+    }
+    async function handleRegister(ws, identity, agentAddresses, cachedSenderAddresses) {
+        await handleAllocatedRegister(ws, identity, agentAddresses, cachedSenderAddresses);
+    }
+    async function handleReconnect(ws, identity, agentAddresses, cachedSenderAddresses) {
+        await handleAllocatedRegister(ws, identity, agentAddresses, cachedSenderAddresses);
+    }
+    // Park a pre-ack sender's mail synchronously and return its entry. Registering
+    // the entry BEFORE the caller awaits `resolveSenderKey` is the interlock that
+    // guarantees a settle landing during the resolve has an entry to find: the
+    // event loop is single-threaded, so no settle can interleave between this
+    // synchronous registration and the caller's first await.
+    function parkDeferredSenderMail(authenticatedSender, rawMessage, recipients) {
+        let parked = deferredSenderMail.get(authenticatedSender);
+        if (parked === undefined) {
+            parked = new Set();
+            deferredSenderMail.set(authenticatedSender, parked);
         }
-        // Cancel any existing pending challenge for this ws before doing
-        // async work, so concurrent reconnect frames don't race.
-        const existingChallenge = pendingChallenges.get(ws);
-        if (existingChallenge !== undefined) {
-            clearTimeout(existingChallenge.timer);
-            pendingChallenges.delete(ws);
-        }
-        // Capture the addresses this live connection already owns. The
-        // internal register below clears them, but ones the reconnect is not
-        // re-challenging are still valid — an agent provisioned during the
-        // sidecar's restore window is routed into addressIndex by its deploy
-        // and is not part of the disk-restored set this reconnect carries.
-        // Without preserving them, the reconnect silently drops a
-        // freshly-deployed agent from routing.
-        const previouslyOwned = new Set(connections.get(ws)?.agentAddresses);
-        // Register the sidecar connection immediately (with no addresses) so it
-        // can receive frames while the ownership challenge is pending. Every
-        // reconnect address -- session and workflow-derived alike -- enters
-        // routing only through the verified path below, never unchallenged here.
-        // Empty address list, so the key-existence gate has nothing to await.
-        // The identity was already verified at the dispatch boundary, so the
-        // internal register does not re-authenticate.
-        await handleRegister(ws, identity, []);
-        const conn = connections.get(ws);
-        if (conn === undefined)
-            return;
-        // Re-add the still-owned addresses the register cleared but this
-        // reconnect is not re-challenging. The challenged addresses below
-        // re-enter addressIndex through the verified path instead.
-        const claimedAddresses = new Set(agentAddresses);
-        for (const addr of previouslyOwned) {
-            if (claimedAddresses.has(addr))
-                continue;
-            conn.agentAddresses.add(addr);
-            addressIndex.set(addr, ws);
-        }
-        // Look up stored public keys for all claimed addresses. Fail closed on a
-        // lookup error (e.g. a transient DB failure): treat the address as
-        // unverifiable so it fails its challenge and stays unrouted, rather than
-        // letting the rejection float out of this void-dispatched handler as an
-        // unhandled rejection that could take down the hub.
-        const keyLookups = await Promise.all(agentAddresses.map(async (addr) => {
-            try {
-                return { address: addr, publicKeyHex: await lookupKey(addr) };
-            }
-            catch (err) {
-                logger.error `Key lookup failed for ${addr} during reconnect: ${err instanceof Error ? err.message : String(err)}; failing closed`;
-                return { address: addr, publicKeyHex: null };
-            }
-        }));
-        // If the connection was closed or superseded while we were awaiting
-        // key lookups, bail out.
-        if (!connections.has(ws))
-            return;
-        const challenges = new Map();
-        const challengeEntries = [];
-        for (const { address, publicKeyHex } of keyLookups) {
-            if (publicKeyHex === null) {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Unknown run address",
-                });
-                continue;
-            }
-            let publicKey;
-            try {
-                publicKey = hexDecode(publicKeyHex);
-            }
-            catch {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Stored public key is corrupt",
+        const entry = {
+            authenticatedSender,
+            rawMessage,
+            recipients,
+            timer: setTimeout(() => {
+                // TTL backstop for the case where a settle never arrives (the sender's
+                // deploy never acked and never failed loudly). Claim the entry and
+                // surface it as undelivered so the mail is not held forever.
+                if (!claimDeferredSenderEntry(entry))
+                    return;
+                events.emit("mail.outbound.undelivered", {
+                    rawMessage: entry.rawMessage,
+                    recipients: entry.recipients,
                 });
-                logger.error `Corrupt stored public key for ${address}`;
-                continue;
-            }
-            const nonce = crypto.getRandomValues(new Uint8Array(32));
-            challenges.set(address, { nonce, publicKey });
-            challengeEntries.push({ address, nonce: hexEncode(nonce) });
-        }
-        if (challenges.size === 0)
-            return;
-        // If another reconnect completed while we were building the
-        // challenge, it will have written its own entry. Don't overwrite.
-        if (pendingChallenges.has(ws))
-            return;
-        const timer = setTimeout(() => {
-            pendingChallenges.delete(ws);
-            logger.warn `Challenge timed out for sidecar ${sidecarId}`;
-        }, challengeTimeoutMs);
-        pendingChallenges.set(ws, {
-            sidecarId,
-            challenges,
-            deployRefs,
-            timer,
-        });
-        conn.send({ type: "challenge", challenges: challengeEntries });
+                logger.warn `Dropping mail from ${entry.authenticatedSender}: its sender key was not recorded before the deferred-mail TTL expired`;
+            }, disconnectQueueTTLMs),
+        };
+        parked.add(entry);
+        return entry;
+    }
+    // Remove one parked entry by identity, clearing its TTL timer. Returns whether
+    // THIS call removed it. The inline-deliver path, a settle, and the TTL all
+    // race to claim the same entry; only the claimer acts on it, so a claim that
+    // finds nothing (already claimed) is a no-op. This is the idempotent
+    // remove-by-key that keeps a settle and the inline non-null branch from both
+    // delivering the same message.
+    function claimDeferredSenderEntry(entry) {
+        const parked = deferredSenderMail.get(entry.authenticatedSender);
+        if (parked === undefined)
+            return false;
+        const claimed = parked.delete(entry);
+        if (!claimed)
+            return false;
+        clearTimeout(entry.timer);
+        if (parked.size === 0)
+            deferredSenderMail.delete(entry.authenticatedSender);
+        return true;
     }
-    async function handleChallengeResponse(ws, responses) {
-        const challenge = pendingChallenges.get(ws);
-        if (challenge === undefined) {
-            logger.warn `Received challenge.response with no pending challenge`;
-            return;
-        }
-        clearTimeout(challenge.timer);
-        pendingChallenges.delete(ws);
-        const conn = connections.get(ws);
-        if (conn === undefined)
+    // Claim every entry parked for a sender, clearing their TTL timers. A later
+    // settle or TTL for the same sender then finds nothing.
+    function claimAllDeferredSenderMail(authenticatedSender) {
+        const parked = deferredSenderMail.get(authenticatedSender);
+        if (parked === undefined)
+            return [];
+        deferredSenderMail.delete(authenticatedSender);
+        const entries = [...parked];
+        for (const entry of entries)
+            clearTimeout(entry.timer);
+        return entries;
+    }
+    function drainDeferredSenderMail(authenticatedSender, reason) {
+        const entries = claimAllDeferredSenderMail(authenticatedSender);
+        if (entries.length === 0)
             return;
-        const verified = [];
-        const responded = new Set();
-        for (const { address, signature } of responses) {
-            responded.add(address);
-            const entry = challenge.challenges.get(address);
-            if (entry === undefined) {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Address was not challenged",
-                });
-                continue;
-            }
-            let valid = false;
-            try {
-                const nonceBytes = entry.nonce;
-                const addressBytes = new TextEncoder().encode(address);
-                const payload = new Uint8Array(nonceBytes.length + addressBytes.length);
-                payload.set(nonceBytes);
-                payload.set(addressBytes, nonceBytes.length);
-                const sigBytes = hexDecode(signature);
-                valid = await verifyEd25519(payload, sigBytes, entry.publicKey);
-            }
-            catch (err) {
-                logger.warn `Challenge failed for ${address}: ${err instanceof Error ? err.message : String(err)}`;
-            }
-            if (valid) {
-                verified.push(address);
-            }
-            else {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "Signature verification failed",
-                });
-            }
+        for (const entry of entries) {
+            events.emit("mail.outbound.undelivered", {
+                rawMessage: entry.rawMessage,
+                recipients: entry.recipients,
+            });
         }
-        // Notify about challenged addresses that were omitted from the response.
