a734bf5 feat(broker): project broker-native daemon observations · vev

M docs/architecture.md +25 -1


@@ -193,7 +193,7 @@ Use cases exchange `protocol.ClientMessage` and `protocol.ServerMessage` values.
193		`go tool buf generate`, and handle the new variant in `sessionwire`.	193		`go tool buf generate`, and handle the new variant in `sessionwire`.
194		Never edit generated `*.pb.go`; never add manual IDs or dispatch tables.	194		Never edit generated `*.pb.go`; never add manual IDs or dispatch tables.
195		- Implement I/O, queues, workers, environment integration, or technology selection in an adapter or `internal/app`.	195		- Implement I/O, queues, workers, environment integration, or technology selection in an adapter or `internal/app`.
196	-	- Bump `internal/protocol.Version` for negotiated wire layout changes (currently `54`). The preamble epoch (`wire.ProtocolEpoch`, QUIC ALPN `vev/1`) bumps only for an intentional clean break.	196	+	- Bump `internal/protocol.Version` for negotiated wire layout changes (currently `55`). The preamble epoch (`wire.ProtocolEpoch`, QUIC ALPN `vev/1`) bumps only for an intentional clean break.
197			197
198		## Broker wire core (Plan 001 P3.1, not activated)	198		## Broker wire core (Plan 001 P3.1, not activated)
199			199

@@ -265,6 +265,30 @@ nonblocking drain on false precedes Reset, supporting buffered timer adapters.
265		Policy identities have independent field-labelled validation and a named bound.	265		Policy identities have independent field-labelled validation and a named bound.
266		These are P2.2 port contracts, not a wire migration or production activation.	266		These are P2.2 port contracts, not a wire migration or production activation.
267			267
			268	+	## Broker registry and daemon observation (Plan 001 P5.2a, not activated)
			269	+
			270	+	`internal/usecase/broker.Registry` owns configured hosts and their immutable
			271	+	observation projections. `ports.BrokerDaemonObservation` is the broker-native
			272	+	projection of one daemon, local or remote: configured authority (local flag,
			273	+	endpoint, registration, policy, display origin, rank) is stamped by the
			274	+	registry from durable membership and never taken from a probe, while observed
			275	+	identity, process incarnation, protocol version, capability bitmask,
			276	+	availability, failure/freshness state, and the exact session catalogue come
			277	+	only from probe results. Unknown identity or version is zero, never invented;
			278	+	an observed identity always carries a protocol version, and availability is
			279	+	never zero (an unobserved daemon carries `RemoteAvailabilityUnknown`). A
			280	+	`ports.BrokerSnapshot` publishes these observations (`Daemons`, local entry
			281	+	first when present, then remotes in registration order) plus the tombstone
			282	+	set; `brokerwire` mirrors them through `SnapshotBegin`/`SnapshotDaemon`/
			283	+	`SnapshotSession` parts. Local observations are never durable: the snapshot
			284	+	store persists and reloads remote observations only, with policy re-stamped
			285	+	from membership on load, so membership stays the single policy authority.
			286	+	Observing a daemon never attaches to it and never starts a stopped one.
			287	+	Attachment streams declare one closed admission variant
			288	+	(`ports.BrokerStreamAdmission`: exact attach/resume, named creation, ephemeral
			289	+	creation) validated identically at the ports, broker IPC, and daemonmux
			290	+	boundaries.
			291	+
268		## Broker local IPC (Plan 001 P3.3, not activated)	292		## Broker local IPC (Plan 001 P3.3, not activated)
269			293
270		`internal/adapters/brokeripc` carries the P3.1 broker conversation over one	294		`internal/adapters/brokeripc` carries the P3.1 broker conversation over one

M internal/adapters/brokeripc/client.go +2 -1

 	// dispatched, because the local identity is already admitted either way.
 	if _, err := c.sendContext(ctx, brokerwire.OpenStream{
 		Epoch: scoped.Epoch, Connection: scoped.Connection, Stream: scoped.Stream,
-		Purpose: scoped.Purpose, Local: scoped.Local,
+		Purpose: scoped.Purpose, Admission: scoped.Admission, Name: scoped.Name,
+		Local:    scoped.Local,
 		Endpoint: scoped.Endpoint, Registration: scoped.Registration,
 		Target: scoped.Target, Env: scoped.Env, Policy: scoped.Policy,
 	}); err != nil {

M internal/adapters/brokeripc/emit.go +24 -20

 // Snapshot publication (P3.3).
 //
 // A broker publication travels as the exact multipart transfer the P3.1
-// assembler accepts: Begin(index 0, element counts), then every host part in
+// assembler accepts: Begin(index 0, element counts), then every daemon part in
-// host-index order immediately followed by that host's session parts in
+// daemon-index order immediately followed by that daemon's session parts in
-// session-index order, then the tombstones, then End at the final index. Host
+// session-index order, then the tombstones, then End at the final index. The
-// parts carry no inline sessions; sessions travel as their own parts. Both
+// local daemon, when present, is daemon index 0 and its sessions carry
-// sides agree on one deterministic layout, so the receiving assembler commits
+// Local=true. Daemon parts carry no inline sessions; sessions travel as their
-// only a transfer whose indexes, counts, and order are exact.
+// own parts. Both sides agree on one deterministic layout, so the receiving
+// assembler commits only a transfer whose indexes, counts, and order are exact.
 //
 // The emitter refuses a transfer the peer's assembler would refuse: more parts
 // than MaxSnapshotParts, or a total encoded payload above the staged ceiling.
 	if snapshot.Revision == 0 {
 		return nil, errors.New("brokeripc: snapshot publication has no revision")
 	}
-	if len(snapshot.Hosts) > ports.BrokerMaxHosts || len(snapshot.Removed) > ports.BrokerMaxTombstones {
+	if len(snapshot.Daemons) > ports.BrokerMaxDaemonsPerSnapshot || len(snapshot.Removed) > ports.BrokerMaxTombstones {
-		return nil, errors.New("brokeripc: snapshot publication exceeds host bound")
+		return nil, errors.New("brokeripc: snapshot publication exceeds daemon bound")
 	}
 	sessions := 0
-	for _, host := range snapshot.Hosts {
+	for _, daemon := range snapshot.Daemons {
-		if len(host.Sessions) > ports.BrokerMaxSessionsPerHost {
+		if len(daemon.Sessions) > ports.BrokerMaxSessionsPerHost {
 			return nil, errors.New("brokeripc: snapshot publication exceeds session bound")
 		}
-		sessions += len(host.Sessions)
+		sessions += len(daemon.Sessions)
 	}
-	total := 1 + len(snapshot.Hosts) + sessions + len(snapshot.Removed) + 1
+	total := 1 + len(snapshot.Daemons) + sessions + len(snapshot.Removed) + 1
 	if total > brokerwire.MaxSnapshotParts {
 		return nil, errors.New("brokeripc: snapshot publication exceeds part bound")
 	}
+	localPresent := len(snapshot.Daemons) > 0 && snapshot.Daemons[0].Local
 	parts := make([]brokerwire.SnapshotPart, 0, total)
 	base := func(part brokerwire.SnapshotPartPayload) brokerwire.SnapshotPart {
 		}
 	}
 	parts = append(parts, base(brokerwire.SnapshotBegin{
-		HostCount:      uint32(len(snapshot.Hosts)),
+		HostCount:      uint32(len(snapshot.Daemons)),
 		SessionCount:   uint32(sessions),
 		TombstoneCount: uint32(len(snapshot.Removed)),
+		LocalPresent:   localPresent,
 	}))
-	for hostIndex, host := range snapshot.Hosts {
+	for daemonIndex, daemon := range snapshot.Daemons {
-		projection := host.Clone()
+		projection := daemon.Clone()
 		sessionCount := len(projection.Sessions)
 		projection.Sessions = nil
-		parts = append(parts, base(brokerwire.SnapshotHostPart{
+		parts = append(parts, base(brokerwire.SnapshotDaemonPart{
-			HostIndex:    uint32(hostIndex),
+			HostIndex:    uint32(daemonIndex),
-			Host:         projection,
+			Daemon:       projection,
 			SessionCount: uint32(sessionCount),
 		}))
-		for sessionIndex, session := range host.Sessions {
+		for sessionIndex, session := range daemon.Sessions {
 			parts = append(parts, base(brokerwire.SnapshotSessionPart{
-				HostIndex:    uint32(hostIndex),
+				HostIndex:    uint32(daemonIndex),
 				SessionIndex: uint32(sessionIndex),
+				Local:        daemon.Local,
 				Session:      cloneCatalogSession(session),
 			}))
 		}

M internal/adapters/brokeripc/helpers_test.go +23 -6

 	}
 }
-// testHostAt builds one catalogue-valid host projection for index i.
+// testDaemonAt builds one catalogue-valid remote daemon projection for index i.
-func testHostAt(i int) ports.RemoteHostSnapshot {
+func testDaemonAt(i int) ports.BrokerDaemonObservation {
 	endpoint := fmt.Sprintf("user%d@host%d:22", i, i)
-	return ports.RemoteHostSnapshot{
+	return ports.BrokerDaemonObservation{
 		Endpoint:       endpoint,
 		DisplayOrigin:  endpoint,
 		Registration:   domain.RemoteRegistration{Endpoint: endpoint, Incarnation: [16]byte{0x10, byte(i + 1), 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xf0, 0x11}, Generation: domain.RemoteGeneration(i + 1)},
+		Policy:         testPolicy(),
 		Availability:   domain.RemoteAvailabilityReachable,
 		LastSuccess:    time.Unix(1700000000+int64(i), 0).UTC(),
 		InventoryKnown: true,
 // testSnapshot builds one valid publication for an epoch and revision.
 func testSnapshot(epoch ports.BrokerEpoch, revision ports.BrokerRevision) ports.BrokerSnapshot {
-	host := testHostAt(0)
+	daemon := testDaemonAt(0)
-	host.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(0, 0), testSessionAt(0, 1)}
+	daemon.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(0, 0), testSessionAt(0, 1)}
-	return ports.BrokerSnapshot{Epoch: epoch, Revision: revision, Hosts: []ports.RemoteHostSnapshot{host}}
+	return ports.BrokerSnapshot{Epoch: epoch, Revision: revision, Daemons: []ports.BrokerDaemonObservation{daemon}}
+}
+// testLocalSnapshot builds one valid publication whose first daemon is local:
+// the local daemon with one session followed by one remote daemon with one.
+func testLocalSnapshot(epoch ports.BrokerEpoch, revision ports.BrokerRevision) ports.BrokerSnapshot {
+	local := ports.BrokerDaemonObservation{
+		Local:          true,
+		DisplayOrigin:  "local",
+		Policy:         testPolicy(),
+		Availability:   domain.RemoteAvailabilityReachable,
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{testSessionAt(0, 0)},
+	}
+	remote := testDaemonAt(0)
+	remote.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(1, 0)}
+	return ports.BrokerSnapshot{Epoch: epoch, Revision: revision, Daemons: []ports.BrokerDaemonObservation{local, remote}}
 }
 // snapshotHub is a multi-subscriber publication hub standing in for the broker

M internal/adapters/brokeripc/limits_test.go +47 -6


@@ -24,10 +24,10 @@ import (
24		// session-less hosts.	24		// session-less hosts.
25		func TestSnapshotPartsLayoutRoundTrips(t *testing.T) {	25		func TestSnapshotPartsLayoutRoundTrips(t *testing.T) {
26		snapshot := testSnapshot(9, 12)	26		snapshot := testSnapshot(9, 12)
27	-	snapshot.Hosts = append(snapshot.Hosts, testHostAt(1))	27	+	snapshot.Daemons = append(snapshot.Daemons, testDaemonAt(1))
28		snapshot.Removed = []ports.BrokerHostTombstone{{	28		snapshot.Removed = []ports.BrokerHostTombstone{{
29		Endpoint: "retired@old:22",	29		Endpoint: "retired@old:22",
30	-	Registration: testHostAt(0).Registration,	30	+	Registration: testDaemonAt(0).Registration,
31		RetiredRevision: 3,	31		RetiredRevision: 3,
32		}}	32		}}
33		snapshot.Removed[0].Registration.Endpoint = "retired@old:22"	33		snapshot.Removed[0].Registration.Endpoint = "retired@old:22"

@@ -61,9 +61,9 @@ func TestSnapshotPartsLayoutRoundTrips(t *testing.T) {
61		}	61		}
62		require.True(t, found, "the transfer must commit")	62		require.True(t, found, "the transfer must commit")
63		require.Equal(t, snapshot.Revision, committed.Revision)	63		require.Equal(t, snapshot.Revision, committed.Revision)
64	-	require.Len(t, committed.Hosts, 2)	64	+	require.Len(t, committed.Daemons, 2)
65	-	require.Len(t, committed.Hosts[0].Sessions, 2)	65	+	require.Len(t, committed.Daemons[0].Sessions, 2)
66	-	for _, host := range committed.Hosts {	66	+	for _, host := range committed.Daemons {
67		for _, session := range host.Sessions {	67		for _, session := range host.Sessions {
68		require.Equal(t, []catalogue.RemoteCatalogTab{}, session.Tabs)	68		require.Equal(t, []catalogue.RemoteCatalogTab{}, session.Tabs)
69		}	69		}

@@ -72,13 +72,54 @@ func TestSnapshotPartsLayoutRoundTrips(t *testing.T) {
72		require.Equal(t, "retired@old:22", committed.Removed[0].Endpoint)	72		require.Equal(t, "retired@old:22", committed.Removed[0].Endpoint)
73		}	73		}
74			74
			75	+	// TestSnapshotPartsLocalDaemonLayoutRoundTrips proves the emitter and the
			76	+	// assembler agree on a local-first transfer: Begin advertises local_present,
			77	+	// the local daemon is index 0 with its session bound locally, and the committed
			78	+	// snapshot reproduces the local-first publication.
			79	+	func TestSnapshotPartsLocalDaemonLayoutRoundTrips(t *testing.T) {
			80	+	snapshot := testLocalSnapshot(4, 2)
			81	+	require.NoError(t, snapshot.Validate())
			82	+
			83	+	parts, err := snapshotParts(snapshot, 4, ports.BrokerConnectionID{4, 4}, 2)
			84	+	require.NoError(t, err)
			85	+	require.Len(t, parts, 1+2+2+1)
			86	+
			87	+	begin, ok := parts[0].Part.(brokerwire.SnapshotBegin)
			88	+	require.True(t, ok)
			89	+	require.True(t, begin.LocalPresent)
			90	+	require.Equal(t, uint32(2), begin.HostCount)
			91	+	require.Equal(t, uint32(2), begin.SessionCount)
			92	+
			93	+	assembler := brokerwire.NewSnapshotAssembler(4, ports.BrokerConnectionID{4, 4}, brokerwire.WithGeneration(2))
			94	+	var committed ports.BrokerSnapshot
			95	+	found := false
			96	+	for index, part := range parts {
			97	+	require.Equal(t, uint32(index), part.Index)
			98	+	done, assembled, err := assembler.Add(part)
			99	+	require.NoError(t, err, "part %d", index)
			100	+	if done {
			101	+	committed = assembled
			102	+	found = true
			103	+	}
			104	+	}
			105	+	require.True(t, found, "the transfer must commit")
			106	+	require.Equal(t, snapshot.Revision, committed.Revision)
			107	+	require.Len(t, committed.Daemons, 2)
			108	+	require.True(t, committed.Daemons[0].Local)
			109	+	require.Empty(t, committed.Daemons[0].Endpoint)
			110	+	require.Len(t, committed.Daemons[0].Sessions, 1)
			111	+	require.Equal(t, snapshot.Daemons[0].Sessions[0].Name, committed.Daemons[0].Sessions[0].Name)
			112	+	require.Equal(t, "user0@host0:22", committed.Daemons[1].Endpoint)
			113	+	require.Len(t, committed.Daemons[1].Sessions, 1)
			114	+	}
			115	+
75		// TestSnapshotPartsRefusesOverBoundInventory proves the emitter fails closed on	116		// TestSnapshotPartsRefusesOverBoundInventory proves the emitter fails closed on
76		// an inventory the peer's assembler would refuse, instead of silently sending a	117		// an inventory the peer's assembler would refuse, instead of silently sending a
77		// transfer that can never commit.	118		// transfer that can never commit.
78		func TestSnapshotPartsRefusesOverBoundInventory(t *testing.T) {	119		func TestSnapshotPartsRefusesOverBoundInventory(t *testing.T) {
79		snapshot := testSnapshot(1, 1)	120		snapshot := testSnapshot(1, 1)
80		over := make([]catalogue.RemoteCatalogSession, ports.BrokerMaxSessionsPerHost+1)	121		over := make([]catalogue.RemoteCatalogSession, ports.BrokerMaxSessionsPerHost+1)
81	-	snapshot.Hosts[0].Sessions = over	122	+	snapshot.Daemons[0].Sessions = over
82		_, err := snapshotParts(snapshot, 1, ports.BrokerConnectionID{1}, 1)	123		_, err := snapshotParts(snapshot, 1, ports.BrokerConnectionID{1}, 1)
83		require.Error(t, err)	124		require.Error(t, err)
84			125

M internal/adapters/brokeripc/session_test.go +35 -8

 	require.ErrorIs(t, session.CloseStream(ports.BrokerConnectionID{0x99}, 2), ports.BrokerAdmissionStale)
 }
+// TestOpenStreamAdmissionRoundTrips proves the attachment-admission contract
+// travels the IPC wire: a create-named request reaches the core with exactly
+// its admission and validated name.
+func TestOpenStreamAdmissionRoundTrips(t *testing.T) {
+	e := startEndpoint(t, Config{})
+	client, _ := e.pair()
+	core := e.authority.last()
+	require.NotNil(t, core)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	stream, err := client.OpenStream(ctx, ports.BrokerOpenStreamRequest{
+		Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionCreateNamed, Name: "work",
+		Local: true, Policy: testPolicy(),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, stream)
+	core.mu.Lock()
+	defer core.mu.Unlock()
+	require.Len(t, core.opens, 1)
+	require.Equal(t, ports.BrokerAdmissionCreateNamed, core.opens[0].Admission)
+	require.Equal(t, "work", core.opens[0].Name)
+	require.Equal(t, ports.BrokerStreamAttachment, core.opens[0].Purpose)
+	require.True(t, core.opens[0].Local)
+}
 // TestRegistrationAssignsScopeAtAccept proves the client adapter adopts exactly
 // the scope the listener assigned at accept.
 func TestRegistrationAssignsScopeAtAccept(t *testing.T) {
 	got := client.Snapshot()
 	require.Equal(t, e.epoch, got.Epoch)
-	require.Len(t, got.Hosts, 1)
+	require.Len(t, got.Daemons, 1)
-	require.Equal(t, snapshot.Hosts[0].Endpoint, got.Hosts[0].Endpoint)
+	require.Equal(t, snapshot.Daemons[0].Endpoint, got.Daemons[0].Endpoint)
-	require.Len(t, got.Hosts[0].Sessions, 2)
+	require.Len(t, got.Daemons[0].Sessions, 2)
-	require.Equal(t, snapshot.Hosts[0].Sessions[0].Name, got.Hosts[0].Sessions[0].Name)
+	require.Equal(t, snapshot.Daemons[0].Sessions[0].Name, got.Daemons[0].Sessions[0].Name)
 	select {
 	case <-sub.Changed():
 	snapshot := e.publish(e.epoch, 4)
 	require.Eventually(t, func() bool { return client.Snapshot().Revision == 4 }, 5*time.Second, 10*time.Millisecond)
-	client.RequestReconcile(snapshot.Hosts[0].Endpoint)
+	client.RequestReconcile(snapshot.Daemons[0].Endpoint)
 	require.Eventually(t, func() bool {
 		core.mu.Lock()
 		defer core.mu.Unlock()
-		return len(core.reconcile) == 1 && core.reconcile[0] == snapshot.Hosts[0].Endpoint
+		return len(core.reconcile) == 1 && core.reconcile[0] == snapshot.Daemons[0].Endpoint
 	}, 5*time.Second, 10*time.Millisecond)
 }
 func TestDomainFixturesAreValid(t *testing.T) {
 	snapshot := testSnapshot(1, 1)
 	require.NoError(t, snapshot.Validate())
-	for _, host := range snapshot.Hosts {
+	for _, host := range snapshot.Daemons {
 		require.NoError(t, ports.ValidateDurableHostProjection(host))
 	}
 	require.NoError(t, testPolicy().Validate())
 	catalogueSession := testSessionAt(0, 0)
 	require.False(t, strings.HasPrefix(catalogueSession.Name, " "))
-	require.NotEqual(t, domain.RemoteAvailabilityUnknown, testHostAt(0).Availability)
+	require.NotEqual(t, domain.RemoteAvailabilityUnknown, testDaemonAt(0).Availability)
 	require.True(t, errors.Is(errors.Join(ErrScopeMismatch, ports.BrokerAdmissionStale), ports.BrokerAdmissionStale))
 }

M internal/adapters/brokeripc/stream.go +2 -1

 		return
 	}
 	request := ports.BrokerOpenStreamRequest{
-		Epoch: m.Epoch, Purpose: m.Purpose, Local: m.Local,
+		Epoch: m.Epoch, Purpose: m.Purpose, Admission: m.Admission, Name: m.Name,
+		Local:      m.Local,
 		Connection: m.Connection, Stream: m.Stream,
 		Endpoint: m.Endpoint, Registration: m.Registration,
 		Target: m.Target, Env: m.Env, Policy: m.Policy,

M internal/adapters/brokerstore/README.md +6 -1


@@ -82,7 +82,12 @@ record remains authoritative for generation. Transient checking/error objects
82		are never persisted. Retirement tombstones are process-local fencing state and	82		are never persisted. Retirement tombstones are process-local fencing state and
83		are never durable: the registry's persistable copy and the store both clear	83		are never durable: the registry's persistable copy and the store both clear
84		`Snapshot.Removed` before writing, so reopening sees membership without stale	84		`Snapshot.Removed` before writing, so reopening sees membership without stale
85	-	tombstones. No environment, launch, or trust policy is guessed.	85	+	tombstones. Policy is membership authority, not observation state, so the
			86	+	durable observation format omits it: the loader re-stamps every restored
			87	+	observation from the matching `ports.BrokerHostRecord`, keeping membership the
			88	+	single policy authority. A local daemon observation is process-local and never
			89	+	durable: the store rejects one outright. No environment, launch, or trust policy
			90	+	is guessed.
86			91
87		Production cutover, lifecycle supervision, and IPC composition remain later	92		Production cutover, lifecycle supervision, and IPC composition remain later
88		phases. Close ordering must drain registry snapshot writers before releasing the	93		phases. Close ordering must drain registry snapshot writers before releasing the

M internal/adapters/brokerstore/legacy.go +14 -2

 				// Unbound v2/v3 cache data is validated and backed up, never promoted
 				// to authority. v4 can seed only its exact surviving incarnation.
 				if e.Host == h.Registration.Endpoint && e.Incarnation == h.Registration.Incarnation {
-					r.State.Snapshot.Hosts = append(r.State.Snapshot.Hosts, ports.RemoteHostSnapshot{Endpoint: e.Host, Registration: h.Registration, Availability: domain.RemoteAvailabilityUnknown, InventoryKnown: true, LastSuccess: e.FetchedAt, Sessions: e.Sessions})
+					// A legacy cache entry carries only observed sessions: daemon
+					// identity, incarnation, protocol version, and capabilities stay
+					// zero (never invented), and policy stays absent because the
+					// loader re-stamps it from membership.
+					r.State.Snapshot.Daemons = append(r.State.Snapshot.Daemons, ports.BrokerDaemonObservation{
+						Endpoint:       e.Host,
+						DisplayOrigin:  domain.RemoteDisplayOrigin(e.Host),
+						Registration:   h.Registration,
+						Availability:   domain.RemoteAvailabilityUnknown,
+						InventoryKnown: true,
+						LastSuccess:    e.FetchedAt,
+						Sessions:       e.Sessions,
+					})
 				}
 			}
 		}
 	}
-	if len(r.State.Snapshot.Hosts) > 0 {
+	if len(r.State.Snapshot.Daemons) > 0 {
 		var epoch [8]byte
 		if _, err = rand.Read(epoch[:]); err != nil {
 			return r, err

M internal/adapters/brokerstore/legacy_test.go +2 -2


@@ -60,10 +60,10 @@ func TestDefensiveCopiesAndConcurrentAccess(t *testing.T) {
60		h.Hosts[0].Policy.Trust = "changed"	60		h.Hosts[0].Policy.Trust = "changed"
61		snap, err := s.Load()	61		snap, err := s.Load()
62		require.NoError(t, err)	62		require.NoError(t, err)
63	-	snap.Hosts[0].Sessions[0].Tabs[0].Name = "changed"	63	+	snap.Daemons[0].Sessions[0].Tabs[0].Name = "changed"
64		again, err := s.Load()	64		again, err := s.Load()
65		require.NoError(t, err)	65		require.NoError(t, err)
66	-	require.Equal(t, "shell", again.Hosts[0].Sessions[0].Tabs[0].Name)	66	+	require.Equal(t, "shell", again.Daemons[0].Sessions[0].Tabs[0].Name)
67		hosts, err := s.LoadHosts()	67		hosts, err := s.LoadHosts()
68		require.NoError(t, err)	68		require.NoError(t, err)
69		require.Equal(t, "known-hosts", hosts.Hosts[0].Policy.Trust)	69		require.Equal(t, "known-hosts", hosts.Hosts[0].Policy.Trust)

M internal/adapters/brokerstore/store.go +90 -20


@@ -17,6 +17,7 @@ import (
17		"sync"	17		"sync"
18		"syscall"	18		"syscall"
19			19
			20	+	"github.com/bnema/vev/internal/domain"
20		"github.com/bnema/vev/internal/ports"	21		"github.com/bnema/vev/internal/ports"
21		"github.com/bnema/vev/pkg/safedir"	22		"github.com/bnema/vev/pkg/safedir"
22		)	23		)

@@ -286,14 +287,18 @@ func (s *Store) Store(snapshot ports.BrokerSnapshot) error {
286		}	287		}
287		// Removed tombstones and in-flight checking/failure detail are process-local	288		// Removed tombstones and in-flight checking/failure detail are process-local
288		// fencing and observation state; the durable snapshot never carries them, so	289		// fencing and observation state; the durable snapshot never carries them, so
289	-	// sanitize the caller's copy before validating the durable shape.	290	+	// sanitize the caller's copy before validating the durable shape. Policy is
			291	+	// membership authority, not observation state, so the durable format omits
			292	+	// it too: membership is the single policy authority and the loader re-stamps
			293	+	// every restored observation from the matching record.
290		snapshot = snapshot.Clone()	294		snapshot = snapshot.Clone()
291		snapshot.Removed = nil	295		snapshot.Removed = nil
292	-	for i := range snapshot.Hosts {	296	+	for i := range snapshot.Daemons {
293	-	snapshot.Hosts[i].Checking = false	297	+	snapshot.Daemons[i].Checking = false
294	-	snapshot.Hosts[i].LastFailure.Err = nil	298	+	snapshot.Daemons[i].LastFailure.Err = nil
			299	+	snapshot.Daemons[i].Policy = ports.BrokerPolicy{}
295		}	300		}
296	-	if err := snapshot.Validate(); err != nil {	301	+	if err := validateDurableSnapshot(snapshot); err != nil {
297		return err	302		return err
298		}	303		}
299		if s.writeEpoch != 0 && s.writeEpoch != snapshot.Epoch {	304		if s.writeEpoch != 0 && s.writeEpoch != snapshot.Epoch {

