agent-embassy 1.4.1 → 1.6.0

package/dist/src/gateway/store.js

@@ -6,9 +6,9 @@ import path from "node:path";
 import { BridgeError } from "../errors.js";
 import { KeyedMutex } from "../mutex.js";
 import { isCodexRegistrationGeneration } from "./codex-registration-generation.js";
-import { compatibilityCacheKey, isCompatibilityAttestation, } from "./compatibility.js";
-import { PROGRESS_WATCH_DEFAULT_CAPACITY, PROGRESS_WATCH_HARD_CAPACITY, PROGRESS_WATCH_MAX_IDLE_MS, PROGRESS_WATCH_MIN_IDLE_MS, createProgressWatchMachine, progressWatchCapabilities, progressWatchJournalKinds, progressWatchPhases, transitionProgressWatch, } from "./progress-watch-machine.js";
-import { CODEX_ENDPOINT_REFRESH_JOURNAL_CAPACITY, CODEX_ORPHAN_REMOVAL_JOURNAL_CAPACITY, compatibilityStates, connectorHealthStates, deliveryStates, gatewayProviders, messageDirections, projectGatewayPublicSnapshot, routeRegistrationModes, routeStates, } from "./types.js";
+import { compatibilityCacheKey, isCompatibilityAttestation, isPersistedCompatibilityAttestation, } from "./compatibility.js";
+import { PROGRESS_WATCH_DEFAULT_CAPACITY, PROGRESS_WATCH_HARD_CAPACITY, PROGRESS_WATCH_MAX_IDLE_MS, PROGRESS_WATCH_MIN_IDLE_MS, commitProgressWatchNudge, createProgressWatch, deferProgressWatchNudge, inspectProgressWatchDue, progressWatchJournalKinds, recordProgressWatchActivity, } from "./progress-watch-machine.js";
+import { CODEX_ENDPOINT_REFRESH_JOURNAL_CAPACITY, CODEX_ORPHAN_REMOVAL_JOURNAL_CAPACITY, compatibilityStates, connectorHealthStates, deliveryStates, gatewayPublicSnapshotLimits, gatewayProviders, messageDirections, projectGatewayPublicSnapshot, routeRegistrationModes, routeStates, } from "./types.js";
 const STATE_MARKER = ".agent-embassy-state";
 const STATE_MARKER_CONTENT = "agent-embassy-state-v1\n";
 const STATE_FILE = "gateway-state.json";
@@ -44,8 +44,6 @@ const ROUTE_STATES = new Set(routeStates);
 const REGISTRATION_MODES = new Set(routeRegistrationModes);
 const DIRECTIONS = new Set(messageDirections);
 const DELIVERY_STATES = new Set(deliveryStates);
-const PROGRESS_WATCH_PHASES = new Set(progressWatchPhases);
-const PROGRESS_WATCH_CAPABILITIES = new Set(progressWatchCapabilities);
 const PROGRESS_WATCH_JOURNAL_KINDS = new Set(progressWatchJournalKinds);
 export const codexSuccessionJournalStages = [
     "prepared",
@@ -289,7 +287,30 @@ function progressWatchMatchesPair(watch, pair) {
             watch.workerAlias === pair.claudeAlias &&
             watch.workerLease === pair.claudeOwnerLease));
 }
-function isLegacyProgressWatchMachine(value) {
+function progressWatchJournalEvent(watch, timestamp, transition) {
+    return {
+        timestamp,
+        conversationId: watch.conversationId,
+        ownerAlias: watch.ownerAlias,
+        workerAlias: watch.workerAlias,
+        ...transition,
+    };
+}
+const LEGACY_V14_PROGRESS_WATCH_JOURNAL_KINDS = new Set([
+    "opened",
+    "replaced",
+    "activity",
+    "nudge",
+    "worker_reported_complete",
+    "capability_degraded",
+    "conversation_rebound",
+    "done",
+    "unresponsive",
+    "pair_removed",
+    "endpoint_retired",
+    "disabled",
+]);
+function isLegacyV14ProgressWatch(value) {
     if (!isObject(value) ||
         !hasOnlyKeys(value, [
             "conversationId",
@@ -306,7 +327,7 @@ function isLegacyProgressWatchMachine(value) {
             "nextActionAt",
             "capability",
             "degradedNoticeSent",
-        ], ["workerReportedCompleteAt"])) {
+        ])) {
         return false;
     }
     return (typeof value.conversationId === "string" &&
@@ -325,8 +346,7 @@ function isLegacyProgressWatchMachine(value) {
         isPositiveInteger(value.idleMs) &&
         value.idleMs >= PROGRESS_WATCH_MIN_IDLE_MS &&
         value.idleMs <= PROGRESS_WATCH_MAX_IDLE_MS &&
-        typeof value.phase === "string" &&
-        PROGRESS_WATCH_PHASES.has(value.phase) &&
+        (value.phase === "quiet" || value.phase === "episode") &&
         (value.nudgeCount === 0 ||
             value.nudgeCount === 1 ||
             value.nudgeCount === 2) &&
@@ -334,17 +354,10 @@ function isLegacyProgressWatchMachine(value) {
             ? value.nudgeCount === 0
             : value.nudgeCount === 1 || value.nudgeCount === 2) &&
         isIsoTimestamp(value.nextActionAt) &&
-        typeof value.capability === "string" &&
-        PROGRESS_WATCH_CAPABILITIES.has(value.capability) &&
-        typeof value.degradedNoticeSent === "boolean" &&
-        (value.workerReportedCompleteAt === undefined ||
-            isIsoTimestamp(value.workerReportedCompleteAt)));
+        (value.capability === "conversation" || value.capability === "route") &&
+        typeof value.degradedNoticeSent === "boolean");
 }
-function isProgressWatchMachine(value) {
-    return (isLegacyProgressWatchMachine(value) &&
-        !Object.hasOwn(value, "workerReportedCompleteAt"));
-}
-function isProgressWatchJournalEvent(value) {
+function isLegacyV14ProgressWatchJournalEvent(value) {
     return (isObject(value) &&
         hasOnlyKeys(value, [
             "sequence",
@@ -364,14 +377,94 @@ function isProgressWatchJournalEvent(value) {
         ALIAS_PATTERN.test(value.workerAlias) &&
         value.ownerAlias !== value.workerAlias &&
         typeof value.kind === "string" &&
-        PROGRESS_WATCH_JOURNAL_KINDS.has(value.kind) &&
-        (value.nudgeNumber === undefined ||
-            value.nudgeNumber === 1 ||
-            value.nudgeNumber === 2) &&
+        LEGACY_V14_PROGRESS_WATCH_JOURNAL_KINDS.has(value.kind) &&
         (value.kind === "nudge"
             ? value.nudgeNumber === 1 || value.nudgeNumber === 2
             : value.nudgeNumber === undefined));
 }
+function isProgressWatch(value) {
+    return (isObject(value) &&
+        hasOnlyKeys(value, [
+            "conversationId",
+            "ownerAlias",
+            "workerAlias",
+            "ownerLease",
+            "workerLease",
+            "lastActivityAt",
+            "idleMs",
+            "nudgeCount",
+            "nextActionAt",
+        ]) &&
+        typeof value.conversationId === "string" &&
+        CONVERSATION_ID_PATTERN.test(value.conversationId) &&
+        typeof value.ownerAlias === "string" &&
+        ALIAS_PATTERN.test(value.ownerAlias) &&
+        typeof value.workerAlias === "string" &&
+        ALIAS_PATTERN.test(value.workerAlias) &&
+        value.ownerAlias !== value.workerAlias &&
+        isPrivateToken(value.ownerLease) &&
+        isPrivateToken(value.workerLease) &&
+        value.ownerLease !== value.workerLease &&
+        isIsoTimestamp(value.lastActivityAt) &&
+        isPositiveInteger(value.idleMs) &&
+        value.idleMs >= PROGRESS_WATCH_MIN_IDLE_MS &&
+        value.idleMs <= PROGRESS_WATCH_MAX_IDLE_MS &&
+        (value.nudgeCount === 0 ||
+            value.nudgeCount === 1 ||
+            value.nudgeCount === 2) &&
+        isIsoTimestamp(value.nextActionAt));
+}
+function isProgressWatchJournalEvent(value) {
+    if (!isObject(value) ||
+        !hasOnlyKeys(value, [
+            "sequence",
+            "timestamp",
+            "conversationId",
+            "ownerAlias",
+            "workerAlias",
+            "kind",
+            "actor",
+        ], ["reason"]) ||
+        !isPositiveInteger(value.sequence) ||
+        !isIsoTimestamp(value.timestamp) ||
+        typeof value.conversationId !== "string" ||
+        !CONVERSATION_ID_PATTERN.test(value.conversationId) ||
+        typeof value.ownerAlias !== "string" ||
+        !ALIAS_PATTERN.test(value.ownerAlias) ||
+        typeof value.workerAlias !== "string" ||
+        !ALIAS_PATTERN.test(value.workerAlias) ||
+        value.ownerAlias === value.workerAlias ||
+        typeof value.kind !== "string" ||
+        !PROGRESS_WATCH_JOURNAL_KINDS.has(value.kind)) {
+        return false;
+    }
+    if (value.kind === "opened") {
+        return value.actor === "owner" && value.reason === undefined;
+    }
+    if (value.kind === "replaced") {
+        return ((value.actor === "owner" || value.actor === "unknown") &&
+            value.reason === undefined);
+    }
+    if (value.kind !== "settled" || typeof value.reason !== "string") {
+        return false;
+    }
+    if (value.reason === "done") {
+        return value.actor === "owner" || value.actor === "worker";
+    }
+    if (value.reason === "untracked")
+        return value.actor === "operator";
+    if (value.reason === "pair_removed")
+        return value.actor === "operator";
+    if (value.reason === "endpoint_retired") {
+        return value.actor === "gateway" || value.actor === "operator";
+    }
+    if (value.reason === "idle_timeout" ||
+        value.reason === "tracking_disabled" ||
+        value.reason === "legacy_upgrade") {
+        return value.actor === "gateway";
+    }
+    return value.reason === "legacy_done" && value.actor === "unknown";
+}
 function isConnectorRecord(value) {
     if (!isObject(value) ||
         !hasOnlyKeys(value, [
@@ -784,8 +877,9 @@ function isLegacyCompatibilityCertification(value) {
 }
 /**
  * v1.1-v1.2 compatibility rows could contain manual live-certification
- * evidence. The ceremony is gone: accept only its exact old shape, discard
- * it, and retain the automatic bounded probe evidence.