-        for (const address of challenge.challenges.keys()) {
-            if (!responded.has(address)) {
-                conn.send({
-                    type: "challenge.failed",
-                    address,
-                    reason: "No response provided for challenged address",
-                });
-                logger.warn `Challenge failed for ${address}: no response provided`;
-            }
+        logger.warn `Dropping ${String(entries.length)} deferred message(s) from ${authenticatedSender}: ${reason}`;
+    }
+    function noteSenderDeployStarted(address, attempt) {
+        if (allocatedKeyRecordInFlight.has(address)) {
+            throw new Error(`Sender deployment ${address} has an unresolved attempt`);
         }
-        // Add verified addresses to the routing table immediately so that
-        // `agent.reconnected` subscribers can use sendRequest-based methods
-        // (e.g. sendSourcesUpdate). Addresses that fail governance are
-        // rolled back from the routing table afterward.
-        for (const addr of verified) {
-            // If a different ws still owns this address (live takeover via
-            // verified reconnect), evict its cached connector state before
-            // routing flips. The new owner's harness will bootstrap via
-            // restore-fires-callback.
-            const prevWs = addressIndex.get(addr);
-            if (prevWs !== undefined && prevWs !== ws) {
-                connectorStates.delete(addr);
-                // Evict the reclaimed address from the superseded connection's owned
-                // set. handleClose's cancelByAgent sweep iterates a connection's owned
-                // union WITHOUT an ownership guard, so if the stale connection still
-                // listed this address it would cancel THIS connection's in-flight pack
-                // transfer for it when it finally closes. Delete from both sets: a
-                // workflow-derived address lives on the workflow set, a launched agent
-                // on the session set, and delete is a no-op for the absent one.
-                const prevConn = connections.get(prevWs);
-                if (prevConn !== undefined) {
-                    prevConn.workflowAddresses.delete(addr);
-                    prevConn.agentAddresses.delete(addr);
+        allocatedKeyRecordInFlight.set(address, attempt);
+    }
+    function noteSenderDeploySettled(sender, outcome) {
+        if (typeof sender !== "string") {
+            for (const [address, attempt] of [...allocatedKeyRecordInFlight]) {
+                if (attempt.allocationId !== sender.allocationId ||
+                    attempt.generation !== sender.generation ||
+                    ("leaseId" in sender && attempt.leaseId !== sender.leaseId)) {
+                    continue;
                 }
+                allocatedKeyRecordInFlight.delete(address);
+                settleSenderMail(address, outcome);
             }
-            // A run address goes on the workflow set (no disconnect queue -- its
-            // in-flight state is reconstructed sidecar-locally on the next reconnect),
-            // so handleClose reclaims it correctly. The routing pointer is the same
-            // either way; only now it is written behind a passed challenge.
-            //
-            // The `else` (session set, queued for reconnect) is the retired
-            // launched-agent path: launched agents no longer exist (the folded-launch
-            // route was removed), so no current producer reaches it. It is left in
-            // place for the reconnect-subsystem teardown to remove as its own
-            // reviewable change, not folded into this collapse.
-            if (isRunAddress(addr)) {
-                conn.workflowAddresses.add(addr);
-            }
-            else {
-                conn.agentAddresses.add(addr);
-            }
-            addressIndex.set(addr, ws);
-        }
-        const ready = [];
-        const failed = [];
-        for (const addr of verified) {
-            // A workflow run needs routing + queue flush only, which the passed
-            // challenge has now made safe: its in-flight state is reconstructed
-            // sidecar-locally, so it does not enrol in the `agent.reconnected` session
-            // reaction (event-collector restore). Skip the reaction for it.
-            //
-            // The reaction below was the retired launched-agent path (restore a
-            // launched agent's collector). Launched agents no longer exist, so no
-            // current producer reaches it; the `agent.reconnected` listener is gone,
-            // so `listenerCount` is 0 and the emit is inert. Left for the
-            // reconnect-subsystem teardown to remove.
-            if (isRunAddress(addr)) {
-                ready.push(addr);
-                continue;
-            }
-            if (events.listenerCount("agent.reconnected") === 0) {
-                ready.push(addr);
-                continue;
-            }
-            try {
-                await events.emitAndAwait("agent.reconnected", { agentAddress: addr });
-                ready.push(addr);
-            }
-            catch (err) {
-                logger.error `Failed to handle reconnection for ${addr}: ${err instanceof Error ? err.message : String(err)}`;
-                failed.push(addr);
-            }
+            return;
         }
-        // If a second reconnect arrived during the callback loop, our conn
-        // is orphaned — handleRegister already rebuilt the connection and
-        // cleared addressIndex. Bail out; the new reconnect flow will
-        // re-verify these addresses from scratch.
-        if (connections.get(ws) !== conn) {
-            logger.warn `Challenge response processing aborted: connection superseded by new reconnect`;
-            return;
-        }
-        // Roll back failed addresses from the routing table. Only the session set
-        // is touched: a workflow-derived address can never be in `failed` -- it
-        // early-`continue`s to `ready` above, before the reaction that populates
-        // `failed` -- so it is never on the workflow set at this point.
-        for (const addr of failed) {
-            conn.agentAddresses.delete(addr);
-            addressIndex.delete(addr);
-        }
-        // Flush queued messages and redeliver retained un-acked mail, only for
-        // ready addresses. The disconnect queue carries mail that arrived WHILE
-        // disconnected; pending-mail redelivery carries mail that was delivered
-        // over the prior live connection but never acked (the connected-window
-        // drop). Both replay over the verified new connection.
-        for (const addr of ready) {
-            flushDisconnectedQueue(addr, conn);
-            redeliverPendingMail(addr, conn);
-        }
-        // Re-deploy agents whose deploy ref is stale or absent. Fire-and-forget
-        // so reconnect completion is not blocked on pack transfer. The
-        // wire layer owns the staleness comparison; the event fires only
-        // when staleness is confirmed.
-        const checkDeployRef = lookups.lookupDeployRef;
-        if (checkDeployRef !== undefined) {
-            for (const addr of ready) {
-                // Workflow deployments are pinned-forever: a deployment keeps its
-                // deploy-time definition until an explicit undeploy/redeploy, so the
-                // deploy-ref freshness catch-up is deliberately NOT run for a run
-                // address. A definition edited on the hub while the sidecar was
-                // disconnected does not reconcile on reconnect; it affects only newly
-                // created deployments. The deployment's in-flight run state is
-                // reconstructed sidecar-locally at restore, not re-fetched here. Do NOT
-                // add a reconcile path for these addresses -- see the "Workflow
-                // Definition Versioning: Pinned-Forever" note under "Reconnect
-                // Sequencing" in docs/IMPLEMENTATION.md. (Every routable address is a
-                // run address now; the fall-through was the retired launched-agent
-                // catch-up path.)
-                if (isRunAddress(addr))
-                    continue;
-                void (async () => {
-                    try {
-                        const hubRef = await checkDeployRef(addr);
-                        if (hubRef === null)
-                            return;
-                        const sidecarRef = challenge.deployRefs[addr];
-                        if (sidecarRef === hubRef)
-                            return;
-                        logger.info `Re-deploying ${addr}: sidecar ref ${sidecarRef ?? "(none)"} != hub ref ${hubRef.slice(0, 8)}`;
-                        await events.emitAndAwait("deploy.ref.stale", {
-                            agentAddress: addr,
-                        });
-                    }
-                    catch (err) {
-                        logger.error `Failed to re-deploy ${addr} after reconnect: ${err instanceof Error ? err.message : String(err)}`;
-                    }
-                })();
-            }
+        if (allocatedKeyRecordInFlight.has(sender))
+            return;
+        settleSenderMail(sender, outcome);
+    }
+    function settleSenderMail(address, outcome) {
+        if ("failed" in outcome) {
+            drainDeferredSenderMail(address, `sender deploy failed: ${outcome.failed}`);
+            return;
         }
-        // Failed addresses: reset their queue TTL so messages survive until
-        // the next reconnect attempt, and notify the sidecar.
-        for (const addr of failed) {
-            const entry = disconnectedAgents.get(addr);
-            if (entry !== undefined) {
-                clearTimeout(entry.timer);
-                entry.timer = setTimeout(() => {
-                    const expired = disconnectedAgents.get(addr);
-                    disconnectedAgents.delete(addr);
-                    if (expired !== undefined) {
-                        surfaceDroppedFrames(addr, expired.queue, "disconnect queue TTL expired");
-                    }
-                }, disconnectQueueTTLMs);
-            }
-            conn.send({
-                type: "challenge.failed",
-                address: addr,
-                reason: "Reconnection rejected by governance",
+        for (const entry of claimAllDeferredSenderMail(address)) {
+            // Re-drive delivery as its OWN task, off the settle's stack, so delivery
+            // work never runs on the deploy-ack handler's stack. Carry the confirmed
+            // key: another attempt may start before this task runs, and must not
+            // capture this mail or change the key that authenticates it.
