agent-embassy 2.0.1 → 3.0.0

package/dist/src/gateway/store.js

@@ -5,12 +5,38 @@ import os from "node:os";
 import path from "node:path";
 import { BridgeError } from "../errors.js";
 import { KeyedMutex } from "../mutex.js";
-import { peerEdgeRef, peerRouteRef } from "./peer-protocol.js";
+import { peerRouteRef } from "./peer-protocol.js";
 import { deliveryStates, directionId, gatewayActivityActions, gatewayActivityKinds, gatewayProviders, gatewayPublicSnapshotLimits, gatewayRegistrationIngressPrefixes, parseDirection, projectGatewayPublicSnapshot, routeRegistrationModes } from "./types.js";
 const STATE_MARKER = ".agent-embassy-state";
 const STATE_MARKER_CONTENT = "agent-embassy-state-v1\n";
 const STATE_FILE = "gateway-state.json";
-const CONTROLLER_LOCK = ".gateway-controller.lock";
+/** Static dashboard files a 2.x install may have left behind (emb-100 removed the feature; emb-106 sweeps the litter). */
+const STALE_DASHBOARD_FILES = ["gateway-dashboard.html", "gateway-dashboard.zh-CN.html"];
+/** 2.x wrote its dashboards via temp-file + rename; a crash mid-publish could leave one of these behind too. */
+const STALE_DASHBOARD_TEMP_PATTERNS = [
+    /^\.gateway-dashboard\.html\.[^/]+\.tmp$/,
+    /^\.gateway-dashboard\.zh-CN\.html\.[^/]+\.tmp$/,
+];
+function isStaleDashboardArtifact(name) {
+    return STALE_DASHBOARD_FILES.includes(name) ||
+        STALE_DASHBOARD_TEMP_PATTERNS.some((pattern) => pattern.test(name));
+}
+/**
+ * Locks this store moved aside as stale, kept a week so a crash stays
+ * diagnosable. The recovery time is in the name, not in the file's mtime:
+ * `rename` carries the crashed lock's own timestamps across, so a broker that
+ * ran for a month would have its lock swept by the very boot that recovered it.
+ */
+const STALE_LOCK_PATTERN = /^\.gateway-controller\.lock\.stale-(\d{13,16})-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const STALE_LOCK_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+/** The recovery time encoded in a stale-lock name, or undefined if this is not one. */
+function staleLockRecoveredAt(name) {
+    const found = STALE_LOCK_PATTERN.exec(name);
+    return found === null ? undefined : Number(found[1]);
+}
+/** The controller lock's file name; the CLI reads the same file for a pid. */
+export const GATEWAY_CONTROLLER_LOCK_FILE = ".gateway-controller.lock";
+const CONTROLLER_LOCK = GATEWAY_CONTROLLER_LOCK_FILE;
 const MAX_MARKER_FILE_BYTES = 128;
 const MAX_LOCK_FILE_BYTES = 4 * 1024;
 export const GATEWAY_MAX_STATE_FILE_BYTES = 8 * 1024 * 1024;
@@ -55,6 +81,27 @@ function isNonNegativeInteger(value) {
 function isPositiveInteger(value) {
     return Number.isSafeInteger(value) && value > 0;
 }
+const LOCK_HOSTNAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/;
+/**
+ * A machine name bounded before it is compared or handed to a client hint.
+ * Both sides of the comparison pass through here, so a local hostname the
+ * pattern cannot represent (a name with a space, say) is never mistaken for
+ * a different machine — it is simply unverifiable on both sides.
+ */
+function boundedHostname(value) {
+    return typeof value === "string" && LOCK_HOSTNAME_PATTERN.test(value) ? value : undefined;
+}
+const lockUnverified = () => new BridgeError("GATEWAY_STATE_LOCK_UNVERIFIED", "The gateway state lock exists but cannot be read as a controller record.");
+function defaultProcessLiveness(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // ESRCH is the only answer that means "gone"; EPERM means alive and not ours.
+        return !(error instanceof Error && "code" in error && error.code === "ESRCH");
+    }
+}
 function isIsoTimestamp(value) {
     return (typeof value === "string" &&
         value.length >= 20 &&
@@ -113,79 +160,26 @@ function isRoute(value) {
         isIsoTimestamp(value.updatedAt) &&
         isCounters(value.counters));
 }
-function isConsentEndpoint(value) {
-    return (isObject(value) &&
-        hasOnlyKeys(value, ["alias", "provider", "registrationId"]) &&
-        typeof value.alias === "string" &&
-        ALIAS_PATTERN.test(value.alias) &&
-        isProvider(value.provider) &&
-        isPrivateToken(value.registrationId));
-}
-function compareConsentEndpoints(left, right) {
-    const providerOrder = gatewayProviders.indexOf(left.provider) -
-        gatewayProviders.indexOf(right.provider);
-    return providerOrder !== 0 ? providerOrder : left.alias.localeCompare(right.alias);
-}
-function canonicalConsentEndpoints(left, right) {
-    const endpoints = [
-        {
-            alias: left.alias, provider: left.binding.provider,
-            registrationId: left.binding.registrationId,
-        },
-        {
-            alias: right.alias, provider: right.binding.provider,
-            registrationId: right.binding.registrationId,
-        },
-    ];
-    endpoints.sort(compareConsentEndpoints);
-    return endpoints;
-}
-function consentKey(endpoints) {
-    return endpoints
-        .map((endpoint) => [endpoint.provider, endpoint.alias, endpoint.registrationId].join("\0"))
-        .join("\0");
-}
-function edgeOwnerHost(endpoints) {
-    return endpoints.map((endpoint) => aliasHost(endpoint.alias)).sort()[0];
-}
 function peerMirrorRegistrationId(host, routeRef) {
     return `reg_peer_${createHash("sha256").update(`${host}\0${routeRef}`).digest("base64url").slice(0, 32)}`;
 }
-function sameConsent(left, right) {
-    if (left === null || right === null)
-        return left === right;
-    return consentKey(left) === consentKey(right);
-}
 function routeModeMatchesHost(route, localHost) {
     if (route.registrationMode === "federated_peer") {
-        return localHost !== undefined && route.binding.hostId !== localHost;
+        // Without a known local host there is nothing to prove the mirror foreign
+        // against, so the check abstains rather than refusing. The store always
+        // supplies its configured host, so the shipped path always checks.
+        return localHost === undefined || route.binding.hostId !== localHost;
     }
     return route.binding.hostId === localHost && (route.binding.provider === "claude"
         ? route.registrationMode === "selected_live_peer"
         : route.registrationMode === "explicit_opt_in");
 }
-function isConsentEdge(value) {
-    if (!isObject(value) ||
-        !hasOnlyKeys(value, ["endpoints", "createdAt", "updatedAt", "counters"]) ||
-        !Array.isArray(value.endpoints) ||
-        value.endpoints.length !== 2 ||
-        !value.endpoints.every(isConsentEndpoint)) {
-        return false;
-    }
-    const endpoints = value.endpoints;
-    return (compareConsentEndpoints(endpoints[0], endpoints[1]) < 0 &&
-        endpoints[0].alias !== endpoints[1].alias &&
-        isIsoTimestamp(value.createdAt) &&
-        isIsoTimestamp(value.updatedAt) &&
-        isCounters(value.counters));
-}
 function isPrepared(value) {
     return (isObject(value) &&
         hasOnlyKeys(value, ["kind", "bodyBytes", "bodySha256", "frameBytes", "sha256"]) &&
         (value.kind === "claude_mailbox" ||
             value.kind === "codex_turn_start" ||
             value.kind === "codex_turn_steer" ||
-            value.kind === "acp_prompt" ||
             value.kind === "peer_mailbox" ||
             value.kind === "peer_handoff") &&
         isPositiveInteger(value.bodyBytes) &&
@@ -202,12 +196,9 @@ function expectedPreparedKind(message, targetMode) {
     const target = parseDirection(message.direction).targetProvider;
     if (target === "claude")
         return "claude_mailbox";
-    if (target === "codex") {
-        return message.steer === true ? "codex_turn_steer" : "codex_turn_start";
-    }
     if (target === "peer")
         return "peer_mailbox";
-    return "acp_prompt";
+    return message.steer === true ? "codex_turn_steer" : "codex_turn_start";
 }
 function isAttemptAuthority(value) {
     return (typeof value.attemptId === "string" &&
@@ -215,13 +206,7 @@ function isAttemptAuthority(value) {
         isPositiveInteger(value.attemptCount) &&
         typeof value.targetRegistrationId === "string" &&
         isPrivateToken(value.targetRegistrationId) &&
-        (value.sourceRegistrationId === null ||
-            isPrivateToken(value.sourceRegistrationId)) &&
-        (value.consentEdge === null ||
-            (Array.isArray(value.consentEdge) &&
-                value.consentEdge.length === 2 &&
-                value.consentEdge.every(isConsentEndpoint) &&
-                compareConsentEndpoints(value.consentEdge[0], value.consentEdge[1]) < 0)));
+        isPrivateToken(value.sourceRegistrationId));
 }
 function isMessageState(value) {
     if (!isObject(value) || typeof value.phase !== "string")
@@ -232,20 +217,20 @@ function isMessageState(value) {
     }
     if (value.phase === "reserved") {
