agent-embassy 1.9.5 → 3.0.0

package/dist/src/gateway/service.js

@@ -1,19 +1,22 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { BridgeError } from "../errors.js";
-import { createGatewayConversationId, startGatewayControlServer, pairParamAliases, pairParamThreadAttestation, } from "./control.js";
-import { publishGatewayDashboard } from "./dashboard.js";
-import { spawnPeerClient } from "./peer-client.js";
-import { peerEdgeRef, peerRouteRef } from "./peer-protocol.js";
-import { PROGRESS_WATCH_DEFAULT_CAPACITY, PROGRESS_WATCH_DEFAULT_IDLE_MS, PROGRESS_WATCH_HARD_CAPACITY, commitProgressWatchNudge, createProgressWatch, deferProgressWatchNudge, inspectProgressWatchDue, recordProgressWatchActivity, } from "./progress-watch-machine.js";
+import { createGatewayConversationId, startGatewayControlServer, GATEWAY_EPHEMERAL_PEER_TTL_DEFAULT_MS, } from "./control.js";
+import { PeerConnectionLostError, spawnPeerClient } from "./peer-client.js";
+import { peerRouteRef } from "./peer-protocol.js";
 import { GatewayStore } from "./store.js";
-import { CONNECTOR_OBSERVATION_STALE_AFTER_MS, GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET, gatewayPublicSnapshotLimits, gatewayRegistrationIngressPrefixes, parseDirection, projectGatewayPublicSnapshot, } from "./types.js";
+import { CONNECTOR_OBSERVATION_STALE_AFTER_MS, directionId, GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET, gatewayPublicSnapshotLimits, gatewayRegistrationIngressPrefixes, parseDirection, projectGatewayPublicSnapshot, } from "./types.js";
 const SAFE_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
 const PRIVATE_HANDLE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
 const PUBLIC_ALIAS = /^[a-z][a-z0-9_-]{0,31}@[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
 const PEER_TOKEN = /^peer_[A-Za-z0-9_-]{32}$/;
 const DISCOVERY_INTERVAL_MS = 30_000;
-const CODEX_DOCTOR_INTERVAL_MS = 30_000;
+const MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS = 30_000;
 const PEER_REFRESH_INTERVAL_MS = 30_000;
+/** A failed timed retirement of an ephemeral peer is retried this much later… */
+const EPHEMERAL_EXPIRY_RETRY_MS = 5_000;
+/** …this many times in a row before the registration is left to the next restart. */
+const EPHEMERAL_EXPIRY_MAX_ATTEMPTS = 3;
+const PEER_FAILURE_CODES = ["PEER_DIAL_FAILED", "PEER_TUNNEL_UNAVAILABLE", "PEER_PROTOCOL_MISMATCH"];
 const CLEAN_RETRY_DELAY_MS = 500;
 const MAX_CONVERSATIONS = 1_024;
 const MAX_PENDING_CLAUDE_REPLIES = MAX_CONVERSATIONS;
@@ -39,16 +42,7 @@ function aliasHost(alias) {
 function safeCode(value, fallback) {
     return value !== undefined && SAFE_CODE.test(value) ? value : fallback;
 }
-class ConsentOwnerError extends BridgeError {
-    ownerHost;
-    constructor(ownerHost) {
-        super("CONSENT_OWNER_HOST_REQUIRED", `Run pair or unpair on the edge owner host ${ownerHost}.`);
-        this.ownerHost = ownerHost;
-    }
-}
 function decisionFor(error, peerPrincipal = false) {
-    if (error instanceof ConsentOwnerError)
-        return { accepted: false, code: "conflict", ownerHost: error.ownerHost };
     if (!(error instanceof BridgeError))
         return { accepted: false, code: "rejected" };
     if (error.code.includes("NOT_FOUND") || error.code.includes("NOT_AVAILABLE")) {
@@ -63,11 +57,42 @@ function decisionFor(error, peerPrincipal = false) {
     if (error.code.includes("UNAVAILABLE") || error.code.includes("OFFLINE") || error.code.includes("UNOBSERVED")) {
         return { accepted: false, code: "unavailable" };
     }
-    if ((peerPrincipal && error.code === "ROUTE_UNREGISTERED") || error.code.includes("MISMATCH") || error.code.includes("ADDRESS")) {
+    if ((peerPrincipal && error.code === "ROUTE_UNREGISTERED") || error.code.includes("MISMATCH") ||
+        error.code.includes("CHANGED") || error.code.includes("ADDRESS")) {
         return { accepted: false, code: "route_mismatch" };
     }
     return { accepted: false, code: "rejected" };
 }
+/**
+ * The refusal a send returns: the coarse decision clients branch on,
+ * plus the safe code behind it so the CLI can name the one remedy that fits.
+ * Only a BridgeError's own code is carried; anything else stays anonymous.
+ */
+function sendRefusal(error, peerPrincipal = false) {
+    const decision = decisionFor(error, peerPrincipal);
+    const reason = error instanceof BridgeError && SAFE_CODE.test(error.code) ? error.code : undefined;
+    return { accepted: false, code: decision.code, ...(reason === undefined ? {} : { reason }) };
+}
+/**
+ * A grammar-valid alias for a session that cannot have the name it discovered
+ * under, because a live session already holds it. The suffix is derived from
+ * the session's own route handle, so it is stable across sends, and it is a
+ * hash rather than the handle itself: a native session UUID must never enter a
+ * public alias.
+ */
+function disambiguatedAlias(alias, routeHandle) {
+    const at = alias.lastIndexOf("@");
+    const name = alias.slice(0, at), host = alias.slice(at + 1);
+    const suffix = createHash("sha256").update(routeHandle).digest("hex").slice(0, 8);
+    return `${name.slice(0, 32 - suffix.length - 1)}-${suffix}@${host}`;
+}
+/** The decoder already accepted exactly one credential, so the last arm holds. */
+function replyCaller(params) {
+    const { fromAlias, threadId, replyAddress, peerToken } = params;
+    return threadId !== undefined ? { kind: "codex", alias: fromAlias, threadId }
+        : replyAddress !== undefined ? { kind: "claude", alias: fromAlias, replyAddress }
+            : { kind: "peer", alias: fromAlias, token: peerToken };
+}
 function sameBinding(left, right) {
     return left.provider === right.provider && left.hostId === right.hostId &&
         left.routeHandle === right.routeHandle && left.registrationId === right.registrationId;
@@ -76,9 +101,13 @@ function connectorKey(identity) {
     return `${identity.provider}\0${identity.hostId}`;
 }
 function publicRegistry(value, previouslyParseable) {
-    const rejected = [...value.rejected]
-        .filter((row) => SAFE_CODE.test(row.safeErrorCode) && Number.isSafeInteger(row.count) && row.count > 0)
-        .sort((left, right) => left.safeErrorCode.localeCompare(right.safeErrorCode));
+    const counts = new Map();
+    for (const row of value.rejected)
+        if (SAFE_CODE.test(row.safeErrorCode) && Number.isSafeInteger(row.count) && row.count > 0)
+            counts.set(row.safeErrorCode, (counts.get(row.safeErrorCode) ?? 0) + row.count);
+    const rejected = [...counts].map(([safeErrorCode, count]) => ({ safeErrorCode, count }))
+        .sort((left, right) => left.safeErrorCode < right.safeErrorCode ? -1 :
+        left.safeErrorCode > right.safeErrorCode ? 1 : 0);
     const retained = rejected.slice(0, gatewayPublicSnapshotLimits.registryRejectionCodes);
     return {
         entriesScanned: Math.max(0, value.entriesScanned),
@@ -96,10 +125,7 @@ function bodyHash(body) {
     return createHash("sha256").update(body, "utf8").digest("hex");
 }
 function peerCatalogAuthorityChanged(prior, current) {
-    const authority = (catalog) => JSON.stringify([
-        catalog.routes.map(({ state: _state, queueDepth: _depth, lastSeenAt: _seen, safeErrorCode: _code, ...route }) => route).sort((a, b) => a.ref.localeCompare(b.ref)),
-        [...catalog.consentEdges].sort((a, b) => a.ref.localeCompare(b.ref)),
-    ]);
+    const authority = (catalog) => JSON.stringify(catalog.routes.map(({ state: _state, queueDepth: _depth, lastSeenAt: _seen, safeErrorCode: _code, ...route }) => route).sort((a, b) => a.ref.localeCompare(b.ref)));
     return prior === undefined || authority(prior) !== authority(current);
 }
 function peerCatalogViewChanged(prior, current) {
@@ -107,7 +133,6 @@ function peerCatalogViewChanged(prior, current) {
         catalog.health,
         catalog.connectors.map(({ lastSeenAt: _seen, observationAgeMs: _age, ...row }) => row),
         catalog.routes.map(({ lastSeenAt: _seen, ...row }) => row).sort((a, b) => a.ref.localeCompare(b.ref)),
-        [...catalog.consentEdges].sort((a, b) => a.ref.localeCompare(b.ref)),
         catalog.alerts.map(({ timestamp: _timestamp, ...row }) => row),
     ]);
     return prior === undefined || view(prior) !== view(current);
@@ -119,11 +144,10 @@ export class GatewayService {
     config;
     store;
     adapters;
-    publishDashboard;
     now;
     timers;
     nativePeerCwd;
-    codexDoctor;
+    managedCodexSocketHeld;
     spawnPeer;
     peerClients = new Map();
     peerCatalogs = new Map();
@@ -133,6 +157,7 @@ export class GatewayService {
     connectors = new Map();
     routeObservations = new Map();
     candidates = new Map();
+    collidingClaudeAliases = new Set();
     conversations = new Map();
     messageContexts = new Map();
     activeAttempts = new Map();
@@ -141,18 +166,25 @@ export class GatewayService {
     peerRefreshOperations = new Set();
     pendingClaudeReplies = new Map();
     nativeReceipts = new Map();
-    progressWatches = new Map();
-    progressWatchEvents = [];
     dispatchRunners = new Map();
     steerRunners = new Map();
     startingTargets = new Set();
     runtimeAlerts = [];
+    /**
+     * Ephemeral peer registrations and the wall-clock instant each one dies.
+     * Nothing durable records them, so this map is the whole lifetime: it is
+     * swept on the ordinary maintenance tick, and a restart simply never sees
+     * the routes at all.