+            void Promise.resolve()
+                .then(() => handleMailOutbound(entry.rawMessage, entry.authenticatedSender, entry.recipients, outcome.recorded))
+                .catch((err) => {
+                logger.error `Re-driving deferred mail from ${entry.authenticatedSender} failed: ${err instanceof Error ? err.message : String(err)}`;
             });
         }
-        logger.info `Sidecar ${challenge.sidecarId} reconnected with ${String(ready.length)} verified agent(s)${failed.length > 0 ? `, ${String(failed.length)} rejected` : ""}`;
     }
-    async function handleMailOutbound(rawMessage, recipients) {
+    function senderIdentitiesFromKey(address, publicKey) {
+        return publicKey !== null ? [{ address, publicKey }] : undefined;
+    }
+    // Resolve the co-delivered sender identities for a message, applying the
+    // register-before-read interlock for a pre-ack run sender. Returns either
+    // `deliver: true` with the resolved identities (undefined when there is no
+    // resolvable key), or `deliver: false` when the message is parked and will be
+    // driven later by a settle (`noteSenderDeploySettled`) or the TTL.
+    async function resolveSenderIdentitiesOrPark(rawMessage, authenticatedSender, recipients) {
+        const resolveSenderKey = lookups.resolveSenderKey;
+        if (resolveSenderKey === undefined)
+            return { deliver: true, senderIdentities: undefined };
+        // The co-delivered key is consumed only by a run recipient caching it from the
+        // run.grants frame. Purely external/federated mail never uses it and is never
+        // locally verified, so resolve nothing and never park it.
+        if (!recipients.some(isRunAddress))
+            return { deliver: true, senderIdentities: undefined };
+        // A stable-key (non-run) sender has no pre-ack window; resolve inline.
+        if (!isRunAddress(authenticatedSender)) {
+            const key = await resolveSenderKey(authenticatedSender);
+            return {
+                deliver: true,
+                senderIdentities: senderIdentitiesFromKey(authenticatedSender, key),
+            };
+        }
+        // Park a run sender ONLY while a key-record settle is guaranteed to arrive -- a
+        // deploy is in flight. Without one, a null resolve is a transient fault or a
+        // genuine absence on an already-settled run: no settle is coming, so parking
+        // would strand the mail to the TTL. Deliver on the normal path instead.
+        const settleGuaranteed = pendingDeploys.has(authenticatedSender) ||
+            allocatedKeyRecordInFlight.has(authenticatedSender);
+        if (!settleGuaranteed) {
+            const key = await resolveSenderKey(authenticatedSender);
+            return {
+                deliver: true,
+                senderIdentities: senderIdentitiesFromKey(authenticatedSender, key),
+            };
+        }
+        // Register-before-read: park a waiter entry synchronously (NO await) so a
+        // settle that lands while we resolve below has an entry to find, THEN
+        // resolve. The single-threaded event loop cannot interleave a settle between
+        // this registration and the await.
+        const entry = parkDeferredSenderMail(authenticatedSender, rawMessage, recipients);
+        const key = await resolveSenderKey(authenticatedSender);
+        if (key === null) {
+            // Not recorded yet. Leave the entry parked; a settle or the TTL drives it.
+            return { deliver: false };
+        }
+        // The key was already recorded before we parked. Claim our entry and deliver
+        // inline -- unless a concurrent settle already claimed it and is re-driving
+        // this message, in which case claiming fails and we must NOT deliver again.
+        if (!claimDeferredSenderEntry(entry)) {
+            return { deliver: false };
+        }
+        return {
+            deliver: true,
+            senderIdentities: senderIdentitiesFromKey(authenticatedSender, key),
+        };
+    }
+    async function handleMailOutbound(rawMessage, authenticatedSender, recipients, recordedSenderKey) {
         // A mail addressed to more than one workflow deployment would birth a
         // run per recipient from a single inbound mail. The stable runId
         // removed the Message-ID collision that originally forced this guard --
@@ -1176,6 +1195,23 @@ export function createSidecarRouter(config) {
                 throw new Error(`mail addressed to multiple workflow-derived recipients (${workflowRecipients.join(", ")}); materializing a run for more than one workflow deployment from a single mail is unsupported`);
             }
         }
+        // Resolve the sender's hub-held key ONCE for the whole message, ahead of the
+        // recipient fan-out and any grant materialization, so every recipient in
+        // this fan-out binds the same key snapshot. A run-address sender may be
+        // pre-ack -- it minted its keypair locally and can send before the hub
+        // records its public key. The register-before-read interlock holds such mail
+        // until the key lands rather than delivering it keyless, which a strict
+        // recipient drops as an unknown sender. A parked message returns here and is
+        // re-driven later by a settle or the TTL.
+        const resolution = recordedSenderKey === undefined
+            ? await resolveSenderIdentitiesOrPark(rawMessage, authenticatedSender, recipients)
+            : {
+                deliver: true,
+                senderIdentities: senderIdentitiesFromKey(authenticatedSender, recordedSenderKey),
+            };
+        if (!resolution.deliver)
+            return;
+        const senderIdentities = resolution.senderIdentities;
         // Route to locally connected sidecars first, then try disconnect queues.
         const unrouted = [];
         for (const recipient of recipients) {
@@ -1184,7 +1220,7 @@ export function createSidecarRouter(config) {
             // co-recipients. The catch fails THIS recipient closed (its run never
             // starts under-authorized) and continues to the rest.
             try {
-                const outcome = await deliverMailToRecipient(recipient, rawMessage);
+                const outcome = await deliverMailToRecipient(recipient, rawMessage, authenticatedSender, senderIdentities);
                 if (outcome === "unrouted")
                     unrouted.push(recipient);
             }
@@ -1219,10 +1255,19 @@ export function createSidecarRouter(config) {
     // grants rather than failing closed. Reservation happens before routing so
     // concurrent first deliveries cannot send different snapshots; a routing
     // failure leaves a grants-only, still-unfired run.
-    async function deliverMailToRecipient(recipient, rawMessage) {
+    async function deliverMailToRecipient(recipient, rawMessage, authenticatedSender, senderIdentities) {
         if (lookups.materializeMailTriggeredRunGrants !== undefined &&
             isRunAddress(recipient)) {
             const runId = deriveWorkflowRunId(recipient);
+            // This does NOT let mail mutate a run's authorization. First delivery
+            // reserves and commits the run's grants (the mail IS the trigger);
+            // every later delivery only RE-READS the current committed grants
+            // (`loadCommittedRunGrants`) and re-asserts them ahead of the dispatch.
+            // The committed rows already carry any standing-approval change (an
+            // approve/reject-with-`always` resolution mutates them through its own
+            // path), so this re-send is idempotent -- it re-establishes the run's
+            // current floor on the sidecar, self-healing a `grants.json` a sidecar
+            // may have lost, and never overwrites it with anything staler.
             const result = await lookups.materializeMailTriggeredRunGrants({
                 agentAddress: recipient,
                 runId,
@@ -1235,11 +1280,23 @@ export function createSidecarRouter(config) {
                 return "failed-closed";
             }
             if (result.outcome === "materialized") {
+                // The sender's hub-held key was resolved ONCE in handleMailOutbound,
+                // ahead of this fan-out, and threaded in as `senderIdentities`. Co-
+                // deliver it on the run's grants barrier so a recipient that caches from
+                // the `run.grants` frame binds the sender address to the key and can
+                // verify the sender's mail locally. A null key is never carried (the
+                // list is undefined then), so the "authorized-with-a-key implies key
+                // cached" invariant holds; a recipient with no cached key resolves such
+                // mail as `unknown`, which its admission policy rejects by default (a
+                // workflow may relax `unknown` to admit).
+                // Finish asynchronous preparation before sending the grants and mail
+                // together, keeping another delivery's key out of the gap between them.
+                const messageId = await deriveMessageId(base64Decode(rawMessage));
                 // Send the run's grants ahead of the mail. A `false` here means the
                 // deployment is unroutable. Do not route the mail that would dispatch
                 // it; the grants-only reservation remains the canonical snapshot for a
                 // later first-delivery attempt.
-                if (!sendRunGrants(recipient, runId, result.stepGrants)) {
+                if (!sendRunGrants(recipient, runId, result.stepGrants, senderIdentities)) {
                     logger.error `Deployment ${recipient} is not routable for run ${runId}; retaining the unfired run's grant reservation for retry`;
                     return "unrouted";
                 }
@@ -1253,8 +1310,11 @@ export function createSidecarRouter(config) {
                 // mail's own id (derived over the same bytes the sidecar derives), so a
                 // redelivery replays identically and the downstream RunStarted /
                 // stable-runId dedup makes it effectively-once.
-                const messageId = await deriveMessageId(base64Decode(rawMessage));
-                const outcome = routeMail(recipient, rawMessage, messageId, { runId, stepGrants: result.stepGrants })
+                const outcome = routeMail(recipient, rawMessage, authenticatedSender, messageId, {
+                    runId,
+                    stepGrants: result.stepGrants,
+                    ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+                })
                     ? "routed"
                     : "unrouted";
                 return outcome;
@@ -1263,7 +1323,9 @@ export function createSidecarRouter(config) {
             // the mail without grants -- the run, if any, is not ours to
             // authorize. No run is committed here, so no ack handshake is needed.