         return (hasOnlyKeys(value, ["phase", "attemptId", "attemptCount", "targetRegistrationId",
-            "sourceRegistrationId", "consentEdge", "reservedAt"]) &&
+            "sourceRegistrationId", "reservedAt"]) &&
             isAttemptAuthority(value) &&
             isIsoTimestamp(value.reservedAt));
     }
     if (value.phase === "armed") {
         return (hasOnlyKeys(value, ["phase", "attemptId", "attemptCount", "targetRegistrationId",
-            "sourceRegistrationId", "consentEdge", "armedAt", "prepared"]) &&
+            "sourceRegistrationId", "armedAt", "prepared"]) &&
             isAttemptAuthority(value) &&
             isIsoTimestamp(value.armedAt) &&
             isPrepared(value.prepared));
     }
     if (value.phase === "accepted") {
         return (hasOnlyKeys(value, ["phase", "attemptId", "attemptCount", "targetRegistrationId",
-            "sourceRegistrationId", "consentEdge", "acceptedAt", "prepared", "lossOutcome"]) &&
+            "sourceRegistrationId", "acceptedAt", "prepared", "lossOutcome"]) &&
             isAttemptAuthority(value) &&
             isIsoTimestamp(value.acceptedAt) &&
             isPrepared(value.prepared) &&
@@ -270,7 +255,7 @@ function isMessage(value) {
     if (!isObject(value) ||
         !hasOnlyKeys(value, ["sequence", "messageId", "messageIdSuffix", "direction", "sourceAlias",
             "targetAlias", "enqueuedAt", "deadlineAt", "bytes", "sourceRegistrationId",
-            "targetRegistrationId", "consentEdge", "state"], ["conversationIdSuffix", "deliveryToken", "body", "pair", "transientTarget", "steer"])) {
+            "targetRegistrationId", "state"], ["conversationIdSuffix", "deliveryToken", "body", "steer"])) {
         return false;
     }
     return (isPositiveInteger(value.sequence) &&
@@ -299,18 +284,10 @@ function isMessage(value) {
         (value.deliveryToken === undefined ||
             (typeof value.deliveryToken === "string" &&
                 DELIVERY_TOKEN_PATTERN.test(value.deliveryToken))) &&
-        (value.pair === undefined || value.pair === true) &&
-        (value.transientTarget === undefined || value.transientTarget === true) &&
         (value.steer === undefined || value.steer === true) &&
-        (value.sourceRegistrationId === null ||
-            isPrivateToken(value.sourceRegistrationId)) &&
+        isPrivateToken(value.sourceRegistrationId) &&
         (value.targetRegistrationId === null ||
             isPrivateToken(value.targetRegistrationId)) &&
-        (value.consentEdge === null ||
-            (Array.isArray(value.consentEdge) &&
-                value.consentEdge.length === 2 &&
-                value.consentEdge.every(isConsentEndpoint) &&
-                compareConsentEndpoints(value.consentEdge[0], value.consentEdge[1]) < 0)) &&
         isMessageState(value.state) &&
         (value.state.phase === "terminal" ||
             value.state.attemptCount <=
@@ -324,7 +301,7 @@ function isMessage(value) {
 function isDedupe(value) {
     return (isObject(value) &&
         hasOnlyKeys(value, ["fingerprint", "messageIdSuffix", "sourceAlias", "targetAlias", "direction",
-            "firstSeenAt", "expiresAt"], ["conversationIdSuffix", "pair"]) &&
+            "firstSeenAt", "expiresAt"], ["conversationIdSuffix"]) &&
         typeof value.fingerprint === "string" &&
         FINGERPRINT_PATTERN.test(value.fingerprint) &&
         typeof value.messageIdSuffix === "string" &&
@@ -338,8 +315,7 @@ function isDedupe(value) {
         isIsoTimestamp(value.expiresAt) &&
         (value.conversationIdSuffix === undefined ||
             (typeof value.conversationIdSuffix === "string" &&
-                CONVERSATION_SUFFIX_PATTERN.test(value.conversationIdSuffix))) &&
-        (value.pair === undefined || value.pair === true));
+                CONVERSATION_SUFFIX_PATTERN.test(value.conversationIdSuffix))));
 }
 function isAccounting(value) {
     return (isObject(value) &&
@@ -402,11 +378,20 @@ function isMessageActivity(value) {
         value.type === "message_activity" &&
         isNormalizedEvent(value.event));
 }
-export function isGatewayPersistedStateV4(value) {
+/**
+ * `configuredHost` is the broker's own host identity, known at construction and
+ * always supplied on the shipped path. Deriving the local host from the routes
+ * alone is not sufficient: a federation node whose only routes are mirrors has
+ * no local route to derive from, and a state file it just wrote would fail its
+ * own validator on the next persist.
+ */
+export function isGatewayPersistedStateV5(value, configuredHost) {
     if (!isObject(value) ||
+        // Exact keys: a file that still carries the retired `consentEdges` key is
+        // refused here as a corrupt document; the documented recovery is a reset.
         !hasOnlyKeys(value, ["schemaVersion", "commit", "createdAt", "updatedAt", "eventSequence",
-            "routes", "consentEdges", "messages", "dedupe", "rateBuckets", "activity", "accounting"]) ||
-        value.schemaVersion !== 4 ||
+            "routes", "messages", "dedupe", "rateBuckets", "activity", "accounting"]) ||
+        value.schemaVersion !== 5 ||
         !isObject(value.commit) ||
         !hasOnlyKeys(value.commit, ["sequence", "id"]) ||
         !isNonNegativeInteger(value.commit.sequence) ||
@@ -416,8 +401,6 @@ export function isGatewayPersistedStateV4(value) {
         !isNonNegativeInteger(value.eventSequence) ||
         !Array.isArray(value.routes) ||
         !value.routes.every(isRoute) ||
-        !Array.isArray(value.consentEdges) ||
-        !value.consentEdges.every(isConsentEdge) ||
         !Array.isArray(value.messages) ||
         !value.messages.every(isMessage) ||
         !Array.isArray(value.dedupe) ||
@@ -436,7 +419,6 @@ export function isGatewayPersistedStateV4(value) {
     const routesByAlias = new Map(state.routes.map((route) => [route.alias, route]));
     const registrationIds = state.routes.map((route) => route.binding.registrationId);
     const routeTargets = state.routes.map((route) => [route.binding.provider, route.binding.hostId, route.binding.routeHandle].join("\0"));
-    const edgeKeys = state.consentEdges.map((edge) => consentKey(edge.endpoints));
     const messages = state.messages;
     const activitySequences = state.activity.map((entry) => entry.event.sequence);
     const active = messages.filter((message) => message.state.phase !== "terminal");
@@ -449,7 +431,6 @@ export function isGatewayPersistedStateV4(value) {
     if (routesByAlias.size !== state.routes.length ||
         new Set(registrationIds).size !== registrationIds.length ||
         new Set(routeTargets).size !== routeTargets.length ||
-        new Set(edgeKeys).size !== edgeKeys.length ||
         new Set(messages.map((message) => message.messageId)).size !== messages.length ||
         new Set(tokens).size !== tokens.length ||
         new Set(attemptIds).size !== attempts.length ||
@@ -462,34 +443,15 @@ export function isGatewayPersistedStateV4(value) {
         new Set(state.rateBuckets.map((entry) => entry.sourceAlias)).size !== state.rateBuckets.length) {
         return false;
     }
-    for (const message of messages) {
-        const direction = parseDirection(message.direction);
-        if ((message.pair === true) !== (message.consentEdge !== null) ||
-            (message.sourceRegistrationId === null &&
-                (direction.sourceProvider !== "claude" || message.pair === true)) ||
-            (message.transientTarget === true &&
-                (direction.targetProvider !== "claude" ||
-                    message.pair === true ||
-                    message.sourceRegistrationId === null))) {
-            return false;
-        }
-        if (message.consentEdge !== null) {
-            const source = message.consentEdge.find((endpoint) => endpoint.alias === message.sourceAlias);
-            const target = message.consentEdge.find((endpoint) => endpoint.alias === message.targetAlias);
-            if (source?.provider !== direction.sourceProvider ||
-                target?.provider !== direction.targetProvider ||
-                source.registrationId !== message.sourceRegistrationId ||
-                target.registrationId !== message.targetRegistrationId) {
-                return false;
-            }
-        }
-    }
     const localHosts = new Set(state.routes
         .filter((route) => route.registrationMode !== "federated_peer")
         .map((route) => route.binding.hostId));
     if (localHosts.size > 1)
         return false;
-    const localHost = [...localHosts][0];
+    // The configured host is authority; a local route's own hostId is checked
+    // against it in the loop below, so the derived host is only the fallback for
+    // a caller that has no configured identity to offer.