@@ -304,10 +309,10 @@ func (s *Store) Store(snapshot ports.BrokerSnapshot) error {
304		return ErrStale	309		return ErrStale
305		}	310		}
306		// Reject rather than partially adopt a queued publication from retired hosts.	311		// Reject rather than partially adopt a queued publication from retired hosts.
307	-	for _, h := range snapshot.Hosts {	312	+	for _, daemon := range snapshot.Daemons {
308		found := false	313		found := false
309		for _, a := range s.state.Hosts.Hosts {	314		for _, a := range s.state.Hosts.Hosts {
310	-	if h.Registration.Equal(a.Registration) {	315	+	if daemon.Registration.Equal(a.Registration) {
311		found = true	316		found = true
312		}	317		}
313		}	318		}

@@ -323,14 +328,15 @@ func (s *Store) Store(snapshot ports.BrokerSnapshot) error {
323		s.writeEpoch = snapshot.Epoch	328		s.writeEpoch = snapshot.Epoch
324		return nil	329		return nil
325		}	330		}
			331	+
326		func filter(snapshot ports.BrokerSnapshot, hosts ports.BrokerHosts) ports.BrokerSnapshot {	332		func filter(snapshot ports.BrokerSnapshot, hosts ports.BrokerHosts) ports.BrokerSnapshot {
327		out := snapshot.Clone()	333		out := snapshot.Clone()
328	-	out.Hosts = nil	334	+	out.Daemons = nil
329		out.Removed = nil	335		out.Removed = nil
330	-	for _, h := range snapshot.Hosts {	336	+	for _, daemon := range snapshot.Daemons {
331		for _, a := range hosts.Hosts {	337		for _, a := range hosts.Hosts {
332	-	if h.Registration.Equal(a.Registration) {	338	+	if daemon.Registration.Equal(a.Registration) {
333	-	out.Hosts = append(out.Hosts, h.Clone())	339	+	out.Daemons = append(out.Daemons, daemon.Clone())
334		}	340		}
335		}	341		}
336		}	342		}

@@ -360,32 +366,96 @@ func validate(st state) error {
360		return invalid("%v", err)	366		return invalid("%v", err)
361		}	367		}
362		if st.Snapshot.Epoch == 0 {	368		if st.Snapshot.Epoch == 0 {
363	-	if st.Snapshot.Revision != 0 \|\| len(st.Snapshot.Hosts) != 0 \|\| len(st.Snapshot.Removed) != 0 {	369	+	if st.Snapshot.Revision != 0 \|\| len(st.Snapshot.Daemons) != 0 \|\| len(st.Snapshot.Removed) != 0 {
364		return invalid("invalid empty snapshot")	370		return invalid("invalid empty snapshot")
365		}	371		}
366		return nil	372		return nil
367		}	373		}
368	-	if err := st.Snapshot.Validate(); err != nil {	374	+	if err := validateDurableSnapshot(st.Snapshot); err != nil {
369		return invalid("%v", err)	375		return invalid("%v", err)
370		}	376		}
371	-	for _, h := range st.Snapshot.Hosts {	377	+	for _, daemon := range st.Snapshot.Daemons {
372		found := false	378		found := false
373		for _, a := range st.Hosts.Hosts {	379		for _, a := range st.Hosts.Hosts {
374	-	if h.Registration.Equal(a.Registration) {	380	+	if daemon.Registration.Equal(a.Registration) {
375		found = true	381		found = true
376		}	382		}
377		}	383		}
378	-	if !found \|\| h.Checking \|\| h.LastFailure.Err != nil {	384	+	if !found \|\| daemon.Checking \|\| daemon.LastFailure.Err != nil {
379		return invalid("non-authoritative snapshot")	385		return invalid("non-authoritative snapshot")
380		}	386		}
381	-	// The store enforces the same durable projection rules the registry	387	+	}
382	-	// checks before publishing, so an accepted publication always persists.	388	+	return nil
383	-	if err := ports.ValidateDurableHostProjection(h); err != nil {	389	+	}
384	-	return invalid("%v", err)	390	+
			391	+	// validateDurableSnapshot reports whether a snapshot satisfies the durable
			392	+	// shape: an empty placeholder stays empty, and a populated snapshot carries
			393	+	// only non-local daemon observations bound to an exact valid registration with
			394	+	// a closed availability/failure range and a catalogue-valid inventory. Policy
			395	+	// and display authority are deliberately excluded: the durable format omits
			396	+	// policy (membership is the single policy authority and the loader re-stamps
			397	+	// it) and display hints are derived presentation state, never durable
			398	+	// authority. Transient checking and live failure causes are sanitized away by
			399	+	// the callers before this rule runs.
			400	+	func validateDurableSnapshot(snapshot ports.BrokerSnapshot) error {
			401	+	if snapshot.Epoch == 0 {
			402	+	if snapshot.Revision != 0 \|\| len(snapshot.Daemons) != 0 \|\| len(snapshot.Removed) != 0 {
			403	+	return errors.New("invalid empty snapshot")
			404	+	}
			405	+	return nil
			406	+	}
			407	+	if snapshot.Revision == 0 {
			408	+	return errors.New("snapshot has no revision")
			409	+	}
			410	+	if len(snapshot.Daemons) > ports.BrokerMaxDaemonsPerSnapshot {
			411	+	return errors.New("snapshot has too many daemons")
			412	+	}
			413	+	seen := make(map[string]struct{}, len(snapshot.Daemons))
			414	+	for _, daemon := range snapshot.Daemons {
			415	+	if err := validateDurableObservation(daemon); err != nil {
			416	+	return err
			417	+	}
			418	+	if _, duplicate := seen[daemon.Endpoint]; duplicate {
			419	+	return errors.New("snapshot has duplicate host")
			420	+	}
			421	+	seen[daemon.Endpoint] = struct{}{}
			422	+	}
			423	+	if len(snapshot.Removed) > ports.BrokerMaxTombstones {
			424	+	return errors.New("snapshot has too many tombstones")
			425	+	}
			426	+	for _, tombstone := range snapshot.Removed {
			427	+	if err := tombstone.Validate(); err != nil {
			428	+	return err
			429	+	}
			430	+	if _, live := seen[tombstone.Endpoint]; live {
			431	+	return errors.New("snapshot carries a live host as tombstone")
385		}	432		}
386		}	433		}
387		return nil	434		return nil
388		}	435		}
			436	+
			437	+	// validateDurableObservation reports whether one daemon observation may be
			438	+	// durable: it is remote-only (a local daemon observation is never durable), it
			439	+	// carries an exact valid registration matching its endpoint, and it satisfies
			440	+	// the ports durable projection rules shared with the registry.
			441	+	func validateDurableObservation(daemon ports.BrokerDaemonObservation) error {
			442	+	if daemon.Local {
			443	+	return errors.New("local daemon observation is never durable")
			444	+	}
			445	+	if err := domain.ValidateRemoteHostTarget(daemon.Endpoint); err != nil {
			446	+	return err
			447	+	}
			448	+	if err := daemon.Registration.Validate(); err != nil {
			449	+	return err
			450	+	}
			451	+	if daemon.Endpoint != daemon.Registration.Endpoint {
			452	+	return errors.New("observation endpoint does not match registration")
			453	+	}
			454	+	if len(daemon.Sessions) > 0 && !daemon.InventoryKnown {
			455	+	return errors.New("observation carries sessions without known inventory")
			456	+	}
			457	+	return ports.ValidateDurableHostProjection(daemon)
			458	+	}
389		func (s *Store) commit(next state) error {	459		func (s *Store) commit(next state) error {
390		if err := validate(next); err != nil {	460		if err := validate(next); err != nil {
391		return err	461		return err

M internal/adapters/brokerstore/store_test.go +41 -7

 	"github.com/stretchr/testify/require"
 )
+func testPolicy() ports.BrokerPolicy {
+	return ports.BrokerPolicy{ProtocolVersion: 1, CatalogSchemaVersion: 1, EnvironmentPolicy: protocol.EnvironmentPolicyDaemonOwned, Transport: "quic", Trust: "known-hosts", Launch: "explicit", Isolation: "user"}
+}
+// observation builds a remote daemon observation that satisfies the durable
+// shape: an exact registration, a derived display origin, and a reachable
+// availability. Policy is intentionally left absent: the loader stamps it from
+// membership, never from the durable snapshot.
+func observation(endpoint string, registration domain.RemoteRegistration) ports.BrokerDaemonObservation {
+	return ports.BrokerDaemonObservation{
+		Endpoint:      endpoint,
+		DisplayOrigin: domain.RemoteDisplayOrigin(endpoint),
+		Registration:  registration,
+		Availability:  domain.RemoteAvailabilityReachable,
+	}
+}
 func options(t *testing.T) Options {
 	t.Helper()
-	return Options{Dir: filepath.Join(t.TempDir(), "broker"), LegacyHosts: "testdata/hosts-v3.json", LegacyCache: "testdata/cache-v4.json", Policies: map[string]ports.BrokerPolicy{"user@arch": {ProtocolVersion: 1, CatalogSchemaVersion: 1, EnvironmentPolicy: protocol.EnvironmentPolicyDaemonOwned, Transport: "quic", Trust: "known-hosts", Launch: "explicit", Isolation: "user"}}}
+	return Options{Dir: filepath.Join(t.TempDir(), "broker"), LegacyHosts: "testdata/hosts-v3.json", LegacyCache: "testdata/cache-v4.json", Policies: map[string]ports.BrokerPolicy{"user@arch": testPolicy()}}
 }
 func TestPriorFixtures(t *testing.T) {
 	for h := 1; h <= 3; h++ {
 				snap, err := s.Load()
 				require.NoError(t, err)
 				if h == 3 && c == 4 {
-					require.Len(t, snap.Hosts, 1)
+					require.Len(t, snap.Daemons, 1)
-					require.Len(t, snap.Hosts[0].Sessions, 1)
+					require.Len(t, snap.Daemons[0].Sessions, 1)
-					require.Equal(t, "t_work", snap.Hosts[0].Sessions[0].Tabs[0].ID)
+					require.Equal(t, "t_work", snap.Daemons[0].Sessions[0].Tabs[0].ID)
 				} else {
-					require.Empty(t, snap.Hosts)
+					require.Empty(t, snap.Daemons)
 				}
 				require.NoError(t, s.Close())
 				o.LegacyHosts = "missing"
 	// A queued publication from the retired incarnation is refused even though
 	// its revision is newer.
-	require.ErrorIs(t, s.Store(ports.BrokerSnapshot{Epoch: 9, Revision: 1, Hosts: []ports.RemoteHostSnapshot{{Endpoint: base.Registration.Endpoint, Registration: base.Registration, Availability: domain.RemoteAvailabilityReachable}}}), ErrStale)
+	require.ErrorIs(t, s.Store(ports.BrokerSnapshot{Epoch: 9, Revision: 1, Daemons: []ports.BrokerDaemonObservation{observation(base.Registration.Endpoint, base.Registration)}}), ErrStale)
 	// Re-adding the endpoint needs a fresh incarnation; the retired
 	// observation never comes back for it.
 		defer s.Close()
 		got, err := s.Load()
 		require.NoError(t, err)
-		require.Empty(t, got.Hosts)
+		require.Empty(t, got.Daemons)
 		gotH, err := s.LoadHosts()
 		require.NoError(t, err)
 		require.Equal(t, h.Hosts, gotH.Hosts)
 	})
 }
+// TestLocalDaemonObservationIsNeverDurable pins the durable boundary: a local
+// daemon observation is process-local state and the store refuses it outright,
+// so it can never become durable authority.
+func TestLocalDaemonObservationIsNeverDurable(t *testing.T) {
+	s, err := OpenOffline(options(t))
+	require.NoError(t, err)
+	defer s.Close()
+	err = s.Store(ports.BrokerSnapshot{Epoch: 9, Revision: 1, Daemons: []ports.BrokerDaemonObservation{{
+		Local:         true,
+		DisplayOrigin: "local",
+		Policy:        testPolicy(),
+		Availability:  domain.RemoteAvailabilityReachable,
+	}}})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "never durable")
+}

M internal/adapters/brokerwire/codec.go +195 -80

 func openStreamToWire(m OpenStream) (*wire.OpenStream, error) {
 	request := ports.BrokerOpenStreamRequest{
-		Epoch: m.Epoch, Purpose: m.Purpose, Local: m.Local,
+		Epoch: m.Epoch, Purpose: m.Purpose, Admission: m.Admission, Name: m.Name,
+		Local:      m.Local,
 		Connection: m.Connection, Stream: m.Stream,
 		Endpoint: m.Endpoint, Registration: m.Registration,
 		Target: m.Target, Env: m.Env, Policy: m.Policy,
 	default:
 		return nil, ErrInvalidMessage
 	}
+	admission, err := admissionToWire(m.Admission)
+	if err != nil {
+		return nil, err
+	}
 	out := &wire.OpenStream{
 		Ref:     refToWire(m.Epoch, m.Connection, m.Stream),
 		Purpose: purpose, Local: m.Local, Endpoint: m.Endpoint,
 		Env:    append([]string(nil), m.Env...),
 		Policy: policyToWire(m.Policy),
+		// The admission taxonomy mirrors the port values (0 none, 1 exact,
+		// 2 create named, 3 create ephemeral); the name travels only for the
+		// create-named variant.
+		Admission: admission, Name: m.Name,
 	}
 	if !m.Local {
 		out.Registration = registrationToWire(m.Registration)
 	}
-	if m.Purpose == ports.BrokerStreamAttachment {
+	// Only exact attach/resume carries a session target; a creation
-		target := m.Target
+	// admission carries a zero target that must never be encoded as a
-		out.Target = exactTargetToWire(target)
+	// present message.
+	if m.Purpose == ports.BrokerStreamAttachment && m.Admission == ports.BrokerAdmissionExact {
+		out.Target = exactTargetToWire(m.Target)
 	}
 	return out, nil
 }
+// admissionToWire maps the closed admission taxonomy onto its wire code.
+func admissionToWire(admission ports.BrokerStreamAdmission) (uint32, error) {
+	switch admission {
+	case 0:
+		return 0, nil
+	case ports.BrokerAdmissionExact:
+		return 1, nil
+	case ports.BrokerAdmissionCreateNamed:
+		return 2, nil
+	case ports.BrokerAdmissionCreateEphemeral:
+		return 3, nil
+	default:
+		return 0, errConvertRange
+	}
+}
+// admissionFromWire maps a wire admission code onto the closed taxonomy.
+func admissionFromWire(value uint32) (ports.BrokerStreamAdmission, error) {
+	switch value {
+	case 0:
+		return 0, nil
+	case 1:
+		return ports.BrokerAdmissionExact, nil
+	case 2:
+		return ports.BrokerAdmissionCreateNamed, nil
+	case 3:
+		return ports.BrokerAdmissionCreateEphemeral, nil
+	default:
+		return 0, errConvertRange
+	}
+}
 func openStreamFromWire(message *wire.OpenStream) (OpenStream, error) {
 	var out OpenStream
 	if message == nil {
 	default:
 		return OpenStream{}, ErrInvalidMessage
 	}
+	admission, err := admissionFromWire(message.GetAdmission())
+	if err != nil {
+		return OpenStream{}, ErrInvalidMessage
+	}
 	local := message.GetLocal()
 	var registration domain.RemoteRegistration
 	if !local {
 	} else if message.GetRegistration() != nil {
 		return OpenStream{}, ErrInvalidMessage
 	}
+	// Only exact attach/resume carries a session target. A present target on
+	// any other admission or purpose is malformed.
 	var target protocol.ExactSessionTarget
-	if purpose == ports.BrokerStreamAttachment {
+	if purpose == ports.BrokerStreamAttachment && admission == ports.BrokerAdmissionExact {
 		target, err = exactTargetFromWire(message.GetTarget())
 		if err != nil {
 			return OpenStream{}, ErrInvalidMessage
 	endpoint := message.GetEndpoint()
 	candidate := OpenStream{
 		Epoch: epoch, Connection: connection, Stream: stream,
-		Purpose: purpose, Local: local, Endpoint: endpoint,
+		Purpose: purpose, Admission: admission, Name: message.GetName(),
+		Local:        local,
+		Endpoint:     endpoint,
 		Registration: registration, Target: target, Env: env, Policy: policy,
 	}
 	request := ports.BrokerOpenStreamRequest{
-		Epoch: candidate.Epoch, Purpose: candidate.Purpose, Local: candidate.Local,
+		Epoch: candidate.Epoch, Purpose: candidate.Purpose,
+		Admission: candidate.Admission, Name: candidate.Name, Local: candidate.Local,
 		Connection: candidate.Connection, Stream: candidate.Stream,
 		Endpoint: candidate.Endpoint, Registration: candidate.Registration,
 		Target: candidate.Target, Env: candidate.Env, Policy: candidate.Policy,
 	}
 	switch part := m.Part.(type) {
 	case SnapshotBegin:
-		if part.HostCount > ports.BrokerMaxHosts ||
+		if part.HostCount > ports.BrokerMaxDaemonsPerSnapshot ||
-			part.SessionCount > ports.BrokerMaxHosts*ports.BrokerMaxSessionsPerHost ||
+			part.SessionCount > ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost ||
 			part.TombstoneCount > ports.BrokerMaxTombstones {
 			return nil, ErrTooLarge
 		}
+		if part.LocalPresent && part.HostCount == 0 {
+			return nil, ErrInvalidMessage
+		}
 		out.Part = &wire.SnapshotPart_Begin{Begin: &wire.SnapshotBegin{
 			HostCount: part.HostCount, SessionCount: part.SessionCount, TombstoneCount: part.TombstoneCount,
+			LocalPresent: part.LocalPresent,
 		}}
 	case *SnapshotBegin:
 		if part == nil {
 			return nil, ErrInvalidMessage
 		}
 		return snapshotPartToWire(SnapshotPart{Epoch: m.Epoch, Connection: m.Connection, Generation: m.Generation, Revision: m.Revision, Index: m.Index, Part: *part})
-	case SnapshotHostPart:
+	case SnapshotDaemonPart:
-		converted, err := snapshotHostToWire(part)
+		converted, err := snapshotDaemonToWire(part)
 		if err != nil {
 			return nil, err
 		}
-		out.Part = &wire.SnapshotPart_Host{Host: converted}
+		out.Part = &wire.SnapshotPart_Daemon{Daemon: converted}
-	case *SnapshotHostPart:
+	case *SnapshotDaemonPart:
 		if part == nil {
 			return nil, ErrInvalidMessage
 		}
 		if payload.Begin == nil {
 			return SnapshotPart{}, ErrInvalidMessage
 		}
-		if payload.Begin.GetHostCount() > ports.BrokerMaxHosts ||
+		if payload.Begin.GetHostCount() > ports.BrokerMaxDaemonsPerSnapshot ||
-			payload.Begin.GetSessionCount() > ports.BrokerMaxHosts*ports.BrokerMaxSessionsPerHost ||
+			payload.Begin.GetSessionCount() > ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost ||
 			payload.Begin.GetTombstoneCount() > ports.BrokerMaxTombstones {
 			return SnapshotPart{}, ErrTooLarge
 		}
+		if payload.Begin.GetLocalPresent() && payload.Begin.GetHostCount() == 0 {
+			return SnapshotPart{}, ErrInvalidMessage
+		}
 		part.Part = SnapshotBegin{
 			HostCount:      payload.Begin.GetHostCount(),
 			SessionCount:   payload.Begin.GetSessionCount(),
 			TombstoneCount: payload.Begin.GetTombstoneCount(),
+			LocalPresent:   payload.Begin.GetLocalPresent(),
 		}
-	case *wire.SnapshotPart_Host:
+	case *wire.SnapshotPart_Daemon:
-		if payload.Host == nil {
+		if payload.Daemon == nil {
 			return SnapshotPart{}, ErrInvalidMessage
 		}
-		host, index, sessionCount, err := snapshotHostFromWire(payload.Host)
+		daemon, index, sessionCount, err := snapshotDaemonFromWire(payload.Daemon)
 		if err != nil {
 			return SnapshotPart{}, err
 		}
-		part.Part = SnapshotHostPart{HostIndex: index, Host: host, SessionCount: sessionCount}
+		part.Part = SnapshotDaemonPart{HostIndex: index, Daemon: daemon, SessionCount: sessionCount}
 	case *wire.SnapshotPart_Session:
 		if payload.Session == nil {
 			return SnapshotPart{}, ErrInvalidMessage
 		}
-		session, hostIndex, sessionIndex, err := snapshotSessionFromWire(payload.Session)
+		session, hostIndex, sessionIndex, local, err := snapshotSessionFromWire(payload.Session)
 		if err != nil {
 			return SnapshotPart{}, err
 		}
-		part.Part = SnapshotSessionPart{HostIndex: hostIndex, SessionIndex: sessionIndex, Session: session}
+		part.Part = SnapshotSessionPart{HostIndex: hostIndex, SessionIndex: sessionIndex, Local: local, Session: session}
 	case *wire.SnapshotPart_Tombstone:
 		if payload.Tombstone == nil {
 			return SnapshotPart{}, ErrInvalidMessage
 	return part, nil
 }
-func snapshotHostToWire(part SnapshotHostPart) (*wire.SnapshotHost, error) {
+// snapshotDaemonToWire converts one daemon part losslessly. It refuses a
-	if part.HostIndex >= ports.BrokerMaxHosts {
+// malformed local/remote authority pairing, a partial identity, an
+// out-of-range enum or rank, a session inventory that could not be durable,
+// inline sessions (they travel separately), and any index or count above
+// the snapshot bounds.
+func snapshotDaemonToWire(part SnapshotDaemonPart) (*wire.SnapshotDaemon, error) {
+	if part.HostIndex >= ports.BrokerMaxDaemonsPerSnapshot {
 		return nil, ErrTooLarge
 	}
-	host := part.Host
+	daemon := part.Daemon
-	if err := validateSnapshotHostFields(host); err != nil {
+	if err := validateSnapshotDaemonFields(daemon); err != nil {
 		return nil, err
 	}
-	if err := host.Registration.Validate(); err != nil {
+	if err := daemon.Validate(); err != nil {
-		return nil, ErrInvalidMessage
-	}
-	if host.Endpoint != host.Registration.Endpoint {
 		return nil, ErrInvalidMessage
 	}
-	if err := ports.ValidateDurableHostProjection(host); err != nil {
+	if !daemon.Local {
-		return nil, ErrInvalidMessage
+		if err := ports.ValidateDurableHostProjection(daemon); err != nil {
+			return nil, ErrInvalidMessage
+		}
 	}
-	if len(host.Sessions) != 0 {
+	if len(daemon.Sessions) != 0 {
 		return nil, ErrInvalidMessage
 	}
 	if part.SessionCount > ports.BrokerMaxSessionsPerHost {
 		return nil, ErrTooLarge
 	}
-	lastAttemptSeconds, lastAttemptNanos := brokerTimeToWire(host.LastAttempt)
+	lastAttemptSeconds, lastAttemptNanos := brokerTimeToWire(daemon.LastAttempt)
-	lastSuccessSeconds, lastSuccessNanos := brokerTimeToWire(host.LastSuccess)
+	lastSuccessSeconds, lastSuccessNanos := brokerTimeToWire(daemon.LastSuccess)
-	nextDueSeconds, nextDueNanos := brokerTimeToWire(host.NextDue)
+	nextDueSeconds, nextDueNanos := brokerTimeToWire(daemon.NextDue)
-	return &wire.SnapshotHost{
+	var registration *wire.RemoteRegistration
-		HostIndex: part.HostIndex, Endpoint: host.Endpoint, DisplayOrigin: host.DisplayOrigin,
+	if !daemon.Local {
-		Rank: uint32(host.Rank), Registration: registrationToWire(host.Registration),
+		registration = registrationToWire(daemon.Registration)
-		Availability: uint32(host.Availability), Checking: host.Checking,
+	}
+	var incarnation []byte
+	if !daemon.Incarnation.IsZero() {
+		incarnation = append([]byte(nil), daemon.Incarnation[:]...)
+	}
+	return &wire.SnapshotDaemon{
+		HostIndex: part.HostIndex, Local: daemon.Local,
+		Endpoint: daemon.Endpoint, DisplayOrigin: daemon.DisplayOrigin,
+		Rank: uint32(daemon.Rank), Registration: registration,
+		Policy:         policyToWire(daemon.Policy),
+		DaemonIdentity: string(daemon.Identity), DaemonIncarnation: incarnation,
+		ProtocolVersion: uint32(daemon.ProtocolVersion), Capabilities: daemon.Capabilities,
+		Availability: uint32(daemon.Availability), Checking: daemon.Checking,
 		LastAttempt:         &wire.BrokerTimestamp{Seconds: lastAttemptSeconds, Nanos: lastAttemptNanos},
 		LastSuccess:         &wire.BrokerTimestamp{Seconds: lastSuccessSeconds, Nanos: lastSuccessNanos},
 		NextDue:             &wire.BrokerTimestamp{Seconds: nextDueSeconds, Nanos: nextDueNanos},
-		ConsecutiveFailures: uint64(host.ConsecutiveFailures), FailureEpisode: host.FailureEpisode,
+		ConsecutiveFailures: uint64(daemon.ConsecutiveFailures), FailureEpisode: daemon.FailureEpisode,
-		FailureKind:    uint32(host.LastFailure.Kind),
+		FailureKind:    uint32(daemon.LastFailure.Kind),
-		InventoryKnown: host.InventoryKnown, SessionCount: part.SessionCount,
+		InventoryKnown: daemon.InventoryKnown, SessionCount: part.SessionCount,
 	}, nil
 }
-func snapshotHostFromWire(message *wire.SnapshotHost) (ports.RemoteHostSnapshot, uint32, uint32, error) {
+func snapshotDaemonFromWire(message *wire.SnapshotDaemon) (ports.BrokerDaemonObservation, uint32, uint32, error) {
-	var host ports.RemoteHostSnapshot
+	var daemon ports.BrokerDaemonObservation
 	if message == nil {
-		return host, 0, 0, ErrInvalidMessage
+		return daemon, 0, 0, ErrInvalidMessage
 	}
-	if message.GetHostIndex() >= ports.BrokerMaxHosts {
+	if message.GetHostIndex() >= ports.BrokerMaxDaemonsPerSnapshot {
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrTooLarge
+		return daemon, 0, 0, ErrTooLarge
 	}
+	local := message.GetLocal()
 	endpoint := message.GetEndpoint()
-	if err := validateBrokerEndpoint(endpoint); err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, err
-	}
 	origin := message.GetDisplayOrigin()
 	if err := validateBrokerOrigin(origin); err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, err
+		return daemon, 0, 0, err
 	}
-	registration, err := registrationFromWire(message.GetRegistration())
+	var registration domain.RemoteRegistration
+	if local {
+		if message.GetRegistration() != nil || endpoint != "" {
+			return daemon, 0, 0, ErrInvalidMessage
+		}
+	} else {
+		if err := validateBrokerEndpoint(endpoint); err != nil {
+			return daemon, 0, 0, err
+		}
+		converted, err := registrationFromWire(message.GetRegistration())
+		if err != nil {
+			return daemon, 0, 0, ErrInvalidMessage
+		}
+		if endpoint != converted.Endpoint {
+			return daemon, 0, 0, ErrInvalidMessage
+		}
+		registration = converted
+	}
+	policy, err := policyFromWire(message.GetPolicy())
 	if err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrInvalidMessage
+		return daemon, 0, 0, ErrInvalidMessage
 	}
-	if endpoint != registration.Endpoint {
+	raw := message.GetDaemonIncarnation()
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrInvalidMessage
+	if len(raw) != 0 && len(raw) != len(daemon.Incarnation) {
+		return daemon, 0, 0, errConvertRange
+	}
+	if len(raw) == len(daemon.Incarnation) {
+		copy(daemon.Incarnation[:], raw)
+	}
+	protocolVersion, err := brokerEnum16[uint16](message.GetProtocolVersion())
+	if err != nil {
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	availability, err := brokerEnum8[domain.RemoteAvailability](message.GetAvailability())
 	if err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, err
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	if availability < domain.RemoteAvailabilityUnknown || availability > domain.RemoteAvailabilityInvalidResponse {
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrInvalidMessage
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	failureKind, err := brokerEnum8[domain.RemoteFailureKind](message.GetFailureKind())
 	if err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, err
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	if failureKind > domain.RemoteFailureInvalidResponse {
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrInvalidMessage
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	lastAttempt, err := brokerTimeFromWire(message.GetLastAttempt().GetSeconds(), message.GetLastAttempt().GetNanos())
 	if err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrInvalidMessage
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	lastSuccess, err := brokerTimeFromWire(message.GetLastSuccess().GetSeconds(), message.GetLastSuccess().GetNanos())
 	if err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrInvalidMessage
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	nextDue, err := brokerTimeFromWire(message.GetNextDue().GetSeconds(), message.GetNextDue().GetNanos())
 	if err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrInvalidMessage
+		return daemon, 0, 0, ErrInvalidMessage
 	}
 	if message.GetConsecutiveFailures() > math.MaxUint32 {
-		return ports.RemoteHostSnapshot{}, 0, 0, errConvertRange
+		return daemon, 0, 0, errConvertRange
 	}
-	sessionCount := message.GetSessionCount()
+	if message.GetSessionCount() > ports.BrokerMaxSessionsPerHost {
-	if sessionCount > ports.BrokerMaxSessionsPerHost {
+		return daemon, 0, 0, ErrTooLarge
-		return ports.RemoteHostSnapshot{}, 0, 0, ErrTooLarge
 	}
-	host = ports.RemoteHostSnapshot{
+	daemon = ports.BrokerDaemonObservation{
-		Endpoint: endpoint, DisplayOrigin: origin, Rank: int(message.GetRank()),
+		Local: local, Endpoint: endpoint, DisplayOrigin: origin, Rank: int(message.GetRank()),
-		Registration: registration, Availability: availability, Checking: message.GetChecking(),
+		Registration: registration, Policy: policy,
+		Identity: ports.BrokerDaemonIdentity(message.GetDaemonIdentity()), Incarnation: daemon.Incarnation,
+		ProtocolVersion: protocolVersion, Capabilities: message.GetCapabilities(),
+		Availability: availability, Checking: message.GetChecking(),
 		LastAttempt: lastAttempt, LastSuccess: lastSuccess, NextDue: nextDue,
 		ConsecutiveFailures: uint(message.GetConsecutiveFailures()), FailureEpisode: message.GetFailureEpisode(),
 		LastFailure:    domain.RemoteFailure{Kind: failureKind},
 		InventoryKnown: message.GetInventoryKnown(),
 		Sessions:       []catalogue.RemoteCatalogSession{},
 	}
-	if err := validateSnapshotHostFields(host); err != nil {
+	if err := validateSnapshotDaemonFields(daemon); err != nil {
-		return ports.RemoteHostSnapshot{}, 0, 0, err
+		return daemon, 0, 0, err
 	}
-	return host, message.GetHostIndex(), message.GetSessionCount(), nil
+	if err := daemon.Validate(); err != nil {
+		return daemon, 0, 0, ErrInvalidMessage
+	}
+	return daemon, message.GetHostIndex(), message.GetSessionCount(), nil
 }
 func snapshotSessionToWire(part SnapshotSessionPart) (*wire.SnapshotSession, error) {
-	if part.HostIndex >= ports.BrokerMaxHosts {
+	if part.Local {
+		if part.HostIndex != 0 {
+			return nil, ErrInvalidMessage
+		}
+	} else if part.HostIndex >= ports.BrokerMaxDaemonsPerSnapshot {
 		return nil, ErrTooLarge
 	}
 	if part.SessionIndex >= ports.BrokerMaxSessionsPerHost {
 	}
 	return &wire.SnapshotSession{
 		HostIndex: part.HostIndex, SessionIndex: part.SessionIndex,
+		Local:   part.Local,
 		Session: catalogSessionToWire(part.Session),
 	}, nil
 }
-func snapshotSessionFromWire(message *wire.SnapshotSession) (catalogue.RemoteCatalogSession, uint32, uint32, error) {
+func snapshotSessionFromWire(message *wire.SnapshotSession) (catalogue.RemoteCatalogSession, uint32, uint32, bool, error) {
 	var session catalogue.RemoteCatalogSession
 	if message == nil {
-		return session, 0, 0, ErrInvalidMessage
+		return session, 0, 0, false, ErrInvalidMessage
 	}
-	if message.GetHostIndex() >= ports.BrokerMaxHosts {
+	local := message.GetLocal()
-		return catalogue.RemoteCatalogSession{}, 0, 0, ErrTooLarge
+	if local {
+		if message.GetHostIndex() != 0 {
+			return session, 0, 0, false, ErrInvalidMessage
+		}
+	} else if message.GetHostIndex() >= ports.BrokerMaxDaemonsPerSnapshot {
+		return session, 0, 0, false, ErrTooLarge
 	}
 	if message.GetSessionIndex() >= ports.BrokerMaxSessionsPerHost {
-		return catalogue.RemoteCatalogSession{}, 0, 0, ErrTooLarge
+		return session, 0, 0, false, ErrTooLarge
 	}
 	converted, err := catalogSessionFromWire(message.GetSession())
 	if err != nil {
-		return catalogue.RemoteCatalogSession{}, 0, 0, err
+		return session, 0, 0, false, err
 	}
-	return converted, message.GetHostIndex(), message.GetSessionIndex(), nil
+	return converted, message.GetHostIndex(), message.GetSessionIndex(), local, nil
 }
 func operationResultToWire(m OperationResult) (*wire.OperationResult, error) {

