agent-embassy 1.0.0 → 1.3.0

package/dist/src/gateway/service.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { BridgeError } from "../errors.js";
 import { KeyedMutex } from "../mutex.js";
-import { certifiedCompatibilityVersions, compatibilitySurfaces, attachCompatibilityCertification, evaluateCompatibilityAttestation, isCompatibilityCertification, isCompatibilityCertificationReport, isCompatibilityCheckReport, } from "./compatibility.js";
+import { certifiedCompatibilityVersions, compatibilitySurfaces, evaluateCompatibilityAttestation, isCompatibilityAttestation, } from "./compatibility.js";
 import { createGatewayConversationId, isGatewaySnapshot, startGatewayControlServer, } from "./control.js";
 import { publishGatewayDashboard } from "./dashboard.js";
 import { createDeliveryMachine, isTerminalDeliveryMachine, projectDelivery, projectDeliveryWakeups, transitionDelivery, } from "./delivery-machine.js";
@@ -49,6 +49,41 @@ function bindingKey(binding) {
         binding.ownerLease,
     ].join("\0");
 }
+function endpointRefreshCallbackKey(event) {
+    const attestation = {
+        schemaVersion: event.attestation.schemaVersion,
+        surface: event.attestation.surface,
+        version: event.attestation.version,
+        tier: event.attestation.tier,
+        checkedAt: event.attestation.checkedAt,
+        probes: event.attestation.probes.map((probe) => ({
+            name: probe.name,
+            outcome: probe.outcome,
+            ...(probe.safeErrorCode === undefined
+                ? {}
+                : { safeErrorCode: probe.safeErrorCode }),
+        })),
+        ...(event.attestation.safeErrorCode === undefined
+            ? {}
+            : { safeErrorCode: event.attestation.safeErrorCode }),
+    };
+    return event.outcome === "compatible"
+        ? JSON.stringify({
+            outcome: event.outcome,
+            previous: event.previous,
+            current: event.current,
+            attestation,
+            routes: [...event.routes]
+                .map((route) => ({ ...route }))
+                .sort((left, right) => left.routeHandle.localeCompare(right.routeHandle)),
+        })
+        : JSON.stringify({
+            outcome: event.outcome,
+            previous: event.previous,
+            candidate: event.candidate,
+            attestation,
+        });
+}
 function stableLease(provider, value) {
     return `lease_${createHash("sha256").update(provider).update("\0").update(value).digest("base64url")}`;
 }
@@ -107,10 +142,34 @@ export class GatewayService {
     deliveryTokens = new Map();
     runtimeAlerts = [];
     activityEvents = [];
+    activeCodexIncompatibility;
     activitySequence = 0;
     detachedReceiptWrites = new Set();
     nativeIngressByConversation = new Map();
     callbackQueue = [];
+    /**
+     * Endpoint replacement is authority-bearing lifecycle evidence, not an
+     * ordinary refreshable observation. Keep one coalesced slot outside the
+     * bounded callback queue so delivery evidence can never displace it (or be
+     * displaced by it).
+     */
+    endpointRefreshCallback;
+    activeEndpointRefreshCallback;
+    endpointRefreshRetryRequested;
+    endpointRefreshConflictBoundary;
+    activeEndpointRefreshCallbackKey;
+    endpointRefreshCallbackPoisoned = false;
+    endpointRefreshConflictPending = false;
+    /** Last successfully activated transition per allowed Codex host. */
+    activatedEndpointRefreshes = new Map();
+    /** Durable reanchors awaiting their exact native-listener activation. */
+    durablyAppliedEndpointRefreshes = new Map();
+    /** Selector transitions staged until their exact registration owns a helper. */
+    pendingSelectorEndpointActivations = new Map();
+    /** Last incompatible transition already projected per allowed Codex host. */
+    handledIncompatibleEndpointRefreshes = new Map();
+    /** Process-local dedupe for automatic public activity rows across retries. */
+    endpointRefreshActivityKeys = new Set();
     callbackWorker;
     callbackScheduled = false;
     callbackCapacity;
@@ -136,6 +195,12 @@ export class GatewayService {
     /** Route-scoped fences; unrelated Codex registrations remain dispatchable. */
     codexSuccessionDispatchFrozen = new Set();
     codexSuccessionPoisoned = new Set();
+    /**
+     * Exact stale authority whose process-owned native advertisement was already
+     * removed, but whose durable orphan deletion did not commit. Keep dispatch
+     * frozen and permit only the same exact cleanup transaction to retry.
+     */
+    codexOrphanCleanupPending = new Map();
     codexSuccessionState;
     pendingCodexSuccessionRecovery;
     /**
@@ -171,6 +236,7 @@ export class GatewayService {
     async start(signal) {
         if (this.running || this.closing)
             return;
+        let bootReactivatedIdleAliases = [];
         const assertStartActive = () => {
             if (signal?.aborted === true || this.closing) {
                 throw new BridgeError("GATEWAY_START_CANCELLED", "Gateway startup was cancelled before it became ready.", true);
@@ -191,7 +257,7 @@ export class GatewayService {
                     throw new BridgeError("GATEWAY_ADAPTER_NOT_ALLOWED", "A provider adapter is duplicated or outside the host allowlist.");
                 }
                 seen.add(key);
-                const observation = await adapter.initialize(this.callbacksFor(adapter.identity));
+                const observation = await adapter.initialize(this.callbacksFor(adapter));
                 assertStartActive();
                 await this.store.observeConnector({
                     identity: adapter.identity,
@@ -208,13 +274,15 @@ export class GatewayService {
             if (this.adapters.length > 0 &&
                 this.adapters.every((adapter) => adapter.compatibilitySurface !== undefined &&
                     adapter.runCompatibilityProbes !== undefined)) {
-                const report = await this.compatibilityCheckLocked();
-                const incompatible = report.surfaces.find((surface) => surface.tier === "incompatible");
+                const attestations = await this.runAutomaticCompatibilityProbesLocked();
+                const incompatible = attestations.find((surface) => surface.tier === "incompatible");
                 if (incompatible !== undefined) {
                     throw new BridgeError(incompatible.safeErrorCode ?? "COMPATIBILITY_CHECK_FAILED", "A local provider failed bounded compatibility attestation.");
                 }
             }
             await this.recoverCodexSuccessionAfterRestartLocked();
+            bootReactivatedIdleAliases =
+                await this.reactivateRetainedCodexRoutesAfterRestartLocked();
             assertStartActive();
             const control = await startGatewayControlServer({
                 stateDir: this.store.rootDir,
@@ -235,6 +303,9 @@ export class GatewayService {
             this.nextDashboardRefreshAt = undefined;
             await this.refreshNextProgressWatchWakeLocked();
             this.scheduleLifecycleWakeLocked();
+            for (const alias of bootReactivatedIdleAliases) {
+                this.scheduleDispatch(alias);
+            }
             await this.publish();
             assertStartActive();
         }
@@ -284,7 +355,10 @@ export class GatewayService {
                 for (const messageId of [...this.providerTurnContinuations.keys()]) {
                     await this.finishProviderTurnContinuationLocked(messageId, "cancelled");
                 }
+                const retainedQueuedMessageIds = new Set(await this.store.inspectQueuedMessageIds());
                 for (const messageId of [...this.messageContexts.keys()]) {
+                    if (retainedQueuedMessageIds.has(messageId))
+                        continue;
                     const queued = await this.store.settleQueuedMessage({
                         messageId,
                         state: "cancelled",
@@ -300,6 +374,8 @@ export class GatewayService {
                     });
                 }
                 for (const tracker of this.deliveryTrackers.values()) {
+                    if (retainedQueuedMessageIds.has(tracker.messageId))
+                        continue;
                     if (!isTerminalDeliveryMachine(tracker.machine)) {
                         await this.advanceDeliveryLocked(tracker.messageId, {
                             type: "shutdown",
@@ -351,6 +427,19 @@ export class GatewayService {
                 this.detachedReceiptWrites.clear();
                 this.nativeIngressByConversation.clear();
                 this.callbackQueue.length = 0;
+                this.endpointRefreshCallback = undefined;
+                this.activeEndpointRefreshCallback = undefined;
+                this.endpointRefreshRetryRequested = undefined;
+                this.endpointRefreshConflictBoundary = undefined;
+                this.activeEndpointRefreshCallbackKey = undefined;
+                this.endpointRefreshConflictPending = false;
+                this.endpointRefreshCallbackPoisoned = true;
+                this.activatedEndpointRefreshes.clear();
+                this.durablyAppliedEndpointRefreshes.clear();
+                this.pendingSelectorEndpointActivations.clear();
+                this.handledIncompatibleEndpointRefreshes.clear();
+                this.endpointRefreshActivityKeys.clear();
+                this.codexOrphanCleanupPending.clear();
                 this.candidates.clear();
                 this.routeBindings.clear();
                 this.routeStates.clear();
@@ -390,6 +479,11 @@ export class GatewayService {
                 action: "codex_unregistered",
                 aliases: [params.alias],
             }),
+            removeStaleCodexRegistration: async (params) => await this.exclusiveDecision(async () => this.removeStaleCodexRegistration(params.alias), {
+                kind: "recovery",
+                action: "codex_orphan_removed",
+                aliases: [params.alias],
+            }),
             selectClaude: async (params) => await this.exclusiveDecision(async () => this.selectClaude(params), {
                 kind: "selection",
                 action: "claude_selected",
@@ -412,8 +506,6 @@ export class GatewayService {
             }),
             listSnapshot: async () => (await this.observeSnapshot()).snapshot,
             observeSnapshot: async () => await this.observeSnapshot(),
-            compatibilityCheck: async () => await this.compatibilityCheck(),
-            compatibilityCertify: async (params) => await this.compatibilityCertify(params),
             deliveryStatus: async (params) => await this.deliveryStatus(params.token),
             untrack: async (params) => await this.exclusiveDecision(async () => {
                 const settled = await this.store.settleProgressWatch({
@@ -444,133 +536,7 @@ export class GatewayService {
     async snapshot() {
         return (await this.observeSnapshot()).snapshot;
     }
-    async compatibilityCheck() {
-        return await this.mutex.run("service", async () => await this.compatibilityCheckLocked());
-    }
-    async compatibilityCertify(params) {
-        const plan = await this.mutex.run("service", async () => {
-            if (!this.running || this.closing) {
-                throw new BridgeError("COMPAT_PROVIDER_UNAVAILABLE", "Compatibility certification requires one running broker.");
-            }
-            const report = await this.compatibilityCheckLocked();
-            const codexRoutes = (await this.store.inspectPrivateCodexRoutes()).filter((route) => route.enabled);
-            const codexRoute = params.codexAlias === undefined
-                ? codexRoutes.length === 1
-                    ? codexRoutes[0]
-                    : undefined
-                : codexRoutes.find((route) => route.alias === params.codexAlias);
-            if (codexRoute === undefined) {
-                throw new BridgeError("COMPAT_CERTIFY_CODEX_ROUTE_REQUIRED", "Choose one exact registered Codex route for live certification.");
-            }
-            const adapters = new Map(this.adapters.map((adapter) => [adapter.identity.provider, adapter]));
-            return { adapters, codexRoute, report };
-        });
-        const certifiedAt = this.now().toISOString();
-        const updated = [];
-        for (const attestation of plan.report.surfaces) {
-            const adapter = plan.adapters.get(attestation.surface);
-            let certification;
-            if (attestation.tier === "incompatible" ||
-                adapter?.runCompatibilityCertification === undefined) {
-                certification = {
-                    depth: attestation.surface === "claude"
-                        ? "wire"
-                        : params.withTurn
-                            ? "turn"
-                            : "thread_ops",
-                    outcome: "fail",
-                    certifiedAt,
-                    safeErrorCode: attestation.safeErrorCode ??