+    const localHost = configuredHost ?? [...localHosts][0];
     for (const route of state.routes) {
         if (!route.alias.endsWith(`@${route.binding.hostId}`) ||
             !routeModeMatchesHost(route, localHost)) {
@@ -499,70 +461,24 @@ export function isGatewayPersistedStateV4(value) {
         if (prefix !== undefined && !route.alias.startsWith(prefix))
             return false;
     }
-    for (const edge of state.consentEdges) {
-        const [leftEndpoint, rightEndpoint] = edge.endpoints;
-        const left = routesByAlias.get(leftEndpoint.alias);
-        const right = routesByAlias.get(rightEndpoint.alias);
-        if (left?.binding.registrationId !== leftEndpoint.registrationId ||
-            right?.binding.registrationId !== rightEndpoint.registrationId ||
-            left.binding.provider !== leftEndpoint.provider ||
-            right.binding.provider !== rightEndpoint.provider ||
-            (left.binding.hostId === right.binding.hostId &&
-                left.binding.provider === right.binding.provider)) {
-            return false;
-        }
-    }
     for (const message of active) {
         const target = routesByAlias.get(message.targetAlias);
         const source = routesByAlias.get(message.sourceAlias);
         const direction = parseDirection(message.direction);
         if (message.targetRegistrationId === null ||
-            (message.transientTarget !== true &&
-                (target?.binding.registrationId !== message.targetRegistrationId ||
-                    target.binding.provider !== direction.targetProvider)) ||
-            (message.transientTarget === true && direction.targetProvider !== "claude")) {
-            return false;
-        }
-        if (message.sourceRegistrationId !== null) {
-            if (source?.binding.registrationId !== message.sourceRegistrationId ||
-                source.binding.provider !== direction.sourceProvider ||
-                (target !== undefined && source.binding.hostId === target.binding.hostId &&
-                    source.binding.provider === target.binding.provider)) {
-                return false;
-            }
-        }
-        else if (direction.sourceProvider !== "claude" ||
-            target === undefined ||
-            aliasHost(message.sourceAlias) !== target.binding.hostId) {
-            return false;
-        }
-        if (message.transientTarget === true) {
-            if (message.pair === true ||
-                message.consentEdge !== null ||
-                message.sourceRegistrationId === null ||
-                source === undefined ||
-                aliasHost(message.targetAlias) !== source.binding.hostId) {
-                return false;
-            }
-        }
-        if (message.pair === true) {
-            if (message.consentEdge === null ||
-                source === undefined ||
-                target === undefined ||
-                !sameConsent(message.consentEdge, canonicalConsentEndpoints(source, target)) ||
-                !state.consentEdges.some((edge) => sameConsent(edge.endpoints, message.consentEdge))) {
-                return false;
-            }
-        }
-        else if (message.consentEdge !== null) {
+            target?.binding.registrationId !== message.targetRegistrationId ||
+            target.binding.provider !== direction.targetProvider ||
+            source?.binding.registrationId !== message.sourceRegistrationId ||
+            source.binding.provider !== direction.sourceProvider ||
+            (source.binding.hostId === target.binding.hostId &&
+                source.binding.provider === target.binding.provider)) {
             return false;
         }
         if ((message.state.phase === "reserved" ||
             message.state.phase === "armed" ||
             message.state.phase === "accepted") &&
             (message.state.sourceRegistrationId !== message.sourceRegistrationId ||
-                message.state.targetRegistrationId !== message.targetRegistrationId ||
-                !sameConsent(message.state.consentEdge, message.consentEdge))) {
+                message.state.targetRegistrationId !== message.targetRegistrationId)) {
             return false;
         }
         if ((message.state.phase === "armed" ||
@@ -615,9 +531,6 @@ function sameBinding(left, right) {
         left.routeHandle === right.routeHandle &&
         left.registrationId === right.registrationId);
 }
-function aliasHost(alias) {
-    return alias.slice(alias.lastIndexOf("@") + 1);
-}
 async function assertNoSymlinkComponents(candidate) {
     let cursor = path.resolve(candidate);
     while (true) {
@@ -668,7 +581,20 @@ export class GatewayStore {
     state;
     lockHandle;
     lockToken;
+    isProcessAlive;
+    hostname;
     persistenceDeferred = false;
+    /**
+     * Registration ids that must never reach the durable state document. They
+     * are ordinary rows in the in-memory state — admission, dispatch, queueing
+     * and settlement all see them — and are projected out at the one place that
+     * serializes, together with every row that names one. When such a
+     * registration is removed, the same rows leave the live state in the same
+     * mutate, before the id leaves this set; a rolled-back mutate restores the
+     * set with the state. Nothing here is written down, so a restart reclaims
+     * them by construction.
+     */
+    ephemeralRegistrations = new Set();
     constructor(config, dependencies = {}) {
         this.config = config;
         this.rootDir = path.resolve(config.stateDir);
@@ -676,6 +602,8 @@ export class GatewayStore {
         this.randomId = dependencies.randomId ?? randomUUID;
         this.renameStateFile = dependencies.renameStateFile ?? rename;
         this.afterStateFileRename = dependencies.afterStateFileRename;
+        this.isProcessAlive = dependencies.isProcessAlive ?? defaultProcessLiveness;
+        this.hostname = dependencies.hostname ?? (() => os.hostname());
     }
     get stateFilePath() {
         return path.join(this.rootDir, STATE_FILE);
@@ -690,15 +618,16 @@ export class GatewayStore {
                 const now = this.now();
                 const loaded = await this.loadStateFile();
                 this.state = loaded ?? {
-                    schemaVersion: 4,
+                    schemaVersion: 5,
                     commit: { sequence: 0, id: this.randomId() },
                     createdAt: now.toISOString(), updatedAt: now.toISOString(),
                     eventSequence: 0, routes: [],
-                    consentEdges: [], messages: [],
+                    messages: [],
                     dedupe: [], rateBuckets: [],
                     activity: [], accounting: emptyAccounting(),
                 };
                 this.assertConfiguredBounds(this.state);
+                await this.removeStateDirectoryLitter(this.rootDir);
                 this.recoverAfterRestart(now);
                 this.prune(this.state, now);
                 if (loaded !== undefined) {
@@ -744,9 +673,6 @@ export class GatewayStore {
     async listLogicalRoutes() {
         return this.inspectPrivateRoutes();
     }
-    async inspectPrivateConsentEdges() {
-        return this.read((state) => structuredClone(state.consentEdges));
-    }
     async inspectPrivateRoute(alias) {
         return this.read((state) => {
             const route = state.routes.find((candidate) => candidate.alias === alias);
@@ -762,8 +688,7 @@ export class GatewayStore {
         return this.mutate((state, now) => {
             const localHost = this.config.hostId;
             if (!this.config.allowedHosts.includes(peerHost) || peerHost === localHost ||
-                !catalog.complete || catalog.truncated || catalog.routes.some((route) => route.host !== peerHost) ||
-                catalog.consentEdges.some((edge) => edge.ownerHost !== peerHost)) {
+                !catalog.complete || catalog.truncated || catalog.routes.some((route) => route.host !== peerHost)) {
                 throw new BridgeError("INVALID_PEER_CATALOG", "The peer catalog is not an exact complete projection for this configured host.");
             }
             const desired = new Map(catalog.routes.map((route) => [route.ref, route]));
@@ -799,31 +724,6 @@ export class GatewayStore {
                 route.enabled = row.enabled;
                 route.updatedAt = now.toISOString();
             }
-            const peerOwned = (edge) => edgeOwnerHost(edge.endpoints) === peerHost &&
-                edge.endpoints.some((endpoint) => endpoint.alias.endsWith(`@${peerHost}`));
-            const desiredEdges = [];
-            for (const edge of catalog.consentEdges) {
-                const resolved = edge.endpoints.map((endpoint) => state.routes.find((route) => route.alias === endpoint.alias && route.binding.provider === endpoint.provider &&
-                    (endpoint.host === peerHost ? route.registrationMode === "federated_peer" && route.binding.hostId === peerHost &&
-                        route.binding.routeHandle === endpoint.routeRef : endpoint.host === localHost &&
-                        route.registrationMode !== "federated_peer" && route.binding.hostId === localHost &&
-                        peerRouteRef(localHost, route.binding.registrationId) === endpoint.routeRef)));
-                if (resolved[0] === undefined || resolved[1] === undefined || edge.ref !== peerEdgeRef(edge.endpoints))
-                    throw new BridgeError("INVALID_PEER_CATALOG", "A peer consent edge does not match current endpoint authority.");
-                desiredEdges.push(canonicalConsentEndpoints(resolved[0], resolved[1]));
-            }
-            const removedEdges = state.consentEdges.filter((edge) => peerOwned(edge) &&
-                !desiredEdges.some((candidate) => sameConsent(edge.endpoints, candidate)));
-            for (const edge of removedEdges)
-                settlements.push(...this.terminalizeConsentEdge(state, edge, now));
-            state.consentEdges = state.consentEdges.filter((edge) => !removedEdges.includes(edge));
-            for (const endpoints of desiredEdges) {
-                if (state.consentEdges.some((edge) => sameConsent(edge.endpoints, endpoints)))
-                    continue;
-                if (state.consentEdges.length >= this.config.limits.maxConsentEdges)
-                    throw new BridgeError("CONSENT_EDGE_CAPACITY_REACHED", "The bounded consent-edge inventory is full.", true);
-                state.consentEdges.push({ endpoints, createdAt: now.toISOString(), updatedAt: now.toISOString(), counters: emptyCounters() });
-            }
             return { settlements, routes: state.routes.filter((route) => route.registrationMode === "federated_peer" &&
                     route.binding.hostId === peerHost).map((route) => ({ alias: route.alias, binding: { ...route.binding },
                     registrationMode: route.registrationMode, enabled: route.enabled })) };
@@ -832,9 +732,11 @@ export class GatewayStore {
     async enqueuePeerHandoff(peerHost, handoff) {
         return this.mutate((state, now) => {
             const localHost = this.config.hostId;
+            // A handoff is authorized by the sending host's nodes.json membership
+            // (checked by the service before this call) plus exact alias addressing
+            // to a mirrored source and a local, enabled target.
             if (!this.config.allowedHosts.includes(peerHost) || peerHost === localHost || handoff.source.host !== peerHost ||
-                handoff.target.host !== localHost || handoff.edgeOwnerHost !== [peerHost, localHost].sort()[0] ||
-                handoff.edgeRef !== peerEdgeRef([handoff.source, handoff.target]))
+                handoff.target.host !== localHost)
                 throw new BridgeError("INVALID_PEER_HANDOFF", "The peer handoff does not match this configured direct link.");
             const source = state.routes.find((route) => route.registrationMode === "federated_peer" && route.binding.hostId === peerHost &&
                 route.alias === handoff.source.alias && route.binding.provider === handoff.source.provider && route.binding.routeHandle === handoff.source.routeRef);
@@ -843,21 +745,11 @@ export class GatewayStore {
                 peerRouteRef(localHost, route.binding.registrationId) === handoff.target.routeRef && route.enabled);
             if (source === undefined || target === undefined)
                 throw new BridgeError("ROUTE_UNREGISTERED", "The peer handoff endpoint is no longer current.");
-            const endpoints = canonicalConsentEndpoints(source, target);
-            let edge = state.consentEdges.find((candidate) => sameConsent(candidate.endpoints, endpoints));
-            if (edge === undefined && handoff.edgeOwnerHost === peerHost) {
-                if (state.consentEdges.length >= this.config.limits.maxConsentEdges)
-                    throw new BridgeError("CONSENT_EDGE_CAPACITY_REACHED", "The bounded consent-edge inventory is full.", true);
-                edge = { endpoints, createdAt: now.toISOString(), updatedAt: now.toISOString(), counters: emptyCounters() };
-                state.consentEdges.push(edge);
-            }
-            if (edge === undefined)
-                throw new BridgeError("SENDER_NOT_PAIRED", "The peer handoff lacks current exact consent.");
             return this.enqueueResolved(state, now, { body: handoff.body, dedupeKey: `${peerHost}:${handoff.originMessageId}`,
                 deadlineAt: handoff.deadlineAt, ...(handoff.conversationCorrelation === undefined ? {} :
                     { conversationIdSuffix: handoff.conversationCorrelation }), ...(handoff.steer === true ? { steer: true } : {}) }, { sourceAlias: source.alias, targetAlias: target.alias, direction: directionId(source.binding.provider, target.binding.provider),
                 sourceRegistrationId: source.binding.registrationId, targetRegistrationId: target.binding.registrationId,
-                consentEdge: edge.endpoints, pair: true, exposeDeliveryToken: false });
+                exposeDeliveryToken: false });
         });
     }
     async registerRoute(input) {
@@ -883,8 +775,59 @@ export class GatewayStore {
                 throw new BridgeError("ROUTE_CAPACITY_REACHED", "The bounded logical route inventory is full.", true);
             }
             state.routes.push(routeRecord(input, now));
+            if (input.ephemeral === true)
+                this.ephemeralRegistrations.add(input.binding.registrationId);
         });
     }
+    /** Whether this registration is memory-only; false for every durable route. */
+    isEphemeralRegistration(registrationId) {
+        return this.ephemeralRegistrations.has(registrationId);
+    }
+    /**
+     * Everything an ephemeral registration owns, taken out of `state`: the route
+     * itself, every message that names it as source or target, the dedupe
+     * fingerprints and rate bucket keyed by its alias, the journal rows —
+     * message activity and runtime activity — that name the alias, and the
+     * queued-bytes total those messages contributed. Pure: the caller decides
+     * whether this becomes the written projection or the live state.
