agent-embassy 1.7.0 → 1.8.0

package/dist/src/gateway/providers.js

@@ -1,63 +1,46 @@
+import { createHash } from "node:crypto";
 import path from "node:path";
 import { BridgeError } from "../errors.js";
 import { CLAUDE_PEER_COMPATIBILITY, ClaudePeerAdapter, } from "./claude-peer.js";
-import { CodexAppServerConnector, CodexConnectorError, } from "./codex-app-server.js";
-import { LocalCodexTransportError } from "./codex-local-transport.js";
 import { ClaudeNativeHelperSupervisor, } from "./claude-helper-supervisor.js";
 import { isDashboardLocale } from "./locale.js";
 import { composeProvenanceEnvelope } from "./provenance-envelope.js";
-import { gatewayRegistrationIngressPrefixes } from "./types.js";
 const LOCAL_HOST = "this-mac";
-const STABLE_CLAUDE_ENDPOINT_GENERATION = "claude_local_endpoint";
 const NATIVE_CLAUDE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
 const PUBLIC_ALIAS = /^[a-z][a-z0-9_-]{0,31}@[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
 const OPAQUE_ROUTE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
 const MAX_CLAUDE_PENDING = 1_024;
 const DEFAULT_CLAUDE_DISCOVERY_POLL_MS = 1_000;
-const CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS = [25, 100, 250];
-const MAX_CODEX_ROUTES = 128;
-const MAX_CODEX_CALLBACKS = 512;
-const MAX_TRANSIENT_REPLY_BYTES = 64 * 1024;
-const DEFAULT_CODEX_CLEANUP_TIMEOUT_MS = 5_000;
-const DEFAULT_CODEX_CLEANUP_POLL_MS = 25;
-const DEFAULT_CODEX_RECOVERY_INITIAL_MS = 250;
-const DEFAULT_CODEX_RECOVERY_MAX_MS = 5_000;
-const MAX_CODEX_ENDPOINT_REFRESH_CANDIDATES = 3;
+const DEFAULT_CODEX_OBSERVATION_POLL_MS = 15_000;
+const DEFAULT_CODEX_OBSERVATION_TIMEOUT_MS = 15_000;
+const DEFAULT_CODEX_OBSERVATION_BACKOFF_MAX_MS = 60_000;
+const MAX_CODEX_OBSERVED_ROUTES = 128;
 const CLAUDE_CLEAN_PREWRITE_RETRY_CODES = new Set([
     "CLAUDE_PEER_TARGET_UNKNOWN",
     "CLAUDE_PEER_TARGET_STALE",
     "CLAUDE_PEER_TARGET_CHANGED",
     "CLAUDE_PEER_WORKSPACE_UNATTESTED",
 ]);
-const CODEX_TRUST_FAILURE_CODES = new Set([
-    "HOME_INVALID",
-    "MANAGED_CODEX_INVALID",
-    "LOCAL_APP_SERVER_ENDPOINT_UNSAFE",
-    "APP_SERVER_VERSION_MISMATCH",
+const CODEX_CLEAN_RETRY_CODES = new Set([
+    "THREAD_NOT_OBSERVED",
+    "ROUTE_BUSY",
+    "APPROVAL_REQUIRED",
+    "MANAGED_CODEX_UNAVAILABLE",
+    "LOCAL_APP_SERVER_NOT_RUNNING",
     "ENDPOINT_GENERATION_CHANGED",
-    "CLEANUP_FAILED",
-    "FACTORY_CLOSED",
-    "INVALID_CONFIGURATION",
-    "CODEX_ROUTE_CLEANUP_FAILED",
-    "CODEX_PROVIDER_CLEANUP_FAILED",
-    "CODEX_PROVIDER_CLEANUP_AMBIGUOUS",
-    "CODEX_PROVIDER_CLEANUP_TIMEOUT",
+    "SPAWN_FAILED",
+    "SPAWN_TIMEOUT",
+    "TRANSPORT_CONNECT_FAILED",
+    "REQUEST_TIMEOUT",
 ]);
-function isCodexTrustFailure(error) {
-    return (typeof error === "object" &&
-        error !== null &&
-        "code" in error &&
-        typeof error.code === "string" &&
-        CODEX_TRUST_FAILURE_CODES.has(error.code));
-}
 function claudeCleanPrewriteResult(error) {
     if (error instanceof BridgeError &&
         error.code === "CLAUDE_PEER_MESSAGE_EXPIRED") {
-        return { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" };
+        return { state: "expired", safeErrorCode: "MESSAGE_EXPIRED" };
     }
     if (error instanceof BridgeError &&
         CLAUDE_CLEAN_PREWRITE_RETRY_CODES.has(error.code)) {
-        return { state: "deferred", safeErrorCode: error.code };
+        return { state: "deferred", safeErrorCode: "ROUTE_BUSY" };
     }
     const systemCode = typeof error === "object" &&
         error !== null &&
@@ -78,6 +61,32 @@ function claudeCleanPrewriteResult(error) {
                         : "CLAUDE_DISPATCH_PREWRITE_FAILED",
     };
 }
+function claudePostAuthorizationResult(error) {
+    if (error instanceof BridgeError && error.recoverable) {
+        return {
+            state: "failed",
+            safeErrorCode: error.code === "CLAUDE_PEER_MESSAGE_EXPIRED"
+                ? "MESSAGE_EXPIRED"
+                : error.code,
+        };
+    }
+    return {
+        state: "ambiguous",
+        safeErrorCode: error instanceof BridgeError &&
+            /^[A-Z][A-Z0-9_]{0,95}$/.test(error.code)
+            ? error.code
+            : "CLAUDE_DISPATCH_OUTCOME_AMBIGUOUS",
+    };
+}
+async function cancelPreparedClaude(prepared) {
+    try {
+        await prepared.cancel();
+    }
+    catch {
+        // Cancellation is a no-write cleanup path. Its failure cannot turn a
+        // denied or uncertain authorization into permission to perform.
+    }
+}
 function exactLocalHost(hostId) {
     if ((hostId ?? LOCAL_HOST) !== LOCAL_HOST) {
         throw new BridgeError("GATEWAY_REMOTE_PROVIDER_DISABLED", "This provider is restricted to the exact local host boundary.");
@@ -93,22 +102,9 @@ function positiveBounded(value, fallback, maximum) {
     }
     return resolved;
 }
-function strictDeadline(value, now) {
-    const parsed = Date.parse(value);
-    if (!Number.isFinite(parsed) ||
-        new Date(parsed).toISOString() !== value ||
-        parsed <= now) {
-        return undefined;
-    }
-    return parsed;
-}
 function sameEndpoint(binding, identity) {
     return (binding.provider === identity.provider &&
-        binding.hostId === identity.hostId &&
-        binding.endpointGeneration === identity.endpointGeneration);
-}
-function callbackEndpoint(identity, routeHandle) {
-    return { ...identity, routeHandle };
+        binding.hostId === identity.hostId);
 }
 function invokeCallback(operation) {
     try {
@@ -118,15 +114,8 @@ function invokeCallback(operation) {
         // Provider observation consumers cannot change a transport outcome.
     }
 }
-function validateAttestedClaudeRuntime(runtime) {
-    validateClaudeRuntimePathEvidence(runtime);
-}
 function validateClaudeRuntimePathEvidence(runtime) {
-    if ([
-        runtime.claudeExecutable,
-        runtime.sessionsDir,
-        runtime.socketDir,
-    ].some((value) => !path.isAbsolute(value) ||
+    if ([runtime.sessionsDir, runtime.socketDir].some((value) => !path.isAbsolute(value) ||
         path.normalize(value) !== value ||
         value.includes("\0"))) {
         throw new BridgeError("CLAUDE_RUNTIME_ATTESTATION_INVALID", "The local Claude provider requires bounded absolute runtime evidence.");
@@ -158,15 +147,6 @@ function unavailableClaudeRegistryObservation() {
         ]),
     });
 }
-function isClaudeRegistryAvailabilityError(error) {
-    if (typeof error !== "object" || error === null || !("code" in error)) {
-        return false;
-    }
-    return (error.code === "ENOENT" ||
-        error.code === "EACCES" ||
-        error.code === "EPERM" ||
-        error.code === "UNSAFE_PEER_DIRECTORY");
-}
 export class LocalClaudeGatewayProvider {
     identity;
     protocol = "claude-peer";
@@ -175,48 +155,18 @@ export class LocalClaudeGatewayProvider {
     maxPending;
     discoveryPollMs;
     now;
-    selectedStateRoots = new Map();
     nativeHelpers;
-    nativeHelperSourceProvider;
     discovered = new Map();
+    /** Exact UUID selection plus its display-only observation bookkeeping. */
     selected = new Map();
-    /** Exact live same-UID sessions observed through native inbound frames. */
-    nativeInbound = new Map();
-    /** Exact listener owner for every receipt capability handed to the service. */
-    nativeInboundReceiptOwners = new Map();
-    selectedObservations = new Map();
-    /** Invalidates any discovery that overlaps a dispatch on this route. */
-    selectedDispatchEpoch = new Map();
-    /**
-     * A dispatch invalidates the pre-dispatch registry observation. The first
-     * subsequent successful discovery must therefore be published even when
-     * the native peer completed between polls and is idle again.
-     */
-    selectedObservationDirty = new Set();
-    pendingByProviderId = new Map();
-    providerIdByGatewayId = new Map();
-    /** Includes the pre-write reservation through exact terminal settlement. */
-    pendingTargetByGatewayId = new Map();
-    /** Provider-owned terminal rejections that never enter the service queue. */
-    rejectedNativeInbound = new Map();
     discoveryInFlight;
     registryObservation;
     monitorTimer;
-    /** Invocation-ordered registry mutations; the tail itself never rejects. */
-    nativeCodexRegistrationTail = Promise.resolve();
     callbacks;
-    activeNativeCodexListener;
-    preparedNativeCodexListener;
-    nativeCodexPreparationInFlight;
-    retiredNativeCodexListener;
-    /** Fences discovery callbacks and monitor restarts across listener rotation. */
-    nativeCodexSuccessionFreeze;
-    /** External registry trust/availability failures degrade Claude only. */
-    unavailableCode;
     initialized = false;
     closed = false;
     constructor(options) {
-        validateAttestedClaudeRuntime(options.runtime);
+        validateClaudeRuntimePathEvidence(options.runtime);
         if (options.locale !== undefined && !isDashboardLocale(options.locale)) {
             throw new BridgeError("DASHBOARD_LOCALE_UNSUPPORTED", "The Claude provider notice locale is unsupported.");
         }
@@ -224,22 +174,15 @@ export class LocalClaudeGatewayProvider {
         this.identity = {
             provider: "claude",
             hostId,
-            endpointGeneration: STABLE_CLAUDE_ENDPOINT_GENERATION,
         };
         this.maxPending = positiveBounded(options.maxPendingMessages, MAX_CLAUDE_PENDING, 4_096);
         this.discoveryPollMs = positiveBounded(options.discoveryPollMs, DEFAULT_CLAUDE_DISCOVERY_POLL_MS, 30_000);
         this.now = options.now ?? Date.now;
-        const protocolRuntime = {
-            claudeExecutable: options.runtime.claudeExecutable,
-            claudeCodeVersion: options.runtime.claudeCodeVersion,
-            sessionsDir: options.runtime.sessionsDir,
-            socketDir: options.runtime.socketDir,
-        };
+        const protocolRuntime = options.runtime;
         this.peer = (options.peerFactory ??
             ((runtime, locale, deliveryNotices) => new ClaudePeerAdapter({
                 sessionsDir: runtime.sessionsDir,
                 socketDir: runtime.socketDir,
-                attestedClaudeCodeVersion: runtime.claudeCodeVersion,
                 locale,
                 deliveryNotices,
             })))(protocolRuntime, options.locale ?? "en", options.deliveryNotices ?? "merged");
@@ -258,16 +201,10 @@ export class LocalClaudeGatewayProvider {
                         ? {}
                         : { factory: options.nativeHelpers.factory }),
                 });
-        this.nativeHelperSourceProvider = options.nativeHelperSourceProvider;
     }
     latestRegistryObservation() {
         return this.registryObservation;
     }
-    activateEndpointGeneration(endpointGeneration) {
-        if (endpointGeneration !== this.identity.endpointGeneration) {
-            throw new BridgeError("CLAUDE_ENDPOINT_ACTIVATION_MISMATCH", "Only the exact current Claude endpoint generation can be activated.");
-        }
-    }
     async initialize(callbacks) {
         if (this.closed) {
             throw new BridgeError("CLAUDE_PROVIDER_CLOSED", "The local Claude provider is closed.");
@@ -276,63 +213,8 @@ export class LocalClaudeGatewayProvider {
             throw new BridgeError("CLAUDE_PROVIDER_ALREADY_INITIALIZED", "The local Claude provider can be initialized only once.");
         }
         this.callbacks = callbacks;
-        if (this.nativeHelpers !== undefined) {
-            this.initialized = true;
-            return { health: "healthy" };
-        }
-        try {
-            let listenerGeneration;
-            const listener = await this.peer.listen({
-                onMessage: async (message) => {
-                    if (listenerGeneration !== undefined) {
-                        await this.onListenerMessage(listenerGeneration, message);
-                    }
-                },
-                onReceipt: (event) => {
-                    if (listenerGeneration !== undefined) {
-                        this.onReceipt(listenerGeneration, event);
-                    }
-                },
-                onProtocolNotice: (notice) => {
-                    this.callbacks?.onProtocolNotice?.({ code: notice.code });
-                },
-            });
-            listenerGeneration = {
-                generation: listener.generation,
-                listener,
-                lifecycle: "active",
-                registrationProvisional: false,
-                provisionalIngressForwarded: false,
-                inboundQuiesced: false,
-                publicationAttempted: false,
-                publicationUncertain: false,
-            };
-            if (this.closed) {
-                await listener.close();
-                throw new BridgeError("CLAUDE_PROVIDER_CLOSED", "The local Claude provider closed during initialization.");
-            }
-            this.activeNativeCodexListener = listenerGeneration;
-            this.initialized = true;
-            return { health: "healthy" };
-        }
-        catch (error) {
-            if (error instanceof BridgeError &&
-                error.code === "UNSAFE_PEER_DIRECTORY") {
-                this.unavailableCode = "CLAUDE_REGISTRY_UNAVAILABLE";
-                this.registryObservation = unavailableClaudeRegistryObservation();
-                this.initialized = true;
-                return {
-                    health: "degraded",
-                    safeErrorCode: "CLAUDE_REGISTRY_UNAVAILABLE",
-                };
-            }
-            this.callbacks = undefined;
-            if (error instanceof BridgeError &&
-                error.code === "CLAUDE_PEER_CALLBACK_UNSAFE") {
-                throw error;
-            }
-            throw new BridgeError("CLAUDE_CALLBACK_UNAVAILABLE", "The private Claude callback listener could not be established.");
-        }
+        this.initialized = true;
+        return { health: "healthy" };
     }
     async discoverClaudePeers() {
         this.assertReady();
@@ -341,7 +223,18 @@ export class LocalClaudeGatewayProvider {
     async assertWorkspaceDisjoint(routeHandle, stateRoot) {
         this.assertReady();
         await this.peer.assertTargetWorkspaceDisjoint(routeHandle, stateRoot);
-        this.selectedStateRoots.set(routeHandle, stateRoot);
+        const route = this.selected.get(routeHandle);
+        const alias = route?.alias ?? this.discovered.get(routeHandle)?.alias;
+        if (alias !== undefined) {
+            this.selected.set(routeHandle, {
+                alias,
+                dispatchEpoch: route?.dispatchEpoch ?? 0,
+                observationDirty: route?.observationDirty ?? false,
+                ...(route?.registrationId === undefined ? {} : { registrationId: route.registrationId }),
+                ...(route?.observation === undefined ? {} : { observation: route.observation }),
+                stateRoot,
+            });
+        }
     }
     async selectRoute(input) {
         this.assertReady();
@@ -349,17 +242,47 @@ export class LocalClaudeGatewayProvider {
         if (candidate === undefined || candidate.alias !== input.alias) {
             throw new BridgeError("CLAUDE_ROUTE_MISMATCH", "The selected Claude alias no longer matches that exact peer generation.");
         }
-        this.selected.set(input.routeHandle, input.alias);
-        this.selectedDispatchEpoch.set(input.routeHandle, this.selectedDispatchEpoch.get(input.routeHandle) ?? 0);
-        this.selectedObservationDirty.delete(input.routeHandle);
-        this.selectedObservations.set(input.routeHandle, `${candidate.state}:`);
+        const route = this.selected.get(input.routeHandle);
+        this.selected.set(input.routeHandle, {
+            alias: input.alias,
+            dispatchEpoch: route?.dispatchEpoch ?? 0,
+            observation: `${candidate.state}:`,
+            observationDirty: false,
+            ...(route?.registrationId === undefined ? {} : { registrationId: route.registrationId }),
+            ...(route?.stateRoot === undefined ? {} : { stateRoot: route.stateRoot }),
+        });
         this.scheduleClaudeMonitor();
         return { routeHandle: input.routeHandle, state: candidate.state };
     }
+    observeLogicalRoute(input) {
+        if (this.closed ||
+            !PUBLIC_ALIAS.test(input.alias) ||
+            !input.alias.endsWith(`@${this.identity.hostId}`) ||
+            !OPAQUE_ROUTE.test(input.routeHandle) ||
+            !OPAQUE_ROUTE.test(input.registrationId)) {
+            return;
+        }
+        const route = this.selected.get(input.routeHandle);
+        this.selected.set(input.routeHandle, {
+            alias: input.alias,
+            registrationId: input.registrationId,
+            dispatchEpoch: route?.dispatchEpoch ?? 0,
+            observationDirty: route?.observationDirty ?? false,
+            ...(route?.stateRoot === undefined ? {} : { stateRoot: route.stateRoot }),
+            ...(route?.observation === undefined ? {} : { observation: route.observation }),
+        });
+    }
+    forgetLogicalRoute(registrationId) {
+        for (const [routeHandle, route] of this.selected) {
+            if (route.registrationId === registrationId) {
+                this.selected.delete(routeHandle);
+            }
+        }
+    }
     async resolveReplyAddress(address) {
         this.assertReady();
         const resolved = await this.peer.resolveReplyAddress(address);
-        const selectedAlias = this.selected.get(resolved.targetId);
+        const selectedAlias = this.selected.get(resolved.targetId)?.alias;
         if (selectedAlias === undefined ||
             resolved.kind !== "interactive" ||
             selectedAlias !== `${resolved.alias}@${this.identity.hostId}`) {
@@ -368,1219 +291,265 @@ export class LocalClaudeGatewayProvider {
         return { routeHandle: resolved.targetId };
     }
     async advertiseNativeSourcePeer(input) {
-        if (this.nativeHelpers !== undefined) {
-            this.assertReady();
-            await this.nativeHelpers.advertise(input);
-            return;
-        }
-        if (input.sourceProvider !== "codex" &&
-            input.sourceProvider !== this.nativeHelperSourceProvider) {
-            throw new BridgeError("CLAUDE_NATIVE_HELPER_UNAVAILABLE", "A non-Codex source requires a supervised native Claude helper.", true);
-        }
-        const registration = this.nativeCodexRegistration(input);
-        await this.serializeNativeCodexRegistration(async () => {
-            this.assertReady();
-            const active = this.requireActiveNativeCodexListener();
-            if (active.registration !== undefined &&
-                active.registration.alias !== registration.alias) {
-                throw new BridgeError("CODEX_PEER_ALREADY_ADVERTISED", "This listener generation already advertises another Codex peer.");
-            }
-            const installedProvisional = active.registration === undefined;
-            if (installedProvisional) {
-                active.registration = registration;
-                active.registrationProvisional = true;
-                active.provisionalIngressForwarded = false;
-            }
-            try {
-                await active.listener.advertise(registration.name, registration.cwd);
-                // Reassert exact ownership after publication. A preceding serialized
-                // attempt may have removed its own clean provisional registration.