-                        `${attestation.surface.toUpperCase()}_CERTIFICATION_UNAVAILABLE`,
-                };
-            }
-            else {
-                try {
-                    certification = await adapter.runCompatibilityCertification({
-                        controllerStateRoot: this.store.rootDir,
-                        withTurn: params.withTurn,
-                        ...(attestation.surface === "codex"
-                            ? { routeHandle: plan.codexRoute.binding.routeHandle }
-                            : {}),
-                    });
-                }
-                catch {
-                    certification = {
-                        depth: attestation.surface === "claude"
-                            ? "wire"
-                            : params.withTurn
-                                ? "turn"
-                                : "thread_ops",
-                        outcome: "fail",
-                        certifiedAt: this.now().toISOString(),
-                        safeErrorCode: `${attestation.surface.toUpperCase()}_CERTIFICATION_FAILED`,
-                    };
-                }
-            }
-            const expectedDepth = attestation.surface === "claude"
-                ? "wire"
-                : params.withTurn
-                    ? "turn"
-                    : "thread_ops";
-            if (!isCompatibilityCertification(certification) ||
-                certification.depth !== expectedDepth) {
-                certification = {
-                    depth: expectedDepth,
-                    outcome: "fail",
-                    certifiedAt: this.now().toISOString(),
-                    safeErrorCode: `${attestation.surface.toUpperCase()}_CERTIFICATION_EVIDENCE_INVALID`,
-                };
-            }
-            updated.push(attachCompatibilityCertification(attestation, certification));
-        }
-        return await this.mutex.run("service", async () => {
-            const currentCodexRoute = (await this.store.inspectPrivateCodexRoutes()).find((route) => route.enabled &&
-                route.alias === plan.codexRoute.alias &&
-                bindingKey(route.binding) === bindingKey(plan.codexRoute.binding));
-            const reconciled = updated.map((attestation) => {
-                if (attestation.surface === "codex" && currentCodexRoute === undefined) {
-                    return attachCompatibilityCertification(attestation, {
-                        depth: params.withTurn ? "turn" : "thread_ops",
-                        outcome: "fail",
-                        certifiedAt: this.now().toISOString(),
-                        safeErrorCode: "CODEX_CERTIFICATION_ROUTE_CHANGED",
-                    });
-                }
-                const observation = plan.adapters
-                    .get(attestation.surface)
-                    ?.compatibilitySurface?.();
-                if (observation?.surface === attestation.surface &&
-                    observation.version === attestation.version) {
-                    return attestation;
-                }
-                return attachCompatibilityCertification(attestation, {
-                    depth: attestation.surface === "claude"
-                        ? "wire"
-                        : params.withTurn
-                            ? "turn"
-                            : "thread_ops",
-                    outcome: "fail",
-                    certifiedAt: this.now().toISOString(),
-                    safeErrorCode: `${attestation.surface.toUpperCase()}_CERTIFICATION_VERSION_CHANGED`,
-                });
-            });
-            const result = {
-                policy: plan.report.policy,
-                certified: reconciled.every((attestation) => attestation.certification?.outcome === "pass"),
-                withTurn: params.withTurn,
-                surfaces: reconciled,
-            };
-            if (!isCompatibilityCertificationReport(result)) {
-                throw new BridgeError("COMPAT_CERTIFICATION_REPORT_INVALID", "Compatibility certification evidence failed its closed report schema.");
-            }
-            for (const attestation of reconciled) {
-                await this.store.recordCompatibilityAttestation(attestation);
-            }
-            await this.changed();
-            return result;
-        });
-    }
-    async compatibilityCheckLocked() {
+    async runAutomaticCompatibilityProbesLocked() {
         const bySurface = new Map(this.adapters.map((adapter) => {
             if (adapter.compatibilitySurface === undefined ||
                 adapter.runCompatibilityProbes === undefined) {
@@ -589,39 +555,21 @@ export class GatewayService {
             if (entry === undefined) {
                 throw new BridgeError("COMPAT_PROVIDER_UNAVAILABLE", "A required compatibility surface is unavailable.");
             }
-            const cached = await this.store.inspectCompatibilityAttestation(surface, entry.observation.version);
-            const probes = cached?.probes ?? (await entry.adapter.runCompatibilityProbes());
-            const checkedAt = cached?.checkedAt ?? this.now().toISOString();
-            let attestation = evaluateCompatibilityAttestation({
+            const probes = await entry.adapter.runCompatibilityProbes();
+            const attestation = evaluateCompatibilityAttestation({
                 surface,
                 version: entry.observation.version,
-                checkedAt,
-                policy: this.config.compatibilityPolicy ?? "observed",
+                checkedAt: this.now().toISOString(),
                 certifiedVersions: certifiedCompatibilityVersions[surface],
                 probes,
             });
-            if (cached?.certification !== undefined &&
-                attestation.tier !== "incompatible") {
-                attestation = attachCompatibilityCertification(attestation, cached.certification);
-            }
-            if (cached === undefined ||
-                JSON.stringify(cached) !== JSON.stringify(attestation)) {
-                await this.store.recordCompatibilityAttestation(attestation);
-            }
+            await this.store.recordCompatibilityAttestation(attestation);
             if (attestation.tier !== "incompatible") {
                 entry.adapter.acceptCompatibilityAttestation?.(attestation);
             }
             attestations.push(attestation);
         }
-        const report = {
-            policy: this.config.compatibilityPolicy ?? "observed",
-            compatible: attestations.every((attestation) => attestation.tier !== "incompatible"),
-            surfaces: attestations,
-        };
-        if (!isCompatibilityCheckReport(report)) {
-            throw new BridgeError("COMPAT_REPORT_INVALID", "Compatibility evidence failed its closed report schema.");
-        }
-        return report;
+        return attestations;
     }
     async observeSnapshot() {
         return await this.mutex.run("service", async () => {
@@ -663,9 +611,10 @@ export class GatewayService {
         }
         return createHash("sha256").update(encoded, "utf8").digest("base64url");
     }
-    callbacksFor(source) {
+    callbacksFor(adapter) {
         return {
             onDelivery: (event) => {
+                const source = adapter.identity;
                 if (!this.running ||
                     !MESSAGE_ID.test(event.messageId) ||
                     this.deliveryCorrelation(event.messageId) === undefined ||
@@ -694,6 +643,7 @@ export class GatewayService {
                 });
             },
             onRouteState: (event) => {
+                const source = adapter.identity;
                 if (!this.running ||
                     event.endpoint.provider !== source.provider ||
                     event.endpoint.hostId !== source.hostId ||
@@ -716,6 +666,7 @@ export class GatewayService {
                 });
             },
             onClaudeReply: (event) => {
+                const source = adapter.identity;
                 if (!this.running ||
                     event.endpoint.provider !== source.provider ||
                     event.endpoint.hostId !== source.hostId ||
@@ -742,6 +693,7 @@ export class GatewayService {
                 });
             },
             onClaudeMessage: (event) => {
+                const source = adapter.identity;
                 const ingressFailureCode = this.closing
                     ? "GATEWAY_SHUTDOWN"
                     : "NATIVE_INGRESS_INVALID";
@@ -779,6 +731,7 @@ export class GatewayService {
                 }
             },
             onProtocolNotice: (event) => {
+                const source = adapter.identity;
                 if (!this.running || !SAFE_CODE.test(event.code))
                     return;
                 this.enqueueCallback({
@@ -787,11 +740,61 @@ export class GatewayService {
                     value: { code: event.code },
                 });
             },
+            onEndpointRefresh: (event) => {
+                if (!this.running ||
+                    adapter.identity.provider !== "codex" ||
+                    event.previous.provider !== "codex" ||
+                    event.previous.hostId !== adapter.identity.hostId ||
+                    !isCompatibilityAttestation(event.attestation) ||
+                    event.attestation.surface !== "codex") {
+                    return;
+                }
+                if (event.outcome === "compatible") {
+                    const routeHandles = event.routes.map((route) => route.routeHandle);
+                    if (event.current.provider !== "codex" ||
+                        event.current.hostId !== event.previous.hostId ||
+                        event.current.endpointGeneration !==
+                            adapter.identity.endpointGeneration ||
+                        event.attestation.version !== adapter.protocolVersion ||
+                        event.attestation.tier === "incompatible" ||
+                        routeHandles.length > this.config.limits.maxRoutes ||
+                        new Set(routeHandles).size !== routeHandles.length ||
+                        routeHandles.some((routeHandle) => !PRIVATE_HANDLE.test(routeHandle))) {
+                        return;
+                    }
+                }
+                else if (event.candidate.provider !== "codex" ||
+                    event.candidate.hostId !== event.previous.hostId ||
+                    event.previous.endpointGeneration !==
+                        adapter.identity.endpointGeneration ||
+                    event.attestation.tier !== "incompatible") {
+                    return;
+                }
+                this.enqueueCallback({
+                    type: "endpoint_refresh",
+                    adapter,
+                    value: event.outcome === "compatible"
+                        ? {
+                            ...event,
+                            previous: { ...event.previous },
+                            current: { ...event.current },
+                            routes: event.routes.map((route) => ({ ...route })),
+                        }
+                        : {
+                            ...event,
+                            previous: { ...event.previous },
+                            candidate: { ...event.candidate },
+                        },
+                });
+            },
         };
     }
     enqueueCallback(event) {
         if (!this.acceptingCallbacks)
             return false;
+        if (event.type === "endpoint_refresh") {
+            return this.enqueueEndpointRefreshCallback(event);
+        }
         if (event.type === "delivery") {
             const duplicate = this.callbackQueue.findIndex((candidate) => candidate.type === "delivery" &&
                 candidate.value.messageId === event.value.messageId &&
@@ -834,7 +837,7 @@ export class GatewayService {
             // Delivery write/approval observations are authoritative evidence for
             // no-replay and deadline arbitration. Never evict them. A stale route
             // observation is safe to replace because discovery re-observes it.
-            const replaceable = this.callbackQueue.findIndex((candidate) => candidate.type === "route");
+            const replaceable = this.callbackQueue.findIndex((candidate) => candidate.type === "route" || candidate.type === "protocol_notice");
             if (replaceable < 0) {
                 this.dashboardHealthy = false;
                 return false;
@@ -842,29 +845,49 @@ export class GatewayService {
             this.callbackQueue.splice(replaceable, 1);
         }
         this.callbackQueue.push(event);
-        if (this.callbackScheduled)
-            return true;
-        this.callbackScheduled = true;
-        setImmediate(() => {
-            this.callbackScheduled = false;
-            const worker = this.mutex.run("service", async () => {
-                await this.drainCallbackQueueLocked();
-            });
-            this.callbackWorker = worker;
-            worker
-                .catch(() => {
-                this.dashboardHealthy = false;
-            })
-                .finally(() => {
-                if (this.callbackWorker === worker)
-                    this.callbackWorker = undefined;
-                if (this.callbackQueue.length > 0 && !this.closing) {
-                    this.enqueueCallbackWorkerOnly();
-                }
-            });
-        });
+        this.enqueueCallbackWorkerOnly();
         return true;
     }
+    enqueueEndpointRefreshCallback(event) {
+        if (this.endpointRefreshCallbackPoisoned)
+            return false;
+        const key = endpointRefreshCallbackKey(event.value);
+        if (this.activeEndpointRefreshCallbackKey !== undefined) {
+            if (this.activeEndpointRefreshCallbackKey === key) {
+                this.endpointRefreshRetryRequested = event;
+                return true;
+            }
+            this.poisonEndpointRefreshCallbacks(event);
+            return false;
+        }
+        if (this.endpointRefreshCallback !== undefined) {
+            if (endpointRefreshCallbackKey(this.endpointRefreshCallback.value) === key) {
+                return true;
+            }
+            this.poisonEndpointRefreshCallbacks(event);
+            return false;
+        }
+        this.endpointRefreshCallback = event;
+        this.enqueueCallbackWorkerOnly();
+        return true;
+    }
+    poisonEndpointRefreshCallbacks(conflicting) {
+        this.endpointRefreshConflictBoundary =
+            this.activeEndpointRefreshCallback ??
+                this.endpointRefreshCallback ??
+                conflicting;
+        this.endpointRefreshCallback = undefined;
+        this.endpointRefreshRetryRequested = undefined;
+        this.endpointRefreshCallbackPoisoned = true;
+        this.endpointRefreshConflictPending = true;
+        this.dashboardHealthy = false;
+        this.enqueueCallbackWorkerOnly();
+    }
+    hasPendingCallbackWork() {
+        return (this.callbackQueue.length > 0 ||
+            this.endpointRefreshCallback !== undefined ||
+            this.endpointRefreshConflictPending);
+    }
     enqueueCallbackWorkerOnly() {
         if (this.callbackScheduled)
             return;
@@ -882,7 +905,7 @@ export class GatewayService {
                 .finally(() => {
                 if (this.callbackWorker === worker)
                     this.callbackWorker = undefined;
-                if (this.callbackQueue.length > 0 && !this.closing) {
+                if (this.hasPendingCallbackWork() && !this.closing) {
                     this.enqueueCallbackWorkerOnly();
                 }
             });
@@ -895,10 +918,95 @@ export class GatewayService {
             await this.publish();
         }
         this.pruneTransient();
-        while (this.callbackQueue.length > 0) {
-            const event = this.callbackQueue.shift();
-            if (event === undefined)
+        while (this.hasPendingCallbackWork()) {
+            // Preserve the complete ordinary queue order. In particular, every
+            // delivery observation already retained before endpoint replacement is
+            // reduced before the lifecycle transition can settle its generation.
