agent-embassy 1.7.0 → 1.8.0

package/dist/src/gateway/service.d.ts

@@ -1,29 +1,17 @@
 import type { GatewayConfig } from "./config.js";
 import { type GatewayControlHandlers, type GatewaySnapshotObservation } from "./control.js";
 import { publishGatewayDashboard } from "./dashboard.js";
+import type { CodexDoctorResult } from "./codex-doctor.js";
 import { GatewayStore } from "./store.js";
-import { type GatewayProvider, type GatewayPublicSnapshot, type PrivateEndpointIdentity, type PrivateRouteBinding, type RouteState } from "./types.js";
-export type GatewayAdapterRouteState = Extract<RouteState, "idle" | "busy" | "awaiting_approval">;
-export type GatewayAdapterRouteObservationState = GatewayAdapterRouteState | "stale";
-export type GatewayAdapterDiscovery = {
-    /** Canonical public alias. The service never lowercases or truncates it. */
+import { type GatewayPreparedWriteEvidence, type GatewayProvider, type GatewayPublicSnapshot, type LogicalRouteBinding } from "./types.js";
+export type GatewayAdapterRouteState = "idle" | "busy" | "awaiting_approval";
+export type GatewayAdapterRouteObservationState = GatewayAdapterRouteState | "unobserved";
+export type GatewayAdapterDiscovery = Readonly<{
     alias: string;
-    /** Stable provider identity; for Claude this is its native session UUID. */
     routeHandle: string;
     kind: "interactive";
     state: GatewayAdapterRouteState;
-};
-/**
- * One bounded discovery pass. `complete` is false when the provider stopped
- * before it could inspect the full registry; such a pass may be displayed but
- * cannot authorize selection restoration.
- */
-export type GatewayAdapterDiscoverySnapshot = {
-    peers: readonly GatewayAdapterDiscovery[];
-    complete: boolean;
-    /** Bounded registry-shape evidence; never carries record contents or paths. */
-    registry?: GatewayAdapterRegistryObservation;
-};
+}>;
 export type GatewayAdapterRegistryObservation = Readonly<{
     entriesScanned: number;
     parseableRecords: number;
@@ -32,223 +20,129 @@ export type GatewayAdapterRegistryObservation = Readonly<{
         count: number;
     }>[];
 }>;
-export type GatewayAdapterDeliveryState = "transport_uncertain" | "transport_written" | "held" | "released" | "unconfirmed" | "denied" | "expired" | "ambiguous" | "completed" | "failed" | "cancelled";
-export type GatewayAdapterDelivery = {
-    messageId: string;
-    state: GatewayAdapterDeliveryState;
+export type GatewayAdapterDiscoverySnapshot = Readonly<{
+    peers: readonly GatewayAdapterDiscovery[];
+    complete: boolean;
+    registry?: GatewayAdapterRegistryObservation;
+}>;
+export type GatewayAdapterRouteObservation = Readonly<{
+    route: LogicalRouteBinding;
+    state: GatewayAdapterRouteObservationState;
+    observedAt: string;
     safeErrorCode?: string;
-    /** Transient, bounded by the adapter. Never copied into normalized state. */
-    replyText?: string;
-};
-/**
- * One provider-wide Codex endpoint transition. Native thread and generation
- * identifiers stay inside this controller boundary and are never projected.