+     */
+    ephemeralPeerExpiries = new Map();
+    /** Consecutive failed retirements per ephemeral alias; cleared on success or removal. */
+    ephemeralExpiryFailures = new Map();
     control;
     wakeTimer;
     nextDiscoveryAt = 0;
-    nextDoctorAt = 0;
+    nextManagedCodexCheckAt = 0;
     nextPeerRefreshAt = 0;
-    codexDoctorResult;
+    managedCodexSocketHeldOutside = false;
     revision = 0;
     snapshotRevision = 0;
     snapshotFingerprint;
@@ -163,10 +195,9 @@ export class GatewayService {
         this.config = options.config;
         this.adapters = [...(options.adapters ?? [])];
         this.store = options.store ?? new GatewayStore(options.config, options.now === undefined ? {} : { now: options.now });
-        this.publishDashboard = options.publishDashboard ?? publishGatewayDashboard;
         this.now = options.now ?? (() => new Date());
         this.nativePeerCwd = options.nativePeerCwd ?? process.cwd();
-        this.codexDoctor = options.codexDoctor;
+        this.managedCodexSocketHeld = options.managedCodexSocketHeld;
         this.spawnPeer = options.spawnPeer ?? spawnPeerClient;
         this.timers = options.timers ?? {
             setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
@@ -211,7 +242,7 @@ export class GatewayService {
                 }
             }
             await this.refreshClaudeDiscovery().catch(() => undefined);
-            await this.refreshCodexDoctor().catch(() => undefined);
+            await this.refreshManagedCodexSocket().catch(() => undefined);
             const control = await startGatewayControlServer({
                 stateDir: this.store.rootDir,
                 socketPath: this.config.controlSocketPath,
@@ -230,11 +261,10 @@ export class GatewayService {
             await this.observeLoadedRoutes();
             const now = this.now().getTime();
             this.nextDiscoveryAt = now + DISCOVERY_INTERVAL_MS;
-            this.nextDoctorAt = now + CODEX_DOCTOR_INTERVAL_MS;
-            this.nextPeerRefreshAt = (this.config.peerNodes?.length ?? 0) > 0 ? now : 0;
+            this.nextManagedCodexCheckAt = now + MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS;
+            this.nextPeerRefreshAt = this.config.peerNodes.length > 0 ? now : 0;
             for (const target of await this.store.inspectDispatchableTargets())
                 this.kick(target);
-            await this.publish();
             this.scheduleWake();
             assertActive();
         }
@@ -307,7 +337,6 @@ export class GatewayService {
                 this.assertWritable();
                 await operation();
                 this.revision += 1;
-                await this.publish();
                 return { accepted: true, code: "ok" };
             }
             catch (error) {
@@ -322,7 +351,6 @@ export class GatewayService {
                     this.assertWritable();
                     const token = await this.registerPeer(params);
                     this.revision += 1;
-                    await this.publish();
                     return token === undefined ? { accepted: true, code: "ok" } : { accepted: true, code: "ok", token };
                 }
                 catch (error) {
@@ -333,25 +361,24 @@ export class GatewayService {
             awaitPeer: (params) => this.awaitPeer(params),
             peerReceipt: (params) => decide(async () => this.peerReceipt(params), true),
             unregisterCodex: (params) => decide(async () => this.unregisterCodex(params)),
-            removeCodexRegistration: (params) => decide(async () => this.removeCodexRegistration(params.alias)),
-            selectClaude: (params) => decide(async () => this.selectClaude(params)),
-            unselectClaude: (params) => decide(async () => this.unselectClaude(params)),
-            pair: (params) => decide(async () => this.pair(params)),
-            unpair: (params) => decide(async () => this.unpair(params)),
             listSnapshot: () => this.snapshot(),
             observeSnapshot: () => this.observeSnapshot(),
             deliveryStatus: (params) => this.deliveryStatus(params.token),
-            untrack: (params) => decide(async () => this.untrack(params.conversationId)),
-            sendToClaude: (params) => this.sendToClaude(params),
-            sendToCodex: (params) => this.sendToCodex(params),
-            reply: (params) => this.reply(params),
-            refreshDashboard: async () => {
+            send: (params) => this.send(params),
+            refreshDiscovery: async () => {
                 if (this.closing) {
                     return { accepted: false, code: "unavailable", revision: this.revision };
                 }
-                await this.refreshClaudeDiscovery().catch(() => undefined);
-                await this.recordActivity("discovery", "discovery_refreshed", [], true);
-                await this.publish();
+                try {
+                    // An operator-triggered rescan reports its own failure. It must never
+                    // journal `discovery_refreshed` for a scan that did not complete, and
+                    // must never answer `accepted: true` for a provider that is down.
+                    await this.refreshClaudeDiscovery();
+                    await this.recordActivity("discovery", "discovery_refreshed", [], true);
+                }
+                catch (error) {
+                    return { accepted: false, code: decisionFor(error).code, revision: this.revision };
+                }
                 return { accepted: true, code: "ok", revision: this.revision };
             },
             peerCatalog: ({ peerHost }) => this.buildPeerCatalog(peerHost),
@@ -359,15 +386,18 @@ export class GatewayService {
         };
     }
     async buildPeerCatalog(peerHost) {
-        const localHost = this.config.hostId ?? this.config.allowedHosts[0];
-        if (!(this.config.peerNodes ?? []).includes(peerHost))
+        const localHost = this.config.hostId;
+        if (!this.config.peerNodes.includes(peerHost))
             throw new BridgeError("PEER_NOT_CONFIGURED", "The requested peer host is not configured.");
-        const [snapshot, privateRoutes, privateEdges] = await Promise.all([
-            this.snapshot(), this.store.inspectPrivateRoutes(), this.store.inspectPrivateConsentEdges(),
+        const [snapshot, privateRoutes] = await Promise.all([
+            this.snapshot(), this.store.inspectPrivateRoutes(),
         ]);
-        const localRoutes = privateRoutes.filter((route) => route.registrationMode !== "federated_peer" && route.binding.hostId === localHost);
+        // An ephemeral registration is never published: a peer node that mirrored
+        // one would hold a route this broker will delete on a timer and can never
+        // restore, and a self-test must not leave a trace on another machine.
+        const localRoutes = privateRoutes.filter((route) => route.registrationMode !== "federated_peer" &&
+            route.binding.hostId === localHost && !this.store.isEphemeralRegistration(route.binding.registrationId));
         const publicRoutes = new Map(snapshot.routes.map((route) => [route.alias, route]));
-        const routeByAlias = new Map(privateRoutes.map((route) => [route.alias, route]));
         const routes = localRoutes.map((route) => {
             const row = publicRoutes.get(route.alias);
             return {
@@ -377,30 +407,16 @@ export class GatewayService {
                 ...(row?.safeErrorCode === undefined ? {} : { safeErrorCode: row.safeErrorCode }),
             };
         });
-        const consentEdges = privateEdges.flatMap((edge) => {
-            if (edge.endpoints.map((endpoint) => aliasHost(endpoint.alias)).sort()[0] !== localHost)
-                return [];
-            const rows = edge.endpoints.map((endpoint) => routeByAlias.get(endpoint.alias));
-            if (rows[0] === undefined || rows[1] === undefined ||
-                !rows.some((route) => route?.binding.hostId === peerHost) ||
-                !rows.some((route) => route?.binding.hostId === localHost))
-                return [];
-            const endpoint = (route) => ({ alias: route.alias, provider: route.binding.provider,
-                host: route.binding.hostId, routeRef: route.registrationMode === "federated_peer"
-                    ? route.binding.routeHandle : peerRouteRef(localHost, route.binding.registrationId) });
-            const endpoints = [endpoint(rows[0]), endpoint(rows[1])];
-            return [{ ref: peerEdgeRef(endpoints), ownerHost: localHost, endpoints }];
-        });
         return { revision: this.revision, complete: true, truncated: false, generatedAt: snapshot.generatedAt,
             health: snapshot.health, connectors: snapshot.connectors.filter((row) => row.host === localHost).map((row) => ({
                 provider: row.provider, host: row.host, health: row.health, protocol: row.protocol, protocolVersion: row.protocolVersion,
                 ...(row.lastSeenAt === undefined ? {} : { lastSeenAt: row.lastSeenAt }),
                 ...(row.observationAgeMs === undefined ? {} : { observationAgeMs: row.observationAgeMs }),
                 ...(row.safeErrorCode === undefined ? {} : { safeErrorCode: row.safeErrorCode }),
-            })), routes, consentEdges, alerts: snapshot.alerts.filter((alert) => (alert.host === undefined || alert.host === localHost) && (alert.alias === undefined || aliasHost(alert.alias) === localHost)), };
+            })), routes, alerts: snapshot.alerts.filter((alert) => (alert.host === undefined || alert.host === localHost) && (alert.alias === undefined || aliasHost(alert.alias) === localHost)), };
     }
     async receivePeerHandoff(peerHost, handoff) {
-        if (!(this.config.peerNodes ?? []).includes(peerHost))
+        if (!this.config.peerNodes.includes(peerHost))
             throw new BridgeError("PEER_NOT_CONFIGURED", "The sending peer host is not configured.");
         const enqueued = await this.store.enqueuePeerHandoff(peerHost, handoff);
         if (enqueued.messageId !== undefined) {
@@ -411,12 +427,11 @@ export class GatewayService {
             const conversationId = conversationIdForSuffix(handoff.conversationCorrelation);
             this.rememberConversation({ id: conversationId, sourceAlias: source.alias, targetAlias: target.alias,
                 sourceBinding: source.binding, targetBinding: target.binding, expectsReply: handoff.expectsReply,
-                pair: true, nextSequence: 1 });
+                nextSequence: 1 });
             this.messageContexts.set(enqueued.messageId, { conversationId, expectsReply: handoff.expectsReply });
             this.kick(target.alias, target.binding.registrationId);
         }
         this.revision += 1;
-        await this.publish();
         return { accepted: true };
     }
     async snapshot() {
@@ -450,30 +465,23 @@ export class GatewayService {
             const age = observedAt === undefined ? undefined : Math.max(0, now.getTime() - Date.parse(observedAt));
             const stale = runtime.health === "healthy" &&
                 (age === undefined || age > CONNECTOR_OBSERVATION_STALE_AFTER_MS);
-            const doctor = runtime.adapter.identity.provider === "codex" ? this.codexDoctorResult : undefined;
-            const doctorConditions = doctor === undefined
-                ? [] : [...new Set(doctor.conditions)];
-            if (doctor !== undefined && stale && !doctorConditions.includes("observation_stale"))
-                doctorConditions.push("observation_stale");
-            const managedLayoutMissing = doctorConditions.includes("managed_layout_missing");
+            const socketHeld = runtime.adapter.identity.provider === "codex" && this.managedCodexSocketHeldOutside;
             const connectorCode = stale ? "CONNECTOR_OBSERVATION_STALE" : runtime.safeErrorCode ??