+ * evidence. Discard only an exact old certification, retain the automatic
+ * bounded probes as schema-attested evidence, and leave malformed rows
+ * untouched for strict state validation to reject.
  */
 function migrateLegacyCompatibilityCertifications(value) {
     if (!isObject(value) ||
@@ -795,105 +889,180 @@ function migrateLegacyCompatibilityCertifications(value) {
     }
     let changed = false;
     const compatibilityAttestations = value.compatibilityAttestations.map((entry) => {
-        if (!isObject(entry) || !Object.hasOwn(entry, "certification")) {
-            return entry;
-        }
-        if (!isLegacyCompatibilityCertification(entry.certification)) {
+        let candidate = entry;
+        if (isObject(entry) &&
+            Object.hasOwn(entry, "certification") &&
+            isLegacyCompatibilityCertification(entry.certification)) {
+            const { certification: _legacyCertification, ...current } = entry;
+            candidate =
+                current.tier === "certified"
+                    ? { ...current, tier: "schema_attested" }
+                    : current;
+        }
+        if (!isPersistedCompatibilityAttestation(candidate))
             return entry;
-        }
-        const { certification: _legacyCertification, ...current } = entry;
-        if (!isCompatibilityAttestation(current))
-            return entry;
-        changed = true;
-        return current;
+        if (candidate !== entry)
+            changed = true;
+        return candidate;
     });
     return changed ? { ...value, compatibilityAttestations } : value;
 }
+function legacyProgressWatchGraphIsValid(value, watches) {
+    if (!isObject(value) ||
+        !Array.isArray(value.routes) ||
+        !value.routes.every(isRouteRecord) ||
+        !Array.isArray(value.pairs) ||
+        value.pairs.length > 256 ||
+        !value.pairs.every(isPairRecord) ||
+        new Set(watches.map((watch) => watch.conversationId)).size !==
+            watches.length ||
+        new Set(watches.map(progressWatchPairKey)).size !== watches.length) {
+        return false;
+    }
+    const routes = value.routes;
+    const pairs = value.pairs;
+    for (const watch of watches) {
+        const owner = routes.find((route) => route.alias === watch.ownerAlias &&
+            route.binding.ownerLease === watch.ownerLease);
+        const worker = routes.find((route) => route.alias === watch.workerAlias &&
+            route.binding.ownerLease === watch.workerLease);
+        if (owner === undefined ||
+            worker === undefined ||
+            owner.binding.provider === worker.binding.provider ||
+            owner.binding.hostId !== worker.binding.hostId) {
+            return false;
+        }
+        const claude = owner.binding.provider === "claude" ? owner : worker;
+        const codex = owner.binding.provider === "codex" ? owner : worker;
+        if (!pairs.some((pair) => pair.claudeAlias === claude.alias &&
+            pair.codexAlias === codex.alias &&
+            pair.claudeOwnerLease === claude.binding.ownerLease &&
+            pair.codexOwnerLease === codex.binding.ownerLease)) {
+            return false;
+        }
+    }
+    return true;
+}
+function mapLegacyProgressWatchEvent(event) {
+    const base = {
+        timestamp: event.timestamp,
+        conversationId: event.conversationId,
+        ownerAlias: event.ownerAlias,
+        workerAlias: event.workerAlias,
+    };
+    switch (event.kind) {
+        case "opened":
+            return { ...base, kind: "opened", actor: "owner" };
+        case "replaced":
+            // v1.4 used this kind for both owner replacement and an automatic
+            // duplicate migration. Its actor cannot be reconstructed honestly.
+            return { ...base, kind: "replaced", actor: "unknown" };
+        case "worker_reported_complete":
+            return { ...base, kind: "settled", actor: "worker", reason: "done" };
+        case "done":
+            return {
+                ...base,
+                kind: "settled",
+                actor: "unknown",
+                reason: "legacy_done",
+            };
+        case "unresponsive":
+            return {
+                ...base,
+                kind: "settled",
+                actor: "gateway",
+                reason: "idle_timeout",
+            };
+        case "pair_removed":
+            return {
+                ...base,
+                kind: "settled",
+                actor: "operator",
+                reason: "pair_removed",
+            };
+        case "endpoint_retired":
+            return {
+                ...base,
+                kind: "settled",
+                actor: "gateway",
+                reason: "endpoint_retired",
+            };
+        case "disabled":
+            return {
+                ...base,
+                kind: "settled",
+                actor: "gateway",
+                reason: "tracking_disabled",
+            };
+        case "activity":
+        case "nudge":
+        case "capability_degraded":
+        case "conversation_rebound":
+            return undefined;
+    }
+}
 /**
- * Before v1.4, separately tracked conversations could leave multiple active
- * watches on one exact pair, and a worker completion could remain as a flag on
- * an active watch. Settle both legacy shapes into the bounded journal. Losers
- * are ordered by their stable original-array position, so a persisted result
- * is idempotent when loaded again.
+ * v1.4.x watches carried capability and phase state that no longer has product
+ * meaning. Strictly recognize the complete old graph, preserve representable
+ * history, and settle every live row once at upgrade. Rebase the bounded
+ * private sequence so a historical counter cannot make the new format fatal.