M internal/adapters/brokerwire/codec_test.go +205 -47

 	}
 }
-func testHostSnapshot() ports.RemoteHostSnapshot {
+// testDaemonObservation builds one observed, catalogue-valid remote daemon
-	return ports.RemoteHostSnapshot{
+// projection. Sessions are empty: they travel as separate parts.
-		Endpoint:       "dev@host:22",
+func testDaemonObservation() ports.BrokerDaemonObservation {
-		DisplayOrigin:  "dev@host",
+	return ports.BrokerDaemonObservation{
-		Rank:           2,
+		Endpoint:        "dev@host:22",
-		Registration:   testRegistration(),
+		DisplayOrigin:   "dev@host",
+		Rank:            2,
+		Registration:    testRegistration(),
+		Policy:          testPolicy(),
+		Identity:        ports.BrokerDaemonIdentity("authed-daemon"),
+		Incarnation:     ports.BrokerDaemonIncarnation{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
+		ProtocolVersion: protocol.Version,
+		Capabilities:    protocol.CapabilityResume | protocol.CapabilityUDP,
+		Availability:    domain.RemoteAvailabilityReachable,
+		Checking:        true,
+		LastAttempt:     time.Unix(1700000000, 1).UTC(),
+		LastSuccess:     time.Unix(1700000001, 2).UTC(),
+		NextDue:         time.Unix(1700000002, 3).UTC(),
+		FailureEpisode:  6,
+		LastFailure:     domain.RemoteFailure{Kind: domain.RemoteFailureTransport},
+		InventoryKnown:  true,
+		Sessions:        []catalogue.RemoteCatalogSession{},
+	}
+}
+// testLocalDaemonObservation builds the local daemon projection: no endpoint,
+// no registration, always a valid policy, and an explicit availability.
+func testLocalDaemonObservation() ports.BrokerDaemonObservation {
+	return ports.BrokerDaemonObservation{
+		Local:          true,
+		DisplayOrigin:  "local",
+		Policy:         testPolicy(),
 		Availability:   domain.RemoteAvailabilityReachable,
-		Checking:       true,
-		LastAttempt:    time.Unix(1700000000, 1).UTC(),
-		LastSuccess:    time.Unix(1700000001, 2).UTC(),
-		NextDue:        time.Unix(1700000002, 3).UTC(),
-		FailureEpisode: 6,
-		LastFailure:    domain.RemoteFailure{Kind: domain.RemoteFailureTransport},
 		InventoryKnown: true,
 		Sessions:       []catalogue.RemoteCatalogSession{},
 	}
 		{"add_host", AddHost{Epoch: 7, Connection: connection, Operation: operation, Endpoint: "dev@host:22"}, 105},
 		{"remove_host", RemoveHost{Epoch: 7, Connection: connection, Operation: operation, Endpoint: "dev@host:22"}, 106},
 		{"reconcile", Reconcile{Epoch: 7, Connection: connection, Registration: testRegistration()}, 107},
-		{"open_stream", OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: []string{"TERM=xterm"}, Policy: testPolicy()}, 108},
+		{"open_stream", OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: []string{"TERM=xterm"}, Policy: testPolicy()}, 108},
 		{"client_stream_data", ClientStreamData{Epoch: 7, Connection: connection, Stream: 3, Data: []byte("frame")}, 109},
 		{"close_stream", CloseStream{Epoch: 7, Connection: connection, Stream: 3}, 110},
 	}
 	}
 }
+// TestBrokerOpenStreamAdmissionVariants pins the attachment-admission
+// contract: exact, create-named, and create-ephemeral round-trip, control
+// carries none, and wrong admission/purpose/name/target combinations are
+// refused exactly like ports.BrokerOpenStreamRequest.Validate.
+func TestBrokerOpenStreamAdmissionVariants(t *testing.T) {
+	connection := testConnectionID(0x11)
+	base := func() OpenStream {
+		return OpenStream{
+			Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment,
+			Endpoint: "dev@host:22", Registration: testRegistration(), Policy: testPolicy(),
+		}
+	}
+	roundTrips := []struct {
+		name    string
+		message OpenStream
+	}{
+		{"exact", func() OpenStream {
+			message := base()
+			message.Admission = ports.BrokerAdmissionExact
+			message.Target = testTarget()
+			return message
+		}()},
+		{"create named", func() OpenStream {
+			message := base()
+			message.Admission = ports.BrokerAdmissionCreateNamed
+			message.Name = "work"
+			return message
+		}()},
+		{"create ephemeral", func() OpenStream {
+			message := base()
+			message.Admission = ports.BrokerAdmissionCreateEphemeral
+			return message
+		}()},
+		{"control carries none", OpenStream{
+			Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamControl,
+			Local: true, Policy: testPolicy(),
+		}},
+	}
+	for _, tc := range roundTrips {
+		t.Run(tc.name, func(t *testing.T) {
+			raw := mustEncodeClient(t, tc.message)
+			decoded, err := DecodeClient(raw, testEnvelopeCeiling, testChunkCeiling)
+			require.NoError(t, err)
+			require.Equal(t, tc.message, decoded)
+		})
+	}
+	t.Run("wrong combinations refused", func(t *testing.T) {
+		exact := func() OpenStream {
+			message := base()
+			message.Admission = ports.BrokerAdmissionExact
+			message.Target = testTarget()
+			return message
+		}
+		cases := map[string]OpenStream{
+			"attachment without admission": func() OpenStream { m := base(); return m }(),
+			"exact with name": func() OpenStream {
+				m := exact()
+				m.Name = "work"
+				return m
+			}(),
+			"named with target": func() OpenStream {
+				m := base()
+				m.Admission = ports.BrokerAdmissionCreateNamed
+				m.Name = "work"
+				m.Target = testTarget()
+				return m
+			}(),
+			"named without name": func() OpenStream {
+				m := base()
+				m.Admission = ports.BrokerAdmissionCreateNamed
+				return m
+			}(),
+			"ephemeral with name": func() OpenStream {
+				m := base()
+				m.Admission = ports.BrokerAdmissionCreateEphemeral
+				m.Name = "work"
+				return m
+			}(),
+			"control with admission": OpenStream{
+				Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamControl,
+				Local: true, Policy: testPolicy(), Admission: ports.BrokerAdmissionExact,
+			},
+		}
+		for name, message := range cases {
+			t.Run(name, func(t *testing.T) {
+				_, err := EncodeClient(message, testEnvelopeCeiling, testChunkCeiling)
+				require.ErrorIs(t, err, ErrInvalidMessage)
+			})
+		}
+	})
+	t.Run("unknown admission code refused on decode", func(t *testing.T) {
+		message := base()
+		message.Admission = ports.BrokerAdmissionExact
+		message.Target = testTarget()
+		raw := mustEncodeClient(t, message)
+		envelope := &wire.BrokerClientEnvelope{}
+		require.NoError(t, wire.ScanEnvelope(envelope, raw))
+		require.NoError(t, proto.Unmarshal(raw, envelope))
+		envelope.GetOpenStream().Admission = 9
+		mutated, err := proto.Marshal(envelope)
+		require.NoError(t, err)
+		_, err = DecodeClient(mutated, testEnvelopeCeiling, testChunkCeiling)
+		require.ErrorIs(t, err, ErrInvalidMessage)
+	})
+}
+// TestBrokerSnapshotDaemonByteForByte proves the daemon and session parts are
+// byte-for-byte stable across an encode/decode/re-encode cycle, including an
+// observed identity/incarnation/version/capability set, the local daemon, and a
+// locally-bound session.
+func TestBrokerSnapshotDaemonByteForByte(t *testing.T) {
+	connection := testConnectionID(0x11)
+	messages := []struct {
+		name    string
+		message SnapshotPart
+	}{
+		{"observed remote daemon", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 1, Part: SnapshotDaemonPart{HostIndex: 1, Daemon: testDaemonObservation(), SessionCount: 1}}},
+		{"local daemon", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 0, Part: SnapshotDaemonPart{HostIndex: 0, Daemon: testLocalDaemonObservation(), SessionCount: 1}}},
+		{"local session", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 2, Part: SnapshotSessionPart{HostIndex: 0, SessionIndex: 0, Local: true, Session: testCatalogSession()}}},
+	}
+	for _, tc := range messages {
+		t.Run(tc.name, func(t *testing.T) {
+			raw := mustEncodeServer(t, tc.message)
+			decoded, err := DecodeServer(raw, testEnvelopeCeiling, testChunkCeiling)
+			require.NoError(t, err)
+			require.Equal(t, tc.message, decoded)
+			again, err := EncodeServer(decoded, testEnvelopeCeiling, testChunkCeiling)
+			require.NoError(t, err)
+			require.Equal(t, raw, again, "re-encode must be byte-for-byte identical")
+		})
+	}
+}
 // TestBrokerServerVariants inventories every server variant tag.
 func TestBrokerServerVariants(t *testing.T) {
 	connection := testConnectionID(0x11)
 		tag     protowire.Number
 	}{
 		{"registered", Registered{Epoch: 7, Connection: connection}, 201},
-		{"snapshot_begin", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 0, Part: SnapshotBegin{HostCount: 1, SessionCount: 2, TombstoneCount: 0}}, 202},
+		{"snapshot_begin", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 0, Part: SnapshotBegin{HostCount: 2, SessionCount: 2, TombstoneCount: 0, LocalPresent: true}}, 202},
-		{"snapshot_host", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 1, Part: SnapshotHostPart{HostIndex: 0, Host: testHostSnapshot(), SessionCount: 1}}, 202},
+		{"snapshot_daemon", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 1, Part: SnapshotDaemonPart{HostIndex: 0, Daemon: testLocalDaemonObservation(), SessionCount: 0}}, 202},
-		{"snapshot_session", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 2, Part: SnapshotSessionPart{HostIndex: 0, SessionIndex: 0, Session: testCatalogSession()}}, 202},
+		{"snapshot_daemon_remote", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 2, Part: SnapshotDaemonPart{HostIndex: 1, Daemon: testDaemonObservation(), SessionCount: 1}}, 202},
-		{"snapshot_tombstone", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 3, Part: SnapshotTombstonePart{TombstoneIndex: 0, Registration: testRegistration(), RetiredRevision: 4}}, 202},
+		{"snapshot_session", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 3, Part: SnapshotSessionPart{HostIndex: 1, SessionIndex: 0, Session: testCatalogSession()}}, 202},
-		{"snapshot_end", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 4, Part: SnapshotEnd{}}, 202},
+		{"snapshot_session_local", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 4, Part: SnapshotSessionPart{HostIndex: 0, SessionIndex: 0, Local: true, Session: testCatalogSession()}}, 202},
+		{"snapshot_tombstone", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 5, Part: SnapshotTombstonePart{TombstoneIndex: 0, Registration: testRegistration(), RetiredRevision: 4}}, 202},
+		{"snapshot_end", SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 6, Part: SnapshotEnd{}}, 202},
 		{"operation_result", OperationResult{Epoch: 7, Connection: connection, Operation: operation, Outcome: ports.BrokerOutcomeFailed, Removed: true, Error: testErrorDetail(), HasError: true}, 203},
 		{"stream_opened", StreamOpened{Epoch: 7, Connection: connection, Stream: 3}, 204},
 		{"server_stream_data", ServerStreamData{Epoch: 7, Connection: connection, Stream: 3, Data: []byte("frame")}, 205},
 	require.ErrorIs(t, err, errConvertRange)
 }
-// mutateHostIndex re-encodes one host snapshot part envelope with its host
+// mutateDaemonIndex re-encodes one daemon snapshot part envelope with its
-// index overwritten, so decode can be fed a value encode would never emit.
+// daemon index overwritten, so decode can be fed a value encode would never
-func mutateHostIndex(t *testing.T, part SnapshotPart, hostIndex uint32) []byte {
+// emit.
+func mutateDaemonIndex(t *testing.T, part SnapshotPart, hostIndex uint32) []byte {
 	t.Helper()
 	raw := mustEncodeServer(t, part)
 	envelope := &wire.BrokerServerEnvelope{}
 	require.NoError(t, wire.ScanEnvelope(envelope, raw))
 	require.NoError(t, proto.Unmarshal(raw, envelope))
-	envelope.GetSnapshotPart().GetHost().HostIndex = hostIndex
+	envelope.GetSnapshotPart().GetDaemon().HostIndex = hostIndex
 	mutated, err := proto.Marshal(envelope)
 	require.NoError(t, err)
 	return mutated
 // TestBrokerSnapshotIndexBounds proves snapshot part indexes are strict
 // ranges: max-1 is accepted on both encode and decode, and max is refused as a
-// range refusal on both paths. Host indexes are bounded by BrokerMaxHosts and
+// range refusal on both paths. Daemon indexes are bounded by
-// session indexes by BrokerMaxSessionsPerHost.
+// BrokerMaxDaemonsPerSnapshot and session indexes by BrokerMaxSessionsPerHost.
 func TestBrokerSnapshotIndexBounds(t *testing.T) {
 	connection := testConnectionID(0x11)
-	hostPart := func(hostIndex uint32) SnapshotPart {
+	daemonPart := func(hostIndex uint32) SnapshotPart {
-		return SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 1, Part: SnapshotHostPart{HostIndex: hostIndex, Host: testHostSnapshot()}}
+		return SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 1, Part: SnapshotDaemonPart{HostIndex: hostIndex, Daemon: testDaemonObservation()}}
 	}
 	sessionPart := func(hostIndex, sessionIndex uint32) SnapshotPart {
 		return SnapshotPart{Epoch: 7, Connection: connection, Generation: 2, Revision: 5, Index: 2, Part: SnapshotSessionPart{HostIndex: hostIndex, SessionIndex: sessionIndex, Session: testCatalogSession()}}
 	}
-	t.Run("host part at max-1 accepted", func(t *testing.T) {
+	t.Run("daemon part at max-1 accepted", func(t *testing.T) {
-		message := hostPart(ports.BrokerMaxHosts - 1)
+		message := daemonPart(ports.BrokerMaxDaemonsPerSnapshot - 1)
 		raw := mustEncodeServer(t, message)
 		decoded, err := DecodeServer(raw, testEnvelopeCeiling, testChunkCeiling)
 		require.NoError(t, err)
 		require.Equal(t, message, decoded)
-		decoded, err = DecodeServer(mutateHostIndex(t, message, ports.BrokerMaxHosts-1), testEnvelopeCeiling, testChunkCeiling)
+		decoded, err = DecodeServer(mutateDaemonIndex(t, message, ports.BrokerMaxDaemonsPerSnapshot-1), testEnvelopeCeiling, testChunkCeiling)
 		require.NoError(t, err)
 		require.Equal(t, message, decoded)
 	})
-	t.Run("host part at max refused", func(t *testing.T) {
+	t.Run("daemon part at max refused", func(t *testing.T) {
-		_, err := EncodeServer(hostPart(ports.BrokerMaxHosts), testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeServer(daemonPart(ports.BrokerMaxDaemonsPerSnapshot), testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
-		_, err = DecodeServer(mutateHostIndex(t, hostPart(0), ports.BrokerMaxHosts), testEnvelopeCeiling, testChunkCeiling)
+		_, err = DecodeServer(mutateDaemonIndex(t, daemonPart(0), ports.BrokerMaxDaemonsPerSnapshot), testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
 	})
-	t.Run("host part at uint32 maximum refused", func(t *testing.T) {
+	t.Run("daemon part at uint32 maximum refused", func(t *testing.T) {
-		_, err := EncodeServer(hostPart(^uint32(0)), testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeServer(daemonPart(^uint32(0)), testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
-		_, err = DecodeServer(mutateHostIndex(t, hostPart(0), ^uint32(0)), testEnvelopeCeiling, testChunkCeiling)
+		_, err = DecodeServer(mutateDaemonIndex(t, daemonPart(0), ^uint32(0)), testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
 	})
 	t.Run("session part at max-1 accepted", func(t *testing.T) {
-		message := sessionPart(ports.BrokerMaxHosts-1, ports.BrokerMaxSessionsPerHost-1)
+		message := sessionPart(ports.BrokerMaxDaemonsPerSnapshot-1, ports.BrokerMaxSessionsPerHost-1)
 		raw := mustEncodeServer(t, message)
 		decoded, err := DecodeServer(raw, testEnvelopeCeiling, testChunkCeiling)
 		require.NoError(t, err)
 		require.Equal(t, message, decoded)
-		decoded, err = DecodeServer(mutateSessionIndexes(t, message, ports.BrokerMaxHosts-1, ports.BrokerMaxSessionsPerHost-1), testEnvelopeCeiling, testChunkCeiling)
+		decoded, err = DecodeServer(mutateSessionIndexes(t, message, ports.BrokerMaxDaemonsPerSnapshot-1, ports.BrokerMaxSessionsPerHost-1), testEnvelopeCeiling, testChunkCeiling)
 		require.NoError(t, err)
 		require.Equal(t, message, decoded)
 	})
 	t.Run("session part host index at max refused", func(t *testing.T) {
-		_, err := EncodeServer(sessionPart(ports.BrokerMaxHosts, 0), testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeServer(sessionPart(ports.BrokerMaxDaemonsPerSnapshot, 0), testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
-		_, err = DecodeServer(mutateSessionIndexes(t, sessionPart(0, 0), ports.BrokerMaxHosts, 0), testEnvelopeCeiling, testChunkCeiling)
+		_, err = DecodeServer(mutateSessionIndexes(t, sessionPart(0, 0), ports.BrokerMaxDaemonsPerSnapshot, 0), testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
 	})
 		for i := range many {
 			many[i] = "A=B"
 		}
-		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: many, Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: many, Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
 		oversize := []string{"K=" + strings.Repeat("x", ports.BrokerMaxEnvEntryBytes)}
-		_, err = EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: oversize, Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
+		_, err = EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: oversize, Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
 	})
 	t.Run("error text", func(t *testing.T) {
 		require.ErrorIs(t, err, ErrTooLarge)
 	})
 	t.Run("snapshot counts", func(t *testing.T) {
-		_, err := EncodeServer(SnapshotPart{Epoch: 7, Connection: connection, Generation: 1, Revision: 1, Index: 0, Part: SnapshotBegin{HostCount: ports.BrokerMaxHosts + 1}}, testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeServer(SnapshotPart{Epoch: 7, Connection: connection, Generation: 1, Revision: 1, Index: 0, Part: SnapshotBegin{HostCount: ports.BrokerMaxDaemonsPerSnapshot + 1}}, testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrTooLarge)
 	})
 	t.Run("control env carries no attachment state", func(t *testing.T) {
 		require.ErrorIs(t, err, ErrInvalidMessage)
 	})
 	t.Run("taxonomy switches", func(t *testing.T) {
-		raw := mustEncodeClient(t, OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Policy: testPolicy()})
+		raw := mustEncodeClient(t, OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Policy: testPolicy()})
 		envelope := &wire.BrokerClientEnvelope{}
 		require.NoError(t, wire.ScanEnvelope(envelope, raw))
 		require.NoError(t, proto.Unmarshal(raw, envelope))
 		require.ErrorIs(t, err, ErrInvalidMessage)
 	})
 	t.Run("env without equals refused", func(t *testing.T) {
-		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: []string{"NOEQUALS"}, Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Env: []string{"NOEQUALS"}, Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrInvalidMessage)
 	})
 	t.Run("invalid policy refused", func(t *testing.T) {
-		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Policy: ports.BrokerPolicy{}}, testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Policy: ports.BrokerPolicy{}}, testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrInvalidMessage)
 	})
 	t.Run("snapshot revision zero refused", func(t *testing.T) {
 		require.ErrorIs(t, err, ErrInvalidMessage)
 	})
 	t.Run("local open with registration refused", func(t *testing.T) {
-		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Local: true, Registration: testRegistration(), Target: testTarget(), Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
+		_, err := EncodeClient(OpenStream{Epoch: 7, Connection: connection, Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Local: true, Registration: testRegistration(), Target: testTarget(), Policy: testPolicy()}, testEnvelopeCeiling, testChunkCeiling)
 		require.ErrorIs(t, err, ErrInvalidMessage)
 	})
 	t.Run("bad shutdown reason refused", func(t *testing.T) {
 	for _, message := range []ClientMessage{
 		Register{},
 		Subscribe{Epoch: 7, Connection: testConnectionID(0x11), Generation: 1},
-		OpenStream{Epoch: 7, Connection: testConnectionID(0x11), Stream: 3, Purpose: ports.BrokerStreamAttachment, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Policy: testPolicy()},
+		OpenStream{Epoch: 7, Connection: testConnectionID(0x11), Stream: 3, Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(), Policy: testPolicy()},
 		ClientStreamData{Epoch: 7, Connection: testConnectionID(0x11), Stream: 3, Data: []byte("frame")},
 		CloseStream{Epoch: 7, Connection: testConnectionID(0x11), Stream: 3},
 	} {

