agent-embassy 3.0.0 → 4.0.0

package/dist/src/gateway/service.js

@@ -1,2274 +0,0 @@
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { BridgeError } from "../errors.js";
-import { createGatewayConversationId, startGatewayControlServer, GATEWAY_EPHEMERAL_PEER_TTL_DEFAULT_MS, } from "./control.js";
-import { PeerConnectionLostError, spawnPeerClient } from "./peer-client.js";
-import { peerRouteRef } from "./peer-protocol.js";
-import { GatewayStore } from "./store.js";
-import { CONNECTOR_OBSERVATION_STALE_AFTER_MS, directionId, GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET, gatewayPublicSnapshotLimits, gatewayRegistrationIngressPrefixes, parseDirection, projectGatewayPublicSnapshot, } from "./types.js";
-const SAFE_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
-const PRIVATE_HANDLE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
-const PUBLIC_ALIAS = /^[a-z][a-z0-9_-]{0,31}@[a-z0-9](?:[a-z0-9.-]{0,61}[a-z0-9])?$/;
-const PEER_TOKEN = /^peer_[A-Za-z0-9_-]{32}$/;
-const DISCOVERY_INTERVAL_MS = 30_000;
-const MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS = 30_000;
-const PEER_REFRESH_INTERVAL_MS = 30_000;
-/** A failed timed retirement of an ephemeral peer is retried this much later… */
-const EPHEMERAL_EXPIRY_RETRY_MS = 5_000;
-/** …this many times in a row before the registration is left to the next restart. */
-const EPHEMERAL_EXPIRY_MAX_ATTEMPTS = 3;
-const PEER_FAILURE_CODES = ["PEER_DIAL_FAILED", "PEER_TUNNEL_UNAVAILABLE", "PEER_PROTOCOL_MISMATCH"];
-const CLEAN_RETRY_DELAY_MS = 500;
-const MAX_CONVERSATIONS = 1_024;
-const MAX_PENDING_CLAUDE_REPLIES = MAX_CONVERSATIONS;
-const CLEAN_RETRY_CODES = new Set([
-    "THREAD_NOT_OBSERVED",
-    "ROUTE_BUSY",
-    "APPROVAL_REQUIRED",
-    "MANAGED_CODEX_UNAVAILABLE",
-    "LOCAL_APP_SERVER_NOT_RUNNING",
-    "ENDPOINT_GENERATION_CHANGED",
-    "SPAWN_FAILED",
-    "SPAWN_TIMEOUT",
-    "TRANSPORT_CONNECT_FAILED",
-    "REQUEST_TIMEOUT",
-    "PEER_NOT_AWAITING",
-]);
-function registrationId() {
-    return `reg_${randomBytes(18).toString("base64url")}`;
-}
-function aliasHost(alias) {
-    return alias.slice(alias.lastIndexOf("@") + 1);
-}
-function safeCode(value, fallback) {
-    return value !== undefined && SAFE_CODE.test(value) ? value : fallback;
-}
-function decisionFor(error, peerPrincipal = false) {
-    if (!(error instanceof BridgeError))
-        return { accepted: false, code: "rejected" };
-    if (error.code.includes("NOT_FOUND") || error.code.includes("NOT_AVAILABLE")) {
-        return { accepted: false, code: "not_found" };
-    }
-    if (error.code.includes("COLLISION") || error.code.includes("ALREADY") || error.code.includes("OWNER")) {
-        return { accepted: false, code: "conflict" };
-    }
-    if (error.code.includes("BUSY") || error.code.includes("CAPACITY")) {
-        return { accepted: false, code: "busy" };
-    }
-    if (error.code.includes("UNAVAILABLE") || error.code.includes("OFFLINE") || error.code.includes("UNOBSERVED")) {
-        return { accepted: false, code: "unavailable" };
-    }
-    if ((peerPrincipal && error.code === "ROUTE_UNREGISTERED") || error.code.includes("MISMATCH") ||
-        error.code.includes("CHANGED") || error.code.includes("ADDRESS")) {
-        return { accepted: false, code: "route_mismatch" };
-    }
-    return { accepted: false, code: "rejected" };
-}
-/**
- * The refusal a send returns: the coarse decision clients branch on,
- * plus the safe code behind it so the CLI can name the one remedy that fits.
- * Only a BridgeError's own code is carried; anything else stays anonymous.
- */
-function sendRefusal(error, peerPrincipal = false) {
-    const decision = decisionFor(error, peerPrincipal);
-    const reason = error instanceof BridgeError && SAFE_CODE.test(error.code) ? error.code : undefined;
-    return { accepted: false, code: decision.code, ...(reason === undefined ? {} : { reason }) };
-}
-/**
- * A grammar-valid alias for a session that cannot have the name it discovered
- * under, because a live session already holds it. The suffix is derived from
- * the session's own route handle, so it is stable across sends, and it is a
- * hash rather than the handle itself: a native session UUID must never enter a
- * public alias.
- */
-function disambiguatedAlias(alias, routeHandle) {
-    const at = alias.lastIndexOf("@");
-    const name = alias.slice(0, at), host = alias.slice(at + 1);
-    const suffix = createHash("sha256").update(routeHandle).digest("hex").slice(0, 8);
-    return `${name.slice(0, 32 - suffix.length - 1)}-${suffix}@${host}`;
-}
-/** The decoder already accepted exactly one credential, so the last arm holds. */
-function replyCaller(params) {
-    const { fromAlias, threadId, replyAddress, peerToken } = params;
-    return threadId !== undefined ? { kind: "codex", alias: fromAlias, threadId }
-        : replyAddress !== undefined ? { kind: "claude", alias: fromAlias, replyAddress }
-            : { kind: "peer", alias: fromAlias, token: peerToken };
-}
-function sameBinding(left, right) {
-    return left.provider === right.provider && left.hostId === right.hostId &&
-        left.routeHandle === right.routeHandle && left.registrationId === right.registrationId;
-}
-function connectorKey(identity) {
-    return `${identity.provider}\0${identity.hostId}`;
-}
-function publicRegistry(value, previouslyParseable) {
-    const counts = new Map();
-    for (const row of value.rejected)
-        if (SAFE_CODE.test(row.safeErrorCode) && Number.isSafeInteger(row.count) && row.count > 0)
-            counts.set(row.safeErrorCode, (counts.get(row.safeErrorCode) ?? 0) + row.count);
-    const rejected = [...counts].map(([safeErrorCode, count]) => ({ safeErrorCode, count }))
-        .sort((left, right) => left.safeErrorCode < right.safeErrorCode ? -1 :
-        left.safeErrorCode > right.safeErrorCode ? 1 : 0);
-    const retained = rejected.slice(0, gatewayPublicSnapshotLimits.registryRejectionCodes);
-    return {
-        entriesScanned: Math.max(0, value.entriesScanned),
-        parseableRecords: Math.max(0, Math.min(value.entriesScanned, value.parseableRecords)),
-        parseableRecordSeenSinceBoot: previouslyParseable || value.parseableRecords > 0,
-        rejected: retained.map((row) => ({ ...row })),
-        rejectedCodesOmitted: Math.max(0, rejected.length - retained.length),
-    };
-}
-function conversationIdForSuffix(suffix) {
-    const fresh = createGatewayConversationId();
-    return suffix === undefined ? fresh : `${fresh.slice(0, -8)}${suffix}`;
-}
-function bodyHash(body) {
-    return createHash("sha256").update(body, "utf8").digest("hex");
-}
-function peerCatalogAuthorityChanged(prior, current) {
-    const authority = (catalog) => JSON.stringify(catalog.routes.map(({ state: _state, queueDepth: _depth, lastSeenAt: _seen, safeErrorCode: _code, ...route }) => route).sort((a, b) => a.ref.localeCompare(b.ref)));
-    return prior === undefined || authority(prior) !== authority(current);
-}
-function peerCatalogViewChanged(prior, current) {
-    const view = (catalog) => JSON.stringify([
-        catalog.health,
-        catalog.connectors.map(({ lastSeenAt: _seen, observationAgeMs: _age, ...row }) => row),
-        catalog.routes.map(({ lastSeenAt: _seen, ...row }) => row).sort((a, b) => a.ref.localeCompare(b.ref)),
-        catalog.alerts.map(({ timestamp: _timestamp, ...row }) => row),
-    ]);
-    return prior === undefined || view(prior) !== view(current);
-}
-function peerHandle(uid, alias, token) {
-    return `peer:${createHash("sha256").update(`${uid}\0${alias}\0${token}`).digest("hex")}`;
-}
-export class GatewayService {
-    config;
-    store;
-    adapters;
-    now;
-    timers;
-    nativePeerCwd;
-    managedCodexSocketHeld;
-    spawnPeer;
-    peerClients = new Map();
-    peerCatalogs = new Map();
-    peerCleanupAliases = new Set();
-    /** View-only freshness; never consulted by routing or write authorization. */
-    peerRouteViews = new Map();
-    connectors = new Map();
-    routeObservations = new Map();
-    candidates = new Map();
-    collidingClaudeAliases = new Set();
-    conversations = new Map();
-    messageContexts = new Map();
-    activeAttempts = new Map();
-    reserveOperations = new Set();
-    inboundOperations = new Set();
-    peerRefreshOperations = new Set();
-    pendingClaudeReplies = new Map();
-    nativeReceipts = new Map();
-    dispatchRunners = new Map();
-    steerRunners = new Map();
-    startingTargets = new Set();
-    runtimeAlerts = [];
-    /**
-     * Ephemeral peer registrations and the wall-clock instant each one dies.
-     * Nothing durable records them, so this map is the whole lifetime: it is
-     * swept on the ordinary maintenance tick, and a restart simply never sees
-     * the routes at all.
-     */
-    ephemeralPeerExpiries = new Map();
-    /** Consecutive failed retirements per ephemeral alias; cleared on success or removal. */
-    ephemeralExpiryFailures = new Map();
-    control;
-    wakeTimer;
-    nextDiscoveryAt = 0;
-    nextManagedCodexCheckAt = 0;
-    nextPeerRefreshAt = 0;
-    managedCodexSocketHeldOutside = false;
-    revision = 0;
-    snapshotRevision = 0;
-    snapshotFingerprint;
-    running = false;
-    closing = false;
-    closeInFlight;
-    constructor(options) {
-        this.config = options.config;
-        this.adapters = [...(options.adapters ?? [])];
-        this.store = options.store ?? new GatewayStore(options.config, options.now === undefined ? {} : { now: options.now });
-        this.now = options.now ?? (() => new Date());
-        this.nativePeerCwd = options.nativePeerCwd ?? process.cwd();
-        this.managedCodexSocketHeld = options.managedCodexSocketHeld;
-        this.spawnPeer = options.spawnPeer ?? spawnPeerClient;
-        this.timers = options.timers ?? {
-            setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
-            clearTimeout: (timer) => clearTimeout(timer),
-        };
-    }
-    async start(signal) {
-        if (this.running || this.closing)
-            return;
-        const assertActive = () => {
-            if (signal?.aborted === true || this.closing) {
-                throw new BridgeError("GATEWAY_START_CANCELLED", "Gateway startup was cancelled.", true);
-            }
-        };
-        await this.store.initialize({ deferPersistence: true });
-        try {
-            assertActive();
-            const seen = new Set();
-            for (const adapter of this.adapters) {
-                const key = connectorKey(adapter.identity);
-                if (seen.has(key) || !this.config.allowedHosts.includes(adapter.identity.hostId)) {
-                    throw new BridgeError("GATEWAY_ADAPTER_NOT_ALLOWED", "A provider adapter is duplicated or outside the host allowlist.");
-                }
-                seen.add(key);
-                const started = await adapter.initialize(this.callbacksFor(adapter));
-                assertActive();
-                const observedAt = this.now().toISOString();
-                const runtime = {
-                    adapter,
-                    health: started.health,
-                    observedAt,
-                    ...(started.safeErrorCode === undefined
-                        ? {}
-                        : { safeErrorCode: safeCode(started.safeErrorCode, "ADAPTER_DEGRADED") }),
-                };
-                const registry = adapter.latestRegistryObservation?.();
-                if (registry !== undefined)
-                    runtime.registry = publicRegistry(registry, false);
-                this.connectors.set(key, runtime);
-                if (started.ownedRoute !== undefined) {
-                    await this.installOwnedRoute(adapter, started.ownedRoute);
-                }
-            }
-            await this.refreshClaudeDiscovery().catch(() => undefined);
-            await this.refreshManagedCodexSocket().catch(() => undefined);
-            const control = await startGatewayControlServer({
-                stateDir: this.store.rootDir,
-                socketPath: this.config.controlSocketPath,
-                handlers: this.handlers(),
-            });
-            try {
-                assertActive();
-                await this.store.commitInitialization();
-            }
-            catch (error) {
-                await control.close();
-                throw error;
-            }
-            this.control = control;
-            this.running = true;
-            await this.observeLoadedRoutes();
-            const now = this.now().getTime();
-            this.nextDiscoveryAt = now + DISCOVERY_INTERVAL_MS;
-            this.nextManagedCodexCheckAt = now + MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS;
-            this.nextPeerRefreshAt = this.config.peerNodes.length > 0 ? now : 0;
-            for (const target of await this.store.inspectDispatchableTargets())
-                this.kick(target);
-            this.scheduleWake();
-            assertActive();
-        }
-        catch (error) {
-            await this.close();
-            throw error;
-        }
-    }
-    async close() {
-        if (this.closeInFlight !== undefined)
-            return await this.closeInFlight;
-        this.closing = true;
-        this.closeInFlight = this.closeOnce();
-        return await this.closeInFlight;
-    }
-    async closeOnce() {
-        this.running = false;
-        if (this.wakeTimer !== undefined) {
-            this.timers.clearTimeout(this.wakeTimer);
-            this.wakeTimer = undefined;
-        }
-        // The durable phase reducer wins before any provider cleanup I/O. Exact
-        // reserved work requeues; armed and accepted work terminalize by phase.