  */
-function migrateLegacyProgressWatchState(value, eventCapacity) {
+function migrateV14ProgressWatchState(value, migratedAt) {
     if (!isObject(value) ||
         value.schemaVersion !== 1 ||
         !isIsoTimestamp(value.updatedAt) ||
+        !isIsoTimestamp(migratedAt) ||
         !isNonNegativeInteger(value.watchSequence) ||
         !Array.isArray(value.progressWatches) ||
-        value.progressWatches.length > PROGRESS_WATCH_HARD_CAPACITY ||
-        !value.progressWatches.every(isLegacyProgressWatchMachine) ||
-        !Array.isArray(value.progressWatchEvents) ||
-        !value.progressWatchEvents.every(isProgressWatchJournalEvent) ||
-        value.progressWatchEvents.length > eventCapacity ||
-        new Set(value.progressWatches.map((watch) => watch.conversationId)).size !== value.progressWatches.length) {
+        !Array.isArray(value.progressWatchEvents)) {
         return value;
     }
-    const progressWatches = value.progressWatches;
-    const existingEvents = value.progressWatchEvents;
-    const watchSequenceBefore = value.watchSequence;
-    if (existingEvents.some((event, index) => event.sequence > watchSequenceBefore ||
-        (index > 0 && event.sequence <= existingEvents[index - 1].sequence))) {
+    const hasLegacyRows = value.progressWatches.some(isLegacyV14ProgressWatch) ||
+        value.progressWatchEvents.some(isLegacyV14ProgressWatchJournalEvent);
+    if (!hasLegacyRows)
         return value;
-    }
-    const winnerByPair = new Map();
-    for (const [index, watch] of progressWatches.entries()) {
-        const key = progressWatchPairKey(watch);
-        const winnerIndex = winnerByPair.get(key);
-        const winner = winnerIndex === undefined
-            ? undefined
-            : progressWatches[winnerIndex];
-        if (winner === undefined ||
-            Date.parse(watch.createdAt) >= Date.parse(winner.createdAt)) {
-            winnerByPair.set(key, index);
-        }
-    }
-    const winnerIndexes = new Set(winnerByPair.values());
-    const loserIndexes = progressWatches
-        .map((_, index) => index)
-        .filter((index) => !winnerIndexes.has(index));
-    const completedWinnerIndexes = [...winnerByPair.values()].filter((index) => progressWatches[index]?.workerReportedCompleteAt !== undefined);
-    const additions = loserIndexes.length + completedWinnerIndexes.length;
-    if (additions === 0)
+    if (value.progressWatches.length > PROGRESS_WATCH_HARD_CAPACITY ||
+        !value.progressWatches.every(isLegacyV14ProgressWatch) ||
+        value.progressWatchEvents.length > gatewayPublicSnapshotLimits.messages ||
+        !value.progressWatchEvents.every(isLegacyV14ProgressWatchJournalEvent)) {
         return value;
-    if (watchSequenceBefore > Number.MAX_SAFE_INTEGER - additions) {
-        throw new BridgeError("PROGRESS_WATCH_SEQUENCE_EXHAUSTED", "The bounded progress-watch journal sequence is exhausted.");
-    }
-    const retained = new Set(winnerIndexes);
-    for (const index of completedWinnerIndexes)
-        retained.delete(index);
-    let watchSequence = watchSequenceBefore;
-    const progressWatchEvents = [...existingEvents];
-    const append = (watch, kind, timestamp) => {
-        watchSequence += 1;
-        progressWatchEvents.push({
-            sequence: watchSequence,
-            timestamp,
-            conversationId: watch.conversationId,
-            ownerAlias: watch.ownerAlias,
-            workerAlias: watch.workerAlias,
-            kind,
-        });
-        while (progressWatchEvents.length > eventCapacity) {
-            progressWatchEvents.shift();
-        }
-    };
-    for (const index of loserIndexes) {
-        const watch = progressWatches[index];
-        const winner = progressWatches[winnerByPair.get(progressWatchPairKey(watch))];
-        append(watch, "replaced", winner.createdAt);
     }
-    for (const index of completedWinnerIndexes) {
-        const watch = progressWatches[index];
-        append(watch, "worker_reported_complete", watch.workerReportedCompleteAt);
+    const watches = value.progressWatches;
+    const legacyEvents = value.progressWatchEvents;
+    const watchSequence = value.watchSequence;
+    if (!legacyProgressWatchGraphIsValid(value, watches) ||
+        legacyEvents.some((event, index) => event.sequence > watchSequence ||
+            (index > 0 && event.sequence <= legacyEvents[index - 1].sequence))) {
+        return value;
     }
+    const pending = [];
+    for (const event of legacyEvents) {
+        const mapped = mapLegacyProgressWatchEvent(event);
+        if (mapped !== undefined)
+            pending.push(mapped);
+    }
+    const settlements = watches.map((watch) => ({
+        timestamp: migratedAt,
+        conversationId: watch.conversationId,
+        ownerAlias: watch.ownerAlias,
+        workerAlias: watch.workerAlias,
+        kind: "settled",
+        actor: "gateway",
+        reason: "legacy_upgrade",
+    }));
+    const retainedHistoryCount = gatewayPublicSnapshotLimits.messages - settlements.length;
+    const retained = [
+        ...pending.slice(Math.max(0, pending.length - retainedHistoryCount)),
+        ...settlements,
+    ];
+    const progressWatchEvents = retained.map((event, index) => ({
+        ...event,
+        sequence: index + 1,
+    }));
     return {
         ...value,
-        watchSequence,
-        progressWatches: progressWatches
-            .filter((_, index) => retained.has(index))
-            .map(({ workerReportedCompleteAt: _legacy, ...watch }) => watch),
+        watchSequence: progressWatchEvents.length,
+        progressWatches: [],
         progressWatchEvents,
     };
 }
@@ -936,14 +1105,15 @@ function isPersistedState(value) {
         value.pairs.length > 256 ||
         !value.pairs.every(isPairRecord) ||
         !Array.isArray(value.progressWatches) ||
-        value.progressWatches.length > 256 ||
-        !value.progressWatches.every(isProgressWatchMachine) ||
+        value.progressWatches.length > PROGRESS_WATCH_HARD_CAPACITY ||
+        !value.progressWatches.every(isProgressWatch) ||
         !Array.isArray(value.progressWatchEvents) ||
+        value.progressWatchEvents.length > gatewayPublicSnapshotLimits.messages ||
         !value.progressWatchEvents.every(isProgressWatchJournalEvent) ||
         !Array.isArray(value.compatibilityAttestations) ||
         value.compatibilityAttestations.length >
             COMPATIBILITY_ATTESTATION_CAPACITY ||
-        !value.compatibilityAttestations.every(isCompatibilityAttestation) ||
+        !value.compatibilityAttestations.every(isPersistedCompatibilityAttestation) ||
         !Array.isArray(value.codexEndpointRefreshEvents) ||
         value.codexEndpointRefreshEvents.length >
             CODEX_ENDPOINT_REFRESH_JOURNAL_CAPACITY ||
@@ -959,6 +1129,7 @@ function isPersistedState(value) {
         !Array.isArray(value.inFlight) ||
         !value.inFlight.every(isInFlightMetadata) ||
         !Array.isArray(value.events) ||
+        value.events.length > gatewayPublicSnapshotLimits.messages ||
         !value.events.every(isEvent) ||
         !Array.isArray(value.dedupe) ||
         !value.dedupe.every(isDedupeRecord) ||
@@ -1333,6 +1504,15 @@ function renamePairAlias(state, previousAlias, newAlias, now) {
         }
     }
 }
+function renameProgressWatchAlias(state, previousAlias, newAlias) {
+    if (previousAlias === newAlias)
+        return;
+    state.progressWatches = state.progressWatches.map((watch) => watch.ownerAlias === previousAlias
+        ? { ...watch, ownerAlias: newAlias }
+        : watch.workerAlias === previousAlias
+            ? { ...watch, workerAlias: newAlias }
+            : watch);
+}
 function removePairsForAliases(state, aliases) {
     state.pairs = state.pairs.filter((pair) => !aliases.has(pair.claudeAlias) && !aliases.has(pair.codexAlias));
 }
@@ -1396,8 +1576,8 @@ export class GatewayStore {
             }
             await this.acquireLock();
             try {
-                const loaded = await this.loadStateFile();
                 const now = this.now();
+                const loaded = await this.loadStateFile(now);
                 this.state = loaded ?? {
                     schemaVersion: 1,
                     createdAt: now.toISOString(),
@@ -1627,22 +1807,21 @@ export class GatewayStore {
             // Replacing an endpoint is scoped to the replacement alias. Other
             // selected Claude routes and their independent consent edges survive.
