agent-embassy 1.7.0 → 1.8.0

package/dist/src/gateway/types.d.ts

@@ -1,13 +1,5 @@
-import type { ProgressWatch, ProgressWatchJournalEvent } from "./progress-watch-machine.js";
 export declare const gatewayProviders: readonly ["claude", "codex", "deepseek", "grok"];
 export type GatewayProvider = (typeof gatewayProviders)[number];
-export declare const gatewayProviderDisplayNames: Readonly<{
-    claude: string;
-    codex: string;
-    deepseek: string;
-    grok: string;
-}>;
-/** Registration syntax only; route bindings, never prefixes, prove providers. */
 export declare const gatewayRegistrationIngressPrefixes: Readonly<{
     claude: undefined;
     codex: string;
@@ -36,11 +28,10 @@ export declare function parseDirection(value: unknown): ParsedMessageDirection |
 export declare const isMessageDirection: (value: unknown) => value is MessageDirection;
 export declare const deliveryStates: readonly ["queued", "duplicate", "dispatching", "transport_written", "held", "delivered", "unconfirmed", "failed", "ambiguous", "expired", "cancelled", "abandoned", "rejected"];
 export type DeliveryState = (typeof deliveryStates)[number];
-export declare const terminalDeliveryStates: Set<"delivered" | "failed" | "cancelled" | "queued" | "duplicate" | "dispatching" | "transport_written" | "held" | "unconfirmed" | "ambiguous" | "expired" | "abandoned" | "rejected">;
+export type TerminalDeliveryOutcome = Extract<DeliveryState, "delivered" | "unconfirmed" | "failed" | "ambiguous" | "expired" | "cancelled" | "abandoned">;
 export declare const alertSeverities: readonly ["info", "warning", "error"];
 export type AlertSeverity = (typeof alertSeverities)[number];
 export type BusyPolicy = "queue";
-/** Canonical closed-array bounds shared by store projections and control/UI. */
 export declare const gatewayPublicSnapshotLimits: Readonly<{
     readonly connectors: 64;
     readonly registryRejectionCodes: 32;
@@ -53,25 +44,16 @@ export declare const gatewayPublicSnapshotLimits: Readonly<{
     readonly messages: 1024;
     readonly alerts: 256;
 }>;
-/** Leaves headroom for the private control protocol response envelope. */
 export declare const GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET: number;
 /**
- * Private connector identity. Values in this structure are permitted only in
- * controller-owned state and connector calls. They must never be copied into
- * public snapshots, normalized events, logs, or error messages.
+ * Durable logical registration. Provider endpoint generations are deliberately
+ * absent: they are operation-local evidence and never routing authority.
  */
-export type PrivateEndpointIdentity = {
+export type LogicalRouteBinding = {
     provider: GatewayProvider;
     hostId: string;
-    endpointGeneration: string;
-};
-/**
- * Private, immutable target binding. routeHandle may be a native provider
- * thread/session identifier; ownerLease proves which registration owns it.
- */
-export type PrivateRouteBinding = PrivateEndpointIdentity & {
     routeHandle: string;
-    ownerLease: string;
+    registrationId: string;
 };
 export type RouteCounters = {
     accepted: number;
@@ -87,30 +69,25 @@ export type RouteCounters = {
 };
 export type GatewayRouteRecord = {
     alias: string;
-    binding: PrivateRouteBinding;
+    binding: LogicalRouteBinding;
     registrationMode: RouteRegistrationMode;
     enabled: boolean;
-    state: RouteState;
     busyPolicy: BusyPolicy;
     registeredAt: string;
     updatedAt: string;
-    lastSeenAt?: string;
-    queueDepth: number;
     counters: RouteCounters;
-    safeErrorCode?: string;
 };
 /**
  * Durable bidirectional consent between two exact route owners. Aliases are
- * display coordinates; the private leases prevent an alias from silently
+ * display coordinates; the private registration identities prevent an alias from silently
  * retargeting an existing permission edge.