         }
-        return routeMail(recipient, rawMessage) ? "routed" : "unrouted";
+        return routeMail(recipient, rawMessage, authenticatedSender)
+            ? "routed"
+            : "unrouted";
     }
     async function handleMailPersist(persist, rawMessage, senderAddress, recipients) {
         let results;
@@ -1381,18 +1443,19 @@ export function createSidecarRouter(config) {
         for (const addr of conn.workflowAddresses) {
             if (addressIndex.get(addr) === ws) {
                 addressIndex.delete(addr);
+                connectorStates.delete(addr);
                 // Retain un-acked workflow trigger mail across the disconnect for the
-                // same reason as the session loop above -- a challenged reconnect
+                // same reason as the session loop above -- an authenticated reconnect
                 // redelivers it. This is un-acked TRIGGER mail, distinct from the
                 // deployment's in-flight run state (reconstructed sidecar-locally); the
                 // "no disconnect queue" note above is about that run state, not this.
                 retainPendingMailForAddress(addr);
             }
         }
-        if (conn.identity.kind === "allocated") {
-            const current = allocatedConnections.get(conn.identity.allocationId);
-            if (current?.ws === ws) {
-                allocatedConnections.delete(conn.identity.allocationId);
+        const current = allocatedConnections.get(conn.identity.allocationId);
+        if (current?.ws === ws) {
+            allocatedConnections.delete(conn.identity.allocationId);
+            if (conn.identity.kind === "allocated") {
                 allocated = {
                     allocationId: conn.identity.allocationId,
                     generation: conn.identity.generation,
@@ -1401,64 +1464,31 @@ export function createSidecarRouter(config) {
         }
         connections.delete(ws);
         // Cancel the liveness timer for this connection.
-        const livenessTimer = livenessTimers.get(ws);
-        if (livenessTimer !== undefined) {
-            clearTimeout(livenessTimer);
+        const cancelLiveness = livenessTimers.get(ws);
+        if (cancelLiveness !== undefined) {
+            cancelLiveness();
             livenessTimers.delete(ws);
         }
         // Drop the per-ws serialization chain; no more frames will queue on it.
         messageChains.delete(ws);
-        // Cancel any pending challenge for this connection.
-        const challengeReq = pendingChallenges.get(ws);
-        if (challengeReq !== undefined) {
-            clearTimeout(challengeReq.timer);
-            pendingChallenges.delete(ws);
-        }
-        // Reject any in-flight requests that were sent to this sidecar.
-        for (const [requestId, req] of pending) {
-            if (req.ws !== ws)
-                continue;
-            clearTimeout(req.timer);
-            pending.delete(requestId);
-            req.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        // Reject any in-flight requests that were sent to this sidecar. Each
+        // entry's reject closure runs its own per-site cleanup (the deploy and
+        // undeploy closures roll routing back), exactly as a frame-error
+        // rejection would.
+        pendingRequests.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Reject every deploy issued on this socket, including allocated
         // workflow deployments stored in `workflowAddresses` rather than
         // `agentAddresses`.
-        for (const [agentAddress, req] of pendingDeploys) {
-            if (req.ws !== ws)
-                continue;
-            clearTimeout(req.timer);
-            pendingDeploys.delete(agentAddress);
-            req.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        pendingDeploys.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Reject any in-flight pack transfers for this sidecar.
-        for (const [transferId, pack] of pendingPacks) {
-            if (pack.ws !== ws)
-                continue;
-            clearTimeout(pack.timer);
-            pendingPacks.delete(transferId);
-            pack.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        pendingPacks.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Reject any in-flight undeploys for this sidecar.
-        for (const [addr, req] of pendingUndeploys) {
-            if (req.ws !== ws)
-                continue;
-            clearTimeout(req.timer);
-            pendingUndeploys.delete(addr);
-            req.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        pendingUndeploys.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Reject any in-flight probes sent to this sidecar. A probe never enters
         // the address maps, so this ws-keyed sweep is its ONLY disconnect cleanup:
         // without it a probe whose sidecar drops mid-flight would hang until its
         // own timeout instead of failing fast on the disconnect.
-        for (const [requestId, probe] of pendingProbes) {
-            if (probe.ws !== ws)
-                continue;
-            clearTimeout(probe.timer);
-            pendingProbes.delete(requestId);
-            probe.reject(`Sidecar ${conn.sidecarId} disconnected`);
-        }
+        pendingProbes.rejectAllForWs(ws, `Sidecar ${conn.sidecarId} disconnected`);
         // Cancel any in-flight inbound pack transfers from this sidecar
         // across both receivers. The two receivers track their own in-
         // flight transferIds, so a pending workflow-run transfer for an
@@ -1496,43 +1526,22 @@ export function createSidecarRouter(config) {
         const requestId = nextRequestId();
         const frame = buildFrame(requestId);
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pending.delete(requestId);
-                reject(new Error(`Request ${requestId} timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
-            pending.set(requestId, {
-                requestId,
-                ws,
+            pendingRequests.register(requestId, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Request ${requestId} timed out after ${requestTimeoutMs}ms`,
                 resolve,
                 reject(error) {
                     reject(new Error(error));
                 },
-                timer,
-            });
+            }, undefined);
             conn.send(frame);
         });
     }
-    function resolvePending(requestId) {
-        const req = pending.get(requestId);
-        if (req === undefined)
-            return;
-        clearTimeout(req.timer);
-        pending.delete(requestId);
-        req.resolve();
-    }
-    function rejectPending(requestId, error) {
-        const req = pending.get(requestId);
-        if (req === undefined)
-            return;
-        clearTimeout(req.timer);
-        pending.delete(requestId);
-        req.reject(error);
-    }
     function packResponseMatches(entry, ws, frame) {
         return (entry.ws === ws &&
-            entry.agentAddress === frame.agentAddress &&
-            entry.repoId.kind === frame.repoId.kind &&
-            entry.repoId.id === frame.repoId.id);
+            entry.meta.agentAddress === frame.agentAddress &&
+            entry.meta.repoId.kind === frame.repoId.kind &&
+            entry.meta.repoId.id === frame.repoId.id);
     }
     function resolvePackPending(ws, frame) {
         const entry = pendingPacks.get(frame.transferId);
@@ -1542,9 +1551,7 @@ export function createSidecarRouter(config) {
             logger.warn `Ignoring repo.pack.ack for transfer ${frame.transferId} from a connection that does not own the pending transfer`;
             return;
         }
-        clearTimeout(entry.timer);
-        pendingPacks.delete(frame.transferId);
-        entry.resolve();
+        pendingPacks.resolve(frame.transferId);
     }
     function rejectPackPending(ws, frame) {
         const entry = pendingPacks.get(frame.transferId);
@@ -1554,13 +1561,13 @@ export function createSidecarRouter(config) {
             logger.warn `Ignoring repo.pack.reject for transfer ${frame.transferId} from a connection that does not own the pending transfer`;
             return;
         }
-        clearTimeout(entry.timer);
-        pendingPacks.delete(frame.transferId);
         // Surface the receiver's specific cause when it carried one, so the awaiting
-        // push sees "corrupt: <detail>" rather than only the coarse reason.
-        entry.reject(frame.detail !== undefined
+        // push sees "corrupt: <detail>" rather than only the coarse reason. The
+        // "Pack rejected:" prefix is applied here rather than in the entry's
+        // reject closure because a TIMEOUT rejection must not carry it.