-                active.registration = registration;
-                active.registrationProvisional = false;
-                active.provisionalIngressForwarded = false;
-            }
-            catch (error) {
-                if (error instanceof BridgeError &&
-                    error.recoverable &&
-                    installedProvisional &&
-                    active.registration === registration &&
-                    !active.provisionalIngressForwarded) {
-                    delete active.registration;
-                    active.registrationProvisional = false;
-                }
-                throw error;
-            }
-        });
+        await this.helpers().advertise(input);
     }
-    currentNativeCodexPeerGeneration(alias) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            return this.nativeHelpers.currentGeneration(alias);
-        }
-        const active = this.requireActiveNativeCodexListener();
-        if (active.registration?.alias !== alias) {
-            throw new BridgeError("CODEX_PEER_GENERATION_MISMATCH", "The requested Codex alias is not the active listener generation.");
-        }
-        return active.generation;
+    async unadvertiseNativeSourcePeer(alias) {
+        await this.helpers().unadvertise(alias);
     }
-    /** Child-host initialization seam before its immutable advertisement exists. */
-    currentUnadvertisedNativeCodexPeerGeneration() {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            throw new BridgeError("CLAUDE_NATIVE_HELPER_NESTING_FORBIDDEN", "A supervised provider cannot itself act as a native helper host.");
-        }
-        const active = this.requireActiveNativeCodexListener();
-        if (active.registration !== undefined) {
-            throw new BridgeError("CODEX_PEER_ALREADY_ADVERTISED", "The native listener already owns an advertised Codex identity.");
-        }
-        return active.generation;
+    async updateNativeSourcePeerStatus(alias, status) {
+        await this.helpers().updateStatus(alias, status);
     }
-    async prepareNativeCodexPeerGeneration(input) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            if (input.currentGeneration === undefined) {
-                throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "A supervised succession must name its exact current generation.");
-            }
-            await this.nativeHelpers.prepareGeneration({
-                alias: input.alias,
-                cwd: input.cwd,
-                generation: input.generation,
-                currentGeneration: input.currentGeneration,
-            });
-            return;
-        }
-        const active = this.requireActiveNativeCodexListener();
-        if (input.currentGeneration !== undefined &&
-            input.currentGeneration !== active.generation) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "The prepared successor does not name the exact current generation.");
-        }
-        if (active.registration === undefined) {
-            throw new BridgeError("CODEX_PEER_NOT_ADVERTISED", "A successor requires one active advertised Codex generation.");
+    async updateNativeInboundStatus(receiptHandle, status, diagnosticCode) {
+        await this.helpers().updateInboundStatus(receiptHandle, status, diagnosticCode);
+    }
+    async notifyNativeInboundProgress(receiptHandle, progress) {
+        await this.helpers().notifyInboundProgress(receiptHandle, progress);
+    }
+    async releaseNativeInboundReceipt(receiptHandle) {
+        return await this.helpers().releaseInboundReceipt(receiptHandle);
+    }
+    async dispatch(input) {
+        if (!this.initialized ||
+            this.closed ||
+            !sameEndpoint(input.binding, this.identity)) {
+            return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
         }
-        if (input.generation === active.generation ||
-            this.nativeCodexPreparationInFlight !== undefined ||
-            this.preparedNativeCodexListener !== undefined ||
-            this.retiredNativeCodexListener !== undefined) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_CAPACITY", "Only one distinct prepared or retired Codex generation is allowed.");
+        if (input.authorization === "selected_route") {
+            const logical = this.selected.get(input.binding.routeHandle);
+            if (logical === undefined ||
+                logical.alias !== input.targetAlias ||
+                logical.registrationId !== input.binding.registrationId) {
+                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
+            }
+            logical.dispatchEpoch += 1;
+            logical.observationDirty = true;
+            this.emitClaudeRouteObservation(input.binding.routeHandle, "busy");
         }
-        const registration = this.nativeCodexRegistration({ ...input, sourceProvider: "codex" });
-        this.nativeCodexPreparationInFlight = input.generation;
         let prepared;
         try {
-            const listener = await this.peer.listenPrepared(input.generation, {
-                onMessage: async (message) => {
-                    if (prepared !== undefined) {
-                        await this.onListenerMessage(prepared, message);
-                    }
-                },
-                onReceipt: (event) => {
-                    if (prepared !== undefined)
-                        this.onReceipt(prepared, event);
-                },
+            const selected = this.selected.get(input.binding.routeHandle);
+            prepared = await this.helpers().prepareDispatch({
+                sourceAlias: input.sourceAlias,
+                sourceProvider: input.sourceProvider,
+                targetAlias: input.targetAlias,
+                conversationId: input.conversationId,
+                binding: input.binding,
+                authorization: input.authorization,
+                messageId: input.messageId,
+                text: input.text,
+                expectsReply: input.expectsReply,
+                deadlineAt: input.deadlineAt,
+                ...(selected?.alias === undefined ? {} : { selectedAlias: selected.alias }),
+                ...(input.authorization !== "selected_route" || selected?.stateRoot === undefined
+                    ? {}
+                    : { stateRoot: selected.stateRoot }),
+                ...(input.progressWatchActive === true ? { progressWatchActive: true } : {}),
             });
-            prepared = {
-                generation: listener.generation,
-                listener,
-                lifecycle: "prepared",
-                registration,
-                registrationProvisional: false,
-                provisionalIngressForwarded: false,
-                inboundQuiesced: true,
-                publicationAttempted: false,
-                publicationUncertain: false,
-            };
-            if (listener.generation !== input.generation || this.closed) {
-                await listener.close().catch(() => undefined);
-                throw new BridgeError("CLAUDE_CALLBACK_UNAVAILABLE", "The prepared Claude callback generation could not be established.");
-            }
-            this.preparedNativeCodexListener = prepared;
-        }
-        finally {
-            if (this.nativeCodexPreparationInFlight === input.generation) {
-                this.nativeCodexPreparationInFlight = undefined;
-            }
-        }
-    }
-    async quiesceNativeCodexPeerGeneration(generation) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.quiesceGeneration(generation);
-            return;
-        }
-        const active = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, generation, "active");
-        if (this.nativeCodexSuccessionFreeze !== undefined &&
-            this.nativeCodexSuccessionFreeze !== generation) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "Another native Codex generation already owns the succession freeze.");
-        }
-        this.nativeCodexSuccessionFreeze = generation;
-        if (this.monitorTimer !== undefined) {
-            clearTimeout(this.monitorTimer);
-            this.monitorTimer = undefined;
-        }
-        try {
-            await active.listener.quiesceInbound();
-            active.inboundQuiesced = true;
         }
         catch (error) {
-            if (this.nativeCodexSuccessionFreeze === generation) {
-                this.nativeCodexSuccessionFreeze = undefined;
-            }
-            this.scheduleClaudeMonitor();
-            throw error;
-        }
-    }
-    async observeNativeCodexSuccessionBarrier(generation) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            return await this.nativeHelpers.observeBarrier(generation);
-        }
-        const active = this.activeNativeCodexListener;
-        const activeGenerationMatched = active?.generation === generation;
-        const pendingOutboundReceipts = this.providerIdByGatewayId.size;
-        let pendingInboundReceipts = 0;
-        for (const owner of this.nativeInboundReceiptOwners.values()) {
-            if (owner.generation === generation)
-                pendingInboundReceipts += 1;
-        }
-        let rejectedInboundSettlements = 0;
-        for (const rejection of this.rejectedNativeInbound.values()) {
-            if (rejection.listenerGeneration === generation) {
-                rejectedInboundSettlements += 1;
+            if (error instanceof BridgeError &&
+                CLAUDE_CLEAN_PREWRITE_RETRY_CODES.has(error.code)) {
+                this.emitClaudeRouteObservation(input.binding.routeHandle, "busy", error.code);
             }
+            return claudeCleanPrewriteResult(error);
         }
-        const ingressQuiesced = activeGenerationMatched && active.inboundQuiesced;
-        const monitorFrozen = activeGenerationMatched &&
-            this.nativeCodexSuccessionFreeze === generation;
-        const discoveryInFlight = this.discoveryInFlight !== undefined;
-        return {
-            generation,
-            activeGenerationMatched,
-            ingressQuiesced,
-            monitorFrozen,
-            discoveryInFlight,
-            pendingOutboundReceipts,
-            pendingInboundReceipts,
-            rejectedInboundSettlements,
-            clean: activeGenerationMatched &&
-                ingressQuiesced &&
-                monitorFrozen &&
-                !discoveryInFlight &&
-                pendingOutboundReceipts === 0 &&
-                pendingInboundReceipts === 0 &&
-                rejectedInboundSettlements === 0,
+        const evidence = {
+            attemptId: input.attemptId,
+            kind: "claude_mailbox",
+            bodyBytes: Buffer.byteLength(input.text, "utf8"),
+            bodySha256: createHash("sha256").update(input.text).digest("hex"),
+            frameBytes: prepared.frameBytes,
+            sha256: prepared.sha256,
         };
-    }
-    async publishPreparedNativeCodexPeer(input) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            return await this.nativeHelpers.publishPrepared(input);
-        }
-        const current = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, input.currentGeneration, "active");
-        const prepared = this.requireNativeCodexListenerGeneration(this.preparedNativeCodexListener, input.preparedGeneration, "prepared");
-        if (!current.inboundQuiesced || prepared.registration === undefined) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_QUIET", "The old listener must be quiesced before publication.");
-        }
-        if (!(await this.observeNativeCodexSuccessionBarrier(current.generation)).clean) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_QUIET", "Native Codex succession requires a clean provider-wide barrier.", true);
+        let authorized;
+        try {
+            authorized = await input.authorizeWrite(evidence);
         }
-        if (prepared.publicationOutcome === "published" ||
-            prepared.publicationOutcome === "not_published") {
-            return prepared.publicationOutcome;
+        catch {
+            await cancelPreparedClaude(prepared);
+            return {
+                state: "ambiguous",
+                safeErrorCode: "WRITE_AUTHORIZATION_UNCERTAIN",
+            };
         }
-        if (prepared.publicationOperation !== undefined) {
-            return await prepared.publicationOperation;
+        if (!authorized) {
+            await cancelPreparedClaude(prepared);
+            return {
+                state: "failed",
+                safeErrorCode: "WRITE_AUTHORIZATION_DENIED",
+            };
         }
-        prepared.publicationAttempted = true;
-        const operation = prepared.listener.publishReplacing(current.listener, prepared.registration.name, prepared.registration.cwd);
-        prepared.publicationOperation = operation;
         try {
-            const outcome = await operation;
-            if (outcome === "published") {
-                prepared.publicationOutcome = "published";
-                return "published";
-            }
-            if (outcome === "unknown") {
-                prepared.publicationUncertain = true;
-                prepared.publicationOutcome = "unknown";
-                return "unknown";
-            }
-            if (prepared.publicationUncertain) {
-                prepared.publicationOutcome = "unknown";
-                return "unknown";
+            // Authorization is the consent linearization point. Invoke the exact
+            // prepared mailbox write in the same continuation with no intervening
+            // await. Claude has no separate acceptance phase: confirmed mailbox
+            // completion is terminal delivered.