-                (managedLayoutMissing ? "MANAGED_CODEX_UNAVAILABLE" : undefined);
+                (socketHeld ? "MANAGED_CODEX_UNAVAILABLE" : undefined);
             return {
                 provider: runtime.adapter.identity.provider,
                 host: runtime.adapter.identity.hostId,
-                health: stale || managedLayoutMissing ? "degraded" : runtime.health,
+                health: stale || socketHeld ? "degraded" : runtime.health,
                 protocol: runtime.adapter.protocol,
                 protocolVersion: runtime.adapter.protocolVersion,
                 ...(observedAt === undefined ? {} : { lastSeenAt: observedAt }),
                 ...(age === undefined ? {} : { observationAgeMs: age }),
-                ...(doctorConditions.length === 0 ? {} : {
-                    codexDoctor: { conditions: doctorConditions.slice(0, 2) },
-                }),
                 ...(runtime.registry === undefined ? {} : { registry: runtime.registry }),
                 ...(connectorCode === undefined ? {} : { safeErrorCode: connectorCode }),
             };
         });
         const availablePeers = [...this.candidates.values()]
+            .filter((candidate) => !this.collidingClaudeAliases.has(candidate.alias))
             .slice(0, gatewayPublicSnapshotLimits.availablePeers)
             .map((candidate) => ({
             alias: candidate.alias,
@@ -481,20 +489,9 @@ export class GatewayService {
             host: candidate.adapter.identity.hostId,
             state: candidate.state,
             validated: true,
-            selected: routes.some((route) => route.provider === "claude" && route.alias === candidate.alias),
+            routed: routes.some((route) => route.provider === "claude" && route.alias === candidate.alias),
             lastSeenAt: candidate.observedAt,
         }));
-        const progressWatches = [...this.progressWatches.values()]
-            .slice(0, gatewayPublicSnapshotLimits.progressWatches)
-            .map((watch) => ({
-            conversationIdSuffix: watch.conversationId.slice(-8),
-            ownerAlias: watch.ownerAlias,
-            workerAlias: watch.workerAlias,
-            lastActivityAt: watch.lastActivityAt,
-            nextActionAt: watch.nextActionAt,
-            nudgeCount: watch.nudgeCount,
-        }));
-        const progressWatchEvents = this.progressWatchEvents.slice(-gatewayPublicSnapshotLimits.progressWatchEvents);
         return projectGatewayPublicSnapshot({
             ...base,
             generatedAt: now.toISOString(),
@@ -506,14 +503,8 @@ export class GatewayService {
             connectors,
             availablePeers,
             routes,
-            progressWatches,
-            progressWatchEvents,
             alerts: [...base.alerts, ...this.runtimeAlerts].slice(-gatewayPublicSnapshotLimits.alerts),
-            truncation: {
-                ...base.truncation,
-                progressWatches: Math.max(0, this.progressWatches.size - progressWatches.length),
-                progressWatchEvents: Math.max(0, this.progressWatchEvents.length - progressWatchEvents.length),
-            },
+            truncation: base.truncation,
         }, GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET);
     }
     async observeSnapshot() {
@@ -594,7 +585,7 @@ export class GatewayService {
     }
     async advertise(route) {
         const hostId = route.registrationMode === "federated_peer"
-            ? (this.config.hostId ?? this.config.allowedHosts[0]) : route.binding.hostId;
+            ? this.config.hostId : route.binding.hostId;
         await this.claudeAdapter(hostId)?.advertiseNativeSourcePeer?.({
             alias: route.alias,
             sourceProvider: route.binding.provider,
@@ -603,7 +594,7 @@ export class GatewayService {
     }
     async unadvertise(route) {
         const hostId = route.registrationMode === "federated_peer"
-            ? (this.config.hostId ?? this.config.allowedHosts[0]) : route.binding.hostId;
+            ? this.config.hostId : route.binding.hostId;
         await this.claudeAdapter(hostId)?.unadvertiseNativeSourcePeer?.(route.alias);
     }
     reconcileAdvertisement(route) {
@@ -612,7 +603,7 @@ export class GatewayService {
     async reconcileUnadvertisement(route) {
         await this.unadvertise(route).catch((error) => this.alert("NATIVE_UNADVERTISEMENT_FAILED", route, error));
     }
-    async removeOwnedRoute(route, notFoundCode, releaseProviderRoute) {
+    async removeOwnedRoute(route) {
         this.assertWritable();
         const result = await this.store.removeOwnedRouteAtomic({
             alias: route.alias,
@@ -620,16 +611,10 @@ export class GatewayService {
             activity: { operatorAction: true },
         });
         if (!result.removed)
-            throw new BridgeError(notFoundCode, "The exact route is absent.");
+            throw new BridgeError("CODEX_REGISTRATION_NOT_FOUND", "The exact route is absent.");
         await this.finishSettlements(result.settlements);
-        this.settleWatchesForAlias(route.alias, "endpoint_retired", "operator");
         this.forgetRoute(route);
-        if (releaseProviderRoute) {
-            await this.adapterFor(route.binding)?.releaseRoute?.(route.binding.routeHandle);
-        }
-        else {
-            await this.reconcileUnadvertisement(route);
-        }
+        await this.reconcileUnadvertisement(route);
     }
     async recordActivity(kind, action, aliases, operatorAction) {
         await this.store.recordActivity({
@@ -690,7 +675,6 @@ export class GatewayService {
             activity: { operatorAction: true },
         });
         await this.finishSettlements(result.settlements);
-        this.settleWatchesForAlias(previous.alias, "endpoint_retired", "operator");
         if (!result.idempotent) {
             this.forgetRoute(previous);
             this.reconcileUnadvertisement(previous);
@@ -714,15 +698,20 @@ export class GatewayService {
             this.kick(existing.alias, existing.binding.registrationId);
             return undefined;
         }
-        if (params.token !== undefined || !params.alias.endsWith(`@${this.config.hostId ?? this.config.allowedHosts[0]}`)) {
+        if (params.token !== undefined || !params.alias.endsWith(`@${this.config.hostId}`)) {
             throw new BridgeError("ROUTE_UNREGISTERED", "The route binding does not match.");
         }
         const token = `peer_${randomBytes(24).toString("base64url")}`;
         await this.store.registerRoute({ alias: params.alias, binding: {
-                provider: "peer", hostId: this.config.hostId ?? this.config.allowedHosts[0],
+                provider: "peer", hostId: this.config.hostId,
                 routeHandle: peerHandle(process.getuid(), params.alias, token), registrationId: registrationId(),
-            }, registrationMode: "explicit_opt_in" });
+            }, registrationMode: "explicit_opt_in",
+            ...(params.ephemeral === true ? { ephemeral: true } : {}) });
         const installed = (await this.store.inspectPrivateRoute(params.alias));
+        if (params.ephemeral === true) {
+            this.ephemeralPeerExpiries.set(installed.alias, this.now().getTime() + (params.ttlMs ?? GATEWAY_EPHEMERAL_PEER_TTL_DEFAULT_MS));
+            this.scheduleWake();
+        }
         this.observeRoute(installed);
         this.reconcileAdvertisement(installed);
         return token;
@@ -743,19 +732,86 @@ export class GatewayService {
         if (this.peerCleanupAliases.has(route.alias))
             throw new BridgeError("ROUTE_BUSY", "The route is still completing cleanup.", true);
         this.peerCleanupAliases.add(route.alias);
+        // The expiry leaves the map before the removal, under the same cleanup
+        // guard, so a clock that fires mid-removal has nothing to act on; a
+        // removal that does not happen puts it back, so a refused unregister
+        // still leaves the registration to its own expiry.
+        const expiry = this.ephemeralPeerExpiries.get(route.alias);
+        this.ephemeralPeerExpiries.delete(route.alias);
+        this.ephemeralExpiryFailures.delete(route.alias);
+        let removed = false;
         try {
             const result = await this.store.removeOwnedRouteAtomic({ alias: route.alias, binding: route.binding });
             if (!result.removed)
                 throw new BridgeError("ROUTE_UNREGISTERED", "The route binding does not match.");
+            removed = true;
             await this.finishSettlements(result.settlements);
-            this.settleWatchesForAlias(route.alias, "endpoint_retired", "operator");
             this.forgetRoute(route);
             await this.reconcileUnadvertisement(route);
         }
         finally {
+            if (!removed && expiry !== undefined)
+                this.ephemeralPeerExpiries.set(route.alias, expiry);
             this.peerCleanupAliases.delete(route.alias);
         }
     }
+    /**
+     * Retires every ephemeral peer registration whose lifetime has run out. It
+     * is the same removal an explicit `unregister-peer` performs — queued work
+     * is settled, not abandoned — minus the token check, because the authority
+     * here is the clock the broker set itself.
+     *
+     * The clock is keyed by alias, and an alias can be re-registered durably
+     * after its ephemeral holder left, so nothing is retired unless the route
+     * behind the alias is still an ephemeral one. A retirement that throws
+     * keeps its entry and is retried `EPHEMERAL_EXPIRY_RETRY_MS` later, with an
+     * alert each time; after `EPHEMERAL_EXPIRY_MAX_ATTEMPTS` consecutive
+     * failures the entry is dropped and the registration is left to the next
+     * restart, which clears it by construction.
+     */
+    async expireEphemeralPeers(now) {
+        for (const [alias, expiresAt] of [...this.ephemeralPeerExpiries]) {
+            if (expiresAt > now)
+                continue;
+            // Another owner is mid-removal; the entry is theirs to clear or restore.
+            if (this.peerCleanupAliases.has(alias))
+                continue;
+            const route = await this.store.inspectPrivateRoute(alias);
+            if (route === undefined || !this.store.isEphemeralRegistration(route.binding.registrationId)) {
+                this.ephemeralPeerExpiries.delete(alias);
+                this.ephemeralExpiryFailures.delete(alias);
+                continue;
+            }
+            this.peerCleanupAliases.add(alias);
+            try {
+                const result = await this.store.removeOwnedRouteAtomic({ alias, binding: route.binding });
+                if (result.removed) {
+                    await this.finishSettlements(result.settlements);
+                    this.forgetRoute(route);
+                    await this.reconcileUnadvertisement(route);
+                }
+                // Not removed means the binding changed underneath: the alias belongs
+                // to someone else now, and this clock is spent either way.
