[0xcadams]

What

keep native application streams and target sockets alive when a connector replaces either relay carrier. this continues the opt-in native packet path on top of #485; it does not enable production native admission.

Why

the inner QUIC connection can survive carrier loss, but closing the connector's outer session previously retired the relay's publisher registration. reconnecting needs an explicit transfer of that registration's delivery ownership while retaining its deadline and replay history.

Changes

• add native_leg_handoff / native_leg_handed_off, binding a fresh signed hello to the exact previous selected nonce. reject consumed predecessors, reused candidates, changed source/assignment/process, and expired authority; retain at most 64 selected candidates per bridge.
• retain the publisher registration across connector loss, clip handoff to both existing deadlines, and keep replay filtering ahead of persistent TLS/yamux streams. packet-carrier failure also retires its control owner.
• join each slot's failed carrier and renewal work before recovery; rejected or ambiguous selection cannot retry. application admission and the inner connection are unchanged by handoff.
• add strict wire fixtures, cross-transport replay and negative proofs, and a real-control test that replaces both TCP carriers twice while keeping one target socket for QUIC and TLS/TCP publishers.
• qualification at bab9c4e2: routine Go/public-consumer tests, lint, full race suite, generation, committed generation check, and formatting passed. the final race integration matrix passed all ten loss cases (124.36s), claim renewal (57.35s, both claims advanced at least 30.024s), and reconnect cases (15.84s); daemon total 199.224s.

assignment/source/network changes, endpoint replacement, ICE/direct upgrade, public-ingress cutover, and deployed proxy-source qualification remain separate cutover work. production native gates remain off. prior unresolved runtime/CI observations remain recorded in #485's evidence; this matrix is not a root-cause finding for those failures.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T02:11:45.555714Z	5d0195a	New commits
🔒 Security Review	✅ Completed 2026-10-28T02:15:06.249198Z	5d0195a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[0xcadams]

denial shutdown fix

signed commit 5d0195a71e68d9fa1705ea81460ca40989e95921 fixes the Go race job failure at native_peer_handoff_test.go:159.

the serving select could return normal shutdown before consuming the control worker's denial. separately, an error joining that denial with EOF was classified as normal EOF. shutdown now joins the worker and retains its protocol result; protocol errors take precedence over ordinary close/cancellation classification.

a gated control-write regression deterministically exercises both paths. against the previous implementation through a read-only Go overlay, both cases fail with the original missing-denial result (<nil>). both pass with this fix under the race detector.

local qualification: complete go:test:race, go:lint (including the harness), and format-check passed. the real-control reconnect proof passed for both QUIC and TLS/TCP publishers (16.20s), replacing both native carriers twice while retaining one target socket. CI is running on the pushed commit.

[0xcadams]

CI finished on signed commit 5d0195a71e68d9fa1705ea81460ca40989e95921: every non-skipped check passed, including Go race (7m14s), all PostgreSQL API/state/runtime groups, native provider-http and Vercel workloads, and Runtime workloads (18m55s). The Route 53/ACME staging check was skipped. This confirms the pushed lost-denial fix; the remaining direct-path and coordinated ingress cutover work is still tracked separately.

[0xcadams]

superseded by the replacement cutover tracked in #499 (replacement stack #491). closing this original PR at the author's request so only the replacement review remains active. the original branch, commits, reviews and failure evidence are preserved; no branch is deleted. outstanding integration and validation remain tracked in the replacement, not waived by this closure.