-        await Promise.all([...this.inboundOperations]);
-        await Promise.all([...this.reserveOperations]);
-        for (const attempt of [...this.activeAttempts.values()]) {
-            const result = await this.store.settleAttemptForShutdown({
-                messageId: attempt.messageId,
-                attemptId: attempt.attemptId,
-            });
-            if (result.status === "settled")
-                await this.finishSettlement(result.settlement);
-            else if (result.status === "requeued")
-                this.activeAttempts.delete(attempt.messageId);
-        }
-        // Native receipt capabilities are memory-only. Any exact message returned
-        // to queued by the shutdown reducer must terminalize before its helper is
-        // closed; ordinary queued mail without a live receipt remains restartable.
-        for (const messageId of [...this.nativeReceipts.keys()]) {
-            const result = await this.store.settleQueuedMessageForShutdown({ messageId });
-            if (result.status === "settled")
-                await this.finishSettlement(result.settlement);
-        }
-        const control = this.control;
-        this.control = undefined;
-        const failures = [];
-        if (control !== undefined)
-            await control.close().catch((error) => failures.push(error));
-        for (const peer of this.peerClients.values())
-            peer.close();
-        this.peerClients.clear();
-        await Promise.all([...this.peerRefreshOperations]).catch((error) => failures.push(error));
-        this.peerCatalogs.clear();
-        this.peerRouteViews.clear();
-        // Provider close aborts exact owned operations. It must never join a turn.
-        await Promise.all(this.adapters.map(async (adapter) => {
-            await adapter.close().catch((error) => failures.push(error));
-        }));
-        this.activeAttempts.clear();
-        this.dispatchRunners.clear();
-        this.steerRunners.clear();
-        await this.store.close().catch((error) => failures.push(error));
-        if (failures.length > 0) {
-            throw new BridgeError("GATEWAY_CLEANUP_FAILED", "Gateway cleanup could not be confirmed.");
-        }
-    }
-    handlers() {
-        const decide = async (operation, peerPrincipal = false) => {
-            try {
-                this.assertWritable();
-                await operation();
-                this.revision += 1;
-                return { accepted: true, code: "ok" };
-            }
-            catch (error) {
-                return decisionFor(error, peerPrincipal);
-            }
-        };
-        return {
-            health: () => ({ status: this.health(), revision: this.revision }),
-            registerCodex: (params) => decide(async () => this.registerCodex(params)),
-            registerPeer: async (params) => {
-                try {
-                    this.assertWritable();
-                    const token = await this.registerPeer(params);
-                    this.revision += 1;
-                    return token === undefined ? { accepted: true, code: "ok" } : { accepted: true, code: "ok", token };
-                }
-                catch (error) {
-                    return decisionFor(error, true);
-                }
-            },
-            unregisterPeer: (params) => decide(async () => this.unregisterPeer(params), true),
-            awaitPeer: (params) => this.awaitPeer(params),
-            peerReceipt: (params) => decide(async () => this.peerReceipt(params), true),
-            unregisterCodex: (params) => decide(async () => this.unregisterCodex(params)),
-            listSnapshot: () => this.snapshot(),
-            observeSnapshot: () => this.observeSnapshot(),
-            deliveryStatus: (params) => this.deliveryStatus(params.token),
-            send: (params) => this.send(params),
-            refreshDiscovery: async () => {
-                if (this.closing) {
-                    return { accepted: false, code: "unavailable", revision: this.revision };
-                }
-                try {
-                    // An operator-triggered rescan reports its own failure. It must never
-                    // journal `discovery_refreshed` for a scan that did not complete, and
-                    // must never answer `accepted: true` for a provider that is down.
-                    await this.refreshClaudeDiscovery();
-                    await this.recordActivity("discovery", "discovery_refreshed", [], true);
-                }
-                catch (error) {
-                    return { accepted: false, code: decisionFor(error).code, revision: this.revision };
-                }
-                return { accepted: true, code: "ok", revision: this.revision };
-            },
-            peerCatalog: ({ peerHost }) => this.buildPeerCatalog(peerHost),
-            peerHandoff: ({ peerHost, handoff }) => this.receivePeerHandoff(peerHost, handoff),
-        };
-    }
-    async buildPeerCatalog(peerHost) {
-        const localHost = this.config.hostId;
-        if (!this.config.peerNodes.includes(peerHost))
-            throw new BridgeError("PEER_NOT_CONFIGURED", "The requested peer host is not configured.");
-        const [snapshot, privateRoutes] = await Promise.all([
-            this.snapshot(), this.store.inspectPrivateRoutes(),
-        ]);
-        // An ephemeral registration is never published: a peer node that mirrored
-        // one would hold a route this broker will delete on a timer and can never
-        // restore, and a self-test must not leave a trace on another machine.
-        const localRoutes = privateRoutes.filter((route) => route.registrationMode !== "federated_peer" &&
-            route.binding.hostId === localHost && !this.store.isEphemeralRegistration(route.binding.registrationId));
-        const publicRoutes = new Map(snapshot.routes.map((route) => [route.alias, route]));
-        const routes = localRoutes.map((route) => {
-            const row = publicRoutes.get(route.alias);
-            return {
-                ref: peerRouteRef(localHost, route.binding.registrationId), alias: route.alias, provider: route.binding.provider, host: localHost,
-                enabled: route.enabled, state: row?.state ?? (route.enabled ? "stale" : "disabled"),
-                queueDepth: row?.queueDepth ?? 0, ...(row?.lastSeenAt === undefined ? {} : { lastSeenAt: row.lastSeenAt }),
-                ...(row?.safeErrorCode === undefined ? {} : { safeErrorCode: row.safeErrorCode }),
-            };
-        });
-        return { revision: this.revision, complete: true, truncated: false, generatedAt: snapshot.generatedAt,
-            health: snapshot.health, connectors: snapshot.connectors.filter((row) => row.host === localHost).map((row) => ({
-                provider: row.provider, host: row.host, health: row.health, protocol: row.protocol, protocolVersion: row.protocolVersion,
-                ...(row.lastSeenAt === undefined ? {} : { lastSeenAt: row.lastSeenAt }),
-                ...(row.observationAgeMs === undefined ? {} : { observationAgeMs: row.observationAgeMs }),
-                ...(row.safeErrorCode === undefined ? {} : { safeErrorCode: row.safeErrorCode }),
-            })), routes, alerts: snapshot.alerts.filter((alert) => (alert.host === undefined || alert.host === localHost) && (alert.alias === undefined || aliasHost(alert.alias) === localHost)), };
-    }
-    async receivePeerHandoff(peerHost, handoff) {
-        if (!this.config.peerNodes.includes(peerHost))
-            throw new BridgeError("PEER_NOT_CONFIGURED", "The sending peer host is not configured.");
-        const enqueued = await this.store.enqueuePeerHandoff(peerHost, handoff);
-        if (enqueued.messageId !== undefined) {
-            const source = await this.store.inspectPrivateRoute(handoff.source.alias);
-            const target = await this.store.inspectPrivateRoute(handoff.target.alias);
-            if (source === undefined || target === undefined)
-                throw new BridgeError("ROUTE_UNREGISTERED", "The committed peer handoff endpoint is no longer current.");
-            const conversationId = conversationIdForSuffix(handoff.conversationCorrelation);
-            this.rememberConversation({ id: conversationId, sourceAlias: source.alias, targetAlias: target.alias,
-                sourceBinding: source.binding, targetBinding: target.binding, expectsReply: handoff.expectsReply,
-                nextSequence: 1 });
-            this.messageContexts.set(enqueued.messageId, { conversationId, expectsReply: handoff.expectsReply });
-            this.kick(target.alias, target.binding.registrationId);
-        }
-        this.revision += 1;
-        return { accepted: true };
-    }
-    async snapshot() {
-        const base = await this.store.publicSnapshot();
-        const now = this.now();
-        const routes = base.routes.map((route) => {
-            const peer = this.peerRouteViews.get(route.alias);
-            if (peer !== undefined) {
-                const age = now.getTime() - Date.parse(peer.observedAt);
-                return { ...route, state: peer.state === "unobserved" || age > CONNECTOR_OBSERVATION_STALE_AFTER_MS ? "stale" : peer.state,
-                    lastSeenAt: peer.observedAt, ...(peer.safeErrorCode === undefined ? {} : { safeErrorCode: peer.safeErrorCode }) };
-            }
-            const persisted = this.routeObservations.get(route.alias);
-            if (persisted === undefined)
-                return route;
-            const current = this.routeObservationStillCurrent(persisted);
-            if (!current)
-                return route;
-            const age = now.getTime() - Date.parse(persisted.observedAt);
-            const state = persisted.state === "unobserved" ||
-                age > CONNECTOR_OBSERVATION_STALE_AFTER_MS ? "stale" : persisted.state;
-            return {
-                ...route,
-                state,
-                lastSeenAt: persisted.observedAt,
-                ...(persisted.safeErrorCode === undefined ? {} : { safeErrorCode: persisted.safeErrorCode }),
-            };
-        });
-        const connectors = [...this.connectors.values()].map((runtime) => {
-            const observedAt = runtime.observedAt;
-            const age = observedAt === undefined ? undefined : Math.max(0, now.getTime() - Date.parse(observedAt));
-            const stale = runtime.health === "healthy" &&
-                (age === undefined || age > CONNECTOR_OBSERVATION_STALE_AFTER_MS);
-            const socketHeld = runtime.adapter.identity.provider === "codex" && this.managedCodexSocketHeldOutside;
-            const connectorCode = stale ? "CONNECTOR_OBSERVATION_STALE" : runtime.safeErrorCode ??
-                (socketHeld ? "MANAGED_CODEX_UNAVAILABLE" : undefined);
-            return {
-                provider: runtime.adapter.identity.provider,
-                host: runtime.adapter.identity.hostId,
-                health: stale || socketHeld ? "degraded" : runtime.health,
-                protocol: runtime.adapter.protocol,
-                protocolVersion: runtime.adapter.protocolVersion,
-                ...(observedAt === undefined ? {} : { lastSeenAt: observedAt }),
-                ...(age === undefined ? {} : { observationAgeMs: age }),
-                ...(runtime.registry === undefined ? {} : { registry: runtime.registry }),
-                ...(connectorCode === undefined ? {} : { safeErrorCode: connectorCode }),
-            };
-        });
-        const availablePeers = [...this.candidates.values()]
-            .filter((candidate) => !this.collidingClaudeAliases.has(candidate.alias))
-            .slice(0, gatewayPublicSnapshotLimits.availablePeers)
-            .map((candidate) => ({
-            alias: candidate.alias,
-            provider: "claude",
-            host: candidate.adapter.identity.hostId,
-            state: candidate.state,
-            validated: true,
-            routed: routes.some((route) => route.provider === "claude" && route.alias === candidate.alias),
-            lastSeenAt: candidate.observedAt,
-        }));
-        return projectGatewayPublicSnapshot({
-            ...base,
-            generatedAt: now.toISOString(),
-            health: connectors.some((connector) => connector.health === "degraded")
-                ? "degraded"
-                : connectors.length === 0
-                    ? "offline"
-                    : "healthy",
-            connectors,
-            availablePeers,
-            routes,
-            alerts: [...base.alerts, ...this.runtimeAlerts].slice(-gatewayPublicSnapshotLimits.alerts),
-            truncation: base.truncation,
-        }, GATEWAY_PUBLIC_SNAPSHOT_BYTE_BUDGET);
-    }
-    async observeSnapshot() {
-        const snapshot = await this.snapshot();
-        const fingerprint = JSON.stringify({ ...snapshot, generatedAt: "" });
-        if (this.snapshotFingerprint !== undefined && fingerprint !== this.snapshotFingerprint) {
-            this.snapshotRevision += 1;
-        }
-        this.snapshotFingerprint = fingerprint;
-        return { snapshotRevision: this.snapshotRevision, snapshot };
-    }
-    health() {
-        return this.connectors.size > 0 &&
-            [...this.connectors.values()].every((runtime) => runtime.health === "healthy") ? "ok" : "degraded";
-    }
-    async installOwnedRoute(adapter, owned) {
-        const prefix = gatewayRegistrationIngressPrefixes[adapter.identity.provider];
-        if (!PUBLIC_ALIAS.test(owned.alias) ||
-            !owned.alias.endsWith(`@${adapter.identity.hostId}`) ||
-            (prefix !== undefined && !owned.alias.startsWith(prefix)) ||
-            !PRIVATE_HANDLE.test(owned.routeHandle)) {
-            throw new BridgeError("GATEWAY_OWNED_ROUTE_INVALID", "The configured route identity is invalid.");
-        }
-        const existing = await this.store.inspectPrivateRoute(owned.alias);
-        if (existing !== undefined) {
-            if (existing.binding.provider !== adapter.identity.provider ||
-                existing.binding.hostId !== adapter.identity.hostId ||
-                existing.binding.routeHandle !== owned.routeHandle) {
-                throw new BridgeError("ROUTE_ALIAS_ALREADY_REGISTERED", "The configured route conflicts with durable state.");
-            }
-            return;
-        }
-        await this.store.registerRoute({
-            alias: owned.alias,
-            binding: { ...adapter.identity, routeHandle: owned.routeHandle, registrationId: registrationId() },
-            registrationMode: "explicit_opt_in",
-        });
-    }
-    async observeLoadedRoutes() {
-        for (const route of await this.store.listLogicalRoutes()) {
-            if (route.registrationMode === "federated_peer")
-                this.peerRouteViews.set(route.alias, { route: route.binding,
-                    state: "unobserved", observedAt: this.now().toISOString(), safeErrorCode: "PEER_TUNNEL_UNAVAILABLE" });
-            this.observeRoute(route);
-            if (route.binding.provider !== "claude") {
-                this.reconcileAdvertisement(route);
-            }
-        }
-    }
-    observeRoute(route) {
-        const adapter = this.adapterFor(route.binding);
-        try {
-            adapter?.observeLogicalRoute?.({
-                alias: route.alias,
-                routeHandle: route.binding.routeHandle,
-                registrationId: route.binding.registrationId,
-            });
-        }
-        catch {
-            this.alert("ROUTE_OBSERVATION_FAILED", route);
-        }
-    }
-    forgetRoute(route) {
-        try {
-            this.adapterFor(route.binding)?.forgetLogicalRoute?.(route.binding.registrationId);
-        }
-        catch {
-            this.alert("ROUTE_OBSERVATION_FAILED", route);
-        }
-        this.routeObservations.delete(route.alias);
-    }
-    adapterFor(binding) {
-        return this.connectors.get(connectorKey(binding))?.adapter ??