+                this.ephemeralPeerExpiries.delete(alias);
+                this.ephemeralExpiryFailures.delete(alias);
+            }
+            catch (error) {
+                this.alert("EPHEMERAL_ROUTE_EXPIRY_FAILED", route, error);
+                const attempts = (this.ephemeralExpiryFailures.get(alias) ?? 0) + 1;
+                if (attempts >= EPHEMERAL_EXPIRY_MAX_ATTEMPTS) {
+                    this.ephemeralPeerExpiries.delete(alias);
+                    this.ephemeralExpiryFailures.delete(alias);
+                }
+                else {
+                    this.ephemeralExpiryFailures.set(alias, attempts);
+                    this.ephemeralPeerExpiries.set(alias, now + EPHEMERAL_EXPIRY_RETRY_MS);
+                }
+            }
+            finally {
+                this.peerCleanupAliases.delete(alias);
+            }
+        }
+    }
     async awaitPeer(params) {
         this.assertWritable();
         const route = await this.assertPeer(params);
@@ -780,33 +836,56 @@ export class GatewayService {
             route.binding.routeHandle !== params.threadId) {
             throw new BridgeError("CODEX_REGISTRATION_NOT_FOUND", "The exact Codex registration is absent.");
         }
-        await this.removeOwnedRoute(route, "CODEX_REGISTRATION_NOT_FOUND", false);
-    }
-    async removeCodexRegistration(alias) {
-        const route = await this.store.inspectPrivateRoute(alias);
-        if (route === undefined || route.binding.provider !== "codex" || route.registrationMode === "federated_peer") {
-            throw new BridgeError("CODEX_REGISTRATION_NOT_FOUND", "The Codex registration is absent.");
-        }
-        await this.removeOwnedRoute(route, "CODEX_REGISTRATION_NOT_FOUND", false);
-    }
-    async selectClaude(params) {
-        const selected = await this.resolveClaudeSelector(params.alias, true);
-        if (selected === undefined) {
-            throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "The Claude session is not currently selectable.");
-        }
-        const adapter = selected.adapter;
+        if (route.registrationMode === "federated_peer") {
+            throw new BridgeError("FEDERATED_ROUTE_READ_ONLY", "A federated route is owned by its peer node and cannot be unregistered here.");
+        }
+        await this.removeOwnedRoute(route);
+    }
+    /**
+     * The name this session may take. A name belongs to one route at a time, so
+     * when another Claude route already holds it and THAT route's session is
+     * still live, this session takes a disambiguated name rather than displacing
+     * a working session and cancelling its queued work. Twins that share a
+     * display name therefore both keep routes and both stay reachable by UUID;
+     * only a route whose session is actually gone is displaced.
+     */
+    claimableAlias(candidate, routes) {
+        const holder = routes.find((route) => route.alias === candidate.alias &&
+            route.binding.provider === "claude" &&
+            !(route.binding.hostId === candidate.adapter.identity.hostId &&
+                route.binding.routeHandle === candidate.routeHandle));
+        if (holder === undefined)
+            return candidate.alias;
+        const holderIsLive = [...this.candidates.values()].some((row) => row.adapter.identity.hostId === holder.binding.hostId &&
+            row.routeHandle === holder.binding.routeHandle);
+        return holderIsLive
+            ? disambiguatedAlias(candidate.alias, candidate.routeHandle)
+            : candidate.alias;
+    }
+    /**
+     * Installs (or brings up to date) the route of one discovered Claude
+     * session. The adapter pins the session's route handle, the workspace
+     * check keeps deliberately broad workspaces out, and the store reuses the
+     * registration of a session already bound under the same (host, UUID) so a
+     * re-anchored or renamed session keeps its identity and in-flight
+     * conversations. Any Claude route the install displaced is forgotten and
+     * released at the adapter; its work was settled `ENDPOINT_RETIRED` by the
+     * store — and only a route whose own session is gone is ever displaced.
+     */
+    async installClaudeRoute(candidate) {
+        const adapter = candidate.adapter;
         if (adapter.selectRoute === undefined) {
-            throw new BridgeError("CLAUDE_PROVIDER_UNAVAILABLE", "The Claude provider cannot select routes.");
+            throw new BridgeError("CLAUDE_PROVIDER_UNAVAILABLE", "The Claude provider cannot install routes.");
         }
-        await adapter.assertWorkspaceDisjoint?.(selected.routeHandle, this.store.rootDir);
-        const chosen = await adapter.selectRoute({ alias: selected.alias, routeHandle: selected.routeHandle });
+        await adapter.assertWorkspaceDisjoint?.(candidate.routeHandle, this.store.rootDir);
+        const chosen = await adapter.selectRoute({ alias: candidate.alias, routeHandle: candidate.routeHandle });
         this.assertWritable();
         const before = (await this.store.listLogicalRoutes()).filter((route) => route.binding.provider === "claude");
-        const existing = before.find((route) => route.binding.provider === "claude" &&
-            route.binding.hostId === adapter.identity.hostId &&
+        const alias = this.claimableAlias(candidate, before);
+        const existing = before.find((route) => route.binding.hostId === adapter.identity.hostId &&
             route.binding.routeHandle === chosen.routeHandle);
-        const result = await this.store.replaceClaudeSelection({
-            alias: selected.alias,
+        const input = {
+            alias,
             binding: {
                 provider: "claude",
                 hostId: adapter.identity.hostId,
@@ -814,112 +893,196 @@ export class GatewayService {
                 registrationId: existing?.binding.registrationId ?? registrationId(),
             },
             registrationMode: "selected_live_peer",
-        });
+        };
+        const result = await this.installWithConcurrentFirstSend(input, adapter.identity.hostId, chosen.routeHandle);
         await this.finishSettlements(result.settlements);
         const after = (await this.store.listLogicalRoutes()).filter((route) => route.binding.provider === "claude");
         for (const prior of before) {
-            const retained = after.find((route) => route.alias === prior.alias);
-            if (retained === undefined || !sameBinding(retained.binding, prior.binding)) {
-                this.settleWatchesForAlias(prior.alias, "endpoint_retired", "operator");
+            const retained = after.find((route) => route.binding.registrationId === prior.binding.registrationId);
+            if (retained === undefined) {
+                // Displaced: the alias now names another session.
                 this.forgetRoute(prior);
                 void this.adapterFor(prior.binding)?.releaseRoute?.(prior.binding.routeHandle)
                     .catch((error) => this.alert("ROUTE_RELEASE_FAILED", prior, error));
             }
+            else if (retained.alias !== prior.alias) {
+                // Renamed: identity kept, the stale display-only observation goes and
+                // open conversations follow the session to its new name.
+                this.routeObservations.delete(prior.alias);
+                this.renameConversationCoordinates(prior.alias, retained.alias, prior.binding.registrationId);
+            }
         }
-        const installed = (await this.store.inspectPrivateRoute(selected.alias));
+        const installed = (await this.store.inspectPrivateRoute(alias));
         this.observeRoute(installed);
-        this.routeObservations.set(selected.alias, {
+        this.routeObservations.set(alias, {
             route: installed.binding,
             state: chosen.state,
             observedAt: this.now().toISOString(),
         });
-        await this.recordActivity("selection", "claude_selected", [selected.alias], true);
-        this.kick(selected.alias);
-    }
-    async unselectClaude(params) {
-        const route = await this.resolveSelectedClaudeRoute(params.alias);
-        if (route === undefined || route.registrationMode === "federated_peer")
-            throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "The selected Claude route is absent.");
-        await this.removeOwnedRoute(route, "CLAUDE_ROUTE_NOT_FOUND", true);
-    }
-    async pair(params) {
-        const endpoints = await this.resolvePairEndpoints(params, true);
-        const aliases = endpoints.aliases;
-        const ownerHost = aliases.map(aliasHost).sort()[0];
-        if ((this.config.hostId ?? this.config.allowedHosts[0]) !== ownerHost)
-            throw new ConsentOwnerError(ownerHost);
-        const attestation = pairParamThreadAttestation(params);
-        if (attestation !== undefined)
-            await this.assertThread(attestation.alias, attestation.threadId);
-        this.assertWritable();
-        const existed = await this.store.hasConsentEdge(endpoints);
-        await this.store.addConsentEdge(endpoints);
-        if (!existed)
-            await this.recordActivity("pairing", "routes_paired", [...aliases], true);
-    }
-    async unpair(params) {
-        const endpoints = await this.resolvePairEndpoints(params, false);
-        const aliases = endpoints.aliases;
-        const ownerHost = aliases.map(aliasHost).sort()[0];
-        if ((this.config.hostId ?? this.config.allowedHosts[0]) !== ownerHost)
-            throw new ConsentOwnerError(ownerHost);
-        const attestation = pairParamThreadAttestation(params);
-        if (attestation !== undefined)
-            await this.assertThread(attestation.alias, attestation.threadId);
-        this.assertWritable();
-        const existed = await this.store.hasConsentEdge(endpoints);
-        const result = await this.store.removeConsentEdge(endpoints);
-        await this.finishSettlements(result.settlements);
-        for (const alias of aliases)
-            this.settleWatchesForAlias(alias, "pair_removed", "operator");
-        if (existed)
-            await this.recordActivity("pairing", "routes_unpaired", [...aliases], true);
-        for (const alias of aliases)
-            this.kick(alias);
-    }
-    async resolvePairEndpoints(params, maySelect) {
-        const raw = pairParamAliases(params);
-        const aliases = [raw[0], raw[1]];
-        for (let index = 0; index < aliases.length; index += 1) {
-            if (PUBLIC_ALIAS.test(aliases[index]))
-                continue;
-            const selected = await this.resolveClaudeSelector(aliases[index], maySelect);
-            if (selected === undefined)
-                throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "The Claude selector is unavailable.");
-            if (maySelect)
-                await this.selectClaude({ alias: aliases[index] });
-            aliases[index] = selected.alias;
-        }
-        const left = await this.store.inspectPrivateRoute(aliases[0]);
-        const right = await this.store.inspectPrivateRoute(aliases[1]);
-        if (left === undefined || right === undefined) {
-            throw new BridgeError("ROUTE_NOT_AVAILABLE", "The pair endpoint is absent.");
+        if (result.installed)
+            this.revision += 1;
+        this.kick(alias);
+        return installed;
+    }
+    /**
+     * Two first sends to the same never-installed session race: both read no
+     * route and both mint a registration, and the loser's write is refused
+     * because the identity is now bound. That is a race, not a conflict — the
+     * session is exactly the one the loser resolved — so re-read once and adopt
+     * the registration that won instead of failing an honest send.
+     */
+    async installWithConcurrentFirstSend(input, hostId, routeHandle) {
+        try {
+            return await this.store.installClaudeRoute(input);
+        }
+        catch (error) {
+            if (!(error instanceof BridgeError) || error.code !== "ROUTE_IDENTITY_ALREADY_REGISTERED")
+                throw error;
+            const bound = (await this.store.listLogicalRoutes()).find((route) => route.binding.provider === "claude" &&
+                route.binding.hostId === hostId &&
+                route.binding.routeHandle === routeHandle);
+            if (bound === undefined)
+                throw error;
+            return await this.store.installClaudeRoute({
+                ...input,
+                binding: { ...input.binding, registrationId: bound.binding.registrationId },
+            });
         }
-        return {
-            aliases,
-            expectedRegistrationIds: [
-                left.binding.registrationId,
-                right.binding.registrationId,
-            ],
-        };
+    }
+    /**
+     * Looks a Claude selector up without writing anything. Callers that may
+     * still refuse — a `--from` alias that must match the sending session, a
+     * native sender whose adapter-reported name must match discovery — resolve
+     * here first, refuse on the read, and only then materialize.