             const retired = selectedClaudeRoutes.filter((route) => route !== retained && route === aliasOwner);
+            if (state.routes.some((route) => route !== retained &&
+                !retired.includes(route) &&
+                (sameRouteTarget(route.binding, replacement.binding) ||
+                    route.binding.ownerLease === replacement.binding.ownerLease))) {
+                throw new BridgeError("ROUTE_BINDING_COLLISION", "The replacement Claude authority collides with a non-retired route.");
+            }
             const retiredAliases = new Set(retired.map((route) => route.alias));
-            this.requireProgressWatchJournalCapacity(state, state.progressWatches.filter((watch) => retiredAliases.has(watch.ownerAlias) ||
-                retiredAliases.has(watch.workerAlias)).length);
             const settlementPlan = this.validateAffectedInFlightSettlements(state, retiredAliases, input.inFlightSettlements ?? []);
-            const settlements = this.terminateAffectedMessages(state, retiredAliases, now, "ROUTE_UNREGISTERED", settlementPlan);
             this.settleProgressWatchesForAliases(state, retiredAliases, now);
+            const settlements = this.terminateAffectedMessages(state, retiredAliases, now, "ROUTE_UNREGISTERED", settlementPlan);
             state.routes = state.routes.filter((route) => !retired.includes(route));
             removePairsForAliases(state, retiredAliases);
             state.rateBuckets = state.rateBuckets.filter((bucket) => !retiredAliases.has(bucket.sourceAlias));
             state.dedupe = state.dedupe.filter((record) => !retiredAliases.has(record.sourceAlias) &&
                 !retiredAliases.has(record.targetAlias));
-            if (state.routes.some((route) => route !== retained &&
-                (sameRouteTarget(route.binding, replacement.binding) ||
-                    route.binding.ownerLease === replacement.binding.ownerLease))) {
-                throw new BridgeError("ROUTE_BINDING_COLLISION", "The replacement Claude authority collides with a non-retired route.");
-            }
             if (retained !== undefined) {
                 const previousAlias = retained.alias;
                 retained.alias = replacement.alias;
@@ -1672,6 +1851,7 @@ export class GatewayStore {
                     }
                     renameRateBucket(state, previousAlias, replacement.alias);
                     renamePairAlias(state, previousAlias, replacement.alias, now);
+                    renameProgressWatchAlias(state, previousAlias, replacement.alias);
                 }
             }
             else {
@@ -2006,7 +2186,6 @@ export class GatewayStore {
         return await this.mutate(async (state, now) => {
             const route = this.requireOwnedRoute(state, alias, ownerLease);
             const aliases = new Set([route.alias]);
-            this.requireProgressWatchJournalCapacity(state, state.progressWatches.filter((watch) => aliases.has(watch.ownerAlias) || aliases.has(watch.workerAlias)).length);
             const settlementPlan = this.validateAffectedInFlightSettlements(state, aliases, inFlightSettlements);
             route.enabled = false;
             route.state = "disabled";
@@ -2014,13 +2193,13 @@ export class GatewayStore {
             return this.terminateAffectedMessages(state, aliases, now, "ROUTE_DISABLED", settlementPlan);
         });
     }
-    async unregisterRoute(alias, ownerLease, inFlightSettlements = []) {
+    async unregisterRoute(alias, ownerLease, inFlightSettlements = [], progressWatchSettlementActor = "gateway") {
         return await this.mutate(async (state, now) => {
             const route = this.requireOwnedRoute(state, alias, ownerLease);
             const aliases = new Set([route.alias]);
             const settlementPlan = this.validateAffectedInFlightSettlements(state, aliases, inFlightSettlements);
+            this.settleProgressWatchesForAliases(state, aliases, now, progressWatchSettlementActor);
             const settlements = this.terminateAffectedMessages(state, aliases, now, "ROUTE_UNREGISTERED", settlementPlan);
-            this.settleProgressWatchesForAliases(state, aliases, now);
             state.routes = state.routes.filter((candidate) => candidate !== route);
             removePairsForAliases(state, aliases);
             const remainingCodexHosts = new Set(state.routes
@@ -2068,25 +2247,7 @@ export class GatewayStore {
             }
             renameRateBucket(state, alias, newAlias);
             renamePairAlias(state, alias, newAlias, now);
-            for (let index = 0; index < state.progressWatches.length; index += 1) {
-                const watch = state.progressWatches[index];
-                if (watch === undefined)
-                    continue;
-                if (watch.ownerAlias === alias) {
-                    state.progressWatches[index] = {
-                        ...watch,
-                        ownerAlias: newAlias,
-                        updatedAt: now.toISOString(),
-                    };
-                }
-                else if (watch.workerAlias === alias) {
-                    state.progressWatches[index] = {
-                        ...watch,
-                        workerAlias: newAlias,
-                        updatedAt: now.toISOString(),
-                    };
-                }
-            }
+            renameProgressWatchAlias(state, alias, newAlias);
         });
     }
     async resolveRoute(alias) {
@@ -2462,32 +2623,42 @@ export class GatewayStore {
                 .sort((left, right) => pairKey(left.claudeAlias, left.codexAlias).localeCompare(pairKey(right.claudeAlias, right.codexAlias)));
         });
     }
-    async inspectProgressWatches() {
-        return this.mutex.run("gateway", async () => this.requireState().progressWatches.map((watch) => ({ ...watch })));
-    }
-    /** Bind one restarted route-capability watch to its first exact owner send. */
-    async bindProgressWatchConversation(input) {
-        return this.mutate(async (state, now) => {
-            if (!CONVERSATION_ID_PATTERN.test(input.conversationId) ||
-                !ALIAS_PATTERN.test(input.ownerAlias) ||
-                !ALIAS_PATTERN.test(input.workerAlias) ||
-                input.ownerAlias === input.workerAlias) {
-                throw new BridgeError("INVALID_PROGRESS_WATCH", "The progress-watch conversation binding is malformed.");
-            }
-            const routeWatch = state.progressWatches.find((watch) => watch.capability === "route" &&
-                watch.ownerAlias === input.ownerAlias &&
-                watch.workerAlias === input.workerAlias);
-            if (routeWatch === undefined)
-                return false;
-            const pair = state.pairs.find((candidate) => pairMatchesMessage(candidate, {
-                sourceAlias: input.ownerAlias,
-                targetAlias: input.workerAlias,
-                pair: true,
-            }) && progressWatchMatchesPair(routeWatch, candidate));
-            if (pair === undefined) {
-                throw new BridgeError("PROGRESS_WATCH_EDGE_REQUIRED", "A restarted watch can bind only through its exact durable pair.");
+    /** Resolve only an exact live watch; recovery may substitute its suffix. */
+    async resolveProgressWatchDispatch(input) {
+        return this.mutex.run("gateway", async () => {
+            if (!ALIAS_PATTERN.test(input.sourceAlias) ||
+                !ALIAS_PATTERN.test(input.targetAlias) ||
+                input.sourceAlias === input.targetAlias ||
+                (input.conversationId === undefined) ===
+                    (input.recoveredConversationIdSuffix === undefined) ||
+                (input.conversationId !== undefined &&
+                    !CONVERSATION_ID_PATTERN.test(input.conversationId)) ||
+                (input.recoveredConversationIdSuffix !== undefined &&
+                    !CONVERSATION_SUFFIX_PATTERN.test(input.recoveredConversationIdSuffix))) {
+                throw new BridgeError("INVALID_PROGRESS_WATCH", "The progress-watch dispatch lookup is malformed.");
             }
-            return this.bindRouteProgressWatchConversation(state, now, input.conversationId, input.ownerAlias, input.workerAlias, pair);
+            const state = this.requireState();
+            const watch = state.progressWatches.find((watch) => (input.conversationId !== undefined
+                ? watch.conversationId === input.conversationId
+                : watch.conversationId.endsWith(input.recoveredConversationIdSuffix)) &&
+                ((watch.ownerAlias === input.sourceAlias &&
+                    watch.workerAlias === input.targetAlias) ||
+                    (watch.ownerAlias === input.targetAlias &&
+                        watch.workerAlias === input.sourceAlias)));
+            if (watch === undefined)
+                return { markerActive: false };
+            const hasExactPair = state.pairs.some((candidate) => pairMatchesMessage(candidate, {
+                sourceAlias: input.sourceAlias,