-            this.adapters.find((adapter) => adapter.identity.provider === binding.provider && adapter.identity.hostId === binding.hostId);
-    }
-    claudeAdapter(hostId) {
-        return this.adapterFor({ provider: "claude", hostId });
-    }
-    async advertise(route) {
-        const hostId = route.registrationMode === "federated_peer"
-            ? this.config.hostId : route.binding.hostId;
-        await this.claudeAdapter(hostId)?.advertiseNativeSourcePeer?.({
-            alias: route.alias,
-            sourceProvider: route.binding.provider,
-            cwd: this.nativePeerCwd,
-        });
-    }
-    async unadvertise(route) {
-        const hostId = route.registrationMode === "federated_peer"
-            ? this.config.hostId : route.binding.hostId;
-        await this.claudeAdapter(hostId)?.unadvertiseNativeSourcePeer?.(route.alias);
-    }
-    reconcileAdvertisement(route) {
-        void this.advertise(route).catch((error) => this.alert("NATIVE_ADVERTISEMENT_FAILED", route, error));
-    }
-    async reconcileUnadvertisement(route) {
-        await this.unadvertise(route).catch((error) => this.alert("NATIVE_UNADVERTISEMENT_FAILED", route, error));
-    }
-    async removeOwnedRoute(route) {
-        this.assertWritable();
-        const result = await this.store.removeOwnedRouteAtomic({
-            alias: route.alias,
-            binding: route.binding,
-            activity: { operatorAction: true },
-        });
-        if (!result.removed)
-            throw new BridgeError("CODEX_REGISTRATION_NOT_FOUND", "The exact route is absent.");
-        await this.finishSettlements(result.settlements);
-        this.forgetRoute(route);
-        await this.reconcileUnadvertisement(route);
-    }
-    async recordActivity(kind, action, aliases, operatorAction) {
-        await this.store.recordActivity({
-            kind,
-            action,
-            outcome: "accepted",
-            aliases,
-            operatorAction,
-        });
-    }
-    async registerCodex(params) {
-        const existing = await this.store.inspectPrivateRoute(params.alias);
-        if (existing !== undefined && params.succeedsAlias === undefined) {
-            if (existing.binding.provider !== "codex" || existing.binding.routeHandle !== params.threadId) {
-                throw new BridgeError("ROUTE_ALIAS_ALREADY_REGISTERED", "The alias belongs to another registration.");
-            }
-            this.observeRoute(existing);
-            this.reconcileAdvertisement(existing);
-            return;
-        }
-        const replacement = {
-            alias: params.alias,
-            binding: {
-                provider: "codex",
-                hostId: params.hostId,
-                routeHandle: params.threadId,
-                registrationId: registrationId(),
-            },
-            registrationMode: "explicit_opt_in",
-        };
-        if (params.succeedsAlias === undefined) {
-            this.assertWritable();
-            await this.store.registerRoute(replacement);
-            const installed = (await this.store.inspectPrivateRoute(params.alias));
-            await this.recordActivity("registration", "codex_registered", [installed.alias], true);
-            this.observeRoute(installed);
-            this.reconcileAdvertisement(installed);
-            this.kick(params.alias);
-            return;
-        }
-        const previous = await this.store.inspectPrivateRoute(params.succeedsAlias);
-        if (previous === undefined) {
-            const installed = await this.store.inspectPrivateRoute(params.alias);
-            if (installed !== undefined &&
-                installed.binding.provider === "codex" &&
-                installed.binding.routeHandle === params.threadId) {
-                this.observeRoute(installed);
-                this.reconcileAdvertisement(installed);
-                return;
-            }
-            throw new BridgeError("CODEX_SUCCESSION_OWNER_MISMATCH", "The succeeded registration is absent.");
-        }
-        this.assertWritable();
-        const result = await this.store.replaceCodexRegistrationAtomic({
-            oldAlias: params.succeedsAlias,
-            expectedOldRegistrationId: previous.binding.registrationId,
-            replacement,
-            activity: { operatorAction: true },
-        });
-        await this.finishSettlements(result.settlements);
-        if (!result.idempotent) {
-            this.forgetRoute(previous);
-            this.reconcileUnadvertisement(previous);
-        }
-        const installed = (await this.store.inspectPrivateRoute(params.alias));
-        this.observeRoute(installed);
-        this.reconcileAdvertisement(installed);
-        this.kick(params.alias);
-    }
-    async registerPeer(params) {
-        if (this.peerCleanupAliases.has(params.alias)) {
-            throw new BridgeError("ROUTE_BUSY", "The route is still completing cleanup.", true);
-        }
-        const existing = await this.store.inspectPrivateRoute(params.alias);
-        if (existing !== undefined) {
-            if (params.token === undefined)
-                throw new BridgeError("ROUTE_UNREGISTERED", "The route binding does not match.");
-            await this.assertPeer({ alias: params.alias, token: params.token });
-            this.observeRoute(existing);
-            this.reconcileAdvertisement(existing);
-            this.kick(existing.alias, existing.binding.registrationId);
-            return undefined;
-        }
-        if (params.token !== undefined || !params.alias.endsWith(`@${this.config.hostId}`)) {
-            throw new BridgeError("ROUTE_UNREGISTERED", "The route binding does not match.");
-        }
-        const token = `peer_${randomBytes(24).toString("base64url")}`;
-        await this.store.registerRoute({ alias: params.alias, binding: {
-                provider: "peer", hostId: this.config.hostId,
-                routeHandle: peerHandle(process.getuid(), params.alias, token), registrationId: registrationId(),
-            }, registrationMode: "explicit_opt_in",
-            ...(params.ephemeral === true ? { ephemeral: true } : {}) });
-        const installed = (await this.store.inspectPrivateRoute(params.alias));
-        if (params.ephemeral === true) {
-            this.ephemeralPeerExpiries.set(installed.alias, this.now().getTime() + (params.ttlMs ?? GATEWAY_EPHEMERAL_PEER_TTL_DEFAULT_MS));
-            this.scheduleWake();
-        }
-        this.observeRoute(installed);
-        this.reconcileAdvertisement(installed);
-        return token;
-    }
-    async assertPeer(params) {
-        const route = await this.store.inspectPrivateRoute(params.alias);
-        const expected = Buffer.from(peerHandle(process.getuid(), params.alias, params.token));
-        const actualHandle = route?.binding.provider === "peer" && /^peer:[0-9a-f]{64}$/.test(route.binding.routeHandle)
-            ? route.binding.routeHandle : `peer:${"0".repeat(64)}`;
-        const matches = timingSafeEqual(Buffer.from(actualHandle), expected);
-        if (!PEER_TOKEN.test(params.token) || route?.binding.provider !== "peer" || !matches) {
-            throw new BridgeError("ROUTE_UNREGISTERED", "The route binding does not match.");
-        }
-        return route;
-    }
-    async unregisterPeer(params) {
-        const route = await this.assertPeer(params);
-        if (this.peerCleanupAliases.has(route.alias))
-            throw new BridgeError("ROUTE_BUSY", "The route is still completing cleanup.", true);
-        this.peerCleanupAliases.add(route.alias);
-        // The expiry leaves the map before the removal, under the same cleanup
-        // guard, so a clock that fires mid-removal has nothing to act on; a
-        // removal that does not happen puts it back, so a refused unregister
-        // still leaves the registration to its own expiry.
-        const expiry = this.ephemeralPeerExpiries.get(route.alias);
-        this.ephemeralPeerExpiries.delete(route.alias);
-        this.ephemeralExpiryFailures.delete(route.alias);
-        let removed = false;
-        try {
-            const result = await this.store.removeOwnedRouteAtomic({ alias: route.alias, binding: route.binding });
-            if (!result.removed)
-                throw new BridgeError("ROUTE_UNREGISTERED", "The route binding does not match.");
-            removed = true;
-            await this.finishSettlements(result.settlements);
-            this.forgetRoute(route);
-            await this.reconcileUnadvertisement(route);
-        }
-        finally {
-            if (!removed && expiry !== undefined)
-                this.ephemeralPeerExpiries.set(route.alias, expiry);
-            this.peerCleanupAliases.delete(route.alias);
-        }
-    }
-    /**
-     * Retires every ephemeral peer registration whose lifetime has run out. It
-     * is the same removal an explicit `unregister-peer` performs — queued work
-     * is settled, not abandoned — minus the token check, because the authority
-     * here is the clock the broker set itself.
-     *
-     * The clock is keyed by alias, and an alias can be re-registered durably
-     * after its ephemeral holder left, so nothing is retired unless the route
-     * behind the alias is still an ephemeral one. A retirement that throws
-     * keeps its entry and is retried `EPHEMERAL_EXPIRY_RETRY_MS` later, with an
-     * alert each time; after `EPHEMERAL_EXPIRY_MAX_ATTEMPTS` consecutive
-     * failures the entry is dropped and the registration is left to the next
-     * restart, which clears it by construction.
-     */
-    async expireEphemeralPeers(now) {
-        for (const [alias, expiresAt] of [...this.ephemeralPeerExpiries]) {
-            if (expiresAt > now)
-                continue;
-            // Another owner is mid-removal; the entry is theirs to clear or restore.
-            if (this.peerCleanupAliases.has(alias))
-                continue;
-            const route = await this.store.inspectPrivateRoute(alias);
-            if (route === undefined || !this.store.isEphemeralRegistration(route.binding.registrationId)) {
-                this.ephemeralPeerExpiries.delete(alias);
-                this.ephemeralExpiryFailures.delete(alias);
-                continue;
-            }
-            this.peerCleanupAliases.add(alias);
-            try {
-                const result = await this.store.removeOwnedRouteAtomic({ alias, binding: route.binding });
-                if (result.removed) {
-                    await this.finishSettlements(result.settlements);
-                    this.forgetRoute(route);
-                    await this.reconcileUnadvertisement(route);
-                }
-                // Not removed means the binding changed underneath: the alias belongs
-                // to someone else now, and this clock is spent either way.
-                this.ephemeralPeerExpiries.delete(alias);
-                this.ephemeralExpiryFailures.delete(alias);
-            }
-            catch (error) {
-                this.alert("EPHEMERAL_ROUTE_EXPIRY_FAILED", route, error);
-                const attempts = (this.ephemeralExpiryFailures.get(alias) ?? 0) + 1;
-                if (attempts >= EPHEMERAL_EXPIRY_MAX_ATTEMPTS) {
-                    this.ephemeralPeerExpiries.delete(alias);
-                    this.ephemeralExpiryFailures.delete(alias);
-                }
-                else {
-                    this.ephemeralExpiryFailures.set(alias, attempts);
-                    this.ephemeralPeerExpiries.set(alias, now + EPHEMERAL_EXPIRY_RETRY_MS);
-                }
-            }
-            finally {
-                this.peerCleanupAliases.delete(alias);
-            }
-        }
-    }
-    async awaitPeer(params) {
-        this.assertWritable();
-        const route = await this.assertPeer(params);
-        const adapter = this.adapterFor(route.binding);
-        if (adapter?.awaitMessage === undefined)
-            throw new BridgeError("PROVIDER_UNAVAILABLE", "The provider is unavailable.", true);
-        const pending = adapter.awaitMessage({ alias: route.alias, ...route.binding });
-        this.kick(route.alias, route.binding.registrationId);
-        return await pending;
-    }
-    async peerReceipt(params) {
-        const route = await this.assertPeer(params);
-        const adapter = this.adapterFor(route.binding);
-        if (adapter?.acknowledgeReceipt({ alias: route.alias, ...route.binding, receipt: params.receipt }) === "rejected") {
-            throw new BridgeError("ROUTE_UNREGISTERED", "The route binding does not match.");
-        }
-    }
-    async unregisterCodex(params) {
-        const route = await this.store.inspectPrivateRoute(params.alias);
-        if (route === undefined ||
-            route.binding.provider !== "codex" ||
-            route.binding.routeHandle !== params.threadId) {
-            throw new BridgeError("CODEX_REGISTRATION_NOT_FOUND", "The exact Codex registration is absent.");
-        }
-        if (route.registrationMode === "federated_peer") {
-            throw new BridgeError("FEDERATED_ROUTE_READ_ONLY", "A federated route is owned by its peer node and cannot be unregistered here.");
-        }
-        await this.removeOwnedRoute(route);
-    }
-    /**
-     * The name this session may take. A name belongs to one route at a time, so
-     * when another Claude route already holds it and THAT route's session is
-     * still live, this session takes a disambiguated name rather than displacing
-     * a working session and cancelling its queued work. Twins that share a
-     * display name therefore both keep routes and both stay reachable by UUID;
-     * only a route whose session is actually gone is displaced.