+     */
+    ephemeralRowsRemoved(state, ids, aliases) {
+        const kept = (message) => !ids.has(message.sourceRegistrationId) &&
+            (message.targetRegistrationId === null || !ids.has(message.targetRegistrationId));
+        const names = (row) => aliases.has(row.sourceAlias) || aliases.has(row.targetAlias);
+        const droppedQueuedBytes = state.messages
+            .filter((message) => !kept(message) && message.state.phase === "queued")
+            .reduce((total, message) => total + message.bytes, 0);
+        return {
+            routes: state.routes.filter((route) => !ids.has(route.binding.registrationId)),
+            messages: state.messages.filter(kept),
+            dedupe: state.dedupe.filter((row) => !names(row)),
+            rateBuckets: state.rateBuckets.filter((row) => !aliases.has(row.sourceAlias)),
+            activity: state.activity.filter((entry) => entry.type === "message_activity"
+                ? !names(entry.event)
+                : !entry.event.aliases.some((alias) => aliases.has(alias))),
+            accounting: { ...state.accounting,
+                queuedBytes: state.accounting.queuedBytes - droppedQueuedBytes },
+        };
+    }
+    /**
+     * The document actually written. While an ephemeral registration lives, its
+     * rows are projected out here, so the written state stays internally
+     * consistent under the strict loader — which refuses a state whose active
+     * message points at a route it cannot find, or whose queued total disagrees
+     * with its queued rows. Both refusals are exactly right, and neither must
+     * ever be reachable by a document we wrote. When the registration is
+     * removed, `removeRegistrationMetadata` takes the same rows out of the live
+     * state in the same mutate, so nothing of it is written afterwards either.
+     */
+    persistedProjection(state) {
+        if (this.ephemeralRegistrations.size === 0)
+            return state;
+        const dropped = state.routes.filter((route) => this.ephemeralRegistrations.has(route.binding.registrationId));
+        if (dropped.length === 0)
+            return state;
+        return { ...state, ...this.ephemeralRowsRemoved(state, new Set(dropped.map((route) => route.binding.registrationId)), new Set(dropped.map((route) => route.alias))) };
+    }
     async removeOwnedRouteAtomic(input) {
         return this.mutate((state, now) => {
             if (!ALIAS_PATTERN.test(input.alias) || !isLogicalBinding(input.binding)) {
@@ -894,19 +837,17 @@ export class GatewayStore {
             if (route === undefined || !sameBinding(route.binding, input.binding)) {
                 return { removed: false, settlements: [] };
             }
-            if (input.activity !== undefined &&
-                route.binding.provider !== "codex" &&
-                route.binding.provider !== "claude") {
-                throw new BridgeError("INVALID_ROUTE_BINDING", "Only exact Codex unregister or Claude unselection has public activity.");
+            if (route.registrationMode === "federated_peer") {
+                throw new BridgeError("FEDERATED_ROUTE_READ_ONLY", "A federated route is owned by its peer node; only catalog reconciliation may retire it.");
+            }
+            if (input.activity !== undefined && route.binding.provider !== "codex") {
+                throw new BridgeError("INVALID_ROUTE_BINDING", "Only exact Codex unregister has public activity.");
             }
             const settlements = this.terminalizeRegistration(state, route.binding.registrationId, now);
             this.removeRegistrationMetadata(state, route);
             if (input.activity !== undefined) {
                 this.appendRuntimeActivity(state, now, {
-                    kind: route.binding.provider === "claude" ? "selection" : "registration",
-                    action: route.binding.provider === "claude"
-                        ? "claude_unselected"
-                        : "codex_unregistered",
+                    kind: "registration", action: "codex_unregistered",
                     outcome: "accepted", aliases: [route.alias],
                     operatorAction: input.activity.operatorAction,
                 });
@@ -969,90 +910,129 @@ export class GatewayStore {
             return { replaced: true, idempotent: false, settlements };
         });
     }
-    async replaceClaudeSelection(replacement) {
+    /**
+     * Installs the route of a discovered Claude session on its first send, or
+     * brings an existing route up to date with discovery. The (host, session
+     * UUID) pair is the identity: a session already bound keeps its
+     * registration (and its in-flight conversations) and is renamed if its
+     * current name changed; a route whose alias now names a different session
+     * is displaced, its work settled `cancelled/ENDPOINT_RETIRED`. Both
+     * outcomes are journaled so `embassy status` can show them. Installation
+     * never creates a permission: same-UID, same-host addressing already is
+     * the permission, and the service's alias-collision fence has already run.
+     */
+    async installClaudeRoute(replacement) {
         return this.mutate((state, now) => {
             this.validateRouteInput(replacement);
             if (replacement.binding.provider !== "claude") {
-                throw new BridgeError("INVALID_ROUTE_BINDING", "Claude selection replacement requires a Claude logical route.");
+                throw new BridgeError("INVALID_ROUTE_BINDING", "Only a Claude logical route installs on first send.");
             }
             const byAlias = state.routes.find((route) => route.alias === replacement.alias);
             const byRegistration = state.routes.find((route) => route.binding.registrationId === replacement.binding.registrationId);
-            const byTarget = state.routes.find((route) => route.binding.provider === "claude" &&
+            const byIdentity = state.routes.find((route) => route.binding.provider === "claude" &&
                 route.binding.hostId === replacement.binding.hostId &&
                 route.binding.routeHandle === replacement.binding.routeHandle);
-            if ((byRegistration === undefined) !== (byTarget === undefined) ||
-                (byRegistration !== undefined && byRegistration !== byTarget)) {
-                throw new BridgeError("ROUTE_IDENTITY_ALREADY_REGISTERED", "The Claude registration ID and native target do not identify one route.");
-            }
-            const byIdentity = byRegistration;
-            if (byAlias !== undefined &&
-                byIdentity !== undefined &&
-                byAlias !== byIdentity) {
-                throw new BridgeError("ROUTE_IDENTITY_ALREADY_REGISTERED", "The Claude alias and logical identity belong to distinct selections.");
-            }
-            const current = byIdentity ?? byAlias;
-            if (current === undefined) {
+            if (byRegistration !== undefined && byRegistration !== byIdentity) {
+                throw new BridgeError("ROUTE_IDENTITY_ALREADY_REGISTERED", "The Claude registration ID and native session do not identify one route.");
+            }
+            if (byIdentity !== undefined &&
+                byIdentity.binding.registrationId !== replacement.binding.registrationId) {
+                throw new BridgeError("ROUTE_IDENTITY_ALREADY_REGISTERED", "The native Claude session is already registered under another identity.");
+            }
+            const settlements = [];
+            if (byAlias !== undefined && byAlias !== byIdentity) {
+                if (byAlias.binding.provider !== "claude" || byAlias.registrationMode === "federated_peer") {
+                    throw new BridgeError("ROUTE_ALIAS_ALREADY_REGISTERED", "The alias belongs to a route that a Claude session cannot displace.");
+                }
+                settlements.push(...this.terminalizeRegistration(state, byAlias.binding.registrationId, now, "ENDPOINT_RETIRED"));
+                this.removeRegistrationMetadata(state, byAlias);
+                this.appendRuntimeActivity(state, now, {
+                    kind: "registration", action: "claude_route_retired",
+                    outcome: "accepted", aliases: [byAlias.alias], operatorAction: true,
+                });
+            }
+            if (byIdentity === undefined) {
                 if (state.routes.length >= this.config.limits.maxRoutes) {
                     throw new BridgeError("ROUTE_CAPACITY_REACHED", "The bounded logical route inventory is full.", true);
                 }
                 state.routes.push(routeRecord(replacement, now));
-                return { settlements: [] };
-            }
-            if (current.binding.routeHandle === replacement.binding.routeHandle &&
-                current.binding.registrationId === replacement.binding.registrationId) {
-                this.renameRegistrationCoordinates(state, current.alias, replacement.alias, current.binding.registrationId);
-                current.alias = replacement.alias;
-                current.enabled = true;
-                current.updatedAt = now.toISOString();
-                return { settlements: [] };
-            }
-            const settlements = this.terminalizeRegistration(state, current.binding.registrationId, now);
-            this.removeRegistrationMetadata(state, current);
-            state.routes.push(routeRecord(replacement, now));
-            return { settlements };
-        });
-    }
-    async hasConsentEdge(input) {
-        return this.read((state) => {
-            const pair = this.resolvePair(state, input.aliases, false, input.expectedRegistrationIds);
-            return (pair !== undefined &&
-                state.consentEdges.some((edge) => sameConsent(edge.endpoints, pair.endpoints)));
-        });
-    }
-    async addConsentEdge(input) {
-        await this.mutate((state, now) => {
-            const pair = this.resolvePair(state, input.aliases, true, input.expectedRegistrationIds);
-            if (state.consentEdges.some((edge) => sameConsent(edge.endpoints, pair.endpoints))) {
-                return;
+                this.appendRuntimeActivity(state, now, {
+                    kind: "registration", action: "claude_route_installed",
+                    outcome: "accepted", aliases: [replacement.alias], operatorAction: true,
+                });
+                return { installed: true, settlements };
             }
-            if (state.consentEdges.length >= this.config.limits.maxConsentEdges) {
-                throw new BridgeError("CONSENT_EDGE_CAPACITY_REACHED", "The bounded consent-edge inventory is full.", true);
+            const priorAlias = byIdentity.alias;
+            if (priorAlias !== replacement.alias) {
+                this.renameRegistrationCoordinates(state, priorAlias, replacement.alias, byIdentity.binding.registrationId);
+                byIdentity.alias = replacement.alias;
+                this.appendRuntimeActivity(state, now, {
+                    kind: "registration", action: "claude_route_installed",
+                    outcome: "accepted", aliases: [priorAlias, replacement.alias], operatorAction: true,
+                });
             }
-            state.consentEdges.push({
-                endpoints: pair.endpoints, createdAt: now.toISOString(),
-                updatedAt: now.toISOString(), counters: emptyCounters(),
-            });
+            byIdentity.enabled = true;
+            byIdentity.updatedAt = now.toISOString();
+            return { installed: priorAlias !== replacement.alias, settlements };
         });
     }
-    async removeConsentEdge(input) {
-        return this.mutate((state, now) => {
-            const pair = this.resolvePair(state, input.aliases, false, input.expectedRegistrationIds);
-            if (pair === undefined) {
-                return { settlements: [], unreferencedAliases: [] };
-            }
-            const index = state.consentEdges.findIndex((edge) => sameConsent(edge.endpoints, pair.endpoints));
-            if (index < 0)
-                return { settlements: [], unreferencedAliases: [] };
-            const edge = state.consentEdges[index];
-            const settlements = this.terminalizeConsentEdge(state, edge, now);
-            state.consentEdges.splice(index, 1);
-            return {
-                settlements,
-                unreferencedAliases: edge.endpoints
-                    .map((endpoint) => endpoint.alias)
-                    .filter((alias) => !state.consentEdges.some((candidate) => candidate.endpoints.some((endpoint) => endpoint.alias === alias))),
-            };
+    /**
+     * The refusal half of admission, without the write. A send to a Claude
+     * session that has no route yet would otherwise install one — displacing
+     * another session and settling its queued work — on its way to being
+     * refused for its own reasons: too large, past the deadline window, rate
+     * limited, or into a full queue. Callers that are about to materialize a
+     * route run this first and materialize only if it returns.