- */
-export type GatewayAdapterEndpointRefresh = Readonly<{
-    previous: PrivateEndpointIdentity;
-    current: PrivateEndpointIdentity;
-    routes: readonly Readonly<{
-        routeHandle: string;
-        state: GatewayAdapterRouteState;
-    }>[];
 }>;
-export type GatewayAdapterCallbacks = {
-    onDelivery: (event: GatewayAdapterDelivery) => void;
-    onRouteState: (event: {
-        endpoint: PrivateEndpointIdentity & {
-            routeHandle: string;
-        };
-        state: GatewayAdapterRouteObservationState;
-        safeErrorCode?: string;
-    }) => void;
-    /** A callback user frame has no conversation ID; correlation is service-owned. */
-    onClaudeReply: (event: {
-        endpoint: PrivateEndpointIdentity & {
-            routeHandle: string;
-        };
+export type GatewayAdapterNativeEndpoint = Readonly<{
+    provider: GatewayProvider;
+    hostId: string;
+    routeHandle: string;
+}>;
+export type GatewayAdapterCallbacks = Readonly<{
+    onRouteState: (event: GatewayAdapterRouteObservation) => void;
+    onClaudeReply: (event: Readonly<{
+        endpoint: GatewayAdapterNativeEndpoint;
         text: string;
-    }) => void;
-    onClaudeMessage?: (event: {
-        endpoint: PrivateEndpointIdentity & {
-            routeHandle: string;
-        };
+    }>) => void;
+    onClaudeMessage?: (event: Readonly<{
+        endpoint: GatewayAdapterNativeEndpoint;
         sourceAlias: string;
         targetAlias: string;
         text: string;
         receiptHandle?: string;
-    }) => void;
-    /** Bounded provider protocol diagnostics; never includes raw frame data. */
-    onProtocolNotice?: (event: {
+    }>) => void;
+    onProtocolNotice?: (event: Readonly<{
         code: string;
-    }) => void;
-    /** Provider-wide exact Codex endpoint-generation replacement. */
-    onEndpointRefresh?: (event: GatewayAdapterEndpointRefresh) => void;
-};
-export type GatewayAdapterStart = {
+    }>) => void;
+}>;
+export type GatewayAdapterStart = Readonly<{
     health: "healthy" | "degraded";
     safeErrorCode?: string;
-    /** One config-declared, Embassy-owned route observed without spawning. */
     ownedRoute?: Readonly<{
         alias: string;
         routeHandle: string;
         state: GatewayAdapterRouteState;
     }>;
-};
-export type GatewayAdapterDispatchResult = {
-    state: "pending";
-}
-/** Provider accepted the turn, but its final result/reply remains pending. */
- | {
-    state: "accepted";
-} | {
+}>;
+export type GatewayAdapterDispatchResult = Readonly<{
     state: "deferred";
     safeErrorCode?: string;
-} | {
-    state: "delivered" | "unconfirmed" | "failed" | "ambiguous" | "cancelled";
+}> | Readonly<{
+    state: "delivered" | "unconfirmed" | "failed" | "ambiguous" | "expired" | "cancelled";
     safeErrorCode?: string;
     replyText?: string;
-};
-/**
- * One transient, service-authorized provider dispatch. Provenance fields are
- * carried beside the raw body so the provider can frame it exactly once at
- * its semantic write boundary. They must not be projected or persisted.
- */
-export type GatewayAdapterDispatchInput = {
+}>;
+export type GatewayAdapterDispatchInput = Readonly<{
+    attemptId: string;
     sourceAlias: string;
     sourceProvider: GatewayProvider;
     targetAlias: string;
     conversationId: string;
-    binding: PrivateRouteBinding;
+    binding: LogicalRouteBinding;
     authorization: "selected_route" | "native_reply";
     messageId: string;
     text: string;
     expectsReply: boolean;
     deadlineAt: string;
     steer?: true;
-    /** Broker-derived display metadata; never grants or persists authority. */
     progressWatchActive?: true;
-    /** Older accepted rows observed when this exact STEER left the queue. */
     queuedAhead?: number;
-};
-/**
- * Narrow provider boundary. Production adapters wrap ClaudePeerAdapter or one
- * exact CodexAppServerConnector; tests use in-memory fakes. Implementations
- * must never retry a dispatch after a write may have occurred.