+     *
+     * THE ALIAS-COLLISION FENCE lives here (emb-94, moved into the send path by
+     * emb-104). Invariant: discovery is refreshed inside every send that
+     * addresses a Claude session, never only on the timer; a NAME currently
+     * shared by more than one live session is refused with a hard,
+     * non-retryable `PEER_ALIAS_COLLISION` naming that alias, so the broker
+     * never picks first and never installs a route under an ambiguous name;
+     * collisions stay sticky while a scan is incomplete
+     * (`collidingClaudeAliases` retention in refreshClaudeDiscovery); and
+     * `availablePeers` keeps filtering colliders so `status` never lists an
+     * unaddressable name.
+     *
+     * The fence is a fence on NAMES, not on sessions. A session UUID is
+     * unambiguous by construction, so a UUID selector — an explicit
+     * `send --to <uuid>`, an identity-pinned route addressed by its own handle,
+     * or a sender resolved from its inherited socket — passes the fence even
+     * while its display name collides. That is the emb-94 escape hatch: the
+     * operator can always reach an ambiguously named session, and a collision on
+     * a *sender's* name never silences that sender, whose identity was attested
+     * rather than typed. In-flight conversations are likewise unaffected:
+     * `reply` resolves by exact binding.
+     */
+    async lookUpClaudeRoute(selector, hostId) {
+        await this.refreshClaudeDiscovery().catch(() => undefined);
+        if (PUBLIC_ALIAS.test(selector) && this.collidingClaudeAliases.has(selector)) {
+            throw new BridgeError("PEER_ALIAS_COLLISION", `The Claude alias ${selector} names more than one live session; rename one, or address the session by UUID.`);
+        }
+        const routed = (await this.store.listLogicalRoutes()).find((route) => route.binding.provider === "claude" &&
+            (hostId === undefined || route.binding.hostId === hostId) &&
+            (route.alias === selector || route.binding.routeHandle === selector));
+        const candidate = [...this.candidates.values()].find((row) => (hostId === undefined || row.adapter.identity.hostId === hostId) &&
+            (row.routeHandle === selector || row.alias === selector));
+        return { routed, candidate };
+    }
+    /**
+     * The name discovery currently shows for a looked-up session, which a caller
+     * compares against the alias it claimed before anything is written.
+     */
+    claimedAlias(resolution) {
+        const alias = resolution.candidate?.alias ?? resolution.routed?.alias;
+        if (alias === undefined) {
+            throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "No live Claude session matches that name or UUID; run `embassy refresh` and check `embassy status`.");
+        }
+        return alias;
+    }
+    /** Installs the looked-up session's route if it is not already current. */
+    async materializeClaudeRoute(resolution) {
+        const { routed, candidate } = resolution;
+        if (candidate === undefined) {
+            if (routed !== undefined)
+                return routed;
+            throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "No live Claude session matches that name or UUID; run `embassy refresh` and check `embassy status`.");
+        }
+        if (routed !== undefined &&
+            routed.binding.hostId === candidate.adapter.identity.hostId &&
+            routed.binding.routeHandle === candidate.routeHandle &&
+            routed.alias === this.claimableAlias(candidate, await this.store.listLogicalRoutes()))
+            return routed;
+        return await this.installClaudeRoute(candidate);
+    }
+    async resolveClaudeRoute(selector, hostId) {
+        return await this.materializeClaudeRoute(await this.lookUpClaudeRoute(selector, hostId));
     }
     async assertThread(alias, threadId) {
         const route = await this.store.inspectPrivateRoute(alias);
-        if (route?.binding.provider !== "codex" || route.binding.routeHandle !== threadId) {
+        // No registration at all is its own condition — the state every Codex
+        // task is in after a private state reset — and is never dressed up as a
+        // thread mismatch, which would send the operator hunting a wrong id.
+        if (route === undefined)
+            throw new BridgeError("ROUTE_UNREGISTERED", "The route is not registered.");
+        if (route.binding.provider !== "codex" || route.binding.routeHandle !== threadId) {
             throw new BridgeError("CODEX_THREAD_MISMATCH", "The task attestation does not match the route.");
         }
         return route;
     }
+    /**
+     * Direction follows the inherited principal, not the route table: a Claude
+     * session or its target may have no route yet, because routes install on
+     * first send. A Codex task sends to Claude sessions and shell peers; a
+     * Claude session sends to Codex tasks and shell peers (Claude-to-Claude is
+     * native); a shell peer sends to either.
+     */
+    async send(params) {
+        if (params.conversationId !== undefined)
+            return await this.replyToConversation(params);
+        const target = await this.store.inspectPrivateRoute(params.toAlias);
+        if ("replyAddress" in params && params.replyAddress !== undefined) {
+            // A UUID names a Claude session as surely as a name does: recognize it
+            // here, or a Claude-to-Claude send addressed by UUID falls through to the
+            // Codex path and is answered as an unknown target.
+            const claudeTarget = target?.binding.provider === "claude" ||
+                (target === undefined && [...this.candidates.values()].some((row) => row.alias === params.toAlias || row.routeHandle === params.toAlias));
+            return claudeTarget ? { accepted: false, code: "route_mismatch" } : this.sendToCodex(params);
+        }
+        if ("threadId" in params && params.threadId !== undefined) {
+            return target?.binding.provider === "codex" ? { accepted: false, code: "route_mismatch" } : this.sendToClaude(params);
+        }
+        return target === undefined || target.binding.provider === "claude" ? this.sendToClaude(params) : this.sendToCodex(params);
+    }
     async sendToClaude(params) {
         try {
             this.assertWritable();
             const source = "peerToken" in params && params.peerToken !== undefined
                 ? await this.assertPeer({ alias: params.fromAlias, token: params.peerToken })
-                : await this.assertThread(params.fromAlias, params.threadId);
+                : params.threadId === undefined
+                    ? undefined
+                    : await this.assertThread(params.fromAlias, params.threadId);
+            if (source === undefined)
+                throw new BridgeError("ROUTE_NOT_AVAILABLE", "The source route is absent.");
             const direct = await this.store.inspectPrivateRoute(params.toAlias);
-            const target = direct?.binding.provider === "peer" ? direct : await this.resolveSelectedClaudeRoute(params.toAlias);
-            if (target === undefined)
-                throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "The selected Claude route is absent.");
+            let target;
+            if (direct?.binding.provider === "peer") {
+                target = direct;
+            }
+            else {
+                const seen = await this.lookUpClaudeRoute(params.toAlias);
+                // Admission before materialization: a send that is already going to be
+                // refused for its own reasons — too large, outside the deadline
+                // window, rate limited, or into a full queue — must not install a
+                // route or displace another session on its way to that refusal.
+                await this.store.assertEnqueueAdmissible({
+                    sourceAlias: params.fromAlias,
+                    targetAlias: this.claimedAlias(seen),
+                    direction: directionId(source.binding.provider, "claude"),
+                    sourceRegistrationId: source.binding.registrationId,
+                    body: params.text,
+                });
+                target = await this.materializeClaudeRoute(seen);
+            }
             return await this.enqueueConversation({
                 sourceAlias: params.fromAlias,
                 targetAlias: target.alias,
@@ -927,13 +1090,10 @@ export class GatewayService {
                 expectsReply: params.expectsReply,
                 expectedSourceBinding: source.binding,
                 expectedTargetBinding: target.binding,
-                ...(params.trackIdleMinutes === undefined
-                    ? {}
-                    : { trackIdleMinutes: params.trackIdleMinutes }),
             });
         }
         catch (error) {
-            return decisionFor(error, "peerToken" in params);
+            return sendRefusal(error, "peerToken" in params);
         }
     }
     async sendToCodex(params) {
@@ -947,13 +1107,18 @@ export class GatewayService {
                 throw new BridgeError("CLAUDE_REPLY_ADDRESS_INVALID", "The inherited reply capability is required.");
             }
             else {
+                // The sending session's identity comes from its inherited socket, never
+                // from --from. Look the session up read-only first: a send that is
+                // about to be refused must not install, rename, or displace a route,
+                // and must not settle another session's queued work.
                 const resolved = await this.claudeAdapter(aliasHost(params.fromAlias))?.resolveReplyAddress?.(params.replyAddress);
                 if (resolved === undefined)
                     throw new BridgeError("CLAUDE_REPLY_ADDRESS_INVALID", "The reply capability is stale.");
-                source = (await this.store.listLogicalRoutes()).find((route) => route.binding.provider === "claude" &&
-                    route.alias === params.fromAlias && route.binding.routeHandle === resolved.routeHandle);
-                if (source === undefined)
-                    throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "The reply route is not selected.");
+                const seen = await this.lookUpClaudeRoute(resolved.routeHandle, aliasHost(params.fromAlias));
+                if (this.claimedAlias(seen) !== params.fromAlias) {
+                    throw new BridgeError("CLAUDE_ROUTE_MISMATCH", "The --from alias does not name the sending Claude session.");
+                }
+                source = await this.materializeClaudeRoute(seen);
             }
             const target = await this.store.inspectPrivateRoute(params.toAlias);
             if (source === undefined || target === undefined) {
@@ -969,23 +1134,26 @@ export class GatewayService {
                 expectsReply: params.expectsReply,
                 expectedSourceBinding: source.binding,
                 expectedTargetBinding: target.binding,
-                ...(params.trackIdleMinutes === undefined
-                    ? {}
-                    : { trackIdleMinutes: params.trackIdleMinutes }),
             });
         }
         catch (error) {
-            return decisionFor(error, "peerToken" in params);
+            return sendRefusal(error, "peerToken" in params);
         }
     }
-    async reply(params) {
+    /**
+     * A send addressed by conversation token: the caller must own one end, the
+     * other end is the binding the conversation recorded, and the caller's
+     * principal is the same attested one every send carries.