+            const ordinaryBatch = this.callbackQueue.splice(0, this.callbackQueue.length);
+            for (const event of ordinaryBatch) {
+                try {
+                    if (event.type === "delivery") {
+                        await this.onDelivery(event.source, event.value, event.receivedAt);
+                    }
+                    else if (event.type === "route") {
+                        await this.onRouteState(event.source, event.value);
+                    }
+                    else if (event.type === "claude_reply") {
+                        await this.onClaudeReply(event.value);
+                    }
+                    else if (event.type === "claude_message") {
+                        await this.onClaudeMessage(event.value);
+                    }
+                    else if (event.type === "protocol_notice") {
+                        this.addRuntimeAlert(event.value.code, "warning", {
+                            provider: event.source.provider,
+                            host: event.source.hostId,
+                        });
+                        await this.changed();
+                    }
+                }
+                catch {
+                    this.dashboardHealthy = false;
+                }
+            }
+            await this.drainPreDeadlineDeliveryCallbacksLocked();
+            if (this.endpointRefreshConflictPending) {
+                this.endpointRefreshConflictPending = false;
+                const boundary = this.endpointRefreshConflictBoundary;
+                if (boundary !== undefined) {
+                    await this.failClosedEndpointRefreshConflict(boundary);
+                }
+                else {
+                    this.addRuntimeAlert("CODEX_ENDPOINT_REFRESH_CONFLICT", "error", { provider: "codex" });
+                    await this.changed();
+                }
                 continue;
+            }
+            const endpointRefresh = this.endpointRefreshCallback;
+            if (endpointRefresh === undefined)
+                continue;
+            const key = endpointRefreshCallbackKey(endpointRefresh.value);
+            this.endpointRefreshCallback = undefined;
+            this.activeEndpointRefreshCallback = endpointRefresh;
+            this.activeEndpointRefreshCallbackKey = key;
+            let succeeded = false;
+            try {
+                await this.onCodexEndpointRefresh(endpointRefresh.adapter, endpointRefresh.value);
+                succeeded = true;
+            }
+            catch {
+                this.dashboardHealthy = false;
+            }
+            finally {
+                this.activeEndpointRefreshCallback = undefined;
+                if (this.activeEndpointRefreshCallbackKey === key) {
+                    this.activeEndpointRefreshCallbackKey = undefined;
+                }
+            }
+            const requestedRetry = this.endpointRefreshRetryRequested;
+            this.endpointRefreshRetryRequested = undefined;
+            if (!succeeded &&
+                !this.endpointRefreshCallbackPoisoned &&
+                requestedRetry !== undefined) {
+                this.endpointRefreshCallback = requestedRetry;
+            }
+        }
+    }
+    /**
+     * A selector can synchronously admit callbacks while its promise is still
+     * running under the service mutex. Drain exactly the ordinary work that was
+     * retained before the selector returned before applying a returned endpoint
+     * transition. Delivery evidence wins within that fixed snapshot; callbacks
+     * admitted while it is reduced remain queued for the ordinary worker, and
+     * the dedicated endpoint-transition slot is never consumed recursively.
+     */
+    async drainSelectorCallbackSnapshotLocked() {
+        const snapshot = this.callbackQueue.splice(0, this.callbackQueue.length);
+        const ordered = [
+            ...snapshot.filter((event) => event.type === "delivery"),
+            ...snapshot.filter((event) => event.type !== "delivery"),
+        ];
+        for (const event of ordered) {
             try {
                 if (event.type === "delivery") {
                     await this.onDelivery(event.source, event.value, event.receivedAt);
@@ -912,7 +1020,7 @@ export class GatewayService {
                 else if (event.type === "claude_message") {
                     await this.onClaudeMessage(event.value);
                 }
-                else {
+                else if (event.type === "protocol_notice") {
                     this.addRuntimeAlert(event.value.code, "warning", {
                         provider: event.source.provider,
                         host: event.source.hostId,
@@ -924,6 +1032,59 @@ export class GatewayService {
                 this.dashboardHealthy = false;
             }
         }
+        // Synchronous dispatch may have admitted authoritative delivery evidence,
+        // and rejected native ingress may have started a detached terminal write.
+        // Join both before the endpoint boundary can move to its next generation.
+        await this.drainPreDeadlineDeliveryCallbacksLocked();
+        await this.drainDetachedReceiptWritesLocked();
+    }
+    async failClosedEndpointRefreshConflict(boundary) {
+        const identities = [
+            boundary.value.previous,
+            ...(boundary.value.outcome === "compatible"
+                ? [boundary.value.current]
+                : []),
+        ];
+        for (const identity of identities) {
+            const routes = (await this.store.inspectPrivateCodexRoutes()).filter((route) => route.binding.hostId === identity.hostId &&
+                route.binding.endpointGeneration === identity.endpointGeneration);
+            const aliases = routes.map((route) => route.alias);
+            const inFlightSettlements = aliases.length === 0
+                ? []
+                : await this.planRoutesInFlightSettlementsLocked(aliases, {
+                    unwrittenOutcome: "failed",
+                    safeErrorCode: "CODEX_ENDPOINT_REFRESH_CONFLICT",
+                });
+            try {
+                const settlements = await this.store.markConnectorOffline(identity, "CODEX_ENDPOINT_REFRESH_CONFLICT", inFlightSettlements, { preserveQueued: true });
+                for (const settlement of settlements) {
+                    await this.applyTerminalSettlementLocked(settlement);
+                }
+                for (const route of routes) {
+                    this.routeStates.set(route.alias, "stale");
+                }
+                break;
+            }
+            catch (error) {
+                if (error instanceof BridgeError &&
+                    error.code === "CONNECTOR_NOT_FOUND") {
+                    continue;
+                }
+                throw error;
+            }
+        }
+        this.addRuntimeAlert("CODEX_ENDPOINT_REFRESH_CONFLICT", "error", { provider: "codex", host: boundary.value.previous.hostId });
+        await this.changed();
+    }
+    async requireEndpointRefreshUnconflicted() {
+        if (!this.endpointRefreshCallbackPoisoned)
+            return;
+        this.endpointRefreshConflictPending = false;
+        const boundary = this.endpointRefreshConflictBoundary;
+        if (boundary !== undefined) {
+            await this.failClosedEndpointRefreshConflict(boundary);
+        }
+        throw new BridgeError("CODEX_ENDPOINT_REFRESH_CONFLICT", "Conflicting Codex endpoint transitions require a clean broker restart.");
     }
     isTerminalAdapterDelivery(event) {
         return (event.state !== "transport_uncertain" &&
@@ -1030,6 +1191,144 @@ export class GatewayService {
             generation: authority.journal.new.generation,
         }));
     }
+    /**
+     * Rebuild process-owned route and listener authority for retained Codex
+     * registrations during staged startup. The provider's selectRoute performs
+     * the exact loaded/list + history-free resume proof; durable state advances
+     * only after the new native advertisement and status are live.
+     */
+    async reactivateRetainedCodexRoutesAfterRestartLocked() {
+        const idleAliases = [];
+        const retained = await this.store.inspectPrivateCodexRoutes();
+        for (const route of retained) {
+            if (!route.enabled ||
+                route.state !== "stale" ||
+                route.compatibility !== "expired" ||
+                this.pendingCodexSuccessionRecovery?.journal.new.alias === route.alias ||
+                this.codexSuccessionPoisoned.has(route.alias)) {
+                continue;
+            }
+            const codexAdapter = this.adapters.find((adapter) => adapter.identity.provider === "codex" &&
+                adapter.identity.hostId === route.binding.hostId);
+            const claudeAdapter = this.adapters.find((adapter) => adapter.identity.provider === "claude" &&
+                adapter.identity.hostId === route.binding.hostId);
+            if (codexAdapter === undefined || claudeAdapter === undefined) {
+                this.addRuntimeAlert("CODEX_BOOT_REACTIVATION_SKIPPED", "warning", { provider: "codex", host: route.binding.hostId, alias: route.alias });
+                continue;
+            }
+            let routeSelected = false;
+            let advertiseAttempted = false;
+            let storeReactivated = false;
+            let deferredEndpointRefresh = false;
+            try {
+                const selected = await codexAdapter.selectRoute({
+                    alias: route.alias,
+                    routeHandle: route.binding.routeHandle,
+                });
+                routeSelected = true;
+                await this.drainSelectorCallbackSnapshotLocked();
+                if (selected.routeHandle !== route.binding.routeHandle) {
+                    throw new BridgeError("CODEX_BOOT_REACTIVATION_MISMATCH", "The retained Codex task changed during broker startup reactivation.");
+                }
+                if (selected.endpointRefresh !== undefined) {
+                    deferredEndpointRefresh = await this.onCodexEndpointRefresh(codexAdapter, selected.endpointRefresh, {
+                        deferActivation: true,
+                        deferredRoute: {
+                            alias: route.alias,
+                            threadId: route.binding.routeHandle,
+                            state: selected.state,
+                        },
+                    });
+                    if (!deferredEndpointRefresh) {
+                        throw new BridgeError("CODEX_BOOT_REACTIVATION_MISMATCH", "The retained Codex task could not stage a compatible endpoint refresh during startup.");
+                    }
+                }
+                const binding = {
+                    ...codexAdapter.identity,
+                    routeHandle: route.binding.routeHandle,
+                    ownerLease: route.binding.ownerLease,
+                };
+                if (deferredEndpointRefresh) {
+                    const afterStaging = await this.store.inspectPrivateRoute(route.alias);
+                    storeReactivated =
+                        afterStaging !== undefined &&
+                            afterStaging.enabled &&
+                            afterStaging.compatibility === "compatible" &&
+                            bindingKey(afterStaging.binding) === bindingKey(binding);
+                }
+                advertiseAttempted = true;
+                const advertise = claudeAdapter.advertiseNativeCodexPeer;
+                if (advertise === undefined) {
+                    throw new BridgeError("CODEX_BOOT_REACTIVATION_UNAVAILABLE", "The retained Codex task cannot rebuild its native advertisement.");
+                }
+                await advertise.call(claudeAdapter, {
+                    alias: route.alias,
+                    cwd: this.nativePeerCwd,
+                });
+                await claudeAdapter.updateNativeCodexPeerStatus?.(route.alias, selected.state === "idle"
+                    ? "idle"
+                    : selected.state === "awaiting_approval"
+                        ? "waiting"
+                        : "busy");
+                const listenerGeneration = this.requireCurrentNativeCodexGeneration(claudeAdapter, route.alias);
+                if (!storeReactivated) {
+                    await this.store.rebindStaleRoute({
+                        alias: route.alias,
+                        currentOwnerLease: route.binding.ownerLease,
+                        newBinding: binding,
+                        reason: "endpoint_reobserved",
+                        journalReason: "boot_reactivation",
+                        state: selected.state,
+                    });
+                    storeReactivated = true;
+                }
+                this.rememberBinding(route.alias, binding, selected.state);
+                this.lockCodexRegistration({
+                    alias: route.alias,
+                    threadId: route.binding.routeHandle,
+                    hostId: route.binding.hostId,
+                    busyPolicy: "queue",
+                }, listenerGeneration);
+                if (deferredEndpointRefresh &&
+                    selected.endpointRefresh !== undefined) {
+                    await this.onCodexEndpointRefresh(codexAdapter, selected.endpointRefresh, {
+                        requiredRoute: {
+                            alias: route.alias,
+                            threadId: route.binding.routeHandle,
+                            state: selected.state,
+                        },
+                    });
+                }
+                if (this.requireCurrentNativeCodexGeneration(claudeAdapter, route.alias) !== listenerGeneration) {
+                    throw new BridgeError("CODEX_BOOT_REACTIVATION_NATIVE_LISTENER_MISSING", "The retained Codex task's native listener changed during boot reactivation.");
+                }
+                if (selected.state === "idle")
+                    idleAliases.push(route.alias);
+            }
+            catch {
+                let cleanupFailed = false;
+                if (advertiseAttempted) {
+                    await claudeAdapter
+                        .unadvertiseNativeCodexPeer?.(route.alias)
+                        .catch(() => {
+                        cleanupFailed = true;
+                    });
+                }
+                if (routeSelected) {
+                    await codexAdapter
+                        .releaseRoute?.(route.binding.routeHandle)
+                        .catch(() => {
+                        cleanupFailed = true;
+                    });
+                }
+                if (cleanupFailed || storeReactivated || deferredEndpointRefresh) {
+                    throw new BridgeError("CODEX_BOOT_REACTIVATION_CLEANUP_FAILED", "A Codex boot reactivation crossed its durable boundary without exact live authority.");
+                }