-     */
-    claimableAlias(candidate, routes) {
-        const holder = routes.find((route) => route.alias === candidate.alias &&
-            route.binding.provider === "claude" &&
-            !(route.binding.hostId === candidate.adapter.identity.hostId &&
-                route.binding.routeHandle === candidate.routeHandle));
-        if (holder === undefined)
-            return candidate.alias;
-        const holderIsLive = [...this.candidates.values()].some((row) => row.adapter.identity.hostId === holder.binding.hostId &&
-            row.routeHandle === holder.binding.routeHandle);
-        return holderIsLive
-            ? disambiguatedAlias(candidate.alias, candidate.routeHandle)
-            : candidate.alias;
-    }
-    /**
-     * Installs (or brings up to date) the route of one discovered Claude
-     * session. The adapter pins the session's route handle, the workspace
-     * check keeps deliberately broad workspaces out, and the store reuses the
-     * registration of a session already bound under the same (host, UUID) so a
-     * re-anchored or renamed session keeps its identity and in-flight
-     * conversations. Any Claude route the install displaced is forgotten and
-     * released at the adapter; its work was settled `ENDPOINT_RETIRED` by the
-     * store — and only a route whose own session is gone is ever displaced.
-     */
-    async installClaudeRoute(candidate) {
-        const adapter = candidate.adapter;
-        if (adapter.selectRoute === undefined) {
-            throw new BridgeError("CLAUDE_PROVIDER_UNAVAILABLE", "The Claude provider cannot install routes.");
-        }
-        await adapter.assertWorkspaceDisjoint?.(candidate.routeHandle, this.store.rootDir);
-        const chosen = await adapter.selectRoute({ alias: candidate.alias, routeHandle: candidate.routeHandle });
-        this.assertWritable();
-        const before = (await this.store.listLogicalRoutes()).filter((route) => route.binding.provider === "claude");
-        const alias = this.claimableAlias(candidate, before);
-        const existing = before.find((route) => route.binding.hostId === adapter.identity.hostId &&
-            route.binding.routeHandle === chosen.routeHandle);
-        const input = {
-            alias,
-            binding: {
-                provider: "claude",
-                hostId: adapter.identity.hostId,
-                routeHandle: chosen.routeHandle,
-                registrationId: existing?.binding.registrationId ?? registrationId(),
-            },
-            registrationMode: "selected_live_peer",
-        };
-        const result = await this.installWithConcurrentFirstSend(input, adapter.identity.hostId, chosen.routeHandle);
-        await this.finishSettlements(result.settlements);
-        const after = (await this.store.listLogicalRoutes()).filter((route) => route.binding.provider === "claude");
-        for (const prior of before) {
-            const retained = after.find((route) => route.binding.registrationId === prior.binding.registrationId);
-            if (retained === undefined) {
-                // Displaced: the alias now names another session.
-                this.forgetRoute(prior);
-                void this.adapterFor(prior.binding)?.releaseRoute?.(prior.binding.routeHandle)
-                    .catch((error) => this.alert("ROUTE_RELEASE_FAILED", prior, error));
-            }
-            else if (retained.alias !== prior.alias) {
-                // Renamed: identity kept, the stale display-only observation goes and
-                // open conversations follow the session to its new name.
-                this.routeObservations.delete(prior.alias);
-                this.renameConversationCoordinates(prior.alias, retained.alias, prior.binding.registrationId);
-            }
-        }
-        const installed = (await this.store.inspectPrivateRoute(alias));
-        this.observeRoute(installed);
-        this.routeObservations.set(alias, {
-            route: installed.binding,
-            state: chosen.state,
-            observedAt: this.now().toISOString(),
-        });
-        if (result.installed)
-            this.revision += 1;
-        this.kick(alias);
-        return installed;
-    }
-    /**
-     * Two first sends to the same never-installed session race: both read no
-     * route and both mint a registration, and the loser's write is refused
-     * because the identity is now bound. That is a race, not a conflict — the
-     * session is exactly the one the loser resolved — so re-read once and adopt
-     * the registration that won instead of failing an honest send.
-     */
-    async installWithConcurrentFirstSend(input, hostId, routeHandle) {
-        try {
-            return await this.store.installClaudeRoute(input);
-        }
-        catch (error) {
-            if (!(error instanceof BridgeError) || error.code !== "ROUTE_IDENTITY_ALREADY_REGISTERED")
-                throw error;
-            const bound = (await this.store.listLogicalRoutes()).find((route) => route.binding.provider === "claude" &&
-                route.binding.hostId === hostId &&
-                route.binding.routeHandle === routeHandle);
-            if (bound === undefined)
-                throw error;
-            return await this.store.installClaudeRoute({
-                ...input,
-                binding: { ...input.binding, registrationId: bound.binding.registrationId },
-            });
-        }
-    }
-    /**
-     * Looks a Claude selector up without writing anything. Callers that may
-     * still refuse — a `--from` alias that must match the sending session, a
-     * native sender whose adapter-reported name must match discovery — resolve
-     * here first, refuse on the read, and only then materialize.
-     *
-     * THE ALIAS-COLLISION FENCE lives here (emb-94, moved into the send path by
-     * emb-104). Invariant: discovery is refreshed inside every send that
-     * addresses a Claude session, never only on the timer; a NAME currently
-     * shared by more than one live session is refused with a hard,
-     * non-retryable `PEER_ALIAS_COLLISION` naming that alias, so the broker
-     * never picks first and never installs a route under an ambiguous name;
-     * collisions stay sticky while a scan is incomplete
-     * (`collidingClaudeAliases` retention in refreshClaudeDiscovery); and
-     * `availablePeers` keeps filtering colliders so `status` never lists an
-     * unaddressable name.
-     *
-     * The fence is a fence on NAMES, not on sessions. A session UUID is
-     * unambiguous by construction, so a UUID selector — an explicit
-     * `send --to <uuid>`, an identity-pinned route addressed by its own handle,
-     * or a sender resolved from its inherited socket — passes the fence even
-     * while its display name collides. That is the emb-94 escape hatch: the
-     * operator can always reach an ambiguously named session, and a collision on
-     * a *sender's* name never silences that sender, whose identity was attested
-     * rather than typed. In-flight conversations are likewise unaffected:
-     * `reply` resolves by exact binding.
-     */
-    async lookUpClaudeRoute(selector, hostId) {
-        await this.refreshClaudeDiscovery().catch(() => undefined);
-        if (PUBLIC_ALIAS.test(selector) && this.collidingClaudeAliases.has(selector)) {
-            throw new BridgeError("PEER_ALIAS_COLLISION", `The Claude alias ${selector} names more than one live session; rename one, or address the session by UUID.`);
-        }
-        const routed = (await this.store.listLogicalRoutes()).find((route) => route.binding.provider === "claude" &&
-            (hostId === undefined || route.binding.hostId === hostId) &&
-            (route.alias === selector || route.binding.routeHandle === selector));
-        const candidate = [...this.candidates.values()].find((row) => (hostId === undefined || row.adapter.identity.hostId === hostId) &&
-            (row.routeHandle === selector || row.alias === selector));
-        return { routed, candidate };
-    }
-    /**
-     * The name discovery currently shows for a looked-up session, which a caller
-     * compares against the alias it claimed before anything is written.
-     */
-    claimedAlias(resolution) {
-        const alias = resolution.candidate?.alias ?? resolution.routed?.alias;
-        if (alias === undefined) {
-            throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "No live Claude session matches that name or UUID; run `embassy refresh` and check `embassy status`.");
-        }
-        return alias;
-    }
-    /** Installs the looked-up session's route if it is not already current. */
-    async materializeClaudeRoute(resolution) {
-        const { routed, candidate } = resolution;
-        if (candidate === undefined) {
-            if (routed !== undefined)
-                return routed;
-            throw new BridgeError("CLAUDE_ROUTE_NOT_FOUND", "No live Claude session matches that name or UUID; run `embassy refresh` and check `embassy status`.");
-        }
-        if (routed !== undefined &&
-            routed.binding.hostId === candidate.adapter.identity.hostId &&
-            routed.binding.routeHandle === candidate.routeHandle &&
-            routed.alias === this.claimableAlias(candidate, await this.store.listLogicalRoutes()))
-            return routed;
-        return await this.installClaudeRoute(candidate);
-    }
-    async resolveClaudeRoute(selector, hostId) {
-        return await this.materializeClaudeRoute(await this.lookUpClaudeRoute(selector, hostId));
-    }
-    async assertThread(alias, threadId) {
-        const route = await this.store.inspectPrivateRoute(alias);
-        // No registration at all is its own condition — the state every Codex
-        // task is in after a private state reset — and is never dressed up as a
-        // thread mismatch, which would send the operator hunting a wrong id.
-        if (route === undefined)
-            throw new BridgeError("ROUTE_UNREGISTERED", "The route is not registered.");
-        if (route.binding.provider !== "codex" || route.binding.routeHandle !== threadId) {
-            throw new BridgeError("CODEX_THREAD_MISMATCH", "The task attestation does not match the route.");
-        }
-        return route;
-    }
-    /**
-     * Direction follows the inherited principal, not the route table: a Claude
-     * session or its target may have no route yet, because routes install on
-     * first send. A Codex task sends to Claude sessions and shell peers; a
-     * Claude session sends to Codex tasks and shell peers (Claude-to-Claude is
-     * native); a shell peer sends to either.
-     */
-    async send(params) {
-        if (params.conversationId !== undefined)
-            return await this.replyToConversation(params);
-        const target = await this.store.inspectPrivateRoute(params.toAlias);
-        if ("replyAddress" in params && params.replyAddress !== undefined) {
-            // A UUID names a Claude session as surely as a name does: recognize it
-            // here, or a Claude-to-Claude send addressed by UUID falls through to the
-            // Codex path and is answered as an unknown target.
-            const claudeTarget = target?.binding.provider === "claude" ||
-                (target === undefined && [...this.candidates.values()].some((row) => row.alias === params.toAlias || row.routeHandle === params.toAlias));
-            return claudeTarget ? { accepted: false, code: "route_mismatch" } : this.sendToCodex(params);
-        }
-        if ("threadId" in params && params.threadId !== undefined) {
-            return target?.binding.provider === "codex" ? { accepted: false, code: "route_mismatch" } : this.sendToClaude(params);
-        }
-        return target === undefined || target.binding.provider === "claude" ? this.sendToClaude(params) : this.sendToCodex(params);
-    }
-    async sendToClaude(params) {
-        try {
-            this.assertWritable();
-            const source = "peerToken" in params && params.peerToken !== undefined
-                ? await this.assertPeer({ alias: params.fromAlias, token: params.peerToken })
-                : params.threadId === undefined
-                    ? undefined
-                    : await this.assertThread(params.fromAlias, params.threadId);
-            if (source === undefined)
-                throw new BridgeError("ROUTE_NOT_AVAILABLE", "The source route is absent.");
-            const direct = await this.store.inspectPrivateRoute(params.toAlias);
-            let target;
-            if (direct?.binding.provider === "peer") {
-                target = direct;
-            }
-            else {
-                const seen = await this.lookUpClaudeRoute(params.toAlias);
-                // Admission before materialization: a send that is already going to be
-                // refused for its own reasons — too large, outside the deadline
-                // window, rate limited, or into a full queue — must not install a
-                // route or displace another session on its way to that refusal.
-                await this.store.assertEnqueueAdmissible({
-                    sourceAlias: params.fromAlias,
-                    targetAlias: this.claimedAlias(seen),
-                    direction: directionId(source.binding.provider, "claude"),
-                    sourceRegistrationId: source.binding.registrationId,
-                    body: params.text,
-                });
-                target = await this.materializeClaudeRoute(seen);
-            }
-            return await this.enqueueConversation({
-                sourceAlias: params.fromAlias,
-                targetAlias: target.alias,
-                text: params.text,
-                expectsReply: params.expectsReply,
-                expectedSourceBinding: source.binding,
-                expectedTargetBinding: target.binding,
-            });
-        }
-        catch (error) {
-            return sendRefusal(error, "peerToken" in params);
-        }
-    }
-    async sendToCodex(params) {
-        try {
-            this.assertWritable();
-            let source;
-            if ("peerToken" in params && params.peerToken !== undefined) {
-                source = await this.assertPeer({ alias: params.fromAlias, token: params.peerToken });
-            }
-            else if (params.replyAddress === undefined) {
-                throw new BridgeError("CLAUDE_REPLY_ADDRESS_INVALID", "The inherited reply capability is required.");
-            }
-            else {
-                // The sending session's identity comes from its inherited socket, never
-                // from --from. Look the session up read-only first: a send that is
-                // about to be refused must not install, rename, or displace a route,
-                // and must not settle another session's queued work.