+     *
+     * The refusal is still journaled, because a rejection is a fact about a real
+     * attempt; nothing else is written, and the authoritative checks still run
+     * inside `enqueueMessage` itself. `dedupeKey` is optional: a first send's key
+     * is broker-generated and cannot collide, and omitting it keeps this from
+     * inventing one to test against.
+     */
+    async assertEnqueueAdmissible(input) {
+        const bytes = Buffer.byteLength(typeof input.body === "string" ? input.body : "", "utf8");
+        const refusal = await this.read((state) => {
+            const now = this.now();
+            if (bytes > this.config.limits.maxMessageBytes)
+                return "MESSAGE_TOO_LARGE";
+            const deadlineAt = input.deadlineAt ??
+                new Date(now.getTime() + this.config.limits.messageDeadlineMs).toISOString();
+            if (!isIsoTimestamp(deadlineAt) || Date.parse(deadlineAt) <= now.getTime() ||
+                Date.parse(deadlineAt) > now.getTime() + this.config.limits.messageDeadlineMs) {
+                return "INVALID_DEADLINE";
+            }
+            // Read-only rate probe: the real enqueue consumes the token, this only
+            // asks whether one is available.
+            const bucket = state.rateBuckets.find((row) => row.sourceAlias === input.sourceAlias);
+            const windowOpen = bucket === undefined ||
+                now.getTime() - Date.parse(bucket.windowStartedAt) >= this.config.limits.rateWindowMs;
+            if (windowOpen
+                ? state.rateBuckets.filter((row) => row.sourceAlias !== input.sourceAlias).length >=
+                    this.config.limits.maxRoutes
+                : bucket.count >= this.config.limits.rateLimitPerRoute) {
+                return "GATEWAY_RATE_LIMITED";
+            }
+            const active = state.messages.filter((message) => message.state.phase !== "terminal");
+            if (active.length >= this.config.limits.maxQueueMessages ||
+                active.filter((message) => message.targetAlias === input.targetAlias).length >=
+                    this.config.limits.maxQueueMessagesPerRoute ||
+                state.accounting.queuedBytes + bytes > this.config.limits.maxQueueBytes) {
+                return "GATEWAY_QUEUE_FULL";
+            }
+            return undefined;
         });
+        if (refusal === undefined)
+            return;
+        await this.mutate((state, now) => {
+            this.recordRejection(state, { sourceAlias: input.sourceAlias, targetAlias: input.targetAlias,
+                direction: input.direction, sourceRegistrationId: input.sourceRegistrationId,
+                targetRegistrationId: input.sourceRegistrationId }, bytes, now, refusal, input);
+        });
+        throw new BridgeError(refusal, refusal === "MESSAGE_TOO_LARGE" ? "The message exceeds the configured byte bound."
+            : refusal === "INVALID_DEADLINE" ? "The message deadline must fall inside the configured delivery window."
+                : refusal === "GATEWAY_RATE_LIMITED" ? "The source exceeded the bounded gateway rate window."
+                    : "The bounded gateway queue is full.", refusal === "GATEWAY_RATE_LIMITED" || refusal === "GATEWAY_QUEUE_FULL");
     }
     async enqueueMessage(input) {
         return this.mutate((state, now) => {
@@ -1071,12 +1051,14 @@ export class GatewayStore {
                     target.binding.registrationId !== input.expectedTargetRegistrationId)) {
                 throw new BridgeError("ROUTE_UNREGISTERED", "The correlated source or target registration is no longer installed.");
             }
-            const edge = this.requireConsent(state, source, target);
+            if (source.binding.provider === target.binding.provider &&
+                source.binding.hostId === target.binding.hostId) {
+                throw new BridgeError("ROUTE_DIRECTION_MISMATCH", "Messages route only between different providers or between configured hosts.");
+            }
             return this.enqueueResolved(state, now, input, {
                 sourceAlias: source.alias, targetAlias: target.alias,
                 direction: directionId(source.binding.provider, target.binding.provider),
                 sourceRegistrationId: source.binding.registrationId, targetRegistrationId: target.binding.registrationId,
-                consentEdge: edge.endpoints, pair: true,
                 exposeDeliveryToken: true,
             });
         });
@@ -1099,68 +1081,26 @@ export class GatewayStore {
                 input.source.alias.endsWith(`@${nativeSourceHost}`) === false) {
                 throw new BridgeError("INVALID_NATIVE_PEER", "The native Claude sender does not match the target host.");
             }
-            const selected = state.routes.find((route) => route.alias === input.source.alias &&
+            // The sender's own route was installed by the service on this send;
+            // the exact binding fences a same-alias replacement that raced it.