+        pendingPacks.reject(frame.transferId, `Pack rejected: ${frame.detail !== undefined
             ? `${frame.reason}: ${frame.detail}`
-            : frame.reason);
+            : frame.reason}`);
     }
     function resolveUndeployPending(ws, agentAddress) {
         const req = pendingUndeploys.get(agentAddress);
@@ -1570,9 +1577,7 @@ export function createSidecarRouter(config) {
         }
         if (req.ws !== ws)
             return;
-        clearTimeout(req.timer);
-        pendingUndeploys.delete(agentAddress);
-        req.resolve();
+        pendingUndeploys.resolve(agentAddress);
     }
     function rejectUndeployPending(ws, agentAddress, error) {
         const req = pendingUndeploys.get(agentAddress);
@@ -1580,25 +1585,19 @@ export function createSidecarRouter(config) {
             return;
         if (req.ws !== ws)
             return;
-        clearTimeout(req.timer);
-        pendingUndeploys.delete(agentAddress);
-        req.reject(error);
+        pendingUndeploys.reject(agentAddress, error);
     }
-    function resolveProbe(requestId, result) {
+    function resolveProbe(ws, requestId, result) {
         const req = pendingProbes.get(requestId);
-        if (req === undefined)
+        if (req === undefined || req.ws !== ws)
             return;
-        clearTimeout(req.timer);
-        pendingProbes.delete(requestId);
-        req.resolve(result);
+        pendingProbes.resolve(requestId, result);
     }
-    function rejectProbe(requestId, error) {
+    function rejectProbe(ws, requestId, error) {
         const req = pendingProbes.get(requestId);
-        if (req === undefined)
+        if (req === undefined || req.ws !== ws)
             return;
-        clearTimeout(req.timer);
-        pendingProbes.delete(requestId);
-        req.reject(error);
+        pendingProbes.reject(requestId, error);
     }
     // Routing rule: pick the receiver dedicated to the repoId.kind the
     // frame carries. The receivers' in-flight state is independent, so a
@@ -1648,6 +1647,8 @@ export function createSidecarRouter(config) {
             });
             return;
         }
+        if (conn.identity.kind !== "allocated")
+            return;
         const picked = pickPackReceiver(frame.repoId);
         if (picked === null) {
             logger.warn `Received repo.pack.push with unsupported repoId.kind ${frame.repoId.kind}`;
@@ -1690,6 +1691,9 @@ export function createSidecarRouter(config) {
             });
             return;
         }
+        if (conn.identity.kind !== "allocated")
+            return;
+        const identity = conn.identity;
         const picked = pickPackReceiver(frame.repoId);
         if (picked === null) {
             logger.warn `Received repo.pack.done with unsupported repoId.kind ${frame.repoId.kind}`;
@@ -1723,15 +1727,13 @@ export function createSidecarRouter(config) {
             });
             return;
         }
-        const verdict = await receivePackLookup(frame.repoId, result.pack, result.ref, result.commitSha, conn.identity.kind === "allocated"
-            ? {
-                kind: "allocated",
-                agentAddress: frame.agentAddress,
-                allocationId: conn.identity.allocationId,
-                anchorRunId: conn.identity.anchorRunId,
-                generation: conn.identity.generation,
-            }
-            : { kind: "shared", agentAddress: frame.agentAddress });
+        const verdict = await receivePackLookup(frame.repoId, result.pack, result.ref, result.commitSha, {
+            kind: "allocated",
+            agentAddress: frame.agentAddress,
+            allocationId: identity.allocationId,
+            anchorRunId: identity.anchorRunId,
+            generation: identity.generation,
+        });
         // Connection may have closed during async verification.
         const currentConn = connections.get(ws);
         if (currentConn === undefined)
@@ -1759,9 +1761,9 @@ export function createSidecarRouter(config) {
      * window of a multi-step deploy, so `sendPack` can route the step's deploy
      * and asset packs before the deployment-level frame spawns the child.
      *
-     * The address is hub-minted and workflow-derived (no per-address key), so
-     * it enters the keyless `workflowAddresses` set -- never the challenged
-     * `agentAddresses` set -- and is torn down by `unbindStepRoute` once the
+     * The address is Hub-minted and workflow-derived, so it enters the
+     * `workflowAddresses` set rather than the legacy `agentAddresses` set and is
+     * torn down by `unbindStepRoute` once the
      * step's packs land. `handleClose` reclaims it if the sidecar drops
      * mid-stage. Per-step addresses are not runtime-routed (mail, signals, and
      * drains use the deployment address), so the binding is transient: it is
@@ -1774,6 +1776,17 @@ export function createSidecarRouter(config) {
             throw new Error(`Cannot move allocation ${allocationId} fence backward from ${String(existing)} to ${String(generation)}`);
         }
         allocationFences.set(allocationId, generation);
+        // A durable generation advance resolves unfinished initialization as failed.
+        // This also covers a cleanup transaction whose response was lost: the next
+        // reconciliation rebuilds this fence before it can start a replacement.
+        for (const attempt of [...allocatedKeyRecordInFlight.values()]) {
+            if (attempt.allocationId === allocationId &&
+                attempt.generation < generation) {
+                noteSenderDeploySettled(attempt, {
+                    failed: `Allocation ${allocationId} advanced beyond the deployment attempt`,
+                });
+            }
+        }
         const current = allocatedConnections.get(allocationId);
         if (current !== undefined && current.identity.generation !== generation) {
             handleClose(current.ws);
@@ -1792,7 +1805,31 @@ export function createSidecarRouter(config) {
         if (waiters.size === 0)
             allocationWaiters.delete(allocationId);
     }
-    async function getAllocatedConnection(target, use) {
+    function retireAllocation(target) {
+        if (allocationFences.get(target.allocationId) !== target.generation)
+            return;
+        disconnectAllocation(target);
+        allocationFences.delete(target.allocationId);
+        // The fence is gone, so a lingering attempt can never settle normally.
+        // Fail it here rather than leaving a marker that blocks the address.
+        for (const attempt of [...allocatedKeyRecordInFlight.values()]) {
+            if (attempt.allocationId === target.allocationId &&
+                attempt.generation <= target.generation) {
+                noteSenderDeploySettled(attempt, {
+                    failed: `Allocation ${target.allocationId} generation ${String(target.generation)} retired`,
+                });
+            }
+        }
+        const waiters = allocationWaiters.get(target.allocationId);
+        if (waiters === undefined)
+            return;
+        allocationWaiters.delete(target.allocationId);
+        for (const waiter of waiters) {
+            clearTimeout(waiter.timer);
+            waiter.reject(new Error(`Allocation ${target.allocationId} generation ${String(target.generation)} retired`));
+        }
+    }
+    async function getProvisionedConnection(target, use) {
         if (allocationFences.get(target.allocationId) !== target.generation) {
             throw new Error(`Allocation ${target.allocationId} generation ${String(target.generation)} is not current`);
         }
@@ -1801,7 +1838,14 @@ export function createSidecarRouter(config) {
             current.identity.generation !== target.generation) {
             throw new Error(`Allocated sidecar is not connected for allocation ${target.allocationId} generation ${String(target.generation)}`);
         }
-        if (!(await validateSidecarIdentity(current.identity, use))) {
+        let identityCurrent;
+        try {
+            identityCurrent = await validateSidecarIdentity(current.identity, use);
+        }
+        catch (cause) {
+            throw new SidecarIdentityValidationError(target.allocationId, target.generation, cause);
+        }
+        if (!identityCurrent) {
             if (allocatedConnections.get(target.allocationId) === current) {
                 handleClose(current.ws);
                 current.ws.close();
@@ -1813,19 +1857,33 @@ export function createSidecarRouter(config) {
         }
         const conn = connections.get(current.ws);
         if (conn === undefined ||
-            conn.identity.kind !== "allocated" ||
             conn.identity.allocationId !== target.allocationId ||
             conn.identity.generation !== target.generation) {
             throw new Error(`Allocated sidecar is not connected for allocation ${target.allocationId}`);
         }
         return { ws: current.ws, conn };
     }
+    async function getAllocatedConnection(target, use) {
+        const current = await getProvisionedConnection(target, use);
+        if (current.conn.identity.kind !== "allocated") {
+            throw new Error(`Allocation ${target.allocationId} is connected as probe capacity`);
+        }
+        return {
+            ws: current.ws,
+            conn: { ...current.conn, identity: current.conn.identity },
+        };
+    }
     async function isAllocatedSidecarReady(target) {
         try {
-            await getAllocatedConnection(target, "readiness");
+            await getProvisionedConnection(target, "readiness");
             return true;
         }
-        catch {
+        catch (error) {
+            // A failed validation is unknown, not absent: the worker may be healthy
+            // behind a failed lookup, so report it distinctly instead of answering
+            // `false` and letting the caller release a live worker.
+            if (error instanceof SidecarIdentityValidationError)
+                throw error;
             return false;
         }
     }
@@ -1836,22 +1894,40 @@ export function createSidecarRouter(config) {
                 return false;
             return conn.workflowAddresses.has(conn.identity.workflowRunAddress);
         }
-        catch {
+        catch (error) {
+            if (error instanceof SidecarIdentityValidationError)
+                throw error;
             return false;
         }
     }
-    async function waitForAllocatedSidecar(target, timeoutMs) {
-        if (await isAllocatedSidecarReady(target))
-            return;
+    async function waitForAllocatedSidecar(target, timeoutMs, onValidation) {
+        // An indeterminable worker waits out the unknown while time remains: only
+        // confirmed absence may surface as a connection timeout. At expiry the
+        // wait reports the validation failure rather than a missed deadline, so
+        // the caller retries instead of releasing a worker that may be healthy.
+        let validationFailure;
+        try {
+            if (await isAllocatedSidecarReady(target))
+                return;
+        }
+        catch (error) {
+            if (!(error instanceof SidecarIdentityValidationError))
+                throw error;
+            validationFailure = error;
+        }
         if (allocationFences.get(target.allocationId) !== target.generation) {
             throw new Error(`Allocation ${target.allocationId} generation ${String(target.generation)} is not current`);
         }
         if (timeoutMs <= 0) {
+            if (validationFailure !== undefined)
+                throw validationFailure;
             throw new Error(`Timed out waiting for allocated sidecar ${target.allocationId}`);
         }
         await new Promise((resolve, reject) => {
             const waiter = {
                 generation: target.generation,
+                validations: new Set(),
+                ...(onValidation !== undefined ? { onValidation } : {}),
                 resolve,
                 reject,
                 timer: setTimeout(() => {
@@ -1860,8 +1936,12 @@ export function createSidecarRouter(config) {
                     if (current?.size === 0) {
                         allocationWaiters.delete(target.allocationId);
                     }
-                    reject(new Error(`Timed out waiting for allocated sidecar ${target.allocationId} generation ${String(target.generation)}`));
+                    reject(waiter.validationFailure ??