-                const resolved = await this.claudeAdapter(aliasHost(params.fromAlias))?.resolveReplyAddress?.(params.replyAddress);
-                if (resolved === undefined)
-                    throw new BridgeError("CLAUDE_REPLY_ADDRESS_INVALID", "The reply capability is stale.");
-                const seen = await this.lookUpClaudeRoute(resolved.routeHandle, aliasHost(params.fromAlias));
-                if (this.claimedAlias(seen) !== params.fromAlias) {
-                    throw new BridgeError("CLAUDE_ROUTE_MISMATCH", "The --from alias does not name the sending Claude session.");
-                }
-                source = await this.materializeClaudeRoute(seen);
-            }
-            const target = await this.store.inspectPrivateRoute(params.toAlias);
-            if (source === undefined || target === undefined) {
-                throw new BridgeError("ROUTE_NOT_AVAILABLE", "The selected route is absent.");
-            }
-            if (target.binding.provider !== "codex" && target.binding.provider !== "peer") {
-                throw new BridgeError("ROUTE_NOT_AVAILABLE", "The selected route is absent.");
-            }
-            return await this.enqueueConversation({
-                sourceAlias: params.fromAlias,
-                targetAlias: params.toAlias,
-                text: params.text,
-                expectsReply: params.expectsReply,
-                expectedSourceBinding: source.binding,
-                expectedTargetBinding: target.binding,
-            });
-        }
-        catch (error) {
-            return sendRefusal(error, "peerToken" in params);
-        }
-    }
-    /**
-     * A send addressed by conversation token: the caller must own one end, the
-     * other end is the binding the conversation recorded, and the caller's
-     * principal is the same attested one every send carries.
-     */
-    async replyToConversation(params) {
-        try {
-            this.assertWritable();
-            const conversation = this.conversations.get(params.conversationId);
-            if (conversation === undefined)
-                throw new BridgeError("CONVERSATION_NOT_FOUND", "The conversation is absent.");
-            const caller = replyCaller(params);
-            const callerBinding = await this.assertReplyCaller(conversation, caller);
-            const callerAlias = caller.alias;
-            const targetAlias = callerAlias === conversation.sourceAlias
-                ? conversation.targetAlias
-                : conversation.sourceAlias;
-            const targetBinding = callerAlias === conversation.sourceAlias
-                ? conversation.targetBinding
-                : conversation.sourceBinding;
-            if (targetBinding === undefined) {
-                throw new BridgeError("CONVERSATION_ROUTE_RETIRED", "The conversation endpoint is no longer available.");
-            }
-            // The target's route was installed when it first sent or was first
-            // sent to; a reply never re-resolves it by alias. A retired binding is
-            // a refusal at enqueue, never a silent retarget.
-            return await this.enqueueConversation({
-                sourceAlias: callerAlias,
-                targetAlias,
-                text: params.text,
-                expectsReply: true,
-                expectedSourceBinding: callerBinding,
-                expectedTargetBinding: targetBinding,
-                existingConversation: conversation,
-            });
-        }
-        catch (error) {
-            return sendRefusal(error, params.peerToken !== undefined);
-        }
-    }
-    async assertReplyCaller(conversation, caller) {
-        if (caller.alias !== conversation.sourceAlias && caller.alias !== conversation.targetAlias) {
-            throw new BridgeError("CONVERSATION_CALLER_MISMATCH", "The caller does not own this conversation.");
-        }
-        const expected = caller.alias === conversation.sourceAlias
-            ? conversation.sourceBinding
-            : conversation.targetBinding;
-        const route = await this.store.inspectPrivateRoute(caller.alias);
-        if (expected === undefined || route === undefined || !sameBinding(route.binding, expected)) {
-            throw new BridgeError("CONVERSATION_ROUTE_RETIRED", "The conversation endpoint is no longer available.");
-        }
-        if (caller.kind === "codex" &&
-            (route.binding.provider !== "codex" || route.binding.routeHandle !== caller.threadId)) {
-            throw new BridgeError("CODEX_THREAD_MISMATCH", "The task attestation does not match the conversation.");
-        }
-        if (caller.kind === "claude") {
-            if (route.binding.provider !== "claude") {
-                throw new BridgeError("CLAUDE_REPLY_ADDRESS_INVALID", "The inherited reply capability is required.");
-            }
-            const resolved = await this.claudeAdapter(route.binding.hostId)
-                ?.resolveReplyAddress?.(caller.replyAddress);
-            if (resolved?.routeHandle !== route.binding.routeHandle) {
-                throw new BridgeError("CLAUDE_REPLY_ADDRESS_INVALID", "The reply capability is stale.");
-            }
-        }
-        if (caller.kind === "peer")
-            await this.assertPeer({ alias: caller.alias, token: caller.token });
-        return route.binding;
-    }
-    async enqueueConversation(input) {
-        const target = await this.store.inspectPrivateRoute(input.targetAlias);
-        const source = await this.store.inspectPrivateRoute(input.sourceAlias);
-        const conversationSourceBinding = input.existingConversation === undefined
-            ? undefined
-            : input.sourceAlias === input.existingConversation.sourceAlias
-                ? input.existingConversation.sourceBinding
-                : input.sourceAlias === input.existingConversation.targetAlias
-                    ? input.existingConversation.targetBinding
-                    : undefined;
-        const conversationTargetBinding = input.existingConversation === undefined
-            ? undefined
-            : input.targetAlias === input.existingConversation.sourceAlias
-                ? input.existingConversation.sourceBinding
-                : input.targetAlias === input.existingConversation.targetAlias
-                    ? input.existingConversation.targetBinding
-                    : undefined;
-        const sourceBinding = input.expectedSourceBinding ?? conversationSourceBinding ?? source?.binding;
-        const targetBinding = input.expectedTargetBinding ?? conversationTargetBinding ?? target?.binding;
-        const steer = input.text.startsWith("STEER:") && this.config.steeringEnabled &&
-            sourceBinding?.provider === "claude" && targetBinding?.provider === "codex";
-        if (input.existingConversation === undefined &&
-            this.conversations.size >= MAX_CONVERSATIONS &&
-            [...this.conversations.keys()].every((id) => this.conversationIsActive(id))) {
-            throw new BridgeError("CONVERSATION_CAPACITY_REACHED", "Conversation capacity is full.");
-        }
-        const conversation = input.existingConversation ?? {
-            id: createGatewayConversationId(),
-            sourceAlias: input.sourceAlias,
-            targetAlias: input.targetAlias,
-            ...(sourceBinding === undefined ? {} : { sourceBinding: { ...sourceBinding } }),
-            ...(targetBinding === undefined ? {} : { targetBinding: { ...targetBinding } }),
-            expectsReply: input.expectsReply,
-            nextSequence: 0,
-        };
-        const sequence = conversation.nextSequence++;
-        let enqueued;
-        try {
-            this.assertWritable();
-            enqueued = await this.store.enqueueMessage({
-                sourceAlias: input.sourceAlias,
-                targetAlias: input.targetAlias,
-                body: input.text,
-                dedupeKey: `${conversation.id}:${sequence}`,
-                conversationIdSuffix: conversation.id.slice(-8),
-                ...(sourceBinding === undefined || targetBinding === undefined
-                    ? {}
-                    : {
-                        expectedSourceRegistrationId: sourceBinding.registrationId,
-                        expectedTargetRegistrationId: targetBinding.registrationId,
-                    }),
-                ...(steer ? { steer: true } : {}),
-            });
-        }
-        catch (error) {
-            conversation.nextSequence -= 1;
-            throw error;
-        }
-        if (!enqueued.accepted || enqueued.messageId === undefined || enqueued.deliveryToken === undefined) {
-            conversation.nextSequence -= 1;
-            throw new BridgeError("MESSAGE_NOT_ACCEPTED", "The message was not accepted.");
-        }
-        this.rememberConversation(conversation);
-        this.messageContexts.set(enqueued.messageId, {
-            conversationId: conversation.id,
-            expectsReply: input.expectsReply,
-        });
-        if (enqueued.supersededSettlement !== undefined) {
-            await this.finishSettlement(enqueued.supersededSettlement);
-        }
-        if (steer)
-            this.kickSteer(input.targetAlias);
-        this.kick(input.targetAlias);
-        this.scheduleWake();
-        return {
-            accepted: true,
-            code: "ok",
-            conversationId: conversation.id,
-            deliveryToken: enqueued.deliveryToken,
-        };
-    }
-    /**
-     * A renamed Claude session is the same principal under a new display name,
-     * so its open conversations follow it: the registration, not the alias, is
-     * the identity, and a reply under the current name must still resolve.
-     */
-    renameConversationCoordinates(oldAlias, newAlias, registrationId) {
-        for (const conversation of this.conversations.values()) {
-            if (conversation.sourceAlias === oldAlias &&
-                conversation.sourceBinding?.registrationId === registrationId) {
-                conversation.sourceAlias = newAlias;
-            }
-            if (conversation.targetAlias === oldAlias &&
-                conversation.targetBinding?.registrationId === registrationId) {
-                conversation.targetAlias = newAlias;
-            }
-        }
-    }
-    rememberConversation(conversation) {
-        this.conversations.delete(conversation.id);
-        this.conversations.set(conversation.id, conversation);
-        while (this.conversations.size > MAX_CONVERSATIONS) {
-            const oldest = [...this.conversations.keys()].find((id) => id !== conversation.id && !this.conversationIsActive(id));
-            if (oldest === undefined)
-                break;
-            this.conversations.delete(oldest);
-        }
-    }
-    conversationIsActive(conversationId) {
-        if ([...this.messageContexts.values()].some((row) => row.conversationId === conversationId)) {
-            return true;
-        }
-        return [...this.pendingClaudeReplies.values()].some((rows) => rows.some((row) => row.conversationId === conversationId));
-    }
-    async deliveryStatus(token) {
-        const message = await this.store.deliveryStatus(token);
-        if (message === undefined)
-            return { found: false };
-        const state = message.state.phase === "terminal"
-            ? message.state.outcome === "abandoned"
-                ? "failed"
-                : message.state.outcome
-            : message.state.phase === "queued"
-                ? "queued"
-                : "stalled";
-        return {
-            found: true,
-            state,
-            terminal: message.state.phase === "terminal",
-            updatedAt: this.messageUpdatedAt(message),
-            deadlineAt: message.deadlineAt,
-            ...(message.state.phase === "terminal"
-                ? message.state.safeErrorCode === undefined
-                    ? {}
-                    : { safeErrorCode: message.state.safeErrorCode }
-                : { pendingForMs: Math.max(0, this.now().getTime() - Date.parse(message.enqueuedAt)) }),
-        };
-    }
-    messageUpdatedAt(message) {
-        switch (message.state.phase) {
-            case "queued": return message.enqueuedAt;
-            case "reserved": return message.state.reservedAt;
-            case "armed": return message.state.armedAt;
-            case "accepted": return message.state.acceptedAt;
-            case "terminal": return message.state.terminalAt;
-        }
-    }
-    kick(targetAlias, preferredRegistrationId) {
-        const startingKey = `${targetAlias}\0${preferredRegistrationId ?? "current"}`;
-        if (!this.running || this.closing || this.startingTargets.has(startingKey))
-            return;
-        this.startingTargets.add(startingKey);
-        void this.kickExact(targetAlias, preferredRegistrationId)
-            .catch((error) => this.alert("DISPATCH_RUNNER_FAILED", undefined, error))
-            .finally(() => this.startingTargets.delete(startingKey));
-    }
-    async kickExact(targetAlias, preferredRegistrationId) {
-        if (!this.running || this.closing)
-            return;
-        const route = await this.store.inspectPrivateRoute(targetAlias);
-        const registration = preferredRegistrationId ?? route?.binding.registrationId;
-        if (registration === undefined)
-            return;
-        this.startRunner(targetAlias, registration, "any");
-    }
-    kickSteer(targetAlias) {
-        if (!this.running || this.closing)
-            return;
-        void this.store.inspectPrivateRoute(targetAlias).then((route) => {
-            if (route === undefined || route.binding.provider !== "codex")
-                return;
-            this.startRunner(targetAlias, route.binding.registrationId, "steer_only", route);
-        }).catch((error) => this.alert("STEER_RUNNER_FAILED", undefined, error));
-    }
-    startRunner(targetAlias, registrationId, mode, route) {
-        const steer = mode === "steer_only";
-        const runners = steer ? this.steerRunners : this.dispatchRunners;
-        const key = `${targetAlias}\0${registrationId}${steer ? "\0steer" : ""}`;
-        if (runners.has(key))
-            return;
-        let retry = false;
-        const runner = this.runTarget(targetAlias, registrationId, mode)
-            .then((value) => { retry = value; })
-            .finally(() => {
-            if (runners.get(key) !== runner)
-                return;
-            runners.delete(key);
-            if (retry)
-                this.scheduleTargetRetry(targetAlias, registrationId, steer);
-            else if (steer && this.running && !this.closing)
-                this.kickSteer(targetAlias);
-            else if (this.running)
-                void Promise.all([this.store.inspectDispatchableTargets(), this.store.inspectPrivateRoute(targetAlias)]).then(([targets, route]) => {
-                    if (targets.includes(targetAlias) &&
-                        (route?.registrationMode !== "federated_peer" || this.peerClients.has(route.binding.hostId)))
-                        this.kick(targetAlias);
-                }).catch(() => undefined);
-        });
-        runners.set(key, runner);
-        void runner.catch((error) => this.alert(steer ? "STEER_RUNNER_FAILED" : "DISPATCH_RUNNER_FAILED", route, error));
-    }
-    async runTarget(targetAlias, runnerRegistrationId, mode) {
-        while (this.running && !this.closing) {
-            let reserved;
-            const reserveOperation = this.store.reserveMessage(targetAlias, mode).then((result) => {
-                reserved = result;
-                if (result.status === "reserved") {
-                    this.activeAttempts.set(result.attempt.messageId, {
-                        messageId: result.attempt.messageId,
-                        attemptId: result.attempt.attemptId,
-                    });
-                }
-            });
-            this.reserveOperations.add(reserveOperation);
-            try {
-                await reserveOperation;
-            }
-            finally {
-                this.reserveOperations.delete(reserveOperation);
-            }
-            if (reserved === undefined)
-                throw new RangeError("RESERVE_RESULT_MISSING");
-            if (reserved.status === "empty")
-                return false;
-            if (reserved.status === "terminal") {
-                await this.finishSettlement(reserved.settlement);
-                return false;
-            }
-            const attempt = reserved.attempt;
-            if (this.closing || !this.running) {
-                await this.settleAttemptForShutdown(attempt.messageId, attempt.attemptId);
-                return false;
-            }
-            if (attempt.targetRegistrationId !== runnerRegistrationId) {
-                await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "requeue", "ENDPOINT_GENERATION_CHANGED");
-                return false;
-            }
-            const messageContext = this.messageContexts.get(attempt.messageId);
-            const conversation = messageContext === undefined
-                ? undefined
-                : this.conversations.get(messageContext.conversationId);
-            // Resolve by registration, not by the alias captured at reserve: a
-            // session renamed between reserve and dispatch is the same route and
-            // must still be delivered to, under whatever name it carries now.