  */
 export type GatewayConsentEndpoint = Readonly<{
     alias: string;
     provider: GatewayProvider;
-    ownerLease: string;
+    registrationId: string;
 }>;
 export type GatewayConsentEdgeRecord = {
-    /** Canonical order: provider order first, then alias. */
     endpoints: readonly [GatewayConsentEndpoint, GatewayConsentEndpoint];
     createdAt: string;
     updatedAt: string;
@@ -122,28 +99,13 @@ export type GatewayConsentEdgeRecord = {
  */
 export type GatewayPrivateRouteInspection = {
     alias: string;
-    binding: PrivateRouteBinding;
+    binding: LogicalRouteBinding;
     registrationMode: RouteRegistrationMode;
     enabled: boolean;
-    state: RouteState;
-    safeErrorCode?: string;
 };
-export type ConnectorRecord = {
-    provider: GatewayProvider;
-    hostId: string;
-    endpointGeneration: string;
-    health: ConnectorHealth;
-    protocol: string;
-    protocolVersion: string;
-    updatedAt: string;
-    lastSeenAt?: string;
-    safeErrorCode?: string;
-};
-/** Metadata persisted for a queued message. Legacy rows may be bodyless. */
 export type QueuedMessageMetadata = {
     messageId: string;
     messageIdSuffix: string;
-    /** Bounded public correlation only; the full conversation capability stays private. */
     conversationIdSuffix?: string;
     direction: MessageDirection;
     sourceAlias: string;
@@ -151,22 +113,11 @@ export type QueuedMessageMetadata = {
     enqueuedAt: string;
     deadlineAt: string;
     bytes: number;
-    /** Bounded same-user durable payload; absent only on pre-v1.2 rows. */
     body?: string;
-    /** This message was admitted by the exact durable consent edge. */
     pair?: true;
-    /** Target authority was transient and must never be reconstructed after restart. */
     transientTarget?: true;
-    /** Exact Claude-to-Codex `STEER:` classification; absence means ordinary. */
     steer?: true;
 };
-/** A dispatch value with the exact persisted body promoted to required. */
-export type TransientQueuedMessage = QueuedMessageMetadata & {
-    body: string;
-};
-export type InFlightMessageMetadata = QueuedMessageMetadata & {
-    dispatchedAt: string;
-};
 export type DedupeRecord = {
     fingerprint: string;
     messageIdSuffix: string;
@@ -193,7 +144,6 @@ export type NormalizedMessageEvent = {
     targetAlias: string;
     state: DeliveryState;
     bytes: number;
-    /** Retained payload; oldest values are evicted without removing metadata. */
     body?: string;
     steer?: true;
     latencyMs?: number;
@@ -213,61 +163,75 @@ export type GatewayAccounting = {
     bytesAccepted: number;
     queuedBytes: number;
 };
-/**
- * Private proof that one exact Codex task was re-anchored after its App Server
- * endpoint generation changed. Native task and endpoint identifiers in this
- * journal must never enter a public snapshot, event, error, or log.