- */
+    authorizeWrite: (evidence: GatewayPreparedWriteEvidence & Readonly<{
+        attemptId: string;
+    }>) => Promise<boolean>;
+    onAccepted: (evidence: Readonly<{
+        attemptId: string;
+    }>) => Promise<void>;
+}>;
 export interface GatewayProviderAdapter {
-    readonly identity: PrivateEndpointIdentity;
+    readonly identity: Readonly<{
+        provider: GatewayProvider;
+        hostId: string;
+    }>;
     readonly protocol: string;
     readonly protocolVersion: string;
-    /** Latest already-read Claude registry evidence; this accessor performs no I/O. */
     latestRegistryObservation?(): GatewayAdapterRegistryObservation | undefined;
-    /** Releases the provider's exact current-generation activation latch. */
-    activateEndpointGeneration(endpointGeneration: string): void;
-    /** Releases one selector claim after controller-side activation fails. */
-    releaseEndpointRefreshSelectorClaim?(endpointGeneration: string): void;
-    /** Re-publishes pending transition evidence on one observed recovery edge. */
-    rearmEndpointRefreshActivation?(endpointGeneration: string): void;
     initialize(callbacks: GatewayAdapterCallbacks): Promise<GatewayAdapterStart>;
+    observeLogicalRoute?(input: Readonly<{
+        alias: string;
+        routeHandle: string;
+        registrationId: string;
+    }>): void;
+    forgetLogicalRoute?(registrationId: string): void;
     discoverClaudePeers?(): Promise<GatewayAdapterDiscoverySnapshot>;
-    selectRoute(input: {
+    selectRoute?(input: Readonly<{
         alias: string;
         routeHandle: string;
-    }): Promise<{
+    }>): Promise<{
         routeHandle: string;
         state: GatewayAdapterRouteState;
-        endpointRefresh?: GatewayAdapterEndpointRefresh;
     }>;
-    /** Claude-only workspace guard. Codex registration has no workspace gate. */
     assertWorkspaceDisjoint?(routeHandle: string, stateRoot: string): Promise<void>;
-    /** Converts a UDS connect-back capability to an exact already-observed handle. */
     resolveReplyAddress?(address: string): Promise<{
         routeHandle: string;
     }>;
-    advertiseNativeSourcePeer?(input: {
+    advertiseNativeSourcePeer?(input: Readonly<{
         alias: string;
         sourceProvider: GatewayProvider;
         cwd: string;
-    }): Promise<void>;
+    }>): Promise<void>;
     unadvertiseNativeSourcePeer?(alias: string): Promise<void>;
     updateNativeSourcePeerStatus?(alias: string, status: "idle" | "busy" | "waiting"): Promise<void>;
     updateNativeInboundStatus?(receiptHandle: string, status: "held" | "delivered" | "denied" | "expired", diagnosticCode?: string): Promise<void>;
-    notifyNativeInboundProgress?(receiptHandle: string, progress: {
+    notifyNativeInboundProgress?(receiptHandle: string, progress: Readonly<{
         kind: "stall";
-        reason: "ROUTE_BUSY" | "ROUTE_UNAVAILABLE" | "CODEX_ROUTE_STALE" | "AWAITING_EXTERNAL_APPROVAL";
+        reason: "ROUTE_BUSY" | "ROUTE_UNAVAILABLE" | "AWAITING_EXTERNAL_APPROVAL";
         queuedForMs: number;
-    }): Promise<void>;
-    releaseNativeInboundReceipt?(receiptHandle: string): boolean | Promise<boolean>;
-    /** Fence new native ingress while keeping receipt writes available. */
-    quiesceNativeInbound?(): Promise<void>;
-    /** Claude-only exact listener-generation succession controls. */
-    currentNativeCodexPeerGeneration?(alias: string): string;
-    prepareNativeCodexPeerGeneration?(input: {
-        alias: string;
-        cwd: string;
-        generation: string;
-        currentGeneration?: string;
-    }): Promise<void>;
-    quiesceNativeCodexPeerGeneration?(generation: string): Promise<void>;
-    observeNativeCodexSuccessionBarrier?(generation: string): Readonly<{
-        generation: string;
-        activeGenerationMatched: boolean;
-        ingressQuiesced: boolean;
-        monitorFrozen: boolean;
-        discoveryInFlight: boolean;
-        pendingOutboundReceipts: number;
-        pendingInboundReceipts: number;
-        rejectedInboundSettlements: number;
-        clean: boolean;
-    }> | Promise<Readonly<{
-        generation: string;
-        activeGenerationMatched: boolean;
-        ingressQuiesced: boolean;
-        monitorFrozen: boolean;
-        discoveryInFlight: boolean;
-        pendingOutboundReceipts: number;
-        pendingInboundReceipts: number;
-        rejectedInboundSettlements: number;
-        clean: boolean;
-    }>>;