+            const source = state.routes.find((route) => route.alias === input.source.alias &&
+                route.enabled &&
                 route.binding.provider === "claude" &&
                 route.binding.routeHandle === input.source.binding.routeHandle &&
                 route.binding.registrationId === input.source.binding.registrationId);
-            const edge = selected === undefined
-                ? undefined
-                : state.consentEdges.find((candidate) => sameConsent(candidate.endpoints, canonicalConsentEndpoints(selected, target)));
-            if ((this.config.inboundMode === "paired" || target.registrationMode === "federated_peer") && edge === undefined) {
-                this.recordRejection(state, {
-                    sourceAlias: input.source.alias, targetAlias: target.alias,
-                    direction: directionId("claude", target.binding.provider),
-                    sourceRegistrationId: selected?.binding.registrationId ?? null, targetRegistrationId: target.binding.registrationId,
-                    consentEdge: null,
-                }, Buffer.byteLength(input.body, "utf8"), now, "SENDER_NOT_PAIRED", input);
-                throw new CommitAndThrow(new BridgeError("SENDER_NOT_PAIRED", "The native Claude sender lacks exact durable consent."));
+            if (source === undefined) {
+                throw new BridgeError("ROUTE_UNREGISTERED", "The native Claude sender's route is no longer current.");
             }
-            return this.enqueueResolved(state, now, input, {
-                sourceAlias: input.source.alias, targetAlias: target.alias,
-                direction: directionId("claude", target.binding.provider),
-                sourceRegistrationId: selected?.binding.registrationId ?? null,
-                targetRegistrationId: target.binding.registrationId, consentEdge: edge?.endpoints ?? null,
-                ...(edge === undefined ? {} : { pair: true }),
-                exposeDeliveryToken: false,
-            });
-        });
-    }
-    async enqueueNativeReply(input) {
-        return this.mutate((state, now) => {
-            if (!ALIAS_PATTERN.test(input.sourceAlias) ||
-                !isPrivateToken(input.expectedSourceRegistrationId)) {
-                throw new BridgeError("INVALID_ROUTE_BINDING", "The native reply source authority is malformed.");
-            }
-            const source = state.routes.find((route) => route.alias === input.sourceAlias && route.enabled);
-            if (source === undefined ||
-                source.binding.registrationId !== input.expectedSourceRegistrationId) {
-                throw new BridgeError("ROUTE_UNREGISTERED", "The native reply source registration is no longer current.");
-            }
-            if (!isLogicalBinding(input.target.binding) ||
-                input.target.binding.provider !== "claude" ||
-                input.target.binding.hostId !== source.binding.hostId ||
-                !input.target.alias.endsWith(`@${source.binding.hostId}`)) {
-                throw new BridgeError("INVALID_NATIVE_PEER", "The native Claude reply target does not match the source host.");
-            }
-            const selectedTarget = state.routes.find((route) => route.alias === input.target.alias &&
-                route.binding.provider === "claude" &&
-                route.binding.routeHandle === input.target.binding.routeHandle &&
-                route.binding.registrationId === input.target.binding.registrationId);
-            let edge;
-            if (input.pair === true) {
-                if (selectedTarget === undefined) {
-                    throw new BridgeError("SENDER_NOT_PAIRED", "The reply no longer matches an exact selected Claude route.");
-                }
-                edge = this.requireConsent(state, source, selectedTarget);
+            if (source.binding.provider === target.binding.provider &&
+                source.binding.hostId === target.binding.hostId) {
+                throw new BridgeError("ROUTE_DIRECTION_MISMATCH", "Messages route only between different providers or between configured hosts.");
             }
             return this.enqueueResolved(state, now, input, {
-                sourceAlias: source.alias, targetAlias: input.target.alias,
-                direction: directionId(source.binding.provider, "claude"),
+                sourceAlias: source.alias, targetAlias: target.alias,
+                direction: directionId("claude", target.binding.provider),
                 sourceRegistrationId: source.binding.registrationId,
-                targetRegistrationId: selectedTarget?.binding.registrationId ?? input.target.binding.registrationId,
-                consentEdge: edge?.endpoints ?? null,
-                ...(edge === undefined ? { transientTarget: true } : { pair: true }),
-                exposeDeliveryToken: input.exposeDeliveryToken === true,
+                targetRegistrationId: target.binding.registrationId,
+                exposeDeliveryToken: false,
             });
         });
     }
@@ -1219,7 +1159,7 @@ export class GatewayStore {
                 attemptId,
                 attemptCount,
                 reservedAt: now.toISOString(), sourceRegistrationId: message.sourceRegistrationId,
-                targetRegistrationId: message.targetRegistrationId, consentEdge: message.consentEdge,
+                targetRegistrationId: message.targetRegistrationId,
             };
             state.accounting.queuedBytes -= message.bytes;
             this.touchMessage(state, message);
@@ -1236,7 +1176,7 @@ export class GatewayStore {
                         ? {}
                         : { conversationIdSuffix: message.conversationIdSuffix }),
                     sourceRegistrationId: message.sourceRegistrationId, targetRegistrationId: message.targetRegistrationId,
-                    consentEdge: message.consentEdge, bytes: message.bytes,
+                    bytes: message.bytes,
                     ...(message.steer === true ? { steer: true } : {}),
                 },
             };
@@ -1269,26 +1209,20 @@ export class GatewayStore {
             }
             if (input.sourceRegistrationId !== message.sourceRegistrationId ||
                 input.targetRegistrationId !== message.targetRegistrationId ||
-                (message.transientTarget !== true && target === undefined)) {
+                target === undefined) {
                 return { status: "stale", reason: "registration_changed" };
             }
-            if (message.sourceRegistrationId !== null) {
-                const source = state.routes.find((route) => route.alias === message.sourceAlias &&
-                    route.binding.registrationId === message.sourceRegistrationId &&
-                    route.enabled);
-                if (source === undefined) {
-                    return { status: "stale", reason: "registration_changed" };
-                }
-            }
-            if (message.consentEdge !== null &&
-                !state.consentEdges.some((edge) => sameConsent(edge.endpoints, message.consentEdge))) {
-                return { status: "stale", reason: "consent_removed" };
+            const source = state.routes.find((route) => route.alias === message.sourceAlias &&
+                route.binding.registrationId === message.sourceRegistrationId &&
+                route.enabled);
+            if (source === undefined) {
+                return { status: "stale", reason: "registration_changed" };
             }
             const authority = message.state;
             message.state = {
                 phase: "armed", attemptId: authority.attemptId,
                 attemptCount: authority.attemptCount, targetRegistrationId: authority.targetRegistrationId,
-                sourceRegistrationId: authority.sourceRegistrationId, consentEdge: authority.consentEdge,
+                sourceRegistrationId: authority.sourceRegistrationId,
                 armedAt: now.toISOString(), prepared: { ...input.prepared },
             };
             this.touchMessage(state, message);
@@ -1306,7 +1240,7 @@ export class GatewayStore {
             message.state = {
                 phase: "accepted", attemptId: authority.attemptId,
                 attemptCount: authority.attemptCount, targetRegistrationId: authority.targetRegistrationId,
-                sourceRegistrationId: authority.sourceRegistrationId, consentEdge: authority.consentEdge,
+                sourceRegistrationId: authority.sourceRegistrationId,
                 acceptedAt: now.toISOString(), prepared: authority.prepared,
                 lossOutcome: input.lossOutcome,
             };
@@ -1349,8 +1283,7 @@ export class GatewayStore {
             if ((message.state.phase === "armed" &&
                 (input.state === "expired" ||
                     (input.state === "unconfirmed" &&
-                        !((input.safeErrorCode === "ACP_OUTCOME_COARSE" && message.state.prepared.kind === "acp_prompt") ||
-                            (input.safeErrorCode === "PEER_HANDOFF_ACCEPTANCE_UNCONFIRMED" && message.state.prepared.kind === "peer_handoff"))))) ||
+                        !(input.safeErrorCode === "PEER_HANDOFF_ACCEPTANCE_UNCONFIRMED" && message.state.prepared.kind === "peer_handoff")))) ||
                 (message.state.phase === "accepted" &&
                     (input.state === "expired" ||
                         (input.state === "unconfirmed" &&
@@ -1438,18 +1371,6 @@ export class GatewayStore {
                     mutable: route.registrationMode !== "federated_peer",
                 };
             });
-            const consentEdges = state.consentEdges.map((edge) => ({
-                endpoints: [
-                    {
-                        alias: edge.endpoints[0].alias, provider: edge.endpoints[0].provider,
-                    },
-                    {
-                        alias: edge.endpoints[1].alias, provider: edge.endpoints[1].provider,
-                    },
-                ],
-                host: edgeOwnerHost(edge.endpoints), counters: { ...edge.counters },
-                mutable: edgeOwnerHost(edge.endpoints) === this.config.hostId,
-            }));
             const currentEvents = state.messages.map((message) => this.projectMessageEvent(message));
             const messageEvents = state.activity
                 .filter((entry) => entry.type === "message_activity")
@@ -1479,10 +1400,9 @@ export class GatewayStore {
             }
             return projectGatewayPublicSnapshot({
                 schemaVersion: 2, generatedAt: now.toISOString(),
-                inboundMode: this.config.inboundMode, health: "offline",
+                health: "offline",
                 connectors: [], availablePeers: [],
                 routes,
-                consentEdges,
                 activityEvents,
                 deadlinePressure: {
                     configuredDeadlineMs: this.config.limits.messageDeadlineMs,
@@ -1497,7 +1417,7 @@ export class GatewayStore {
                 accounting: { ...state.accounting }, alerts: [],
                 truncation: {
                     connectors: 0, availablePeers: 0,
-                    routes: 0, consentEdges: 0,
+                    routes: 0,
                     activityEvents: 0,
                     messages: Math.max(0, messageEvents.length + currentEvents.length - messages.length),
                     alerts: 0,
@@ -1570,51 +1490,6 @@ export class GatewayStore {
         }
         return route;
     }
-    resolvePair(state, aliases, required, expectedRegistrationIds) {
-        if (aliases.length !== 2 ||
-            aliases[0] === aliases[1] ||
-            !aliases.every((alias) => ALIAS_PATTERN.test(alias))) {
-            if (required) {
-                throw new BridgeError("INVALID_CONSENT_EDGE", "Consent requires two distinct exact route aliases.");
-            }
-            return undefined;
-        }
-        const left = state.routes.find((route) => route.alias === aliases[0]);
-        const right = state.routes.find((route) => route.alias === aliases[1]);
-        if (expectedRegistrationIds === undefined ||
-            !expectedRegistrationIds.every(isPrivateToken)) {
-            if (required) {
-                throw new BridgeError("INVALID_CONSENT_EDGE", "Consent requires both exact registration identities.");
-            }
-            return undefined;
-        }
-        if (left?.binding.registrationId !== expectedRegistrationIds[0] ||
-            right?.binding.registrationId !== expectedRegistrationIds[1]) {
-            throw new BridgeError("ROUTE_UNREGISTERED", "A consent endpoint registration is no longer current.");
-        }
-        if (left === undefined ||
-            right === undefined ||
-            (left.binding.provider === right.binding.provider &&
-                left.binding.hostId === right.binding.hostId)) {
-            if (required) {