M internal/adapters/brokerwire/convert.go +16 -9

 	return nil
 }
-// validateSnapshotHostBounds enforces the per-host snapshot contract:
+// validateSnapshotDaemonFields enforces the per-daemon snapshot contract:
 // endpoint grammar, presentation origin, rank fit, closed availability and
-// failure taxonomies, and time values that survive the wire exactly.
+// failure taxonomies, and a syntactically present policy. The full port
-func validateSnapshotHostFields(host ports.RemoteHostSnapshot) error {
+// projection rules (identity/incarnation pairing, observed version,
-	if err := validateBrokerEndpoint(host.Endpoint); err != nil {
+// inventory, local authority) are re-checked by BrokerDaemonObservation
+// validation and, for remotes, the durable projection rule.
+func validateSnapshotDaemonFields(daemon ports.BrokerDaemonObservation) error {
+	if daemon.Local {
+		if daemon.Endpoint != "" {
+			return ErrInvalidMessage
+		}
+	} else if err := validateBrokerEndpoint(daemon.Endpoint); err != nil {
 		return err
 	}
-	if err := validateBrokerOrigin(host.DisplayOrigin); err != nil {
+	if err := validateBrokerOrigin(daemon.DisplayOrigin); err != nil {
 		return err
 	}
-	if host.Rank < 0 || host.Rank > math.MaxUint32 {
+	if daemon.Rank < 0 || daemon.Rank > math.MaxUint32 {
 		return errConvertRange
 	}
-	if host.Availability < domain.RemoteAvailabilityUnknown ||
+	if daemon.Availability < domain.RemoteAvailabilityUnknown ||
-		host.Availability > domain.RemoteAvailabilityInvalidResponse {
+		daemon.Availability > domain.RemoteAvailabilityInvalidResponse {
 		return ErrInvalidMessage
 	}
-	if host.LastFailure.Kind > domain.RemoteFailureInvalidResponse {
+	if daemon.LastFailure.Kind > domain.RemoteFailureInvalidResponse {
 		return ErrInvalidMessage
 	}
 	return nil

M internal/adapters/brokerwire/messages.go +17 -8

 // OpenStream asks the broker to open one independently cancellable logical
 // stream to the owning daemon. Env is the per-request session environment
-// and is never inherited from the broker process environment.
+// and is never inherited from the broker process environment. Admission
+// selects the attachment admission variant; Name is the validated session
+// name for create-named and is empty otherwise.
 type OpenStream struct {
 	Epoch        ports.BrokerEpoch
 	Connection   ports.BrokerConnectionID
 	Stream       ports.BrokerStreamID
 	Purpose      ports.BrokerStreamPurpose
+	Admission    ports.BrokerStreamAdmission
+	Name         string
 	Local        bool
 	Endpoint     string
 	Registration domain.RemoteRegistration
 type SnapshotPartPayload interface{ snapshotPartPayload() }
 // SnapshotBegin opens a snapshot publication with its element counts.
+// HostCount counts every daemon part in the transfer (the local daemon plus
+// every remote host); LocalPresent reports whether daemon index 0 is local.
 type SnapshotBegin struct {
 	HostCount      uint32
 	SessionCount   uint32
 	TombstoneCount uint32
+	LocalPresent   bool
 }
 func (SnapshotBegin) snapshotPartPayload() {}
-// SnapshotHostPart is one host projection. Sessions travel as separate
+// SnapshotDaemonPart is one daemon projection. Sessions travel as separate
-// SnapshotSessionPart parts bound by host index; SessionCount advertises
+// SnapshotSessionPart parts bound by daemon index; SessionCount advertises
-// how many follow. The embedded Host must carry no inline sessions.
+// how many follow. The embedded Daemon must carry no inline sessions.
-type SnapshotHostPart struct {
+type SnapshotDaemonPart struct {
 	HostIndex    uint32
-	Host         ports.RemoteHostSnapshot
+	Daemon       ports.BrokerDaemonObservation
 	SessionCount uint32
 }
-func (SnapshotHostPart) snapshotPartPayload() {}
+func (SnapshotDaemonPart) snapshotPartPayload() {}
-// SnapshotSessionPart is one catalogue session bound to its host by index.
+// SnapshotSessionPart is one catalogue session bound to its daemon by index.
+// Local marks a session of the local daemon: HostIndex is then exactly 0.
 type SnapshotSessionPart struct {
 	HostIndex    uint32
 	SessionIndex uint32
+	Local        bool
 	Session      catalogue.RemoteCatalogSession
 }

M internal/adapters/brokerwire/snapshot.go +132 -108

 //
 // Transfer layout (indexes are exact positions):
 //
-//	Begin(0) Host/Session... Tombstone... End(N-1)
+//	Begin(0) Daemon/Session... Tombstone... End(N-1)
 //
-// Begin carries the total host, session, and tombstone counts. Host parts
+// Begin carries the total daemon, session, and tombstone counts plus whether
-// arrive in host_index order; each Host advertises how many Session parts
+// the local daemon is present. Daemon parts arrive in host_index order, with
-// follow it immediately, with per-host session_index order. Tombstones
+// the local daemon (when present) first at index 0 and remotes following in
-// arrive in tombstone_index order after all hosts and sessions. End closes
+// registration order; each Daemon advertises how many Session parts follow it
-// the transfer. Total parts are 1 + hosts + sessions + tombstones + 1,
+// immediately, with per-daemon session_index order. A session of the local
-// bounded by MaxSnapshotParts (64 hosts, 64*256 sessions, 64 tombstones).
+// daemon carries Local=true and host_index 0. Tombstones arrive in
+// tombstone_index order after all daemons and sessions. End closes the
+// transfer. Total parts are 1 + daemons + sessions + tombstones + 1, bounded
+// by MaxSnapshotParts (65 daemons, 65*256 sessions, 64 tombstones).
 //
 // Bounds: at most MaxSnapshotParts parts and MaxSnapshotStagedBytes staged
 // estimate per transfer. The staged estimate is a deterministic function of
-// endpoint, origin, session, tab, and tombstone text lengths plus fixed
+// endpoint, origin, policy, identity, session, tab, and tombstone text lengths
-// per-part overhead; it bounds hostile memory without measuring wire bytes.
+// plus fixed per-part overhead; it bounds hostile memory without measuring
+// wire bytes.
 //
 // Publication is atomic: the committed snapshot is replaced only when End
 // arrives with exact indexes and the assembled BrokerSnapshot passes
-// ports.BrokerSnapshot.Validate plus per-host
+// ports.BrokerSnapshot.Validate plus, for every remote daemon,
-// ports.ValidateDurableHostProjection. Any malformed index, count, order,
+// ports.ValidateDurableHostProjection. Any malformed index, count, order, or
-// or validation failure aborts staging and retains the old snapshot. A new
+// validation failure aborts staging and retains the old snapshot. A new Begin
-// Begin for the same generation with a newer revision coalesces by
+// for the same generation with a newer revision coalesces by replacing
-// replacing staging; an older revision is rejected and retains both the
+// staging; an older revision is rejected and retains both the committed
-// committed snapshot and any staging in flight. Equal revisions are allowed
+// snapshot and any staging in flight. Equal revisions are allowed so a resync
-// so a resync may republish the committed revision.
+// may republish the committed revision.
 //
 // Generation fencing: the assembler belongs to exactly one nonzero
 // subscription generation, adopted from the first Begin or pinned by
-// WithGeneration. Parts with a stale generation are ignored without
+// WithGeneration. Parts with a stale generation are ignored without touching
-// touching staging; parts with a future generation are rejected, whether or
+// staging; parts with a future generation are rejected, whether or not a
-// not a transfer is in flight. Scope fencing is exact: every part must carry
+// transfer is in flight. Scope fencing is exact: every part must carry the
-// the assembler's epoch and connection.
+// assembler's epoch and connection.
 //
 // There is no I/O, socket, pump, or P3.2 transport here. The owning
 // Connection discards staging on generation advance, unsubscribe, or close.
 )
 const (
-	// MaxSnapshotParts bounds one multipart publication: 1 Begin + 64
+	// MaxSnapshotParts bounds one multipart publication: 1 Begin + 65 daemons
-	// hosts + 64*256 sessions + 64 tombstones + 1 End.
+	// + 65*256 sessions + 64 tombstones + 1 End.
-	MaxSnapshotParts = 1 + ports.BrokerMaxHosts + ports.BrokerMaxHosts*ports.BrokerMaxSessionsPerHost + ports.BrokerMaxTombstones + 1
+	MaxSnapshotParts = 1 + ports.BrokerMaxDaemonsPerSnapshot + ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost + ports.BrokerMaxTombstones + 1
 	// MaxSnapshotStagedBytes bounds the deterministic staged estimate of
 	// one transfer (80 MiB).
 	MaxSnapshotStagedBytes = uint64(80 << 20)
 	hostCount      uint32
 	sessionTotal   uint32
 	tombstoneCount uint32
+	localPresent   bool
 	totalParts     uint32
 	nextIndex      uint32
-	hosts          []ports.RemoteHostSnapshot
+	daemons        []ports.BrokerDaemonObservation
-	hostExpected   []uint32
+	daemonExpected []uint32
-	hostSeen       []uint32
+	daemonSeen     []uint32
-	hostsSeen      uint32
+	daemonsSeen    uint32
 	sessionsSeen   uint32
 	tombstones     []ports.BrokerHostTombstone
 	tombstonesSeen uint32
 	stagedBytes    uint64
 }
+// newSnapshotStaging allocates one transfer's staging from a validated Begin.
+func newSnapshotStaging(generation SubscriptionGeneration, revision ports.BrokerRevision, begin SnapshotBegin) *snapshotStaging {
+	total := 1 + uint64(begin.HostCount) + uint64(begin.SessionCount) + uint64(begin.TombstoneCount) + 1
+	return &snapshotStaging{
+		generation:     generation,
+		revision:       revision,
+		hostCount:      begin.HostCount,
+		sessionTotal:   begin.SessionCount,
+		tombstoneCount: begin.TombstoneCount,
+		localPresent:   begin.LocalPresent,
+		totalParts:     uint32(total),
+		nextIndex:      1,
+		daemons:        make([]ports.BrokerDaemonObservation, begin.HostCount),
+		daemonExpected: make([]uint32, begin.HostCount),
+		daemonSeen:     make([]uint32, begin.HostCount),
+		tombstones:     make([]ports.BrokerHostTombstone, begin.TombstoneCount),
+	}
+}
 // NewSnapshotAssembler binds an assembler to one exact scope assigned by
 // Registered. Every part must carry that scope.
 func NewSnapshotAssembler(epoch ports.BrokerEpoch, connection ports.BrokerConnectionID, opts ...SnapshotOption) *SnapshotAssembler {
 		if a.hasCommitted && part.Revision < a.committed.Revision {
 			return false, ports.BrokerSnapshot{}, ErrSnapshotStale
 		}
-		total := 1 + uint64(begin.HostCount) + uint64(begin.SessionCount) + uint64(begin.TombstoneCount) + 1
+		staging := newSnapshotStaging(part.Generation, part.Revision, begin)
-		if total > uint64(MaxSnapshotParts) {
-			return false, ports.BrokerSnapshot{}, ErrTooLarge
-		}
-		staging := &snapshotStaging{
-			generation:     part.Generation,
-			revision:       part.Revision,
-			hostCount:      begin.HostCount,
-			sessionTotal:   begin.SessionCount,
-			tombstoneCount: begin.TombstoneCount,
-			totalParts:     uint32(total),
-			nextIndex:      1,
-			hosts:          make([]ports.RemoteHostSnapshot, begin.HostCount),
-			hostExpected:   make([]uint32, begin.HostCount),
-			hostSeen:       make([]uint32, begin.HostCount),
-			tombstones:     make([]ports.BrokerHostTombstone, begin.TombstoneCount),
-		}
 		staged := estimatePartBytes(part)
 		if staged > a.maxStagedBytes {
 			return false, ports.BrokerSnapshot{}, ErrTooLarge
 			a.staging = nil
 			return false, ports.BrokerSnapshot{}, err
 		}
-		total := 1 + uint64(begin.HostCount) + uint64(begin.SessionCount) + uint64(begin.TombstoneCount) + 1
-		if total > uint64(MaxSnapshotParts) {
-			a.staging = nil
-			return false, ports.BrokerSnapshot{}, ErrTooLarge
-		}
 		switch {
 		case part.Revision == staging.revision:
 			// Restart of the same transfer: discard progress.
 		default:
 			return false, ports.BrokerSnapshot{}, ErrSnapshotStale
 		}
-		fresh := &snapshotStaging{
+		fresh := newSnapshotStaging(part.Generation, part.Revision, begin)
-			generation:     part.Generation,
-			revision:       part.Revision,
-			hostCount:      begin.HostCount,
-			sessionTotal:   begin.SessionCount,
-			tombstoneCount: begin.TombstoneCount,
-			totalParts:     uint32(total),
-			nextIndex:      1,
-			hosts:          make([]ports.RemoteHostSnapshot, begin.HostCount),
-			hostExpected:   make([]uint32, begin.HostCount),
-			hostSeen:       make([]uint32, begin.HostCount),
-			tombstones:     make([]ports.BrokerHostTombstone, begin.TombstoneCount),
-		}
 		staged := estimatePartBytes(part)
 		if staged > a.maxStagedBytes {
 			a.staging = nil
 		return false, ports.BrokerSnapshot{}, ErrTooLarge
 	}
 	switch payload := part.Part.(type) {
-	case SnapshotHostPart, *SnapshotHostPart:
+	case SnapshotDaemonPart, *SnapshotDaemonPart:
-		hostPart := normalizeHostPart(payload)
+		daemonPart := normalizeDaemonPart(payload)
-		if err := a.stageHost(staging, hostPart); err != nil {
+		if err := a.stageDaemon(staging, daemonPart); err != nil {
 			a.staging = nil
 			return false, ports.BrokerSnapshot{}, err
 		}
 	}
 }
-func normalizeHostPart(payload SnapshotPartPayload) SnapshotHostPart {
+func normalizeDaemonPart(payload SnapshotPartPayload) SnapshotDaemonPart {
 	switch p := payload.(type) {
-	case SnapshotHostPart:
+	case SnapshotDaemonPart:
 		return p
-	case *SnapshotHostPart:
+	case *SnapshotDaemonPart:
 		if p == nil {
-			return SnapshotHostPart{HostIndex: ^uint32(0)}
+			return SnapshotDaemonPart{HostIndex: ^uint32(0)}
 		}
 		return *p
 	default:
-		return SnapshotHostPart{HostIndex: ^uint32(0)}
+		return SnapshotDaemonPart{HostIndex: ^uint32(0)}
 	}
 }
 }
 func checkBeginCounts(begin SnapshotBegin) error {
-	if begin.HostCount > uint32(ports.BrokerMaxHosts) ||
+	if begin.HostCount > uint32(ports.BrokerMaxDaemonsPerSnapshot) ||
-		begin.SessionCount > uint32(ports.BrokerMaxHosts*ports.BrokerMaxSessionsPerHost) ||
+		begin.SessionCount > uint32(ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost) ||
 		begin.TombstoneCount > uint32(ports.BrokerMaxTombstones) {
 		return ErrTooLarge
 	}
+	// A local daemon occupies daemon index 0, so it can only be present when
+	// at least one daemon part follows.
+	if begin.LocalPresent && begin.HostCount == 0 {
+		return ErrSnapshotInvalid
+	}
 	return nil
 }
-func (a *SnapshotAssembler) stageHost(staging *snapshotStaging, part SnapshotHostPart) error {
+func (a *SnapshotAssembler) stageDaemon(staging *snapshotStaging, part SnapshotDaemonPart) error {
-	if staging.hostsSeen >= staging.hostCount {
+	if staging.daemonsSeen >= staging.hostCount {
 		return ErrSnapshotInvalid
 	}
-	if part.HostIndex != staging.hostsSeen {
+	if part.HostIndex != staging.daemonsSeen {
 		return ErrSnapshotInvalid
 	}
 	if part.HostIndex >= staging.hostCount {
 	if part.SessionCount > uint32(ports.BrokerMaxSessionsPerHost) {
 		return ErrTooLarge
 	}
-	if len(part.Host.Sessions) != 0 {
+	if len(part.Daemon.Sessions) != 0 {
+		return ErrSnapshotInvalid
+	}
+	// The local daemon is always first: daemon index 0 is local exactly when
+	// Begin advertised it, and no later daemon may be local.
+	if part.HostIndex == 0 {
+		if part.Daemon.Local != staging.localPresent {
+			return ErrSnapshotInvalid
+		}
+	} else if part.Daemon.Local {
 		return ErrSnapshotInvalid
 	}
 	var seen uint64
-	for _, n := range staging.hostExpected[:staging.hostsSeen] {
+	for _, n := range staging.daemonExpected[:staging.daemonsSeen] {
 		seen += uint64(n)
 	}
 	if seen+uint64(part.SessionCount) > uint64(staging.sessionTotal) {
 		return ErrSnapshotInvalid
 	}
-	// Remaining hosts must still be able to fill the advertised total:
+	// Remaining daemons must still be able to fill the advertised total:
-	// even if every remaining host carried the per-host maximum, the
+	// even if every remaining daemon carried the per-daemon maximum, the
 	// total must stay reachable. This is checked exactly at End; here we
 	// only refuse an already-exceeded sum.
-	staging.hosts[part.HostIndex] = part.Host.Clone()
+	staging.daemons[part.HostIndex] = part.Daemon.Clone()
-	staging.hostExpected[part.HostIndex] = part.SessionCount
+	staging.daemonExpected[part.HostIndex] = part.SessionCount
-	staging.hostSeen[part.HostIndex] = 0
+	staging.daemonSeen[part.HostIndex] = 0
-	staging.hostsSeen++
+	staging.daemonsSeen++
 	return nil
 }
 func (a *SnapshotAssembler) stageSession(staging *snapshotStaging, part SnapshotSessionPart) error {
-	if staging.hostsSeen == 0 || staging.hostsSeen > staging.hostCount {
+	if staging.daemonsSeen == 0 || staging.daemonsSeen > staging.hostCount {
 		return ErrSnapshotInvalid
 	}
-	current := staging.hostsSeen - 1
+	current := staging.daemonsSeen - 1
 	if part.HostIndex != current {
 		return ErrSnapshotInvalid
 	}
 	if current >= staging.hostCount {
 		return ErrSnapshotInvalid
 	}
-	expected := staging.hostExpected[current]
+	expected := staging.daemonExpected[current]
-	if staging.hostSeen[current] >= expected {
+	if staging.daemonSeen[current] >= expected {
 		return ErrSnapshotInvalid
 	}
-	if part.SessionIndex != staging.hostSeen[current] {
+	if part.SessionIndex != staging.daemonSeen[current] {
 		return ErrSnapshotInvalid
 	}
-	if part.HostIndex >= uint32(ports.BrokerMaxHosts) || part.SessionIndex >= uint32(ports.BrokerMaxSessionsPerHost) {
+	// A session belongs to the daemon it follows: a local session binds to
+	// the local daemon at index 0, and a remote session to a remote daemon.
+	if part.Local != staging.daemons[current].Local {
+		return ErrSnapshotInvalid
+	}
+	if part.HostIndex >= uint32(ports.BrokerMaxDaemonsPerSnapshot) || part.SessionIndex >= uint32(ports.BrokerMaxSessionsPerHost) {
 		return ErrTooLarge
 	}
 	if staging.sessionsSeen >= staging.sessionTotal {
 	tabs := make([]catalogue.RemoteCatalogTab, len(session.Tabs))
 	copy(tabs, session.Tabs)
 	session.Tabs = tabs
-	host := staging.hosts[current]
+	daemon := staging.daemons[current]
-	host.Sessions = append(host.Sessions, session)
+	daemon.Sessions = append(daemon.Sessions, session)
-	staging.hosts[current] = host
+	staging.daemons[current] = daemon
-	staging.hostSeen[current]++
+	staging.daemonSeen[current]++
 	staging.sessionsSeen++
 	return nil
 }
 func (a *SnapshotAssembler) stageTombstone(staging *snapshotStaging, part SnapshotTombstonePart) error {
-	if staging.hostsSeen != staging.hostCount || staging.sessionsSeen != staging.sessionTotal {
+	if staging.daemonsSeen != staging.hostCount || staging.sessionsSeen != staging.sessionTotal {
 		return ErrSnapshotInvalid
 	}
 	if staging.tombstonesSeen >= staging.tombstoneCount {
 }
 func (a *SnapshotAssembler) commitStaging(staging *snapshotStaging) (ports.BrokerSnapshot, error) {
-	if staging.hostsSeen != staging.hostCount || staging.sessionsSeen != staging.sessionTotal || staging.tombstonesSeen != staging.tombstoneCount {
+	if staging.daemonsSeen != staging.hostCount || staging.sessionsSeen != staging.sessionTotal || staging.tombstonesSeen != staging.tombstoneCount {
 		return ports.BrokerSnapshot{}, ErrSnapshotInvalid
 	}
 	if staging.nextIndex != staging.totalParts-1 {
 		return ports.BrokerSnapshot{}, ErrSnapshotInvalid
 	}
 	var sum uint64
-	for _, n := range staging.hostExpected {
+	for _, n := range staging.daemonExpected {
 		sum += uint64(n)
 	}
 	if sum != uint64(staging.sessionTotal) {
 		return ports.BrokerSnapshot{}, ErrSnapshotInvalid
 	}
-	hosts := make([]ports.RemoteHostSnapshot, len(staging.hosts))
+	daemons := make([]ports.BrokerDaemonObservation, len(staging.daemons))
-	for i, host := range staging.hosts {
+	for i, daemon := range staging.daemons {
-		hosts[i] = host.Clone()
+		daemons[i] = daemon.Clone()
-		if hosts[i].Sessions == nil {
+		if daemons[i].Sessions == nil {
-			hosts[i].Sessions = []catalogue.RemoteCatalogSession{}
+			daemons[i].Sessions = []catalogue.RemoteCatalogSession{}
 		}
 	}
 	removed := append([]ports.BrokerHostTombstone(nil), staging.tombstones...)
-	snapshot := ports.BrokerSnapshot{Epoch: a.epoch, Revision: staging.revision, Hosts: hosts, Removed: removed}
+	snapshot := ports.BrokerSnapshot{Epoch: a.epoch, Revision: staging.revision, Daemons: daemons, Removed: removed}
 	if err := snapshot.Validate(); err != nil {
 		return ports.BrokerSnapshot{}, ErrSnapshotInvalid
 	}
-	for _, host := range hosts {
+	for _, daemon := range daemons {
-		if err := ports.ValidateDurableHostProjection(host); err != nil {
+		// The local daemon is process-local state and is never durable.
+		if daemon.Local {
+			continue
+		}
+		if err := ports.ValidateDurableHostProjection(daemon); err != nil {
 			return ports.BrokerSnapshot{}, ErrSnapshotInvalid
 		}
 	}
 	switch payload := part.Part.(type) {
 	case SnapshotBegin, *SnapshotBegin:
 		return overhead
-	case SnapshotHostPart:
+	case SnapshotDaemonPart:
-		return uint64(len(payload.Host.Endpoint)+len(payload.Host.DisplayOrigin)+len(payload.Host.Registration.Endpoint)+64) + overhead
+		return estimateDaemonBytes(payload.Daemon) + overhead
-	case *SnapshotHostPart:
+	case *SnapshotDaemonPart:
 		if payload == nil {
 			return overhead
 		}
-		return uint64(len(payload.Host.Endpoint)+len(payload.Host.DisplayOrigin)+len(payload.Host.Registration.Endpoint)+64) + overhead
+		return estimateDaemonBytes(payload.Daemon) + overhead
 	case SnapshotSessionPart:
 		return estimateCatalogSessionBytes(payload.Session) + overhead
 	case *SnapshotSessionPart:
 	}
 }
+// estimateDaemonBytes bounds one daemon projection's staged memory: every
+// configured-authority and observed-identity string plus a fixed per-daemon
+// charge.
+func estimateDaemonBytes(daemon ports.BrokerDaemonObservation) uint64 {
+	text := len(daemon.Endpoint) + len(daemon.DisplayOrigin) + len(daemon.Registration.Endpoint) +
+		len(daemon.Policy.Transport) + len(daemon.Policy.Trust) + len(daemon.Policy.Launch) + len(daemon.Policy.Isolation) +
+		len(daemon.Identity)
+	return uint64(text + 64)
+}
 // estimateCatalogSessionBytes bounds one session's staged memory. It charges
 // every tab at least estimateTabBytes (covering the tab struct, its string
 // headers, and its slice slot) plus the variable-length text, and adds one