+     */
+    async replyToConversation(params) {
         try {
             this.assertWritable();
             const conversation = this.conversations.get(params.conversationId);
             if (conversation === undefined)
                 throw new BridgeError("CONVERSATION_NOT_FOUND", "The conversation is absent.");
-            const callerBinding = await this.assertReplyCaller(conversation, params.caller);
-            const callerAlias = params.caller.alias;
+            const caller = replyCaller(params);
+            const callerBinding = await this.assertReplyCaller(conversation, caller);
+            const callerAlias = caller.alias;
             const targetAlias = callerAlias === conversation.sourceAlias
                 ? conversation.targetAlias
                 : conversation.sourceAlias;
@@ -995,27 +1163,9 @@ export class GatewayService {
             if (targetBinding === undefined) {
                 throw new BridgeError("CONVERSATION_ROUTE_RETIRED", "The conversation endpoint is no longer available.");
             }
-            if (params.caller.kind === "codex" &&
-                conversation.nativeTarget !== undefined &&
-                targetAlias === conversation.nativeTarget.alias) {
-                const enqueued = await this.enqueueNativeConversationReply({
-                    conversation,
-                    sourceAlias: callerAlias,
-                    sourceBinding: callerBinding,
-                    target: conversation.nativeTarget,
-                    text: params.text,
-                    exposeDeliveryToken: true,
-                });
-                if (enqueued.deliveryToken === undefined) {
-                    throw new BridgeError("MESSAGE_NOT_ACCEPTED", "The message was not accepted.");
-                }
-                return {
-                    accepted: true,
-                    code: "ok",
-                    conversationId: conversation.id,
-                    deliveryToken: enqueued.deliveryToken,
-                };
-            }
+            // The target's route was installed when it first sent or was first
+            // sent to; a reply never re-resolves it by alias. A retired binding is
+            // a refusal at enqueue, never a silent retarget.
             return await this.enqueueConversation({
                 sourceAlias: callerAlias,
                 targetAlias,
@@ -1023,14 +1173,11 @@ export class GatewayService {
                 expectsReply: true,
                 expectedSourceBinding: callerBinding,
                 expectedTargetBinding: targetBinding,
-                ...(params.trackIdleMinutes === undefined
-                    ? {}
-                    : { trackIdleMinutes: params.trackIdleMinutes }),
                 existingConversation: conversation,
             });
         }
         catch (error) {
-            return decisionFor(error, params.caller.kind === "peer");
+            return sendRefusal(error, params.peerToken !== undefined);
         }
     }
     async assertReplyCaller(conversation, caller) {
@@ -1049,7 +1196,7 @@ export class GatewayService {
             throw new BridgeError("CODEX_THREAD_MISMATCH", "The task attestation does not match the conversation.");
         }
         if (caller.kind === "claude") {
-            if (caller.replyAddress === undefined || route.binding.provider !== "claude") {
+            if (route.binding.provider !== "claude") {
                 throw new BridgeError("CLAUDE_REPLY_ADDRESS_INVALID", "The inherited reply capability is required.");
             }
             const resolved = await this.claudeAdapter(route.binding.hostId)
@@ -1095,14 +1242,8 @@ export class GatewayService {
             ...(sourceBinding === undefined ? {} : { sourceBinding: { ...sourceBinding } }),
             ...(targetBinding === undefined ? {} : { targetBinding: { ...targetBinding } }),
             expectsReply: input.expectsReply,
-            pair: true,
             nextSequence: 0,
         };
-        const previousWatch = this.progressWatches.get(conversation.id);
-        const previousWatchEvents = this.progressWatchEvents.length;
-        if (input.skipWatch !== true) {
-            await this.updateProgressWatch(conversation, input.sourceAlias, input.text, input.trackIdleMinutes);
-        }
         const sequence = conversation.nextSequence++;
         let enqueued;
         try {
@@ -1123,12 +1264,10 @@ export class GatewayService {
             });
         }
         catch (error) {
-            this.restoreProgressWatch(conversation.id, previousWatch, previousWatchEvents);
             conversation.nextSequence -= 1;
             throw error;
         }
         if (!enqueued.accepted || enqueued.messageId === undefined || enqueued.deliveryToken === undefined) {
-            this.restoreProgressWatch(conversation.id, previousWatch, previousWatchEvents);
             conversation.nextSequence -= 1;
             throw new BridgeError("MESSAGE_NOT_ACCEPTED", "The message was not accepted.");
         }
@@ -1151,6 +1290,23 @@ export class GatewayService {
             deliveryToken: enqueued.deliveryToken,
         };
     }
+    /**
+     * A renamed Claude session is the same principal under a new display name,
+     * so its open conversations follow it: the registration, not the alias, is
+     * the identity, and a reply under the current name must still resolve.
+     */
+    renameConversationCoordinates(oldAlias, newAlias, registrationId) {
+        for (const conversation of this.conversations.values()) {
+            if (conversation.sourceAlias === oldAlias &&
+                conversation.sourceBinding?.registrationId === registrationId) {
+                conversation.sourceAlias = newAlias;
+            }
+            if (conversation.targetAlias === oldAlias &&
+                conversation.targetBinding?.registrationId === registrationId) {
+                conversation.targetAlias = newAlias;
+            }
+        }
+    }
     rememberConversation(conversation) {
         this.conversations.delete(conversation.id);
         this.conversations.set(conversation.id, conversation);
@@ -1213,12 +1369,7 @@ export class GatewayService {
         if (!this.running || this.closing)
             return;
         const route = await this.store.inspectPrivateRoute(targetAlias);
-        const transient = [...this.messageContexts.values()].find((context) => this.conversations.get(context.conversationId)?.nativeTarget?.alias === targetAlias);
-        const transientTarget = transient === undefined
-            ? undefined
-            : this.conversations.get(transient.conversationId)?.nativeTarget;
-        const registration = preferredRegistrationId ?? route?.binding.registrationId ??
-            transientTarget?.binding.registrationId;
+        const registration = preferredRegistrationId ?? route?.binding.registrationId;
         if (registration === undefined)
             return;
         this.startRunner(targetAlias, registration, "any");
@@ -1299,34 +1450,27 @@ export class GatewayService {
             const conversation = messageContext === undefined
                 ? undefined
                 : this.conversations.get(messageContext.conversationId);
-            const transientTarget = conversation?.nativeTarget?.alias === attempt.targetAlias
-                ? conversation.nativeTarget
-                : undefined;
-            const persistedTarget = await this.store.inspectPrivateRoute(attempt.targetAlias);
-            const target = transientTarget !== undefined
-                ? {
-                    alias: transientTarget.alias,
-                    binding: transientTarget.binding,
-                    registrationMode: "selected_live_peer",
-                    enabled: true,
-                }
-                : (persistedTarget === undefined
-                    ? undefined
-                    : persistedTarget);
-            const source = await this.store.inspectPrivateRoute(attempt.sourceAlias);
+            // Resolve by registration, not by the alias captured at reserve: a
+            // session renamed between reserve and dispatch is the same route and
+            // must still be delivered to, under whatever name it carries now.
+            const installed = await this.store.listLogicalRoutes();
+            const byRegistration = (registration, alias) => installed.find((route) => route.binding.registrationId === registration) ??
+                installed.find((route) => route.alias === alias);
+            const target = byRegistration(attempt.targetRegistrationId, attempt.targetAlias);
+            const source = byRegistration(attempt.sourceRegistrationId, attempt.sourceAlias);
             if (this.closing || !this.running) {
                 await this.settleAttemptForShutdown(attempt.messageId, attempt.attemptId);
                 return false;
             }
             if (target === undefined ||
                 target.binding.registrationId !== attempt.targetRegistrationId ||
-                (attempt.sourceRegistrationId !== null && source?.binding.registrationId !== attempt.sourceRegistrationId)) {
+                source?.binding.registrationId !== attempt.sourceRegistrationId) {
                 await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "failed", "ROUTE_UNREGISTERED");
                 return false;
             }
             if (target.registrationMode === "federated_peer") {
                 const peer = this.peerClients.get(target.binding.hostId);
-                if (peer === undefined || source === undefined || source.registrationMode === "federated_peer") {
+                if (peer === undefined || source.registrationMode === "federated_peer") {
                     await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "requeue", "PEER_TUNNEL_UNAVAILABLE");
                     return false;
                 }
@@ -1337,8 +1481,6 @@ export class GatewayService {
                 const params = {
                     originAttemptId: attempt.attemptId, originMessageId: attempt.messageId,
                     source: sourceEndpoint, target: targetEndpoint,
-                    edgeRef: peerEdgeRef([sourceEndpoint, targetEndpoint]),
-                    edgeOwnerHost: [sourceEndpoint.host, targetEndpoint.host].sort()[0],
                     deadlineAt: attempt.deadlineAt, expectsReply: conversation?.expectsReply ?? true,
                     body: attempt.body,
                     ...(attempt.steer === true ? { steer: true } : {}),
@@ -1415,19 +1557,18 @@ export class GatewayService {
                     attemptId: attempt.attemptId,
                     sourceAlias: attempt.sourceAlias,
                     sourceProvider: parsed.sourceProvider,
-                    targetAlias: attempt.targetAlias,
+                    // The route's CURRENT alias, not the one captured at reserve. The
+                    // provider adapters compare this against the alias they hold for the
+                    // binding, so a session renamed between reserve and dispatch would
+                    // otherwise fail its own delivery over a stale display name.
+                    targetAlias: target.alias,
                     conversationId,
                     binding: target.binding,
-                    authorization: transientTarget === undefined
-                        ? "selected_route"
-                        : "native_reply",
+                    authorization: "selected_route",
                     messageId: attempt.messageId,
                     text: attempt.body,
                     expectsReply: conversation?.expectsReply ?? true,
                     deadlineAt: attempt.deadlineAt,
-                    ...(this.progressWatches.has(conversationId)
-                        ? { progressWatchActive: true }
-                        : {}),
                     ...(attempt.steer === true ? { steer: true, queuedAhead: 0 } : {}),
                     authorizeWrite: async (evidence) => {
                         if (evidence.attemptId !== attempt.attemptId)
@@ -1452,8 +1593,7 @@ export class GatewayService {
                             if (authorized.status === "authorized") {
                                 armed = true;
                                 if (target.binding.provider === "claude" &&
-                                    messageContext?.expectsReply === true &&
-                                    source !== undefined) {
+                                    messageContext?.expectsReply === true) {
                                     this.installPendingClaudeReply({
                                         messageId: attempt.messageId,
                                         conversationId,
@@ -1637,30 +1777,31 @@ export class GatewayService {
             }
         }
         this.revision += 1;
-        void this.publish().catch(() => undefined);
     }
     async onClaudeMessage(event) {
         const target = await this.store.inspectPrivateRoute(event.targetAlias);
-        const localHost = this.config.hostId ?? this.config.allowedHosts[0];
+        const localHost = this.config.hostId;
         if (target === undefined || (target.binding.hostId !== event.endpoint.hostId &&
             !(target.registrationMode === "federated_peer" && event.endpoint.hostId === localHost))) {
             throw new BridgeError("ROUTE_NOT_AVAILABLE", "The native target is absent.");
         }
-        const selected = (await this.store.listLogicalRoutes()).find((route) => route.binding.provider === "claude" &&
-            route.alias === event.sourceAlias &&
-            route.binding.routeHandle === event.endpoint.routeHandle &&
-            route.binding.hostId === event.endpoint.hostId);
-        const sourceBinding = selected?.binding ?? {
-            provider: "claude",
-            hostId: event.endpoint.hostId,
-            routeHandle: event.endpoint.routeHandle,
-            registrationId: `native_${bodyHash(`${event.endpoint.routeHandle}\0${event.sourceAlias}`).slice(0, 32)}`,
-        };
+        // A native SendMessage is this session's send: its route installs here,
+        // from the exact identity the adapter attested, so the Codex task can
+        // reply through the ordinary path. The adapter's name for the sender must
+        // be the name discovery shows for that UUID; the check runs on a read-only
+        // lookup so a refusal writes nothing.