-                throw new BridgeError("INVALID_CONSENT_EDGE", "Consent requires distinct providers or distinct configured hosts.");
-            }
-            return undefined;
-        }
-        return {
-            left,
-            right,
-            endpoints: canonicalConsentEndpoints(left, right),
-        };
-    }
-    requireConsent(state, source, target) {
-        const endpoints = canonicalConsentEndpoints(source, target);
-        const edge = state.consentEdges.find((candidate) => sameConsent(candidate.endpoints, endpoints));
-        if (edge === undefined) {
-            throw new BridgeError("SENDER_NOT_PAIRED", "The exact logical routes do not share consent.");
-        }
-        return edge;
-    }
     enqueueResolved(state, now, input, authority) {
         if (typeof input.body !== "string" ||
             input.body.length === 0 ||
@@ -1708,13 +1583,8 @@ export class GatewayStore {
             deadlineAt,
             bytes,
             body: input.body,
-            ...(authority.pair === true ? { pair: true } : {}),
-            ...(authority.transientTarget === true
-                ? { transientTarget: true }
-                : {}),
             ...(input.steer === true ? { steer: true } : {}),
             sourceRegistrationId: authority.sourceRegistrationId, targetRegistrationId: authority.targetRegistrationId,
-            consentEdge: authority.consentEdge,
             state: { phase: "queued", attemptCount: 0 },
         };
         state.messages.push(message);
@@ -1726,12 +1596,6 @@ export class GatewayStore {
             source.counters.accepted += 1;
             source.counters.bytesAccepted += bytes;
         }
-        const edge = state.consentEdges.find((candidate) => sameConsent(candidate.endpoints, authority.consentEdge));
-        if (edge !== undefined) {
-            edge.counters.accepted += 1;
-            edge.counters.bytesAccepted += bytes;
-            edge.updatedAt = now.toISOString();
-        }
         state.dedupe.push({
             fingerprint,
             messageIdSuffix,
@@ -1740,7 +1604,6 @@ export class GatewayStore {
                 : { conversationIdSuffix: input.conversationIdSuffix }),
             sourceAlias: authority.sourceAlias, targetAlias: authority.targetAlias,
             direction: authority.direction,
-            ...(authority.pair === true ? { pair: true } : {}),
             firstSeenAt: now.toISOString(),
             expiresAt: new Date(now.getTime() + this.config.limits.dedupeTtlMs).toISOString(),
         });
@@ -1752,22 +1615,11 @@ export class GatewayStore {
             messageId,
             messageIdSuffix,
             ...(deliveryToken === undefined ? {} : { deliveryToken }),
-            ...(authority.pair === true ? { pair: true } : {}),
             ...(supersededSettlement === undefined
                 ? {}
                 : { supersededSettlement }),
         };
     }
-    terminalizeConsentEdge(state, edge, now) {
-        return state.messages.filter((message) => message.state.phase !== "terminal" &&
-            sameConsent(message.consentEdge, edge.endpoints)).map((message) => {
-            const outcome = message.state.phase === "armed" ? "ambiguous" :
-                message.state.phase === "accepted" ? message.state.lossOutcome : "cancelled";
-            return this.finishMessage(state, message, outcome, now, outcome === "ambiguous"
-                ? "DISPATCH_OUTCOME_AMBIGUOUS" : outcome === "unconfirmed"
-                ? "DELIVERY_UNCONFIRMED" : "SENDER_NOT_PAIRED");
-        });
-    }
     allocateDeliveryToken(state) {
         for (let attempt = 0; attempt < 8; attempt += 1) {
             const token = `dlv_${createHash("sha256")
@@ -1807,11 +1659,6 @@ export class GatewayStore {
         const source = state.routes.find((route) => route.binding.registrationId === authority.sourceRegistrationId);
         if (source !== undefined)
             source.counters.rejected += 1;
-        const edge = state.consentEdges.find((candidate) => sameConsent(candidate.endpoints, authority.consentEdge));
-        if (edge !== undefined) {
-            edge.counters.rejected += 1;
-            edge.updatedAt = now.toISOString();
-        }
         const suffix = this.randomId().replaceAll("-", "").slice(-8).toLowerCase();
         if (!MESSAGE_SUFFIX_PATTERN.test(suffix))
             return;
@@ -1858,11 +1705,6 @@ export class GatewayStore {
         const target = state.routes.find((route) => route.binding.registrationId === message.targetRegistrationId);
         if (target !== undefined)
             target.counters[outcome] += 1;
-        const edge = state.consentEdges.find((candidate) => sameConsent(candidate.endpoints, message.consentEdge));
-        if (edge !== undefined) {
-            edge.counters[outcome] += 1;
-            edge.updatedAt = now.toISOString();
-        }
         return {
             messageId: message.messageId, state: outcome,
             ...(safeErrorCode === undefined ? {} : { safeErrorCode }),
@@ -1887,7 +1729,7 @@ export class GatewayStore {
         }
         return structuredClone(recorded);
     }
-    terminalizeRegistration(state, registrationId, now) {
+    terminalizeRegistration(state, registrationId, now, cancelledCode = "ROUTE_UNREGISTERED") {
         const settlements = [];
         for (const message of state.messages) {
             if (message.state.phase === "terminal" ||
@@ -1901,7 +1743,7 @@ export class GatewayStore {
                     ? message.state.lossOutcome
                     : "cancelled";
             settlements.push(this.finishMessage(state, message, outcome, now, outcome === "cancelled"
-                ? "ROUTE_UNREGISTERED"
+                ? cancelledCode
                 : outcome === "ambiguous"
                     ? "DISPATCH_OUTCOME_AMBIGUOUS"
                     : "DELIVERY_UNCONFIRMED"));
@@ -1909,8 +1751,16 @@ export class GatewayStore {
         return settlements;
     }
     removeRegistrationMetadata(state, route) {
+        if (this.ephemeralRegistrations.has(route.binding.registrationId)) {
+            // An ephemeral registration takes every row it owns with it — in this
+            // same mutate, and before its id leaves the set — so the closing
+            // persist finds nothing of it to write: not the message it sent, not
+            // the reply it received, not a journal row that names it.
+            Object.assign(state, this.ephemeralRowsRemoved(state, new Set([route.binding.registrationId]), new Set([route.alias])));
+            this.ephemeralRegistrations.delete(route.binding.registrationId);
+            return;
+        }
         state.routes = state.routes.filter((candidate) => candidate !== route);
-        state.consentEdges = state.consentEdges.filter((edge) => !edge.endpoints.some((endpoint) => endpoint.registrationId === route.binding.registrationId));
         state.dedupe = state.dedupe.filter((entry) => entry.sourceAlias !== route.alias && entry.targetAlias !== route.alias);
         state.rateBuckets = state.rateBuckets.filter((entry) => entry.sourceAlias !== route.alias);
     }
@@ -1921,13 +1771,6 @@ export class GatewayStore {
             state.routes.some((route) => route.alias === newAlias)) {
             throw new BridgeError("ROUTE_ALIAS_ALREADY_REGISTERED", "The replacement alias is invalid or already registered.");
         }
-        for (const edge of state.consentEdges) {
-            const updated = edge.endpoints.map((endpoint) => endpoint.registrationId === registrationId
-                ? { ...endpoint, alias: newAlias }
-                : endpoint);
-            updated.sort(compareConsentEndpoints);
-            edge.endpoints = updated;
-        }
         for (const message of state.messages) {
             if (message.sourceRegistrationId === registrationId) {
                 message.sourceAlias = newAlias;
@@ -1935,24 +1778,6 @@ export class GatewayStore {
             if (message.targetRegistrationId === registrationId) {
                 message.targetAlias = newAlias;
             }
-            if (message.consentEdge !== null) {
-                const updated = message.consentEdge.map((endpoint) => endpoint.registrationId === registrationId
-                    ? { ...endpoint, alias: newAlias }
-                    : endpoint);
-                updated.sort(compareConsentEndpoints);
-                message.consentEdge = updated;
-            }
-            if (message.state.phase === "reserved" ||
-                message.state.phase === "armed" ||
-                message.state.phase === "accepted") {
-                if (message.state.consentEdge !== null) {
-                    const updated = message.state.consentEdge.map((endpoint) => endpoint.registrationId === registrationId
-                        ? { ...endpoint, alias: newAlias }
-                        : endpoint);
-                    updated.sort(compareConsentEndpoints);
-                    message.state.consentEdge = updated;
-                }
-            }
         }
         for (const entry of state.dedupe) {
             if (entry.sourceAlias === oldAlias)
@@ -1996,10 +1821,6 @@ export class GatewayStore {
                     : "CONTROLLER_RESTARTED");
                 continue;
             }
-            if (message.transientTarget === true) {
-                this.finishMessage(state, message, "abandoned", now, "CONTROLLER_RESTARTED");
-                continue;
-            }
             if (message.state.phase === "reserved") {
                 const attemptCount = message.state.attemptCount;
                 message.state = { phase: "queued", attemptCount };
@@ -2054,7 +1875,6 @@ export class GatewayStore {
         if (state.routes.some((route) => !this.config.allowedHosts.includes(route.binding.hostId) ||
             !routeModeMatchesHost(route, this.config.hostId)) ||
             state.routes.length > this.config.limits.maxRoutes ||
-            state.consentEdges.length > this.config.limits.maxConsentEdges ||
             active.length > this.config.limits.maxQueueMessages ||
             active.filter((message) => message.state.phase === "reserved" ||
                 message.state.phase === "armed" ||
@@ -2075,6 +1895,16 @@ export class GatewayStore {
         return this.mutex.run("gateway", async () => {
             const state = this.requireState();
             const before = structuredClone(state);
+            // The ephemeral set is state too: a removal drops an id from it inside
+            // the operation, and a rollback that restored the rows but not the id
+            // would turn a memory-only registration into a durable one.
+            const ephemeralBefore = new Set(this.ephemeralRegistrations);
+            const rollback = () => {
+                this.state = before;
+                this.ephemeralRegistrations.clear();
+                for (const id of ephemeralBefore)
+                    this.ephemeralRegistrations.add(id);
+            };
             const now = this.now();
             this.prune(state, now);
             let value;
@@ -2091,14 +1921,13 @@ export class GatewayStore {
                         await this.persist();
                     }
                     catch (persistError) {
-                        if (!(persistError instanceof PostRenamePersistenceError)) {
-                            this.state = before;
-                        }
+                        if (!(persistError instanceof PostRenamePersistenceError))
+                            rollback();
                         throw persistError;
                     }
                     throw error.error;
                 }
-                this.state = before;
+                rollback();
                 throw error;
             }
             state.updatedAt = now.toISOString();
@@ -2110,7 +1939,7 @@ export class GatewayStore {
             }
             catch (error) {
                 if (!(error instanceof PostRenamePersistenceError))
-                    this.state = before;
+                    rollback();
                 throw error;
             }
             return value;
@@ -2189,6 +2018,58 @@ export class GatewayStore {
         }
         return root;
     }
+    /**
+     * Boot-time litter sweep (emb-106): the static `gateway-dashboard*.html`
+     * files 2.x published, any `.tmp` file its temp-file+rename publish could
+     * have left behind mid-crash, and controller locks this store recovered as
+     * stale more than seven days ago, are unlinked best-effort. Only a
+     * regular file owned by this uid is removed (lstat, no symlink following);
+     * nothing else in the state directory is touched, and a removal failure
+     * never blocks startup. Runs only after the controller lock is held and
+     * the state this boot will run on has passed both its schema check and
+     * assertConfiguredBounds, so a refused boot leaves the directory exactly
+     * as found.