+            const operation = prepared.perform();
+            const result = await operation;
+            if (result.state === "deferred") {
+                return {
+                    state: "ambiguous",
+                    safeErrorCode: "CLAUDE_PREPARED_RESULT_INVALID",
+                };
             }
-            prepared.publicationOutcome = "not_published";
-            return "not_published";
+            return result.state === "expired"
+                ? { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" }
+                : result;
         }
         catch (error) {
-            prepared.publicationUncertain = true;
-            prepared.publicationOutcome = "unknown";
-            throw error;
-        }
-        finally {
-            if (prepared.publicationOperation === operation) {
-                delete prepared.publicationOperation;
-            }
+            return claudePostAuthorizationResult(error);
         }
     }
-    async activatePreparedNativeCodexPeerGeneration(generation) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.activatePrepared(generation);
-            return;
-        }
-        const prepared = this.requireNativeCodexListenerGeneration(this.preparedNativeCodexListener, generation, "prepared");
-        if (prepared.publicationOutcome !== "published" ||
-            this.retiredNativeCodexListener !== undefined) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_PUBLISHED", "Only a confirmed published generation can become active.");
-        }
-        const current = this.requireActiveNativeCodexListener();
-        prepared.listener.grantSuccessionActivation();
-        prepared.listener.resumeInbound();
-        prepared.inboundQuiesced = false;
-        current.lifecycle = "retired";
-        prepared.lifecycle = "active";
-        this.retiredNativeCodexListener = current;
-        this.activeNativeCodexListener = prepared;
-        this.preparedNativeCodexListener = undefined;
-        if (this.nativeCodexSuccessionFreeze === current.generation) {
-            this.nativeCodexSuccessionFreeze = undefined;
+    async releaseRoute(routeHandle) {
+        this.selected.delete(routeHandle);
+        this.discovered.delete(routeHandle);
+        if (this.selected.size === 0 && this.monitorTimer !== undefined) {
+            clearTimeout(this.monitorTimer);
+            this.monitorTimer = undefined;
         }
-        await this.purgeNativeCodexPeerGenerationReplyCapabilities(current.generation);
-        this.scheduleClaudeMonitor();
     }
-    async cleanupPreparedNativeCodexPeerGeneration(generation) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.cleanupPrepared(generation);
+    async close() {
+        if (this.closed)
             return;
+        this.closed = true;
+        try {
+            await this.nativeHelpers?.close();
+            await this.peer.close();
         }
-        const prepared = this.requireNativeCodexListenerGeneration(this.preparedNativeCodexListener, generation, "prepared");
-        if (prepared.publicationAttempted &&
-            (prepared.publicationUncertain ||
-                prepared.publicationOutcome !== "not_published")) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_ROLLBACK_FORBIDDEN", "A possibly published Codex generation cannot be rolled back.");
+        finally {
+            this.selected.clear();
+            this.discovered.clear();
+            if (this.monitorTimer !== undefined)
+                clearTimeout(this.monitorTimer);
+            this.monitorTimer = undefined;
+            this.callbacks = undefined;
         }
-        await prepared.listener.close();
-        if (this.preparedNativeCodexListener === prepared) {
-            this.preparedNativeCodexListener = undefined;
+    }
+    assertReady() {
+        if (!this.initialized || this.closed) {
+            throw new BridgeError("CLAUDE_PROVIDER_UNAVAILABLE", "The local Claude provider is not available.", true);
         }
     }
-    async resumeNativeCodexPeerGeneration(generation) {
+    helpers() {
         this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.resumeGeneration(generation);
-            return;
+        if (this.nativeHelpers === undefined) {
+            throw new BridgeError("CLAUDE_NATIVE_HELPER_UNAVAILABLE", "The supervised native Claude helper is unavailable.", true);
         }
-        const active = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, generation, "active");
-        if (this.preparedNativeCodexListener !== undefined) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_CLEANUP_REQUIRED", "The prepared listener must be cleaned before resuming the old one.");
-        }
-        active.listener.resumeInbound();
-        active.inboundQuiesced = false;
-        if (this.nativeCodexSuccessionFreeze === generation) {
-            this.nativeCodexSuccessionFreeze = undefined;
-        }
-        this.scheduleClaudeMonitor();
+        return this.nativeHelpers;
     }
-    async rollbackPreparedNativeCodexPeerGeneration(input) {
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.rollbackPrepared(input);
-            return;
+    async refreshClaudeDiscovery() {
+        if (this.discoveryInFlight !== undefined) {
+            return await this.discoveryInFlight;
         }
-        await this.cleanupPreparedNativeCodexPeerGeneration(input.preparedGeneration);
-        await this.resumeNativeCodexPeerGeneration(input.resumeGeneration);
-    }
-    async retireNativeCodexPeerGeneration(input) {
-        this.assertReady();
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.retireGeneration(input);
-            return;
+        const operation = this.refreshClaudeDiscoveryOnce();
+        this.discoveryInFlight = operation;
+        try {
+            return await operation;
         }
-        const active = this.requireNativeCodexListenerGeneration(this.activeNativeCodexListener, input.protectedActiveGeneration, "active");
-        const retired = this.requireNativeCodexListenerGeneration(this.retiredNativeCodexListener, input.retiredGeneration, "retired");
-        if (active === retired) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "The protected and retired listener generations must be distinct.");
+        finally {
+            if (this.discoveryInFlight === operation) {
+                this.discoveryInFlight = undefined;
+            }
         }
-        const ownsPendingReceipt = [...this.nativeInboundReceiptOwners.values()].some((owner) => owner === retired);
-        const ownsRejectedSettlement = [
-            ...this.rejectedNativeInbound.values(),
-        ].some((rejection) => rejection.listener === retired.listener);
-        const ownsOutboundReceipt = [...this.pendingByProviderId.values()].some((pending) => pending.listener === retired.listener);
-        if (ownsPendingReceipt || ownsRejectedSettlement || ownsOutboundReceipt) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_NOT_QUIET", "A retired listener cannot close while it owns receipt capabilities.", true);
+    }
+    async refreshClaudeDiscoveryOnce() {
+        const dispatchEpochAtStart = new Map();
+        for (const [routeHandle, route] of this.selected) {
+            dispatchEpochAtStart.set(routeHandle, route.dispatchEpoch);
         }
-        await retired.listener.close();
-        if (this.retiredNativeCodexListener === retired) {
-            this.retiredNativeCodexListener = undefined;
+        let discovery;
+        try {
+            discovery = await this.peer.discover();
         }
-    }
-    async purgeNativeCodexPeerGenerationReplyCapabilities(generation) {
-        if (this.nativeHelpers !== undefined) {
-            return await this.nativeHelpers.purgeGenerationReplies(generation);
+        catch (error) {
+            this.registryObservation = unavailableClaudeRegistryObservation();
+            throw error;
         }
-        let purged = 0;
-        for (const [routeHandle, route] of this.nativeInbound) {
-            if (route.listenerGeneration !== generation)
+        const registry = claudeRegistryObservation(discovery);
+        this.registryObservation = registry;
+        this.discovered.clear();
+        const rows = [];
+        for (const peer of discovery.peers) {
+            if (peer.kind !== "interactive" ||
+                !NATIVE_CLAUDE_NAME.test(peer.alias)) {
+                continue;
+            }
+            const alias = `${peer.alias}@${this.identity.hostId}`;
+            if (!PUBLIC_ALIAS.test(alias))
                 continue;
-            this.nativeInbound.delete(routeHandle);
-            purged += 1;
+            const row = {
+                alias,
+                routeHandle: peer.targetId,
+                kind: "interactive",
+                state: claudeRouteState(peer),
+            };
+            this.discovered.set(peer.targetId, row);
+            rows.push(row);
         }
-        return purged;
-    }
-    async unadvertiseNativeSourcePeer(alias) {
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.unadvertise(alias);
-            return;
+        for (const [routeHandle, selected] of this.selected) {
+            const row = this.discovered.get(routeHandle);
+            if (row === undefined) {
+                this.emitClaudeRouteObservation(routeHandle, "busy", "CLAUDE_PEER_NOT_OBSERVED", true);
+            }
+            else {
+                if (!discovery.truncated && row.alias !== selected.alias) {
+                    // A Claude rename changes only the live name index. The native
+                    // session UUID remains the selected logical route. An incomplete
+                    // scan is display evidence only and cannot rename dispatch authority.
+                    selected.alias = row.alias;
+                }
+                if (row.state === "idle" &&
+                    (dispatchEpochAtStart.get(routeHandle) !==
+                        selected.dispatchEpoch)) {
+                    // Never publish an idle sample from a discovery that overlapped the
+                    // exact mailbox write. A wholly post-terminal discovery may clear
+                    // the dirty epoch.
+                    continue;
+                }
+                this.emitClaudeRouteObservation(routeHandle, row.state, undefined, true);
+            }
         }
-        await this.serializeNativeCodexRegistration(async () => {
-            const active = this.activeNativeCodexListener;
-            if (active?.registration?.alias !== alias)
-                return;
-            await active.listener.unadvertise(active.registration.name);
-            await this.purgeNativeCodexPeerGenerationReplyCapabilities(active.generation);
-            delete active.registration;
-            active.registrationProvisional = false;
-            active.provisionalIngressForwarded = false;
-        });
+        return { peers: rows, complete: !discovery.truncated, registry };
     }
-    async updateNativeSourcePeerStatus(alias, status) {
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.updateStatus(alias, status);
+    emitClaudeRouteObservation(routeHandle, state, safeErrorCode, authoritative = false) {
+        const signature = `${state}:${safeErrorCode ?? ""}`;
+        const selected = this.selected.get(routeHandle);
+        const mustPublish = authoritative && selected?.observationDirty === true;
+        if (selected !== undefined && mustPublish)
+            selected.observationDirty = false;
+        if (!mustPublish && selected?.observation === signature) {
             return;
         }
-        const active = this.activeNativeCodexListener;
-        if (active?.registration?.alias !== alias)
+        if (selected !== undefined)
+            selected.observation = signature;
+        const callbacks = this.callbacks;
+        const registrationId = selected?.registrationId;
+        if (callbacks === undefined ||
+            this.closed ||
+            registrationId === undefined) {
             return;
-        await active.listener.updateAdvertisedStatus(status);
+        }
+        invokeCallback(() => callbacks.onRouteState({
+            route: {
+                ...this.identity,
+                routeHandle,
+                registrationId,
+            },
+            observedAt: new Date(this.now()).toISOString(),
+            state,
+            ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
+        }));
     }
-    async updateNativeInboundStatus(receiptHandle, status, diagnosticCode) {
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.updateInboundStatus(receiptHandle, status, diagnosticCode);
-            return;
-        }
-        const owner = this.requireNativeInboundReceiptOwner(receiptHandle);
-        try {
-            await owner.listener.acknowledge(receiptHandle, status, diagnosticCode === undefined ? undefined : { code: diagnosticCode });
-            if (status !== "held") {
-                this.nativeInboundReceiptOwners.delete(receiptHandle);
-            }
-        }
-        catch (error) {
-            if (status !== "held" &&
-                (!(error instanceof BridgeError) || !error.recoverable)) {
-                this.nativeInboundReceiptOwners.delete(receiptHandle);
-            }
-            throw error;
-        }
-    }
-    async notifyNativeInboundProgress(receiptHandle, progress) {
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.notifyInboundProgress(receiptHandle, progress);
-            return;
-        }
-        const owner = this.requireNativeInboundReceiptOwner(receiptHandle);
-        await owner.listener.notifyInboundProgress(receiptHandle, progress);
-    }
-    async releaseNativeInboundReceipt(receiptHandle) {
-        if (this.nativeHelpers !== undefined) {
-            return await this.nativeHelpers.releaseInboundReceipt(receiptHandle);
-        }
-        const owner = this.nativeInboundReceiptOwners.get(receiptHandle);
-        if (owner === undefined)
-            return false;
-        this.nativeInboundReceiptOwners.delete(receiptHandle);
-        return owner.listener.releaseInboundReceipt(receiptHandle);
-    }
-    async quiesceNativeInbound() {
-        if (this.closed)
-            return;
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.quiesceAll();
-            return;
-        }
-        const active = this.activeNativeCodexListener;
-        if (active === undefined)
-            return;
-        await active.listener.quiesceInbound();
-        active.inboundQuiesced = true;
-    }
-    async dispatch(input) {
-        if (this.unavailableCode !== undefined) {
-            return {
-                state: "failed",
-                safeErrorCode: this.unavailableCode,
-            };
-        }
-        if (this.nativeHelpers !== undefined) {
-            if (input.sourceAlias === undefined ||
-                !this.initialized ||
-                this.closed ||
-                !sameEndpoint(input.binding, this.identity)) {
-                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
-            }
-            const selectedAlias = this.selected.get(input.binding.routeHandle);
-            const stateRoot = this.selectedStateRoots.get(input.binding.routeHandle);
-            if (input.authorization === "selected_route" &&
-                (selectedAlias === undefined || stateRoot === undefined)) {
-                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
-            }
-            if (input.authorization === "selected_route") {
-                this.selectedDispatchEpoch.set(input.binding.routeHandle, (this.selectedDispatchEpoch.get(input.binding.routeHandle) ?? 0) + 1);
-                this.selectedObservationDirty.add(input.binding.routeHandle);
-                this.emitClaudeRouteObservation(input.binding.routeHandle, "busy");
-            }
-            try {
-                const sourceAlias = input.sourceAlias;
-                const result = await this.nativeHelpers.dispatch({
-                    ...input,
-                    sourceAlias,
-                    ...(selectedAlias === undefined ? {} : { selectedAlias }),
-                    ...(stateRoot === undefined ? {} : { stateRoot }),
-                });
-                if (input.authorization === "selected_route" &&
-                    result.state === "pending") {
-                    this.selectedObservationDirty.delete(input.binding.routeHandle);
-                    this.emitClaudeRouteObservation(input.binding.routeHandle, "idle", undefined, true);
-                }
-                return result;
-            }
-            catch (error) {
-                if (error instanceof BridgeError && error.recoverable) {
-                    return {
-                        state: "failed",
-                        safeErrorCode: "CLAUDE_NATIVE_HELPER_UNAVAILABLE",
-                    };
-                }
-                return {
-                    state: "ambiguous",
-                    safeErrorCode: "CLAUDE_NATIVE_HELPER_OUTCOME_UNKNOWN",
-                };
-            }
-        }
-        const activeListener = this.activeNativeCodexListener;
-        if (!this.initialized ||
-            this.closed ||
-            activeListener === undefined ||
-            activeListener.inboundQuiesced ||
-            this.nativeCodexSuccessionFreeze !== undefined ||
-            !sameEndpoint(input.binding, this.identity)) {
-            return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
-        }
-        if (input.authorization === "native_reply") {
-            const observedRoute = this.nativeInbound.get(input.binding.routeHandle);
-            if (observedRoute === undefined ||
-                observedRoute.listenerGeneration !== activeListener.generation) {
-                this.nativeInbound.delete(input.binding.routeHandle);
-                return { state: "failed", safeErrorCode: "CLAUDE_NATIVE_REPLY_STALE" };
-            }
-        }
-        else {
-            const selectedAlias = this.selected.get(input.binding.routeHandle);
-            const stateRoot = this.selectedStateRoots.get(input.binding.routeHandle);
-            if (selectedAlias === undefined ||
-                stateRoot === undefined) {
-                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
-            }
-        }
-        if (activeListener.registration?.alias !== input.sourceAlias ||
-            activeListener.registration.sourceProvider !== input.sourceProvider) {
-            return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
-        }
-        if (this.activeNativeCodexListener !== activeListener ||
-            activeListener.inboundQuiesced ||
-            this.nativeCodexSuccessionFreeze !== undefined) {
-            return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
-        }
-        const deadline = strictDeadline(input.deadlineAt, this.now());
-        if (deadline === undefined) {
-            return { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" };
-        }
-        if (this.providerIdByGatewayId.size >= this.maxPending ||
-            this.providerIdByGatewayId.has(input.messageId)) {
-            return { state: "failed", safeErrorCode: "CLAUDE_RECEIPT_CAPACITY" };
-        }
-        let content;
-        try {
-            content = composeProvenanceEnvelope({
-                sourceProvider: input.sourceProvider,
-                recipientProvider: this.identity.provider,
-                sourceAlias: input.sourceAlias,
-                targetAlias: input.targetAlias,
-                conversationId: input.conversationId,
-                body: input.text,
-                ...(input.progressWatchActive === true
-                    ? { progressWatchActive: true }
-                    : {}),
-            });
-        }
-        catch (error) {
-            if (error instanceof BridgeError &&
-                (error.code === "PROVENANCE_ENVELOPE_INVALID" ||
-                    error.code === "PROVENANCE_ENVELOPE_TOO_LARGE")) {
-                return { state: "failed", safeErrorCode: error.code };
-            }
-            throw error;
-        }
-        if (input.authorization === "selected_route") {
-            const stateRoot = this.selectedStateRoots.get(input.binding.routeHandle);
-            if (stateRoot === undefined) {
-                return { state: "failed", safeErrorCode: "CLAUDE_ROUTE_UNAVAILABLE" };
-            }
-            this.selectedDispatchEpoch.set(input.binding.routeHandle, (this.selectedDispatchEpoch.get(input.binding.routeHandle) ?? 0) + 1);
-            // The exact workspace attestation is refreshed before every send. A
-            // clean prewrite failure remains retryable within the message deadline;
-            // retry timing does not depend on the model turn's observed state.
-            this.selectedObservationDirty.add(input.binding.routeHandle);
-            this.emitClaudeRouteObservation(input.binding.routeHandle, "busy");
-            try {
-                await this.peer.assertTargetWorkspaceDisjoint(input.binding.routeHandle, stateRoot);
-            }
-            catch (error) {
-                return claudeCleanPrewriteResult(error);
-            }
-        }
-        this.providerIdByGatewayId.set(input.messageId, "");
-        this.pendingTargetByGatewayId.set(input.messageId, input.binding.routeHandle);
-        let providerId;
-        let trackingFailed = false;
-        let terminalDuringSend = false;
-        const onTransportStatus = (event) => {
-            if (providerId === undefined) {
-                providerId = event.messageId;
-                trackingFailed = !this.trackClaudeMessage(event.messageId, input.messageId, input.binding.routeHandle, deadline, activeListener);
-            }
-            if (trackingFailed)
-                return;
-            if (providerId !== event.messageId) {
-                terminalDuringSend = true;
-                this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_RECEIPT_ID_MISMATCH");
-                return;
-            }
-            if (event.status === "transport_written") {
-                this.recordClaudeWriteEvidence(event.messageId, "transport_written");
-                this.emitDelivery({
-                    messageId: input.messageId,
-                    state: "transport_written",
-                });
-            }
-            else if (event.status === "write_started" ||
-                event.status === "ambiguous") {
-                const newlyUncertain = this.recordClaudeWriteEvidence(event.messageId, "transport_uncertain");
-                if (newlyUncertain) {
-                    this.emitDelivery({
-                        messageId: input.messageId,
-                        state: "transport_uncertain",
-                        safeErrorCode: "CLAUDE_TRANSPORT_OUTCOME_UNCERTAIN",
-                    });
-                }
-            }
-            else if (event.status === "not_written") {
-                terminalDuringSend = true;
-                this.finishClaudeMessage(event.messageId, "failed", "CLAUDE_TRANSPORT_NOT_WRITTEN");
-            }
-            // A post-write ambiguity remains tracked. The exact receipt or the
-            // listener's bounded timeout is authoritative and may settle it later.