-            const installed = await this.store.listLogicalRoutes();
-            const byRegistration = (registration, alias) => installed.find((route) => route.binding.registrationId === registration) ??
-                installed.find((route) => route.alias === alias);
-            const target = byRegistration(attempt.targetRegistrationId, attempt.targetAlias);
-            const source = byRegistration(attempt.sourceRegistrationId, attempt.sourceAlias);
-            if (this.closing || !this.running) {
-                await this.settleAttemptForShutdown(attempt.messageId, attempt.attemptId);
-                return false;
-            }
-            if (target === undefined ||
-                target.binding.registrationId !== attempt.targetRegistrationId ||
-                source?.binding.registrationId !== attempt.sourceRegistrationId) {
-                await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "failed", "ROUTE_UNREGISTERED");
-                return false;
-            }
-            if (target.registrationMode === "federated_peer") {
-                const peer = this.peerClients.get(target.binding.hostId);
-                if (peer === undefined || source.registrationMode === "federated_peer") {
-                    await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "requeue", "PEER_TUNNEL_UNAVAILABLE");
-                    return false;
-                }
-                const sourceEndpoint = { alias: source.alias, provider: source.binding.provider,
-                    host: source.binding.hostId, routeRef: peerRouteRef(source.binding.hostId, source.binding.registrationId) };
-                const targetEndpoint = { alias: target.alias, provider: target.binding.provider,
-                    host: target.binding.hostId, routeRef: target.binding.routeHandle };
-                const params = {
-                    originAttemptId: attempt.attemptId, originMessageId: attempt.messageId,
-                    source: sourceEndpoint, target: targetEndpoint,
-                    deadlineAt: attempt.deadlineAt, expectsReply: conversation?.expectsReply ?? true,
-                    body: attempt.body,
-                    ...(attempt.steer === true ? { steer: true } : {}),
-                    ...(attempt.conversationIdSuffix === undefined ? {} : { conversationCorrelation: attempt.conversationIdSuffix }),
-                };
-                let armed = false, authorizationUncertain = false, acceptanceObserved = false, result;
-                try {
-                    const prepared = peer.prepareHandoff(params);
-                    let authorized;
-                    try {
-                        authorized = await this.store.authorizeMessage({ messageId: attempt.messageId,
-                            attemptId: attempt.attemptId, sourceRegistrationId: attempt.sourceRegistrationId,
-                            targetRegistrationId: attempt.targetRegistrationId,
-                            prepared: { kind: "peer_handoff", bodyBytes: prepared.bodyBytes,
-                                bodySha256: prepared.bodySha256, frameBytes: prepared.frameBytes, sha256: prepared.sha256 } });
-                    }
-                    catch (error) {
-                        authorizationUncertain = true;
-                        throw error;
-                    }
-                    if (authorized.status !== "authorized") {
-                        prepared.cancel();
-                        if (authorized.status === "terminal")
-                            await this.finishSettlement(authorized.settlement);
-                        this.activeAttempts.delete(attempt.messageId);
-                        return false;
-                    }
-                    armed = true;
-                    await prepared.perform();
-                    acceptanceObserved = true;
-                    const accepted = await this.store.acceptMessage({ messageId: attempt.messageId,
-                        attemptId: attempt.attemptId, lossOutcome: "unconfirmed" });
-                    if (accepted.status !== "accepted")
-                        throw new BridgeError("ACCEPTANCE_UNCONFIRMED", "The peer acceptance fence is stale.");
-                    result = { state: "delivered", safeErrorCode: "PEER_HANDOFF_CONFIRMED" };
-                }
-                catch {
-                    if (!armed && !authorizationUncertain) {
-                        peer.close();
-                        this.peerClients.delete(target.binding.hostId);
-                        await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "requeue", "PEER_TUNNEL_UNAVAILABLE");
-                        return false;
-                    }
-                    result = acceptanceObserved
-                        ? { state: "unconfirmed", safeErrorCode: "PEER_HANDOFF_ACCEPTANCE_UNCONFIRMED" }
-                        : { state: "ambiguous", safeErrorCode: authorizationUncertain ? "WRITE_AUTHORIZATION_UNCERTAIN" : "PEER_HANDOFF_OUTCOME_UNKNOWN" };
-                }
-                const requeued = await this.applyDispatchResult(attempt.messageId, attempt.attemptId, result, armed, conversation, attempt.sourceAlias, attempt.targetAlias);
-                this.activeAttempts.delete(attempt.messageId);
-                return requeued;
-            }
-            const adapter = this.adapterFor(target.binding);
-            if (adapter === undefined) {
-                await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "failed", "PROVIDER_UNAVAILABLE");
-                return false;
-            }
-            const active = this.activeAttempts.get(attempt.messageId);
-            let authorizationUncertain = false;
-            let armed = false;
-            let accepted = false;
-            const conversationId = messageContext?.conversationId ??
-                conversationIdForSuffix(attempt.conversationIdSuffix);
-            const parsed = parseDirection(attempt.direction);
-            if (target.binding.provider === "claude" &&
-                messageContext?.expectsReply === true &&
-                ![...this.pendingClaudeReplies.values()].some((rows) => rows.some((row) => row.messageId === attempt.messageId)) &&
-                [...this.pendingClaudeReplies.values()].reduce((count, rows) => count + rows.length, 0) >= MAX_PENDING_CLAUDE_REPLIES) {
-                await this.resolvePrewrite(attempt.messageId, attempt.attemptId, "requeue", "ROUTE_BUSY");
-                return true;
-            }
-            let result;
-            try {
-                result = await adapter.dispatch({
-                    attemptId: attempt.attemptId,
-                    sourceAlias: attempt.sourceAlias,
-                    sourceProvider: parsed.sourceProvider,
-                    // The route's CURRENT alias, not the one captured at reserve. The
-                    // provider adapters compare this against the alias they hold for the
-                    // binding, so a session renamed between reserve and dispatch would
-                    // otherwise fail its own delivery over a stale display name.
-                    targetAlias: target.alias,
-                    conversationId,
-                    binding: target.binding,
-                    authorization: "selected_route",
-                    messageId: attempt.messageId,
-                    text: attempt.body,
-                    expectsReply: conversation?.expectsReply ?? true,
-                    deadlineAt: attempt.deadlineAt,
-                    ...(attempt.steer === true ? { steer: true, queuedAhead: 0 } : {}),
-                    authorizeWrite: async (evidence) => {
-                        if (evidence.attemptId !== attempt.attemptId)
-                            return false;
-                        try {
-                            const authorized = await this.store.authorizeMessage({
-                                messageId: attempt.messageId,
-                                attemptId: attempt.attemptId,
-                                sourceRegistrationId: attempt.sourceRegistrationId,
-                                targetRegistrationId: attempt.targetRegistrationId,
-                                prepared: {
-                                    kind: evidence.kind,
-                                    bodyBytes: evidence.bodyBytes,
-                                    bodySha256: evidence.bodySha256,
-                                    frameBytes: evidence.frameBytes,
-                                    sha256: evidence.sha256,
-                                },
-                            });
-                            if (authorized.status === "terminal") {
-                                await this.finishSettlement(authorized.settlement);
-                            }
-                            if (authorized.status === "authorized") {
-                                armed = true;
-                                if (target.binding.provider === "claude" &&
-                                    messageContext?.expectsReply === true) {
-                                    this.installPendingClaudeReply({
-                                        messageId: attempt.messageId,
-                                        conversationId,
-                                        sourceAlias: attempt.sourceAlias,
-                                        targetAlias: attempt.targetAlias,
-                                        sourceBinding: source.binding,
-                                        targetBinding: target.binding,
-                                        deadlineAt: attempt.deadlineAt,
-                                        state: "armed",
-                                    });
-                                }
-                            }
-                            return authorized.status === "authorized";
-                        }
-                        catch (error) {
-                            authorizationUncertain = true;
-                            throw error;
-                        }
-                    },
-                    onAccepted: async (evidence) => {
-                        if ((target.binding.provider !== "codex" && target.binding.provider !== "peer") ||
-                            evidence.attemptId !== attempt.attemptId) {
-                            throw new BridgeError("ACCEPTANCE_UNCONFIRMED", "The provider accepted another attempt.");
-                        }
-                        const result = await this.store.acceptMessage({
-                            messageId: attempt.messageId,
-                            attemptId: attempt.attemptId,
-                            lossOutcome: attempt.steer === true ? "ambiguous" : "unconfirmed",
-                        });
-                        if (result.status !== "accepted") {
-                            throw new BridgeError("ACCEPTANCE_UNCONFIRMED", "The durable acceptance fence is stale.");
-                        }
-                        accepted = true;
-                    },
-                });
-            }
-            catch {
-                result = {
-                    state: accepted
-                        ? attempt.steer === true
-                            ? "ambiguous"
-                            : "unconfirmed"
-                        : armed || authorizationUncertain
-                            ? "ambiguous"
-                            : "failed",
-                    safeErrorCode: accepted
-                        ? "DELIVERY_UNCONFIRMED"
-                        : authorizationUncertain || armed
-                            ? "WRITE_AUTHORIZATION_UNCERTAIN"
-                            : "PROVIDER_DISPATCH_FAILED",
-                };
-            }
-            const requeued = await this.applyDispatchResult(attempt.messageId, attempt.attemptId, result, armed, conversation, attempt.sourceAlias, attempt.targetAlias);
-            if (this.activeAttempts.get(attempt.messageId) === active)
-                this.activeAttempts.delete(attempt.messageId);
-            return requeued;
-        }
-        return false;
-    }
-    async settleAttemptForShutdown(messageId, attemptId) {
-        const result = await this.store.settleAttemptForShutdown({ messageId, attemptId });
-        if (result.status === "settled")
-            await this.finishSettlement(result.settlement);
-    }
-    async resolvePrewrite(messageId, attemptId, outcome, safeErrorCode) {
-        const result = await this.store.resolvePrewriteAttempt({
-            messageId, attemptId, outcome, safeErrorCode,
-        });
-        if (result.status === "settled")
-            await this.finishSettlement(result.settlement);
-        else
-            this.activeAttempts.delete(messageId);
-    }
-    async applyDispatchResult(messageId, attemptId, result, armed, conversation, sourceAlias, targetAlias) {
-        if (result.state === "deferred" && armed) {
-            result = {
-                state: "ambiguous",
-                safeErrorCode: "DISPATCH_OUTCOME_AMBIGUOUS",
-            };
-        }
-        if (result.state === "deferred") {
-            const code = safeCode(result.safeErrorCode, "PROVIDER_DEFERRED");
-            const resolution = await this.store.resolvePrewriteAttempt({
-                messageId,
-                attemptId,
-                outcome: CLEAN_RETRY_CODES.has(code) ? "requeue" : "failed",
-                safeErrorCode: code,
-            });
-            if (resolution.status === "settled")
-                await this.finishSettlement(resolution.settlement);
-            return resolution.status === "requeued";
-        }
-        const terminal = result.state;
-        const resultCode = "safeErrorCode" in result
-            ? result.safeErrorCode
-            : undefined;
-        const prewrite = await this.store.resolvePrewriteAttempt({
-            messageId,
-            attemptId,
-            outcome: "failed",
-            ...(resultCode === undefined ? {} : { safeErrorCode: safeCode(resultCode, "PROVIDER_DISPATCH_FAILED") }),
-        });
-        if (prewrite.status === "settled") {
-            await this.finishSettlement(prewrite.settlement);
-            return false;
-        }
-        if (prewrite.status !== "stale")
-            return false;
-        const settlement = await this.store.settleAttempt({
-            messageId,
-            attemptId,
-            state: terminal,
-            ...(resultCode === undefined ? {} : { safeErrorCode: safeCode(resultCode, "PROVIDER_DISPATCH_FAILED") }),
-        });
-        if (settlement.status === "settled") {