+                        (waiter.validations.size > 0
+                            ? new SidecarIdentityValidationError(target.allocationId, target.generation)
+                            : new Error(`Timed out waiting for allocated sidecar ${target.allocationId} generation ${String(target.generation)}`)));
                 }, timeoutMs),
+                ...(validationFailure !== undefined ? { validationFailure } : {}),
             };
             let waiters = allocationWaiters.get(target.allocationId);
             if (waiters === undefined) {
@@ -1872,21 +1952,6 @@ export function createSidecarRouter(config) {
             void notifyAllocationWaiters(target.allocationId);
         });
     }
-    function bindStepRoute(stepAddress) {
-        const ws = addressIndex.get(stepAddress) ?? findSidecarForNewAgent(stepAddress);
-        if (ws === undefined) {
-            throw new Error(`No sidecar available to stage workflow step "${stepAddress}"`);
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            throw new Error(`No sidecar connected to stage workflow step "${stepAddress}"`);
-        }
-        if (conn.identity.kind !== "shared") {
-            throw new Error(`Allocated sidecar ${conn.sidecarId} cannot receive ordinary workflow step ${stepAddress}`);
-        }
-        conn.workflowAddresses.add(stepAddress);
-        addressIndex.set(stepAddress, ws);
-    }
     async function bindAllocatedStepRoute(target, stepAddress) {
         const { ws, conn } = await getAllocatedConnection(target, "routing");
         const existing = addressIndex.get(stepAddress);
@@ -1896,21 +1961,6 @@ export function createSidecarRouter(config) {
         conn.workflowAddresses.add(stepAddress);
         addressIndex.set(stepAddress, ws);
     }
-    /**
-     * Remove a per-step route bound by `bindStepRoute` once the step's packs
-     * have landed. Idempotent: an address that was never bound (or already
-     * unbound, e.g. by a mid-stage `handleClose`) is a no-op.
-     */
-    function unbindStepRoute(stepAddress) {
-        const ws = addressIndex.get(stepAddress);
-        if (ws === undefined)
-            return;
-        const conn = connections.get(ws);
-        if (conn !== undefined) {
-            conn.workflowAddresses.delete(stepAddress);
-        }
-        addressIndex.delete(stepAddress);
-    }
     function unbindAllocatedStepRoute(target, stepAddress) {
         const current = allocatedConnections.get(target.allocationId);
         if (current === undefined ||
@@ -1924,20 +1974,6 @@ export function createSidecarRouter(config) {
     }
     // Pack transfers may take longer than session requests due to data volume.
     const PACK_TIMEOUT_MS = requestTimeoutMs * 4;
-    function sendPack(agentAddress, pack, ref, commitSha, options) {
-        const ws = addressIndex.get(agentAddress);
-        if (ws === undefined) {
-            return Promise.reject(new Error(`No sidecar connected for agent "${agentAddress}"`));
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            return Promise.reject(new Error(`No sidecar connected for agent "${agentAddress}"`));
-        }
-        if (conn.identity.kind !== "shared") {
-            return Promise.reject(new Error(`Allocated sidecar ${conn.sidecarId} requires allocation-bound pack routing for "${agentAddress}"`));
-        }
-        return sendPackOnConnection(ws, conn, agentAddress, pack, ref, commitSha, options);
-    }
     function sendPackOnConnection(ws, conn, agentAddress, pack, ref, commitSha, options) {
         const transferId = `pack-${++packCounter}`;
         // For the agent-state flow the destination agent and the source repo
@@ -1952,21 +1988,14 @@ export function createSidecarRouter(config) {
         // Register pending entry before sending frames so that a synchronous
         // repo.pack.ack (e.g. in tests or loopback transports) resolves correctly.
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingPacks.delete(transferId);
-                reject(new Error(`Pack transfer ${transferId} timed out after ${PACK_TIMEOUT_MS}ms`));
-            }, PACK_TIMEOUT_MS);
-            pendingPacks.set(transferId, {
-                transferId,
-                ws,
-                agentAddress,
-                repoId,
+            pendingPacks.register(transferId, ws, {
+                timeoutMs: PACK_TIMEOUT_MS,
+                timeoutMessage: `Pack transfer ${transferId} timed out after ${PACK_TIMEOUT_MS}ms`,
                 resolve,
                 reject(error) {
-                    reject(new Error(`Pack rejected: ${error}`));
+                    reject(new Error(error));
                 },
-                timer,
-            });
+            }, { agentAddress, repoId });
             // Send chunks
             for (const chunk of chunkPack(pack)) {
                 conn.send({
@@ -1997,11 +2026,10 @@ export function createSidecarRouter(config) {
         }
         return sendPackOnConnection(ws, conn, agentAddress, pack, ref, commitSha, options);
     }
-    async function sendWorkflowRunPackToAllocation(target, agentAddress, pack, ref, commitSha) {
+    async function sendWorkflowRunPackToAllocation(target, agentAddress, pack, ref, commitSha, signal) {
+        signal?.throwIfAborted();
         const { ws, conn } = await getAllocatedConnection(target, "routing");
-        if (conn.identity.kind !== "allocated") {
-            throw new Error(`Allocation ${target.allocationId} resolved to a shared sidecar`);
-        }
+        signal?.throwIfAborted();
         if (agentAddress !== conn.identity.workflowRunAddress) {
             throw new Error(`Allocation ${target.allocationId} cannot restore unrelated address ${agentAddress}`);
         }
@@ -2015,7 +2043,16 @@ export function createSidecarRouter(config) {
             },
         });
     }
-    function routeMail(agentAddress, rawMessage, messageId, runGrants) {
+    function routeMail(agentAddress, rawMessage, authenticatedSender, messageId, runGrants) {
+        // `authenticatedSender` is hub-assigned by the caller from a hub-verified
+        // value (the ownership-gated sender of a relayed mail, or the triggering
+        // principal's address) -- never the message's own MIME `From`. It rides
+        // the frame as the hub-verified sender of record, so a recipient can take
+        // the sender from it rather than the forgeable `From`. The recipient's
+        // signature check reads it as the sender of record -- resolving the
+        // sender's key from its local cache to verify the signature -- and its
+        // admission policy gates delivery on the verdict.
+        //
         // Carry the hub-minted messageId on the frame so the sidecar's durable-
         // receipt ack (`mail.inbound.ack`) keys on the same id the hub tracks, and
         // a redelivery replays identical bytes for the downstream RunStarted dedup.
@@ -2026,6 +2063,7 @@ export function createSidecarRouter(config) {
             type: "mail.inbound",
             agentAddress,
             rawMessage,
+            authenticatedSender,
             ...(messageId !== undefined ? { messageId } : {}),
         };
         const ws = addressIndex.get(agentAddress);
@@ -2048,12 +2086,13 @@ export function createSidecarRouter(config) {
         // If the agent recently disconnected, queue for delivery on reconnect.
         return enqueueForDisconnected(agentAddress, frame);
     }
-    function sendRunGrants(agentAddress, runId, stepGrants) {
+    function sendRunGrants(agentAddress, runId, stepGrants, senderIdentities) {
         const frame = {
             type: "run.grants",
             agentAddress,
             runId,
             stepGrants,
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
         };
         const ws = addressIndex.get(agentAddress);
         if (ws !== undefined) {
@@ -2067,29 +2106,65 @@ export function createSidecarRouter(config) {
         // so a run.grants issued in the window between deploy and the first
         // reconnect survives the same way the dispatching trigger mail does.
         // A queue exists only while the deployment address is still on
-        // agentAddresses (pre-first-reconnect); after a challenged reconnect it
+        // agentAddresses (pre-first-reconnect); after an authenticated reconnect it
         // moves to workflowAddresses, which handleClose leaves unqueued because
         // that generation's in-flight run state is reconstructed sidecar-locally.
         // Returning without enqueueing there is correct; enqueueing is what keeps
         // grants and mail from diverging in the pre-reconnect window.
         return enqueueForDisconnected(agentAddress, frame);
     }
-    async function sendWorkflowRunDispatchToAllocation(target, agentAddress, runId, stepGrants, rawMessage, messageId) {
+    async function sendWorkflowRunDispatchToAllocation(target, agentAddress, runId, stepGrants, rawMessage, authenticatedSender, messageId, signal) {
+        signal?.throwIfAborted();
         const { ws, conn } = await getAllocatedConnection(target, "routing");
+        signal?.throwIfAborted();
         if (addressIndex.get(agentAddress) !== ws) {
             throw new Error(`Address ${agentAddress} is not routed on allocation ${target.allocationId}`);
         }
-        const runGrants = { runId, stepGrants };
+        // authenticatedSender is the sender persisted at enqueue on the dispatch
+        // row (the triggering principal's hub-verified address); the caller reads
+        // it from that row. It is never the message's MIME From.