+                targetAlias: input.targetAlias,
+                pair: true,
+            }) && progressWatchMatchesPair(watch, candidate));
+            if (!hasExactPair)
+                return { markerActive: false };
+            return {
+                conversationId: watch.conversationId,
+                markerActive: watch.ownerAlias === input.sourceAlias &&
+                    watch.workerAlias === input.targetAlias,
+            };
         });
     }
     async inspectCompatibilityAttestation(surface, version) {
@@ -2533,97 +2704,67 @@ export class GatewayStore {
                     (watch.ownerAlias !== alias && watch.workerAlias !== alias)) {
                     continue;
                 }
-                const transition = transitionProgressWatch(watch, {
-                    type: "route_activity",
-                    at: now.getTime(),
-                });
-                if (transition.state !== null) {
-                    state.progressWatches[index] = transition.state;
-                    changed += 1;
-                }
+                state.progressWatches[index] = recordProgressWatchActivity(watch, now.getTime());
+                changed += 1;
             }
             return changed;
         });
     }
-    async settleProgressWatch(input) {
+    async endProgressWatch(conversationId) {
         return this.mutate(async (state, now) => {
-            const index = state.progressWatches.findIndex((watch) => watch.conversationId === input.conversationId);
+            if (!CONVERSATION_ID_PATTERN.test(conversationId)) {
+                throw new BridgeError("INVALID_PROGRESS_WATCH", "The progress-watch conversation token is malformed.");
+            }
+            const index = state.progressWatches.findIndex((watch) => watch.conversationId === conversationId);
             const watch = state.progressWatches[index];
             if (watch === undefined)
                 return false;
-            if (input.ownerAlias !== undefined &&
-                input.ownerAlias !== watch.ownerAlias) {
-                throw new BridgeError("PROGRESS_WATCH_OWNER_REQUIRED", "Only the exact watch owner may end this watch.");
-            }
-            const event = input.outcome === "done"
-                ? { type: "owner_done", at: now.getTime() }
-                : input.outcome === "endpoint_retired"
-                    ? { type: "endpoint_retired", at: now.getTime() }
-                    : input.outcome === "disabled"
-                        ? { type: "disabled", at: now.getTime() }
-                        : undefined;
-            if (event === undefined) {
-                throw new BridgeError("INVALID_PROGRESS_WATCH_SETTLEMENT", "Unresponsive settlement is owned only by the watch deadline machine.");
-            }
-            const transition = transitionProgressWatch(watch, event);
-            this.requireProgressWatchJournalCapacity(state, 1);
+            this.appendProgressWatchEvents(state, [
+                progressWatchJournalEvent(watch, now.toISOString(), {
+                    kind: "settled",
+                    actor: "operator",
+                    reason: "untracked",
+                }),
+            ]);
             state.progressWatches.splice(index, 1);
-            this.appendProgressWatchEvent(state, watch, {
-                kind: input.outcome,
-                timestamp: now.toISOString(),
-            });
-            return transition.state === null;
+            return true;
         });
     }
     /** Advance every due watch once under one durable store mutation. */
     async advanceDueProgressWatches() {
         return this.mutate(async (state, now) => {
-            const terminalCount = state.progressWatches.filter((watch) => {
-                if (Date.parse(watch.nextActionAt) > now.getTime())
-                    return false;
-                return this.progressWatchDueTransition(state, watch, now).effects.some((effect) => effect.type === "settled");
-            }).length;
-            this.requireProgressWatchJournalCapacity(state, terminalCount);
             const actions = [];
             const retained = [];
+            const events = [];
             for (const watch of state.progressWatches) {
                 if (Date.parse(watch.nextActionAt) > now.getTime()) {
                     retained.push(watch);
                     continue;
                 }
-                const transition = this.progressWatchDueTransition(state, watch, now);
-                const nudge = transition.effects.find((effect) => effect.type === "send_nudge");
-                // A nudge is only reserved here. Its state transition and journal row
-                // commit atomically with the ordinary queued body.
-                if (nudge !== undefined)
+                const due = this.inspectProgressWatchDue(state, watch, now);
+                if (due.kind === "not_due" || due.kind === "nudge") {
                     retained.push(watch);
-                else if (transition.state !== null)
-                    retained.push(transition.state);
-                for (const effect of transition.effects) {
-                    if (effect.type === "send_nudge") {
-                        actions.push({
-                            type: "send_nudge",
-                            conversationId: watch.conversationId,
-                            ownerAlias: watch.ownerAlias,
-                            workerAlias: watch.workerAlias,
-                            nudgeNumber: effect.nudgeNumber,
-                        });
-                    }
-                    else if (effect.type === "settled") {
-                        this.appendProgressWatchEvent(state, watch, {
-                            kind: effect.outcome,
-                            timestamp: now.toISOString(),
-                        });
-                        actions.push({
-                            type: "settled",
-                            conversationId: watch.conversationId,
-                            ownerAlias: watch.ownerAlias,
-                            workerAlias: watch.workerAlias,
-                            outcome: effect.outcome,
-                        });
-                    }
+                }
+                else if (due.kind === "rescheduled") {
+                    retained.push(due.watch);
+                }
+                if (due.kind === "nudge") {
+                    actions.push({
+                        conversationId: watch.conversationId,
+                        ownerAlias: watch.ownerAlias,
+                        workerAlias: watch.workerAlias,
+                        nudgeNumber: due.nudgeNumber,
+                    });
+                }
+                else if (due.kind === "settled") {
+                    events.push(progressWatchJournalEvent(watch, now.toISOString(), {
+                        kind: "settled",
+                        actor: "gateway",
+                        reason: "idle_timeout",
+                    }));
                 }
             }
+            this.appendProgressWatchEvents(state, events);
             state.progressWatches = retained;
             return actions;
         });
@@ -2633,21 +2774,17 @@ export class GatewayStore {
             ? watch.nextActionAt
             : earliest, undefined));
     }
-    async deferProgressWatchNudge(conversationId, retryDelayMs = 1_000) {
+    async deferProgressWatchNudge(conversationId, nudgeNumber) {
         return this.mutate(async (state, now) => {
             const index = state.progressWatches.findIndex((watch) => watch.conversationId === conversationId);
             const watch = state.progressWatches[index];
             if (watch === undefined)
                 return false;
-            const boundedDelay = Math.max(1, Math.min(retryDelayMs, watch.idleMs, 60_000));
-            const transition = transitionProgressWatch(watch, {
-                type: "nudge_deferred",
-                at: now.getTime(),
-                retryAt: now.getTime() + boundedDelay,
-            });
-            if (transition.state === null)
+            const due = this.inspectProgressWatchDue(state, watch, now);
+            if (due.kind !== "nudge" || due.nudgeNumber !== nudgeNumber) {
                 return false;
-            state.progressWatches[index] = transition.state;
+            }
+            state.progressWatches[index] = deferProgressWatchNudge(watch, now.getTime());
             return true;
         });
     }
@@ -2686,10 +2823,9 @@ export class GatewayStore {
         return this.mutate(async (state, now) => {
             const { claude, codex } = this.requirePairRoutes(state, input, false);
             const pair = this.requireExactPair(state, claude, codex);
-            this.requireProgressWatchJournalCapacity(state, state.progressWatches.filter((watch) => progressWatchMatchesPair(watch, pair)).length);
             const plan = this.validateAffectedPairInFlightSettlements(state, pair, input.inFlightSettlements ?? []);