-    publishPreparedNativeCodexPeer?(input: {
-        currentGeneration: string;
-        preparedGeneration: string;
-    }): Promise<"published" | "not_published" | "unknown">;
-    activatePreparedNativeCodexPeerGeneration?(generation: string): void | Promise<void>;
-    cleanupPreparedNativeCodexPeerGeneration?(generation: string): Promise<void>;
-    resumeNativeCodexPeerGeneration?(generation: string): void | Promise<void>;
-    rollbackPreparedNativeCodexPeerGeneration?(input: {
-        preparedGeneration: string;
-        resumeGeneration: string;
-    }): Promise<void>;
-    retireNativeCodexPeerGeneration?(input: {
-        retiredGeneration: string;
-        protectedActiveGeneration: string;
-    }): Promise<void>;
-    purgeNativeCodexPeerGenerationReplyCapabilities?(generation: string): number | Promise<number>;
-    /** Codex-only private provider-work barrier for one exact task route. */
-    observeRouteSuccessionBarrier?(routeHandle: string): Readonly<{
-        routePresent: boolean;
-        connection: string;
-        routeStatus: string;
-        queueDepth: number;
-        hasActiveTurn: boolean;
-        requestInFlight: boolean;
-        routeCreationInFlight: boolean;
-        routeReleaseInFlight: boolean;
-        pendingReplyCorrelations: number;
-        pendingCallbacks: number;
-        clean: boolean;
-    }>;
+    }>): Promise<void>;
+    releaseNativeInboundReceipt?(receiptHandle: string): Promise<boolean>;
     dispatch(input: GatewayAdapterDispatchInput): Promise<GatewayAdapterDispatchResult>;
     releaseRoute?(routeHandle: string): Promise<void>;
     close(): Promise<void>;
 }
 type GatewayServiceTimer = ReturnType<typeof setTimeout>;
-type GatewayServiceTimers = {
+type GatewayServiceTimers = Readonly<{
     setTimeout: (callback: () => void, delayMs: number) => GatewayServiceTimer;
     clearTimeout: (timer: GatewayServiceTimer) => void;
-};
-export type GatewayServiceOptions = {
+}>;
+export type GatewayServiceOptions = Readonly<{
     config: GatewayConfig;
     adapters?: readonly GatewayProviderAdapter[];
     store?: GatewayStore;
@@ -256,9 +150,8 @@ export type GatewayServiceOptions = {
     now?: () => Date;
     nativePeerCwd?: string;
     timers?: GatewayServiceTimers;
-    /** Test seam for opaque listener generations; production remains random. */
-    successionGeneration?: () => string;
-};
+    codexDoctor?: () => Promise<CodexDoctorResult>;
+}>;
 export declare class GatewayService {
     readonly config: GatewayConfig;
     readonly store: GatewayStore;
@@ -267,281 +160,110 @@ export declare class GatewayService {
     private readonly now;
     private readonly timers;
     private readonly nativePeerCwd;
-    private readonly successionGeneration;
-    private readonly mutex;
-    private readonly routeBindings;
-    private readonly routeStates;
-    private readonly bindingAliases;
+    private readonly codexDoctor;
+    private readonly connectors;
+    private readonly routeObservations;
     private readonly candidates;
-    private availablePeers;
-    private readonly registryEvidenceByConnector;
-    private readonly registryAdaptersWithParseableRecords;
     private readonly conversations;
     private readonly messageContexts;
-    private readonly providerTurnContinuations;
-    private readonly activeDispatchByTarget;
-    private readonly scheduledDispatchTargets;
-    private readonly dispatchRunnerTargets;
-    private readonly heldRedispatchTimers;
+    private readonly activeAttempts;
+    private readonly reserveOperations;
+    private readonly inboundOperations;
     private readonly pendingClaudeReplies;
-    private readonly deliveryTrackers;
-    private readonly deliveryTokens;
+    private readonly nativeReceipts;
+    private readonly progressWatches;
+    private readonly progressWatchEvents;
+    private readonly dispatchRunners;
+    private readonly steerRunners;
+    private readonly startingTargets;
     private readonly runtimeAlerts;
-    private readonly activityEvents;
-    private activitySequence;
-    private readonly detachedReceiptWrites;
-    private readonly nativeIngressByConversation;
-    private readonly callbackQueue;
-    /**
-     * Endpoint replacement is authority-bearing lifecycle evidence, not an
-     * ordinary refreshable observation. Keep one coalesced slot outside the
-     * bounded callback queue so delivery evidence can never displace it (or be
-     * displaced by it).