-            await this.finishSettlement(settlement.settlement);
-            if (settlement.settlement.state === "delivered") {
-                await this.activatePendingClaudeReply(messageId);
-            }
-            if (conversation !== undefined &&
-                "replyText" in result &&
-                result.replyText !== undefined) {
-                await this.enqueueCorrelatedReply(conversation, sourceAlias, targetAlias, result.replyText);
-            }
-        }
-        return false;
-    }
-    callbacksFor(adapter) {
-        return {
-            onRouteState: (event) => {
-                if (event.route.provider !== adapter.identity.provider ||
-                    event.route.hostId !== adapter.identity.hostId)
-                    return;
-                void this.onRouteState(event).catch((error) => this.alert("ROUTE_OBSERVATION_FAILED", undefined, error));
-            },
-            onClaudeReply: (event) => {
-                if (adapter.identity.provider !== "claude" ||
-                    event.endpoint.provider !== adapter.identity.provider ||
-                    event.endpoint.hostId !== adapter.identity.hostId)
-                    return;
-                void this.onClaudeReply(event).catch((error) => this.alert("CLAUDE_REPLY_REJECTED", undefined, error));
-            },
-            onClaudeMessage: (event) => {
-                if (adapter.identity.provider !== "claude" ||
-                    event.endpoint.provider !== adapter.identity.provider ||
-                    event.endpoint.hostId !== adapter.identity.hostId)
-                    return;
-                const operation = this.onClaudeMessage(event).catch((error) => {
-                    this.alert("CLAUDE_INGRESS_REJECTED", undefined, error);
-                    if (event.receiptHandle !== undefined) {
-                        void adapter.updateNativeInboundStatus?.(event.receiptHandle, "denied", safeCode(error instanceof BridgeError ? error.code : undefined, "CLAUDE_INGRESS_REJECTED")).finally(() => adapter.releaseNativeInboundReceipt?.(event.receiptHandle));
-                    }
-                }).finally(() => this.inboundOperations.delete(operation));
-                this.inboundOperations.add(operation);
-                void operation;
-            },
-            onProtocolNotice: (event) => this.alert(safeCode(event.code, "PROVIDER_PROTOCOL_NOTICE"), undefined),
-        };
-    }
-    async onRouteState(event) {
-        const route = await this.store.inspectPrivateRoute((await this.store.listLogicalRoutes()).find((candidate) => candidate.binding.registrationId === event.route.registrationId)?.alias ?? "");
-        if (route === undefined || !sameBinding(route.binding, event.route))
-            return;
-        if (!Number.isFinite(Date.parse(event.observedAt)))
-            return;
-        this.routeObservations.set(route.alias, {
-            ...event,
-            ...(event.safeErrorCode === undefined
-                ? {}
-                : { safeErrorCode: safeCode(event.safeErrorCode, "ROUTE_UNOBSERVED") }),
-        });
-        const runtime = this.connectors.get(connectorKey(event.route));
-        if (runtime !== undefined) {
-            runtime.observedAt = event.observedAt;
-            runtime.health = event.state === "unobserved" ? "degraded" : "healthy";
-            if (event.state === "unobserved") {
-                runtime.safeErrorCode = safeCode(event.safeErrorCode, "ROUTE_UNOBSERVED");
-            }
-            else {
-                delete runtime.safeErrorCode;
-            }
-        }
-        this.revision += 1;
-    }
-    async onClaudeMessage(event) {
-        const target = await this.store.inspectPrivateRoute(event.targetAlias);
-        const localHost = this.config.hostId;
-        if (target === undefined || (target.binding.hostId !== event.endpoint.hostId &&
-            !(target.registrationMode === "federated_peer" && event.endpoint.hostId === localHost))) {
-            throw new BridgeError("ROUTE_NOT_AVAILABLE", "The native target is absent.");
-        }
-        // A native SendMessage is this session's send: its route installs here,
-        // from the exact identity the adapter attested, so the Codex task can
-        // reply through the ordinary path. The adapter's name for the sender must
-        // be the name discovery shows for that UUID; the check runs on a read-only
-        // lookup so a refusal writes nothing.
-        this.assertWritable();
-        const seen = await this.lookUpClaudeRoute(event.endpoint.routeHandle, event.endpoint.hostId);
-        if (this.claimedAlias(seen) !== event.sourceAlias) {
-            throw new BridgeError("CLAUDE_ROUTE_MISMATCH", "The native sender's name does not match its discovered session.");
-        }
-        const source = await this.materializeClaudeRoute(seen);
-        const sourceBinding = source.binding;
-        const conversationId = createGatewayConversationId();
-        const steer = target.binding.provider === "codex" && event.text.startsWith("STEER:") && this.config.steeringEnabled;
-        this.assertWritable();
-        const enqueued = await this.store.enqueueNativeIngress({
-            source: { alias: source.alias, binding: sourceBinding },
-            targetAlias: event.targetAlias,
-            expectedTargetRegistrationId: target.binding.registrationId,
-            body: event.text,
-            dedupeKey: `${conversationId}:0`,
-            conversationIdSuffix: conversationId.slice(-8),
-            ...(steer ? { steer: true } : {}),
-        });
-        if (!enqueued.accepted || enqueued.messageId === undefined) {
-            throw new BridgeError("MESSAGE_NOT_ACCEPTED", "The native message was not accepted.");
-        }
-        const conversation = {
-            id: conversationId,
-            sourceAlias: source.alias,
-            targetAlias: event.targetAlias,
-            sourceBinding,
-            targetBinding: target.binding,
-            expectsReply: true,
-            nextSequence: 1,
-        };
-        this.rememberConversation(conversation);
-        this.messageContexts.set(enqueued.messageId, { conversationId, expectsReply: true });
-        if (event.receiptHandle !== undefined) {
-            const adapter = this.claudeAdapter(event.endpoint.hostId);
-            if (adapter !== undefined) {
-                const receipt = {
-                    adapter,
-                    receiptHandle: event.receiptHandle,
-                    targetAlias: event.targetAlias,
-                    enqueuedAt: this.now().getTime(),
-                    heldWrite: Promise.resolve(),
-                    settled: false,
-                };
-                receipt.heldTimer = this.timers.setTimeout(() => {
-                    if (receipt.settled)
-                        return;
-                    delete receipt.heldTimer;
-                    receipt.heldWrite = Promise.resolve(adapter.updateNativeInboundStatus?.(receipt.receiptHandle, "held")).then(() => undefined).catch((error) => this.alert("CLAUDE_RECEIPT_HELD_FAILED", undefined, error));
-                }, 1_000);
-                if (this.config.deliveryNotices !== "quiet") {
-                    receipt.stallTimer = this.timers.setTimeout(() => {
-                        if (receipt.settled)
-                            return;
-                        delete receipt.stallTimer;
-                        void receipt.heldWrite.then(async () => {
-                            if (receipt.settled)
-                                return;
-                            const observation = this.routeObservations.get(receipt.targetAlias);
-                            const reason = observation?.state === "awaiting_approval"
-                                ? "AWAITING_EXTERNAL_APPROVAL"
-                                : observation?.state === "busy"
-                                    ? "ROUTE_BUSY"
-                                    : observation === undefined || observation.state === "unobserved"
-                                        ? "ROUTE_UNAVAILABLE"
-                                        : "ROUTE_BUSY";
-                            await adapter.notifyNativeInboundProgress?.(receipt.receiptHandle, {
-                                kind: "stall",
-                                reason,
-                                queuedForMs: Math.max(0, this.now().getTime() - receipt.enqueuedAt),
-                            });
-                        }).catch((error) => this.alert("CLAUDE_RECEIPT_PROGRESS_FAILED", undefined, error));
-                    }, this.config.stallNoticeMs);
-                }
-                this.nativeReceipts.set(enqueued.messageId, receipt);
-            }
-        }
-        if (steer)
-            this.kickSteer(event.targetAlias);
-        this.kick(event.targetAlias);
-        this.scheduleWake();
-    }
-    async onClaudeReply(event) {
-        if (event.endpoint.provider !== "claude" || this.closing)
-            return;
-        const key = `${event.endpoint.hostId}\0${event.endpoint.routeHandle}`;
-        const pending = this.pendingClaudeReplies.get(key) ?? [];
-        while (pending.length > 0) {
-            const row = pending[0];
-            if (row.state === "retired") {
-                pending.shift();
-                if (pending.length === 0)
-                    this.pendingClaudeReplies.delete(key);
-                else
-                    this.pendingClaudeReplies.set(key, pending);
-                return;
-            }
-            const current = await this.store.inspectPrivateRoute(row.targetAlias);
-            const currentSource = await this.store.inspectPrivateRoute(row.sourceAlias);
-            if (current === undefined ||
-                !sameBinding(current.binding, row.targetBinding) ||
-                currentSource === undefined ||
-                !sameBinding(currentSource.binding, row.sourceBinding)) {
-                pending.shift();
-                if (pending.length === 0)
-                    this.pendingClaudeReplies.delete(key);
-                else
-                    this.pendingClaudeReplies.set(key, pending);
-                return;
-            }
-            if (row.state === "armed") {
-                if (row.bufferedReply === undefined)
-                    row.bufferedReply = event.text;
-                this.pendingClaudeReplies.set(key, pending);
-                return;
-            }
-            pending.shift();
-            if (pending.length === 0)
-                this.pendingClaudeReplies.delete(key);
-            else
-                this.pendingClaudeReplies.set(key, pending);
-            await this.deliverPendingClaudeReply(row, event.text);
-            return;
-        }
-        this.pendingClaudeReplies.delete(key);
-    }
-    async enqueueCorrelatedReply(conversation, sourceAlias, targetAlias, text) {
-        const sourceBinding = sourceAlias === conversation.sourceAlias
-            ? conversation.sourceBinding
-            : conversation.targetBinding;
-        const targetBinding = targetAlias === conversation.targetAlias
-            ? conversation.targetBinding
-            : conversation.sourceBinding;
-        if (sourceBinding === undefined || targetBinding === undefined)
-            return;
-        const currentSource = await this.store.inspectPrivateRoute(sourceAlias);
-        if (currentSource === undefined ||
-            !sameBinding(currentSource.binding, sourceBinding))
-            return;
-        await this.enqueueConversation({
-            sourceAlias: targetAlias,
-            targetAlias: sourceAlias,
-            text,
-            expectsReply: true,
-            expectedSourceBinding: targetBinding,
-            expectedTargetBinding: sourceBinding,
-            existingConversation: conversation,
-        });
-    }
-    installPendingClaudeReply(row) {
-        const key = `${row.targetBinding.hostId}\0${row.targetBinding.routeHandle}`;
-        const pending = this.pendingClaudeReplies.get(key) ?? [];
-        if (!pending.some((candidate) => candidate.messageId === row.messageId)) {
-            pending.push(row);
-            this.pendingClaudeReplies.set(key, pending);
-        }
-    }
-    pruneExpiredPendingClaudeReplies(now) {
-        for (const [key, pending] of this.pendingClaudeReplies) {
-            const retained = pending.filter((row) => Date.parse(row.deadlineAt) > now);
-            if (retained.length === pending.length)
-                continue;
-            if (retained.length === 0)
-                this.pendingClaudeReplies.delete(key);
-            else
-                this.pendingClaudeReplies.set(key, retained);
-        }
-    }
-    retirePendingClaudeReply(messageId) {
-        for (const pending of this.pendingClaudeReplies.values()) {
-            const row = pending.find((candidate) => candidate.messageId === messageId);
-            if (row === undefined)
-                continue;
-            row.state = "retired";
-            delete row.bufferedReply;
-            return;
-        }
-    }
-    async activatePendingClaudeReply(messageId) {
-        for (const [key, pending] of this.pendingClaudeReplies) {
-            const row = pending.find((candidate) => candidate.messageId === messageId);
-            if (row === undefined)
-                continue;
-            row.state = "delivered";
-            if (row.bufferedReply === undefined || pending[0] !== row)
-                return;
-            const text = row.bufferedReply;
-            pending.shift();
-            if (pending.length === 0)
-                this.pendingClaudeReplies.delete(key);
-            else
-                this.pendingClaudeReplies.set(key, pending);
-            await this.deliverPendingClaudeReply(row, text);
-            return;
-        }
-    }
-    async deliverPendingClaudeReply(row, text) {
-        const conversation = this.conversations.get(row.conversationId);
-        if (conversation === undefined)
-            return;
-        const currentSource = await this.store.inspectPrivateRoute(row.sourceAlias);
-        if (currentSource === undefined ||
-            !sameBinding(currentSource.binding, row.sourceBinding))
-            return;
-        await this.enqueueConversation({
-            sourceAlias: row.targetAlias,
-            targetAlias: row.sourceAlias,
-            text,
-            expectsReply: true,
-            expectedSourceBinding: row.targetBinding,
-            expectedTargetBinding: row.sourceBinding,
-            existingConversation: conversation,
-        });