+     */
+    async removeStateDirectoryLitter(root) {
+        let entries;
+        try {
+            entries = await readdir(root);
+        }
+        catch {
+            return;
+        }
+        const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+        const now = this.now().getTime();
+        for (const name of entries) {
+            const dashboard = isStaleDashboardArtifact(name);
+            const recoveredAt = dashboard ? undefined : staleLockRecoveredAt(name);
+            if (!dashboard && recoveredAt === undefined)
+                continue;
+            const filePath = path.join(root, name);
+            let info;
+            try {
+                info = await lstat(filePath);
+            }
+            catch {
+                continue;
+            }
+            if (info.isSymbolicLink() || !info.isFile() || (uid !== undefined && info.uid !== uid))
+                continue;
+            // A recovered lock is evidence: keep it a week from the recovery that
+            // created it, which is what its name records.
+            if (recoveredAt !== undefined && now - recoveredAt <= STALE_LOCK_RETENTION_MS)
+                continue;
+            try {
+                await unlink(filePath);
+                process.stderr.write(dashboard
+                    ? `[embassy] removed stale ${name} left by an earlier Embassy release from the gateway state directory\n`
+                    : `[embassy] removed ${name}, a recovered gateway lock older than seven days\n`);
+            }
+            catch {
+                // Best-effort cleanup; leave the file in place if it cannot be removed.
+            }
+        }
+    }
     assertOwnedPrivate(uid, mode, kind) {
         if (typeof process.getuid === "function" && uid !== process.getuid()) {
             throw new BridgeError("UNSAFE_GATEWAY_STATE_DIRECTORY", `The gateway ${kind} is not owned by the current process user.`);
@@ -2238,6 +2119,23 @@ export class GatewayStore {
             await handle.close();
         }
     }
+    /**
+     * Move a lock nobody owns aside instead of deleting it: a crash stays
+     * diagnosable for a week (the boot sweep ages these out), and the caller
+     * is told, because a silent recovery of another process's lock would be
+     * the one event an operator most needs to see.
+     */
+    async recoverStaleLock(lockPath, description) {
+        const name = `${CONTROLLER_LOCK}.stale-${String(this.now().getTime())}-${randomUUID()}`;
+        const moved = await rename(lockPath, path.join(this.rootDir, name)).then(() => true, (error) => {
+            // Another start recovered it first; retry the create either way.
+            if (error instanceof Error && "code" in error && error.code === "ENOENT")
+                return false;
+            throw error;
+        });
+        if (moved)
+            process.stderr.write(`[embassy] recovered a stale gateway lock (${description}) → ${name}\n`);
+    }
     async acquireLock() {
         const lockPath = path.join(this.rootDir, CONTROLLER_LOCK);
         for (let attempt = 0; attempt < 3; attempt += 1) {
@@ -2250,7 +2148,7 @@ export class GatewayStore {
                 try {
                     await handle.writeFile(`${JSON.stringify({
                         schemaVersion: 1, pid: process.pid,
-                        hostname: os.hostname(),
+                        hostname: this.hostname(),
                         token,
                     })}\n`, "utf8");
                     await handle.sync();
@@ -2271,35 +2169,54 @@ export class GatewayStore {
                     throw error;
                 }
             }
-            let owner;
+            let body;
             try {
-                owner = JSON.parse(await this.readPrivateFile(lockPath, MAX_LOCK_FILE_BYTES));
+                body = await this.readPrivateFile(lockPath, MAX_LOCK_FILE_BYTES);
             }
             catch {
-                throw new BridgeError("GATEWAY_STATE_LOCK_UNVERIFIED", "The gateway state lock exists but cannot be safely verified.");
+                throw lockUnverified();
             }
-            if (owner.hostname !== os.hostname() || !isPositiveInteger(owner.pid)) {
-                throw new BridgeError("GATEWAY_STATE_IN_USE", "The gateway state directory is locked by another host or unverifiable process.", true);
+            // A crash between the O_EXCL create and the write leaves a zero-byte
+            // lock. It records no owner at all, so it can only be the corpse of a
+            // start that never began: recover it rather than wedging on it.
+            if (body.trim().length === 0) {
+                await this.recoverStaleLock(lockPath, "empty, left by an interrupted start");
+                continue;
             }
-            let alive = true;
+            let owner;
             try {
-                process.kill(owner.pid, 0);
+                owner = JSON.parse(body);
             }
-            catch (error) {
-                if (error instanceof Error && "code" in error && error.code === "ESRCH") {
-                    alive = false;
-                }
-            }
-            if (alive) {
-                throw new BridgeError("GATEWAY_STATE_IN_USE", "Another live gateway controller owns this state directory.", true);
-            }
-            await rename(lockPath, path.join(this.rootDir, `.gateway-controller.lock.stale-${randomUUID()}`)).catch((error) => {
-                if (!(error instanceof Error) ||
-                    !("code" in error) ||
-                    error.code !== "ENOENT") {
-                    throw error;
-                }
-            });
+            catch {
+                throw lockUnverified();
+            }
+            // Parsed, but naming no process: there is nothing to probe and nothing
+            // to claim about it, so this is unverified like any other unreadable
+            // record — never "another broker may own this".
+            if (!isPositiveInteger(owner.pid))
+                throw lockUnverified();
+            // Recovery is decided by process liveness alone; the recorded hostname
+            // is informational. A machine that renames itself — a network-triggered
+            // rename, a restore onto new hardware — must not wedge its own state
+            // directory forever, so a dead pid is stale whatever name wrote it.
+            const recorded = boundedHostname(owner.hostname);
+            const pid = String(owner.pid);
+            // A name this cannot represent is not reported as a name: the client
+            // hint drops the whole clause rather than printing a placeholder.
+            const detail = recorded === undefined ? { pid } : { host: recorded, pid };
+            if (this.isProcessAlive(owner.pid)) {
+                // The pid is alive, but nothing here can tell whether it is a broker:
+                // pid numbers are reused, and a renamed machine records its old name.
+                // Refuse, and hand the client the bounded facts its hint needs.
+                const mine = boundedHostname(this.hostname());
+                const message = recorded !== undefined && mine !== undefined && recorded === mine
+                    ? `A live process (pid ${pid}) recorded on this machine owns this gateway state directory.`
+                    : recorded === undefined
+                        ? `The gateway state lock records pid ${pid} under a machine name that cannot be verified, and a process with that pid is alive here.`
+                        : `The gateway state lock records host ${recorded} and pid ${pid}, and a process with that pid is alive here.`;
+                throw new BridgeError("GATEWAY_STATE_IN_USE", message, true, detail);
+            }
+            await this.recoverStaleLock(lockPath, recorded === undefined ? `pid ${pid}, machine name unverifiable` : `recorded host ${recorded}, pid ${pid}`);
         }
         throw new BridgeError("GATEWAY_STATE_IN_USE", "Could not acquire exclusive gateway controller ownership.", true);
     }
@@ -2339,11 +2256,16 @@ export class GatewayStore {
         catch {
             throw new BridgeError("CORRUPT_GATEWAY_STATE", "The gateway controller state is not valid JSON.");
         }
-        if (isObject(parsed) && Object.hasOwn(parsed, "schemaVersion") && parsed.schemaVersion !== 4) {
-            throw new BridgeError("GATEWAY_STATE_SCHEMA_UNSUPPORTED", "The gateway state schema is unsupported. Stop Embassy, move gateway-state.json aside, keep nodes.json, then restart and re-register, select, and pair routes.");
+        if (isObject(parsed) && Object.hasOwn(parsed, "schemaVersion") && parsed.schemaVersion !== 5) {
+            throw new BridgeError("GATEWAY_STATE_SCHEMA_UNSUPPORTED", "The gateway state schema is unsupported. Stop Embassy, move gateway-state.json aside — nodes.json, if you use federation, is untouched — then restart and re-register Codex tasks.");
         }
-        if (!isGatewayPersistedStateV4(parsed)) {
-            throw new BridgeError("CORRUPT_GATEWAY_STATE", "The gateway controller state failed strict v4 schema validation.");
+        if (!isGatewayPersistedStateV5(parsed, this.config.hostId)) {
+            // A document that is a valid v5 state on its own terms but not under this
+            // broker's host identity is not corrupt: it belongs to another host, and
+            // the operator deserves that sentence rather than "failed validation".
+            throw isGatewayPersistedStateV5(parsed)
+                ? new BridgeError("CORRUPT_GATEWAY_STATE", "The gateway state exceeds its configured bounds or host allowlist.")
+                : new BridgeError("CORRUPT_GATEWAY_STATE", "The gateway controller state failed strict v5 schema validation.");
         }
         this.assertConfiguredBounds(parsed);
         return parsed;
@@ -2351,7 +2273,7 @@ export class GatewayStore {
     async persist(force = false) {
         if (this.persistenceDeferred && !force)
             return;
-        const state = this.requireState();
+        const state = this.persistedProjection(this.requireState());
         const temporary = path.join(this.rootDir, `.gateway-state-${randomUUID()}.tmp`);
         const body = `${JSON.stringify(state, null, 2)}\n`;
         if (Buffer.byteLength(body, "utf8") > GATEWAY_MAX_STATE_FILE_BYTES) {
@@ -2410,10 +2332,13 @@ export class GatewayStore {
                 }
                 const installedCurrent = installed?.commit.id === state.commit.id &&
                     installed.commit.sequence === state.commit.sequence;
-                if (installedCurrent && installed !== undefined) {
-                    this.state = installed;
+                // The rename crossed the commit point and the file holds this very
+                // commit: the write succeeded. The live state stays as it is — the
+                // file is its projection, minus the ephemeral rows that must never be
+                // read back in, so installing the readback here would silently turn
+                // every live ephemeral registration into nothing.
+                if (installedCurrent)
                     return;
-                }
                 const installedPrior = !readbackFailed &&
                     (prior === undefined
                         ? installed === undefined