-            const settlements = this.terminateAffectedPairMessages(state, pair, now, "PAIR_REMOVED", plan);
             this.settleProgressWatchesForPair(state, pair, now);
+            const settlements = this.terminateAffectedPairMessages(state, pair, now, "PAIR_REMOVED", plan);
             state.pairs = state.pairs.filter((candidate) => candidate !== pair);
             state.dedupe = state.dedupe.filter((record) => !pairMatchesMessage(pair, record));
             return {
@@ -2848,6 +2984,10 @@ export class GatewayStore {
             const metadata = state.queue[index];
             if (!metadata)
                 return undefined;
+            const queuedAhead = state.queue
+                .slice(0, index)
+                .filter((candidate) => candidate.targetAlias === metadata.targetAlias)
+                .length;
             state.queue.splice(index, 1);
             state.accounting.queuedBytes -= metadata.bytes;
             const target = state.routes.find((route) => route.alias === metadata.targetAlias);
@@ -2875,7 +3015,11 @@ export class GatewayStore {
                 ...(metadata.steer === true ? { steer: true } : {}),
                 latencyMs: Math.max(0, now.getTime() - Date.parse(metadata.enqueuedAt)),
             });
-            return { ...metadata, body };
+            return {
+                ...metadata,
+                body,
+                ...(queuedAhead === 0 ? {} : { queuedAhead }),
+            };
         });
     }
     /** Controller-private shutdown inventory; full IDs never cross control output. */
@@ -3142,26 +3286,20 @@ export class GatewayStore {
                 conversationIdSuffix: watch.conversationId.slice(-8),
                 ownerAlias: watch.ownerAlias,
                 workerAlias: watch.workerAlias,
-                phase: watch.phase,
-                capability: watch.capability,
                 lastActivityAt: watch.lastActivityAt,
                 nextActionAt: watch.nextActionAt,
-                idleMs: watch.idleMs,
                 nudgeCount: watch.nudgeCount,
             }))
                 .sort((left, right) => `${left.nextActionAt}\0${left.ownerAlias}\0${left.workerAlias}`.localeCompare(`${right.nextActionAt}\0${right.ownerAlias}\0${right.workerAlias}`));
-            const progressWatchEvents = state.progressWatchEvents
-                .filter((event) => event.kind !== "activity")
-                .map((event) => ({
+            const progressWatchEvents = state.progressWatchEvents.map((event) => ({
                 sequence: event.sequence,
                 timestamp: event.timestamp,
                 conversationIdSuffix: event.conversationId.slice(-8),
                 ownerAlias: event.ownerAlias,
                 workerAlias: event.workerAlias,
                 kind: event.kind,
-                ...(event.nudgeNumber === undefined
-                    ? {}
-                    : { nudgeNumber: event.nudgeNumber }),
+                actor: event.actor,
+                ...(event.kind === "settled" ? { reason: event.reason } : {}),
             }));
             const pressureBuckets = [
                 { bucket: "under_1m", settled: 0, expired: 0 },
@@ -3382,8 +3520,7 @@ export class GatewayStore {
     replaceCodexRouteForSuccession(state, route, identity, now, routeState, compatibility) {
         const oldAlias = route.alias;
         const affectedAliases = new Set([oldAlias, identity.alias]);
-        this.requireProgressWatchJournalCapacity(state, state.progressWatches.filter((watch) => affectedAliases.has(watch.ownerAlias) ||
-            affectedAliases.has(watch.workerAlias)).length);
+        this.settleProgressWatchesForAliases(state, affectedAliases, now);
         route.alias = identity.alias;
         route.binding = { ...identity.binding };
         route.registrationMode = "explicit_opt_in";
@@ -3408,7 +3545,6 @@ export class GatewayStore {
             record.targetAlias !== identity.alias);
         state.rateBuckets = state.rateBuckets.filter((bucket) => bucket.sourceAlias !== oldAlias &&
             bucket.sourceAlias !== identity.alias);
-        this.settleProgressWatchesForAliases(state, affectedAliases, now);
         removePairsForAliases(state, affectedAliases);
     }
     assertAllowedIdentity(identity) {
@@ -3663,19 +3799,6 @@ export class GatewayStore {
             input.progressWatchNudge !== undefined) {
             throw new BridgeError("INVALID_PROGRESS_WATCH", "A queued message cannot be both endpoint activity and a controller nudge.");
         }
-        this.applyProgressWatchMessageActivity(state, now, input.progressWatch, sides);
-        this.commitProgressWatchNudge(state, now, input.progressWatchNudge, sides);
-        let supersededSettlement;
-        if (superseded !== undefined) {
-            state.queue.splice(oldestSteerIndex, 1);
-            this.transientBodies.delete(superseded.messageId);
-            state.accounting.queuedBytes -= superseded.bytes;
-            const oldestTarget = state.routes.find((route) => route.alias === superseded.targetAlias);
-            if (oldestTarget) {
-                oldestTarget.queueDepth = Math.max(0, oldestTarget.queueDepth - 1);
-            }
-            supersededSettlement = this.finishMetadata(state, superseded, "cancelled", now, "STEER_QUEUE_SUPERSEDED");
-        }
         const opaque = this.randomId();
         const messageId = `msg_${opaque}`;
         if (!MESSAGE_ID_PATTERN.test(messageId)) {
@@ -3701,6 +3824,19 @@ export class GatewayStore {
                 : {}),
             ...(input.steer === true ? { steer: true } : {}),
         };
+        this.applyProgressWatchMessageActivity(state, now, input.progressWatch, sides);
+        this.commitProgressWatchNudge(state, now, input.progressWatchNudge, sides);
+        let supersededSettlement;
+        if (superseded !== undefined) {
+            state.queue.splice(oldestSteerIndex, 1);
+            this.transientBodies.delete(superseded.messageId);
+            state.accounting.queuedBytes -= superseded.bytes;
+            const oldestTarget = state.routes.find((route) => route.alias === superseded.targetAlias);
+            if (oldestTarget) {
+                oldestTarget.queueDepth = Math.max(0, oldestTarget.queueDepth - 1);
+            }
+            supersededSettlement = this.finishMetadata(state, superseded, "cancelled", now, "STEER_QUEUE_SUPERSEDED");
+        }
         state.queue.push(metadata);
         this.transientBodies.set(messageId, input.body);
         state.accounting.accepted += 1;
@@ -3901,22 +4037,7 @@ export class GatewayStore {
         const pair = sides.pair === true
             ? state.pairs.find((candidate) => pairMatchesMessage(candidate, sides))
             : undefined;
-        let index = state.progressWatches.findIndex((watch) => watch.conversationId === activity.conversationId);
-        if (index < 0 &&
-            activity.openIdleMs === undefined &&
-            activity.completionSignal !== true &&
-            pair !== undefined) {
-            const routeMatches = state.progressWatches
-                .map((watch, watchIndex) => ({ watch, watchIndex }))
-                .filter(({ watch }) => watch.capability === "route" &&
-                watch.ownerAlias === sides.sourceAlias &&
-                watch.workerAlias === sides.targetAlias &&
-                progressWatchMatchesPair(watch, pair));
-            if (routeMatches.length === 1) {
-                this.bindRouteProgressWatchConversation(state, now, activity.conversationId, sides.sourceAlias, sides.targetAlias, pair);
-                index = routeMatches[0].watchIndex;
-            }
-        }
+        const index = state.progressWatches.findIndex((watch) => watch.conversationId === activity.conversationId);
         const existing = state.progressWatches[index];
         if (existing !== undefined) {
             if (pair === undefined ||
@@ -3929,32 +4050,22 @@ export class GatewayStore {
             }
             if (activity.openIdleMs !== undefined &&
                 activity.actorAlias !== existing.ownerAlias) {
-                throw new BridgeError("PROGRESS_WATCH_OWNER_REQUIRED", "Only the exact watch owner may reassert tracking options.");
+                throw new BridgeError("PROGRESS_WATCH_OWNER_REQUIRED", "Tracking options persist from the original TRACK; a repeated TRACK from the exact owner refreshes activity without changing them.");
             }
             if (activity.completionSignal === true) {
-                const transition = transitionProgressWatch(existing, activity.actorAlias === existing.ownerAlias
-                    ? { type: "owner_done", at: now.getTime() }
-                    : { type: "worker_done", at: now.getTime() });
-                if (transition.state !== null) {
-                    throw new BridgeError("INVALID_PROGRESS_WATCH_SETTLEMENT", "The completion signal did not settle its exact watch.");
-                }
-                this.requireProgressWatchJournalCapacity(state, 1);