-        };
-        try {
-            const result = await this.peer.send(input.binding.routeHandle, content, {
-                listener: activeListener.listener,
-                receiptDeadlineAt: deadline,
-                onTransportStatus,
-            });
-            if (providerId === undefined ||
-                providerId !== result.messageId ||
-                result.receiptStatus !== "pending" ||
-                trackingFailed) {
-                if (trackingFailed) {
-                    this.abandonClaudeTracking(input.messageId, providerId);
-                    this.emitDelivery({
-                        messageId: input.messageId,
-                        state: "ambiguous",
-                        safeErrorCode: "CLAUDE_RECEIPT_TRACKING_FAILED",
-                    });
-                    return { state: "pending" };
-                }
-                if (providerId !== undefined) {
-                    this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_RECEIPT_TRACKING_FAILED");
-                }
-                else {
-                    this.providerIdByGatewayId.delete(input.messageId);
-                    this.pendingTargetByGatewayId.delete(input.messageId);
-                }
-                return { state: "ambiguous", safeErrorCode: "CLAUDE_RECEIPT_TRACKING_FAILED" };
-            }
-            if (input.authorization === "selected_route") {
-                this.selectedObservationDirty.delete(input.binding.routeHandle);
-                this.emitClaudeRouteObservation(input.binding.routeHandle, "idle", undefined, true);
-            }
-            return { state: "pending" };
-        }
-        catch (error) {
-            if (trackingFailed) {
-                this.abandonClaudeTracking(input.messageId, providerId);
-                this.emitDelivery({
-                    messageId: input.messageId,
-                    state: "ambiguous",
-                    safeErrorCode: "CLAUDE_RECEIPT_TRACKING_FAILED",
-                });
-                return { state: "pending" };
-            }
-            if (terminalDuringSend)
-                return { state: "pending" };
-            if (providerId !== undefined) {
-                if (error instanceof BridgeError &&
-                    error.code === "CLAUDE_PEER_WRITE_AMBIGUOUS") {
-                    return { state: "pending" };
-                }
-                this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_DISPATCH_OUTCOME_AMBIGUOUS");
-                return { state: "pending" };
-            }
-            this.providerIdByGatewayId.delete(input.messageId);
-            this.pendingTargetByGatewayId.delete(input.messageId);
-            return claudeCleanPrewriteResult(error);
-        }
-    }
-    async releaseRoute(routeHandle) {
-        this.selected.delete(routeHandle);
-        this.selectedDispatchEpoch.delete(routeHandle);
-        this.selectedObservationDirty.delete(routeHandle);
-        this.selectedObservations.delete(routeHandle);
-        this.discovered.delete(routeHandle);
-        this.selectedStateRoots.delete(routeHandle);
-        if (this.nativeHelpers !== undefined) {
-            await this.nativeHelpers.releaseRoute(routeHandle);
-        }
-        if (this.selected.size === 0 && this.monitorTimer !== undefined) {
-            clearTimeout(this.monitorTimer);
-            this.monitorTimer = undefined;
-        }
-    }
-    async close() {
-        if (this.closed)
-            return;
-        this.closed = true;
-        for (const rejection of this.rejectedNativeInbound.values()) {
-            this.releaseRejectedNativeInbound(rejection);
-        }
-        this.rejectedNativeInbound.clear();
-        try {
-            await this.nativeHelpers?.close();
-            await this.peer.close();
-        }
-        finally {
-            for (const pending of this.pendingByProviderId.values()) {
-                clearTimeout(pending.timer);
-            }
-            this.pendingByProviderId.clear();
-            this.providerIdByGatewayId.clear();
-            this.pendingTargetByGatewayId.clear();
-            this.selected.clear();
-            this.selectedStateRoots.clear();
-            this.nativeInbound.clear();
-            this.nativeInboundReceiptOwners.clear();
-            this.selectedDispatchEpoch.clear();
-            this.selectedObservationDirty.clear();
-            this.selectedObservations.clear();
-            this.discovered.clear();
-            if (this.monitorTimer !== undefined)
-                clearTimeout(this.monitorTimer);
-            this.monitorTimer = undefined;
-            this.activeNativeCodexListener = undefined;
-            this.preparedNativeCodexListener = undefined;
-            this.retiredNativeCodexListener = undefined;
-            this.nativeCodexPreparationInFlight = undefined;
-            this.nativeCodexSuccessionFreeze = undefined;
-            this.callbacks = undefined;
-        }
-    }
-    assertReady() {
-        if (!this.initialized || this.closed || this.unavailableCode !== undefined) {
-            throw new BridgeError("CLAUDE_PROVIDER_UNAVAILABLE", "The local Claude provider is not available.", true);
-        }
-    }
-    serializeNativeCodexRegistration(operation) {
-        const queued = this.nativeCodexRegistrationTail.then(operation);
-        this.nativeCodexRegistrationTail = queued.then(() => undefined, () => undefined);
-        return queued;
-    }
-    nativeCodexRegistration(input) {
-        const suffix = `@${this.identity.hostId}`;
-        if (!input.alias.endsWith(suffix)) {
-            throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "The native Codex peer alias must target this host.");
-        }
-        const name = input.alias.slice(0, -suffix.length);
-        const prefix = gatewayRegistrationIngressPrefixes[input.sourceProvider];
-        if (prefix === undefined || !name.startsWith(prefix) || !NATIVE_CLAUDE_NAME.test(name)) {
-            throw new BridgeError("INVALID_CODEX_PEER_ALIAS", "The native source peer alias must use its provider prefix.");
-        }
-        if (!path.isAbsolute(input.cwd) || input.cwd.includes("\0")) {
-            throw new BridgeError("INVALID_CODEX_PEER_CWD", "A native Codex peer requires an absolute working directory.");
-        }
-        return { alias: input.alias, sourceProvider: input.sourceProvider, cwd: input.cwd, name };
-    }
-    requireActiveNativeCodexListener() {
-        this.assertReady();
-        const active = this.activeNativeCodexListener;
-        if (active === undefined || active.lifecycle !== "active") {
-            throw new BridgeError("CLAUDE_CALLBACK_UNAVAILABLE", "The private Claude callback listener is unavailable.", true);
-        }
-        return active;
-    }
-    requireNativeCodexListenerGeneration(listenerGeneration, generation, lifecycle) {
-        if (listenerGeneration === undefined ||
-            listenerGeneration.generation !== generation ||
-            listenerGeneration.listener.generation !== generation ||
-            listenerGeneration.lifecycle !== lifecycle) {
-            throw new BridgeError("CODEX_PEER_SUCCESSION_GENERATION_MISMATCH", "The requested native Codex listener generation is not the exact lifecycle owner.");
-        }
-        return listenerGeneration;
-    }
-    requireNativeInboundReceiptOwner(receiptHandle) {
-        this.assertReady();
-        const owner = this.nativeInboundReceiptOwners.get(receiptHandle);
-        if (owner === undefined || !this.ownsNativeCodexListener(owner)) {
-            throw new BridgeError("CLAUDE_PEER_RECEIPT_UNKNOWN", "The native Claude peer receipt is unknown or already settled.");
-        }
-        return owner;
-    }
-    ownsNativeCodexListener(listenerGeneration) {
-        return (this.activeNativeCodexListener === listenerGeneration ||
-            this.preparedNativeCodexListener === listenerGeneration ||
-            this.retiredNativeCodexListener === listenerGeneration);
-    }
-    async onListenerMessage(listenerGeneration, message) {
-        const reject = async (diagnosticCode) => {
-            if (message.receiptHandle !== undefined) {
-                await this.rejectNativeInboundReceipt(listenerGeneration, message.receiptHandle, diagnosticCode);
-            }
-        };
-        if (this.unavailableCode !== undefined ||
-            this.closed ||
-            listenerGeneration.listener.closed ||
-            !this.ownsNativeCodexListener(listenerGeneration)) {
-            try {
-                if (message.receiptHandle !== undefined) {
-                    listenerGeneration.listener.releaseInboundReceipt(message.receiptHandle);
-                }
-            }
-            catch {
-                // A detached generation has no safe callback or settlement authority.
-            }
-            return;
-        }
-        if (this.activeNativeCodexListener !== listenerGeneration ||
-            listenerGeneration.lifecycle !== "active" ||
-            listenerGeneration.inboundQuiesced ||
-            this.nativeCodexSuccessionFreeze !== undefined) {
-            await reject("CLAUDE_NATIVE_GENERATION_STALE");
-            return;
-        }
-        const registrationAtIngress = listenerGeneration.registration;
-        if (message.sourceTargetId === undefined ||
-            message.sourceAlias === undefined ||
-            !message.replySupported) {
-            await reject("CLAUDE_SOURCE_ROUTE_INVALID");
-            return;
-        }
-        const sourceTargetId = message.sourceTargetId;
-        let sourceAlias;
-        try {
-            await this.refreshClaudeDiscovery();
-            const current = this.discovered.get(sourceTargetId);
-            const expectedAlias = `${message.sourceAlias}@${this.identity.hostId}`;
-            if (current?.alias === expectedAlias)
-                sourceAlias = expectedAlias;
-        }
-        catch {
-            sourceAlias = undefined;
-        }
-        // Discovery is asynchronous. Recheck exact generation ownership before
-        // giving the body or its receipt capability to a service callback.
-        if (this.activeNativeCodexListener !== listenerGeneration ||
-            listenerGeneration.lifecycle !== "active" ||
-            listenerGeneration.inboundQuiesced ||
-            this.nativeCodexSuccessionFreeze !== undefined ||
-            listenerGeneration.registration !== registrationAtIngress) {
-            await reject("CLAUDE_NATIVE_GENERATION_STALE");
-            return;
-        }
-        if (sourceAlias === undefined) {
-            await reject("CLAUDE_SOURCE_ROUTE_STALE");
-            return;
-        }
-        const callbacks = this.callbacks;
-        const registration = registrationAtIngress;
-        if (registration !== undefined) {
-            if (callbacks?.onClaudeMessage === undefined ||
-                (!this.nativeInbound.has(sourceTargetId) &&
-                    this.nativeInbound.size >= this.maxPending) ||
-                (message.receiptHandle !== undefined &&
-                    !this.nativeInboundReceiptOwners.has(message.receiptHandle) &&
-                    this.nativeInboundReceiptOwners.size >= this.maxPending)) {
-                await reject("CLAUDE_NATIVE_INGRESS_CAPACITY");
-                return;
-            }
-            if (message.receiptHandle !== undefined &&
-                this.nativeInboundReceiptOwners.has(message.receiptHandle)) {
-                await reject("CLAUDE_NATIVE_RECEIPT_COLLISION");
-                return;
-            }
-            this.nativeInbound.set(sourceTargetId, {
-                alias: sourceAlias,
-                listenerGeneration: listenerGeneration.generation,
-            });
-            if (message.receiptHandle !== undefined) {
-                this.nativeInboundReceiptOwners.set(message.receiptHandle, listenerGeneration);
-            }
-            if (listenerGeneration.registrationProvisional) {
-                listenerGeneration.provisionalIngressForwarded = true;
-            }
-            invokeCallback(() => callbacks.onClaudeMessage?.({
-                endpoint: callbackEndpoint(this.identity, sourceTargetId),
-                sourceAlias,
-                targetAlias: registration.alias,
-                text: message.content,
-                ...(message.receiptHandle === undefined
-                    ? {}
-                    : { receiptHandle: message.receiptHandle }),
-            }));
-            return;
-        }
-        if (callbacks !== undefined && this.selected.get(sourceTargetId) === sourceAlias) {
-            invokeCallback(() => callbacks.onClaudeReply({
-                endpoint: callbackEndpoint(this.identity, sourceTargetId),
-                text: message.content,
-            }));
-            return;
-        }
-        await reject("CLAUDE_ROUTE_UNAVAILABLE");
-    }
-    rejectNativeInboundReceipt(listenerGeneration, receiptHandle, diagnosticCode) {
-        const rejectionKey = `${listenerGeneration.generation}\0${receiptHandle}`;
-        const existing = this.rejectedNativeInbound.get(rejectionKey);
-        if (existing !== undefined)
-            return existing.operation;
-        const listener = listenerGeneration.listener;
-        if (this.closed ||
-            listener.closed ||
-            !this.ownsNativeCodexListener(listenerGeneration)) {
-            try {
-                listener.releaseInboundReceipt(receiptHandle);
-            }
-            catch {
-                // A missing/closing listener leaves no safe terminal write path.
-            }
-            return Promise.resolve();
-        }
-        const rejection = {
-            receiptHandle,
-            listener,
-            listenerGeneration: listenerGeneration.generation,
-            released: false,
-            operation: Promise.resolve(),
-        };
-        this.rejectedNativeInbound.set(rejectionKey, rejection);
-        rejection.operation = this.settleRejectedNativeInbound(rejection, diagnosticCode).finally(() => {
-            if (this.rejectedNativeInbound.get(rejectionKey) === rejection) {
-                this.rejectedNativeInbound.delete(rejectionKey);
-            }
-        });
-        return rejection.operation;
-    }
-    async settleRejectedNativeInbound(rejection, diagnosticCode) {
-        for (let attempt = 0; attempt <= CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS.length; attempt += 1) {
-            if (this.closed ||
-                rejection.released ||
-                rejection.listener.closed ||
-                !this.ownsNativeCodexListenerGeneration(rejection.listenerGeneration, rejection.listener)) {
-                this.releaseRejectedNativeInbound(rejection);
-                return;
-            }
-            try {
-                await rejection.listener.acknowledge(rejection.receiptHandle, "expired", { code: diagnosticCode });
-                return;
-            }
-            catch (error) {
-                if (rejection.released)
-                    return;
-                const cleanPrewrite = error instanceof BridgeError && error.recoverable;
-                if (!cleanPrewrite ||
-                    attempt === CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS.length) {
-                    // Ambiguous/nonrecoverable writes are never replayed. Explicit
-                    // release is idempotent even if the listener already consumed the
-                    // terminal capability after a possibly-written attempt.
-                    this.releaseRejectedNativeInbound(rejection);
-                    return;
-                }
-            }
-            await this.waitForRejectedNativeInboundRetry(rejection, CLAUDE_REJECTION_RECEIPT_RETRY_DELAYS_MS[attempt]);
-        }
-    }
-    ownsNativeCodexListenerGeneration(generation, listener) {
-        return [
-            this.activeNativeCodexListener,
-            this.preparedNativeCodexListener,
-            this.retiredNativeCodexListener,
-        ].some((candidate) => candidate?.generation === generation && candidate.listener === listener);
-    }
-    async waitForRejectedNativeInboundRetry(rejection, delayMs) {
-        await new Promise((resolve) => {
-            let settled = false;
-            const finish = () => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timer);
-                if (rejection.cancelRetry === finish) {
-                    delete rejection.cancelRetry;
-                }
-                resolve();
-            };
-            const timer = setTimeout(finish, delayMs);
-            rejection.cancelRetry = finish;
-            if (this.closed || rejection.released)
-                finish();
-        });
-    }
-    releaseRejectedNativeInbound(rejection) {
-        if (rejection.released)
-            return;
-        rejection.released = true;
-        rejection.cancelRetry?.();
-        try {
-            rejection.listener.releaseInboundReceipt(rejection.receiptHandle);
-        }
-        catch {
-            // The listener owns a bounded process-lifetime capability. Closing must
-            // remain best-effort even if its explicit release path is unavailable.
-        }
-    }
-    trackClaudeMessage(providerId, gatewayMessageId, targetId, deadline, listenerGeneration) {
-        if (this.pendingByProviderId.has(providerId) ||
-            this.providerIdByGatewayId.get(gatewayMessageId) !== "" ||
-            this.pendingByProviderId.size >= this.maxPending) {
-            return false;
-        }
-        const timer = setTimeout(() => {
-            const pending = this.pendingByProviderId.get(providerId);
-            if (pending === undefined)
-                return;
-            pending.listener.untrack(providerId);
-            if (pending.writeEvidence === "transport_written") {
-                this.finishClaudeMessage(providerId, "unconfirmed", "CLAUDE_RECEIPT_UNCONFIRMED");
-            }
-            else if (pending.writeEvidence === "transport_uncertain") {
-                this.finishClaudeMessage(providerId, "ambiguous", "CLAUDE_DISPATCH_OUTCOME_AMBIGUOUS");
-            }
-            else {
-                this.finishClaudeMessage(providerId, "expired", "MESSAGE_EXPIRED");
-            }
-        }, Math.max(1, deadline - this.now()));
-        timer.unref();
-        this.pendingByProviderId.set(providerId, {
-            gatewayMessageId,
-            listener: listenerGeneration.listener,
-            listenerGeneration: listenerGeneration.generation,
-            targetId,
-            writeEvidence: "none",
-            timer,
-        });
-        this.providerIdByGatewayId.set(gatewayMessageId, providerId);
-        return true;
-    }
-    abandonClaudeTracking(gatewayMessageId, providerId) {
-        if (providerId !== undefined) {
-            const pending = this.pendingByProviderId.get(providerId);
-            if (pending?.gatewayMessageId === gatewayMessageId) {
-                clearTimeout(pending.timer);
-                this.pendingByProviderId.delete(providerId);
-                pending.listener.untrack(providerId);
-            }
-        }
-        this.providerIdByGatewayId.delete(gatewayMessageId);
-        this.pendingTargetByGatewayId.delete(gatewayMessageId);
-    }
-    onReceipt(listenerGeneration, event) {
-        const pending = this.pendingByProviderId.get(event.messageId);
-        if (pending === undefined ||
-            pending.listenerGeneration !== listenerGeneration.generation ||
-            pending.listener !== listenerGeneration.listener) {
-            return;
-        }
-        if (event.status === "held") {
-            pending.writeEvidence = "transport_written";
-            this.emitDelivery({ messageId: pending.gatewayMessageId, state: "held" });
-            return;
-        }
-        // `released` is Claude's native approval-gate terminal: the frame reached
-        // the recipient queue. It does not claim a model read or task completion.