- */
-export type CodexEndpointRefreshJournalEvent = {
-    sequence: number;
-    timestamp: string;
-    alias: string;
-    hostId: string;
-    threadId: string;
-    oldEndpointGeneration: string;
-    newEndpointGeneration: string;
-    /** Broker-start proof; absent for a live endpoint-generation refresh. */
-    reason?: "boot_reactivation";
+export type GatewayPreparedWriteEvidence = {
+    kind: "claude_mailbox" | "codex_turn_start" | "codex_turn_steer" | "acp_prompt";
+    bodyBytes: number;
+    bodySha256: string;
+    frameBytes: number;
+    sha256: string;
+};
+export type GatewayMessageAttemptAuthority = {
+    attemptId: string;
+    attemptCount: number;
+    targetRegistrationId: string;
+    sourceRegistrationId: string | null;
+    consentEdge: readonly [GatewayConsentEndpoint, GatewayConsentEndpoint] | null;
+};
+export type GatewayMessageState = {
+    phase: "queued";
+    attemptCount: number;
+} | (GatewayMessageAttemptAuthority & {
+    phase: "reserved";
+    reservedAt: string;
+}) | (GatewayMessageAttemptAuthority & {
+    phase: "armed";
+    armedAt: string;
+    prepared: GatewayPreparedWriteEvidence;
+}) | (GatewayMessageAttemptAuthority & {
+    phase: "accepted";
+    acceptedAt: string;
+    prepared: GatewayPreparedWriteEvidence;
+    lossOutcome: "unconfirmed" | "ambiguous";
+}) | {
+    phase: "terminal";
+    outcome: TerminalDeliveryOutcome;
+    terminalAt: string;
+    safeErrorCode?: string;
+    latencyMs: number;
 };
-export declare const CODEX_ENDPOINT_REFRESH_JOURNAL_CAPACITY = 256;
-/**
- * Private durable evidence that an operator removed one safely proven stale
- * Codex registration. No native task or endpoint identifiers are retained.
- */
-export type CodexOrphanRemovalJournalEvent = {
+export type GatewayMessageRecord = QueuedMessageMetadata & {
     sequence: number;
-    timestamp: string;
-    alias: string;
-    hostId: string;
+    deliveryToken?: string;
+    sourceRegistrationId: string | null;
+    targetRegistrationId: string | null;
+    consentEdge: readonly [GatewayConsentEndpoint, GatewayConsentEndpoint] | null;
+    state: GatewayMessageState;
+};
+export type GatewayLegacyMessageActivity = {
+    type: "legacy_message";
+    event: NormalizedMessageEvent;
 };
-export declare const CODEX_ORPHAN_REMOVAL_JOURNAL_CAPACITY = 256;
+export type GatewayRuntimeActivity = {
+    type: "activity";
+    event: PublicGatewayActivityEvent;
+};
+export type GatewayStateActivity = GatewayLegacyMessageActivity | GatewayRuntimeActivity;
 export type GatewayPersistedState = {
-    schemaVersion: 2;
+    schemaVersion: 3;
+    commit: {
+        sequence: number;
+        id: string;
+    };
     createdAt: string;
     updatedAt: string;
     eventSequence: number;
     routes: GatewayRouteRecord[];
     consentEdges: GatewayConsentEdgeRecord[];
-    connectors: ConnectorRecord[];
-    queue: QueuedMessageMetadata[];
-    inFlight: InFlightMessageMetadata[];
-    events: NormalizedMessageEvent[];
+    messages: GatewayMessageRecord[];
     dedupe: DedupeRecord[];
     rateBuckets: RateBucket[];
+    activity: GatewayStateActivity[];
     accounting: GatewayAccounting;
-    watchSequence: number;
-    progressWatches: ProgressWatch[];
-    progressWatchEvents: ProgressWatchJournalEvent[];
-    /** Monotonic sequence for the bounded private endpoint-refresh journal. */
-    codexEndpointRefreshSequence: number;
-    /** Strictly private route-lifecycle evidence; never publicly projected. */
-    codexEndpointRefreshEvents: CodexEndpointRefreshJournalEvent[];
-    /** Monotonic sequence for bounded private operator-recovery evidence. */
-    codexOrphanRemovalSequence: number;
-    /** Strictly private orphan-removal evidence; never publicly projected. */