+                this.appendProgressWatchEvents(state, [
+                    progressWatchJournalEvent(existing, now.toISOString(), {
+                        kind: "settled",
+                        actor: activity.actorAlias === existing.ownerAlias
+                            ? "owner"
+                            : "worker",
+                        reason: "done",
+                    }),
+                ]);
                 state.progressWatches.splice(index, 1);
-                this.appendProgressWatchEvent(state, existing, {
-                    kind: activity.actorAlias === existing.ownerAlias
-                        ? "done"
-                        : "worker_reported_complete",
-                    timestamp: now.toISOString(),
-                });
                 return;
             }
-            const transition = transitionProgressWatch(existing, {
-                type: "activity",
-                at: now.getTime(),
-            });
-            if (transition.state !== null) {
-                state.progressWatches[index] = transition.state;
-            }
+            state.progressWatches[index] = recordProgressWatchActivity(existing, now.getTime());
             return;
         }
         if (activity.openIdleMs === undefined)
@@ -3965,49 +4076,29 @@ export class GatewayStore {
         if (pair === undefined) {
             throw new BridgeError("PROGRESS_WATCH_EDGE_REQUIRED", "Progress tracking requires one exact paired consent edge.");
         }
-        const owner = state.routes.find((route) => route.alias === sides.sourceAlias);
-        const worker = state.routes.find((route) => route.alias === sides.targetAlias);
-        if (owner === undefined || worker === undefined) {
-            throw new BridgeError("PROGRESS_WATCH_EDGE_REQUIRED", "Progress tracking requires both exact paired routes to be registered.");
-        }
-        const watch = createProgressWatchMachine({
+        const watch = createProgressWatch({
             conversationId: activity.conversationId,
-            ownerAlias: owner.alias,
-            workerAlias: worker.alias,
-            ownerLease: owner.binding.ownerLease,
-            workerLease: worker.binding.ownerLease,
+            ownerAlias: sides.sourceAlias,
+            workerAlias: sides.targetAlias,
+            ownerLease: sides.sourceAlias === pair.claudeAlias
+                ? pair.claudeOwnerLease
+                : pair.codexOwnerLease,
+            workerLease: sides.targetAlias === pair.claudeAlias
+                ? pair.claudeOwnerLease
+                : pair.codexOwnerLease,
             idleMs: activity.openIdleMs,
             at: now.getTime(),
         });
-        if (!progressWatchMatchesPair(watch, pair)) {
-            throw new BridgeError("PROGRESS_WATCH_EDGE_MISMATCH", "The watch endpoints do not form one exact consent edge.");
-        }
         this.installProgressWatch(state, watch, pair, now);
     }
-    progressWatchDueTransition(state, watch, now) {
+    inspectProgressWatchDue(state, watch, now) {
         const owner = state.routes.find((route) => route.alias === watch.ownerAlias &&
             route.binding.ownerLease === watch.ownerLease);
         const worker = state.routes.find((route) => route.alias === watch.workerAlias &&
             route.binding.ownerLease === watch.workerLease);
-        const pairPresent = owner !== undefined &&
-            worker !== undefined &&
-            state.pairs.some((pair) => ((pair.claudeAlias === owner.alias &&
-                pair.codexAlias === worker.alias) ||
-                (pair.claudeAlias === worker.alias &&
-                    pair.codexAlias === owner.alias)) &&
-                pair.claudeOwnerLease ===
-                    (owner.binding.provider === "claude"
-                        ? owner.binding.ownerLease
-                        : worker.binding.ownerLease) &&
-                pair.codexOwnerLease ===
-                    (owner.binding.provider === "codex"
-                        ? owner.binding.ownerLease
-                        : worker.binding.ownerLease));
-        return transitionProgressWatch(watch, {
-            type: "due",
+        return inspectProgressWatchDue(watch, {
             at: now.getTime(),
             bothIdle: owner?.state === "idle" && worker?.state === "idle",
-            endpointsPresent: pairPresent,
         });
     }
     commitProgressWatchNudge(state, now, nudge, sides) {
@@ -4020,17 +4111,12 @@ export class GatewayStore {
             sides.targetAlias !== watch.workerAlias) {
             throw new BridgeError("PROGRESS_WATCH_OWNERSHIP_MISMATCH", "The controller nudge no longer matches its exact watch edge.");
         }
-        const transition = this.progressWatchDueTransition(state, watch, now);
-        if (transition.state === null ||
-            !transition.effects.some((effect) => effect.type === "send_nudge" &&
-                effect.nudgeNumber === nudge.nudgeNumber)) {
+        const due = this.inspectProgressWatchDue(state, watch, now);
+        if (due.kind !== "nudge" || due.nudgeNumber !== nudge.nudgeNumber) {
             throw new BridgeError("PROGRESS_WATCH_NUDGE_NOT_DUE", "The requested progress-watch nudge is not currently due.", true);
         }
-        this.requireProgressWatchJournalCapacity(state, 1);
-        state.progressWatches[index] = transition.state;
-        this.appendProgressWatchEvent(state, transition.state, {
-            kind: "nudge",
-            timestamp: now.toISOString(),
+        state.progressWatches[index] = commitProgressWatchNudge(watch, {
+            at: now.getTime(),
             nudgeNumber: nudge.nudgeNumber,
         });
     }
@@ -4045,118 +4131,75 @@ export class GatewayStore {
             state.progressWatches[replacedIndex].ownerAlias !== watch.ownerAlias) {
             throw new BridgeError("PROGRESS_WATCH_REPLACEMENT_OWNER_REQUIRED", "Only the incumbent watch owner may replace this pair watch; ask that owner to untrack it first.");
         }
-        this.requireProgressWatchJournalCapacity(state, replacedIndex < 0 ? 1 : 2);
         if (replacedIndex >= 0) {
             const replaced = state.progressWatches[replacedIndex];
-            state.progressWatches.splice(replacedIndex, 1);
-            this.appendProgressWatchEvent(state, replaced, {
-                kind: "replaced",
-                timestamp: now.toISOString(),
-            });
+            this.appendProgressWatchEvents(state, [
+                progressWatchJournalEvent(replaced, now.toISOString(), {
+                    kind: "replaced",
+                    actor: "owner",
+                }),
+            ]);
+            state.progressWatches[replacedIndex] = watch;
+            return;
         }
+        this.appendProgressWatchEvents(state, [
+            progressWatchJournalEvent(watch, now.toISOString(), {
+                kind: "opened",
+                actor: "owner",
+            }),
+        ]);
         state.progressWatches.push(watch);
-        this.appendProgressWatchEvent(state, watch, {
-            kind: "opened",
-            timestamp: now.toISOString(),
-        });
     }
-    requireProgressWatchJournalCapacity(state, additions) {
-        if (!Number.isSafeInteger(additions) ||
-            additions < 0 ||
-            state.watchSequence > Number.MAX_SAFE_INTEGER - additions) {
+    appendProgressWatchEvents(state, events) {
+        if (state.watchSequence > Number.MAX_SAFE_INTEGER - events.length) {
             throw new BridgeError("PROGRESS_WATCH_SEQUENCE_EXHAUSTED", "The bounded progress-watch journal sequence is exhausted.");
         }
-    }
-    appendProgressWatchEvent(state, watch, event) {
-        this.requireProgressWatchJournalCapacity(state, 1);
-        state.watchSequence += 1;
-        state.progressWatchEvents.push({
-            sequence: state.watchSequence,
-            timestamp: event.timestamp,
-            conversationId: watch.conversationId,
-            ownerAlias: watch.ownerAlias,
-            workerAlias: watch.workerAlias,
-            kind: event.kind,
-            ...(event.nudgeNumber === undefined
-                ? {}
-                : { nudgeNumber: event.nudgeNumber }),
-        });
+        for (const event of events) {
+            state.watchSequence += 1;
+            state.progressWatchEvents.push({
+                sequence: state.watchSequence,
+                ...event,
+            });
+        }
         while (state.progressWatchEvents.length > this.config.limits.eventCapacity) {
             state.progressWatchEvents.shift();
         }
     }
-    settleProgressWatchesForAliases(state, aliases, now) {
-        this.requireProgressWatchJournalCapacity(state, state.progressWatches.filter((watch) => aliases.has(watch.ownerAlias) || aliases.has(watch.workerAlias)).length);
+    settleProgressWatchesForAliases(state, aliases, now, actor = "gateway") {
         const retained = [];
+        const events = [];
         for (const watch of state.progressWatches) {