-     */
-    private endpointRefreshCallback;
-    private activeEndpointRefreshCallback;
-    private endpointRefreshRetryRequested;
-    private endpointRefreshConflictBoundary;
-    private activeEndpointRefreshCallbackKey;
-    private endpointRefreshCallbackPoisoned;
-    private endpointRefreshConflictPending;
-    /** Last successfully activated transition per allowed Codex host. */
-    private readonly activatedEndpointRefreshes;
-    /** Durable reanchors awaiting their exact native-listener activation. */
-    private readonly durablyAppliedEndpointRefreshes;
-    /** Selector transitions staged until their exact registration owns a helper. */
-    private readonly pendingSelectorEndpointActivations;
-    /** Process-local dedupe for automatic public activity rows across retries. */
-    private readonly endpointRefreshActivityKeys;
-    private callbackWorker;
-    private callbackScheduled;
-    private readonly callbackCapacity;
-    private readonly deliveryCallbackReserve;
-    private readonly deliveryTokenCapacity;
-    private lifecycleTimer;
-    private nextDashboardRefreshAt;
-    private nextProgressWatchAt;
     private control;
-    /** Coarse controller mutation revision exposed by `health`. */
+    private wakeTimer;
+    private nextDiscoveryAt;
+    private nextDoctorAt;
+    private codexDoctorResult;
     private revision;
-    /**
-     * Process-local semantic public-snapshot clock. The first observation
-     * establishes revision zero; a new GatewayService process resets it.
-     */
     private snapshotRevision;
     private snapshotFingerprint;
     private running;
     private closing;
     private closeInFlight;
-    private acceptingCallbacks;
-    private dashboardHealthy;
-    /** Route-scoped fences; unrelated Codex registrations remain dispatchable. */
-    private readonly codexSuccessionDispatchFrozen;
-    private readonly codexSuccessionPoisoned;
-    /**
-     * Exact stale authority whose process-owned native advertisement was already
-     * removed, but whose durable orphan deletion did not commit. Keep dispatch
-     * frozen and permit only the same exact cleanup transaction to retry.
-     */
-    private readonly codexOrphanCleanupPending;
-    private codexSuccessionState;
-    private pendingCodexSuccessionRecovery;
-    /**
-     * Exact active identity. It changes only through the journaled succession
-     * machine; ordinary unregister/register cannot repurpose one listener.
-     */
-    private readonly codexRegistrationLocks;
     constructor(options: GatewayServiceOptions);
     start(signal?: AbortSignal): Promise<void>;
     close(): Promise<void>;
     private closeOnce;
     handlers(): GatewayControlHandlers;
     snapshot(): Promise<GatewayPublicSnapshot>;
-    private captureRegistryObservation;
-    private connectorsWithRegistry;
     observeSnapshot(): Promise<GatewaySnapshotObservation>;
-    private fingerprintSnapshot;
-    private callbacksFor;
-    private enqueueCallback;
-    private enqueueEndpointRefreshCallback;
-    private poisonEndpointRefreshCallbacks;
-    private hasPendingCallbackWork;
-    private enqueueCallbackWorkerOnly;
-    private drainCallbackQueueLocked;
-    /**
-     * A selector can synchronously admit callbacks while its promise is still
-     * running under the service mutex. Drain exactly the ordinary work that was
-     * retained before the selector returned before applying a returned endpoint
-     * transition. Delivery evidence wins within that fixed snapshot; callbacks
-     * admitted while it is reduced remain queued for the ordinary worker, and
-     * the dedicated endpoint-transition slot is never consumed recursively.
-     */
-    private drainSelectorCallbackSnapshotLocked;
-    private failClosedEndpointRefreshConflict;
-    private requireEndpointRefreshUnconflicted;
-    private isTerminalAdapterDelivery;
-    /**
-     * Delivery evidence observed strictly before the deadline must reach the
-     * reducer before its deadline event, even when callback scheduling is late.
-     * Evidence observed at/after the cutoff cannot reopen the terminal machine.