M internal/adapters/brokerwire/snapshot_test.go +202 -92

 	return NewSnapshotAssembler(epoch, connection, opts...)
 }
-// testHostAt builds one catalogue-valid host projection for host index i.
+// testDaemonAt builds one catalogue-valid remote daemon projection for daemon
-func testHostAt(i int) ports.RemoteHostSnapshot {
+// index i. Sessions are attached by the sample helpers; the emitter strips
+// them before a daemon part travels.
+func testDaemonAt(i int) ports.BrokerDaemonObservation {
 	endpoint := fmt.Sprintf("user%d@host%d:22", i, i)
-	return ports.RemoteHostSnapshot{
+	return ports.BrokerDaemonObservation{
 		Endpoint:       endpoint,
 		DisplayOrigin:  endpoint,
 		Registration:   domain.RemoteRegistration{Endpoint: endpoint, Incarnation: [16]byte{0x10, byte(i + 1), 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xf0, 0x11}, Generation: domain.RemoteGeneration(i + 1)},
+		Policy:         testPolicy(),
 		Availability:   domain.RemoteAvailabilityReachable,
 		LastSuccess:    time.Unix(1700000000+int64(i), 0).UTC(),
 		InventoryKnown: true,
 	}
 }
+// testLocalDaemonAt builds the local daemon projection.
+func testLocalDaemonAt() ports.BrokerDaemonObservation {
+	return ports.BrokerDaemonObservation{
+		Local:          true,
+		DisplayOrigin:  "local",
+		Policy:         testPolicy(),
+		Availability:   domain.RemoteAvailabilityReachable,
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{},
+	}
+}
 // testSessionAt builds one catalogue-valid session for a host and index.
 func testSessionAt(host, index int) catalogue.RemoteCatalogSession {
 	return catalogue.RemoteCatalogSession{
 	}
 }
-func sampleSnapshotHosts() []ports.RemoteHostSnapshot {
+func sampleSnapshotDaemons() []ports.BrokerDaemonObservation {
-	host0 := testHostAt(0)
+	daemon0 := testDaemonAt(0)
-	host0.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(0, 0), testSessionAt(0, 1)}
+	daemon0.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(0, 0), testSessionAt(0, 1)}
-	host1 := testHostAt(1)
+	daemon1 := testDaemonAt(1)
-	host1.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(1, 0)}
+	daemon1.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(1, 0)}
-	return []ports.RemoteHostSnapshot{host0, host1}
+	return []ports.BrokerDaemonObservation{daemon0, daemon1}
+}
+// sampleLocalSnapshotDaemons builds a local-first publication: the local daemon
+// at index 0 with two sessions, then one remote daemon with one session.
+func sampleLocalSnapshotDaemons() []ports.BrokerDaemonObservation {
+	local := testLocalDaemonAt()
+	local.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(0, 0), testSessionAt(0, 1)}
+	remote := testDaemonAt(0)
+	remote.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(1, 0)}
+	return []ports.BrokerDaemonObservation{local, remote}
 }
 func sampleSnapshotTombstones() []ports.BrokerHostTombstone {
 	return []ports.BrokerHostTombstone{testTombstoneAt(0)}
 }
-func snapshotSessionTotal(hosts []ports.RemoteHostSnapshot) int {
+func snapshotSessionTotal(daemons []ports.BrokerDaemonObservation) int {
 	total := 0
-	for _, host := range hosts {
+	for _, daemon := range daemons {
-		total += len(host.Sessions)
+		total += len(daemon.Sessions)
 	}
 	return total
 }
-// snapshotPartsFor lays out one exact transfer: Begin(0), hosts with their
+// snapshotPartsFor lays out one exact transfer: Begin(0), daemons with their
 // sessions, tombstones, End. Indexes are exact sequential positions.
-func snapshotPartsFor(gen uint64, rev ports.BrokerRevision, hosts []ports.RemoteHostSnapshot, tombstones []ports.BrokerHostTombstone) []SnapshotPart {
+func snapshotPartsFor(gen uint64, rev ports.BrokerRevision, daemons []ports.BrokerDaemonObservation, tombstones []ports.BrokerHostTombstone) []SnapshotPart {
 	epoch, connection := testSnapshotScope()
 	next := uint32(0)
 	part := func(payload SnapshotPartPayload) SnapshotPart {
 		next++
 		return out
 	}
+	localPresent := len(daemons) > 0 && daemons[0].Local
 	parts := []SnapshotPart{part(SnapshotBegin{
-		HostCount:      uint32(len(hosts)),
+		HostCount:      uint32(len(daemons)),
-		SessionCount:   uint32(snapshotSessionTotal(hosts)),
+		SessionCount:   uint32(snapshotSessionTotal(daemons)),
 		TombstoneCount: uint32(len(tombstones)),
+		LocalPresent:   localPresent,
 	})}
-	for hostIndex, host := range hosts {
+	for daemonIndex, daemon := range daemons {
-		// Host parts carry no inline sessions: the advertised count is
+		// Daemon parts carry no inline sessions: the advertised count is
 		// followed by that many session parts.
-		projection := host.Clone()
+		projection := daemon.Clone()
 		projection.Sessions = []catalogue.RemoteCatalogSession{}
-		parts = append(parts, part(SnapshotHostPart{HostIndex: uint32(hostIndex), Host: projection, SessionCount: uint32(len(host.Sessions))}))
+		parts = append(parts, part(SnapshotDaemonPart{HostIndex: uint32(daemonIndex), Daemon: projection, SessionCount: uint32(len(daemon.Sessions))}))
-		for sessionIndex, session := range host.Sessions {
+		for sessionIndex, session := range daemon.Sessions {
-			parts = append(parts, part(SnapshotSessionPart{HostIndex: uint32(hostIndex), SessionIndex: uint32(sessionIndex), Session: session}))
+			parts = append(parts, part(SnapshotSessionPart{HostIndex: uint32(daemonIndex), SessionIndex: uint32(sessionIndex), Local: daemon.Local, Session: session}))
 		}
 	}
 	for tombstoneIndex, tombstone := range tombstones {
 }
 func TestSnapshotAssemblerBoundsConstants(t *testing.T) {
-	require.Equal(t, 16514, MaxSnapshotParts)
+	require.Equal(t, 16771, MaxSnapshotParts)
-	require.Equal(t, 1+64+64*256+64+1, MaxSnapshotParts)
+	require.Equal(t, 1+ports.BrokerMaxDaemonsPerSnapshot+ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost+ports.BrokerMaxTombstones+1, MaxSnapshotParts)
 	require.Equal(t, uint64(80<<20), MaxSnapshotStagedBytes)
 }
 // TestSnapshotAssemblerExactTransfer proves exact order, count, and index
 // acceptance, and that committed order matches the staged order.
 func TestSnapshotAssemblerExactTransfer(t *testing.T) {
-	hosts := sampleSnapshotHosts()
+	hosts := sampleSnapshotDaemons()
 	tombstones := sampleSnapshotTombstones()
 	parts := snapshotPartsFor(5, 3, hosts, tombstones)
 	require.Len(t, parts, 1+2+3+1+1)
 	epoch, connection := testSnapshotScope()
 	require.Equal(t, epoch, committed.Epoch)
 	require.Equal(t, ports.BrokerRevision(3), committed.Revision)
-	require.Len(t, committed.Hosts, 2)
+	require.Len(t, committed.Daemons, 2)
-	require.Equal(t, "user0@host0:22", committed.Hosts[0].Endpoint)
+	require.Equal(t, "user0@host0:22", committed.Daemons[0].Endpoint)
-	require.Equal(t, "user1@host1:22", committed.Hosts[1].Endpoint)
+	require.Equal(t, "user1@host1:22", committed.Daemons[1].Endpoint)
-	require.Equal(t, 2, len(committed.Hosts[0].Sessions))
+	require.Equal(t, 2, len(committed.Daemons[0].Sessions))
-	require.Equal(t, "s00-000", committed.Hosts[0].Sessions[0].Name)
+	require.Equal(t, "s00-000", committed.Daemons[0].Sessions[0].Name)
-	require.Equal(t, "s00-001", committed.Hosts[0].Sessions[1].Name)
+	require.Equal(t, "s00-001", committed.Daemons[0].Sessions[1].Name)
-	require.Equal(t, "s01-000", committed.Hosts[1].Sessions[0].Name)
+	require.Equal(t, "s01-000", committed.Daemons[1].Sessions[0].Name)
 	require.Len(t, committed.Removed, 1)
 	require.Equal(t, "retired0@old0:22", committed.Removed[0].Endpoint)
 	_ = connection
 	completed, snapshot, err := a.Add(parts[1])
 	require.NoError(t, err)
 	require.True(t, completed)
-	require.Empty(t, snapshot.Hosts)
+	require.Empty(t, snapshot.Daemons)
 	require.Empty(t, snapshot.Removed)
 }
+// TestSnapshotAssemblerLocalDaemonTransfer proves a local-first transfer with a
+// local daemon and its sessions commits with the local entry first, and that
+// local sessions bind to index 0 while a mismatched local flag is refused.
+func TestSnapshotAssemblerLocalDaemonTransfer(t *testing.T) {
+	daemons := sampleLocalSnapshotDaemons()
+	parts := snapshotPartsFor(5, 1, daemons, nil)
+	require.Len(t, parts, 1+2+3+1)
+	begin, ok := parts[0].Part.(SnapshotBegin)
+	require.True(t, ok)
+	require.True(t, begin.LocalPresent)
+	require.Equal(t, uint32(2), begin.HostCount)
+	require.Equal(t, uint32(3), begin.SessionCount)
+	a := testSnapshotAssembler(t)
+	completed, snapshot, err := addAll(a, parts)
+	require.NoError(t, err)
+	require.True(t, completed)
+	require.Len(t, snapshot.Daemons, 2)
+	require.True(t, snapshot.Daemons[0].Local)
+	require.Empty(t, snapshot.Daemons[0].Endpoint)
+	require.Equal(t, "user0@host0:22", snapshot.Daemons[1].Endpoint)
+	require.Len(t, snapshot.Daemons[0].Sessions, 2)
+	require.Equal(t, "s00-000", snapshot.Daemons[0].Sessions[0].Name)
+	require.Len(t, snapshot.Daemons[1].Sessions, 1)
+	requireValidBrokerSnapshot(t, snapshot)
+	t.Run("local session marked remote refused", func(t *testing.T) {
+		a := testSnapshotAssembler(t)
+		require.NoError(t, runSnapshotParts(a, parts[:2]))
+		require.True(t, a.StagingActive())
+		mismatched := parts[2]
+		mismatched.Part = SnapshotSessionPart{HostIndex: 0, SessionIndex: 0, Local: false, Session: testSessionAt(0, 0)}
+		_, _, err := a.Add(mismatched)
+		require.ErrorIs(t, err, ErrSnapshotInvalid)
+		require.False(t, a.StagingActive())
+	})
+	t.Run("non-local daemon under local_present refused", func(t *testing.T) {
+		a := testSnapshotAssembler(t)
+		begin := parts[0]
+		begin.Part = SnapshotBegin{HostCount: 1, LocalPresent: true}
+		require.NoError(t, runSnapshotParts(a, []SnapshotPart{begin}))
+		daemonPart := parts[1]
+		daemonPart.Part = SnapshotDaemonPart{HostIndex: 0, Daemon: testDaemonAt(0)}
+		_, _, err := a.Add(daemonPart)
+		require.ErrorIs(t, err, ErrSnapshotInvalid)
+		require.False(t, a.StagingActive())
+	})
+	t.Run("local daemon without local_present refused", func(t *testing.T) {
+		a := testSnapshotAssembler(t)
+		begin := parts[0]
+		begin.Part = SnapshotBegin{HostCount: 1}
+		require.NoError(t, runSnapshotParts(a, []SnapshotPart{begin}))
+		daemonPart := parts[1]
+		daemonPart.Part = SnapshotDaemonPart{HostIndex: 0, Daemon: testLocalDaemonAt()}
+		_, _, err := a.Add(daemonPart)
+		require.ErrorIs(t, err, ErrSnapshotInvalid)
+		require.False(t, a.StagingActive())
+	})
+}
+// addAll stages every part in order and returns the final commit result.
+func addAll(a *SnapshotAssembler, parts []SnapshotPart) (bool, ports.BrokerSnapshot, error) {
+	completed := false
+	var snapshot ports.BrokerSnapshot
+	for _, part := range parts {
+		published, committed, err := a.Add(part)
+		if err != nil {
+			return false, ports.BrokerSnapshot{}, err
+		}
+		if published {
+			completed = true
+			snapshot = committed
+		}
+	}
+	return completed, snapshot, nil
+}
 // TestSnapshotAssemblerTransferRejections proves malformed indexes, counts,
 // order, payloads, and assembled validation failures abort staging and
 // retain the committed snapshot.
 func TestSnapshotAssemblerTransferRejections(t *testing.T) {
 	base := func() []SnapshotPart {
-		return snapshotPartsFor(5, 3, sampleSnapshotHosts(), sampleSnapshotTombstones())
+		return snapshotPartsFor(5, 3, sampleSnapshotDaemons(), sampleSnapshotTombstones())
 	}
 	mutate := func(parts []SnapshotPart, index int, apply func(*SnapshotPart)) []SnapshotPart {
 		out := cloneSnapshotParts(parts)
 		{"non-begin first", base()[1:], ErrSnapshotInvalid},
 		{"missing session part", append(cloneSnapshotParts(base()[:3]), base()[4:]...), ErrSnapshotInvalid},
 		{"duplicate host index", mutate(base(), 4, func(p *SnapshotPart) {
-			p.Part = SnapshotHostPart{HostIndex: 0, Host: testHostAt(1), SessionCount: 1}
+			p.Part = SnapshotDaemonPart{HostIndex: 0, Daemon: testDaemonAt(1), SessionCount: 1}
 		}), ErrSnapshotInvalid},
 		{"host index skips ahead", mutate(base(), 4, func(p *SnapshotPart) {
-			p.Part = SnapshotHostPart{HostIndex: 5, Host: testHostAt(1), SessionCount: 1}
+			p.Part = SnapshotDaemonPart{HostIndex: 5, Daemon: testDaemonAt(1), SessionCount: 1}
 		}), ErrSnapshotInvalid},
 		{"session host index mismatch", mutate(base(), 3, func(p *SnapshotPart) {
 			p.Part = SnapshotSessionPart{HostIndex: 1, SessionIndex: 1, Session: testSessionAt(0, 1)}
 			p.Part = SnapshotSessionPart{HostIndex: 0, SessionIndex: 0, Session: session}
 		}), ErrSnapshotInvalid},
 		{"host carries inline sessions", mutate(base(), 1, func(p *SnapshotPart) {
-			host := testHostAt(0)
+			host := testDaemonAt(0)
 			host.Sessions = []catalogue.RemoteCatalogSession{testSessionAt(0, 0)}
-			p.Part = SnapshotHostPart{HostIndex: 0, Host: host, SessionCount: 1}
+			p.Part = SnapshotDaemonPart{HostIndex: 0, Daemon: host, SessionCount: 1}
 		}), ErrSnapshotInvalid},
 		{"host session count over maximum", mutate(base(), 1, func(p *SnapshotPart) {
-			p.Part = SnapshotHostPart{HostIndex: 0, Host: testHostAt(0), SessionCount: uint32(ports.BrokerMaxSessionsPerHost) + 1}
+			p.Part = SnapshotDaemonPart{HostIndex: 0, Daemon: testDaemonAt(0), SessionCount: uint32(ports.BrokerMaxSessionsPerHost) + 1}
 		}), ErrTooLarge},
 		{"host session count exceeds advertised total", mutate(base(), 1, func(p *SnapshotPart) {
-			p.Part = SnapshotHostPart{HostIndex: 0, Host: testHostAt(0), SessionCount: 3}
+			p.Part = SnapshotDaemonPart{HostIndex: 0, Daemon: testDaemonAt(0), SessionCount: 3}
 		}), ErrSnapshotInvalid},
 		{"tombstone before all sessions", func() []SnapshotPart {
 			parts := base()
 			p.Part = SnapshotBegin{HostCount: 2, SessionCount: 4, TombstoneCount: 1}
 		}), ErrSnapshotInvalid},
 		{"begin host count over maximum", mutate(base(), 0, func(p *SnapshotPart) {
-			p.Part = SnapshotBegin{HostCount: uint32(ports.BrokerMaxHosts) + 1}
+			p.Part = SnapshotBegin{HostCount: uint32(ports.BrokerMaxDaemonsPerSnapshot) + 1}
 		}), ErrTooLarge},
 		{"begin session count over maximum", mutate(base(), 0, func(p *SnapshotPart) {
-			p.Part = SnapshotBegin{HostCount: 1, SessionCount: uint32(ports.BrokerMaxHosts*ports.BrokerMaxSessionsPerHost) + 1}
+			p.Part = SnapshotBegin{HostCount: 1, SessionCount: uint32(ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost) + 1}
 		}), ErrTooLarge},
 		{"begin tombstone count over maximum", mutate(base(), 0, func(p *SnapshotPart) {
 			p.Part = SnapshotBegin{HostCount: 1, TombstoneCount: uint32(ports.BrokerMaxTombstones) + 1}
 		}), ErrTooLarge},
 		{"commit duplicate host endpoint", func() []SnapshotPart {
-			hosts := sampleSnapshotHosts()
+			hosts := sampleSnapshotDaemons()
 			hosts[1].Endpoint = hosts[0].Endpoint
 			hosts[1].Registration.Endpoint = hosts[0].Endpoint
 			return snapshotPartsFor(5, 3, hosts, nil)
 		}(), ErrSnapshotInvalid},
 		{"commit host endpoint registration mismatch", func() []SnapshotPart {
-			hosts := sampleSnapshotHosts()
+			hosts := sampleSnapshotDaemons()
 			hosts[0].Endpoint = "other@elsewhere:22"
 			return snapshotPartsFor(5, 3, hosts, nil)
 		}(), ErrSnapshotInvalid},
 		{"commit invalid projection", func() []SnapshotPart {
-			hosts := sampleSnapshotHosts()
+			hosts := sampleSnapshotDaemons()
 			hosts[0].Availability = 0
 			return snapshotPartsFor(5, 3, hosts, nil)
 		}(), ErrSnapshotInvalid},
 		{"commit duplicate session name", func() []SnapshotPart {
-			hosts := sampleSnapshotHosts()
+			hosts := sampleSnapshotDaemons()
 			hosts[0].Sessions[1].Name = hosts[0].Sessions[0].Name
 			return snapshotPartsFor(5, 3, hosts, nil)
 		}(), ErrSnapshotInvalid},
 		{"commit tombstone for live host", func() []SnapshotPart {
-			hosts := sampleSnapshotHosts()
+			hosts := sampleSnapshotDaemons()
 			tombstone := testTombstoneAt(0)
 			tombstone.Endpoint = hosts[0].Endpoint
 			tombstone.Registration.Endpoint = hosts[0].Endpoint
 // survives.
 func TestSnapshotAssemblerLatePartAfterCommit(t *testing.T) {
 	a := testSnapshotAssembler(t)
-	parts := snapshotPartsFor(5, 3, sampleSnapshotHosts(), sampleSnapshotTombstones())
+	parts := snapshotPartsFor(5, 3, sampleSnapshotDaemons(), sampleSnapshotTombstones())
 	require.NoError(t, runSnapshotParts(a, parts))
 	late := parts[len(parts)-1]
 	late.Index = uint32(len(parts))
 	require.Equal(t, ports.BrokerRevision(3), committed.Revision)
 }
-// TestSnapshotAssemblerBounds proves the 16,514-part and 80 MiB staged
+// TestSnapshotAssemblerBounds proves the 16,771-part and 80 MiB staged
 // ceilings: maximum counts commit, one over is refused.
 func TestSnapshotAssemblerBounds(t *testing.T) {
 	t.Run("maximum counts commit", func(t *testing.T) {
-		hosts := make([]ports.RemoteHostSnapshot, ports.BrokerMaxHosts)
+		hosts := make([]ports.BrokerDaemonObservation, ports.BrokerMaxDaemonsPerSnapshot)
 		for i := range hosts {
-			host := testHostAt(i)
+			host := testDaemonAt(i)
 			sessions := make([]catalogue.RemoteCatalogSession, ports.BrokerMaxSessionsPerHost)
 			for j := range sessions {
 				sessions[j] = testSessionAt(i, j)
 			}
 		}
 		require.True(t, completed)
-		require.Len(t, snapshot.Hosts, ports.BrokerMaxHosts)
+		require.Len(t, snapshot.Daemons, ports.BrokerMaxDaemonsPerSnapshot)
 		require.Len(t, snapshot.Removed, ports.BrokerMaxTombstones)
-		for _, host := range snapshot.Hosts {
+		for _, host := range snapshot.Daemons {
 			require.Len(t, host.Sessions, ports.BrokerMaxSessionsPerHost)
 		}
 		require.Equal(t, ports.BrokerRevision(12), snapshot.Revision)
 		a := testSnapshotAssembler(t)
 		_, _, err := a.Add(SnapshotPart{
 			Epoch: 7, Connection: testConnectionID(0x21), Generation: 1, Revision: 1, Index: 0,
-			Part: SnapshotBegin{HostCount: 1, SessionCount: uint32(ports.BrokerMaxHosts*ports.BrokerMaxSessionsPerHost) + 1},
+			Part: SnapshotBegin{HostCount: 1, SessionCount: uint32(ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost) + 1},
 		})
 		require.ErrorIs(t, err, ErrTooLarge)
 		require.False(t, a.StagingActive())
 	t.Run("staged byte ceiling aborts and retains", func(t *testing.T) {
 		a := testSnapshotAssembler(t, WithMaxStagedBytes(200))
-		parts := snapshotPartsFor(5, 3, sampleSnapshotHosts(), nil)
+		parts := snapshotPartsFor(5, 3, sampleSnapshotDaemons(), nil)
 		// Begin (32) + host part stay within the cap; the first session part
 		// crosses it.
 		require.NoError(t, runSnapshotParts(a, parts[:2]))
 	session := testSessionAt(0, 0)
 	session.Tabs = maxTabs
 	perSession := estimateCatalogSessionBytes(session)
-	worst := perSession * uint64(ports.BrokerMaxHosts*ports.BrokerMaxSessionsPerHost)
+	worst := perSession * uint64(ports.BrokerMaxDaemonsPerSnapshot*ports.BrokerMaxSessionsPerHost)
 	require.Greater(t, worst, MaxSnapshotStagedBytes, "hostile max tabs must cross the 80 MiB ceiling")
-	host := testHostAt(0)
+	host := testDaemonAt(0)
 	host.Sessions = []catalogue.RemoteCatalogSession{session}
-	parts := snapshotPartsFor(9, 1, []ports.RemoteHostSnapshot{host}, nil)
+	parts := snapshotPartsFor(9, 1, []ports.BrokerDaemonObservation{host}, nil)
 	tight := testSnapshotAssembler(t, WithMaxStagedBytes(perSession))
 	require.NoError(t, runSnapshotParts(tight, parts[:2]))
 	require.NoError(t, runSnapshotParts(generous, parts))
 	committed, ok := generous.Snapshot()
 	require.True(t, ok)
-	require.Len(t, committed.Hosts, 1)
+	require.Len(t, committed.Daemons, 1)
-	require.Len(t, committed.Hosts[0].Sessions, 1)
+	require.Len(t, committed.Daemons[0].Sessions, 1)
-	require.Len(t, committed.Hosts[0].Sessions[0].Tabs, catalogue.RemoteCatalogMaxTabsPerSess)
+	require.Len(t, committed.Daemons[0].Sessions[0].Tabs, catalogue.RemoteCatalogMaxTabsPerSess)
 }
 // TestSnapshotAssemblerAtomicCommit proves publication happens only at End
 // and that the returned snapshot is a defensive clone.
 func TestSnapshotAssemblerAtomicCommit(t *testing.T) {
 	a := testSnapshotAssembler(t)
-	first := snapshotPartsFor(5, 1, sampleSnapshotHosts(), sampleSnapshotTombstones())
+	first := snapshotPartsFor(5, 1, sampleSnapshotDaemons(), sampleSnapshotTombstones())
 	require.NoError(t, runSnapshotParts(a, first))
 	committed, ok := a.Snapshot()
 	require.True(t, ok)
 	require.Equal(t, ports.BrokerRevision(1), committed.Revision)
-	second := snapshotPartsFor(5, 2, sampleSnapshotHosts(), nil)
+	second := snapshotPartsFor(5, 2, sampleSnapshotDaemons(), nil)
 	for _, part := range second[:len(second)-1] {
 		completed, _, err := a.Add(part)
 		require.NoError(t, err)
 	// The committed snapshot is immutable to the caller: mutating a returned
 	// value never reaches the assembler.
-	published.Hosts[0].Endpoint = "mutated@nowhere:22"
+	published.Daemons[0].Endpoint = "mutated@nowhere:22"
-	published.Hosts[0].Sessions[0].Tabs = []catalogue.RemoteCatalogTab{{ID: "injected", Index: 0, Name: "injected"}}
+	published.Daemons[0].Sessions[0].Tabs = []catalogue.RemoteCatalogTab{{ID: "injected", Index: 0, Name: "injected"}}
-	published.Hosts[0].Sessions[0].Name = "mutated"
+	published.Daemons[0].Sessions[0].Name = "mutated"
 	again, ok := a.Snapshot()
 	require.True(t, ok)
-	require.Equal(t, "user0@host0:22", again.Hosts[0].Endpoint)
+	require.Equal(t, "user0@host0:22", again.Daemons[0].Endpoint)
-	require.Equal(t, "s00-000", again.Hosts[0].Sessions[0].Name)
+	require.Equal(t, "s00-000", again.Daemons[0].Sessions[0].Name)
-	require.Empty(t, again.Hosts[0].Sessions[0].Tabs)
+	require.Empty(t, again.Daemons[0].Sessions[0].Tabs)
 	// An aborted transfer retains the committed snapshot.
-	require.NoError(t, runSnapshotParts(a, snapshotPartsFor(5, 3, sampleSnapshotHosts(), nil)[:2]))
+	require.NoError(t, runSnapshotParts(a, snapshotPartsFor(5, 3, sampleSnapshotDaemons(), nil)[:2]))
-	_, _, err = a.Add(snapshotPartsFor(5, 3, sampleSnapshotHosts(), nil)[4])
+	_, _, err = a.Add(snapshotPartsFor(5, 3, sampleSnapshotDaemons(), nil)[4])
 	require.ErrorIs(t, err, ErrSnapshotInvalid)
 	again, ok = a.Snapshot()
 	require.True(t, ok)
 // transfer starts from index 0.
 func TestSnapshotAssemblerInterruptedRetention(t *testing.T) {
 	a := testSnapshotAssembler(t)
-	parts := snapshotPartsFor(5, 1, sampleSnapshotHosts(), sampleSnapshotTombstones())
+	parts := snapshotPartsFor(5, 1, sampleSnapshotDaemons(), sampleSnapshotTombstones())
 	require.NoError(t, runSnapshotParts(a, parts))
 	committed, ok := a.Snapshot()
 	require.True(t, ok)
 	require.Equal(t, ports.BrokerRevision(1), committed.Revision)
-	restart := snapshotPartsFor(5, 2, sampleSnapshotHosts(), sampleSnapshotTombstones())
+	restart := snapshotPartsFor(5, 2, sampleSnapshotDaemons(), sampleSnapshotTombstones())
 	require.NoError(t, runSnapshotParts(a, restart[:3]))
 	require.True(t, a.StagingActive())
 	a.DiscardStaging()
 // staging.
 func TestSnapshotAssemblerRevisionFencing(t *testing.T) {
 	a := testSnapshotAssembler(t)
-	hosts := sampleSnapshotHosts()
+	hosts := sampleSnapshotDaemons()
 	require.NoError(t, runSnapshotParts(a, snapshotPartsFor(5, 5, hosts, nil)))
 	t.Run("older revision refused", func(t *testing.T) {
 // replaces staging: equal revisions restart progress, newer revisions
 // coalesce.
 func TestSnapshotAssemblerCoalescing(t *testing.T) {
-	hosts := sampleSnapshotHosts()
+	hosts := sampleSnapshotDaemons()
 	base := snapshotPartsFor(5, 3, hosts, nil)
 	a := testSnapshotAssembler(t)
 // one generation, ignores stale parts, rejects future parts, and refuses a
 // zero generation.
 func TestSnapshotAssemblerGenerationFencing(t *testing.T) {
-	hosts := sampleSnapshotHosts()
+	hosts := sampleSnapshotDaemons()
 	base := snapshotPartsFor(5, 3, hosts, nil)
 	t.Run("zero generation refused", func(t *testing.T) {
 // TestSnapshotAssemblerScopeFencing proves every part must carry the exact
 // assigned epoch and connection, whether or not a transfer is in flight.
 func TestSnapshotAssemblerScopeFencing(t *testing.T) {
-	base := snapshotPartsFor(5, 3, sampleSnapshotHosts(), nil)
+	base := snapshotPartsFor(5, 3, sampleSnapshotDaemons(), nil)
 	cases := []struct {
 		name  string
 		apply func(*SnapshotPart)
 // TestSnapshotAssemblerZeroRevision proves a zero revision is refused.
 func TestSnapshotAssemblerZeroRevision(t *testing.T) {
 	a := testSnapshotAssembler(t)
-	part := snapshotPartsFor(5, 3, sampleSnapshotHosts(), nil)[0]
+	part := snapshotPartsFor(5, 3, sampleSnapshotDaemons(), nil)[0]
 	part.Revision = 0
 	_, _, err := a.Add(part)
 	require.ErrorIs(t, err, ErrSnapshotInvalid)
 // part from the first one.
 func TestSnapshotAssemblerPinnedGeneration(t *testing.T) {
 	a := testSnapshotAssembler(t, WithGeneration(5))
-	stale := snapshotPartsFor(4, 1, sampleSnapshotHosts(), nil)[0]
+	stale := snapshotPartsFor(4, 1, sampleSnapshotDaemons(), nil)[0]
 	_, _, err := a.Add(stale)
 	require.ErrorIs(t, err, ErrStaleGeneration)
-	future := snapshotPartsFor(6, 1, sampleSnapshotHosts(), nil)[0]
+	future := snapshotPartsFor(6, 1, sampleSnapshotDaemons(), nil)[0]
 	_, _, err = a.Add(future)
 	require.ErrorIs(t, err, ErrFutureGeneration)
-	require.NoError(t, runSnapshotParts(a, snapshotPartsFor(5, 1, sampleSnapshotHosts(), nil)))
+	require.NoError(t, runSnapshotParts(a, snapshotPartsFor(5, 1, sampleSnapshotDaemons(), nil)))
 	committed, ok := a.Snapshot()
 	require.True(t, ok)
 	require.Equal(t, ports.BrokerRevision(1), committed.Revision)
 // keeps publishing it until a newer transfer commits.
 func TestSnapshotAssemblerAdoptCommitted(t *testing.T) {
 	source := testSnapshotAssembler(t)
-	require.NoError(t, runSnapshotParts(source, snapshotPartsFor(5, 3, sampleSnapshotHosts(), sampleSnapshotTombstones())))
+	require.NoError(t, runSnapshotParts(source, snapshotPartsFor(5, 3, sampleSnapshotDaemons(), sampleSnapshotTombstones())))
 	committed, ok := source.Snapshot()
 	require.True(t, ok)
 	require.Len(t, adopted.Removed, 1)
 	// An older revision and a foreign epoch are ignored.
-	target.adoptCommitted(ports.BrokerSnapshot{Epoch: committed.Epoch, Revision: 2, Hosts: committed.Hosts})
+	target.adoptCommitted(ports.BrokerSnapshot{Epoch: committed.Epoch, Revision: 2, Daemons: committed.Daemons})
-	target.adoptCommitted(ports.BrokerSnapshot{Epoch: committed.Epoch + 1, Revision: 9, Hosts: committed.Hosts})
+	target.adoptCommitted(ports.BrokerSnapshot{Epoch: committed.Epoch + 1, Revision: 9, Daemons: committed.Daemons})
 	adopted, ok = target.Snapshot()
 	require.True(t, ok)
 	require.Equal(t, ports.BrokerRevision(3), adopted.Revision)
 	// A newer transfer commits over the adopted snapshot.
-	require.NoError(t, runSnapshotParts(target, snapshotPartsFor(6, 4, sampleSnapshotHosts(), nil)))
+	require.NoError(t, runSnapshotParts(target, snapshotPartsFor(6, 4, sampleSnapshotDaemons(), nil)))
 	adopted, ok = target.Snapshot()
 	require.True(t, ok)
 	require.Equal(t, ports.BrokerRevision(4), adopted.Revision)
 	require.Empty(t, adopted.Removed)
 	// The adopted value is independent of the source.
-	adopted.Hosts[0].Endpoint = "mutated@nowhere:22"
+	adopted.Daemons[0].Endpoint = "mutated@nowhere:22"
 	again, ok := source.Snapshot()
 	require.True(t, ok)
-	require.Equal(t, "user0@host0:22", again.Hosts[0].Endpoint)
+	require.Equal(t, "user0@host0:22", again.Daemons[0].Endpoint)
 }
 // TestSnapshotAssemblerConcurrentReaders is a deterministic race test: one
 		}()
 	}
 	for revision := 1; revision <= revisions; revision++ {
-		parts := snapshotPartsFor(5, ports.BrokerRevision(revision), sampleSnapshotHosts(), nil)
+		parts := snapshotPartsFor(5, ports.BrokerRevision(revision), sampleSnapshotDaemons(), nil)
 		for _, part := range parts {
 			_, _, err := a.Add(part)
 			require.NoError(t, err)
 		require.NoError(tb, err)
 		return raw
 	}
-	parts := snapshotPartsFor(4, 2, sampleSnapshotHosts(), sampleSnapshotTombstones())
+	parts := snapshotPartsFor(4, 2, sampleSnapshotDaemons(), sampleSnapshotTombstones())
 	frames := make([][]byte, 0, len(parts))
 	for _, part := range parts {
 		frames = append(frames, encode(part))
 }
 // requireValidBrokerSnapshot asserts one published snapshot is exactly what the
-// assembler promises: a validated snapshot with durable host projections.
+// assembler promises: a validated snapshot with durable remote daemon
+// projections (the local daemon is process-local and never durable).
 func requireValidBrokerSnapshot(t *testing.T, snapshot ports.BrokerSnapshot) {
 	t.Helper()
 	require.NoError(t, snapshot.Validate())
-	for _, host := range snapshot.Hosts {
+	for _, daemon := range snapshot.Daemons {
-		require.NoError(t, ports.ValidateDurableHostProjection(host))
+		if daemon.Local {
+			continue
+		}
+		require.NoError(t, ports.ValidateDurableHostProjection(daemon))
 	}
 }