-    codexOrphanRemovalEvents: CodexOrphanRemovalJournalEvent[];
-    /** Strictly validated internal restart journal; never publicly projected. */
-    codexSuccession?: unknown;
 };
 export type PublicRouteSnapshot = {
     alias: string;
@@ -278,18 +242,15 @@ export type PublicRouteSnapshot = {
     busyPolicy: BusyPolicy;
     lastSeenAt?: string;
     queueDepth: number;
-    /** Earliest enqueue time for this route's current queue, if non-empty. */
     oldestQueuedAt?: string;
     counters: RouteCounters;
     safeErrorCode?: string;
 };
-/** Metadata-only public consent edge. Private route authority is omitted. */
 export type PublicConsentEndpointSnapshot = Readonly<{
     alias: string;
     provider: GatewayProvider;
 }>;
 export type PublicConsentEdgeSnapshot = {
-    /** Canonical order matching the private consent edge. */
     endpoints: readonly [PublicConsentEndpointSnapshot, PublicConsentEndpointSnapshot];
     host: string;
     counters: RouteCounters;
@@ -301,9 +262,16 @@ export type PublicConnectorSnapshot = {
     protocol: string;
     protocolVersion: string;
     lastSeenAt?: string;
+    observationAgeMs?: number;
+    codexDoctor?: PublicCodexDoctorSnapshot;
     safeErrorCode?: string;
     registry?: PublicRegistryObservationSnapshot;
 };
+export type PublicCodexDoctorCondition = "split_brain" | "orphaned" | "attached" | "observation_stale" | "managed_layout_missing" | "unknown";
+export type PublicCodexDoctorSnapshot = Readonly<{
+    conditions: readonly PublicCodexDoctorCondition[];
+}>;
+export declare const CONNECTOR_OBSERVATION_STALE_AFTER_MS = 35000;
 /**
  * Bounded, native-ID-free evidence attached to one Claude connector. Counts
  * describe only the latest pass; the monotonic flag distinguishes an ordinary
@@ -333,17 +301,15 @@ export type PublicAvailablePeerSnapshot = {
     provider: GatewayProvider;
     host: string;
     state: PublicAvailablePeerState;
-    /** True only when this row passed the provider's strict selectable-peer checks. */
     validated: boolean;
     selected: boolean;
     lastSeenAt?: string;
     safeErrorCode?: string;
 };
-export declare const gatewayActivityKinds: readonly ["discovery", "selection", "registration", "pairing", "watch", "endpoint", "recovery"];
+export declare const gatewayActivityKinds: readonly ["discovery", "selection", "registration", "pairing", "watch"];
 export type GatewayActivityKind = (typeof gatewayActivityKinds)[number];
-export declare const gatewayActivityActions: readonly ["discovery_refreshed", "claude_selected", "claude_unselected", "codex_registered", "codex_succeeded", "codex_unregistered", "routes_paired", "routes_unpaired", "watch_ended", "endpoint_refreshed", "codex_orphan_removed"];
+export declare const gatewayActivityActions: readonly ["discovery_refreshed", "claude_selected", "claude_unselected", "codex_registered", "codex_succeeded", "codex_unregistered", "routes_paired", "routes_unpaired", "watch_ended"];
 export type GatewayActivityAction = (typeof gatewayActivityActions)[number];
-/** Bounded, body-free operator activity retained for this broker process. */
 export type PublicGatewayActivityEvent = {
     sequence: number;
     timestamp: string;
@@ -361,7 +327,6 @@ export type DeadlinePressureBucket = {
     settled: number;
     expired: number;
 };
-/** Counts are computed only from the bounded retained delivery ledger. */
 export type DeadlinePressureSnapshot = {
     configuredDeadlineMs: number;
     retainedSince?: string;
@@ -369,7 +334,6 @@ export type DeadlinePressureSnapshot = {
     expiredEvents: number;
     buckets: DeadlinePressureBucket[];
 };
-/** Strict closed-schema guard for runtime-supplied transient inventory rows. */
 export declare function isPublicAvailablePeerSnapshot(value: unknown): value is PublicAvailablePeerSnapshot;