+                this.addRuntimeAlert("CODEX_BOOT_REACTIVATION_SKIPPED", "warning", { provider: "codex", host: route.binding.hostId, alias: route.alias });
+            }
+        }
+        return idleAliases;
+    }
     async completePendingCodexSuccessionRecoveryLocked(params) {
         const recovery = this.pendingCodexSuccessionRecovery;
         if (recovery === undefined)
@@ -1744,7 +2043,7 @@ export class GatewayService {
             claude.rejectedInboundSettlements === 0 &&
             codexQuiet &&
             this.successionServiceStateClean(aliases) &&
-            this.callbackQueue.length === 0 &&
+            this.endpointCallbacksQuiet() &&
             this.detachedReceiptWrites.size === 0);
     }
     async codexSuccessionBarrierCleanLocked(oldRegistration) {
@@ -1771,7 +2070,7 @@ export class GatewayService {
             claude.monitorFrozen &&
             codex.clean &&
             this.successionServiceStateClean(aliases) &&
-            this.callbackQueue.length === 0 &&
+            this.endpointCallbacksQuiet() &&
             this.detachedReceiptWrites.size === 0);
     }
     rescheduleIdleRoutesLocked() {
@@ -1780,13 +2079,48 @@ export class GatewayService {
                 this.scheduleDispatch(alias);
         }
     }
+    codexSuccessionIsStable() {
+        const state = this.codexSuccessionState;
+        return (state === undefined ||
+            state.phase === "active_old" ||
+            (state.phase === "active_new" && state.retired === null));
+    }
+    async requireUnchangedStaleCodexOrphan(alias, expected) {
+        let current;
+        try {
+            current = await this.store.inspectStaleCodexOrphan(alias);
+        }
+        catch {
+            throw new BridgeError("CODEX_ORPHAN_RECOVERY_MISMATCH", "The stale Codex registration changed during recovery.");
+        }
+        if (bindingKey(current) !== bindingKey(expected)) {
+            throw new BridgeError("CODEX_ORPHAN_RECOVERY_MISMATCH", "The stale Codex registration changed during recovery.");
+        }
+    }
+    nativeCodexOrphanBarrierClean(observation, generation) {
+        return (observation.clean &&
+            observation.generation === generation &&
+            observation.activeGenerationMatched &&
+            observation.ingressQuiesced &&
+            observation.monitorFrozen &&
+            !observation.discoveryInFlight &&
+            observation.pendingOutboundReceipts === 0 &&
+            observation.pendingInboundReceipts === 0 &&
+            observation.rejectedInboundSettlements === 0);
+    }
+    endpointCallbacksQuiet() {
+        return (!this.hasPendingCallbackWork() &&
+            this.activeEndpointRefreshCallbackKey === undefined);
+    }
     async registerCodex(params) {
         if (!params.alias.startsWith("codex-")) {
             throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "A registered Codex alias must start with codex-.");
         }
         if (this.codexSuccessionPoisoned.has(params.alias) ||
+            this.codexOrphanCleanupPending.has(params.alias) ||
             (params.succeedsAlias !== undefined &&
-                this.codexSuccessionPoisoned.has(params.succeedsAlias))) {
+                (this.codexSuccessionPoisoned.has(params.succeedsAlias) ||
+                    this.codexOrphanCleanupPending.has(params.succeedsAlias)))) {
             throw new BridgeError("CODEX_SUCCESSION_RECOVERY_REQUIRED", "Codex registration is offline until the incomplete succession is manually recovered.");
         }
         if (params.succeedsAlias !== undefined) {
@@ -1822,16 +2156,41 @@ export class GatewayService {
             alias: params.alias,
             routeHandle: params.threadId,
         });
+        await this.drainSelectorCallbackSnapshotLocked();
         if (registered.routeHandle !== params.threadId) {
             throw new BridgeError("ROUTE_MISMATCH", "The connector registered a different task.");
         }
+        let deferredEndpointRefresh = false;
+        if (registered.endpointRefresh !== undefined) {
+            try {
+                deferredEndpointRefresh = await this.onCodexEndpointRefresh(adapter, registered.endpointRefresh, {
+                    deferActivation: true,
+                    deferredRoute: {
+                        alias: params.alias,
+                        threadId: params.threadId,
+                        state: registered.state,
+                    },
+                });
+            }
+            catch (error) {
+                await adapter.releaseRoute?.(params.threadId).catch(() => undefined);
+                throw error;
+            }
+        }
         const binding = {
             ...adapter.identity,
             routeHandle: params.threadId,
             ownerLease: stableLease("codex", `${params.hostId}\0${params.threadId}`),
         };
         try {
-            await this.registerOrRebind(params.alias, binding, "endpoint_reobserved", registered.state);
+            const afterRefresh = await this.store.inspectPrivateRoute(params.alias);
+            const alreadyInstalledExactly = afterRefresh !== undefined &&
+                afterRefresh.enabled &&
+                afterRefresh.compatibility === "compatible" &&
+                bindingKey(afterRefresh.binding) === bindingKey(binding);
+            if (!alreadyInstalledExactly || !deferredEndpointRefresh) {
+                await this.registerOrRebind(params.alias, binding, "endpoint_reobserved", registered.state);
+            }
         }
         catch (error) {
             await adapter.releaseRoute?.(params.threadId).catch(() => undefined);
@@ -1857,10 +2216,32 @@ export class GatewayService {
                     : "busy");
             listenerGeneration = this.requireCurrentNativeCodexGeneration(claudeAdapter, params.alias);
             await this.completePendingCodexSuccessionRecoveryLocked(params);
+            this.lockCodexRegistration(params, listenerGeneration);
+            if (deferredEndpointRefresh &&
+                registered.endpointRefresh !== undefined) {
+                await this.onCodexEndpointRefresh(adapter, registered.endpointRefresh, {
+                    requiredRoute: {
+                        alias: params.alias,
+                        threadId: params.threadId,
+                        state: registered.state,
+                    },
+                });
+            }
             await this.changed();
         }
         catch (error) {
             if (routeBeforeRegistration !== undefined) {
+                if (deferredEndpointRefresh &&
+                    registered.endpointRefresh?.outcome === "compatible") {
+                    try {
+                        await this.store.markConnectorOffline(registered.endpointRefresh.current, "CODEX_ENDPOINT_ACTIVATION_FAILED", [], { preserveQueued: true });
+                        this.routeStates.set(params.alias, "stale");
+                        await this.changed();
+                    }
+                    catch {
+                        this.dashboardHealthy = false;
+                    }
+                }
                 // A persisted or live exact route, its queue, and any advertisement
                 // predate this invocation, so a later status/dashboard failure cannot
                 // safely delete them as "rollback". A post-restart reactivation also
@@ -1971,6 +2352,220 @@ export class GatewayService {
         });
         await this.changed();
     }
+    finalizeStaleCodexOrphanRemovalLocked(alias) {
+        const aliases = new Set([alias]);
+        this.forgetBinding(alias);
+        this.purgeSuccessionTransientState(aliases);
+        const lock = this.codexRegistrationLocks.get(alias);
+        if (lock !== undefined) {
+            this.codexRegistrationLocks.delete(alias);
+            const state = this.codexSuccessionState;
+            if ((state?.phase === "active_old" && state.active.alias === alias) ||
+                (state?.phase === "active_new" && state.active.alias === alias)) {
+                this.codexSuccessionState = undefined;
+            }
+        }
+        this.codexOrphanCleanupPending.delete(alias);
+        this.codexSuccessionDispatchFrozen.delete(alias);
+    }
+    async removeStaleCodexRegistration(alias) {
+        const pendingCleanup = this.codexOrphanCleanupPending.get(alias);
+        if (pendingCleanup !== undefined &&
+            (await this.store.wasStaleCodexOrphanRemovalCommitted({
+                alias,
+                binding: pendingCleanup.binding,
+                previousSequence: pendingCleanup.previousSequence,
+            }))) {
+            this.finalizeStaleCodexOrphanRemovalLocked(alias);
+            await this.changed();
+            return;
+        }
+        const authority = await this.store.inspectStaleCodexOrphanRemovalAuthority(alias);
+        const binding = authority.binding;
+        const aliases = new Set([alias]);
+        const resumesExactCleanup = pendingCleanup !== undefined &&
+            bindingKey(pendingCleanup.binding) === bindingKey(binding) &&
+            pendingCleanup.previousSequence === authority.previousSequence;
+        if (pendingCleanup !== undefined && !resumesExactCleanup) {
+            throw new BridgeError("CODEX_ORPHAN_RECOVERY_MISMATCH", "The stale Codex registration changed after native cleanup.");
+        }
+        if (!this.codexSuccessionIsStable() ||
+            this.pendingCodexSuccessionRecovery !== undefined ||
+            this.codexSuccessionPoisoned.has(alias) ||
+            (this.codexSuccessionDispatchFrozen.has(alias) && !resumesExactCleanup)) {
+            throw new BridgeError("CODEX_ORPHAN_RECOVERY_BLOCKED", "Codex orphan recovery cannot run during registration succession.");
+        }
+        const lock = this.codexRegistrationLocks.get(alias);
+        if (lock !== undefined &&
+            (lock.threadId !== binding.routeHandle ||
+                lock.hostId !== binding.hostId ||
+                lock.generation === "unconfirmed" ||
+                !isCodexRegistrationGeneration(lock.generation))) {
+            throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The native Codex listener identity cannot be proven for orphan recovery.");
+        }
+        const claudeAdapter = this.adapter("claude", binding.hostId);
+        const codexAdapter = this.adapter("codex", binding.hostId);
+        const currentNative = claudeAdapter.currentNativeCodexPeerGeneration;
+        if (currentNative === undefined) {
+            throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The Claude provider cannot prove whether the native Codex listener exists.");
+        }
+        this.codexSuccessionDispatchFrozen.add(alias);
+        this.scheduledDispatchTargets.delete(alias);
+        let nativeGeneration;
+        let nativeQuiesceAttempted = false;
+        let irreversibleCleanupStarted = resumesExactCleanup;
+        try {
+            try {
+                const observed = currentNative.call(claudeAdapter, alias);
+                if (!isCodexRegistrationGeneration(observed)) {
+                    throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The native Codex listener generation is malformed.");
+                }
+                if (lock !== undefined && lock.generation !== observed) {
+                    throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The native Codex listener generation changed before orphan recovery.");
+                }
+                nativeGeneration = observed;
+            }
+            catch (error) {
+                const exactAbsence = error instanceof BridgeError &&
+                    error.code === "CODEX_PEER_GENERATION_MISMATCH";
+                if (!exactAbsence || (lock !== undefined && !resumesExactCleanup)) {
+                    if (error instanceof BridgeError &&
+                        error.code === "CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN") {
+                        throw error;
+                    }
+                    throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The native Codex listener identity cannot be proven for orphan recovery.");
+                }
+            }
+            let observeNative;
+            if (nativeGeneration !== undefined) {
+                const quiesce = this.requireSuccessionMethod(claudeAdapter, "quiesceNativeCodexPeerGeneration");
+                // Require the inverse operation before acquiring the quiescence fence
+                // so every pre-unadvertise failure has one exact cleanup path.
+                this.requireSuccessionMethod(claudeAdapter, "resumeNativeCodexPeerGeneration");
+                observeNative = this.requireSuccessionMethod(claudeAdapter, "observeNativeCodexSuccessionBarrier");
+                nativeQuiesceAttempted = true;
+                await quiesce.call(claudeAdapter, nativeGeneration);
+            }
+            // Join every native frame admitted before the exact generation fence,
+            // and every detached terminal receipt write those frames create.
+            await this.drainPreDeadlineDeliveryCallbacksLocked();
+            await this.drainCallbackQueueLocked();
+            await this.drainDetachedReceiptWritesLocked();
+            await this.requireUnchangedStaleCodexOrphan(alias, binding);
+            const observeCodex = codexAdapter.observeRouteSuccessionBarrier;
+            if (observeCodex === undefined) {
+                throw new BridgeError("CODEX_ORPHAN_RECOVERY_BUSY", "The Codex provider cannot prove an empty orphan route boundary.");
+            }
+            const beforeRelease = observeCodex.call(codexAdapter, binding.routeHandle);
+            if (beforeRelease.routePresent ||
+                !this.codexRouteSuccessionQuiet(beforeRelease) ||
+                beforeRelease.routeCreationInFlight ||
+                beforeRelease.routeReleaseInFlight) {
+                throw new BridgeError("CODEX_ORPHAN_RECOVERY_BUSY", "The stale Codex registration still has a live provider or endpoint-refresh claim.");
+            }
+            if (nativeGeneration !== undefined) {
+                const nativeBarrier = await observeNative.call(claudeAdapter, nativeGeneration);
+                if (!this.nativeCodexOrphanBarrierClean(nativeBarrier, nativeGeneration)) {
+                    throw new BridgeError("CODEX_ORPHAN_RECOVERY_BUSY", "The native Codex listener still owns ingress or receipt work.");
+                }
+            }
+            if (!this.successionServiceStateClean(aliases) ||
+                !this.endpointCallbacksQuiet() ||
+                this.detachedReceiptWrites.size !== 0) {
+                throw new BridgeError("CODEX_ORPHAN_RECOVERY_BUSY", "The stale Codex registration still has a live service claim.");
+            }
+            // The awaited native barrier can admit a provider-side route recovery
+            // claim. Re-sample the Codex boundary after that last await and directly
+            // before the generation-unqualified release call.