-     */
-    private drainPreDeadlineDeliveryCallbacksLocked;
-    /**
-     * A provider may synchronously emit a terminal callback before its dispatch
-     * promise resolves to `pending`. Consume those already-retained callbacks
-     * before interpreting `pending` as successful provider acceptance, otherwise
-     * the sender can observe a false delivered result that wins the terminal
-     * race against the queued failure.
-     */
-    private drainDeliveryCallbacksForMessageLocked;
-    private adapter;
-    private assertClaudeWorkspaceDisjoint;
-    private contextTargetBinding;
-    private recoverCodexSuccessionAfterRestartLocked;
-    /**
-     * Rebuild process-owned route and listener authority for retained Codex
-     * registrations during staged startup. The provider's selectRoute performs
-     * the exact loaded/list + history-free resume proof; durable state advances
-     * only after the new native advertisement and status are live.
-     */
-    private reactivateRetainedCodexRoutesAfterRestartLocked;
-    private completePendingCodexSuccessionRecoveryLocked;
-    private assertPendingCodexSuccessionRecoveryMatch;
-    private requireCurrentNativeCodexGeneration;
-    private nextCodexSuccessionGeneration;
-    private successionStoreIdentity;
-    private sameSuccessionStoreIdentity;
-    private reconcilePreparedCodexSuccessionAfterUnknownCommit;
-    private requireSuccessionMethod;
-    private succeedCodexRegistration;
-    private driveCodexSuccessionLocked;
-    private recoverCodexSuccessionLocked;
-    private successionNewRegistration;
-    private codexSuccessionFailurePhase;
-    private executeCodexSuccessionEffectLocked;
-    private successionOldRegistration;
-    private quiesceAndDrainPoisonedSuccessionLocked;
-    private codexRouteSuccessionQuiet;
-    private conversationTouchesAliases;
-    private successionServiceStateClean;
-    private purgeSuccessionTransientState;
-    private codexSuccessionPoisonBarrierCleanLocked;
-    private codexSuccessionBarrierCleanLocked;
-    private rescheduleIdleRoutesLocked;
-    private codexSuccessionIsStable;
-    private requireUnchangedStaleCodexOrphan;
-    private nativeCodexOrphanBarrierClean;
-    private endpointCallbacksQuiet;
+    private health;
+    private installOwnedRoute;
+    private observeLoadedRoutes;
+    private observeRoute;
+    private forgetRoute;
+    private adapterFor;
+    private claudeAdapter;
+    private advertise;
+    private unadvertise;
+    private reconcileAdvertisement;
+    private reconcileUnadvertisement;
+    private removeOwnedRoute;
+    private recordActivity;
     private registerCodex;
-    private lockCodexRegistration;
-    private rollbackCodexRegistration;
     private unregisterCodex;
-    private finalizeStaleCodexOrphanRemovalLocked;
-    private removeStaleCodexRegistration;
-    private discoveryPublicFingerprint;
-    private refreshClaudeDiscovery;
-    private renameClaudeRoute;
-    private claudeCandidate;
-    private activatePersistedClaudeCandidate;
-    private selectClaudeCandidate;
-    private replaceClaudeSelectionCandidate;
-    private resolveSelectedClaudeDestination;
-    private inferCodexAlias;
-    private assertPairThreadAttestation;
-    private pairRoutes;
-    private unpairRoutes;
-    private assertLiveConsentEndpoints;
-    private removeConsentEdge;
+    private removeCodexRegistration;
     private selectClaude;
-    private selectAndPairClaude;
-    private rollbackFreshClaudeSelection;
     private unselectClaude;
-    private selectedClaudeRoute;
-    private registerOrRebind;
-    private rememberBinding;
-    private reanchorQueuedMessageContexts;
-    private forgetBinding;
-    private verifyCodex;
-    private verifyClaude;
-    private acceptedControlResult;
-    private reserveDeliveryToken;
-    private armDeliveryTracker;
-    private isTerminalDeliveryState;
-    private settlementDeliveryState;
-    private pruneDeliveryTrackers;
-    private addRuntimeAlert;
-    private releaseNativeReceiptLocked;
-    /**
-     * Native `held` is progress, not terminal delivery or approval. Emit it
-     * only after this exact message is known to be waiting, or after its prompt
-     * dispatch threshold elapses. A clean pre-write may retry; an ambiguous
-     * write is never replayed, and neither path consumes the terminal receipt.