-        const state = event.status === "released"
-            ? "released"
-            : event.status === "denied"
-                ? "denied"
-                : event.status === "expired"
-                    ? "expired"
-                    : event.status === "unconfirmed"
-                        ? "unconfirmed"
-                        : "ambiguous";
-        this.finishClaudeMessage(event.messageId, state, event.status === "unconfirmed"
-            ? "CLAUDE_RECEIPT_UNCONFIRMED"
-            : undefined);
-    }
-    recordClaudeWriteEvidence(providerId, evidence) {
-        const pending = this.pendingByProviderId.get(providerId);
-        if (pending === undefined)
-            return false;
-        const previous = pending.writeEvidence;
-        if (pending.writeEvidence !== "transport_written" ||
-            evidence === "transport_written") {
-            pending.writeEvidence = evidence;
-        }
-        return pending.writeEvidence !== previous;
-    }
-    finishClaudeMessage(providerId, state, safeErrorCode) {
-        const pending = this.pendingByProviderId.get(providerId);
-        if (pending === undefined)
-            return;
-        clearTimeout(pending.timer);
-        this.pendingByProviderId.delete(providerId);
-        this.providerIdByGatewayId.delete(pending.gatewayMessageId);
-        this.pendingTargetByGatewayId.delete(pending.gatewayMessageId);
-        this.emitDelivery({
-            messageId: pending.gatewayMessageId,
-            state,
-            ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
-        });
-    }
-    emitDelivery(event) {
-        const callbacks = this.callbacks;
-        if (callbacks === undefined || this.closed)
-            return;
-        invokeCallback(() => callbacks.onDelivery(event));
-    }
-    async refreshClaudeDiscovery() {
-        if (this.discoveryInFlight !== undefined) {
-            return await this.discoveryInFlight;
-        }
-        const operation = this.refreshClaudeDiscoveryOnce();
-        this.discoveryInFlight = operation;
-        try {
-            return await operation;
-        }
-        finally {
-            if (this.discoveryInFlight === operation) {
-                this.discoveryInFlight = undefined;
-            }
-        }
-    }
-    async refreshClaudeDiscoveryOnce() {
-        const dispatchEpochAtStart = new Map();
-        for (const routeHandle of this.selected.keys()) {
-            dispatchEpochAtStart.set(routeHandle, this.selectedDispatchEpoch.get(routeHandle) ?? 0);
-        }
-        const pendingAtStart = new Set(this.pendingTargetByGatewayId.values());
-        let discovery;
-        try {
-            discovery = await this.peer.discover();
-        }
-        catch (error) {
-            this.registryObservation = unavailableClaudeRegistryObservation();
-            throw error;
-        }
-        const registry = claudeRegistryObservation(discovery);
-        this.registryObservation = registry;
-        this.discovered.clear();
-        const rows = [];
-        for (const peer of discovery.peers) {
-            if (peer.kind !== "interactive" ||
-                !NATIVE_CLAUDE_NAME.test(peer.alias)) {
-                continue;
-            }
-            const alias = `${peer.alias}@${this.identity.hostId}`;
-            if (!PUBLIC_ALIAS.test(alias))
-                continue;
-            const row = {
-                alias,
-                routeHandle: peer.targetId,
-                kind: "interactive",
-                state: claudeRouteState(peer),
-            };
-            this.discovered.set(peer.targetId, row);
-            rows.push(row);
-        }
-        for (const [routeHandle, selectedAlias] of this.selected) {
-            const row = this.discovered.get(routeHandle);
-            if (row === undefined) {
-                this.emitClaudeRouteObservation(routeHandle, "busy", "CLAUDE_PEER_NOT_OBSERVED", true);
-            }
-            else {
-                if (!discovery.truncated && row.alias !== selectedAlias) {
-                    // A Claude rename changes only the live name index. The native
-                    // session UUID remains the selected logical route. An incomplete
-                    // scan is display evidence only and cannot rename dispatch authority.
-                    this.selected.set(routeHandle, row.alias);
-                }
-                if (row.state === "idle" &&
-                    (pendingAtStart.has(routeHandle) ||
-                        this.hasPendingClaudeReceipt(routeHandle) ||
-                        dispatchEpochAtStart.get(routeHandle) !==
-                            (this.selectedDispatchEpoch.get(routeHandle) ?? 0))) {
-                    // Never publish an idle sample from a discovery that overlapped a
-                    // dispatch or its receipt lifetime. The dirty epoch remains set for
-                    // a wholly post-terminal discovery.
-                    continue;
-                }
-                this.emitClaudeRouteObservation(routeHandle, row.state, undefined, true);
-            }
-        }
-        return { peers: rows, complete: !discovery.truncated, registry };
-    }
-    emitClaudeRouteObservation(routeHandle, state, safeErrorCode, authoritative = false) {
-        if (this.nativeCodexSuccessionFreeze !== undefined)
-            return;
-        if (authoritative &&
-            state === "idle" &&
-            this.hasPendingClaudeReceipt(routeHandle)) {
-            // A registry peer can still report idle after our write but before it
-            // consumes the inbox frame. Preserve the dirty dispatch epoch so only a
-            // fresh discovery after exact terminal receipt can unlock this route.
-            return;
-        }
-        const signature = `${state}:${safeErrorCode ?? ""}`;
-        const mustPublish = authoritative && this.selectedObservationDirty.delete(routeHandle);
-        if (!mustPublish && this.selectedObservations.get(routeHandle) === signature) {
-            return;
-        }
-        this.selectedObservations.set(routeHandle, signature);
-        const callbacks = this.callbacks;
-        if (callbacks === undefined || this.closed)
-            return;
-        invokeCallback(() => callbacks.onRouteState({
-            endpoint: callbackEndpoint(this.identity, routeHandle),
-            state,
-            ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
-        }));
-    }
-    hasPendingClaudeReceipt(routeHandle) {
-        for (const targetId of this.pendingTargetByGatewayId.values()) {
-            if (targetId === routeHandle)
-                return true;
-        }
-        return false;
-    }
-    scheduleClaudeMonitor() {
-        if (this.closed ||
-            this.nativeCodexSuccessionFreeze !== undefined ||
-            this.selected.size === 0 ||
-            this.monitorTimer !== undefined) {
+    scheduleClaudeMonitor() {
+        if (this.closed ||
+            this.selected.size === 0 ||
+            this.monitorTimer !== undefined) {
             return;
         }
         this.monitorTimer = setTimeout(() => {
             this.monitorTimer = undefined;
             void this.refreshClaudeDiscovery()
                 .catch(() => {
-                if (this.nativeCodexSuccessionFreeze !== undefined)
-                    return;
                 for (const routeHandle of this.selected.keys()) {
                     this.emitClaudeRouteObservation(routeHandle, "busy", "CLAUDE_DISCOVERY_UNAVAILABLE");
                 }
@@ -1593,328 +562,167 @@ export class LocalClaudeGatewayProvider {
 export function createLocalClaudeGatewayProvider(options) {
     return new LocalClaudeGatewayProvider(options);
 }
-function validateCodexFactory(factory) {
-    if (factory.hostId !== LOCAL_HOST ||
-        factory.protocol !== "codex-app-server" ||
-        factory.protocolVersion !== factory.appServerVersion ||
-        factory.appServerVersion.length === 0 ||
-        factory.endpointGeneration.length === 0) {
-        throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The local Codex provider requires exact managed endpoint identity.");
-    }
+function boundedProviderOption(value, fallback, maximum) {
+    const candidate = value ?? fallback;
+    if (!Number.isSafeInteger(candidate) ||
+        candidate <= 0 ||
+        candidate > maximum) {
+        throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "The local Codex provider has an invalid bounded option.");
+    }
+    return candidate;
 }
-function codexRouteState(observation) {
-    if (observation.connection !== "ready")
-        return "stale";
-    if (observation.routeStatus === "idle")
-        return "idle";
-    if (observation.routeStatus === "waiting_approval") {
-        return "awaiting_approval";
-    }
-    if (observation.routeStatus === "starting" ||
-        observation.routeStatus === "active" ||
-        observation.routeStatus === "interrupting") {
-        return "busy";
+function cleanCodexResult(result) {
+    if (result.safeErrorCode === "MESSAGE_EXPIRED") {
+        return { state: "expired", safeErrorCode: "MESSAGE_EXPIRED" };
     }
-    // Unknown, not-loaded, uncertain, system-error, and explicit stale states
-    // are never cosmetic busy. They cannot authorize another write.
-    return "stale";
-}
-function codexRouteSafeCode(observation) {
-    if (codexRouteState(observation) === "stale") {
-        return "CODEX_ROUTE_STALE";
+    if (CODEX_CLEAN_RETRY_CODES.has(result.safeErrorCode)) {
+        return { state: "deferred", safeErrorCode: result.safeErrorCode };
     }
-    return undefined;
+    return { state: "failed", safeErrorCode: result.safeErrorCode };
 }
-export class LocalCodexGatewayProvider {
-    factory;
-    refreshFactory;
-    maxCallbacks;
-    maxRoutes;
-    maxReplyBytes;
-    cleanupPollMs;
-    cleanupTimeoutMs;
-    recoveryInitialMs;
-    recoveryMaxMs;
-    now;
-    routes = new Map();
-    /** Exact public alias authority retained across internal route recovery. */
-    routeAliases = new Map();
-    routeCreations = new Map();
-    routeReleases = new Map();
-    routeRecoveryAttempts = new Map();
-    routeRecoveryTimers = new Map();
-    routeRecoveries = new Map();
-    routesRequiringRecovery = new Set();
-    trackedRoutes = new Set();
-    retiredEndpointGeneration;
-    expectsReply = new Map();
-    callbackQueue = [];
-    callbackScheduled = false;
-    callbacks;
-    endpointRefresh;
-    endpointRefreshDelivery;
-    endpointActivationRetry;
-    endpointActivationRetryTimer;
-    callbackDrainFrozen = false;
-    endpointUnavailable = false;
-    pendingEndpointRefreshEvent;
-    pendingEndpointRefreshSelectorClaimed = false;
-    initialized = false;
-    closing = false;
-    closed = false;
-    constructor(options) {
-        validateCodexFactory(options.factory);
-        this.factory = options.factory;
-        this.refreshFactory = options.refreshFactory;
-        exactLocalHost(options.factory.hostId);
-        this.maxCallbacks = positiveBounded(options.maxCallbackEvents, MAX_CODEX_CALLBACKS, 4_096);
-        this.maxRoutes = positiveBounded(options.maxRoutes, MAX_CODEX_ROUTES, 256);
-        this.maxReplyBytes = positiveBounded(options.maxReplyBytes, MAX_TRANSIENT_REPLY_BYTES, 1024 * 1024);
-        this.cleanupPollMs = positiveBounded(options.cleanupPollMs, DEFAULT_CODEX_CLEANUP_POLL_MS, 1_000);
-        this.cleanupTimeoutMs = positiveBounded(options.cleanupTimeoutMs, DEFAULT_CODEX_CLEANUP_TIMEOUT_MS, 60_000);
-        if (this.cleanupPollMs >= this.cleanupTimeoutMs) {
-            throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "The cleanup polling interval must be shorter than its deadline.");
-        }
-        this.recoveryInitialMs = positiveBounded(options.recoveryInitialMs, DEFAULT_CODEX_RECOVERY_INITIAL_MS, 60_000);
-        this.recoveryMaxMs = positiveBounded(options.recoveryMaxMs, DEFAULT_CODEX_RECOVERY_MAX_MS, 5 * 60_000);
-        if (this.recoveryInitialMs > this.recoveryMaxMs) {
-            throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "The Codex recovery initial delay cannot exceed its capped delay.");
-        }
-        this.now = options.now ?? (() => new Date());
+function terminalCodexResult(result, expectsReply) {
+    if (result.outcome === "failed") {
+        return { state: "failed", safeErrorCode: "CODEX_TURN_FAILED" };
     }
-    get identity() {
-        return {
-            provider: "codex",
-            hostId: exactLocalHost(this.factory.hostId),
-            endpointGeneration: this.factory.endpointGeneration,
-        };
-    }
-    get protocol() {
-        return this.factory.protocol;
-    }
-    get protocolVersion() {
-        return this.factory.protocolVersion;
-    }
-    activateEndpointGeneration(endpointGeneration) {
-        const event = this.pendingEndpointRefreshEvent;
-        if (event === undefined ||
-            event.current.endpointGeneration !== endpointGeneration ||
-            this.factory.endpointGeneration !== endpointGeneration) {
-            throw new BridgeError("CODEX_ENDPOINT_ACTIVATION_MISMATCH", "Only the exact pending managed Codex generation can be activated.");
-        }
-        this.pendingEndpointRefreshEvent = undefined;
-        this.pendingEndpointRefreshSelectorClaimed = false;
-        this.clearEndpointActivationRetry();
-        this.endpointUnavailable = false;
-    }
-    releaseEndpointRefreshSelectorClaim(endpointGeneration) {
-        const event = this.pendingEndpointRefreshEvent;
-        if (event?.current.endpointGeneration === endpointGeneration) {
-            this.pendingEndpointRefreshSelectorClaimed = false;
-        }
+    if (result.outcome === "interrupted") {
+        return { state: "cancelled", safeErrorCode: "CODEX_TURN_INTERRUPTED" };
     }
-    rearmEndpointRefreshActivation(endpointGeneration) {
-        const event = this.pendingEndpointRefreshEvent;
-        if (event?.current.endpointGeneration === endpointGeneration &&
-            !this.closing &&
-            !this.closed) {
-            this.publishEndpointRefresh(event);
-        }
-    }
-    async initialize(callbacks) {
-        if (this.closed || this.initialized) {
-            throw new BridgeError("CODEX_PROVIDER_INITIALIZATION_REJECTED", "The local Codex provider cannot be initialized in this state.");
-        }
-        this.callbacks = callbacks;
-        this.initialized = true;
-        return { health: "healthy" };
+    return {
+        state: "delivered",
+        ...(result.replyCode === "REPLY_TOO_LARGE"
+            ? { safeErrorCode: "CODEX_REPLY_TOO_LARGE" }
+            : {}),
+        ...(expectsReply && result.replyText !== null
+            ? { replyText: result.replyText }
+            : {}),
+    };
+}
+function mapCodexStartResult(result, expectsReply) {
+    if (result.phase === "clean")
+        return cleanCodexResult(result);
+    if (result.phase === "armed") {
+        return { state: "ambiguous", safeErrorCode: result.safeErrorCode };
     }
-    async selectRoute(input) {
-        if (!this.initialized || this.closing || this.closed) {
-            throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider is unavailable.", true);
-        }
-        if (!PUBLIC_ALIAS.test(input.alias) ||
-            !input.alias.endsWith(`@${this.identity.hostId}`)) {
-            throw new BridgeError("CODEX_ALIAS_MISMATCH", "The Codex alias is outside the exact local provider boundary.");
-        }
-        if (!OPAQUE_ROUTE.test(input.routeHandle)) {
-            throw new BridgeError("CODEX_ROUTE_INVALID", "The Codex task identifier is outside the exact provider boundary.");
-        }
-        const retainedAlias = this.routeAliases.get(input.routeHandle);
-        if (retainedAlias !== undefined && retainedAlias !== input.alias) {
-            throw new BridgeError("CODEX_ALIAS_MISMATCH", "The Codex route is already bound to another exact public alias.");
-        }
-        this.cancelRouteRecovery(input.routeHandle);
-        let refreshResult;
-        let selectorRefreshReserved = false;
-        let route;
-        const stageRefreshedRoute = async (result) => {
-            if (result === undefined) {
-                throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex endpoint replacement could not be established.");
-            }
-            refreshResult = result;
-            selectorRefreshReserved = this.reserveSelectorRefresh(result);
-            if (!selectorRefreshReserved) {
-                throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The Codex endpoint replacement is awaiting controller activation.", true);
-            }
-            try {
-                return await this.ensureRoute(input.routeHandle, false, true);
-            }
-            catch (selectionError) {
-                this.emitSelectorRefreshFallback(result, input.routeHandle);
-                throw selectionError;
-            }
-        };
-        const retainedEndpointRefresh = this.retainedEndpointRefreshResult();
-        if (this.endpointRefresh !== undefined) {
-            route = await stageRefreshedRoute(await this.refreshEndpoint("selector"));
-        }
-        else if (retainedEndpointRefresh !== undefined) {
-            route = await stageRefreshedRoute(retainedEndpointRefresh);
-        }
-        else if (this.endpointUnavailable &&
-            this.pendingEndpointRefreshEvent === undefined) {
-            route = await stageRefreshedRoute(await this.refreshEndpoint("selector"));
-        }
-        else {
-            this.assertReady();
-            try {
-                route = await this.ensureRoute(input.routeHandle);
-            }
-            catch (error) {
-                const refreshPending = error instanceof BridgeError &&
-                    error.code === "CODEX_ENDPOINT_REFRESH_PENDING";
-                if (!this.isEndpointGenerationChanged(error) && !refreshPending) {
-                    throw error;
-                }
-                if (this.isEndpointGenerationChanged(error)) {
-                    this.endpointUnavailable = true;
-                    route = await stageRefreshedRoute(await this.refreshEndpoint("selector"));
-                }
-                else if (this.endpointRefresh !== undefined) {
-                    route = await stageRefreshedRoute(await this.refreshEndpoint("selector"));
-                }
-                else {
-                    throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The Codex endpoint replacement is awaiting controller activation.", true);
-                }
-            }
-            if (refreshResult === undefined &&
-                (route.endpointGeneration !== this.factory.endpointGeneration ||
-                    this.endpointUnavailable ||
-                    this.endpointRefresh !== undefined)) {
-                if (this.endpointRefresh === undefined) {
-                    throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The Codex endpoint replacement is awaiting controller activation.", true);
-                }
-                route = await stageRefreshedRoute(await this.refreshEndpoint("selector"));
-            }
-        }
-        const observation = route.connector.observation();
-        const state = codexRouteState(observation);
-        if (state === "stale") {
-            if (refreshResult !== undefined && selectorRefreshReserved) {
-                // Publish the transition before any asynchronous connector cleanup so
-                // the controller can accept or durably reject the exact replacement
-                // generation. A route which closed after refresh staging is not valid
-                // re-anchoring evidence and must be removed from both the callback and
-                // its retained retry authority.