+        //
+        // Resolve its key here, at dispatch (redelivery) time, from that persisted
+        // address, to co-deliver on the run's grants barrier so the recipient
+        // caches the sender's current hub-held key. A run sender's deployment key
+        // is immutable once acked; a user sender's key rotating mid-flight would
+        // leave the fixed signed bytes checked against the new key, which the
+        // recipient logs as unverifiable. Null when unresolvable (no resolver
+        // wired, or the sender has no durable key). The lookup contract (see
+        // SidecarLookups.resolveSenderKey) is best-effort and never throws, so
+        // resolving ahead of the run.grants send cannot block it.
+        const authenticatedSenderPublicKey = lookups.resolveSenderKey !== undefined
+            ? await lookups.resolveSenderKey(authenticatedSender)
+            : null;
+        signal?.throwIfAborted();
+        // Co-deliver the resolved key on the run's grants barrier, omitting a null
+        // key so it is never cached (see deliverMailToRecipient). The same list
+        // rides the pending-mail entry so the reconnect replay carries it too.
+        const senderIdentities = authenticatedSenderPublicKey !== null
+            ? [
+                {
+                    address: authenticatedSender,
+                    publicKey: authenticatedSenderPublicKey,
+                },
+            ]
+            : undefined;
+        const runGrants = {
+            runId,
+            stepGrants,
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
+        };
         conn.send({
             type: "run.grants",
             agentAddress,
             runId,
             stepGrants,
+            ...(senderIdentities !== undefined ? { senderIdentities } : {}),
         });
         const frame = {
             type: "mail.inbound",
             agentAddress,
             rawMessage,
+            authenticatedSender,
             messageId,
         };
         conn.send(frame);
@@ -2121,55 +2196,26 @@ export function createSidecarRouter(config) {
                 });
             }
             catch (err) {
-                rejectDeployPending(req, `Failed to store public key: ${err instanceof Error ? err.message : String(err)}`);
+                pendingDeploys.reject(frame.agentAddress, `Failed to store public key: ${err instanceof Error ? err.message : String(err)}`);
                 return;
             }
         }
-        resolveDeployPending(req, frame.publicKey);
-    }
-    function resolveDeployPending(req, publicKey) {
-        if (pendingDeploys.get(req.agentAddress) !== req)
-            return;
-        clearTimeout(req.timer);
-        pendingDeploys.delete(req.agentAddress);
-        req.resolve(publicKey);
-    }
-    function rejectDeployPending(req, error) {
-        if (pendingDeploys.get(req.agentAddress) !== req)
-            return;
-        clearTimeout(req.timer);
-        pendingDeploys.delete(req.agentAddress);
-        req.reject(error);
+        pendingDeploys.resolve(frame.agentAddress, frame.publicKey);
     }
     function rejectDeployPendingFromFrame(ws, agentAddress, error) {
         const req = pendingDeploys.get(agentAddress);
         if (req === undefined || req.ws !== ws)
             return;
-        rejectDeployPending(req, error);
-    }
-    async function sendAgentDeploy(agentAddress, harnessConfig, workflow) {
-        if (hubPublicKeyHex === undefined) {
-            throw new Error("Hub signing key is required for agent deployment");
-        }
-        const ws = addressIndex.get(agentAddress) ?? findSidecarForNewAgent(agentAddress);
-        if (ws === undefined) {
-            throw new Error(`No sidecar available for agent "${agentAddress}"`);
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            throw new Error(`No sidecar connected for agent "${agentAddress}"`);
-        }
-        if (conn.identity.kind !== "shared") {
-            throw new Error(`Allocated sidecar ${conn.sidecarId} requires allocation-bound deploy routing`);
-        }
-        return sendAgentDeployOnConnection(ws, conn, agentAddress, harnessConfig, workflow);
+        // Settle by key, not by the `req` object: a key lookup observes the
+        // CURRENT entry, so a stale handle cannot settle a replaced round-trip.
+        pendingDeploys.reject(agentAddress, error);
     }
     function sendAgentDeployOnConnection(ws, conn, agentAddress, harnessConfig, workflow) {
         if (hubPublicKeyHex === undefined) {
-            throw new Error("Hub signing key is required for agent deployment");
+            throw deployFrameFailure("Hub signing key is required for agent deployment", false);
         }
         if (pendingDeploys.has(agentAddress)) {
-            throw new Error(`Deploy already in progress for agent "${agentAddress}"`);
+            throw deployFrameFailure(`Deploy already in progress for agent "${agentAddress}"`, false);
         }
         const addressSet = conn.identity.kind === "allocated"
             ? conn.workflowAddresses
@@ -2177,17 +2223,11 @@ export function createSidecarRouter(config) {
         addressSet.add(agentAddress);
         addressIndex.set(agentAddress, ws);
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingDeploys.delete(agentAddress);
-                if (addressIndex.get(agentAddress) === ws) {
-                    addressSet.delete(agentAddress);
-                    addressIndex.delete(agentAddress);
-                }
-                reject(new Error(`Deploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
-            pendingDeploys.set(agentAddress, {
-                agentAddress,
-                ws,
+            // Timeout and frame-error rejections share this closure, so the routing
+            // rollback and the `frameSent: true` tag live in one place.
+            pendingDeploys.register(agentAddress, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Deploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`,
                 resolve(publicKey) {
                     resolve({ publicKey });
                 },
@@ -2196,33 +2236,73 @@ export function createSidecarRouter(config) {
                         addressSet.delete(agentAddress);
                         addressIndex.delete(agentAddress);
                     }
-                    reject(new Error(error));
+                    // A non-allocated deployment's key is recorded by the deploy-ack
+                    // projection, whose failure (reject/timeout/agent.error/disconnect)
+                    // is observed only here. Drain any pre-ack sender mail parked on
+                    // this address so it surfaces as undelivered rather than waiting out
+                    // the TTL. An allocated deployment's failure is drained by its
+                    // session-service owner instead, so skip it here to keep one owner
+                    // per case.
+                    if (conn.identity.kind !== "allocated") {
+                        drainDeferredSenderMail(agentAddress, `deploy failed: ${error}`);
+                    }
+                    reject(deployFrameFailure(error, true));
                 },
-                timer,
-            });
-            conn.send({
-                type: "agent.deploy",
-                agentAddress,
-                agentId: harnessConfig.agentId,
-                config: harnessConfig,
-                hubPublicKey: hubPublicKeyHex,
-                ...(workflow !== undefined ? { workflow } : {}),
-            });
+            }, undefined);
+            try {
+                conn.send({
+                    type: "agent.deploy",
+                    agentAddress,
+                    agentId: harnessConfig.agentId,
+                    config: harnessConfig,
+                    hubPublicKey: hubPublicKeyHex,
+                    ...(workflow !== undefined ? { workflow } : {}),
+                });
+            }
+            catch (err) {
+                // A synchronous send failure means the frame never reached the wire.
+                // Drop the pending entry (and its armed timer) and reject as not-sent
+                // so a caller may safely roll back what it staged. The drop bypasses
+                // the entry's reject closure: this failure must report
+                // `frameSent: false`, and the timer must not fire later and
+                // double-reject.
+                pendingDeploys.delete(agentAddress);
+                if (addressIndex.get(agentAddress) === ws) {
+                    addressSet.delete(agentAddress);
+                    addressIndex.delete(agentAddress);
+                }
+                reject(deployFrameFailure(`Deploy of "${agentAddress}" failed to send: ${err instanceof Error ? err.message : String(err)}`, false));
+            }
         });
     }
-    async function sendAgentDeployToAllocation(target, agentAddress, harnessConfig, workflow) {
-        const { ws, conn } = await getAllocatedConnection(target, "routing");
-        if (conn.identity.kind !== "allocated") {
-            throw new Error(`Allocation ${target.allocationId} resolved to a shared sidecar`);
-        }
-        if (agentAddress !== conn.identity.workflowRunAddress) {
-            throw new Error(`Allocation ${target.allocationId} cannot deploy unrelated address ${agentAddress}`);
+    async function sendAgentDeployToAllocation(target, agentAddress, harnessConfig, workflow, signal, beforeSend) {
+        try {
+            signal?.throwIfAborted();
+            const { ws, conn } = await getAllocatedConnection(target, "routing");
+            signal?.throwIfAborted();
+            if (agentAddress !== conn.identity.workflowRunAddress) {
+                throw new Error(`Allocation ${target.allocationId} cannot deploy unrelated address ${agentAddress}`);
+            }
+            const existing = addressIndex.get(agentAddress);
+            if (existing !== undefined && existing !== ws) {
+                throw new Error(`Deployment ${agentAddress} is already routed to another sidecar`);
+            }
+            if (hubPublicKeyHex === undefined)
+                throw new Error("Hub signing key is required for agent deployment");
+            if (pendingDeploys.has(agentAddress))
+                throw new Error(`Deploy already in progress for agent "${agentAddress}"`);
+            await beforeSend?.();
+            signal?.throwIfAborted();
+            if (allocatedConnections.get(target.allocationId)?.ws !== ws ||
+                allocationFences.get(target.allocationId) !== target.generation) {
+                throw new Error(`Allocated sidecar connection changed for allocation ${target.allocationId}`);
+            }
+            // Return without awaiting: only pre-send failures belong to this catch.