+            const releaseBoundary = observeCodex.call(codexAdapter, binding.routeHandle);
+            if (releaseBoundary.routePresent ||
+                !this.codexRouteSuccessionQuiet(releaseBoundary) ||
+                releaseBoundary.routeCreationInFlight ||
+                releaseBoundary.routeReleaseInFlight) {
+                throw new BridgeError("CODEX_ORPHAN_RECOVERY_BUSY", "The stale Codex registration acquired a provider recovery claim before release.");
+            }
+            // The pre-barrier proves this release targets an absent stale handle and
+            // cannot join an already-observed creation. Revalidate immediately after
+            // the provider join before touching the native advertisement.
+            await codexAdapter.releaseRoute?.(binding.routeHandle);
+            await this.drainCallbackQueueLocked();
+            await this.drainDetachedReceiptWritesLocked();
+            await this.requireUnchangedStaleCodexOrphan(alias, binding);
+            const afterRelease = observeCodex.call(codexAdapter, binding.routeHandle);
+            if (afterRelease.routePresent ||
+                !this.codexRouteSuccessionQuiet(afterRelease) ||
+                afterRelease.routeCreationInFlight ||
+                afterRelease.routeReleaseInFlight ||
+                !this.successionServiceStateClean(aliases) ||
+                !this.endpointCallbacksQuiet() ||
+                this.detachedReceiptWrites.size !== 0) {
+                throw new BridgeError("CODEX_ORPHAN_RECOVERY_BUSY", "The stale Codex registration changed at the provider cleanup boundary.");
+            }
+            if (nativeGeneration !== undefined) {
+                const nativeBarrier = await observeNative.call(claudeAdapter, nativeGeneration);
+                if (!this.nativeCodexOrphanBarrierClean(nativeBarrier, nativeGeneration)) {
+                    throw new BridgeError("CODEX_ORPHAN_RECOVERY_BUSY", "The native Codex listener changed during provider cleanup.");
+                }
+                if (currentNative.call(claudeAdapter, alias) !== nativeGeneration) {
+                    throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The native Codex listener generation changed before removal.");
+                }
+            }
+            await this.requireUnchangedStaleCodexOrphan(alias, binding);
+            if (nativeGeneration !== undefined) {
+                const unadvertise = claudeAdapter.unadvertiseNativeCodexPeer;
+                if (unadvertise === undefined) {
+                    throw new BridgeError("CODEX_ORPHAN_NATIVE_IDENTITY_UNPROVEN", "The native Codex listener cannot be removed exactly.");
+                }
+                irreversibleCleanupStarted = true;
+                this.codexOrphanCleanupPending.set(alias, {
+                    binding: { ...binding },
+                    previousSequence: authority.previousSequence,
+                });
+                // The supervisor may remove the exact helper and then report an
+                // ambiguous close failure. Retain retry authority before invoking the
+                // irreversible operation; a retry proves whether the listener remains.
+                await unadvertise.call(claudeAdapter, alias);
+            }
+            // Exact native absence is also an irreversible cleanup boundary: if the
+            // durable mutation fails, only this same binding may resume removal.
+            this.codexOrphanCleanupPending.set(alias, {
+                binding: { ...binding },
+                previousSequence: authority.previousSequence,
+            });
+            irreversibleCleanupStarted = true;
+            const removed = await this.store.removeStaleCodexOrphan({ alias });
+            if (bindingKey(removed.binding) !== bindingKey(binding)) {
+                throw new BridgeError("CODEX_ORPHAN_RECOVERY_MISMATCH", "The stale Codex registration changed during recovery.");
+            }
+            this.finalizeStaleCodexOrphanRemovalLocked(alias);
+            await this.changed();
+        }
+        catch (error) {
+            if (!irreversibleCleanupStarted) {
+                let resumeFailed = false;
+                if (nativeGeneration !== undefined && nativeQuiesceAttempted) {
+                    try {
+                        const resume = this.requireSuccessionMethod(claudeAdapter, "resumeNativeCodexPeerGeneration");
+                        await resume.call(claudeAdapter, nativeGeneration);
+                    }
+                    catch {
+                        resumeFailed = true;
+                        this.dashboardHealthy = false;
+                    }
+                }
+                if (!resumeFailed) {
+                    this.codexSuccessionDispatchFrozen.delete(alias);
+                    if (this.routeStates.get(alias) === "idle") {
+                        this.scheduleDispatch(alias);
+                    }
+                }
+                else {
+                    throw new BridgeError("CODEX_ORPHAN_RECOVERY_CLEANUP_FAILED", "The native Codex listener could not be resumed after failed orphan recovery.");
+                }
+            }
+            throw error;
+        }
+    }
     async discoveryPublicFingerprint() {
         const base = await this.store.publicSnapshot();
         const snapshot = projectGatewayPublicSnapshot({
@@ -1993,13 +2588,22 @@ export class GatewayService {
         const publicBefore = await this.discoveryPublicFingerprint();
         this.candidates.clear();
         const rowsByAlias = new Map();
+        const collisionByRouteHandle = new Map();
         const discoveredCandidates = [];
         const observedSelected = new Set();
         for (const adapter of this.adapters.filter((item) => item.identity.provider === "claude")) {
-            const discovered = (await adapter.discoverClaudePeers?.()) ?? {
+            let discovered = {
                 peers: [],
                 complete: false,
             };
+            try {
+                discovered = (await adapter.discoverClaudePeers?.()) ?? discovered;
+            }
+            catch {
+                // Registry observation is dashboard evidence, not Claude mailbox
+                // authority. The provider still revalidates the exact target before
+                // any write.
+            }
             const grouped = new Map();
             const byHandle = new Map();
             for (const peer of discovered.peers) {
@@ -2019,6 +2623,8 @@ export class GatewayService {
                 if (peer === undefined)
                     continue;
                 if (matches.length !== 1) {
+                    for (const match of matches)
+                        collisionByRouteHandle.set(match.routeHandle, "PEER_ALIAS_COLLISION");
                     rowsByAlias.set(alias, {
                         peer,
                         adapter,
@@ -2035,6 +2641,7 @@ export class GatewayService {
                     continue;
                 }
                 if ((byHandle.get(peer.routeHandle)?.length ?? 0) !== 1) {
+                    collisionByRouteHandle.set(peer.routeHandle, "PEER_SESSION_COLLISION");
                     rowsByAlias.set(alias, {
                         peer,
                         adapter,
@@ -2060,6 +2667,8 @@ export class GatewayService {
                     const collision = this.routeBindings.get(alias);
                     if (collision !== undefined &&
                         bindingKey(collision) !== bindingKey(existing[1])) {
+                        collisionByRouteHandle.set(routeHandle, "PEER_ALIAS_COLLISION");
+                        collisionByRouteHandle.set(collision.routeHandle, "PEER_ALIAS_COLLISION");
                         rowsByAlias.set(alias, {
                             peer: candidate,
                             adapter,
@@ -2074,10 +2683,16 @@ export class GatewayService {
             catch (error) {
                 if (!(error instanceof BridgeError))
                     throw error;
+                // Only a real alias collision may wear that receipt; every other
+                // rename failure is an unobserved peer, not a name conflict.
+                const safeErrorCode = error.code === "ROUTE_ALIAS_COLLISION"
+                    ? "PEER_ALIAS_COLLISION"
+                    : "PEER_NOT_OBSERVED";
+                collisionByRouteHandle.set(routeHandle, safeErrorCode);
                 rowsByAlias.set(alias, {
                     peer: candidate,
                     adapter,
-                    safeErrorCode: "PEER_ALIAS_COLLISION",
+                    safeErrorCode,
                 });
             }
         }
@@ -2146,6 +2761,9 @@ export class GatewayService {
                 observedSelected.has(bindingKey(binding))) {
                 continue;
             }
+            const discoveryError = collisionByRouteHandle.get(binding.routeHandle);
+            if (discoveryError === undefined)
+                continue;
             const inspection = await this.store.inspectPrivateRoute(alias);
             if (inspection !== undefined &&
                 inspection.enabled &&
@@ -2153,9 +2771,9 @@ export class GatewayService {
                 await this.drainPreDeadlineDeliveryCallbacksLocked();
                 const inFlightSettlements = await this.planRouteInFlightSettlementsLocked(alias, {
                     unwrittenOutcome: "failed",
-                    safeErrorCode: "PEER_NOT_OBSERVED",
+                    safeErrorCode: discoveryError,
                 });
-                const settlements = await this.store.invalidateRoute(binding, "PEER_NOT_OBSERVED", inFlightSettlements);
+                const settlements = await this.store.invalidateRoute(binding, discoveryError, inFlightSettlements);
                 for (const settlement of settlements) {
                     await this.applyTerminalSettlementLocked(settlement);
                 }
@@ -2382,6 +3000,11 @@ export class GatewayService {
     async resolveSelectedClaudeDestination(selector) {
         const discoveryChanged = await this.refreshClaudeDiscovery();
         try {
+            const selected = [...this.routeBindings.entries()].find(([alias, binding]) => binding.provider === "claude" &&
+                (alias === selector ||
+                    binding.routeHandle.toLowerCase() === selector.toLowerCase()));
+            if (selected !== undefined)
+                return { alias: selected[0], discoveryChanged };
             const candidate = this.claudeCandidate(selector);
             if (candidate === undefined) {
                 throw new BridgeError("PEER_NOT_FOUND", "No unique compatible interactive peer matches that current name or session UUID.");
@@ -2568,6 +3191,7 @@ export class GatewayService {
         const previous = this.routeBindings.get(alias);
         if (previous !== undefined &&
             bindingKey(previous) !== bindingKey(binding)) {
+            this.bindingAliases.delete(bindingKey(previous));
             this.pendingClaudeReplies.delete(bindingKey(previous));
         }
         this.routeBindings.set(alias, binding);
@@ -2695,8 +3319,10 @@ export class GatewayService {
                 enqueuedAt: input.enqueuedAt,
                 stallAt,
                 deadlineAt,
-                // Deferred means the provider proved no write. Permit one bounded
-                // attempt per 500 ms slice until this message's immutable deadline.
+                // Deferred means the provider proved no write. This budgets one
+                // attempt per 500 ms slice of this message's immutable deadline; a
+                // Codex-bound retry spends one slice each, while a Claude-bound retry
+                // backs off exponentially and spends far fewer of them.
                 maxCleanPrewriteRetries: Math.max(0, Math.ceil((deadlineAt - input.enqueuedAt) / 500)),
                 nativeReceipt: input.nativeReceipt !== undefined,
                 maxNativeReceiptCleanPrewriteRetries: DELIVERY_ACK_RETRY_DELAYS_MS.length,
@@ -3313,12 +3939,10 @@ export class GatewayService {
                 `Embassy 自动活跃检查 — ${action.conversationId}]\n` +
                 "Reply with the result or a status. / 请回复结果或状态。";
             try {
-                await this.enqueue(action.ownerAlias, action.workerAlias, text, false, false, {
+                await this.enqueue(action.ownerAlias, action.workerAlias, text, false, {
                     existingConversationId: action.conversationId,
-                    requestedHopCount: 0,
                     exposeDeliveryToken: false,
                     skipProgressWatchActivity: true,
-                    preserveConversationHop: true,
                     progressWatchNudge: {
                         conversationId: action.conversationId,
                         nudgeNumber: action.nudgeNumber,
@@ -3551,7 +4175,7 @@ export class GatewayService {
                 await this.verifyCodex(params.fromAlias, params.threadId);
                 const resolved = await this.resolveSelectedClaudeDestination(params.toAlias);
                 discoveryChanged = resolved.discoveryChanged;
-                return this.acceptedControlResult(await this.enqueue(params.fromAlias, resolved.alias, params.text, params.expectsReply, false, params.trackIdleMinutes === undefined
+                return this.acceptedControlResult(await this.enqueue(params.fromAlias, resolved.alias, params.text, params.expectsReply, params.trackIdleMinutes === undefined
                     ? {}
                     : { trackIdleMinutes: params.trackIdleMinutes }));
             }
@@ -3570,7 +4194,7 @@ export class GatewayService {
             try {
                 await this.verifyClaude(params.fromAlias, params.replyAddress);
                 const steer = this.config.steeringEnabled && params.text.startsWith("STEER:");
-                return this.acceptedControlResult(await this.enqueue(params.fromAlias, params.toAlias, params.text, steer ? false : params.expectsReply, false, {
+                return this.acceptedControlResult(await this.enqueue(params.fromAlias, params.toAlias, params.text, steer ? false : params.expectsReply, {
                     ...(steer ? { steer: true } : {}),
                     ...(params.trackIdleMinutes === undefined
                         ? {}
@@ -3599,10 +4223,9 @@ export class GatewayService {
                     throw new BridgeError("ROUTE_MISMATCH", "The caller is not a conversation participant.");
                 const result = caller.kind === "codex" &&
                     this.nativeIngressByConversation.has(conversation.id)
-                    ? await this.enqueueNativeReply(conversation, from, params.text, conversation.lastHopCount + 1, true, params.trackIdleMinutes)
-                    : await this.enqueue(from, to, params.text, false, true, {
+                    ? await this.enqueueNativeReply(conversation, from, params.text, true, params.trackIdleMinutes)
+                    : await this.enqueue(from, to, params.text, false, {
                         existingConversationId: conversation.id,
-                        requestedHopCount: conversation.lastHopCount + 1,
                         ...(params.trackIdleMinutes === undefined
                             ? {}
                             : { trackIdleMinutes: params.trackIdleMinutes }),
@@ -3614,7 +4237,7 @@ export class GatewayService {
             }
         });
     }
-    async enqueue(sourceAlias, targetAlias, text, expectsReply, isReply, options = {}) {
+    async enqueue(sourceAlias, targetAlias, text, expectsReply, options = {}) {
         if (this.codexSuccessionPoisoned.has(sourceAlias) ||
             this.codexSuccessionPoisoned.has(targetAlias)) {
             throw new BridgeError("CODEX_SUCCESSION_RECOVERY_REQUIRED", "No message can be accepted while Codex succession requires manual recovery.");
@@ -3637,11 +4260,8 @@ export class GatewayService {
             targetAlias,
             expectsReply,
             nextSequence: 0,
-            lastHopCount: 0,
             lastActivityAt: this.now().toISOString(),
         };
-        const hopCount = options.requestedHopCount ??