-                this.emitSelectorRefreshFallback(refreshResult, input.routeHandle);
-            }
-            this.routesRequiringRecovery.add(input.routeHandle);
-            await this.releaseRouteInternal(input.routeHandle);
-            if (this.trackedRoutes.has(input.routeHandle)) {
-                this.scheduleRouteRecovery(input.routeHandle);
-            }
-            throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task connection closed during route selection.");
+    if (result.phase === "accepted") {
+        return { state: "unconfirmed", safeErrorCode: result.safeErrorCode };
+    }
+    return terminalCodexResult(result, expectsReply);
+}
+function mapCodexSteerResult(result) {
+    if (result.phase === "clean")
+        return cleanCodexResult(result);
+    if (result.phase === "armed") {
+        return { state: "ambiguous", safeErrorCode: result.safeErrorCode };
+    }
+    return { state: "delivered" };
+}
+/**
+ * Thin logical Codex adapter. Registration and construction perform no App
+ * Server I/O. Each semantic operation owns a fresh attested transport, while
+ * the independent observer publishes only best-effort in-memory freshness.
+ */
+export class LocalCodexGatewayProvider {
+    hostId;
+    operation;
+    observationPollMs;
+    observationTimeoutMs;
+    observationBackoffMaxMs;
+    maxObservedRoutes;
+    now;
+    timers;
+    observedRoutes = new Map();
+    activeTurns = new Map();
+    inFlightOperations = new Set();
+    operationControllers = new Set();
+    callbacks;
+    observationTimer;
+    observationInFlight;
+    observationController;
+    initialized = false;
+    closing = false;
+    closed = false;
+    constructor(options) {
+        if (options.hostId !== LOCAL_HOST ||
+            options.operation === undefined ||
+            typeof options.operation.execute !== "function") {
+            throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "The stateless Codex provider requires the exact local host.");
+        }
+        this.hostId = options.hostId;
+        this.operation = options.operation;
+        this.observationPollMs = boundedProviderOption(options.observationPollMs, DEFAULT_CODEX_OBSERVATION_POLL_MS, 60_000);
+        this.observationTimeoutMs = boundedProviderOption(options.observationTimeoutMs, DEFAULT_CODEX_OBSERVATION_TIMEOUT_MS, 60_000);
+        this.observationBackoffMaxMs = boundedProviderOption(options.observationBackoffMaxMs, DEFAULT_CODEX_OBSERVATION_BACKOFF_MAX_MS, 5 * 60_000);
+        if (this.observationPollMs > this.observationBackoffMaxMs) {
+            throw new BridgeError("INVALID_GATEWAY_PROVIDER_CONFIGURATION", "Codex observer backoff must cover its polling interval.");
+        }
+        this.maxObservedRoutes = boundedProviderOption(options.maxObservedRoutes, MAX_CODEX_OBSERVED_ROUTES, 256);
+        this.now = options.now ?? (() => new Date());
+        this.timers = options.timers ?? {
+            setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
+            clearTimeout: (timer) => clearTimeout(timer),
+        };
+    }
+    get identity() {
+        return { provider: "codex", hostId: this.hostId };
+    }
+    get protocol() {
+        return "codex-app-server";
+    }
+    get protocolVersion() {
+        return "stateless-v1";
+    }
+    async initialize(callbacks) {
+        if (this.initialized || this.closing || this.closed) {
+            throw new BridgeError("CODEX_PROVIDER_INITIALIZATION_REJECTED", "The stateless Codex provider cannot initialize in this state.");
         }
-        this.trackedRoutes.add(input.routeHandle);
-        this.routeAliases.set(input.routeHandle, input.alias);
-        if (refreshResult === undefined) {
-            this.queueRouteObservation(route, observation);
+        this.callbacks = callbacks;
+        this.initialized = true;
+        this.scheduleObservation();
+        return { health: "healthy" };
+    }
+    observeLogicalRoute(input) {
+        if (!this.initialized ||
+            this.closing ||
+            this.closed ||
+            !PUBLIC_ALIAS.test(input.alias) ||
+            !input.alias.endsWith("@" + this.hostId) ||
+            !OPAQUE_ROUTE.test(input.routeHandle) ||
+            !OPAQUE_ROUTE.test(input.registrationId)) {
+            return;
         }
-        const endpointRefresh = refreshResult === undefined || !selectorRefreshReserved
-            ? undefined
-            : refreshResult.event;
-        if (endpointRefresh !== undefined) {
-            this.armEndpointActivationRetry(endpointRefresh);
+        const existing = this.observedRoutes.get(input.registrationId);
+        if (existing === undefined &&
+            this.observedRoutes.size >= this.maxObservedRoutes) {
+            return;
         }
-        return {
-            routeHandle: input.routeHandle,
-            state,
-            ...(endpointRefresh === undefined ? {} : { endpointRefresh }),
-        };
+        this.observedRoutes.set(input.registrationId, {
+            ...input,
+            attempt: 0,
+            nextAt: this.now().getTime(),
+        });
+        this.scheduleObservation();
     }
-    observeRouteSuccessionBarrier(routeHandle) {
-        if (!this.initialized || this.closing || this.closed) {
-            throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider is unavailable.", true);
-        }
-        const route = this.routes.get(routeHandle);
-        const observation = route?.connector.observation();
-        const routeCreationInFlight = this.routeCreations.has(routeHandle) ||
-            this.routeRecoveries.has(routeHandle) ||
-            (this.endpointRefresh !== undefined && this.trackedRoutes.has(routeHandle)) ||
-            this.pendingEndpointActivationClaims(routeHandle);
-        const routeReleaseInFlight = this.routeReleases.has(routeHandle);
-        const pendingReplyCorrelations = this.expectsReply.size;
-        const pendingCallbacks = Math.max(this.callbackQueue.length, this.callbackScheduled ? 1 : 0);
-        const routePresent = route !== undefined;
-        const connection = observation?.connection ?? "absent";
-        const routeStatus = observation?.routeStatus ?? "absent";
-        const queueDepth = observation?.queueDepth ?? 0;
-        const hasActiveTurn = observation?.hasActiveTurn ?? false;
-        const requestInFlight = observation?.requestInFlight ?? false;
-        return {
-            routePresent,
-            connection,
-            routeStatus,
-            queueDepth,
-            hasActiveTurn,
-            requestInFlight,
-            routeCreationInFlight,
-            routeReleaseInFlight,
-            pendingReplyCorrelations,
-            pendingCallbacks,
-            clean: routePresent &&
-                connection === "ready" &&
-                routeStatus === "idle" &&
-                queueDepth === 0 &&
-                !hasActiveTurn &&
-                !requestInFlight &&
-                !routeCreationInFlight &&
-                !routeReleaseInFlight &&
-                pendingReplyCorrelations === 0 &&
-                pendingCallbacks === 0,
-        };
+    forgetLogicalRoute(registrationId) {
+        this.observedRoutes.delete(registrationId);
+        this.activeTurns.delete(registrationId);
+        this.scheduleObservation();
     }
     async dispatch(input) {
         if (!this.initialized ||
             this.closing ||
             this.closed ||
-            this.endpointUnavailable ||
-            this.endpointRefresh !== undefined ||
             input.authorization !== "selected_route" ||
-            !sameEndpoint(input.binding, this.identity)) {
-            return { state: "failed", safeErrorCode: "CODEX_ROUTE_UNAVAILABLE" };
-        }
-        const route = this.routes.get(input.binding.routeHandle);
-        if (route === undefined ||
-            this.routeAliases.get(input.binding.routeHandle) !== input.targetAlias ||
-            this.routeReleases.has(input.binding.routeHandle) ||
-            route.endpointGeneration !== input.binding.endpointGeneration ||
-            route.endpointGeneration !== this.factory.endpointGeneration) {
+            input.binding.provider !== "codex" ||
+            input.binding.hostId !== this.hostId ||
+            !PUBLIC_ALIAS.test(input.targetAlias) ||
+            !input.targetAlias.endsWith("@" + this.hostId)) {
             return { state: "failed", safeErrorCode: "CODEX_ROUTE_UNAVAILABLE" };
         }
-        const guard = route.connector.guard();
-        if (strictDeadline(input.deadlineAt, this.now().getTime()) === undefined) {
-            return { state: "failed", safeErrorCode: "MESSAGE_EXPIRED" };
-        }
-        if (this.expectsReply.has(input.messageId)) {
-            return { state: "failed", safeErrorCode: "CODEX_MESSAGE_DUPLICATE" };
-        }
         let content;
         try {
             content = composeProvenanceEnvelope({
                 sourceProvider: input.sourceProvider,
-                recipientProvider: this.identity.provider,
+                recipientProvider: "codex",
                 sourceAlias: input.sourceAlias,
                 targetAlias: input.targetAlias,
                 conversationId: input.conversationId,
@@ -1928,838 +736,233 @@ export class LocalCodexGatewayProvider {
             });
         }
         catch (error) {
-            const safeErrorCode = error instanceof BridgeError &&
-                (error.code === "PROVENANCE_ENVELOPE_INVALID" ||
-                    error.code === "PROVENANCE_ENVELOPE_TOO_LARGE")
-                ? error.code
-                : "PROVENANCE_ENVELOPE_INVALID";
-            return { state: "failed", safeErrorCode };
+            return {
+                state: "failed",
+                safeErrorCode: error instanceof BridgeError &&
+                    error.code === "PROVENANCE_ENVELOPE_TOO_LARGE"
+                    ? error.code
+                    : "PROVENANCE_ENVELOPE_INVALID",
+            };
         }
-        this.expectsReply.set(input.messageId, input.expectsReply);
-        try {
-            const disposition = await route.connector.submitMessage(guard, {
+        if (input.steer === true) {
+            const active = this.activeTurns.get(input.binding.registrationId);
+            if (active === undefined ||
+                active.alias !== input.targetAlias ||
+                active.routeHandle !== input.binding.routeHandle) {
+                return { state: "deferred", safeErrorCode: "ROUTE_BUSY" };
+            }
+            const steering = active.accepted.steer({
+                attemptId: input.attemptId,
+                authorizeWrite: async (evidence) => await input.authorizeWrite({
+                    attemptId: input.attemptId,
+                    kind: "codex_turn_steer",
+                    bodyBytes: Buffer.byteLength(input.text, "utf8"),
+                    bodySha256: createHash("sha256").update(input.text).digest("hex"),
+                    frameBytes: evidence.frameBytes,
+                    sha256: evidence.sha256,
+                }),
                 deadlineAt: input.deadlineAt,
-                messageId: input.messageId,
-                ...(input.steer === true ? { steer: true } : {}),
                 text: content,
             });
-            if (disposition.disposition === "deferred") {
-                this.expectsReply.delete(input.messageId);
-                return { state: "deferred", safeErrorCode: "CODEX_ROUTE_HELD" };
-            }
-            if (disposition.disposition === "steered") {
-                this.expectsReply.delete(input.messageId);
-                return { state: "delivered" };
-            }
-            return { state: "accepted" };
-        }
-        catch (error) {
-            if (!this.expectsReply.has(input.messageId)) {
-                // The connector synchronously handed off an exact terminal result.