M internal/adapters/brokerwire/state_test.go +11 -11


@@ -123,7 +123,7 @@ func TestConnStateString(t *testing.T) {
123		// Register -> Closing -> Closed.	123		// Register -> Closing -> Closed.
124		func TestConnectionLifecycle(t *testing.T) {	124		func TestConnectionLifecycle(t *testing.T) {
125		op := operationIDAt(1)	125		op := operationIDAt(1)
126	-	part := snapshotPartsFor(1, 1, sampleSnapshotHosts(), nil)[0]	126	+	part := snapshotPartsFor(1, 1, sampleSnapshotDaemons(), nil)[0]
127		cases := []struct {	127		cases := []struct {
128		name string	128		name string
129		setup func(testing.T) Connection	129		setup func(testing.T) Connection

@@ -285,7 +285,7 @@ func stageConnectionPart(t testing.T, conn Connection, part SnapshotPart) {
285		func TestConnectionSubscriptionStagingRetention(t *testing.T) {	285		func TestConnectionSubscriptionStagingRetention(t *testing.T) {
286		conn := readyTestConnection(t)	286		conn := readyTestConnection(t)
287		require.NoError(t, conn.Subscribe(1))	287		require.NoError(t, conn.Subscribe(1))
288	-	for _, part := range snapshotPartsFor(1, 4, sampleSnapshotHosts(), sampleSnapshotTombstones()) {	288	+	for _, part := range snapshotPartsFor(1, 4, sampleSnapshotDaemons(), sampleSnapshotTombstones()) {
289		stageConnectionPart(t, conn, part)	289		stageConnectionPart(t, conn, part)
290		}	290		}
291		committed, ok := conn.Snapshot()	291		committed, ok := conn.Snapshot()

@@ -293,7 +293,7 @@ func TestConnectionSubscriptionStagingRetention(t *testing.T) {
293		require.Equal(t, ports.BrokerRevision(4), committed.Revision)	293		require.Equal(t, ports.BrokerRevision(4), committed.Revision)
294			294
295		// In-flight staging of the active generation is discarded on advance.	295		// In-flight staging of the active generation is discarded on advance.
296	-	inFlight := snapshotPartsFor(1, 6, sampleSnapshotHosts(), nil)	296	+	inFlight := snapshotPartsFor(1, 6, sampleSnapshotDaemons(), nil)
297		stageConnectionPart(t, conn, inFlight[0])	297		stageConnectionPart(t, conn, inFlight[0])
298		require.True(t, conn.StagingActive())	298		require.True(t, conn.StagingActive())
299		require.NoError(t, conn.Subscribe(2))	299		require.NoError(t, conn.Subscribe(2))

@@ -312,7 +312,7 @@ func TestConnectionSubscriptionStagingRetention(t *testing.T) {
312		future.Generation = 3	312		future.Generation = 3
313		_, _, err = conn.AddSnapshotPart(future)	313		_, _, err = conn.AddSnapshotPart(future)
314		require.ErrorIs(t, err, ErrFutureGeneration)	314		require.ErrorIs(t, err, ErrFutureGeneration)
315	-	next := snapshotPartsFor(2, 5, sampleSnapshotHosts(), nil)	315	+	next := snapshotPartsFor(2, 5, sampleSnapshotDaemons(), nil)
316		_, _, err = conn.AddSnapshotPart(next[1])	316		_, _, err = conn.AddSnapshotPart(next[1])
317		require.ErrorIs(t, err, ErrSnapshotInvalid)	317		require.ErrorIs(t, err, ErrSnapshotInvalid)
318		require.False(t, conn.StagingActive())	318		require.False(t, conn.StagingActive())

@@ -352,7 +352,7 @@ func TestConnectionSnapshotParts(t *testing.T) {
352		t.Run("future generation rejected", func(t *testing.T) {	352		t.Run("future generation rejected", func(t *testing.T) {
353		conn := readyTestConnection(t)	353		conn := readyTestConnection(t)
354		require.NoError(t, conn.Subscribe(2))	354		require.NoError(t, conn.Subscribe(2))
355	-	part := snapshotPartsFor(1, 1, sampleSnapshotHosts(), nil)[0]	355	+	part := snapshotPartsFor(1, 1, sampleSnapshotDaemons(), nil)[0]
356		part.Generation = 3	356		part.Generation = 3
357		_, _, err := conn.AddSnapshotPart(part)	357		_, _, err := conn.AddSnapshotPart(part)
358		require.ErrorIs(t, err, ErrFutureGeneration)	358		require.ErrorIs(t, err, ErrFutureGeneration)

@@ -364,11 +364,11 @@ func TestConnectionSnapshotParts(t *testing.T) {
364		t.Run("foreign scope rejected", func(t *testing.T) {	364		t.Run("foreign scope rejected", func(t *testing.T) {
365		conn := readyTestConnection(t)	365		conn := readyTestConnection(t)
366		require.NoError(t, conn.Subscribe(2))	366		require.NoError(t, conn.Subscribe(2))
367	-	part := snapshotPartsFor(2, 1, sampleSnapshotHosts(), nil)[0]	367	+	part := snapshotPartsFor(2, 1, sampleSnapshotDaemons(), nil)[0]
368		part.Epoch = 8	368		part.Epoch = 8
369		_, _, err := conn.AddSnapshotPart(part)	369		_, _, err := conn.AddSnapshotPart(part)
370		require.ErrorIs(t, err, ErrScopeMismatch)	370		require.ErrorIs(t, err, ErrScopeMismatch)
371	-	part = snapshotPartsFor(2, 1, sampleSnapshotHosts(), nil)[0]	371	+	part = snapshotPartsFor(2, 1, sampleSnapshotDaemons(), nil)[0]
372		part.Connection = testConnectionID(0x77)	372		part.Connection = testConnectionID(0x77)
373		_, _, err = conn.AddSnapshotPart(part)	373		_, _, err = conn.AddSnapshotPart(part)
374		require.ErrorIs(t, err, ErrScopeMismatch)	374		require.ErrorIs(t, err, ErrScopeMismatch)

@@ -377,7 +377,7 @@ func TestConnectionSnapshotParts(t *testing.T) {
377		t.Run("complete transfer through the connection", func(t *testing.T) {	377		t.Run("complete transfer through the connection", func(t *testing.T) {
378		conn := readyTestConnection(t)	378		conn := readyTestConnection(t)
379		require.NoError(t, conn.Subscribe(9))	379		require.NoError(t, conn.Subscribe(9))
380	-	parts := snapshotPartsFor(9, 2, sampleSnapshotHosts(), sampleSnapshotTombstones())	380	+	parts := snapshotPartsFor(9, 2, sampleSnapshotDaemons(), sampleSnapshotTombstones())
381		var published bool	381		var published bool
382		for _, part := range parts {	382		for _, part := range parts {
383		completed, _, err := conn.AddSnapshotPart(part)	383		completed, _, err := conn.AddSnapshotPart(part)

@@ -410,7 +410,7 @@ func TestConnectionExactScopeRegistration(t *testing.T) {
410		_, err = connectionStreams(conn).Close(other, 1)	410		_, err = connectionStreams(conn).Close(other, 1)
411		require.ErrorIs(t, err, ErrScopeMismatch)	411		require.ErrorIs(t, err, ErrScopeMismatch)
412			412
413	-	part := snapshotPartsFor(1, 1, sampleSnapshotHosts(), nil)[0]	413	+	part := snapshotPartsFor(1, 1, sampleSnapshotDaemons(), nil)[0]
414		part.Connection = other.Connection	414		part.Connection = other.Connection
415		part.Epoch = other.Epoch	415		part.Epoch = other.Epoch
416		require.NoError(t, conn.Subscribe(1))	416		require.NoError(t, conn.Subscribe(1))

@@ -914,7 +914,7 @@ func TestStreamTrackerConcurrentFrames(t *testing.T) {
914		func TestConnectionConcurrentWork(t *testing.T) {	914		func TestConnectionConcurrentWork(t *testing.T) {
915		conn := readyTestConnection(t)	915		conn := readyTestConnection(t)
916		require.NoError(t, conn.Subscribe(1))	916		require.NoError(t, conn.Subscribe(1))
917	-	hosts := sampleSnapshotHosts()	917	+	hosts := sampleSnapshotDaemons()
918		const revisions = 20	918		const revisions = 20
919		const operations = 32	919		const operations = 32
920		for i := 0; i < operations; i++ {	920		for i := 0; i < operations; i++ {

@@ -1069,7 +1069,7 @@ func TestConnectionCloseRaceNoPostCloseSnapshotCommit(t *testing.T) {
1069		for i := 0; i < attempts; i++ {	1069		for i := 0; i < attempts; i++ {
1070		conn := readyTestConnection(t)	1070		conn := readyTestConnection(t)
1071		require.NoError(t, conn.Subscribe(2))	1071		require.NoError(t, conn.Subscribe(2))
1072	-	parts := snapshotPartsFor(2, revision, sampleSnapshotHosts(), nil)	1072	+	parts := snapshotPartsFor(2, revision, sampleSnapshotDaemons(), nil)
1073		end := parts[len(parts)-1]	1073		end := parts[len(parts)-1]
1074		for _, part := range parts[:len(parts)-1] {	1074		for _, part := range parts[:len(parts)-1] {
1075		stageConnectionPart(t, conn, part)	1075		stageConnectionPart(t, conn, part)

M internal/adapters/daemonmux/codec.go +24 -6

 		return nil, ErrInvalidMessage
 	}
 	request := ports.BrokerOpenStreamRequest{
-		Epoch: m.Ref.Epoch, Purpose: m.Purpose, Local: m.Local,
+		Epoch: m.Ref.Epoch, Purpose: m.Purpose, Admission: m.Admission, Name: m.Name, Local: m.Local,
 		Connection: m.Ref.Connection, Stream: m.Ref.Client,
 		Endpoint: m.Endpoint, Registration: m.Registration,
 		Target: m.Target, Env: m.Env, Policy: m.Policy,
 		out.Registration = registrationToWire(m.Registration)
 	}
 	if m.Purpose == ports.BrokerStreamAttachment {
-		out.Target = exactTargetToWire(m.Target)
+		out.Admission = uint32(m.Admission)
+		out.Name = m.Name
+		if m.Admission == ports.BrokerAdmissionExact {
+			out.Target = exactTargetToWire(m.Target)
+		}
 	}
 	return out, nil
 }
 	if err != nil {
 		return Open{}, err
 	}
+	// Narrow the wire uint32 before the cast: a value whose high bits
+	// truncate onto a valid admission code would otherwise alias silently.
+	admission, err := muxEnum8[ports.BrokerStreamAdmission](message.GetAdmission())
+	if err != nil {
+		return Open{}, ErrInvalidMessage
+	}
+	name := message.GetName()
+	if purpose != ports.BrokerStreamAttachment && (admission != 0 || name != "") {
+		return Open{}, ErrInvalidMessage
+	}
 	local := message.GetLocal()
 	var registration domain.RemoteRegistration
 	if !local {
 	}
 	var target protocol.ExactSessionTarget
 	if purpose == ports.BrokerStreamAttachment {
-		target, err = exactTargetFromWire(message.GetTarget())
+		if admission == ports.BrokerAdmissionExact {
-		if err != nil {
+			target, err = exactTargetFromWire(message.GetTarget())
+			if err != nil {
+				return Open{}, ErrInvalidMessage
+			}
+		} else if message.GetTarget() != nil {
 			return Open{}, ErrInvalidMessage
 		}
 	} else if message.GetTarget() != nil {
 	}
 	endpoint := message.GetEndpoint()
 	candidate := Open{
-		Ref: ref, Purpose: purpose, Local: local, Endpoint: endpoint,
+		Ref: ref, Purpose: purpose, Admission: admission, Name: name, Local: local, Endpoint: endpoint,
 		Registration: registration, Target: target, Env: env, Policy: policy,
 	}
 	request := ports.BrokerOpenStreamRequest{
-		Epoch: candidate.Ref.Epoch, Purpose: candidate.Purpose, Local: candidate.Local,
+		Epoch: candidate.Ref.Epoch, Purpose: candidate.Purpose, Admission: candidate.Admission, Name: candidate.Name, Local: candidate.Local,
 		Connection: candidate.Ref.Connection, Stream: candidate.Ref.Client,
 		Endpoint: candidate.Endpoint, Registration: candidate.Registration,
 		Target: candidate.Target, Env: candidate.Env, Policy: candidate.Policy,

M internal/adapters/daemonmux/codec_test.go +119 -1


@@ -94,7 +94,7 @@ func mustEncodeServer(t *testing.T, message ServerMessage) []byte {
94			94
95		func testOpen() Open {	95		func testOpen() Open {
96		return Open{	96		return Open{
97	-	Ref: testRef(5), Purpose: ports.BrokerStreamAttachment, Local: false,	97	+	Ref: testRef(5), Purpose: ports.BrokerStreamAttachment, Admission: ports.BrokerAdmissionExact, Local: false,
98		Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(),	98		Endpoint: "dev@host:22", Registration: testRegistration(), Target: testTarget(),
99		Env: []string{"TERM=xterm-256color"}, Policy: testPolicy(),	99		Env: []string{"TERM=xterm-256color"}, Policy: testPolicy(),
100		}	100		}

@@ -662,3 +662,121 @@ func FuzzDecodeServer(f *testing.F) {
662		_, _ = DecodeServer(payload, testEnvelopeCeiling, testChunkCeiling)	662		_, _ = DecodeServer(payload, testEnvelopeCeiling, testChunkCeiling)
663		})	663		})
664		}	664		}
			665	+
			666	+	// TestMuxAdmissionVariants proves the attachment-admission contract travels
			667	+	// the mux wire losslessly and rejects every incoherent combination at the
			668	+	// same boundary the ports contract rejects it.
			669	+	func TestMuxAdmissionVariants(t *testing.T) {
			670	+	roundTrip := func(t *testing.T, open Open) Open {
			671	+	t.Helper()
			672	+	raw, err := EncodeClient(open, testEnvelopeCeiling, testChunkCeiling)
			673	+	require.NoError(t, err)
			674	+	decoded, err := DecodeClient(raw, testEnvelopeCeiling, testChunkCeiling)
			675	+	require.NoError(t, err)
			676	+	open, ok := decoded.(Open)
			677	+	require.True(t, ok)
			678	+	return open
			679	+	}
			680	+	t.Run("exact attach round-trips", func(t *testing.T) {
			681	+	require.Equal(t, testOpen(), roundTrip(t, testOpen()))
			682	+	})
			683	+	t.Run("named creation round-trips", func(t *testing.T) {
			684	+	named := testOpen()
			685	+	named.Admission = ports.BrokerAdmissionCreateNamed
			686	+	named.Name = "work"
			687	+	named.Target = protocol.ExactSessionTarget{}
			688	+	require.Equal(t, named, roundTrip(t, named))
			689	+	})
			690	+	t.Run("ephemeral creation round-trips", func(t *testing.T) {
			691	+	ephemeral := testOpen()
			692	+	ephemeral.Admission = ports.BrokerAdmissionCreateEphemeral
			693	+	ephemeral.Target = protocol.ExactSessionTarget{}
			694	+	require.Equal(t, ephemeral, roundTrip(t, ephemeral))
			695	+	})
			696	+	t.Run("control never carries admission", func(t *testing.T) {
			697	+	control := Open{Ref: testRef(6), Purpose: ports.BrokerStreamControl, Local: true, Policy: testPolicy()}
			698	+	require.Equal(t, control, roundTrip(t, control))
			699	+	mutated := mustEncodeClient(t, control)
			700	+	envelope := &wire.MuxClientEnvelope{}
			701	+	require.NoError(t, proto.Unmarshal(mutated, envelope))
			702	+	envelope.GetOpen().Admission = 2
			703	+	envelope.GetOpen().Name = "work"
			704	+	mutated, err := proto.Marshal(envelope)
			705	+	require.NoError(t, err)
			706	+	_, err = DecodeClient(mutated, testEnvelopeCeiling, testChunkCeiling)
			707	+	require.ErrorIs(t, err, ErrInvalidMessage)
			708	+	})
			709	+	t.Run("exact with a creation name is refused", func(t *testing.T) {
			710	+	open := testOpen()
			711	+	open.Name = "work"
			712	+	_, err := EncodeClient(open, testEnvelopeCeiling, testChunkCeiling)
			713	+	require.ErrorIs(t, err, ErrInvalidMessage)
			714	+	})
			715	+	t.Run("named creation with a target is refused", func(t *testing.T) {
			716	+	named := testOpen()
			717	+	named.Admission = ports.BrokerAdmissionCreateNamed
			718	+	named.Name = "work"
			719	+	_, err := EncodeClient(named, testEnvelopeCeiling, testChunkCeiling)
			720	+	require.ErrorIs(t, err, ErrInvalidMessage)
			721	+	})
			722	+	t.Run("unknown admission code is refused", func(t *testing.T) {
			723	+	raw := mustEncodeClient(t, testOpen())
			724	+	envelope := &wire.MuxClientEnvelope{}
			725	+	require.NoError(t, proto.Unmarshal(raw, envelope))
			726	+	envelope.GetOpen().Admission = 9
			727	+	mutated, err := proto.Marshal(envelope)
			728	+	require.NoError(t, err)
			729	+	_, err = DecodeClient(mutated, testEnvelopeCeiling, testChunkCeiling)
			730	+	require.ErrorIs(t, err, ErrInvalidMessage)
			731	+	})
			732	+	}
			733	+
			734	+	// TestMuxAdmissionWireRange proves the MuxOpen decoder narrows the wire
			735	+	// admission field before any cast: the accepted semantic set (no admission, or
			736	+	// one of the three closed admission codes) is unchanged, while every wire value
			737	+	// whose high bits would alias a valid code is refused instead of silently
			738	+	// truncating onto that code.
			739	+	func TestMuxAdmissionWireRange(t *testing.T) {
			740	+	control := Open{Ref: testRef(6), Purpose: ports.BrokerStreamControl, Local: true, Policy: testPolicy()}
			741	+	named := testOpen()
			742	+	named.Admission = ports.BrokerAdmissionCreateNamed
			743	+	named.Name = "work"
			744	+	named.Target = protocol.ExactSessionTarget{}
			745	+	ephemeral := testOpen()
			746	+	ephemeral.Admission = ports.BrokerAdmissionCreateEphemeral
			747	+	ephemeral.Target = protocol.ExactSessionTarget{}
			748	+
			749	+	tests := []struct {
			750	+	name string
			751	+	base Open
			752	+	admission uint32
			753	+	wantErr bool
			754	+	}{
			755	+	{"no admission on a control stream", control, 0, false},
			756	+	{"exact admission", testOpen(), uint32(ports.BrokerAdmissionExact), false},
			757	+	{"create-named admission", named, uint32(ports.BrokerAdmissionCreateNamed), false},
			758	+	{"create-ephemeral admission", ephemeral, uint32(ports.BrokerAdmissionCreateEphemeral), false},
			759	+	{"wire value 257 aliasing exact", testOpen(), 257, true},
			760	+	{"wire value 258 aliasing create-named", named, 258, true},
			761	+	{"wire value 1024 aliasing no admission", control, 1024, true},
			762	+	{"wire value max uint32", control, 1<<32 - 1, true},
			763	+	}
			764	+	for _, tc := range tests {
			765	+	t.Run(tc.name, func(t *testing.T) {
			766	+	raw := mustEncodeClient(t, tc.base)
			767	+	envelope := &wire.MuxClientEnvelope{}
			768	+	require.NoError(t, proto.Unmarshal(raw, envelope))
			769	+	envelope.GetOpen().Admission = tc.admission
			770	+	mutated, err := proto.Marshal(envelope)
			771	+	require.NoError(t, err)
			772	+	decoded, err := DecodeClient(mutated, testEnvelopeCeiling, testChunkCeiling)
			773	+	if tc.wantErr {
			774	+	require.ErrorIs(t, err, ErrInvalidMessage)
			775	+	require.Zero(t, decoded, "an out-of-range wire value is never accepted as an alias")
			776	+	return
			777	+	}
			778	+	require.NoError(t, err)
			779	+	require.Equal(t, tc.base, decoded)
			780	+	})
			781	+	}
			782	+	}

M internal/adapters/daemonmux/messages.go +2 -0


@@ -80,6 +80,8 @@ func (r StreamRef) Validate() error {
80	type Open struct {	80		type Open struct {
81	Ref StreamRef	81		Ref StreamRef
82	Purpose ports.BrokerStreamPurpose	82		Purpose ports.BrokerStreamPurpose
		83	+	Admission ports.BrokerStreamAdmission
		84	+	Name string
83	Local bool	85		Local bool
84	Endpoint string	86		Endpoint string
85	Registration domain.RemoteRegistration	87		Registration domain.RemoteRegistration