 export declare function arePublicAvailablePeerSnapshots(value: unknown, maximumRows?: number): value is PublicAvailablePeerSnapshot[];
 export declare function isPublicRegistryObservationSnapshot(value: unknown): value is PublicRegistryObservationSnapshot;
@@ -402,7 +366,6 @@ export type PublicProgressWatchEventSnapshot = {
 export type GatewayPublicSnapshot = {
     schemaVersion: 2;
     generatedAt: string;
-    /** Launch-time Claude-to-Codex consent policy; paired is the safe default. */
     inboundMode: GatewayInboundMode;
     health: ConnectorHealth;
     connectors: PublicConnectorSnapshot[];
@@ -438,100 +401,114 @@ export type GatewaySnapshotTruncation = {
 export declare function projectGatewayPublicSnapshot(snapshot: GatewayPublicSnapshot, maximumBytes?: number): GatewayPublicSnapshot;
 export type RegisterRouteInput = {
     alias: string;
-    binding: PrivateRouteBinding;
+    binding: LogicalRouteBinding;
     registrationMode: RouteRegistrationMode;
-    state?: "idle" | "busy" | "awaiting_approval";
 };
-export type ObserveConnectorInput = {
-    identity: PrivateEndpointIdentity;
-    health: Exclude<ConnectorHealth, "offline">;
-    protocol: string;
-    protocolVersion: string;
+export type GatewayReservedAttempt = Readonly<{
+    messageId: string;
+    attemptId: string;
+    attemptCount: number;
+    body: string;
+    deadlineAt: string;
+    direction: MessageDirection;
+    sourceAlias: string;
+    targetAlias: string;
+    conversationIdSuffix?: string;
+    sourceRegistrationId: string | null;
+    targetRegistrationId: string;
+    consentEdge: readonly [GatewayConsentEndpoint, GatewayConsentEndpoint] | null;
+    bytes: number;
+    steer?: true;
+}>;
+export type ReserveMessageResult = Readonly<{
+    status: "empty";
+}> | Readonly<{
+    status: "terminal";
+    settlement: TerminalMessageSettlement;
+}> | Readonly<{
+    status: "reserved";
+    attempt: GatewayReservedAttempt;
+}>;
+type AttemptInput = Readonly<{
+    messageId: string;
+    attemptId: string;
+}>;
+type StaleAttemptResult = Readonly<{
+    status: "stale";
+}>;
+type SettledAttemptResult = Readonly<{
+    status: "settled";
+    settlement: TerminalMessageSettlement;
+}>;
+export type AuthorizeMessageInput = AttemptInput & Readonly<{
+    sourceRegistrationId: string | null;
+    targetRegistrationId: string;
+    prepared: GatewayPreparedWriteEvidence;
+}>;
+export type AuthorizeMessageResult = Readonly<{
+    status: "authorized";
+}> | Readonly<{
+    status: "stale";
+    reason: "not_reserved" | "attempt_mismatch" | "registration_changed" | "consent_removed";
+}> | Readonly<{
+    status: "terminal";
+    reason: "expired" | "fenced";
+    settlement: TerminalMessageSettlement;
+}>;
+export type AcceptMessageInput = AttemptInput & Readonly<{
+    lossOutcome: "unconfirmed" | "ambiguous";
+}>;
+export type AcceptMessageResult = Readonly<{
+    status: "accepted";
+}> | StaleAttemptResult;
+export type ResolvePrewriteAttemptInput = AttemptInput & Readonly<{
+    outcome: "requeue" | "failed";
     safeErrorCode?: string;
-};
-export type ObserveRouteInput = {
-    binding: PrivateRouteBinding;
-    state: "idle" | "busy" | "awaiting_approval";
+}>;
+export type ResolvePrewriteAttemptResult = Readonly<{
+    status: "requeued";
+}> | SettledAttemptResult | StaleAttemptResult;
+export type SettleAttemptInput = AttemptInput & Readonly<{
+    state: Exclude<TerminalDeliveryOutcome, "abandoned">;
     safeErrorCode?: string;
-} | {
-    binding: PrivateRouteBinding;
-    state: "stale";
-    safeErrorCode: string;
-};
-export type RebindStaleRouteInput = {
-    /** The currently persisted alias. */
-    alias: string;
-    /** The provider's latest live display name for the same logical route. */