-                return { state: "pending" };
-            }
-            this.expectsReply.delete(input.messageId);
-            if (error instanceof CodexConnectorError && error.ambiguous) {
-                return {
-                    state: "ambiguous",
-                    safeErrorCode: "CODEX_DISPATCH_OUTCOME_AMBIGUOUS",
-                };
-            }
-            if (error instanceof CodexConnectorError &&
-                [
-                    "ROUTE_NOT_READY",
-                    "ROUTE_BUSY",
-                ].includes(error.code)) {
-                return { state: "deferred", safeErrorCode: "CODEX_ROUTE_HELD" };
-            }
-            return { state: "failed", safeErrorCode: "CODEX_DISPATCH_REJECTED" };
-        }
-    }
-    async releaseRoute(routeHandle) {
-        if (this.pendingEndpointActivationClaims(routeHandle)) {
-            throw new BridgeError("CODEX_ENDPOINT_ACTIVATION_PENDING", "The exact Codex route still belongs to an unaccepted endpoint transition.", true);
-        }
-        this.trackedRoutes.delete(routeHandle);
-        this.cancelRouteRecovery(routeHandle);
-        const recovery = this.routeRecoveries.get(routeHandle);
-        if (recovery !== undefined)
-            await recovery;
-        const endpointRefresh = this.endpointRefresh;
-        if (endpointRefresh !== undefined)
-            await endpointRefresh;
-        if (this.pendingEndpointActivationClaims(routeHandle)) {
-            throw new BridgeError("CODEX_ENDPOINT_ACTIVATION_PENDING", "The exact Codex route acquired endpoint-transition authority during release.", true);
-        }
-        await this.releaseRouteInternal(routeHandle);
-        this.routeAliases.delete(routeHandle);
-    }
-    async releaseRouteInternal(routeHandle) {
-        const pending = this.routeReleases.get(routeHandle);
-        if (pending !== undefined)
-            return await pending;
-        const route = this.routes.get(routeHandle);
-        if (route === undefined)
-            return;
-        const release = this.closeRoute(route).then(() => {
-            if (this.routes.get(routeHandle) === route) {
-                this.routes.delete(routeHandle);
-            }
+            this.inFlightOperations.add(steering);
+            try {
+                return mapCodexSteerResult(await steering);
+            }
+            finally {
+                this.inFlightOperations.delete(steering);
+            }
+        }
+        if (this.activeTurns.has(input.binding.registrationId)) {
+            return { state: "deferred", safeErrorCode: "ROUTE_BUSY" };
+        }
+        let accepted;
+        const controller = new AbortController();
+        this.operationControllers.add(controller);
+        const operation = this.operation.execute({
+            attemptId: input.attemptId,
+            authorizeWrite: async (evidence) => await input.authorizeWrite({
+                attemptId: input.attemptId,
+                kind: "codex_turn_start",
+                bodyBytes: Buffer.byteLength(input.text, "utf8"),
+                bodySha256: createHash("sha256").update(input.text).digest("hex"),
+                frameBytes: evidence.frameBytes,
+                sha256: evidence.sha256,
+            }),
+            deadlineAt: input.deadlineAt,
+            kind: "start",
+            signal: controller.signal,
+            route: {
+                alias: input.targetAlias,
+                hostId: input.binding.hostId,
+                registrationId: input.binding.registrationId,
+                threadId: input.binding.routeHandle,
+            },
+            text: content,
+            onAccepted: async (current) => {
+                if (this.closing ||
+                    this.closed ||
+                    current.attemptId !== input.attemptId ||
+                    this.activeTurns.has(input.binding.registrationId)) {
+                    throw new BridgeError("ACCEPTANCE_UNCONFIRMED", "The exact Codex attempt cannot acquire its active-turn slot.");
+                }
+                await input.onAccepted({ attemptId: input.attemptId });
+                accepted = current;
+                this.activeTurns.set(input.binding.registrationId, {
+                    attemptId: input.attemptId,
+                    accepted: current,
+                    alias: input.targetAlias,
+                    routeHandle: input.binding.routeHandle,
+                });
+            },
         });
-        this.routeReleases.set(routeHandle, release);
+        this.inFlightOperations.add(operation);
         try {
-            await release;
+            const result = await operation;
+            this.publishOperationObservation(input, result);
+            return mapCodexStartResult(result, input.expectsReply);
         }
         finally {
-            this.routeReleases.delete(routeHandle);
+            this.inFlightOperations.delete(operation);
+            this.operationControllers.delete(controller);
+            if (accepted !== undefined &&
+                this.activeTurns.get(input.binding.registrationId)?.attemptId ===
+                    input.attemptId) {
+                this.activeTurns.delete(input.binding.registrationId);
+            }
         }
     }
     async close() {
         if (this.closed || this.closing)
             return;
         this.closing = true;
-        for (const timer of this.routeRecoveryTimers.values())
-            clearTimeout(timer);
-        this.routeRecoveryTimers.clear();
-        this.routesRequiringRecovery.clear();
-        this.clearEndpointActivationRetry();
-        this.pendingEndpointRefreshEvent = undefined;
-        this.pendingEndpointRefreshSelectorClaimed = false;
-        const refreshResult = this.endpointRefresh === undefined
-            ? []
-            : await Promise.allSettled([this.endpointRefresh]);
-        const entries = [...this.routes.entries()];
-        const routeResults = await Promise.allSettled(entries.map(async ([routeHandle]) => this.releaseRoute(routeHandle)));
-        await Promise.allSettled([
-            ...this.routeRecoveries.values(),
-            ...this.routeCreations.values(),
-        ]);
-        this.drainCallbackQueue();
-        if (refreshResult.some((result) => result.status === "rejected") ||
-            routeResults.some((result) => result.status === "rejected")) {
-            this.closing = false;
-            throw new BridgeError("CODEX_PROVIDER_CLEANUP_FAILED", "An exact owned Codex turn did not confirm termination.");
-        }
-        try {
-            await this.factory.close();
-        }
-        catch {
-            this.closing = false;
-            throw new BridgeError("CODEX_PROVIDER_CLEANUP_FAILED", "An exact owned Codex provider process did not confirm cleanup.");
-        }
+        if (this.observationTimer !== undefined) {
+            this.timers.clearTimeout(this.observationTimer);
+            this.observationTimer = undefined;
+        }
+        this.observationController?.abort();
+        for (const controller of this.operationControllers)
+            controller.abort();
+        await this.observationInFlight?.catch(() => undefined);
+        for (const operation of this.inFlightOperations) {
+            void operation.catch(() => undefined);
+        }
+        this.operationControllers.clear();
+        this.activeTurns.clear();
+        this.observedRoutes.clear();
+        this.callbacks = undefined;
+        this.initialized = false;
         this.closed = true;
         this.closing = false;
-        this.callbackQueue.length = 0;
-        this.pendingEndpointRefreshEvent = undefined;
-        this.pendingEndpointRefreshSelectorClaimed = false;
-        this.trackedRoutes.clear();
-        this.routeAliases.clear();
-        this.expectsReply.clear();
-        this.callbacks = undefined;
     }
-    assertReady() {
+    publishOperationObservation(input, result) {
+        const state = !result.cleanupConfirmed
+            ? { state: "unobserved", safeErrorCode: "CLEANUP_FAILED" }
+            : result.phase === "terminal"
+                ? { state: "idle" }
+                : result.safeErrorCode === "ROUTE_BUSY"
+                    ? { state: "busy" }
+                    : result.safeErrorCode === "APPROVAL_REQUIRED"
+                        ? { state: "awaiting_approval" }
+                        : result.safeErrorCode === "THREAD_NOT_OBSERVED"
+                            ? {
+                                state: "unobserved",
+                                safeErrorCode: "THREAD_NOT_OBSERVED",
+                            }
+                            : {
+                                state: "unobserved",
+                                safeErrorCode: "CODEX_OBSERVER_UNAVAILABLE",
+                            };
+        this.emitObservation({
+            alias: input.targetAlias,
+            registrationId: input.binding.registrationId,
+            routeHandle: input.binding.routeHandle,
+        }, state);
+    }
+    scheduleObservation() {
         if (!this.initialized ||
             this.closing ||
             this.closed ||
-            this.endpointUnavailable ||
-            this.endpointRefresh !== undefined) {
-            throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider is unavailable.", true);
-        }
-    }
-    async ensureRoute(threadId, queueInitialObservation = true, allowPendingEndpointActivation = false) {
-        if (allowPendingEndpointActivation) {
-            if (!this.initialized || this.closing || this.closed) {
-                throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider is unavailable.", true);
-            }
-        }
-        else {
-            this.assertReady();
-        }
-        const pendingRelease = this.routeReleases.get(threadId);
-        if (pendingRelease !== undefined) {
-            await pendingRelease;
-            return await this.ensureRoute(threadId, queueInitialObservation, allowPendingEndpointActivation);
-        }
-        const existing = this.routes.get(threadId);
-        if (existing !== undefined) {
-            if (existing.connector.observation().connection === "ready") {
-                return existing;
-            }
-            // A cached connector cannot recover after its transport closes or the
-            // protocol faults. Fully release that exact connector before constructing
-            // a fresh one. The identity-checked release lets automatic recovery and
-            // an explicit selector join the same cleanup safely.
-            await this.releaseRouteInternal(threadId);
-            return await this.ensureRoute(threadId, queueInitialObservation, allowPendingEndpointActivation);
-        }
-        const pending = this.routeCreations.get(threadId);
-        if (pending !== undefined)
-            return await pending;
-        if (this.routes.size + this.routeCreations.size >= this.maxRoutes) {
-            throw new BridgeError("CODEX_ROUTE_CAPACITY", "The bounded local Codex route table is full.", true);
-        }
-        const admittedFactory = this.factory;
-        const creation = (async () => {
-            const route = await this.createRoute(threadId, admittedFactory, queueInitialObservation);
-            if (this.closing || this.closed) {
-                await this.closeRoute(route);
-                throw new BridgeError("CODEX_PROVIDER_UNAVAILABLE", "The local Codex provider closed during route creation.");
-            }
-            if (!allowPendingEndpointActivation &&
-                (this.endpointUnavailable ||
-                    this.endpointRefresh !== undefined ||
-                    admittedFactory !== this.factory ||
-                    route.endpointGeneration !== this.factory.endpointGeneration)) {
-                await this.closeRoute(route);
-                throw new BridgeError("CODEX_ENDPOINT_REFRESH_PENDING", "The Codex endpoint moved during exact route creation.", true);
-            }
-            this.routes.set(threadId, route);
-            return route;
-        })();
-        this.routeCreations.set(threadId, creation);
-        try {
-            return await creation;
-        }
-        finally {
-            this.routeCreations.delete(threadId);
-        }
-    }
-    async createRoute(threadId, factory, queueInitialObservation) {
-        let transport;
-        let connector;
-        const generation = Symbol(threadId);
-        try {
-            transport = await factory.connectTransport();
-            connector = await CodexAppServerConnector.connect({
-                compatibility: { endpointGeneration: factory.endpointGeneration },
-                route: {
-                    endpointGeneration: factory.endpointGeneration,
-                    threadId,
-                },
-                transport,
-                maxReplyBytes: this.maxReplyBytes,
-                now: this.now,
-                onEvent: (event) => this.onConnectorEvent(threadId, generation, event),
-                onTurnResult: (result) => this.onTurnResult(factory.endpointGeneration, result),
-            });
-            const loaded = await connector.observeLoadedThread(connector.guard());
-            if (!loaded.selectedThreadLoaded) {
-                throw new BridgeError("CODEX_THREAD_NOT_OBSERVED", "The exact opted-in Codex task is not loaded on this endpoint.");
-            }
-            await connector.resumeThread(connector.guard());
-            const route = {
-                connector,
-                endpointGeneration: factory.endpointGeneration,
-                generation,
-                threadId,
-                transport,
-            };
-            if (queueInitialObservation) {
-                this.queueRouteObservation(route, connector.observation());
-            }
-            return route;
-        }
-        catch (error) {
-            let cleanupFailure;
-            if (connector !== undefined) {
-                await connector.close().catch((closeError) => {
-                    cleanupFailure = closeError;
-                });
-            }
-            else if (transport !== undefined) {
-                await transport.close().catch((closeError) => {
-                    cleanupFailure = closeError;
-                });
-            }
-            if (cleanupFailure !== undefined) {
-                if (isCodexTrustFailure(cleanupFailure))
-                    throw cleanupFailure;
-                throw new BridgeError("CODEX_ROUTE_CLEANUP_FAILED", "Codex route setup could not prove exact provider-process cleanup.");
-            }
-            if (isCodexTrustFailure(error))
-                throw error;
-            if (error instanceof BridgeError)
-                throw error;
-            if (error instanceof CodexConnectorError) {
-                throw new BridgeError(error.ambiguous
-                    ? "CODEX_ROUTE_SETUP_AMBIGUOUS"
-                    : "CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task could not be safely observed and resumed.");
-            }
-            throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task could not be safely observed and resumed.");
-        }
-    }
-    onConnectorEvent(threadId, generation, event) {
-        const route = this.routes.get(threadId);
-        if (route === undefined || route.generation !== generation)
+            this.observationInFlight !== undefined) {
             return;
-        this.queueRouteObservation(route, event);
-        if (event.kind === "protocol_fault" ||
-            (event.kind === "connection_closed" &&
-                event.details?.errorCode !== undefined) ||
-            (event.kind === "route_status_changed" &&
-                codexRouteState(event) === "stale")) {
-            this.routesRequiringRecovery.add(threadId);
-            this.scheduleRouteRecovery(threadId);
         }
-    }
-    scheduleRouteRecovery(threadId) {
-        if (this.closed ||
-            this.closing ||
-            !this.routesRequiringRecovery.has(threadId) ||
-            this.routeRecoveryTimers.has(threadId) ||
-            this.routeRecoveries.has(threadId)) {
-            return;
+        if (this.observationTimer !== undefined) {
+            this.timers.clearTimeout(this.observationTimer);
+            this.observationTimer = undefined;
         }
-        const attempt = this.routeRecoveryAttempts.get(threadId) ?? 0;
-        const delay = Math.min(this.recoveryMaxMs, this.recoveryInitialMs * 2 ** Math.min(attempt, 16));
-        const timer = setTimeout(() => {
-            if (this.routeRecoveryTimers.get(threadId) !== timer)
+        const next = [...this.observedRoutes.values()].reduce((selected, candidate) => selected === undefined || candidate.nextAt < selected.nextAt
+            ? candidate
+            : selected, undefined);
+        if (next === undefined)
+            return;
+        const delay = Math.max(0, next.nextAt - this.now().getTime());
+        const timer = this.timers.setTimeout(() => {
+            if (this.observationTimer !== timer)
                 return;
-            this.routeRecoveryTimers.delete(threadId);
-            const recovery = this.recoverRoute(threadId);
-            this.routeRecoveries.set(threadId, recovery);
-            void recovery.finally(() => {
-                if (this.routeRecoveries.get(threadId) === recovery) {
-                    this.routeRecoveries.delete(threadId);
-                }
-                this.scheduleRouteRecovery(threadId);
+            this.observationTimer = undefined;
+            const operation = this.runObservation(next);
+            this.observationInFlight = operation;
+            void operation.finally(() => {
+                if (this.observationInFlight === operation) {
+                    this.observationInFlight = undefined;
+                }
+                this.scheduleObservation();
             });
         }, delay);
         timer.unref();
-        this.routeRecoveryTimers.set(threadId, timer);
-    }
-    async recoverRoute(threadId) {
-        if (this.closed ||
-            this.closing ||
-            !this.routesRequiringRecovery.has(threadId)) {
-            return;
-        }
-        try {
-            if (this.endpointUnavailable) {
-                if (this.pendingEndpointRefreshEvent !== undefined) {
-                    throw new BridgeError("CODEX_ENDPOINT_REFRESH_PENDING", "The replacement Codex endpoint is awaiting controller activation.", true);
-                }
-                const refreshed = await this.refreshEndpoint("callback");
-                if (refreshed?.event.routes.some((route) => route.routeHandle === threadId)) {
-                    this.routesRequiringRecovery.delete(threadId);
-                    this.routeRecoveryAttempts.delete(threadId);
-                    return;
-                }
-                throw new BridgeError("CODEX_ENDPOINT_REFRESH_PENDING", "The replacement Codex endpoint is not ready.", true);
-            }
-            const current = this.routes.get(threadId);
-            if (current !== undefined &&
-                codexRouteState(current.connector.observation()) === "stale") {
-                await this.releaseRouteInternal(threadId);
-            }
-            if (!this.routesRequiringRecovery.has(threadId))
-                return;
-            const replacement = await this.ensureRoute(threadId);
-            if (!this.routesRequiringRecovery.has(threadId)) {
-                // An explicit selector can join this exact creation after cancelling
-                // automatic recovery. In that case the replacement is now operator-
-                // owned and must remain live. Explicit release waits for this recovery
-                // promise before closing any late-created replacement.
-                return;
-            }
-            this.routesRequiringRecovery.delete(threadId);
-            this.routeRecoveryAttempts.delete(threadId);
-            this.queueRouteObservation(replacement, replacement.connector.observation());
-        }
-        catch (error) {
-            if (this.isEndpointGenerationChanged(error)) {
-                this.endpointUnavailable = true;
-                const refreshed = await this.refreshEndpoint("callback").catch(() => undefined);
-                if (refreshed?.event.routes.some((route) => route.routeHandle === threadId)) {
-                    this.routesRequiringRecovery.delete(threadId);
-                    this.routeRecoveryAttempts.delete(threadId);
-                    return;
-                }
-            }
-            this.routeRecoveryAttempts.set(threadId, (this.routeRecoveryAttempts.get(threadId) ?? 0) + 1);
-        }
-    }
-    cancelRouteRecovery(threadId) {
-        this.routesRequiringRecovery.delete(threadId);
-        this.routeRecoveryAttempts.delete(threadId);
-        const timer = this.routeRecoveryTimers.get(threadId);
-        if (timer !== undefined)
-            clearTimeout(timer);
-        this.routeRecoveryTimers.delete(threadId);
-    }
-    isEndpointGenerationChanged(error) {
-        return (error instanceof LocalCodexTransportError &&
-            error.code === "ENDPOINT_GENERATION_CHANGED");
-    }
-    pendingEndpointActivationClaims(routeHandle) {
-        const event = this.pendingEndpointRefreshEvent;
-        return (event !== undefined &&
-            event.current.endpointGeneration === this.factory.endpointGeneration &&
-            event.routes.some((route) => route.routeHandle === routeHandle));
-    }
-    retainedEndpointRefreshResult() {
-        const event = this.pendingEndpointRefreshEvent;
-        if (event === undefined ||
-            this.pendingEndpointRefreshSelectorClaimed ||
-            event.current.endpointGeneration !== this.factory.endpointGeneration) {
-            return undefined;
-        }
-        return {
-            event,
-            delivery: "selector",
-            selectorClaimed: false,
-            published: true,
-        };
-    }
-    async refreshEndpoint(delivery) {
-        if (this.refreshFactory === undefined || this.closing || this.closed) {
-            return undefined;
-        }
-        const existing = this.endpointRefresh;
-        if (existing !== undefined) {
-            // A selector already running inside the controller lock takes ownership
-            // of the transition result. This avoids waiting on a callback that needs
-            // that same lock while still ensuring exactly one activation path.