M internal/app/broker_offline_status.go +9 -1

 }
 // readyBrokerStatus projects one committed snapshot into the ready report.
+// HostCount counts configured remote hosts; the local daemon observation is
+// not a configured host.
 func readyBrokerStatus(socketPath string, snapshot ports.BrokerSnapshot) brokerStatusReport {
+	hosts := 0
+	for _, daemon := range snapshot.Daemons {
+		if !daemon.Local {
+			hosts++
+		}
+	}
 	return brokerStatusReport{
 		Status:    "ready",
 		Endpoint:  socketPath,
 		Epoch:     snapshot.Epoch,
 		Revision:  snapshot.Revision,
-		HostCount: len(snapshot.Hosts),
+		HostCount: hosts,
 	}
 }

M internal/ports/broker.go +167 -57

 		t.Registration.Generation >= candidate.Generation
 }
-// BrokerSnapshot is an immutable, fully defensive broker publication. Hosts
+// BrokerSnapshot is an immutable, fully defensive broker publication.
-// reuse the ordered RemoteHostSnapshot projection; Removed carries the
+// Daemons carries the broker-native daemon observations (Plan 001 P5.2a):
-// bounded tombstone set that fences stale authority. Nested slices are
+// the local daemon entry first when present, then remote hosts in
-// never mutated after publication. Removed is process-local fencing state and
+// registration order. Removed carries the bounded tombstone set that fences
-// is never durable: a BrokerSnapshotStore persists and reloads hosts without
+// stale authority. Nested slices are never mutated after publication.
-// tombstones.
+// Tombstones and the local daemon observation are process-local state and
+// are never durable: a BrokerSnapshotStore persists and reloads remote
+// daemon observations only.
 type BrokerSnapshot struct {
 	Epoch    BrokerEpoch
 	Revision BrokerRevision
-	Hosts    []RemoteHostSnapshot
+	Daemons  []BrokerDaemonObservation
 	Removed  []BrokerHostTombstone
 }
 	if s.Revision == 0 {
 		return errors.New("ports: broker snapshot has no revision")
 	}
-	if len(s.Hosts) > BrokerMaxHosts {
+	if len(s.Daemons) > BrokerMaxDaemonsPerSnapshot {
-		return errors.New("ports: broker snapshot has too many hosts")
+		return errors.New("ports: broker snapshot has too many daemons")
 	}
-	if len(s.Removed) > BrokerMaxTombstones {
+	local := false
-		return errors.New("ports: broker snapshot has too many tombstones")
+	seen := make(map[string]struct{}, len(s.Daemons))
-	}
+	for i, daemon := range s.Daemons {
-	seen := make(map[string]struct{}, len(s.Hosts))
+		if err := daemon.Validate(); err != nil {
-	for _, host := range s.Hosts {
+			return fmt.Errorf("ports: broker snapshot daemon %d: %w", i, err)
-		if err := domain.ValidateRemoteHostTarget(host.Endpoint); err != nil {
-			return fmt.Errorf("ports: broker snapshot: %w", err)
-		}
-		if err := host.Registration.Validate(); err != nil {
-			return fmt.Errorf("ports: broker snapshot: %w", err)
 		}
-		if host.Endpoint != host.Registration.Endpoint {
+		if daemon.Local {
-			return errors.New("ports: broker snapshot host endpoint does not match registration")
+			if local {
+				return errors.New("ports: broker snapshot has more than one local daemon")
+			}
+			// The wire layout carries the local daemon at index zero only, so a
+			// local observation anywhere else is a publication the peer's
+			// assembler refuses. Refuse it at the contract gate instead.
+			if i != 0 {
+				return fmt.Errorf("ports: broker snapshot carries its local daemon at index %d", i)
+			}
+			local = true
+			continue
 		}
-		if len(host.Sessions) > BrokerMaxSessionsPerHost {
+		if _, dup := seen[daemon.Endpoint]; dup {
-			return errors.New("ports: broker snapshot host has too many sessions")
+			return fmt.Errorf("ports: broker snapshot has duplicate host %q", daemon.Endpoint)
 		}
-		if _, dup := seen[host.Endpoint]; dup {
+		seen[daemon.Endpoint] = struct{}{}
-			return fmt.Errorf("ports: broker snapshot has duplicate host %q", host.Endpoint)
+	}
-		}
+	if len(s.Removed) > BrokerMaxTombstones {
-		seen[host.Endpoint] = struct{}{}
+		return errors.New("ports: broker snapshot has too many tombstones")
 	}
 	for _, tombstone := range s.Removed {
 		if err := tombstone.Validate(); err != nil {
 	return nil
 }
-// Clone returns a defensive copy with independent host, session, tab, and
+// Clone returns a defensive copy with independent daemon, session, and
 // tombstone slices.
 func (s BrokerSnapshot) Clone() BrokerSnapshot {
 	out := s
-	out.Hosts = make([]RemoteHostSnapshot, len(s.Hosts))
+	out.Daemons = make([]BrokerDaemonObservation, len(s.Daemons))
-	for i, host := range s.Hosts {
+	for i, daemon := range s.Daemons {
-		out.Hosts[i] = host.Clone()
+		out.Daemons[i] = daemon.Clone()
 	}
 	out.Removed = append([]BrokerHostTombstone(nil), s.Removed...)
 	return out
 }
-// Find returns the snapshot for an exact endpoint identity.
+// Find returns the observation for an exact remote endpoint identity. The
-func (s BrokerSnapshot) Find(endpoint string) (RemoteHostSnapshot, bool) {
+// local daemon has no endpoint and is located by its Local flag.
-	for _, host := range s.Hosts {
+func (s BrokerSnapshot) Find(endpoint string) (BrokerDaemonObservation, bool) {
-		if host.Endpoint == endpoint {
+	for _, daemon := range s.Daemons {
-			return host, true
+		if !daemon.Local && daemon.Endpoint == endpoint {
+			return daemon, true
 		}
 	}
-	return RemoteHostSnapshot{}, false
+	return BrokerDaemonObservation{}, false
 }
 // Supersedes reports whether s is newer than other. Any epoch change
 	return !currentRegistration.Equal(completionRegistration)
 }
+// BrokerStreamAdmission is the closed attachment-admission taxonomy
+// (Plan 001 P5.3a, contract-only until the admission slice wires it):
+// an attachment stream names exactly how the daemon must admit it.
+// Control and observation streams carry no admission.
+type BrokerStreamAdmission uint8
+const (
+	// BrokerAdmissionExact attaches to one exact session lifecycle identity;
+	// the daemon revalidates it before attachment.
+	BrokerAdmissionExact BrokerStreamAdmission = iota + 1
+	// BrokerAdmissionCreateNamed creates one named session when the stream
+	// attaches; the name is validated session-name authority.
+	BrokerAdmissionCreateNamed
+	// BrokerAdmissionCreateEphemeral creates one ephemeral session when the
+	// stream attaches.
+	BrokerAdmissionCreateEphemeral
+)
+func (a BrokerStreamAdmission) String() string {
+	switch a {
+	case BrokerAdmissionExact:
+		return "exact"
+	case BrokerAdmissionCreateNamed:
+		return "create_named"
+	case BrokerAdmissionCreateEphemeral:
+		return "create_ephemeral"
+	default:
+		return fmt.Sprintf("invalid(%d)", uint8(a))
+	}
+}
+func (a BrokerStreamAdmission) Validate() error {
+	switch a {
+	case BrokerAdmissionExact, BrokerAdmissionCreateNamed, BrokerAdmissionCreateEphemeral:
+		return nil
+	default:
+		return errors.New("ports: invalid broker stream admission")
+	}
+}
 // BrokerOpenStreamRequest asks the broker to open one independently
 // cancellable logical stream to the owning daemon. The daemon revalidates
-// the exact session identity before attachment. Env is the per-request
+// the exact session identity before attachment. Admission selects the
-// session environment; it is never inherited from the broker process
+// attachment admission variant; Name is the validated session name for
-// environment.
+// BrokerAdmissionCreateNamed and is empty for every other variant. Env is
+// the per-request session environment; it is never inherited from the
+// broker process environment.
 type BrokerOpenStreamRequest struct {
 	Epoch        BrokerEpoch
 	Purpose      BrokerStreamPurpose
+	Admission    BrokerStreamAdmission
+	Name         string
 	Local        bool
 	Connection   BrokerConnectionID
 	Stream       BrokerStreamID
 	}
 	switch r.Purpose {
 	case BrokerStreamAttachment:
-		if err := r.Target.Validate(); err != nil {
+		if err := r.Admission.Validate(); err != nil {
 			return err
 		}
+		switch r.Admission {
+		case BrokerAdmissionExact:
+			if err := r.Target.Validate(); err != nil {
+				return err
+			}
+			if r.Name != "" {
+				return errors.New("ports: exact admission carries a creation name")
+			}
+		case BrokerAdmissionCreateNamed:
+			if r.Target != (protocol.ExactSessionTarget{}) {
+				return errors.New("ports: named creation carries an exact target")
+			}
+			if err := domain.ValidateSessionName(r.Name); err != nil {
+				return fmt.Errorf("ports: invalid creation session name: %w", err)
+			}
+		case BrokerAdmissionCreateEphemeral:
+			if r.Target != (protocol.ExactSessionTarget{}) {
+				return errors.New("ports: ephemeral creation carries an exact target")
+			}
+			if r.Name != "" {
+				return errors.New("ports: ephemeral creation carries a session name")
+			}
+		}
 	case BrokerStreamControl, BrokerStreamObservation:
-		if r.Target != (protocol.ExactSessionTarget{}) || len(r.Env) != 0 {
+		if r.Admission != 0 || r.Name != "" || r.Target != (protocol.ExactSessionTarget{}) || len(r.Env) != 0 {
 			return errors.New("ports: control/observation carries attachment state")
 		}
 	default:
 }
 // BrokerHostProbe observes one exact host registration without creating an
-// attachment. The returned projection must describe the same registration and
+// attachment. The probe reports only observed state in a
-// must satisfy the durable projection rules (see
+// BrokerDaemonObservation: the observed daemon identity, incarnation,
-// ValidateDurableHostProjection): the registry re-checks exactly those rules,
+// protocol version, capabilities, availability, failure, freshness, and
-// so an over-bound or catalogue-invalid session inventory is classified as an
+// session inventory. Configured authority (endpoint, registration, policy,
-// invalid response and never published. Implementations should therefore
+// display origin, rank) is stamped by the registry from its own records and
-// validate the projection with catalogue.ValidateRemoteCatalog against the
+// never trusted from the probe; unknown identity, version, or inventory is
-// RemoteCatalogMax* bounds before returning it rather than relying on that
+// zero and is never invented. The returned observation must satisfy the
-// rejection. Probe must return promptly once ctx is cancelled: the registry
+// durable projection rules (see ValidateDurableHostProjection): the registry
-// cancels the attempt context when a registration is replaced or removed, and
+// re-checks exactly those rules, so an over-bound or catalogue-invalid session
-// when the run settles. A probe that
+// inventory is classified as an invalid response and never published.
-// ignores cancellation delays that retirement and can overlap a replacement
+// Implementations should therefore validate the observation with
-// attempt for the same endpoint. Stale completions that arrive anyway are
+// catalogue.ValidateRemoteCatalog against the RemoteCatalogMax* bounds
-// fenced by epoch and registration identity before publication.
+// before returning it rather than relying on that rejection. Probe must
+// return promptly once ctx is cancelled: the registry cancels the attempt
+// context when a registration is replaced or removed, and when the run
+// settles. A probe that ignores cancellation delays that retirement and can
+// overlap a replacement attempt for the same endpoint. Stale completions
+// that arrive anyway are fenced by epoch and registration identity before
+// publication.
 type BrokerHostProbe interface {
-	Probe(ctx context.Context, registration domain.RemoteRegistration) (RemoteHostSnapshot, error)
+	Probe(ctx context.Context, registration domain.RemoteRegistration) (BrokerDaemonObservation, error)
 }
 // BrokerPhysicalConnection is one pooled physical transport to an
 		return fmt.Errorf("ports: broker %s is not valid UTF-8", label)
 	}
 	for _, r := range value {
-		if unicode.IsControl(r) || unicode.Is(unicode.Bidi_Control, r) || r == '\u2028' || r == '\u2029' {
+		if !brokerDisplayRuneAllowed(r) {
 			return fmt.Errorf("ports: broker %s contains disallowed characters", label)
 		}
 	}
 	return nil
 }
+// brokerDisplayRuneAllowed reports whether one rune may appear in broker
+// display text. Controls, bidi controls, and the Unicode line separators are
+// refused: none of them carries presentation value, and each lets a value
+// reorder or split the text rendered around it.
+func brokerDisplayRuneAllowed(r rune) bool {
+	return !unicode.IsControl(r) && !unicode.Is(unicode.Bidi_Control, r) && r != '\u2028' && r != '\u2029'
+}
+// SanitizeBrokerDisplayText returns value with every rune broker display text
+// refuses removed, and always as valid UTF-8. Producers apply it to the
+// presentation hints they derive rather than receive: a hint derived from
+// routing authority is not itself authority, so a configured target the
+// routing validator accepts still yields text the display rule accepts instead
+// of a publication the wire refuses. The result is not length-checked; the
+// caller applies the bound for its own field.
+func SanitizeBrokerDisplayText(value string) string {
+	if utf8.ValidString(value) && strings.IndexFunc(value, func(r rune) bool { return !brokerDisplayRuneAllowed(r) }) < 0 {
+		return value
+	}
+	var safe strings.Builder
+	safe.Grow(len(value))
+	for _, r := range value {
+		if brokerDisplayRuneAllowed(r) {
+			safe.WriteRune(r)
+		}
+	}
+	return safe.String()
+}

A internal/ports/broker_observation.go +167 -0

@@ -0,0 +1,167 @@
	1	+	package ports
	2	+
	3	+	import (
	4	+	"errors"
	5	+	"fmt"
	6	+	"time"
	7	+
	8	+	"github.com/bnema/vev/internal/domain"
	9	+	"github.com/bnema/vev/internal/protocol/catalogue"
	10	+	)
	11	+
	12	+	// Broker-native daemon observation (Plan 001 P5.2a).
	13	+	//
	14	+	// BrokerDaemonObservation is the broker's own projection of one daemon, local
	15	+	// or remote. It deliberately does not reuse RemoteHostSnapshot: that type
	16	+	// belongs to the legacy remote monitor and carries no daemon identity,
	17	+	// incarnation, version, capability, or policy authority. The broker
	18	+	// projection keeps configured authority separate from observed state:
	19	+	//
	20	+	// - configured authority: Local flag, Endpoint, Registration, Policy, and
	21	+	// the presentation hints DisplayOrigin and Rank. The registry stamps
	22	+	// them from its own host records (or the local composition) and never
	23	+	// trusts them from a probe.
	24	+	// - observed identity: Identity and Incarnation are zero until a probe
	25	+	// actually authenticated the daemon. Unknown identity is never invented.
	26	+	// - observed capability: ProtocolVersion and Capabilities mirror what the
	27	+	// daemon reported. ProtocolVersion is the daemon's own version and may
	28	+	// differ from Policy.ProtocolVersion; that difference is exactly how an
	29	+	// incompatible daemon is observable. Zero means unobserved.
	30	+	// - observation state: Availability, Checking, timestamps, failure
	31	+	// counters, and the exact session catalogue. Availability zero is
	32	+	// invalid: an unobserved daemon carries RemoteAvailabilityUnknown.
	33	+	//
	34	+	// Observing a daemon never attaches to it and never starts a stopped one.
	35	+
	36	+	const (
	37	+	// BrokerMaxDaemonsPerSnapshot bounds one snapshot publication: the local
	38	+	// daemon plus every configured remote host.
	39	+	BrokerMaxDaemonsPerSnapshot = BrokerMaxHosts + 1
	40	+	// BrokerMaxDisplayOriginBytes bounds the presentation origin hint.
	41	+	BrokerMaxDisplayOriginBytes = 128
	42	+	)
	43	+
	44	+	// BrokerDaemonObservation is one immutable daemon projection in one broker
	45	+	// snapshot. Nested slices are never mutated after publication.
	46	+	type BrokerDaemonObservation struct {
	47	+	// Local marks the broker's own machine daemon. A local observation has
	48	+	// no endpoint and no registration: the local daemon is not a configured
	49	+	// host. At most one local observation exists per snapshot.
	50	+	Local bool
	51	+
	52	+	// Configured authority (registry-stamped, never probe-supplied).
	53	+	Endpoint string // remote only; matches Registration.Endpoint
	54	+	DisplayOrigin string
	55	+	Rank int
	56	+	Registration domain.RemoteRegistration
	57	+	Policy BrokerPolicy
	58	+
	59	+	// Observed identity/incarnation (zero until observed).
	60	+	Identity BrokerDaemonIdentity
	61	+	Incarnation BrokerDaemonIncarnation
	62	+
	63	+	// Observed version/capability (zero until observed).
	64	+	ProtocolVersion uint16
	65	+	Capabilities uint32
	66	+
	67	+	// Availability, checking, failure, and freshness state.
	68	+	Availability domain.RemoteAvailability
	69	+	Checking bool
	70	+	LastAttempt time.Time
	71	+	LastSuccess time.Time
	72	+	NextDue time.Time
	73	+	ConsecutiveFailures uint
	74	+	FailureEpisode uint64
	75	+	LastFailure domain.RemoteFailure
	76	+	InventoryKnown bool
	77	+
	78	+	// Exact session catalogue observed from the daemon.
	79	+	Sessions []catalogue.RemoteCatalogSession
	80	+	}
	81	+
	82	+	// Validate enforces the closed projection rules.
	83	+	func (o BrokerDaemonObservation) Validate() error {
	84	+	// Policy is required authority for every daemon, observed or not.
	85	+	if err := o.Policy.Validate(); err != nil {
	86	+	return fmt.Errorf("ports: broker daemon observation: %w", err)
	87	+	}
	88	+	if err := validateBrokerDisplayText(o.DisplayOrigin, BrokerMaxDisplayOriginBytes, "display origin"); err != nil {
	89	+	return fmt.Errorf("ports: broker daemon observation: %w", err)
	90	+	}
	91	+	if o.DisplayOrigin == "" {
	92	+	return errors.New("ports: broker daemon observation has no display origin")
	93	+	}
	94	+	if o.Local {
	95	+	if o.Endpoint != "" \|\| o.Registration != (domain.RemoteRegistration{}) {
	96	+	return errors.New("ports: local daemon observation carries remote authority")
	97	+	}
	98	+	} else {
	99	+	if err := domain.ValidateRemoteHostTarget(o.Endpoint); err != nil {
	100	+	return fmt.Errorf("ports: broker daemon observation: %w", err)
	101	+	}
	102	+	if err := o.Registration.Validate(); err != nil {
	103	+	return fmt.Errorf("ports: broker daemon observation: %w", err)
	104	+	}
	105	+	if o.Endpoint != o.Registration.Endpoint {
	106	+	return errors.New("ports: broker daemon observation endpoint does not match registration")
	107	+	}
	108	+	}
	109	+	if err := validateObservedDaemonState(o); err != nil {
	110	+	return err
	111	+	}
	112	+	if o.Availability < domain.RemoteAvailabilityUnknown \|\| o.Availability > domain.RemoteAvailabilityInvalidResponse {
	113	+	return errors.New("ports: broker daemon observation availability is out of range")
	114	+	}
	115	+	if o.LastFailure.Kind > domain.RemoteFailureInvalidResponse {
	116	+	return errors.New("ports: broker daemon observation failure kind is out of range")
	117	+	}
	118	+	if len(o.Sessions) > BrokerMaxSessionsPerHost {
	119	+	return errors.New("ports: broker daemon observation has too many sessions")
	120	+	}
	121	+	if len(o.Sessions) > 0 && !o.InventoryKnown {
	122	+	return errors.New("ports: broker daemon observation carries sessions without known inventory")
	123	+	}
	124	+	return nil
	125	+	}
	126	+
	127	+	// validateObservedDaemonState applies the observed-state rules shared by a live
	128	+	// publication and a durable projection. Observed identity is all-or-nothing and
	129	+	// never invented: identity and incarnation appear together, both validate, and
	130	+	// an observed daemon always carries the protocol version its identity was
	131	+	// authenticated with. The offline store, a restored durable record, and the
	132	+	// registry all apply this one rule, so a projection either layer accepts is
	133	+	// never published as an observation the wire refuses.
	134	+	func validateObservedDaemonState(observation BrokerDaemonObservation) error {
	135	+	observed := observation.Identity != ""
	136	+	if observed != !observation.Incarnation.IsZero() {
	137	+	return errors.New("ports: broker daemon observation has partial identity")
	138	+	}
	139	+	if !observed {
	140	+	return nil
	141	+	}
	142	+	if err := observation.Identity.Validate(); err != nil {
	143	+	return err
	144	+	}
	145	+	if err := observation.Incarnation.Validate(); err != nil {
	146	+	return err
	147	+	}
	148	+	if observation.ProtocolVersion == 0 {
	149	+	return errors.New("ports: observed daemon identity carries no protocol version")
	150	+	}
	151	+	return nil
	152	+	}
	153	+
	154	+	// Clone returns a defensive copy with an independent session slice. Each
	155	+	// session keeps the exact nil-ness of its tab list: an empty but present list
	156	+	// is catalogue-valid and must not become absent through a copy.
	157	+	func (o BrokerDaemonObservation) Clone() BrokerDaemonObservation {
	158	+	out := o
	159	+	out.Sessions = append([]catalogue.RemoteCatalogSession(nil), o.Sessions...)
	160	+	for i := range out.Sessions {
	161	+	if o.Sessions[i].Tabs == nil {
	162	+	continue
	163	+	}
	164	+	out.Sessions[i].Tabs = append(make([]catalogue.RemoteCatalogTab, 0, len(o.Sessions[i].Tabs)), o.Sessions[i].Tabs...)
	165	+	}
	166	+	return out
	167	+	}

A internal/ports/broker_observation_test.go +170 -0

@@ -0,0 +1,170 @@
	1	+	package ports
	2	+
	3	+	import (
	4	+	"strings"
	5	+	"testing"
	6	+
	7	+	"github.com/bnema/vev/internal/domain"
	8	+	"github.com/bnema/vev/internal/protocol"
	9	+	"github.com/bnema/vev/internal/protocol/catalogue"
	10	+	"github.com/stretchr/testify/require"
	11	+	)
	12	+
	13	+	func TestBrokerDaemonObservationValidate(t *testing.T) {
	14	+	observed := func(o BrokerDaemonObservation) BrokerDaemonObservation {
	15	+	o.Identity = BrokerDaemonIdentity("authed-daemon")
	16	+	o.Incarnation = BrokerDaemonIncarnation{9}
	17	+	o.ProtocolVersion = protocol.Version
	18	+	o.Capabilities = protocol.CapabilityResume \| protocol.CapabilityUDP
	19	+	return o
	20	+	}
	21	+	tests := []struct {
	22	+	name string
	23	+	mutate func(*BrokerDaemonObservation)
	24	+	valid bool
	25	+	}{
	26	+	{name: "unobserved remote daemon", mutate: func(*BrokerDaemonObservation) {}, valid: true},
	27	+	{name: "unknown availability", mutate: func(o *BrokerDaemonObservation) {
	28	+	o.Availability = domain.RemoteAvailabilityUnknown
	29	+	}, valid: true},
	30	+	{name: "observed daemon", mutate: func(o BrokerDaemonObservation) { o = observed(*o) }, valid: true},
	31	+	{name: "observed daemon without capabilities", mutate: func(o *BrokerDaemonObservation) {
	32	+	o = observed(o)
	33	+	o.Capabilities = 0
	34	+	}, valid: true},
	35	+	{name: "observed daemon reports a different protocol version", mutate: func(o *BrokerDaemonObservation) {
	36	+	o = observed(o)
	37	+	o.ProtocolVersion = protocol.Version + 1
	38	+	o.Availability = domain.RemoteAvailabilityIncompatible
	39	+	}, valid: true},
	40	+	{name: "observed identity without protocol version", mutate: func(o *BrokerDaemonObservation) {
	41	+	o = observed(o)
	42	+	o.ProtocolVersion = 0
	43	+	}, valid: false},
	44	+	{name: "identity without incarnation", mutate: func(o *BrokerDaemonObservation) {
	45	+	o.Identity = BrokerDaemonIdentity("authed-daemon")
	46	+	}, valid: false},
	47	+	{name: "incarnation without identity", mutate: func(o *BrokerDaemonObservation) {
	48	+	o.Incarnation = BrokerDaemonIncarnation{9}
	49	+	}, valid: false},
	50	+	{name: "empty display origin", mutate: func(o *BrokerDaemonObservation) {
	51	+	o.DisplayOrigin = ""
	52	+	}, valid: false},
	53	+	{name: "control characters in display origin", mutate: func(o *BrokerDaemonObservation) {
	54	+	o.DisplayOrigin = "bad\x1border"
	55	+	}, valid: false},
	56	+	{name: "oversized display origin", mutate: func(o *BrokerDaemonObservation) {
	57	+	o.DisplayOrigin = strings.Repeat("a", BrokerMaxDisplayOriginBytes+1)
	58	+	}, valid: false},
	59	+	{name: "missing policy", mutate: func(o *BrokerDaemonObservation) {
	60	+	o.Policy = BrokerPolicy{}
	61	+	}, valid: false},
	62	+	{name: "zero availability is never invented", mutate: func(o *BrokerDaemonObservation) {
	63	+	o.Availability = 0
	64	+	}, valid: false},
	65	+	{name: "failure kind past the closed range", mutate: func(o *BrokerDaemonObservation) {
	66	+	o.LastFailure.Kind = domain.RemoteFailureInvalidResponse + 1
	67	+	}, valid: false},
	68	+	{name: "empty inventory is known inventory", mutate: func(o *BrokerDaemonObservation) {
	69	+	o.InventoryKnown = true
	70	+	}, valid: true},
	71	+	{name: "sessions without known inventory", mutate: func(o *BrokerDaemonObservation) {
	72	+	o.Sessions = []catalogue.RemoteCatalogSession{{
	73	+	LifecycleID: testBrokerLifecycle(),
	74	+	Name: "work",
	75	+	State: catalogue.RemoteCatalogSessionUp,
	76	+	Tabs: []catalogue.RemoteCatalogTab{},
	77	+	}}
	78	+	}, valid: false},
	79	+	{name: "local daemon without remote authority", mutate: func(o *BrokerDaemonObservation) {
	80	+	*o = testLocalBrokerObservation()
	81	+	}, valid: true},
	82	+	{name: "local daemon carrying an endpoint", mutate: func(o *BrokerDaemonObservation) {
	83	+	*o = testLocalBrokerObservation()
	84	+	o.Endpoint = "user@arch"
	85	+	}, valid: false},
	86	+	{name: "local daemon carrying a registration", mutate: func(o *BrokerDaemonObservation) {
	87	+	*o = testLocalBrokerObservation()
	88	+	o.Registration = testBrokerRegistration("user@arch", 1, 1)
	89	+	}, valid: false},
	90	+	{name: "remote daemon missing registration", mutate: func(o *BrokerDaemonObservation) {
	91	+	o.Registration = domain.RemoteRegistration{}
	92	+	}, valid: false},
	93	+	{name: "endpoint registration mismatch", mutate: func(o *BrokerDaemonObservation) {
	94	+	o.Registration = testBrokerRegistration("user@other", 1, 1)
	95	+	}, valid: false},
	96	+	}
	97	+	for _, tc := range tests {
	98	+	t.Run(tc.name, func(t *testing.T) {
	99	+	obs := testBrokerObservation("user@arch")
	100	+	tc.mutate(&obs)
	101	+	if (obs.Validate() == nil) != tc.valid {
	102	+	t.Fatalf("Validate() = %v, want valid %t", obs.Validate(), tc.valid)
	103	+	}
	104	+	})
	105	+	}
	106	+	}
	107	+
	108	+	// TestBrokerDaemonObservationValidateDisplayOrigin pins the display-origin
	109	+	// bound and character rules with exact refusals: a bidi control or a Unicode
	110	+	// line separator is refused as disallowed text, an origin at the byte bound is
	111	+	// accepted, and one byte over is refused.
	112	+	func TestBrokerDaemonObservationValidateDisplayOrigin(t *testing.T) {
	113	+	tests := []struct {
	114	+	name string
	115	+	origin string
	116	+	wantErrContains string
	117	+	}{
	118	+	{
	119	+	name: "bidi control is refused",
	120	+	origin: "user\u202earch",
	121	+	wantErrContains: "display origin contains disallowed characters",
	122	+	},
	123	+	{
	124	+	name: "line separator is refused",
	125	+	origin: "user@arch\u2028",
	126	+	wantErrContains: "display origin contains disallowed characters",
	127	+	},
	128	+	{
	129	+	name: "origin at the byte bound is accepted",
	130	+	origin: strings.Repeat("a", BrokerMaxDisplayOriginBytes),
	131	+	},
	132	+	{
	133	+	name: "origin one byte over the bound is refused",
	134	+	origin: strings.Repeat("a", BrokerMaxDisplayOriginBytes+1),
	135	+	wantErrContains: "display origin too long",
	136	+	},
	137	+	}
	138	+	for _, tc := range tests {
	139	+	t.Run(tc.name, func(t *testing.T) {
	140	+	obs := testBrokerObservation("user@arch")
	141	+	obs.DisplayOrigin = tc.origin
	142	+	err := obs.Validate()
	143	+	if tc.wantErrContains != "" {
	144	+	require.ErrorContains(t, err, tc.wantErrContains)
	145	+	return
	146	+	}
	147	+	require.NoError(t, err)
	148	+	})
	149	+	}
	150	+	}
	151	+
	152	+	func TestBrokerDaemonObservationCloneIsDefensive(t *testing.T) {
	153	+	original := testBrokerObservation("user@arch")
	154	+	original.InventoryKnown = true
	155	+	original.Sessions = []catalogue.RemoteCatalogSession{{
	156	+	LifecycleID: testBrokerLifecycle(),
	157	+	Name: "work",
	158	+	State: catalogue.RemoteCatalogSessionUp,
	159	+	Tabs: []catalogue.RemoteCatalogTab{{ID: "tab-1", Index: 0, Name: "shell"}},
	160	+	}}
	161	+	cloned := original.Clone()
	162	+	cloned.Sessions[0].Name = "mutated"
	163	+	cloned.Sessions[0].Tabs[0].ID = "mutated"
	164	+	if original.Sessions[0].Name != "work" \|\| original.Sessions[0].Tabs[0].ID != "tab-1" {
	165	+	t.Fatal("Clone() shares memory with the original")
	166	+	}
	167	+	if (BrokerDaemonObservation{}).Clone().Sessions != nil {
	168	+	t.Fatal("Clone() of an empty observation must keep a nil session slice")
	169	+	}
	170	+	}