+        this.assertWritable();
+        const seen = await this.lookUpClaudeRoute(event.endpoint.routeHandle, event.endpoint.hostId);
+        if (this.claimedAlias(seen) !== event.sourceAlias) {
+            throw new BridgeError("CLAUDE_ROUTE_MISMATCH", "The native sender's name does not match its discovered session.");
+        }
+        const source = await this.materializeClaudeRoute(seen);
+        const sourceBinding = source.binding;
         const conversationId = createGatewayConversationId();
         const steer = target.binding.provider === "codex" && event.text.startsWith("STEER:") && this.config.steeringEnabled;
         this.assertWritable();
         const enqueued = await this.store.enqueueNativeIngress({
-            source: { alias: event.sourceAlias, binding: sourceBinding },
+            source: { alias: source.alias, binding: sourceBinding },
             targetAlias: event.targetAlias,
             expectedTargetRegistrationId: target.binding.registrationId,
             body: event.text,
@@ -1673,13 +1814,11 @@ export class GatewayService {
         }
         const conversation = {
             id: conversationId,
-            sourceAlias: event.sourceAlias,
+            sourceAlias: source.alias,
             targetAlias: event.targetAlias,
             sourceBinding,
             targetBinding: target.binding,
             expectsReply: true,
-            ...(enqueued.pair === true ? { pair: true } : {}),
-            nativeTarget: { alias: event.sourceAlias, binding: sourceBinding },
             nextSequence: 1,
         };
         this.rememberConversation(conversation);
@@ -1784,65 +1923,21 @@ export class GatewayService {
         const targetBinding = targetAlias === conversation.targetAlias
             ? conversation.targetBinding
             : conversation.sourceBinding;
-        if (conversation.nativeTarget === undefined ||
-            sourceAlias !== conversation.nativeTarget.alias) {
-            if (sourceBinding === undefined || targetBinding === undefined)
-                return;
-            const currentSource = await this.store.inspectPrivateRoute(sourceAlias);
-            if (currentSource === undefined ||
-                !sameBinding(currentSource.binding, sourceBinding))
-                return;
-            await this.enqueueConversation({
-                sourceAlias: targetAlias,
-                targetAlias: sourceAlias,
-                text,
-                expectsReply: true,
-                expectedSourceBinding: targetBinding,
-                expectedTargetBinding: sourceBinding,
-                existingConversation: conversation,
-            });
+        if (sourceBinding === undefined || targetBinding === undefined)
             return;
-        }
-        if (targetBinding === undefined)
+        const currentSource = await this.store.inspectPrivateRoute(sourceAlias);
+        if (currentSource === undefined ||
+            !sameBinding(currentSource.binding, sourceBinding))
             return;
-        await this.enqueueNativeConversationReply({
-            conversation,
+        await this.enqueueConversation({
             sourceAlias: targetAlias,
-            sourceBinding: targetBinding,
-            target: conversation.nativeTarget,
+            targetAlias: sourceAlias,
             text,
-        });
-    }
-    async enqueueNativeConversationReply(input) {
-        const sequence = input.conversation.nextSequence++;
-        let enqueued;
-        try {
-            enqueued = await this.store.enqueueNativeReply({
-                sourceAlias: input.sourceAlias,
-                expectedSourceRegistrationId: input.sourceBinding.registrationId,
-                target: input.target,
-                body: input.text,
-                dedupeKey: `${input.conversation.id}:${sequence}`,
-                conversationIdSuffix: input.conversation.id.slice(-8),
-                ...(input.conversation.pair === true ? { pair: true } : {}),
-                ...(input.exposeDeliveryToken === true ? { exposeDeliveryToken: true } : {}),
-            });
-        }
-        catch (error) {
-            input.conversation.nextSequence -= 1;
-            throw error;
-        }
-        if (!enqueued.accepted || enqueued.messageId === undefined) {
-            input.conversation.nextSequence -= 1;
-            throw new BridgeError("MESSAGE_NOT_ACCEPTED", "The message was not accepted.");
-        }
-        this.messageContexts.set(enqueued.messageId, {
-            conversationId: input.conversation.id,
             expectsReply: true,
+            expectedSourceBinding: targetBinding,
+            expectedTargetBinding: sourceBinding,
+            existingConversation: conversation,
         });
-        this.kick(input.target.alias, input.target.binding.registrationId);
-        this.scheduleWake();
-        return enqueued;
     }
     installPendingClaudeReply(row) {
         const key = `${row.targetBinding.hostId}\0${row.targetBinding.routeHandle}`;
@@ -1909,173 +2004,6 @@ export class GatewayService {
             existingConversation: conversation,
         });
     }
-    async updateProgressWatch(conversation, actorAlias, text, trackIdleMinutes) {
-        const existing = this.progressWatches.get(conversation.id);
-        if (this.config.trackingEnabled === false) {
-            if (existing !== undefined) {
-                this.settleProgressWatch(existing, "gateway", "tracking_disabled");
-            }
-            return;
-        }
-        if (text.startsWith("DONE:")) {
-            if (existing !== undefined) {
-                const actor = actorAlias === existing.ownerAlias
-                    ? "owner"
-                    : actorAlias === existing.workerAlias
-                        ? "worker"
-                        : undefined;
-                if (actor !== undefined)
-                    this.settleProgressWatch(existing, actor, "done");
-            }
-            return;
-        }
-        const explicit = text.startsWith("TRACK:") || trackIdleMinutes !== undefined;
-        if (existing !== undefined && !explicit) {
-            this.progressWatches.set(conversation.id, {
-                ...existing,
-                ...recordProgressWatchActivity(existing, this.now().getTime()),
-            });
-            return;
-        }
-        if (!explicit)
-            return;
-        if (existing !== undefined && actorAlias !== existing.ownerAlias) {
-            throw new BridgeError("PROGRESS_WATCH_REPLACEMENT_OWNER_REQUIRED", "Only the progress-watch owner may replace its watch.");
-        }
-        const capacity = Math.min(this.config.limits.maxWatches ?? PROGRESS_WATCH_DEFAULT_CAPACITY, PROGRESS_WATCH_HARD_CAPACITY);
-        if (existing === undefined && this.progressWatches.size >= capacity) {
-            throw new BridgeError("PROGRESS_WATCH_CAPACITY_REACHED", "Progress-watch capacity is full.");
-        }
-        const owner = await this.store.inspectPrivateRoute(actorAlias);
-        const workerAlias = actorAlias === conversation.sourceAlias
-            ? conversation.targetAlias
-            : conversation.sourceAlias;
-        const worker = await this.store.inspectPrivateRoute(workerAlias);
-        if (owner === undefined || worker === undefined) {
-            throw new BridgeError("PROGRESS_WATCH_ENDPOINT_NOT_FOUND", "A progress-watch endpoint is absent.");
-        }
-        const idleMs = trackIdleMinutes === undefined
-            ? PROGRESS_WATCH_DEFAULT_IDLE_MS
-            : trackIdleMinutes * 60_000;
-        const watch = createProgressWatch({
-            conversationId: conversation.id,
-            ownerAlias: actorAlias,
-            workerAlias,
-            idleMs,
-            at: this.now().getTime(),
-        });
-        this.progressWatches.set(conversation.id, {
-            ...watch,
-            ownerRegistrationId: owner.binding.registrationId,
-            workerRegistrationId: worker.binding.registrationId,
-        });
-        this.recordProgressWatchEvent({
-            watch,
-            kind: existing === undefined ? "opened" : "replaced",
-            actor: "owner",
-        });
-    }
-    restoreProgressWatch(conversationId, previous, eventLength) {
-        if (previous === undefined)
-            this.progressWatches.delete(conversationId);
-        else
-            this.progressWatches.set(conversationId, previous);
-        this.progressWatchEvents.length = eventLength;
-    }
-    untrack(conversationId) {
-        const watch = this.progressWatches.get(conversationId);
-        if (watch === undefined) {
-            throw new BridgeError("PROGRESS_WATCH_NOT_FOUND", "The progress watch is absent.");
-        }
-        this.settleProgressWatch(watch, "operator", "untracked");
-    }
-    settleWatchesForAlias(alias, reason, actor) {
-        for (const watch of [...this.progressWatches.values()]) {
-            if (watch.ownerAlias === alias || watch.workerAlias === alias) {
-                this.settleProgressWatch(watch, actor, reason);
-            }
-        }
-    }
-    settleProgressWatch(watch, actor, reason) {
-        if (!this.progressWatches.delete(watch.conversationId))
-            return;
-        this.recordProgressWatchEvent({ watch, kind: "settled", actor, reason });
-    }
-    recordProgressWatchEvent(input) {
-        this.progressWatchEvents.push({
-            sequence: (this.progressWatchEvents.at(-1)?.sequence ?? 0) + 1,
-            timestamp: this.now().toISOString(),
-            conversationIdSuffix: input.watch.conversationId.slice(-8),
-            ownerAlias: input.watch.ownerAlias,
-            workerAlias: input.watch.workerAlias,
-            kind: input.kind,
-            actor: input.actor,
-            ...(input.reason === undefined ? {} : { reason: input.reason }),
-        });
-        while (this.progressWatchEvents.length > gatewayPublicSnapshotLimits.progressWatchEvents) {
-            this.progressWatchEvents.shift();
-        }
-    }
-    async processProgressWatches() {
-        const at = this.now().getTime();
-        for (const watch of [...this.progressWatches.values()]) {
-            const owner = await this.store.inspectPrivateRoute(watch.ownerAlias);
-            const worker = await this.store.inspectPrivateRoute(watch.workerAlias);
-            if (owner?.binding.registrationId !== watch.ownerRegistrationId ||
-                worker?.binding.registrationId !== watch.workerRegistrationId) {
-                this.settleProgressWatch(watch, "gateway", "endpoint_retired");
-                continue;
-            }
-            const ownerObservation = this.routeObservations.get(watch.ownerAlias);
-            const workerObservation = this.routeObservations.get(watch.workerAlias);
-            const due = inspectProgressWatchDue(watch, {
-                at,
-                bothIdle: ownerObservation?.state === "idle" &&
-                    workerObservation?.state === "idle" &&
-                    this.routeObservationStillCurrent(ownerObservation) &&
-                    this.routeObservationStillCurrent(workerObservation),
-            });
-            if (due.kind === "not_due")
-                continue;
-            if (due.kind === "rescheduled") {
-                this.progressWatches.set(watch.conversationId, {
-                    ...watch,
-                    ...due.watch,
-                });
-                continue;
-            }
-            if (due.kind === "settled") {
-                this.settleProgressWatch(watch, "gateway", "idle_timeout");