+            return sendAgentDeployOnConnection(ws, conn, agentAddress, harnessConfig, workflow);
         }
-        const existing = addressIndex.get(agentAddress);
-        if (existing !== undefined && existing !== ws) {
-            throw new Error(`Deployment ${agentAddress} is already routed to another sidecar`);
+        catch (cause) {
+            throw deployFrameFailure(cause instanceof Error ? cause.message : String(cause), false, cause);
         }
-        return sendAgentDeployOnConnection(ws, conn, agentAddress, harnessConfig, workflow);
     }
     /**
      * Provision one step of a multi-step deploy on the sidecar WITHOUT
@@ -2238,20 +2318,6 @@ export function createSidecarRouter(config) {
      * so the caller can safely deliver the deploy pack afterward. On failure
      * the caller owns tearing the route down via `unbindStepRoute`.
      */
-    function sendProvisionStep(agentAddress, harnessConfig) {
-        const ws = addressIndex.get(agentAddress);
-        if (ws === undefined) {
-            throw new Error(`Step route for "${agentAddress}" is not bound; call bindStepRoute before provisioning`);
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            throw new Error(`No sidecar connected for agent "${agentAddress}"`);
-        }
-        if (conn.identity.kind !== "shared") {
-            throw new Error(`Allocated sidecar ${conn.sidecarId} requires allocation-bound step provisioning`);
-        }
-        return sendProvisionStepOnConnection(ws, conn, agentAddress, harnessConfig);
-    }
     function sendProvisionStepOnConnection(ws, conn, agentAddress, harnessConfig) {
         if (hubPublicKeyHex === undefined) {
             throw new Error("Hub signing key is required for step provisioning");
@@ -2261,25 +2327,20 @@ export function createSidecarRouter(config) {
         }
         const hubKey = hubPublicKeyHex;
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingDeploys.delete(agentAddress);
-                reject(new Error(`Step provision of "${agentAddress}" timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
             // The sidecar's `agent.deploy.ack` resolves this through
-            // `resolveDeployPending` -> `req.resolve()`. The per-step address is
-            // workflow-derived and records no hub-side key, so the ack's public
-            // key is not needed and this resolves void.
-            pendingDeploys.set(agentAddress, {
-                agentAddress,
-                ws,
+            // `pendingDeploys.resolve`. The per-step address is workflow-derived
+            // and records no hub-side key, so the ack's public key is not needed
+            // and this resolves void.
+            pendingDeploys.register(agentAddress, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Step provision of "${agentAddress}" timed out after ${requestTimeoutMs}ms`,
                 resolve(_publicKey) {
                     resolve();
                 },
                 reject(error) {
                     reject(new Error(error));
                 },
-                timer,
-            });
+            }, undefined);
             conn.send({
                 type: "agent.deploy",
                 agentAddress,
@@ -2297,42 +2358,17 @@ export function createSidecarRouter(config) {
         }
         return sendProvisionStepOnConnection(ws, conn, agentAddress, harnessConfig);
     }
-    function findSidecarForNewAgent(_agentAddress) {
-        for (const [ws, conn] of connections) {
-            if (conn.identity.kind === "shared")
-                return ws;
-        }
-        return undefined;
-    }
-    function sendProbe(args) {
-        // Select any connected sidecar, exactly as the pre-deploy window does.
-        // A probe runs in the sidecar's pre-deploy state, so it targets a
-        // connection, not an address -- `findSidecarForNewAgent` ignores its
-        // argument and returns the first connection. Throw immediately on an empty
-        // registry rather than register a probe that could only time out.
-        const ws = findSidecarForNewAgent("");
-        if (ws === undefined) {
-            return Promise.reject(new Error("No sidecar available to probe workflow"));
-        }
-        const conn = connections.get(ws);
-        if (conn === undefined) {
-            return Promise.reject(new Error("No sidecar connected to probe workflow"));
-        }
+    function sendProbeOnConnection(ws, conn, args) {
         const requestId = nextRequestId();
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingProbes.delete(requestId);
-                reject(new Error(`Probe ${requestId} timed out after ${probeTimeoutMs}ms`));
-            }, probeTimeoutMs);
-            pendingProbes.set(requestId, {
-                requestId,
-                ws,
+            pendingProbes.register(requestId, ws, {
+                timeoutMs: probeTimeoutMs,
+                timeoutMessage: `Probe ${requestId} timed out after ${probeTimeoutMs}ms`,
                 resolve,
                 reject(error) {
                     reject(new Error(error));
                 },
-                timer,
-            });
+            }, undefined);
             conn.send({
                 type: "workflow.probe.request",
                 requestId,
@@ -2343,6 +2379,19 @@ export function createSidecarRouter(config) {
             });
         });
     }
+    async function sendProbeToAllocation(target, args) {
+        const { ws, conn } = await getProvisionedConnection(target, "routing");
+        return sendProbeOnConnection(ws, conn, args);
+    }
+    function disconnectAllocation(target) {
+        const current = allocatedConnections.get(target.allocationId);
+        if (current === undefined ||
+            current.identity.generation !== target.generation) {
+            return;
+        }
+        handleClose(current.ws);
+        current.ws.close();
+    }
     function sendAgentUndeploy(agentAddress, reason) {
         const ws = addressIndex.get(agentAddress);
         if (ws === undefined) {
@@ -2353,14 +2402,11 @@ export function createSidecarRouter(config) {
             return Promise.reject(new Error(`No sidecar connected for agent "${agentAddress}"`));
         }
         return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                pendingUndeploys.delete(agentAddress);
-                removeAgentAddress(ws, agentAddress);
-                reject(new Error(`Undeploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`));
-            }, requestTimeoutMs);
-            pendingUndeploys.set(agentAddress, {
-                agentAddress,
-                ws,
+            // Timeout, ack, and error rejection share one closure so the routing
+            // teardown runs exactly once no matter how the round-trip settles.
+            pendingUndeploys.register(agentAddress, ws, {
+                timeoutMs: requestTimeoutMs,
+                timeoutMessage: `Undeploy of "${agentAddress}" timed out after ${requestTimeoutMs}ms`,
                 resolve() {
                     removeAgentAddress(ws, agentAddress);
                     resolve();
@@ -2369,8 +2415,7 @@ export function createSidecarRouter(config) {
                     removeAgentAddress(ws, agentAddress);
                     reject(new Error(error));
                 },
-                timer,
-            });
+            }, undefined);
             conn.send({
                 type: "agent.undeploy",
                 agentAddress,
@@ -2433,12 +2478,13 @@ export function createSidecarRouter(config) {
             defaultSource,
         }));
     }
-    async function sendCredentialsUpdate(agentAddress, delivery) {
+    async function sendCredentialsUpdate(agentAddress, delivery, revoke) {
         await sendRequest(agentAddress, (requestId) => ({
             type: "credentials.update",
             requestId,
             agentAddress,
             delivery,
+            ...(revoke !== undefined ? { revoke } : {}),
         }));
     }
     function sendSyncRequest(agentAddress) {
@@ -2475,8 +2521,10 @@ export function createSidecarRouter(config) {
             payload: opts.payload,
         });
     }
-    async function sendSignalDeliverToAllocation(target, opts) {
+    async function sendSignalDeliverToAllocation(target, opts, signal) {
+        signal?.throwIfAborted();
         const { ws, conn } = await getAllocatedConnection(target, "routing");
+        signal?.throwIfAborted();
         if (addressIndex.get(opts.agentAddress) !== ws) {
             throw new Error(`Address ${opts.agentAddress} is not routed on allocation ${target.allocationId}`);
         }
@@ -2503,24 +2551,23 @@ export function createSidecarRouter(config) {
         handleClose,
         routeMail,
         sendRunGrants,
-        sendAgentDeploy,
-        sendProbe,
+        noteSenderDeployStarted,
+        noteSenderDeploySettled,
+        sendProbeToAllocation,
+        disconnectAllocation,
         sendAgentUndeploy,
         sendSourcesUpdate,
         sendCredentialsUpdate,
-        sendPack,
         sendPackToAllocation,
         sendWorkflowRunPackToAllocation,
         fenceAllocation,
+        retireAllocation,
         waitForAllocatedSidecar,
         isAllocatedSidecarReady,
         isAllocatedWorkflowActive,
         sendAgentDeployToAllocation,
-        bindStepRoute,
         bindAllocatedStepRoute,
-        unbindStepRoute,
         unbindAllocatedStepRoute,
-        sendProvisionStep,
         sendProvisionStepToAllocation,
         sendWorkflowRunDispatchToAllocation,
         sendSyncRequest,