-    newAlias?: string;
-    currentOwnerLease: string;
-    newBinding: PrivateRouteBinding;
-    reason: "endpoint_reobserved" | "peer_explicitly_reselected" | "peer_identity_reobserved";
-    /** Append exact private boot-recovery evidence in the refresh journal. */
-    journalReason?: "boot_reactivation";
-    state?: "idle" | "busy" | "awaiting_approval";
-};
-export type ReanchorCodexRouteInput = {
-    alias: string;
-    /** Exact private App Server thread identifier proved present by loaded/list. */
-    threadId: string;
-    /** Existing registration authority; a refresh never rotates this lease. */
-    ownerLease: string;
-    state?: "idle" | "busy" | "awaiting_approval";
-};
-export type ReanchorCodexRoutesInput = {
-    oldEndpoint: PrivateEndpointIdentity;
-    newEndpoint: PrivateEndpointIdentity;
-    /** Only the exact loaded/list-present subset is named here. */
-    routes: readonly ReanchorCodexRouteInput[];
-};
-export type ReanchorCodexRoutesResult = {
-    reboundAliases: string[];
-};
-export type RemoveStaleCodexOrphanInput = {
-    /** Dashboard-confirmed exact public alias; no native identifier is accepted. */
-    alias: string;
-};
-export type StaleCodexOrphanRemovalAuthority = {
-    binding: PrivateRouteBinding;
-    previousSequence: number;
-};
-export type StaleCodexOrphanRemovalCommitProofInput = {
-    alias: string;
-    binding: PrivateRouteBinding;
-    previousSequence: number;
-};
-export type RemoveStaleCodexOrphanResult = {
-    alias: string;
-    /** Private result used only to reconcile in-process service bindings. */
-    binding: PrivateRouteBinding;
-    removedEdges: Array<{
-        aliases: readonly [string, string];
-    }>;
-};
+}>;
+export type SettleAttemptResult = SettledAttemptResult | StaleAttemptResult;
+export type SettleAttemptForShutdownInput = AttemptInput;
+export type SettleAttemptForShutdownResult = Readonly<{
+    status: "requeued";
+}> | SettledAttemptResult | StaleAttemptResult;
+export type SettleQueuedMessageForShutdownInput = Readonly<{
+    messageId: string;
+}>;
+export type SettleQueuedMessageForShutdownResult = SettledAttemptResult | StaleAttemptResult;
+export type RemoveRouteAtomicResult = Readonly<{
+    removed: boolean;
+    settlements: readonly TerminalMessageSettlement[];
+}>;
+export type GatewayAtomicActivityInput = Readonly<{
+    operatorAction: boolean;
+}>;
+export type ReplaceCodexRegistrationAtomicInput = Readonly<{
+    oldAlias: string;
+    expectedOldRegistrationId: string;
+    replacement: RegisterRouteInput;
+    activity: GatewayAtomicActivityInput;
+}>;
+export type ReplaceCodexRegistrationAtomicResult = Readonly<{
+    replaced: boolean;
+    idempotent: boolean;
+    settlements: readonly TerminalMessageSettlement[];
+}>;
 export type EnqueueMessageInput = {
     sourceAlias: string;
     targetAlias: string;
+    expectedSourceRegistrationId?: string;
+    expectedTargetRegistrationId?: string;
     body: string;
     dedupeKey: string;
-    /** Last eight opaque characters of the controller-owned conversation ID. */
     conversationIdSuffix?: string;
     deadlineAt?: string;
     steer?: true;
-    /**
-     * Controller-derived watch intent committed in the same mutation as the
-     * accepted message. Bodies and command flags are never persisted here.
-     */
-    progressWatch?: {
-        conversationId: string;
-        actorAlias: string;
-        openIdleMs?: number;
-        completionSignal?: true;
-    };
-    /** Controller-authored nudge committed atomically with its queued body. */
-    progressWatchNudge?: {
-        conversationId: string;
-        nudgeNumber: 1 | 2;
-    };
 };
 /**
  * Controller-internal proof of one currently observed native Claude peer.