-     */
-    private publishNativeHeldLocked;
-    private nativeReceiptNotificationFor;
-    private sendNativeReceiptLocked;
-    private deliveryCorrelation;
-    private eventTime;
-    private normalizeDeliverySafeCode;
-    private planRouteInFlightSettlementsLocked;
-    private planRoutesInFlightSettlementsLocked;
-    private planConsentEdgeInFlightSettlementsLocked;
-    private purgeConsentEdgeCapabilitiesLocked;
-    private settleDeliveryStoreLocked;
-    private publishStallNoticeLocked;
-    private applyDeliveryEffectsLocked;
-    private advanceDeliveryLocked;
-    private applyTerminalSettlementLocked;
-    private takeMessageContextLocked;
-    /**
-     * Codex App Server acceptance is a terminal delivery boundary for the
-     * original message body, but not for its later model reply. Settle the
-     * durable ledger/body now and retain only bounded in-memory reply
-     * correlation until completion or the original deadline.
-     */
-    private acceptProviderDeliveryLocked;
-    private stallReasonFor;
-    private refreshNextProgressWatchWakeLocked;
-    private processProgressWatchesLocked;
-    private processLifecycleLocked;
-    private scheduleLifecycleWakeLocked;
+    private pair;
+    private unpair;
+    private resolvePairEndpoints;
+    private assertThread;
+    private sendToClaude;
+    private sendToCodex;
+    private reply;
+    private assertReplyCaller;
+    private enqueueConversation;
+    private rememberConversation;
+    private conversationIsActive;
     private deliveryStatus;
-    private acceptToClaude;
-    private acceptToCodex;
-    private acceptReply;
-    private enqueue;
-    private enqueueNativeReply;
-    /**
-     * A provider reply observed before route teardown remains valid evidence
-     * even when the same atomic mutation removes its selected Claude route.
-     * Re-enter that already-observed reply through the existing transient
-     * native-ingress boundary; this preserves the exact connector generation
-     * without recreating route authority or accepting a new unsolicited send.
-     */
-    private enqueueObservedClaudeReplyAfterRouteTeardownLocked;
-    private pruneTransient;
-    private awaitDispatchWithNativeHeldLocked;
-    private restoreQueuedMessageContextLocked;
-    private dispatchOne;
-    private scheduleDispatch;
-    private scheduleHeldRedispatch;
-    private onDelivery;
-    private finishDelivery;
-    private finishDeliveredReplyLocked;
-    private finishProviderTurnContinuationLocked;
-    private onClaudeReply;
-    private onClaudeMessage;
-    private releasePendingClaude;
-    private onCodexEndpointRefresh;
-    private applyCodexEndpointRefresh;
+    private messageUpdatedAt;
+    private kick;
+    private kickExact;
+    private kickSteer;
+    private startRunner;
+    private runTarget;
+    private settleAttemptForShutdown;
+    private resolvePrewrite;
+    private applyDispatchResult;
+    private callbacksFor;
     private onRouteState;
-    private setNativeSourceStatus;
-    private rejectDetachedNativeReceipt;
-    private drainDetachedReceiptWritesLocked;
-    private settleDetachedNativeReceipt;
-    private exclusiveDecision;
-    private changed;
-    private publicSnapshotLocked;
+    private onClaudeMessage;
+    private onClaudeReply;
+    private enqueueCorrelatedReply;
+    private enqueueNativeConversationReply;
+    private installPendingClaudeReply;
+    private pruneExpiredPendingClaudeReplies;
+    private retirePendingClaudeReply;
+    private activatePendingClaudeReply;
+    private deliverPendingClaudeReply;
+    private updateProgressWatch;
+    private restoreProgressWatch;
+    private untrack;
+    private settleWatchesForAlias;
+    private settleProgressWatch;
+    private recordProgressWatchEvent;
+    private processProgressWatches;
+    private finishSettlements;
+    private finishSettlement;
+    private scheduleTargetRetry;
+    private scheduleWake;
+    private onWake;
+    private refreshClaudeDiscovery;
+    private refreshCodexDoctor;
+    private assertWritable;
+    private resolveClaudeSelector;
+    private resolveSelectedClaudeRoute;
+    private routeObservationStillCurrent;
     private publish;
+    private alert;
 }
 export {};