-                continue;
-            }
-            const conversation = this.conversations.get(watch.conversationId);
-            if (conversation === undefined) {
-                this.settleProgressWatch(watch, "gateway", "endpoint_retired");
-                continue;
-            }
-            const text = `[Embassy automated liveness check — ${due.nudgeNumber} / Embassy 自动活跃检查 — ${due.nudgeNumber}]\nReply with the result or a status. / 请回复结果或状态。`;
-            try {
-                await this.enqueueConversation({
-                    sourceAlias: watch.ownerAlias,
-                    targetAlias: watch.workerAlias,
-                    text,
-                    expectsReply: false,
-                    existingConversation: conversation,
-                    skipWatch: true,
-                });
-                this.progressWatches.set(watch.conversationId, {
-                    ...watch,
-                    ...commitProgressWatchNudge(watch, { at, nudgeNumber: due.nudgeNumber }),
-                });
-            }
-            catch {
-                this.progressWatches.set(watch.conversationId, {
-                    ...watch,
-                    ...deferProgressWatchNudge(watch, at),
-                });
-            }
-        }
-    }
     async finishSettlements(settlements) {
         await Promise.all(settlements.map(async (settlement) => this.finishSettlement(settlement)));
     }
@@ -2118,13 +2046,13 @@ export class GatewayService {
             const now = this.now().getTime();
             const due = [
                 this.nextDiscoveryAt || now + DISCOVERY_INTERVAL_MS,
-                this.nextDoctorAt || now + CODEX_DOCTOR_INTERVAL_MS,
-                ...((this.config.peerNodes?.length ?? 0) > 0
+                this.nextManagedCodexCheckAt || now + MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS,
+                ...(this.config.peerNodes.length > 0
                     ? [this.nextPeerRefreshAt || now + PEER_REFRESH_INTERVAL_MS]
                     : []),
+                ...this.ephemeralPeerExpiries.values(),
                 ...(deadlineAt === undefined ? [] : [Date.parse(deadlineAt)]),
                 ...[...this.pendingClaudeReplies.values()].flatMap((rows) => rows.map((row) => Date.parse(row.deadlineAt))),
-                ...[...this.progressWatches.values()].map((watch) => Date.parse(watch.nextActionAt)),
             ].filter(Number.isFinite);
             const delay = Math.max(0, Math.min(...due) - now);
             this.wakeTimer = this.timers.setTimeout(() => {
@@ -2139,14 +2067,14 @@ export class GatewayService {
         const now = this.now();
         await this.finishSettlements(await this.store.expireDueMessages(now));
         this.pruneExpiredPendingClaudeReplies(now.getTime());
-        await this.processProgressWatches();
+        await this.expireEphemeralPeers(now.getTime());
         if (now.getTime() >= this.nextDiscoveryAt) {
             await this.refreshClaudeDiscovery().catch(() => undefined);
             this.nextDiscoveryAt = now.getTime() + DISCOVERY_INTERVAL_MS;
         }
-        if (now.getTime() >= this.nextDoctorAt) {
-            await this.refreshCodexDoctor().catch(() => undefined);
-            this.nextDoctorAt = now.getTime() + CODEX_DOCTOR_INTERVAL_MS;
+        if (now.getTime() >= this.nextManagedCodexCheckAt) {
+            await this.refreshManagedCodexSocket().catch(() => undefined);
+            this.nextManagedCodexCheckAt = now.getTime() + MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS;
         }
         if (this.nextPeerRefreshAt > 0 && now.getTime() >= this.nextPeerRefreshAt) {
             const operation = this.refreshPeers();
@@ -2163,12 +2091,11 @@ export class GatewayService {
             return;
         for (const target of await this.store.inspectDispatchableTargets())
             this.kick(target);
-        await this.publish();
         this.scheduleWake();
     }
     async refreshPeers() {
-        const localHost = this.config.hostId ?? this.config.allowedHosts[0];
-        await Promise.all((this.config.peerNodes ?? []).map(async (peerHost) => {
+        const localHost = this.config.hostId;
+        await Promise.all(this.config.peerNodes.map(async (peerHost) => {
             let failureCode = "PEER_TUNNEL_UNAVAILABLE";
             try {
                 let client = this.peerClients.get(peerHost);
@@ -2227,33 +2154,52 @@ export class GatewayService {
                 if (viewChanged)
                     this.revision += 1;
             }
-            catch {
+            catch (error) {
                 this.peerClients.get(peerHost)?.close();
                 this.peerClients.delete(peerHost);
                 if (!this.running || this.closing)
                     return;
+                // A wire-version disagreement is not a tunnel fault: name it so an operator
+                // upgrades the lagging node instead of debugging SSH.
+                if (error instanceof PeerConnectionLostError && error.failureClass === "protocol")
+                    failureCode = "PEER_PROTOCOL_MISMATCH";
                 this.recordPeerFailure(peerHost, failureCode);
                 const observedAt = this.now().toISOString();
+                const mirrorCode = failureCode === "PEER_PROTOCOL_MISMATCH" ? failureCode : "PEER_TUNNEL_UNAVAILABLE";
                 for (const route of await this.store.inspectPrivateRoutes())
                     if (route.registrationMode === "federated_peer" &&
                         route.binding.hostId === peerHost)
                         this.peerRouteViews.set(route.alias, { route: route.binding,
-                            state: "unobserved", observedAt, safeErrorCode: "PEER_TUNNEL_UNAVAILABLE" });
+                            state: "unobserved", observedAt, safeErrorCode: mirrorCode });
             }
         }));
     }
     async refreshClaudeDiscovery() {
         const seen = new Set();
+        const nextCollisions = new Set();
+        const refreshedHosts = new Set();
         for (const adapter of this.adapters) {
             if (adapter.identity.provider !== "claude" || adapter.discoverClaudePeers === undefined)
                 continue;
             const snapshot = await adapter.discoverClaudePeers();
             const observedAt = this.now().toISOString();
-            for (const peer of snapshot.peers) {
-                if (!PUBLIC_ALIAS.test(peer.alias) ||
-                    !peer.alias.endsWith(`@${adapter.identity.hostId}`) ||
-                    !PRIVATE_HANDLE.test(peer.routeHandle))
-                    continue;
+            const peers = snapshot.peers.filter((peer) => PUBLIC_ALIAS.test(peer.alias) &&
+                peer.alias.endsWith(`@${adapter.identity.hostId}`) && PRIVATE_HANDLE.test(peer.routeHandle));
+            const aliasHandles = new Map();
+            for (const peer of peers) {
+                const handles = aliasHandles.get(peer.alias) ?? new Set();
+                handles.add(peer.routeHandle);
+                aliasHandles.set(peer.alias, handles);
+            }
+            const collidingAliases = new Set([...aliasHandles].filter(([, handles]) => handles.size > 1).map(([alias]) => alias));
+            refreshedHosts.add(adapter.identity.hostId);
+            if (!snapshot.complete)
+                for (const alias of this.collidingClaudeAliases)
+                    if (alias.endsWith(`@${adapter.identity.hostId}`))
+                        collidingAliases.add(alias);
+            for (const alias of collidingAliases)
+                nextCollisions.add(alias);
+            for (const peer of peers) {
                 const key = `${adapter.identity.hostId}\0${peer.routeHandle}`;
                 seen.add(key);
                 this.candidates.set(key, { ...peer, adapter, observedAt });
@@ -2264,39 +2210,42 @@ export class GatewayService {
                 runtime.health = snapshot.complete ? "healthy" : "degraded";
                 const registry = snapshot.registry ?? adapter.latestRegistryObservation?.();
                 if (registry !== undefined) {
-                    runtime.registry = publicRegistry(registry, runtime.registry?.parseableRecordSeenSinceBoot ?? false);
+                    runtime.registry = publicRegistry({ ...registry, rejected: [
+                            ...registry.rejected,
+                            ...(collidingAliases.size === 0 ? [] : [{ safeErrorCode: "PEER_ALIAS_COLLISION",
+                                    count: collidingAliases.size }]),
+                        ] }, runtime.registry?.parseableRecordSeenSinceBoot ?? false);
                 }
             }
         }
         for (const [key] of this.candidates)
             if (!seen.has(key))
                 this.candidates.delete(key);
+        for (const alias of this.collidingClaudeAliases)
+            if (refreshedHosts.has(aliasHost(alias)))
+                this.collidingClaudeAliases.delete(alias);
+        const retainedCollisions = new Set([...nextCollisions].slice(0, gatewayPublicSnapshotLimits.availablePeers));
+        // Discovery currently caps rows such that collisions cannot overflow this independent public bound.
+        // If those constants diverge, discard overflow candidates rather than expose an unfenced alias.
+        for (const [key, candidate] of this.candidates)
+            if (nextCollisions.has(candidate.alias) && !retainedCollisions.has(candidate.alias))
+                this.candidates.delete(key);
+        for (const alias of retainedCollisions)
+            this.collidingClaudeAliases.add(alias);
     }
-    async refreshCodexDoctor() {
-        if (this.codexDoctor === undefined)
+    async refreshManagedCodexSocket() {
+        if (this.managedCodexSocketHeld === undefined)
             return;
-        this.codexDoctorResult = await this.codexDoctor();
+        this.managedCodexSocketHeldOutside = await this.managedCodexSocketHeld();
     }
     assertWritable() {
         if (this.closing || !this.running) {
             throw new BridgeError("GATEWAY_CLOSING", "The gateway is not accepting mutations.");
         }
     }
-    async resolveClaudeSelector(selector, refresh) {
-        if (refresh)
-            await this.refreshClaudeDiscovery().catch(() => undefined);
-        return [...this.candidates.values()].find((candidate) => candidate.alias === selector || candidate.routeHandle === selector);
-    }
-    async resolveSelectedClaudeRoute(selector) {
-        return (await this.store.listLogicalRoutes()).find((route) => route.binding.provider === "claude" &&
-            (route.alias === selector || route.binding.routeHandle === selector));
-    }
     routeObservationStillCurrent(event) {
         return this.connectors.has(connectorKey(event.route));
     }
-    async publish() {
-        await this.publishDashboard(this.store.rootDir, await this.snapshot());
-    }
     alert(code, route, error) {
         const errorCode = error instanceof BridgeError ? error.code : undefined;
         this.runtimeAlerts.push({
@@ -2315,7 +2264,7 @@ export class GatewayService {
     recordPeerFailure(host, code) {
         for (let index = this.runtimeAlerts.length - 1; index >= 0; index -= 1) {
             const alert = this.runtimeAlerts[index];
-            if (alert?.host === host && (alert.code === "PEER_DIAL_FAILED" || alert.code === "PEER_TUNNEL_UNAVAILABLE"))
+            if (alert?.host === host && PEER_FAILURE_CODES.includes(alert.code))
                 this.runtimeAlerts.splice(index, 1);
         }
         if (code !== undefined)