@@ -540,36 +517,30 @@ export type EnqueueMessageInput = {
  */
 export type TransientNativeClaudePeer = {
     alias: string;
-    binding: PrivateRouteBinding;
+    binding: LogicalRouteBinding;
 };
-export type EnqueueNativeIngressInput = Omit<EnqueueMessageInput, "sourceAlias" | "targetAlias"> & {
+export type EnqueueNativeIngressInput = Omit<EnqueueMessageInput, "sourceAlias" | "targetAlias" | "expectedSourceRegistrationId" | "expectedTargetRegistrationId"> & {
     source: TransientNativeClaudePeer;
     targetAlias: string;
-    /** Pre-deadline reply evidence retained across exact pair teardown. */
+    expectedTargetRegistrationId: string;
     authorizedPairTeardownReply?: true;
 };
-export type EnqueueNativeReplyInput = Omit<EnqueueMessageInput, "sourceAlias" | "targetAlias"> & {
+export type EnqueueNativeReplyInput = Omit<EnqueueMessageInput, "sourceAlias" | "targetAlias" | "expectedSourceRegistrationId" | "expectedTargetRegistrationId"> & {
     sourceAlias: string;
+    expectedSourceRegistrationId: string;
     target: TransientNativeClaudePeer;
-    /** Retain the original paired admission authority, when one existed. */
     pair?: true;
+    exposeDeliveryToken?: true;
 };
 export type EnqueueMessageResult = {
     accepted: boolean;
     duplicate: boolean;
     messageId?: string;
     messageIdSuffix: string;
-    /** The accepted message is owned by one exact consent edge. */
+    deliveryToken?: string;
     pair?: true;
-    /** Exact older queued steer displaced by the per-edge cap, if any. */
     supersededSettlement?: TerminalMessageSettlement;
 };
-export type InFlightMessageProgressState = Extract<DeliveryState, "transport_written" | "held">;
-export type SettleMessageInput = {
-    messageId: string;
-    state: Extract<DeliveryState, "delivered" | "unconfirmed" | "failed" | "ambiguous" | "expired" | "cancelled">;
-    safeErrorCode?: string;
-};
 /**
  * Controller-internal proof that one message won its terminal-state race.
  * Full message IDs are required only for in-memory service correlation; this
@@ -577,27 +548,12 @@ export type SettleMessageInput = {
  */
 export type TerminalMessageSettlement = {
     messageId: string;
-    state: Extract<DeliveryState, "delivered" | "unconfirmed" | "failed" | "ambiguous" | "expired" | "cancelled" | "abandoned">;
+    state: TerminalDeliveryOutcome;
     safeErrorCode?: string;
 };
-export type SettleMessageResult = {
-    status: "settled";
-    settlement: TerminalMessageSettlement;
-} | {
-    status: "not_in_flight";
-};
-export type RequeueInFlightMessageResult = {
-    status: "requeued";
-} | {
-    status: "settled";
-    settlement: TerminalMessageSettlement;
-} | {
-    status: "not_in_flight";
-};
 export type GatewayStoreLimits = {
     maxRoutes: number;
     maxConsentEdges: number;
-    /** Omitted injected-test configs use the production default of 32. */
     maxWatches?: number;
     eventCapacity: number;
     eventTtlMs: number;
@@ -608,7 +564,6 @@ export type GatewayStoreLimits = {
     maxInFlightMessages: number;
     maxQueueBytes: number;
     maxMessageBytes: number;
-    /** Bounded historical event-body bytes; omitted configs use 1 MiB. */
     maxRetainedBodyBytes?: number;
     messageDeadlineMs: number;
     rateLimitPerRoute: number;
@@ -617,6 +572,7 @@ export type GatewayStoreLimits = {
 export type GatewayStoreDependencies = {
     now?: () => Date;
     randomId?: () => string;
-    /** Deterministic durability-fault seam; production callers leave this unset. */
+    renameStateFile?: (source: string, target: string) => Promise<void>;
     afterStateFileRename?: () => void | Promise<void>;
 };
+export {};