-            (isReply ? conversation.lastHopCount + 1 : 0);
         const sequence = conversation.nextSequence;
         const enqueuedAt = this.now().getTime();
         const deliveryToken = (options.exposeDeliveryToken ?? true)
@@ -3654,7 +4274,6 @@ export class GatewayService {
             body: text,
             dedupeKey: `${conversationId}:${sequence}`,
             conversationIdSuffix: conversationId.slice(-8),
-            hopCount,
             deadlineAt,
             ...(options.steer === true ? { steer: true } : {}),
             ...(options.skipProgressWatchActivity === true
@@ -3675,15 +4294,10 @@ export class GatewayService {
         if (queued.pair === true)
             conversation.pair = true;
         conversation.nextSequence += 1;
-        if (options.preserveConversationHop !== true) {
-            conversation.lastHopCount = hopCount;
-        }
         conversation.lastActivityAt = this.now().toISOString();
         this.messageContexts.set(queued.messageId, {
             conversationId,
-            isReply,
             expectsReply,
-            hopCount,
             sequence,
             targetBindingKey: bindingKey(target),
             authorization: "selected_route",
@@ -3702,7 +4316,6 @@ export class GatewayService {
             this.pendingClaudeReplies.set(bindingKey(target), {
                 conversationId,
                 bindingKey: bindingKey(target),
-                hopCount,
                 deadlineAt,
                 tainted: false,
             });
@@ -3716,7 +4329,7 @@ export class GatewayService {
             ...(deliveryToken === undefined ? {} : { deliveryToken }),
         };
     }
-    async enqueueNativeReply(conversation, sourceAlias, text, requestedHopCount, exposeDeliveryToken = true, trackIdleMinutes) {
+    async enqueueNativeReply(conversation, sourceAlias, text, exposeDeliveryToken = true, trackIdleMinutes) {
         this.pruneTransient();
         const capability = this.nativeIngressByConversation.get(conversation.id);
         if (capability === undefined ||
@@ -3740,7 +4353,6 @@ export class GatewayService {
             body: text,
             dedupeKey: `${conversation.id}:${sequence}`,
             conversationIdSuffix: conversation.id.slice(-8),
-            hopCount: requestedHopCount,
             deadlineAt,
             ...(conversation.pair === true ? { pair: true } : {}),
             progressWatch: progressWatchActivity(text, conversation.id, sourceAlias, trackIdleMinutes),
@@ -3749,13 +4361,10 @@ export class GatewayService {
             throw new BridgeError("MESSAGE_REJECTED", "The native reply was not accepted.");
         }
         conversation.nextSequence += 1;
-        conversation.lastHopCount = requestedHopCount;
         conversation.lastActivityAt = this.now().toISOString();
         this.messageContexts.set(queued.messageId, {
             conversationId: conversation.id,
-            isReply: true,
             expectsReply: false,
-            hopCount: requestedHopCount,
             sequence,
             targetBindingKey: bindingKey(capability.binding),
             nativeReplyBinding: { ...capability.binding },
@@ -3787,7 +4396,7 @@ export class GatewayService {
      * native-ingress boundary; this preserves the exact connector generation
      * without recreating route authority or accepting a new unsolicited send.
      */
-    async enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, text, requestedHopCount) {
+    async enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, text) {
         const target = await this.store.resolveRoute(conversation.sourceAlias);
         if (sourceBinding.provider !== "claude" ||
             target.provider !== "codex" ||
@@ -3806,7 +4415,6 @@ export class GatewayService {
             body: text,
             dedupeKey: `${conversation.id}:${sequence}`,
             conversationIdSuffix: conversation.id.slice(-8),
-            hopCount: requestedHopCount,
             deadlineAt,
             authorizedPairTeardownReply: true,
             progressWatch: progressWatchActivity(text, conversation.id, conversation.targetAlias),
@@ -3815,16 +4423,13 @@ export class GatewayService {
             throw new BridgeError("MESSAGE_REJECTED", "The retained provider reply was not accepted.");
         }
         conversation.nextSequence += 1;
-        conversation.lastHopCount = requestedHopCount;
         conversation.lastActivityAt = this.now().toISOString();
         // The old edge has already been removed. Retain only this already-observed
         // reply attempt; the conversation no longer grants pair reply authority.
         delete conversation.pair;
         this.messageContexts.set(queued.messageId, {
             conversationId: conversation.id,
-            isReply: true,
             expectsReply: false,
-            hopCount: requestedHopCount,
             sequence,
             targetBindingKey: bindingKey(target),
             authorization: "selected_route",
@@ -3923,6 +4528,42 @@ export class GatewayService {
             await this.publishNativeHeldLocked(afterCallbacks);
         }
     }
+    restoreQueuedMessageContextLocked(item, binding) {
+        this.pruneTransient();
+        const generatedConversationId = createGatewayConversationId();
+        const conversationId = item.conversationIdSuffix === undefined
+            ? generatedConversationId
+            : `${generatedConversationId.slice(0, -8)}${item.conversationIdSuffix}`;
+        const conversation = {
+            id: conversationId,
+            sourceAlias: item.sourceAlias,
+            targetAlias: item.targetAlias,
+            expectsReply: false,
+            nextSequence: 1,
+            lastActivityAt: this.now().toISOString(),
+            ...(item.pair === true ? { pair: true } : {}),
+        };
+        const context = {
+            conversationId,
+            expectsReply: false,
+            sequence: 0,
+            targetBindingKey: bindingKey(binding),
+            authorization: "selected_route",
+            targetAlias: item.targetAlias,
+            deadlineAt: item.deadlineAt,
+            recovered: true,
+        };
+        this.conversations.set(conversationId, conversation);
+        this.messageContexts.set(item.messageId, context);
+        this.armDeliveryTracker({
+            messageId: item.messageId,
+            conversationId,
+            targetAlias: item.targetAlias,
+            enqueuedAt: Date.parse(item.enqueuedAt),
+            deadlineAt: item.deadlineAt,
+        });
+        return context;
+    }
     async dispatchOne(targetAlias) {
         if (!this.running ||
             this.closing ||
@@ -3949,8 +4590,19 @@ export class GatewayService {
         }
         if (item === undefined)
             return;
-        const context = this.messageContexts.get(item.messageId);
         const selectedBinding = this.routeBindings.get(targetAlias);
+        let context = this.messageContexts.get(item.messageId);
+        if (context === undefined && selectedBinding === undefined) {
+            const result = await this.store.requeueInFlightMessage(item.messageId, item.body);
+            if (result.status === "settled") {
+                await this.applyTerminalSettlementLocked(result.settlement);
+            }
+            await this.changed();
+            return;
+        }
+        if (context === undefined && selectedBinding !== undefined) {
+            context = this.restoreQueuedMessageContextLocked(item, selectedBinding);
+        }
         const binding = context?.nativeReplyBinding ?? selectedBinding;
         if (context === undefined) {
             const result = await this.store.settleMessage({
@@ -3974,8 +4626,8 @@ export class GatewayService {
         }
         if (context.authorization === "selected_route") {
             const routeState = this.routeStates.get(targetAlias);
-            const dispatchable = routeState === "idle" ||
-                (binding.provider === "claude" && routeState === "busy") ||
+            const dispatchable = binding.provider === "claude" ||
+                routeState === "idle" ||
                 (binding.provider === "codex" &&
                     item.steer === true &&
                     routeState === "busy");
@@ -3985,6 +4637,14 @@ export class GatewayService {
                     inspection?.state === "stale" ||
                     inspection?.safeErrorCode === "CODEX_ROUTE_STALE");
             if (codexRouteStale) {
+                if (context.recovered === true) {
+                    const result = await this.store.requeueInFlightMessage(item.messageId, item.body);
+                    if (result.status === "settled") {
+                        await this.applyTerminalSettlementLocked(result.settlement);
+                    }
+                    await this.changed();
+                    return;
+                }
                 await this.advanceDeliveryLocked(item.messageId, {
                     type: "route_terminated",
                     at: this.now().getTime(),
@@ -3995,8 +4655,8 @@ export class GatewayService {
                 this.scheduleDispatch(targetAlias);
                 return;
             }
-            const storedDispatchable = inspection?.state === "idle" ||
-                (binding.provider === "claude" && inspection?.state === "busy") ||
+            const storedDispatchable = binding.provider === "claude" ||
+                inspection?.state === "idle" ||
                 (binding.provider === "codex" &&
                     item.steer === true &&
                     inspection?.state === "busy");
@@ -4088,6 +4748,8 @@ export class GatewayService {
         try {
             result = await this.awaitDispatchWithNativeHeldLocked(tracker, this.adapter(binding.provider, binding.hostId).dispatch({
                 sourceAlias: item.sourceAlias,
+                targetAlias: item.targetAlias,
+                conversationId: context.conversationId,
                 binding,
                 authorization: context.authorization,
                 messageId: item.messageId,
@@ -4126,12 +4788,23 @@ export class GatewayService {
         if (result.state === "deferred") {
             const currentTargetAlias = this.bindingAliases.get(bindingKey(binding)) ?? targetAlias;
             const now = this.now().getTime();
+            const deferredSafeErrorCode = safeCode(result.safeErrorCode, "PROVIDER_DISPATCH_DEFERRED");
+            const retryDelayMs = binding.provider === "claude"
+                ? Math.min(500 * 2 ** (tracker.machine.dispatchAttempt - 1), 300_000)
+                : 500;
+            // Only Claude's backoff is clamped inside the deadline, so a long delay
+            // still buys one last attempt. A Codex-bound retry keeps its exact
+            // unclamped slice: a slice past the deadline must settle now, not wait.