-            if (delivery === "selector")
-                this.endpointRefreshDelivery = "selector";
-            return await existing;
-        }
-        this.endpointRefreshDelivery = delivery;
-        const refresh = this.performEndpointRefresh();
-        this.endpointRefresh = refresh;
+        this.observationTimer = timer;
+    }
+    async runObservation(route) {
+        const controller = new AbortController();
+        this.observationController = controller;
+        let observation;
+        const timeout = this.timers.setTimeout(() => controller.abort(), this.observationTimeoutMs);
+        timeout.unref();
         try {
-            return await refresh;
-        }
-        finally {
-            if (this.endpointRefresh === refresh) {
-                this.endpointRefresh = undefined;
-                this.endpointRefreshDelivery = undefined;
-            }
-        }
-    }
-    async performEndpointRefresh() {
-        const refreshFactory = this.refreshFactory;
-        if (refreshFactory === undefined)
-            return undefined;
-        const previousFactory = this.factory;
-        const previous = this.identity;
-        let candidate;
-        try {
-            const resolved = await this.resolveEndpointRefreshCandidate(refreshFactory, previousFactory, previous);
-            candidate = resolved.factory;
-            await this.retireEndpointGeneration(previousFactory, previous.endpointGeneration);
-            if (this.closing || this.closed) {
-                await candidate.close();
-                candidate = undefined;
-                return undefined;
-            }
-            const replacementFactory = candidate;
-            const refreshedRoutes = [];
-            const stagedRoutes = [];
-            for (const routeHandle of [...this.trackedRoutes]) {
-                if (this.closing || this.closed)
-                    break;
-                try {
-                    const route = await this.createRoute(routeHandle, replacementFactory, false);
-                    if (this.closing || this.closed) {
-                        await this.closeRoute(route);
-                        break;
-                    }
-                    const state = codexRouteState(route.connector.observation());
-                    if (state === "stale") {
-                        await this.closeRoute(route);
-                        throw new BridgeError("CODEX_ROUTE_SETUP_REJECTED", "The exact Codex task was stale on the replacement endpoint.");
-                    }
-                    stagedRoutes.push({ routeHandle, route, state });
-                }
-                catch (error) {
-                    this.routesRequiringRecovery.add(routeHandle);
-                    if (isCodexTrustFailure(error))
-                        throw error;
-                }
-            }
-            if (this.closing || this.closed) {
-                await replacementFactory.close();
-                candidate = undefined;
-                return undefined;
-            }
-            this.factory = replacementFactory;
-            candidate = undefined;
-            this.retiredEndpointGeneration = undefined;
-            this.endpointUnavailable = true;
-            for (const staged of stagedRoutes) {
-                this.routes.set(staged.routeHandle, staged.route);
-                this.routesRequiringRecovery.delete(staged.routeHandle);
-                this.routeRecoveryAttempts.delete(staged.routeHandle);
-                refreshedRoutes.push({
-                    routeHandle: staged.routeHandle,
-                    state: staged.state,
-                });
-            }
-            const result = {
-                event: {
-                    previous,
-                    current: this.identity,
-                    routes: refreshedRoutes,
-                },
-                delivery: this.endpointRefreshDelivery ?? "callback",
-                selectorClaimed: false,
-                published: false,
-            };
-            this.pendingEndpointRefreshEvent = result.event;
-            this.pendingEndpointRefreshSelectorClaimed = false;
-            if (result.delivery === "callback") {
-                result.selectorClaimed = true;
-                result.published = true;
-                this.publishEndpointRefresh(result.event);
-            }
-            for (const routeHandle of this.routesRequiringRecovery) {
-                if (this.trackedRoutes.has(routeHandle)) {
-                    this.scheduleRouteRecovery(routeHandle);
-                }
-            }
-            return result;
-        }
-        catch (error) {
-            if (candidate !== undefined && candidate !== previousFactory) {
-                await candidate.close();
-            }
-            throw error;
+            observation = await this.operation.observe({
+                alias: route.alias,
+                hostId: this.hostId,
+                registrationId: route.registrationId,
+                threadId: route.routeHandle,
+            }, controller.signal);
         }
         finally {
-            if (this.callbackDrainFrozen) {
-                this.callbackDrainFrozen = false;
-                this.drainCallbackQueue();
-            }
-        }
-    }
-    async resolveEndpointRefreshCandidate(refreshFactory, previousFactory, previous) {
-        for (let attempt = 0; attempt < MAX_CODEX_ENDPOINT_REFRESH_CANDIDATES; attempt += 1) {
-            let candidate;
-            try {
-                candidate = await refreshFactory();
-                validateCodexFactory(candidate);
-                if (candidate.hostId !== previous.hostId ||
-                    candidate.protocol !== previousFactory.protocol) {
-                    throw new BridgeError("CODEX_FACTORY_ATTESTATION_INVALID", "The replacement Codex factory moved outside its pinned boundary.");
-                }
-                if (candidate === previousFactory ||
-                    candidate.endpointGeneration === previous.endpointGeneration) {
-                    if (candidate !== previousFactory)
-                        await candidate.close();
-                    candidate = undefined;
-                    if (attempt + 1 < MAX_CODEX_ENDPOINT_REFRESH_CANDIDATES) {
-                        continue;
-                    }
-                    throw new BridgeError("CODEX_ENDPOINT_GENERATION_CHURN", "The Codex endpoint did not stabilize within its bounded refresh window.", true);
-                }
-                return { factory: candidate };
-            }
-            catch (error) {
-                if (candidate !== undefined && candidate !== previousFactory) {
-                    await candidate.close();
-                }
-                if (this.isEndpointGenerationChanged(error)) {
-                    if (attempt + 1 < MAX_CODEX_ENDPOINT_REFRESH_CANDIDATES) {
-                        continue;
-                    }
-                    throw new BridgeError("CODEX_ENDPOINT_GENERATION_CHURN", "The Codex endpoint did not stabilize within its bounded refresh window.", true);
-                }
-                throw error;
-            }
-        }
-        throw new BridgeError("CODEX_ENDPOINT_GENERATION_CHURN", "The Codex endpoint did not stabilize within its bounded refresh window.", true);
-    }
-    async retireEndpointGeneration(factory, endpointGeneration) {
-        this.callbackDrainFrozen = true;
-        this.drainCallbackQueue(true);
-        // Fence every operation admitted on the previous immutable factory.
-        // Ordinary route creation is blocked by endpointRefresh; joining these
-        // exact promises ensures none can be inserted after the close sweep.
-        await Promise.allSettled([...this.routeCreations.values()]);
-        await Promise.allSettled([...this.routeReleases.values()]);
-        this.drainCallbackQueue(true);
-        for (const [routeHandle, route] of [...this.routes]) {
-            if (route.endpointGeneration !== endpointGeneration)
-                continue;
-            await this.closeRoute(route);
-            if (this.routes.get(routeHandle) === route) {
-                this.routes.delete(routeHandle);
-            }
-        }
-        this.drainCallbackQueue(true);
-        await factory.close();
-        this.drainCallbackQueue(true);
-        this.retiredEndpointGeneration = endpointGeneration;
-    }
-    reserveSelectorRefresh(result) {
-        if (result.delivery !== "selector" || result.selectorClaimed) {
-            return false;
-        }
-        result.selectorClaimed = true;
-        if (this.pendingEndpointRefreshEvent === result.event) {
-            this.pendingEndpointRefreshSelectorClaimed = true;
-        }
-        return true;
-    }
-    emitSelectorRefreshFallback(result, staleRouteHandle) {
-        if (result.delivery !== "selector" || !result.selectorClaimed)
-            return;
-        if (result.published)
-            return;
-        let event = result.event;
-        if (staleRouteHandle !== undefined &&
-            event.routes.some((route) => route.routeHandle === staleRouteHandle)) {
-            event = {
-                ...event,
-                routes: event.routes.filter((route) => route.routeHandle !== staleRouteHandle),
-            };
-            result.event = event;
-            this.pendingEndpointRefreshEvent = event;
-        }
-        result.published = true;
-        this.publishEndpointRefresh(event);
-    }
-    publishEndpointRefresh(event) {
-        this.emitEndpointRefresh(event);
-        this.armEndpointActivationRetry(event);
-    }
-    armEndpointActivationRetry(event) {
-        this.clearEndpointActivationRetry();
-        this.endpointActivationRetry = { event, attempt: 0 };
-        this.scheduleEndpointActivationRetry();
-    }
-    scheduleEndpointActivationRetry() {
-        const pending = this.endpointActivationRetry;
-        if (pending === undefined ||
-            this.closing ||
-            this.closed ||
-            pending.attempt >= 3 ||
-            this.pendingEndpointRefreshEvent !== pending.event) {
-            this.clearEndpointActivationRetry();
-            return;
-        }
-        const delay = Math.max(DEFAULT_CODEX_RECOVERY_INITIAL_MS, Math.min(this.recoveryMaxMs, this.recoveryInitialMs * 2 ** pending.attempt));
-        const timer = setTimeout(() => {
-            if (this.endpointActivationRetryTimer !== timer)
-                return;
-            this.endpointActivationRetryTimer = undefined;
-            const current = this.endpointActivationRetry;
-            if (current === undefined || current.event !== pending.event)
-                return;
-            if (this.pendingEndpointRefreshEvent !== current.event) {
-                this.clearEndpointActivationRetry();
-                return;
-            }
-            this.emitEndpointRefresh(current.event);
-            if (this.endpointActivationRetry === undefined ||
-                this.endpointActivationRetry.event !== current.event) {
-                return;
-            }
-            this.endpointActivationRetry = {
-                event: current.event,
-                attempt: current.attempt + 1,
-            };
-            this.scheduleEndpointActivationRetry();
-        }, delay);
-        timer.unref();
-        this.endpointActivationRetryTimer = timer;
-    }
-    clearEndpointActivationRetry() {
-        if (this.endpointActivationRetryTimer !== undefined) {
-            clearTimeout(this.endpointActivationRetryTimer);
-        }
-        this.endpointActivationRetryTimer = undefined;
-        this.endpointActivationRetry = undefined;
-    }
-    emitEndpointRefresh(event) {
-        const callbacks = this.callbacks;
-        if (callbacks?.onEndpointRefresh === undefined)
-            return;
-        invokeCallback(() => callbacks.onEndpointRefresh?.(event));
-    }
-    onTurnResult(endpointGeneration, result) {
-        const wantsReply = this.expectsReply.get(result.messageId) === true;
-        this.expectsReply.delete(result.messageId);
-        let replyText;
-        if (wantsReply && result.text !== null) {
-            const bytes = Buffer.from(result.text, "utf8");
-            if (bytes.length <= this.maxReplyBytes) {
-                replyText = Buffer.from(bytes).toString("utf8");
-            }
-        }
-        const state = result.outcome === "completed"
-            ? "completed"
-            : result.outcome === "interrupted"
-                ? "cancelled"
-                : result.outcome === "expired"
-                    ? "expired"
-                    : result.outcome === "failed"
-                        ? "failed"
-                        : "ambiguous";
-        const safeErrorCode = result.outcome === "completed"
-            ? result.replyCode === "REPLY_TOO_LARGE"
-                ? "CODEX_REPLY_TOO_LARGE"
-                : undefined
-            : result.outcome === "expired"
-                ? "MESSAGE_EXPIRED"
-                : result.outcome === "interrupted"
-                    ? "CODEX_TURN_INTERRUPTED"
-                    : result.outcome === "failed"
-                        ? "CODEX_TURN_FAILED"
-                        : "CODEX_DELIVERY_AMBIGUOUS";
-        this.enqueueCodexCallback({
-            type: "delivery",
-            endpointGeneration,
-            value: {
-                messageId: result.messageId,
-                state,
-                ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
-                ...(replyText === undefined ? {} : { replyText }),
+            this.timers.clearTimeout(timeout);
+            if (this.observationController === controller) {
+                this.observationController = undefined;
+            }
+        }
+        const current = this.observedRoutes.get(route.registrationId);
+        if (current !== route || this.closing || this.closed)
+            return;
+        const failed = observation.state === "unobserved";
+        current.attempt = failed ? Math.min(current.attempt + 1, 16) : 0;
+        const delay = failed
+            ? Math.min(this.observationBackoffMaxMs, this.observationPollMs * 2 ** Math.max(0, current.attempt - 1))
+            : this.observationPollMs;
+        current.nextAt = this.now().getTime() + delay;
+        this.emitObservation(current, observation);
+    }
+    emitObservation(route, observation) {
+        const current = this.observedRoutes.get(route.registrationId);
+        if (this.callbacks === undefined ||
+            current === undefined ||
+            current.alias !== route.alias ||
+            current.routeHandle !== route.routeHandle) {
+            return;
+        }
+        invokeCallback(() => this.callbacks.onRouteState({
+            route: {
+                provider: "codex",
+                hostId: this.hostId,
+                routeHandle: route.routeHandle,
+                registrationId: route.registrationId,
             },
-        });
-    }
-    queueRouteObservation(route, observation) {
-        this.enqueueCodexCallback({
-            type: "route",
-            endpointGeneration: route.endpointGeneration,
-            generation: route.generation,
-            routeHandle: route.threadId,
-            state: codexRouteState(observation),
-            ...(codexRouteSafeCode(observation) === undefined
+            state: observation.state,
+            observedAt: this.now().toISOString(),
+            ...(observation.safeErrorCode === undefined
                 ? {}
-                : { safeErrorCode: codexRouteSafeCode(observation) }),
-        });
-    }
-    enqueueCodexCallback(event) {
-        if (this.closed)
-            return;
-        if (this.callbackQueue.length >= this.maxCallbacks) {
-            const routeIndex = this.callbackQueue.findIndex((candidate) => candidate.type === "route");
-            if (routeIndex >= 0) {
-                this.callbackQueue.splice(routeIndex, 1);
-            }
-            else {
-                // The callback consumer is synchronous and itself queues safely. Drain
-                // one exact terminal handoff before accepting another; never drop one.
-                this.drainOneCallback();
-            }
-        }
-        this.callbackQueue.push(event);
-        if (this.callbackDrainFrozen)
-            return;
-        if (this.callbackScheduled)
-            return;
-        this.callbackScheduled = true;
-        queueMicrotask(() => {
-            this.callbackScheduled = false;
-            this.drainCallbackQueue();
-        });
-    }
-    drainOneCallback() {
-        const event = this.callbackQueue.shift();
-        const callbacks = this.callbacks;
-        if (event === undefined || callbacks === undefined)
-            return;
-        if (event.endpointGeneration !== this.factory.endpointGeneration ||
-            this.retiredEndpointGeneration === event.endpointGeneration) {
-            return;
-        }
-        if (event.type === "delivery") {
-            invokeCallback(() => callbacks.onDelivery(event.value));
-        }
-        else {
-            if (this.routes.get(event.routeHandle)?.generation !== event.generation) {
-                return;
-            }
-            invokeCallback(() => callbacks.onRouteState({
-                endpoint: callbackEndpoint({
-                    provider: "codex",
-                    hostId: this.identity.hostId,
-                    endpointGeneration: event.endpointGeneration,
-                }, event.routeHandle),
-                state: event.state,
-                ...(event.safeErrorCode === undefined
-                    ? {}
-                    : { safeErrorCode: event.safeErrorCode }),
-            }));
-        }
-    }
-    drainCallbackQueue(force = false) {
-        if (this.callbackDrainFrozen && !force)
-            return;
-        while (this.callbackQueue.length > 0)
-            this.drainOneCallback();
-    }
-    async closeRoute(route) {
-        let observation = route.connector.observation();
-        if (observation.connection === "ready") {
-            try {
-                route.connector.cancelQueuedMessages(route.connector.guard());
-            }
-            catch {
-                throw new BridgeError("CODEX_PROVIDER_CLEANUP_AMBIGUOUS", "The exact Codex queue could not be safely cancelled.");
-            }
-            let guard = route.connector.guard();
-            let externalTurnObserved = false;
-            if (guard.activeTurnId !== null &&
-                (guard.status === "active" || guard.status === "waiting_approval")) {
-                try {
-                    await route.connector.interruptOwnedTurn(guard);
-                }
-                catch (error) {
-                    if (error instanceof CodexConnectorError &&
-                        error.code === "TURN_NOT_OWNED") {
-                        // An approval request or turn notification can expose another
-                        // Desktop client's turn ID. The connector verifies ownership
-                        // before issuing RPC, so release must detach without waiting for
-                        // or attempting to control that external work.
-                        externalTurnObserved = true;
-                    }
-                    else {
-                        throw new BridgeError("CODEX_PROVIDER_CLEANUP_AMBIGUOUS", "The exact bridge-owned Codex turn did not confirm interruption.");
-                    }
-                }
-            }
-            if (!externalTurnObserved) {
-                guard = await this.waitForOwnedTurnToSettle(route.connector);
-                observation = route.connector.observation();
-                if (guard.activeTurnId !== null ||
-                    observation.hasActiveTurn ||
-                    observation.queueDepth !== 0) {
-                    throw new BridgeError("CODEX_PROVIDER_CLEANUP_AMBIGUOUS", "The exact bridge-owned Codex work did not reach a terminal state.");
-                }
-                if (observation.routeStatus !== "active" &&
-                    observation.routeStatus !== "waiting_approval" &&
-                    observation.routeStatus !== "starting" &&
-                    observation.routeStatus !== "interrupting") {
-                    await route.connector
-                        .unsubscribeThread(route.connector.guard())
-                        .catch(() => undefined);
-                }
-            }
-        }
-        await route.connector.close();
-        if (!route.transport.cleanupConfirmed) {
-            await route.transport.close();
-        }
-        if (!route.transport.cleanupConfirmed) {
-            throw new BridgeError("CODEX_PROVIDER_CLEANUP_FAILED", "The exact owned Codex proxy did not confirm termination.");
-        }
-    }
-    async waitForOwnedTurnToSettle(connector) {
-        const deadline = Date.now() + this.cleanupTimeoutMs;
-        while (true) {
-            const guard = connector.guard();
-            if (guard.activeTurnId === null)
-                return guard;
-            if (connector.observation().connection !== "ready" ||
-                Date.now() >= deadline) {
-                throw new BridgeError("CODEX_PROVIDER_CLEANUP_TIMEOUT", "The exact bridge-owned Codex turn did not confirm termination before the cleanup deadline.");
-            }
-            await new Promise((resolve) => {
-                setTimeout(resolve, this.cleanupPollMs);
-            });
-        }
+                : { safeErrorCode: observation.safeErrorCode }),
+        }));
     }
 }
 export function createLocalCodexGatewayProvider(options) {