[0xcadams]

What

Select one authenticated native relay transport before it installs publisher packet delivery. Stacked on #482 as the startup-selection part of #470; this does not enable production native admission or implement reconnect handoff.

Why

QUIC and TLS/TCP can both finish their signed native hellos. Installing publisher registration during each hello lets an unselected candidate spend the shared delivery generation's tombstone or interfere with the winner's packet state. A successful control claim is not a carrier-selection decision.

The connector now joins the losing attempts before activating its chosen hello. A passive candidate can close without retiring publisher registration, and a late duplicate activation cannot replace a live registration or reopen a retired generation. Application permission remains the publisher's independent decision.

Changes

• Bind a one-shot activation exchange to the nonce already authenticated in the signed hello, without another signature, control call, or authority extension.
• Keep relay candidates packet-passive until selection; recheck the exact publisher assignment, relay process lease, and claim deadline before installing forwarding.
• Clip activation to both the original startup budget and confirmed claim deadline; close a rejected, canceled, expired, or ambiguous winner without retrying admission.
• Preserve claim renewal on the existing control stream, plus pair isolation, replay fences, bounded cleanup, and retired-generation rejection at the activation boundary.
• Cover the wire union with golden JSON/framed fixtures, invalid and bounded reads, fuzz seeds, transport rejection/cancellation checks, overlapping candidate races, and real-control packet-loss/renewal proofs retaining one target socket.

[0xcadams]

signed/pushed startup-selection slice: #483 at 1fd92f90e8751e6f65b6b7eed3095d9bf307ea20, stacked on #482.

• passed routine Go/public consumer, full Go races, six owning-package race suites, lint, formatting, regeneration, and committed generation verification.
• final disposable-PostgreSQL real-control/two-relay race run passed all ten packet-loss continuity cases and checked claim renewal in 184.322s. one target socket survived the original pair deadline; both relay claims advanced by at least 30.030s.
• activation selects the nonce already authenticated in one signed hello, after joining losing attempts. no extra signature, control call, application admission, or authority extension; the original startup and confirmed claim deadlines both clip the exchange.
• relay hellos stay passive, loser cleanup leaves publisher registration alone, and duplicate activation cannot replace a live registration or reopen a retired delivery generation. protocol fixtures, invalid/bounded reads, fuzz seeds, cancellation/cause/classification checks, overlapping hello selection, and expiry-during-join cases retain these boundaries.

this is not reconnect handoff: active outer-session closure still retires that registration. ICE/direct upgrade, public-ingress cutover, source-proxy qualification, guest serving-tail/metrics, remaining website service-access reconciliation, and final source pins remain open. production native admission remains disabled. no merge, deployment, live infrastructure change, release, or deployed benchmark was run.

#482's binary CI group passed, but its workload proof failed the QUIC revoked-HTTP assertion (workload_transport_integration_test.go:156). that assertion currently conflates HTTP 200 with redirect and omits the service. its log is retained; evidence improvements and reproduction are separate from this activation change. previous control-outage EOF/manual-Compose failures also remain unexplained rather than being erased by later passes.

[0xcadams]

combined source reconciliation is signed/pushed in #485 at 9b7d4b8f7ce91a7ce1132663ffdeaf740b4ae82e, stacked on #483. it includes #470's later 61033ba5 authority/certificate evidence and #484's exact workload-denial evidence, without modifying product behavior or weakening assertions.

on that combined source:

• the disposable-PostgreSQL race invocation task go:test:integration RUN='^TestIntegration(ControlRestartPreservesDataPlane|PeerPackets.*|WorkloadTransportLifecycle)$' passed in 649.373s.
• all ten native packet-loss cases passed (120.76s total); checked relay-claim renewal passed (62.69s). one target socket survived the original pair deadline, and both claims advanced by at least 30.019s.
• control restart passed in 23.60s, with the exact allocation and process-lease snapshot retained before shutdown.
• workload lifecycle passed QUIC in 223.05s and TLS/TCP in 217.62s, including revocation, unrenewed expiry, renewed continuity, and fixed expiry.
• daemon races, routine Go/public API, harness races, lint, formatting, and generation verification passed. routine Go's first attempt had a separate five-second QUIC fixture connection timeout before full-duplex assertions; the unchanged focused contract and subsequent routine run passed. the initial failure remains retained, not diagnosed by those passes.

#484's isolated Linux QUIC workload reproduction also passed in 223.298s. neither it nor the combined proof explains #482's original revoked-HTTP response, the earlier manual-Compose startup failure, or the original control-outage EOF. their evidence and open qualification status remain intact.

latest CI snapshot: #483 has 48 passing checks, one expected skip, and Runtime workloads still running; #485 has 43 passing checks, one expected skip, and runtime shards/workload/load still running. this is not final-matrix completion.

remaining product work includes reconnect handoff (active outer closure still retires its registration), assignment/source/network-change recovery, ICE/direct upgrade, public-ingress cutover, proxy-source qualification, guest serving-tail/metrics, and remaining website service-access/source-pin reconciliation. production native admission remains disabled. nothing merged or deployed; no live infrastructure, release, or deployed benchmark operation occurred.