+            const retryAt = binding.provider === "claude"
+                ? Math.min(now + retryDelayMs, tracker.deadlineAt - 1)
+                : now + retryDelayMs;
             await this.advanceDeliveryLocked(item.messageId, {
                 type: "dispatch_clean_prewrite_failed",
                 at: now,
-                retryAt: now + 500,
-                safeErrorCode: safeCode(result.safeErrorCode, "PROVIDER_DISPATCH_DEFERRED"),
+                retryAt,
+                safeErrorCode: deferredSafeErrorCode,
             });
+            tracker.deliverySafeErrorCode = deferredSafeErrorCode;
             const postDeferred = this.deliveryTrackers.get(item.messageId)?.machine;
             if (postDeferred === undefined ||
                 isTerminalDeliveryMachine(postDeferred)) {
@@ -4150,13 +4823,13 @@ export class GatewayService {
                 await this.changed();
                 return;
             }
-            const requeued = await this.store.requeueInFlightMessage(item.messageId, item.body);
+            const requeued = await this.store.requeueInFlightMessage(item.messageId, item.body, deferredSafeErrorCode);
             if (this.activeDispatchByTarget.get(currentTargetAlias) === item.messageId) {
                 this.activeDispatchByTarget.delete(currentTargetAlias);
             }
             if (requeued.status === "requeued") {
                 if (context.authorization === "selected_route") {
-                    if (!steeringWhileBusy) {
+                    if (binding.provider === "codex" && !steeringWhileBusy) {
                         this.routeStates.set(currentTargetAlias, "idle");
                         await this.store.observeRoute({
                             binding,
@@ -4164,7 +4837,7 @@ export class GatewayService {
                             compatibility: "compatible",
                         });
                     }
-                    else {
+                    else if (binding.provider === "codex") {
                         this.scheduleHeldRedispatch(currentTargetAlias);
                     }
                     await this.setNativeCodexStatus(currentTargetAlias, "waiting");
@@ -4275,7 +4948,9 @@ export class GatewayService {
                 safeErrorCode: safeCode(event.safeErrorCode, "DISPATCH_OUTCOME_AMBIGUOUS"),
             }
             : event.state === "transport_written"
-                ? { type: "transport_written", observedAt: receivedAt }
+                ? target.provider === "claude"
+                    ? { type: "provider_released", observedAt: receivedAt }
+                    : { type: "transport_written", observedAt: receivedAt }
                 : event.state === "held"
                     ? { type: "provider_held", observedAt: receivedAt }
                     : event.state === "released" || event.state === "completed"
@@ -4367,7 +5042,7 @@ export class GatewayService {
             conversation !== undefined) {
             try {
                 if (this.nativeIngressByConversation.has(conversation.id)) {
-                    await this.enqueueNativeReply(conversation, conversation.targetAlias, replyText, context.hopCount + 1, false);
+                    await this.enqueueNativeReply(conversation, conversation.targetAlias, replyText, false);
                 }
                 else {
                     const sourceBinding = this.routeBindings.get(conversation.targetAlias);
@@ -4382,12 +5057,11 @@ export class GatewayService {
                         }));
                     if ((!sourceStillRoutable || !pairStillActive) &&
                         sourceBinding?.provider === "claude") {
-                        await this.enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, replyText, context.hopCount + 1);
+                        await this.enqueueObservedClaudeReplyAfterRouteTeardownLocked(conversation, sourceBinding, replyText);
                     }
                     else {
-                        await this.enqueue(conversation.targetAlias, conversation.sourceAlias, replyText, false, true, {
+                        await this.enqueue(conversation.targetAlias, conversation.sourceAlias, replyText, false, {
                             existingConversationId: conversation.id,
-                            requestedHopCount: context.hopCount + 1,
                             exposeDeliveryToken: false,
                         });
                     }
@@ -4448,9 +5122,8 @@ export class GatewayService {
         if (conversation === undefined)
             return;
         this.pendingClaudeReplies.delete(key);
-        await this.enqueue(conversation.targetAlias, conversation.sourceAlias, event.text, false, true, {
+        await this.enqueue(conversation.targetAlias, conversation.sourceAlias, event.text, false, {
             existingConversationId: conversation.id,
-            requestedHopCount: pending.hopCount + 1,
             exposeDeliveryToken: false,
         });
     }
@@ -4493,7 +5166,6 @@ export class GatewayService {
                 body: event.text,
                 dedupeKey: `${conversationId}:0`,
                 conversationIdSuffix: conversationId.slice(-8),
-                hopCount: 0,
                 deadlineAt,
                 ...(steer ? { steer: true } : {}),
                 progressWatch: progressWatchActivity(event.text, conversationId, event.sourceAlias),
@@ -4511,16 +5183,13 @@ export class GatewayService {
                 targetAlias: event.targetAlias,
                 expectsReply: !steer,
                 nextSequence: 1,
-                lastHopCount: 0,
                 lastActivityAt: this.now().toISOString(),
                 ...(queued.pair === true ? { pair: true } : {}),
             };
             this.conversations.set(conversationId, conversation);
             this.messageContexts.set(queued.messageId, {
                 conversationId,
-                isReply: false,
                 expectsReply: !steer,
-                hopCount: 0,
                 sequence: 0,
                 targetBindingKey: bindingKey(target),
                 authorization: "selected_route",
@@ -4586,6 +5255,401 @@ export class GatewayService {
             }
         }
     }
+    async onCodexEndpointRefresh(adapter, event, options = {}) {
+        const transitionKey = endpointRefreshCallbackKey(event);
+        if (this.endpointRefreshCallbackPoisoned &&
+            this.activeEndpointRefreshCallbackKey !== transitionKey) {
+            throw new BridgeError("CODEX_ENDPOINT_REFRESH_CONFLICT", "Conflicting Codex endpoint transitions require a clean broker restart.");
+        }
+        const ownsActiveTransition = this.activeEndpointRefreshCallbackKey === undefined;
+        if (!ownsActiveTransition &&
+            this.activeEndpointRefreshCallbackKey !== transitionKey) {
+            this.poisonEndpointRefreshCallbacks({
+                type: "endpoint_refresh",
+                adapter,
+                value: event,
+            });
+            throw new BridgeError("CODEX_ENDPOINT_REFRESH_CONFLICT", "Conflicting Codex endpoint transitions require a clean broker restart.");
+        }
+        if (ownsActiveTransition) {
+            this.activeEndpointRefreshCallback = {
+                type: "endpoint_refresh",
+                adapter,
+                value: event,
+            };
+            this.activeEndpointRefreshCallbackKey = transitionKey;
+        }
+        let succeeded = false;
+        let activationDeferred = false;
+        try {
+            activationDeferred = await this.applyCodexEndpointRefresh(adapter, event, transitionKey, options);
+            succeeded = true;
+            return activationDeferred;
+        }
+        finally {
+            if (ownsActiveTransition &&
+                this.activeEndpointRefreshCallbackKey === transitionKey) {
+                this.activeEndpointRefreshCallback = undefined;
+                this.activeEndpointRefreshCallbackKey = undefined;
+                const requestedRetry = this.endpointRefreshRetryRequested;
+                this.endpointRefreshRetryRequested = undefined;
+                if ((!succeeded || activationDeferred) &&
+                    !this.endpointRefreshCallbackPoisoned &&
+                    requestedRetry !== undefined) {
+                    this.endpointRefreshCallback = requestedRetry;
+                    this.enqueueCallbackWorkerOnly();
+                }
+            }
+        }
+    }
+    async applyCodexEndpointRefresh(adapter, event, transitionKey, options) {
+        if (this.closing ||
+            (event.outcome !== "compatible" && event.outcome !== "incompatible") ||
+            !isCompatibilityAttestation(event.attestation) ||
+            event.attestation.surface !== "codex" ||
+            event.previous.provider !== "codex" ||
+            !PRIVATE_HANDLE.test(event.previous.endpointGeneration) ||
+            adapter.identity.provider !== "codex" ||
+            adapter.identity.hostId !== event.previous.hostId ||
+            !this.config.allowedHosts.includes(event.previous.hostId)) {
+            throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The Codex endpoint transition failed closed runtime validation.");
+        }
+        if (event.outcome === "compatible") {
+            const routeHandles = Array.isArray(event.routes)
+                ? event.routes.map((route) => route.routeHandle)
+                : [];
+            if (event.current.provider !== "codex" ||
+                event.current.hostId !== event.previous.hostId ||
+                !PRIVATE_HANDLE.test(event.current.endpointGeneration) ||
+                event.current.endpointGeneration ===
+                    event.previous.endpointGeneration ||
+                adapter.identity.endpointGeneration !==
+                    event.current.endpointGeneration ||
+                event.attestation.version !== adapter.protocolVersion ||
+                event.attestation.tier === "incompatible" ||
+                !Array.isArray(event.routes) ||
+                event.routes.length > this.config.limits.maxRoutes ||
+                new Set(routeHandles).size !== routeHandles.length ||
+                event.routes.some((route) => !PRIVATE_HANDLE.test(route.routeHandle) ||
+                    !["idle", "busy", "awaiting_approval"].includes(route.state))) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The refreshed Codex provider identity changed before activation.");
+            }
+            if (this.activatedEndpointRefreshes.get(event.current.hostId) ===
+                transitionKey) {
+                return false;
+            }
+        }
+        else {
+            if (event.candidate.provider !== "codex" ||
+                event.candidate.hostId !== event.previous.hostId ||
+                !PRIVATE_HANDLE.test(event.candidate.endpointGeneration) ||
+                event.candidate.endpointGeneration ===
+                    event.previous.endpointGeneration ||
+                adapter.identity.endpointGeneration !==
+                    event.previous.endpointGeneration ||
+                event.attestation.tier !== "incompatible") {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The incompatible Codex candidate no longer matches the active endpoint.");
+            }
+            if (this.handledIncompatibleEndpointRefreshes.get(event.previous.hostId) === transitionKey) {
+                return false;
+            }
+        }
+        let inventory = await this.store.inspectPrivateCodexRoutes();
+        const previousRoutes = inventory.filter((route) => route.binding.hostId === event.previous.hostId &&
+            route.binding.endpointGeneration === event.previous.endpointGeneration);
+        const aliases = previousRoutes.map((route) => route.alias);
+        await this.drainPreDeadlineDeliveryCallbacksLocked();
+        const inFlightSettlements = aliases.length === 0
+            ? []
+            : await this.planRoutesInFlightSettlementsLocked(aliases, {
+                unwrittenOutcome: "failed",
+                safeErrorCode: "ENDPOINT_GENERATION_CHANGED",
+            });
+        let settlements = [];
+        try {
+            settlements = await this.store.markConnectorOffline(event.previous, "ENDPOINT_GENERATION_CHANGED", inFlightSettlements, { preserveQueued: true });
+        }
+        catch (error) {
+            const alreadyInvalidatedCompatibleTransition = event.outcome === "compatible" &&
+                error instanceof BridgeError &&
+                error.code === "CONNECTOR_NOT_FOUND" &&
+                previousRoutes.every((route) => route.state === "stale" && route.compatibility === "expired");
+            if (!alreadyInvalidatedCompatibleTransition)
+                throw error;
+        }
+        for (const settlement of settlements) {
+            await this.applyTerminalSettlementLocked(settlement);
+        }
+        for (const route of previousRoutes) {
+            this.routeStates.set(route.alias, "stale");
+        }
+        await this.store.recordCompatibilityAttestation(event.attestation);
+        if (event.outcome === "incompatible") {
+            await this.requireEndpointRefreshUnconflicted();
+            this.activeCodexIncompatibility = structuredClone(event.attestation);
+            this.addRuntimeAlert(event.attestation.safeErrorCode ?? "CODEX_ENDPOINT_INCOMPATIBLE", "error", { provider: "codex", host: event.previous.hostId });
+            this.handledIncompatibleEndpointRefreshes.set(event.previous.hostId, transitionKey);
+            await this.changed();
+            return false;
+        }
+        await this.store.observeConnector({
+            identity: event.current,
+            health: "healthy",
+            compatibility: "compatible",
+            protocol: adapter.protocol,
+            protocolVersion: adapter.protocolVersion,
+        });
+        const refreshedByHandle = new Map(event.routes.map((route) => [route.routeHandle, route.state]));
+        const pendingReanchors = previousRoutes.flatMap((route) => {
+            const state = refreshedByHandle.get(route.binding.routeHandle);
+            return state === undefined
+                ? []
+                : [
+                    {
+                        alias: route.alias,
+                        threadId: route.binding.routeHandle,
+                        ownerLease: route.binding.ownerLease,
+                        state,
+                    },
+                ];
+        });
+        if (pendingReanchors.length > 0) {
+            try {
+                await this.store.reanchorCodexRoutes({
+                    oldEndpoint: event.previous,
+                    newEndpoint: event.current,
+                    routes: pendingReanchors,
+                });
+                this.durablyAppliedEndpointRefreshes.set(event.current.hostId, transitionKey);
+            }
+            catch (error) {
+                // Persistence may commit and then report an unknown outcome. Because
+                // service/store mutation is serialized, exact G2 ownership for every
+                // requested G1 alias proves this transition durably applied and gives
+                // a later identical retry authority to restore a fail-closed G2 route.
+                const after = await this.store.inspectPrivateCodexRoutes();
+                const committedExactly = pendingReanchors.every((expected) => {
+                    const matches = after.filter((route) => route.alias === expected.alias &&
+                        route.binding.provider === "codex" &&
+                        route.binding.hostId === event.current.hostId &&
+                        route.binding.endpointGeneration ===
+                            event.current.endpointGeneration &&
+                        route.binding.routeHandle === expected.threadId &&
+                        route.binding.ownerLease === expected.ownerLease &&
+                        route.enabled &&
+                        route.compatibility === "compatible");
+                    return matches.length === 1;
+                });
+                if (committedExactly) {
+                    this.durablyAppliedEndpointRefreshes.set(event.current.hostId, transitionKey);
+                    try {
+                        await this.store.markConnectorOffline(event.current, "CODEX_ENDPOINT_ACTIVATION_FAILED", [], { preserveQueued: true });
+                        for (const route of pendingReanchors) {
+                            this.routeStates.set(route.alias, "stale");
+                        }
+                        await this.changed();
+                    }
+                    catch {
+                        this.dashboardHealthy = false;
+                    }
+                }
+                throw error;
+            }
+        }
+        // A retry may arrive after the store commit but before native status or
+        // provider activation. Re-read exact durable authority and accept only one
+        // unique current-generation owner for every claimed task.