-    }
-    async finishSettlements(settlements) {
-        await Promise.all(settlements.map(async (settlement) => this.finishSettlement(settlement)));
-    }
-    async finishSettlement(settlement) {
-        this.activeAttempts.delete(settlement.messageId);
-        this.messageContexts.delete(settlement.messageId);
-        const receipt = this.nativeReceipts.get(settlement.messageId);
-        if (receipt !== undefined) {
-            this.nativeReceipts.delete(settlement.messageId);
-            receipt.settled = true;
-            if (receipt.heldTimer !== undefined)
-                this.timers.clearTimeout(receipt.heldTimer);
-            if (receipt.stallTimer !== undefined)
-                this.timers.clearTimeout(receipt.stallTimer);
-            const status = settlement.state === "delivered"
-                ? "delivered"
-                : "expired";
-            await receipt.heldWrite.then(() => receipt.adapter.updateNativeInboundStatus?.(receipt.receiptHandle, status, settlement.safeErrorCode))
-                .catch((error) => this.alert("CLAUDE_RECEIPT_SETTLEMENT_FAILED", undefined, error))
-                .finally(() => receipt.adapter.releaseNativeInboundReceipt?.(receipt.receiptHandle))
-                .catch((error) => this.alert("CLAUDE_RECEIPT_RELEASE_FAILED", undefined, error));
-        }
-        if (settlement.state !== "delivered") {
-            this.retirePendingClaudeReply(settlement.messageId);
-        }
-    }
-    scheduleTargetRetry(targetAlias, registrationId, steer = false) {
-        this.timers.setTimeout(() => steer
-            ? this.kickSteer(targetAlias)
-            : this.kick(targetAlias, registrationId), CLEAN_RETRY_DELAY_MS);
-    }
-    scheduleWake() {
-        if (!this.running || this.closing)
-            return;
-        if (this.wakeTimer !== undefined)
-            this.timers.clearTimeout(this.wakeTimer);
-        void this.store.nextDeadlineAt().then((deadlineAt) => {
-            if (!this.running || this.closing)
-                return;
-            const now = this.now().getTime();
-            const due = [
-                this.nextDiscoveryAt || now + DISCOVERY_INTERVAL_MS,
-                this.nextManagedCodexCheckAt || now + MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS,
-                ...(this.config.peerNodes.length > 0
-                    ? [this.nextPeerRefreshAt || now + PEER_REFRESH_INTERVAL_MS]
-                    : []),
-                ...this.ephemeralPeerExpiries.values(),
-                ...(deadlineAt === undefined ? [] : [Date.parse(deadlineAt)]),
-                ...[...this.pendingClaudeReplies.values()].flatMap((rows) => rows.map((row) => Date.parse(row.deadlineAt))),
-            ].filter(Number.isFinite);
-            const delay = Math.max(0, Math.min(...due) - now);
-            this.wakeTimer = this.timers.setTimeout(() => {
-                this.wakeTimer = undefined;
-                void this.onWake().catch((error) => this.alert("GATEWAY_WAKE_FAILED", undefined, error));
-            }, delay);
-        }).catch((error) => this.alert("GATEWAY_WAKE_FAILED", undefined, error));
-    }
-    async onWake() {
-        if (!this.running || this.closing)
-            return;
-        const now = this.now();
-        await this.finishSettlements(await this.store.expireDueMessages(now));
-        this.pruneExpiredPendingClaudeReplies(now.getTime());
-        await this.expireEphemeralPeers(now.getTime());
-        if (now.getTime() >= this.nextDiscoveryAt) {
-            await this.refreshClaudeDiscovery().catch(() => undefined);
-            this.nextDiscoveryAt = now.getTime() + DISCOVERY_INTERVAL_MS;
-        }
-        if (now.getTime() >= this.nextManagedCodexCheckAt) {
-            await this.refreshManagedCodexSocket().catch(() => undefined);
-            this.nextManagedCodexCheckAt = now.getTime() + MANAGED_CODEX_SOCKET_CHECK_INTERVAL_MS;
-        }
-        if (this.nextPeerRefreshAt > 0 && now.getTime() >= this.nextPeerRefreshAt) {
-            const operation = this.refreshPeers();
-            this.peerRefreshOperations.add(operation);
-            try {
-                await operation;
-            }
-            finally {
-                this.peerRefreshOperations.delete(operation);
-            }
-            this.nextPeerRefreshAt = now.getTime() + PEER_REFRESH_INTERVAL_MS;
-        }
-        if (!this.running || this.closing)
-            return;
-        for (const target of await this.store.inspectDispatchableTargets())
-            this.kick(target);
-        this.scheduleWake();
-    }
-    async refreshPeers() {
-        const localHost = this.config.hostId;
-        await Promise.all(this.config.peerNodes.map(async (peerHost) => {
-            let failureCode = "PEER_TUNNEL_UNAVAILABLE";
-            try {
-                let client = this.peerClients.get(peerHost);
-                if (client === undefined) {
-                    failureCode = "PEER_DIAL_FAILED";
-                    client = await this.spawnPeer({ node: peerHost, localHost });
-                    if (!this.running || this.closing) {
-                        client.close();
-                        return;
-                    }
-                    this.peerClients.set(peerHost, client);
-                }
-                failureCode = "PEER_TUNNEL_UNAVAILABLE";
-                const catalog = await client.catalog();
-                if (!this.running || this.closing)
-                    return;
-                this.recordPeerFailure(peerHost);
-                const prior = this.peerCatalogs.get(peerHost);
-                let routes = await this.store.inspectPrivateRoutes().then((rows) => rows.filter((route) => route.registrationMode === "federated_peer" && route.binding.hostId === peerHost));
-                if (!catalog.complete || catalog.truncated) {
-                    const observedAt = this.now().toISOString();
-                    for (const route of routes)
-                        this.peerRouteViews.set(route.alias, { route: route.binding,
-                            state: "unobserved", observedAt, safeErrorCode: "PEER_CATALOG_INCOMPLETE" });
-                    return;
-                }
-                const authorityChanged = peerCatalogAuthorityChanged(prior, catalog);
-                const viewChanged = peerCatalogViewChanged(prior, catalog);
-                if (authorityChanged) {
-                    const before = routes;
-                    const reconciled = await this.store.reconcilePeerCatalog(peerHost, catalog);
-                    routes = [...reconciled.routes];
-                    await this.finishSettlements(reconciled.settlements);
-                    for (const old of before)
-                        if (!routes.some((route) => route.alias === old.alias &&
-                            route.binding.registrationId === old.binding.registrationId)) {
-                            this.peerRouteViews.delete(old.alias);
-                            await this.reconcileUnadvertisement(old);
-                        }
-                    for (const route of routes)
-                        if (!before.some((old) => old.alias === route.alias &&
-                            old.binding.registrationId === route.binding.registrationId))
-                            this.reconcileAdvertisement(route);
-                }
-                this.peerCatalogs.set(peerHost, catalog);
-                const observedAt = this.now().toISOString();
-                for (const route of routes) {
-                    const row = catalog.routes.find((candidate) => candidate.ref === route.binding.routeHandle);
-                    const state = row?.state === "idle" || row?.state === "busy" || row?.state === "awaiting_approval"
-                        ? row.state : "unobserved";
-                    this.peerRouteViews.set(route.alias, { route: route.binding, state, observedAt,
-                        ...(state === "unobserved" ? { safeErrorCode: row?.safeErrorCode ?? "PEER_ROUTE_STALE" } : {}) });
-                    if (row?.enabled === true)
-                        this.kick(route.alias, route.binding.registrationId);
-                }
-                if (viewChanged)
-                    this.revision += 1;
-            }
-            catch (error) {
-                this.peerClients.get(peerHost)?.close();
-                this.peerClients.delete(peerHost);
-                if (!this.running || this.closing)
-                    return;
-                // A wire-version disagreement is not a tunnel fault: name it so an operator
-                // upgrades the lagging node instead of debugging SSH.
-                if (error instanceof PeerConnectionLostError && error.failureClass === "protocol")
-                    failureCode = "PEER_PROTOCOL_MISMATCH";
-                this.recordPeerFailure(peerHost, failureCode);
-                const observedAt = this.now().toISOString();
-                const mirrorCode = failureCode === "PEER_PROTOCOL_MISMATCH" ? failureCode : "PEER_TUNNEL_UNAVAILABLE";
-                for (const route of await this.store.inspectPrivateRoutes())
-                    if (route.registrationMode === "federated_peer" &&
-                        route.binding.hostId === peerHost)
-                        this.peerRouteViews.set(route.alias, { route: route.binding,
-                            state: "unobserved", observedAt, safeErrorCode: mirrorCode });
-            }
-        }));
-    }
-    async refreshClaudeDiscovery() {
-        const seen = new Set();
-        const nextCollisions = new Set();
-        const refreshedHosts = new Set();
-        for (const adapter of this.adapters) {
-            if (adapter.identity.provider !== "claude" || adapter.discoverClaudePeers === undefined)
-                continue;
-            const snapshot = await adapter.discoverClaudePeers();
-            const observedAt = this.now().toISOString();
-            const peers = snapshot.peers.filter((peer) => PUBLIC_ALIAS.test(peer.alias) &&
-                peer.alias.endsWith(`@${adapter.identity.hostId}`) && PRIVATE_HANDLE.test(peer.routeHandle));
-            const aliasHandles = new Map();
-            for (const peer of peers) {
-                const handles = aliasHandles.get(peer.alias) ?? new Set();
-                handles.add(peer.routeHandle);
-                aliasHandles.set(peer.alias, handles);
-            }
-            const collidingAliases = new Set([...aliasHandles].filter(([, handles]) => handles.size > 1).map(([alias]) => alias));
-            refreshedHosts.add(adapter.identity.hostId);
-            if (!snapshot.complete)
-                for (const alias of this.collidingClaudeAliases)
-                    if (alias.endsWith(`@${adapter.identity.hostId}`))
-                        collidingAliases.add(alias);
-            for (const alias of collidingAliases)
-                nextCollisions.add(alias);
-            for (const peer of peers) {
-                const key = `${adapter.identity.hostId}\0${peer.routeHandle}`;
-                seen.add(key);
-                this.candidates.set(key, { ...peer, adapter, observedAt });
-            }
-            const runtime = this.connectors.get(connectorKey(adapter.identity));
-            if (runtime !== undefined) {
-                runtime.observedAt = observedAt;
-                runtime.health = snapshot.complete ? "healthy" : "degraded";
-                const registry = snapshot.registry ?? adapter.latestRegistryObservation?.();
-                if (registry !== undefined) {
-                    runtime.registry = publicRegistry({ ...registry, rejected: [
-                            ...registry.rejected,
-                            ...(collidingAliases.size === 0 ? [] : [{ safeErrorCode: "PEER_ALIAS_COLLISION",
-                                    count: collidingAliases.size }]),
-                        ] }, runtime.registry?.parseableRecordSeenSinceBoot ?? false);
-                }
-            }
-        }
-        for (const [key] of this.candidates)
-            if (!seen.has(key))
-                this.candidates.delete(key);
-        for (const alias of this.collidingClaudeAliases)
-            if (refreshedHosts.has(aliasHost(alias)))
-                this.collidingClaudeAliases.delete(alias);
-        const retainedCollisions = new Set([...nextCollisions].slice(0, gatewayPublicSnapshotLimits.availablePeers));
-        // Discovery currently caps rows such that collisions cannot overflow this independent public bound.
-        // If those constants diverge, discard overflow candidates rather than expose an unfenced alias.
-        for (const [key, candidate] of this.candidates)
-            if (nextCollisions.has(candidate.alias) && !retainedCollisions.has(candidate.alias))
-                this.candidates.delete(key);
-        for (const alias of retainedCollisions)
-            this.collidingClaudeAliases.add(alias);
-    }
-    async refreshManagedCodexSocket() {
-        if (this.managedCodexSocketHeld === undefined)
-            return;
-        this.managedCodexSocketHeldOutside = await this.managedCodexSocketHeld();
-    }
-    assertWritable() {
-        if (this.closing || !this.running) {
-            throw new BridgeError("GATEWAY_CLOSING", "The gateway is not accepting mutations.");
-        }
-    }
-    routeObservationStillCurrent(event) {
-        return this.connectors.has(connectorKey(event.route));
-    }
-    alert(code, route, error) {
-        const errorCode = error instanceof BridgeError ? error.code : undefined;
-        this.runtimeAlerts.push({
-            code: safeCode(errorCode, safeCode(code, "GATEWAY_RUNTIME_NOTICE")),
-            severity: "warning",
-            timestamp: this.now().toISOString(),
-            ...(route === undefined ? {} : {
-                provider: route.binding.provider,
-                host: route.binding.hostId,
-                alias: route.alias,
-            }),
-        });
-        while (this.runtimeAlerts.length > gatewayPublicSnapshotLimits.alerts)
-            this.runtimeAlerts.shift();
-    }
-    recordPeerFailure(host, code) {
-        for (let index = this.runtimeAlerts.length - 1; index >= 0; index -= 1) {
-            const alert = this.runtimeAlerts[index];
-            if (alert?.host === host && PEER_FAILURE_CODES.includes(alert.code))
-                this.runtimeAlerts.splice(index, 1);
-        }
-        if (code !== undefined)
-            this.runtimeAlerts.push({ code, severity: "warning", timestamp: this.now().toISOString(), host });
-    }
-}
-//# sourceMappingURL=service.js.map