             if (!aliases.has(watch.ownerAlias) &&
                 !aliases.has(watch.workerAlias)) {
                 retained.push(watch);
                 continue;
             }
-            this.appendProgressWatchEvent(state, watch, {
-                kind: "endpoint_retired",
-                timestamp: now.toISOString(),
-            });
+            events.push(progressWatchJournalEvent(watch, now.toISOString(), {
+                kind: "settled",
+                actor,
+                reason: "endpoint_retired",
+            }));
         }
+        this.appendProgressWatchEvents(state, events);
         state.progressWatches = retained;
     }
     settleProgressWatchesForPair(state, pair, now) {
-        this.requireProgressWatchJournalCapacity(state, state.progressWatches.filter((watch) => progressWatchMatchesPair(watch, pair)).length);
         const retained = [];
+        const events = [];
         for (const watch of state.progressWatches) {
             if (!progressWatchMatchesPair(watch, pair)) {
                 retained.push(watch);
                 continue;
             }
-            this.appendProgressWatchEvent(state, watch, {
-                kind: "pair_removed",
-                timestamp: now.toISOString(),
-            });
+            events.push(progressWatchJournalEvent(watch, now.toISOString(), {
+                kind: "settled",
+                actor: "operator",
+                reason: "pair_removed",
+            }));
         }
+        this.appendProgressWatchEvents(state, events);
         state.progressWatches = retained;
     }
-    bindRouteProgressWatchConversation(state, now, conversationId, ownerAlias, workerAlias, pair) {
-        const conversationOwner = state.progressWatches.find((watch) => watch.conversationId === conversationId);
-        if (conversationOwner !== undefined &&
-            (conversationOwner.capability !== "route" ||
-                conversationOwner.ownerAlias !== ownerAlias ||
-                conversationOwner.workerAlias !== workerAlias ||
-                !progressWatchMatchesPair(conversationOwner, pair))) {
-            throw new BridgeError("PROGRESS_WATCH_OWNERSHIP_MISMATCH", "The fresh conversation capability belongs to another exact watch.");
-        }
-        const matches = state.progressWatches
-            .map((watch, index) => ({ watch, index }))
-            .filter(({ watch }) => watch.capability === "route" &&
-            watch.ownerAlias === ownerAlias &&
-            watch.workerAlias === workerAlias &&
-            progressWatchMatchesPair(watch, pair));
-        if (matches.length === 0)
-            return false;
-        if (matches.length !== 1) {
-            throw new BridgeError("CORRUPT_GATEWAY_STATE", "More than one route-capability watch claims the exact pair.");
-        }
-        const match = matches[0];
-        this.requireProgressWatchJournalCapacity(state, 1);
-        const restored = transitionProgressWatch(match.watch, {
-            type: "restart",
-            at: now.getTime(),
-            conversationCapabilityRestored: true,
-        });
-        if (restored.state === null) {
-            throw new BridgeError("INVALID_PROGRESS_WATCH_REBIND", "The exact progress watch could not restore conversation authority.");
-        }
-        const rebound = {
-            ...restored.state,
-            conversationId,
-        };
-        state.progressWatches[match.index] = rebound;
-        this.appendProgressWatchEvent(state, rebound, {
-            kind: "conversation_rebound",
-            timestamp: now.toISOString(),
-        });
-        return true;
-    }
     finishMetadata(state, metadata, deliveryState, now, safeErrorCode) {
         const counterKey = deliveryState;
         state.accounting[counterKey] += 1;
@@ -4306,11 +4349,9 @@ export class GatewayStore {
         const state = this.requireState();
         const eventCutoff = now.getTime() - this.config.limits.eventTtlMs;
         state.events = state.events
-            .filter((event) => Date.parse(event.timestamp) > eventCutoff)
-            .slice(-this.config.limits.eventCapacity);
+            .filter((event) => Date.parse(event.timestamp) > eventCutoff);
         state.progressWatchEvents = state.progressWatchEvents
-            .filter((event) => Date.parse(event.timestamp) > eventCutoff)
-            .slice(-this.config.limits.eventCapacity);
+            .filter((event) => Date.parse(event.timestamp) > eventCutoff);
         state.dedupe = state.dedupe
             .filter((record) => Date.parse(record.expiresAt) > now.getTime())
             .slice(-this.config.limits.dedupeCapacity);
@@ -4322,37 +4363,13 @@ export class GatewayStore {
         const state = this.requireState();
         this.recoverCodexSuccessionAfterRestart(state, now);
         if (this.config.trackingEnabled === false) {
-            this.requireProgressWatchJournalCapacity(state, state.progressWatches.length);
-            for (const watch of state.progressWatches) {
-                this.appendProgressWatchEvent(state, watch, {
-                    kind: "disabled",
-                    timestamp: now.toISOString(),
-                });
-            }
+            this.appendProgressWatchEvents(state, state.progressWatches.map((watch) => progressWatchJournalEvent(watch, now.toISOString(), {
+                kind: "settled",
+                actor: "gateway",
+                reason: "tracking_disabled",
+            })));
             state.progressWatches = [];
         }
-        else {
-            this.requireProgressWatchJournalCapacity(state, state.progressWatches.filter((watch) => !watch.degradedNoticeSent).length);
-        }
-        for (let index = 0; index < state.progressWatches.length; index += 1) {
-            const watch = state.progressWatches[index];
-            if (watch === undefined)
-                continue;
-            const transition = transitionProgressWatch(watch, {
-                type: "restart",
-                at: now.getTime(),
-                conversationCapabilityRestored: false,
-            });
-            if (transition.state !== null) {
-                state.progressWatches[index] = transition.state;
-            }
-            if (transition.effects.some((effect) => effect.type === "record_capability_degraded")) {
-                this.appendProgressWatchEvent(state, transition.state ?? watch, {
-                    kind: "capability_degraded",
-                    timestamp: now.toISOString(),
-                });
-            }
-        }
         for (const connector of state.connectors) {
             connector.health = "offline";
             connector.compatibility = "expired";
@@ -4417,9 +4434,6 @@ export class GatewayStore {
     aggregateHealth(connectors) {
         if (connectors.length === 0)
             return "offline";
-        if (connectors.some((connector) => connector.health === "incompatible")) {
-            return "incompatible";
-        }
         if (connectors.some((connector) => connector.health === "degraded")) {
             return "degraded";
         }
@@ -4636,7 +4650,7 @@ export class GatewayStore {
             // Never remove a lock that cannot be proven to belong to this instance.
         }
     }
-    async loadStateFile() {
+    async loadStateFile(now) {
         let body;
         try {
             body = await this.readPrivateFile(this.stateFilePath, GATEWAY_MAX_STATE_FILE_BYTES);
@@ -4663,7 +4677,7 @@ export class GatewayStore {
         parsed = migratePreCodexOrphanRemovalJournal(parsed);
         parsed = migrateLegacyHopCounts(parsed);
         parsed = migrateLegacyCompatibilityCertifications(parsed);
-        parsed = migrateLegacyProgressWatchState(parsed, this.config.limits.eventCapacity);
+        parsed = migrateV14ProgressWatchState(parsed, now.toISOString());
         if (!isPersistedState(parsed)) {
             throw new BridgeError("CORRUPT_GATEWAY_STATE", "The gateway controller state failed strict schema validation.");
         }
@@ -4674,8 +4688,6 @@ export class GatewayStore {
             parsed.rateBuckets.length > this.config.limits.maxRoutes ||
             parsed.progressWatches.length >
                 (this.config.limits.maxWatches ?? PROGRESS_WATCH_DEFAULT_CAPACITY) ||
-            parsed.progressWatchEvents.length > this.config.limits.eventCapacity ||
-            parsed.events.length > this.config.limits.eventCapacity ||
             parsed.dedupe.length > this.config.limits.dedupeCapacity ||
             parsed.queue.length > this.config.limits.maxQueueMessages ||
             parsed.inFlight.length > this.config.limits.maxInFlightMessages ||
@@ -4742,7 +4754,7 @@ export class GatewayStore {
                     throw error;
                 let installed;
                 try {
-                    installed = await this.loadStateFile();
+                    installed = await this.loadStateFile(this.now());
                 }
                 catch {
                     // Rename crossed the commit point. Keep the intended in-memory