+        inventory = await this.store.inspectPrivateCodexRoutes();
+        if (this.durablyAppliedEndpointRefreshes.get(event.current.hostId) ===
+            transitionKey) {
+            const observedStates = new Map(event.routes.map((route) => [route.routeHandle, route.state]));
+            for (const route of inventory) {
+                const state = observedStates.get(route.binding.routeHandle);
+                if (state === undefined ||
+                    route.binding.hostId !== event.current.hostId ||
+                    route.binding.endpointGeneration !==
+                        event.current.endpointGeneration ||
+                    route.state !== "stale" ||
+                    route.compatibility !== "expired") {
+                    continue;
+                }
+                await this.registerOrRebind(route.alias, route.binding, "endpoint_reobserved", state, route.binding.ownerLease);
+            }
+            inventory = await this.store.inspectPrivateCodexRoutes();
+        }
+        const previousRouteHandles = new Set(previousRoutes.map((route) => route.binding.routeHandle));
+        const activatedRoutes = event.routes.flatMap((observed) => {
+            const matches = inventory.filter((route) => route.binding.provider === "codex" &&
+                route.binding.hostId === event.current.hostId &&
+                route.binding.endpointGeneration ===
+                    event.current.endpointGeneration &&
+                route.binding.routeHandle === observed.routeHandle &&
+                route.enabled &&
+                route.compatibility === "compatible");
+            if (matches.length > 1) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "A refreshed Codex task has multiple durable owners.");
+            }
+            if (matches.length === 0) {
+                // A selector-triggered refresh can report the freshly selected task
+                // before registerRoute installs that new alias. It has no prior G1
+                // owner to re-anchor, so activation covers only already-durable tasks;
+                // the caller installs this one immediately after the provider ack.
+                if (!previousRouteHandles.has(observed.routeHandle))
+                    return [];
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "A previously durable Codex task was not re-anchored exactly.");
+            }
+            const match = matches[0];
+            if (match === undefined)
+                return [];
+            return {
+                alias: match.alias,
+                threadId: observed.routeHandle,
+                ownerLease: match.binding.ownerLease,
+                state: observed.state,
+            };
+        });
+        const pendingSelector = this.pendingSelectorEndpointActivations.get(event.current.hostId);
+        const requiredRoute = options.deferActivation === true
+            ? undefined
+            : options.requiredRoute ??
+                (pendingSelector?.transitionKey === transitionKey
+                    ? pendingSelector.route
+                    : undefined);
+        if (requiredRoute !== undefined &&
+            !activatedRoutes.some((route) => route.alias === requiredRoute.alias &&
+                route.threadId === requiredRoute.threadId)) {
+            const matches = inventory.filter((route) => route.alias === requiredRoute.alias &&
+                route.binding.provider === "codex" &&
+                route.binding.hostId === event.current.hostId &&
+                route.binding.endpointGeneration ===
+                    event.current.endpointGeneration &&
+                route.binding.routeHandle === requiredRoute.threadId &&
+                route.enabled &&
+                route.compatibility === "compatible");
+            const match = matches[0];
+            if (matches.length !== 1 || match === undefined) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "The registering Codex task was not durably installed exactly.");
+            }
+            activatedRoutes.push({
+                alias: requiredRoute.alias,
+                threadId: requiredRoute.threadId,
+                ownerLease: match.binding.ownerLease,
+                state: requiredRoute.state,
+            });
+        }
+        if (options.deferActivation === true) {
+            const deferredRoute = options.deferredRoute;
+            if (deferredRoute === undefined) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_MISMATCH", "A deferred selector transition requires one exact registration.");
+            }
+            const existing = this.pendingSelectorEndpointActivations.get(event.current.hostId);
+            if (existing !== undefined &&
+                (existing.transitionKey !== transitionKey ||
+                    existing.route.alias !== deferredRoute.alias ||
+                    existing.route.threadId !== deferredRoute.threadId)) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_CONFLICT", "A different selector transition is already awaiting native activation.");
+            }
+            this.pendingSelectorEndpointActivations.set(event.current.hostId, {
+                transitionKey,
+                route: { ...deferredRoute },
+            });
+            return true;
+        }
+        const requireNativeContinuity = (route) => {
+            const registration = this.codexRegistrationLocks.get(route.alias);
+            if (registration === undefined ||
+                registration.hostId !== event.current.hostId ||
+                registration.threadId !== route.threadId ||
+                !isCodexRegistrationGeneration(registration.generation)) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_NATIVE_LISTENER_MISSING", "The refreshed Codex route has no exact live native listener authority.");
+            }
+            const nativeGeneration = this.requireCurrentNativeCodexGeneration(this.adapter("claude", event.current.hostId), route.alias);
+            if (nativeGeneration !== registration.generation) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_NATIVE_LISTENER_MISSING", "The refreshed Codex route's native listener generation changed before activation.");
+            }
+        };
+        try {
+            for (const route of activatedRoutes) {
+                const binding = {
+                    ...event.current,
+                    routeHandle: route.threadId,
+                    ownerLease: route.ownerLease,
+                };
+                this.rememberBinding(route.alias, binding, route.state);
+            }
+            for (const route of activatedRoutes) {
+                requireNativeContinuity(route);
+                await this.setNativeCodexStatus(route.alias, route.state === "idle"
+                    ? "idle"
+                    : route.state === "awaiting_approval"
+                        ? "waiting"
+                        : "busy", true);
+                requireNativeContinuity(route);
+            }
+            await this.requireEndpointRefreshUnconflicted();
+            for (const route of activatedRoutes) {
+                const activityKey = `${transitionKey}\0${route.alias}`;
+                if (!this.endpointRefreshActivityKeys.has(activityKey)) {
+                    this.endpointRefreshActivityKeys.add(activityKey);
+                    while (this.endpointRefreshActivityKeys.size > RUNTIME_ACTIVITY_CAPACITY) {
+                        const oldest = this.endpointRefreshActivityKeys.values().next().value;
+                        if (oldest === undefined)
+                            break;
+                        this.endpointRefreshActivityKeys.delete(oldest);
+                    }
+                    this.activitySequence += 1;
+                    this.activityEvents.push({
+                        sequence: this.activitySequence,
+                        timestamp: this.now().toISOString(),
+                        kind: "endpoint",
+                        action: "endpoint_refreshed",
+                        outcome: "accepted",
+                        aliases: [route.alias],
+                        operatorAction: false,
+                    });
+                    while (this.activityEvents.length > RUNTIME_ACTIVITY_CAPACITY) {
+                        this.activityEvents.shift();
+                    }
+                }
+                if (route.state === "idle")
+                    this.scheduleDispatch(route.alias);
+            }
+            await this.changed();
+            await this.requireEndpointRefreshUnconflicted();
+            for (const route of activatedRoutes) {
+                requireNativeContinuity(route);
+            }
+            // Provider writes remain closed until every durable and native transition
+            // above is complete. This acknowledgement is deliberately the final
+            // fallible activation step.
+            const accept = adapter.acceptCompatibilityAttestation;
+            if (accept === undefined) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_ACTIVATION_UNAVAILABLE", "The Codex provider cannot acknowledge the validated endpoint transition.");
+            }
+            accept.call(adapter, event.attestation);
+        }
+        catch (error) {
+            try {
+                await this.store.markConnectorOffline(event.current, "CODEX_ENDPOINT_ACTIVATION_FAILED", [], { preserveQueued: true });
+                for (const route of activatedRoutes) {
+                    this.routeStates.set(route.alias, "stale");
+                }
+                await this.changed();
+            }
+            catch {
+                this.dashboardHealthy = false;
+            }
+            throw error;
+        }
+        this.activatedEndpointRefreshes.set(event.current.hostId, transitionKey);
+        if (this.pendingSelectorEndpointActivations.get(event.current.hostId)
+            ?.transitionKey === transitionKey) {
+            this.pendingSelectorEndpointActivations.delete(event.current.hostId);
+        }
+        this.handledIncompatibleEndpointRefreshes.delete(event.current.hostId);
+        this.activeCodexIncompatibility = undefined;
+        return false;
+    }
     async onRouteState(source, event) {
         if (this.closing)
             return;
@@ -4655,15 +5719,27 @@ export class GatewayService {
             this.scheduleDispatch(alias);
         }
     }
-    async setNativeCodexStatus(alias, status) {
+    async setNativeCodexStatus(alias, status, requireSuccess = false) {
         const binding = this.routeBindings.get(alias);
         if (binding?.provider !== "codex")
             return;
-        await this.adapter("claude", binding.hostId)
-            .updateNativeCodexPeerStatus?.(alias, status)
-            .catch(() => {
+        const adapter = this.adapter("claude", binding.hostId);
+        const update = adapter.updateNativeCodexPeerStatus;
+        if (update === undefined) {
+            if (requireSuccess) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_NATIVE_STATUS_FAILED", "The native listener does not support refreshed Codex status activation.", true);
+            }
+            return;
+        }
+        try {
+            await update.call(adapter, alias, status);
+        }
+        catch (error) {
             this.dashboardHealthy = false;
-        });
+            if (requireSuccess) {
+                throw new BridgeError("CODEX_ENDPOINT_REFRESH_NATIVE_STATUS_FAILED", "The refreshed Codex route could not be activated in the native listener.", true);
+            }
+        }
     }
     rejectDetachedNativeReceipt(hostId, receiptHandle, diagnosticCode) {
         const work = this.settleDetachedNativeReceipt(hostId, receiptHandle, diagnosticCode).finally(() => {
@@ -4748,15 +5824,29 @@ export class GatewayService {
     async publicSnapshotLocked() {
         const base = await this.store.publicSnapshot();
         const compatibilityChecks = [];
-        for (const adapter of this.adapters) {
-            const observation = adapter.compatibilitySurface?.();
-            if (observation === undefined)
+        for (const surface of compatibilitySurfaces) {
+            if (surface === "codex" && this.activeCodexIncompatibility !== undefined) {
+                compatibilityChecks.push(structuredClone(this.activeCodexIncompatibility));
                 continue;
-            const attestation = await this.store.inspectCompatibilityAttestation(observation.surface, observation.version);
-            if (attestation !== undefined)
-                compatibilityChecks.push(attestation);
+            }
+            const currentVersions = [
+                ...new Set(this.adapters.flatMap((adapter) => {
+                    const observation = adapter.compatibilitySurface?.();
+                    return observation?.surface === surface ? [observation.version] : [];
+                })),
+            ].sort((left, right) => left.localeCompare(right));
+            const currentAttestations = (await Promise.all(currentVersions.map(async (version) => await this.store.inspectCompatibilityAttestation(surface, version))))
+                .filter((attestation) => attestation !== undefined)
+                .sort((left, right) => {
+                const checkedAt = right.checkedAt.localeCompare(left.checkedAt);
+                if (checkedAt !== 0)
+                    return checkedAt;
+                return left.version.localeCompare(right.version);
+            });
+            const selected = currentAttestations[0];
+            if (selected !== undefined)
+                compatibilityChecks.push(selected);
         }
-        compatibilityChecks.sort((left, right) => left.surface.localeCompare(right.surface));
         const peers = this.availablePeers.map((peer) => ({ ...peer }));
         if (!arePublicAvailablePeerSnapshots(peers)) {
             throw new BridgeError("INVALID_TRANSIENT_INVENTORY", "The transient peer inventory is unsafe.");
@@ -4782,21 +5872,6 @@ export class GatewayService {
                 },
             ];
         });
-        const certificationAlerts = compatibilityChecks.flatMap((attestation) => {
-            const certification = attestation.certification;
-            if (certification?.outcome !== "fail")
-                return [];
-            const adapter = this.adapters.find((candidate) => candidate.identity.provider === attestation.surface);
-            return [
-                {
-                    code: "COMPATIBILITY_CERTIFICATION_FAILED",
-                    severity: "error",
-                    timestamp: certification.certifiedAt,
-                    provider: attestation.surface,
-                    host: adapter?.identity.hostId ?? "this-mac",
-                },
-            ];
-        });
         return projectGatewayPublicSnapshot({
             ...base,
             ...(compatibilityChecks.length === 0 ? {} : { compatibilityChecks }),
@@ -4812,7 +5887,6 @@ export class GatewayService {
             alerts: [
                 ...base.alerts,
                 ...this.runtimeAlerts.map((alert) => ({ ...alert })),
-                ...certificationAlerts,
                 ...stalledAlerts,
             ],
         });