M internal/ports/broker_store.go +28 -16


@@ -94,28 +94,40 @@ type BrokerHostStore interface {
94		// one seam. This guard keeps that composition compile-checked.	94		// one seam. This guard keeps that composition compile-checked.
95		var _ BrokerSnapshotStore = (BrokerHostStore)(nil)	95		var _ BrokerSnapshotStore = (BrokerHostStore)(nil)
96			96
97	-	// ValidateDurableHostProjection reports whether one host projection satisfies	97	+	// ValidateDurableHostProjection reports whether one daemon observation
98	-	// the semantic rules of durable broker state: a published availability and	98	+	// satisfies the rules the offline store and wire accept: a local observation
99	-	// failure kind inside their closed ranges, and a session inventory the	99	+	// is never durable, availability and failure kinds stay in their closed
100	-	// catalogue accepts for the host's exact incarnation and success time. The	100	+	// ranges, and a present session inventory is a valid catalogue cache entry
101	-	// offline store and the registry both apply this rule, so a projection the	101	+	// against the exact registration incarnation. The offline store and the
102	-	// registry publishes is never rejected (and therefore silently never	102	+	// registry both apply this rule, so a projection the registry publishes is
103	-	// persisted) by the store. Transient state (Checking and the live failure	103	+	// never rejected (and therefore silently never persisted) by the store.
104	-	// cause) is deliberately not part of the durable rule.	104	+	// Transient state (Checking and the live failure cause) is deliberately not
105	-	func ValidateDurableHostProjection(host RemoteHostSnapshot) error {	105	+	// part of the durable rule.
106	-	if host.Availability < domain.RemoteAvailabilityUnknown \|\| host.Availability > domain.RemoteAvailabilityInvalidResponse {	106	+	func ValidateDurableHostProjection(obs BrokerDaemonObservation) error {
			107	+	if obs.Local {
			108	+	return errors.New("ports: local daemon observation is never durable")
			109	+	}
			110	+	if obs.Availability < domain.RemoteAvailabilityUnknown \|\| obs.Availability > domain.RemoteAvailabilityInvalidResponse {
107		return errors.New("ports: broker host availability is out of range")	111		return errors.New("ports: broker host availability is out of range")
108		}	112		}
109	-	if host.LastFailure.Kind > domain.RemoteFailureInvalidResponse {	113	+	if obs.LastFailure.Kind > domain.RemoteFailureInvalidResponse {
110		return errors.New("ports: broker host failure kind is out of range")	114		return errors.New("ports: broker host failure kind is out of range")
111		}	115		}
112	-	if len(host.Sessions) == 0 {	116	+	// Observed identity is part of the durable rule, not only of the live one: a
			117	+	// restored record with partial identity or without the protocol version its
			118	+	// identity was authenticated with would otherwise reach a publication the
			119	+	// wire refuses, taking down every client connection instead of failing
			120	+	// closed here.
			121	+	if err := validateObservedDaemonState(obs); err != nil {
			122	+	return err
			123	+	}
			124	+	if len(obs.Sessions) == 0 {
113		return nil	125		return nil
114		}	126		}
115		return catalogue.ValidateRemoteCatalogCacheEntries([]catalogue.RemoteCatalogCacheEntry{{	127		return catalogue.ValidateRemoteCatalogCacheEntries([]catalogue.RemoteCatalogCacheEntry{{
116	-	Host: host.Endpoint,	128	+	Host: obs.Endpoint,
117	-	Incarnation: host.Registration.Incarnation,	129	+	Incarnation: obs.Registration.Incarnation,
118	-	FetchedAt: host.LastSuccess,	130	+	FetchedAt: obs.LastSuccess,
119	-	Sessions: host.Sessions,	131	+	Sessions: obs.Sessions,
120		}})	132		}})
121		}	133		}

A internal/ports/broker_store_test.go +70 -0

@@ -0,0 +1,70 @@
	1	+	package ports
	2	+
	3	+	import (
	4	+	"testing"
	5	+
	6	+	"github.com/bnema/vev/internal/protocol"
	7	+	"github.com/stretchr/testify/require"
	8	+	)
	9	+
	10	+	// TestValidateDurableHostProjectionIdentity pins the durable rule to the live
	11	+	// observation rule: an identity and incarnation must appear together, and an
	12	+	// observed identity must carry the protocol version it was authenticated with.
	13	+	// A restored durable record that violates either rule would otherwise reach a
	14	+	// publication the wire refuses.
	15	+	func TestValidateDurableHostProjectionIdentity(t *testing.T) {
	16	+	observed := func(o BrokerDaemonObservation) BrokerDaemonObservation {
	17	+	o.Identity = BrokerDaemonIdentity("authed-daemon")
	18	+	o.Incarnation = BrokerDaemonIncarnation{9}
	19	+	o.ProtocolVersion = protocol.Version
	20	+	return o
	21	+	}
	22	+	tests := []struct {
	23	+	name string
	24	+	mutate func(*BrokerDaemonObservation)
	25	+	wantErrContains string
	26	+	}{
	27	+	{
	28	+	name: "no identity is accepted",
	29	+	mutate: func(*BrokerDaemonObservation) {},
	30	+	},
	31	+	{
	32	+	name: "identity and incarnation with a protocol version are accepted",
	33	+	mutate: func(o BrokerDaemonObservation) { o = observed(*o) },
	34	+	},
	35	+	{
	36	+	name: "identity with zero protocol version is refused",
	37	+	mutate: func(o *BrokerDaemonObservation) {
	38	+	o = observed(o)
	39	+	o.ProtocolVersion = 0
	40	+	},
	41	+	wantErrContains: "carries no protocol version",
	42	+	},
	43	+	{
	44	+	name: "identity without incarnation is refused",
	45	+	mutate: func(o *BrokerDaemonObservation) {
	46	+	o.Identity = BrokerDaemonIdentity("authed-daemon")
	47	+	},
	48	+	wantErrContains: "partial identity",
	49	+	},
	50	+	{
	51	+	name: "incarnation without identity is refused",
	52	+	mutate: func(o *BrokerDaemonObservation) {
	53	+	o.Incarnation = BrokerDaemonIncarnation{9}
	54	+	},
	55	+	wantErrContains: "partial identity",
	56	+	},
	57	+	}
	58	+	for _, tc := range tests {
	59	+	t.Run(tc.name, func(t *testing.T) {
	60	+	obs := testBrokerObservation("user@arch")
	61	+	tc.mutate(&obs)
	62	+	err := ValidateDurableHostProjection(obs)
	63	+	if tc.wantErrContains != "" {
	64	+	require.ErrorContains(t, err, tc.wantErrContains)
	65	+	return
	66	+	}
	67	+	require.NoError(t, err)
	68	+	})
	69	+	}
	70	+	}

M internal/ports/broker_test.go +189 -47


@@ -5,10 +5,12 @@ import (
5		"strings"	5		"strings"
6		"testing"	6		"testing"
7		"time"	7		"time"
			8	+	"unicode/utf8"
8			9
9		"github.com/bnema/vev/internal/domain"	10		"github.com/bnema/vev/internal/domain"
10		"github.com/bnema/vev/internal/protocol"	11		"github.com/bnema/vev/internal/protocol"
11		"github.com/bnema/vev/internal/protocol/catalogue"	12		"github.com/bnema/vev/internal/protocol/catalogue"
			13	+	"github.com/stretchr/testify/require"
12		)	14		)
13			15
14		func testBrokerRegistration(endpoint string, incarnation byte, generation domain.RemoteGeneration) domain.RemoteRegistration {	16		func testBrokerRegistration(endpoint string, incarnation byte, generation domain.RemoteGeneration) domain.RemoteRegistration {

@@ -37,11 +39,21 @@ func testBrokerPolicy() BrokerPolicy {
37		}	39		}
38		}	40		}
39			41
40	-	func testBrokerHost(endpoint string) RemoteHostSnapshot {	42	+	func testBrokerObservation(endpoint string) BrokerDaemonObservation {
41	-	return RemoteHostSnapshot{	43	+	return BrokerDaemonObservation{
42		Endpoint: endpoint,	44		Endpoint: endpoint,
43		DisplayOrigin: endpoint,	45		DisplayOrigin: endpoint,
44		Registration: testBrokerRegistration(endpoint, 1, 1),	46		Registration: testBrokerRegistration(endpoint, 1, 1),
			47	+	Policy: testBrokerPolicy(),
			48	+	Availability: domain.RemoteAvailabilityReachable,
			49	+	}
			50	+	}
			51	+
			52	+	func testLocalBrokerObservation() BrokerDaemonObservation {
			53	+	return BrokerDaemonObservation{
			54	+	Local: true,
			55	+	DisplayOrigin: "local",
			56	+	Policy: testBrokerPolicy(),
45		Availability: domain.RemoteAvailabilityReachable,	57		Availability: domain.RemoteAvailabilityReachable,
46		}	58		}
47		}	59		}

@@ -50,7 +62,7 @@ func validBrokerSnapshot() BrokerSnapshot {
50		return BrokerSnapshot{	62		return BrokerSnapshot{
51		Epoch: 3,	63		Epoch: 3,
52		Revision: 9,	64		Revision: 9,
53	-	Hosts: []RemoteHostSnapshot{testBrokerHost("user@arch")},	65	+	Daemons: []BrokerDaemonObservation{testBrokerObservation("user@arch")},
54		}	66		}
55		}	67		}
56			68

@@ -76,36 +88,45 @@ func TestValidateDurableHostProjection(t *testing.T) {
76		}	88		}
77		tests := []struct {	89		tests := []struct {
78		name string	90		name string
79	-	mutate func(*RemoteHostSnapshot)	91	+	mutate func(*BrokerDaemonObservation)
80		wantErr bool	92		wantErr bool
81		}{	93		}{
82	-	{name: "empty inventory", mutate: func(*RemoteHostSnapshot) {}},	94	+	{name: "empty inventory", mutate: func(*BrokerDaemonObservation) {}},
83	-	{name: "valid inventory", mutate: func(h *RemoteHostSnapshot) { h.Sessions = []catalogue.RemoteCatalogSession{session} }},	95	+	{name: "valid inventory", mutate: func(o *BrokerDaemonObservation) {
84	-	{name: "zero availability", mutate: func(h *RemoteHostSnapshot) { h.Availability = 0 }, wantErr: true},	96	+	o.InventoryKnown = true
85	-	{name: "unknown availability", mutate: func(h *RemoteHostSnapshot) { h.Availability = domain.RemoteAvailabilityUnknown }},	97	+	o.Sessions = []catalogue.RemoteCatalogSession{session}
86	-	{name: "availability past the closed range", mutate: func(h *RemoteHostSnapshot) { h.Availability = domain.RemoteAvailabilityInvalidResponse + 1 }, wantErr: true},	98	+	}},
87	-	{name: "failure kind past the closed range", mutate: func(h *RemoteHostSnapshot) { h.LastFailure.Kind = domain.RemoteFailureInvalidResponse + 1 }, wantErr: true},	99	+	{name: "local observation", mutate: func(o *BrokerDaemonObservation) {
88	-	{name: "missing lifecycle identity", mutate: func(h *RemoteHostSnapshot) {	100	+	*o = testLocalBrokerObservation()
89	-	h.Sessions = []catalogue.RemoteCatalogSession{{Name: "work", State: catalogue.RemoteCatalogSessionUp, Tabs: []catalogue.RemoteCatalogTab{}}}	101	+	}, wantErr: true},
			102	+	{name: "zero availability", mutate: func(o *BrokerDaemonObservation) { o.Availability = 0 }, wantErr: true},
			103	+	{name: "unknown availability", mutate: func(o *BrokerDaemonObservation) { o.Availability = domain.RemoteAvailabilityUnknown }},
			104	+	{name: "availability past the closed range", mutate: func(o *BrokerDaemonObservation) { o.Availability = domain.RemoteAvailabilityInvalidResponse + 1 }, wantErr: true},
			105	+	{name: "failure kind past the closed range", mutate: func(o *BrokerDaemonObservation) { o.LastFailure.Kind = domain.RemoteFailureInvalidResponse + 1 }, wantErr: true},
			106	+	{name: "missing lifecycle identity", mutate: func(o *BrokerDaemonObservation) {
			107	+	o.InventoryKnown = true
			108	+	o.Sessions = []catalogue.RemoteCatalogSession{{Name: "work", State: catalogue.RemoteCatalogSessionUp, Tabs: []catalogue.RemoteCatalogTab{}}}
90		}, wantErr: true},	109		}, wantErr: true},
91	-	{name: "absent tab list", mutate: func(h *RemoteHostSnapshot) {	110	+	{name: "absent tab list", mutate: func(o *BrokerDaemonObservation) {
92		broken := session	111		broken := session
93		broken.Tabs = nil	112		broken.Tabs = nil
94	-	h.Sessions = []catalogue.RemoteCatalogSession{broken}	113	+	o.InventoryKnown = true
			114	+	o.Sessions = []catalogue.RemoteCatalogSession{broken}
95		}, wantErr: true},	115		}, wantErr: true},
96	-	{name: "sessions past the catalogue bound", mutate: func(h *RemoteHostSnapshot) {	116	+	{name: "sessions past the catalogue bound", mutate: func(o *BrokerDaemonObservation) {
97	-	h.Sessions = make([]catalogue.RemoteCatalogSession, catalogue.RemoteCatalogMaxSessions+1)	117	+	o.InventoryKnown = true
98	-	for i := range h.Sessions {	118	+	o.Sessions = make([]catalogue.RemoteCatalogSession, catalogue.RemoteCatalogMaxSessions+1)
99	-	h.Sessions[i] = session	119	+	for i := range o.Sessions {
			120	+	o.Sessions[i] = session
100		}	121		}
101		}, wantErr: true},	122		}, wantErr: true},
102		}	123		}
103		for _, tc := range tests {	124		for _, tc := range tests {
104		t.Run(tc.name, func(t *testing.T) {	125		t.Run(tc.name, func(t *testing.T) {
105	-	host := testBrokerHost("user@arch")	126	+	obs := testBrokerObservation("user@arch")
106	-	host.LastSuccess = time.Unix(50, 0)	127	+	obs.LastSuccess = time.Unix(50, 0)
107	-	tc.mutate(&host)	128	+	tc.mutate(&obs)
108	-	if gotErr := ValidateDurableHostProjection(host); (gotErr != nil) != tc.wantErr {	129	+	if gotErr := ValidateDurableHostProjection(obs); (gotErr != nil) != tc.wantErr {
109		t.Fatalf("ValidateDurableHostProjection() = %v, wantErr %t", gotErr, tc.wantErr)	130		t.Fatalf("ValidateDurableHostProjection() = %v, wantErr %t", gotErr, tc.wantErr)
110		}	131		}
111		})	132		})

@@ -121,21 +142,27 @@ func TestBrokerSnapshotValidateBounds(t *testing.T) {
121		{name: "valid", mutate: func(*BrokerSnapshot) {}, wantErr: false},	142		{name: "valid", mutate: func(*BrokerSnapshot) {}, wantErr: false},
122		{name: "zero epoch", mutate: func(s *BrokerSnapshot) { s.Epoch = 0 }, wantErr: true},	143		{name: "zero epoch", mutate: func(s *BrokerSnapshot) { s.Epoch = 0 }, wantErr: true},
123		{name: "zero revision", mutate: func(s *BrokerSnapshot) { s.Revision = 0 }, wantErr: true},	144		{name: "zero revision", mutate: func(s *BrokerSnapshot) { s.Revision = 0 }, wantErr: true},
124	-	{name: "too many hosts", mutate: func(s *BrokerSnapshot) {	145	+	{name: "too many daemons", mutate: func(s *BrokerSnapshot) {
125	-	s.Hosts = make([]RemoteHostSnapshot, BrokerMaxHosts+1)	146	+	s.Daemons = make([]BrokerDaemonObservation, BrokerMaxDaemonsPerSnapshot+1)
126	-	for i := range s.Hosts {	147	+	for i := range s.Daemons {
127	-	s.Hosts[i] = testBrokerHost("user@arch")	148	+	s.Daemons[i] = testBrokerObservation("user@arch")
128	-	s.Hosts[i].Registration = testBrokerRegistration("user@arch", 1, 1)	149	+	s.Daemons[i].Registration = testBrokerRegistration("user@arch", 1, 1)
129		}	150		}
130		}, wantErr: true},	151		}, wantErr: true},
			152	+	{name: "local daemon plus remote hosts is valid", mutate: func(s *BrokerSnapshot) {
			153	+	s.Daemons = append([]BrokerDaemonObservation{testLocalBrokerObservation()}, s.Daemons...)
			154	+	}},
			155	+	{name: "two local daemons", mutate: func(s *BrokerSnapshot) {
			156	+	s.Daemons = append(s.Daemons, testLocalBrokerObservation(), testLocalBrokerObservation())
			157	+	}, wantErr: true},
131		{name: "duplicate host", mutate: func(s *BrokerSnapshot) {	158		{name: "duplicate host", mutate: func(s *BrokerSnapshot) {
132	-	s.Hosts = append(s.Hosts, testBrokerHost("user@arch"))	159	+	s.Daemons = append(s.Daemons, testBrokerObservation("user@arch"))
133		}, wantErr: true},	160		}, wantErr: true},
134		{name: "endpoint registration mismatch", mutate: func(s *BrokerSnapshot) {	161		{name: "endpoint registration mismatch", mutate: func(s *BrokerSnapshot) {
135	-	s.Hosts[0].Registration = testBrokerRegistration("user@other", 1, 1)	162	+	s.Daemons[0].Registration = testBrokerRegistration("user@other", 1, 1)
136		}, wantErr: true},	163		}, wantErr: true},
137		{name: "zero registration incarnation", mutate: func(s *BrokerSnapshot) {	164		{name: "zero registration incarnation", mutate: func(s *BrokerSnapshot) {
138	-	s.Hosts[0].Registration = domain.RemoteRegistration{Endpoint: "user@arch", Generation: 1}	165	+	s.Daemons[0].Registration = domain.RemoteRegistration{Endpoint: "user@arch", Generation: 1}
139		}, wantErr: true},	166		}, wantErr: true},
140		{name: "live host as tombstone", mutate: func(s *BrokerSnapshot) {	167		{name: "live host as tombstone", mutate: func(s *BrokerSnapshot) {
141		s.Removed = []BrokerHostTombstone{{	168		s.Removed = []BrokerHostTombstone{{

@@ -228,7 +255,9 @@ func TestBrokerSnapshotEpochRevisionOrdering(t *testing.T) {
228			255
229		func TestBrokerSnapshotCloneAndFind(t *testing.T) {	256		func TestBrokerSnapshotCloneAndFind(t *testing.T) {
230		original := validBrokerSnapshot()	257		original := validBrokerSnapshot()
231	-	original.Hosts[0].Sessions = []catalogue.RemoteCatalogSession{{	258	+	original.Daemons = append([]BrokerDaemonObservation{testLocalBrokerObservation()}, original.Daemons...)
			259	+	original.Daemons[1].InventoryKnown = true
			260	+	original.Daemons[1].Sessions = []catalogue.RemoteCatalogSession{{
232		LifecycleID: testBrokerLifecycle(),	261		LifecycleID: testBrokerLifecycle(),
233		Name: "work",	262		Name: "work",
234		State: catalogue.RemoteCatalogSessionUp,	263		State: catalogue.RemoteCatalogSessionUp,

@@ -241,9 +270,18 @@ func TestBrokerSnapshotCloneAndFind(t *testing.T) {
241		if _, ok := cloned.Find("user@mule"); ok {	270		if _, ok := cloned.Find("user@mule"); ok {
242		t.Fatal("Find() must miss unknown endpoints")	271		t.Fatal("Find() must miss unknown endpoints")
243		}	272		}
244	-	cloned.Hosts[0].Sessions[0].Name = "mutated"	273	+	local := 0
245	-	cloned.Hosts[0].Sessions[0].Tabs[0].ID = "mutated"	274	+	for _, daemon := range cloned.Daemons {
246	-	if original.Hosts[0].Sessions[0].Name != "work" \|\| original.Hosts[0].Sessions[0].Tabs[0].ID != "tab-1" {	275	+	if daemon.Local {
			276	+	local++
			277	+	}
			278	+	}
			279	+	if local != 1 {
			280	+	t.Fatalf("Clone() lost the local daemon entry: %d local entries", local)
			281	+	}
			282	+	cloned.Daemons[1].Sessions[0].Name = "mutated"
			283	+	cloned.Daemons[1].Sessions[0].Tabs[0].ID = "mutated"
			284	+	if original.Daemons[1].Sessions[0].Name != "work" \|\| original.Daemons[1].Sessions[0].Tabs[0].ID != "tab-1" {
247		t.Fatal("Clone() shares memory with the original")	285		t.Fatal("Clone() shares memory with the original")
248		}	286		}
249		}	287		}

@@ -352,6 +390,7 @@ func TestBrokerOpenStreamRequestValidate(t *testing.T) {
352		valid := func() BrokerOpenStreamRequest {	390		valid := func() BrokerOpenStreamRequest {
353		return BrokerOpenStreamRequest{	391		return BrokerOpenStreamRequest{
354		Epoch: 1, Purpose: BrokerStreamAttachment,	392		Epoch: 1, Purpose: BrokerStreamAttachment,
			393	+	Admission: BrokerAdmissionExact,
355		Connection: BrokerConnectionID{1},	394		Connection: BrokerConnectionID{1},
356		Stream: 2,	395		Stream: 2,
357		Endpoint: "user@arch",	396		Endpoint: "user@arch",

@@ -379,6 +418,26 @@ func TestBrokerOpenStreamRequestValidate(t *testing.T) {
379		{name: "bad session name", mutate: func(r *BrokerOpenStreamRequest) {	418		{name: "bad session name", mutate: func(r *BrokerOpenStreamRequest) {
380		r.Target = protocol.ExactSessionTarget{LifecycleID: testBrokerLifecycle(), SessionName: "bad name!"}	419		r.Target = protocol.ExactSessionTarget{LifecycleID: testBrokerLifecycle(), SessionName: "bad name!"}
381		}},	420		}},
			421	+	{name: "exact admission carries a creation name", mutate: func(r *BrokerOpenStreamRequest) {
			422	+	r.Name = "work"
			423	+	}},
			424	+	{name: "named creation carries an exact target", mutate: func(r *BrokerOpenStreamRequest) {
			425	+	r.Admission = BrokerAdmissionCreateNamed
			426	+	r.Name = "work"
			427	+	}},
			428	+	{name: "named creation with invalid name", mutate: func(r *BrokerOpenStreamRequest) {
			429	+	r.Admission = BrokerAdmissionCreateNamed
			430	+	r.Name = "bad name!"
			431	+	r.Target = protocol.ExactSessionTarget{}
			432	+	}},
			433	+	{name: "ephemeral creation carries a name", mutate: func(r *BrokerOpenStreamRequest) {
			434	+	r.Admission = BrokerAdmissionCreateEphemeral
			435	+	r.Target = protocol.ExactSessionTarget{}
			436	+	r.Name = "work"
			437	+	}},
			438	+	{name: "ephemeral creation carries a target", mutate: func(r *BrokerOpenStreamRequest) {
			439	+	r.Admission = BrokerAdmissionCreateEphemeral
			440	+	}},
382		{name: "too many env entries", mutate: func(r *BrokerOpenStreamRequest) {	441		{name: "too many env entries", mutate: func(r *BrokerOpenStreamRequest) {
383		r.Env = make([]string, BrokerMaxEnvEntries+1)	442		r.Env = make([]string, BrokerMaxEnvEntries+1)
384		}},	443		}},

@@ -546,24 +605,107 @@ func TestBrokerInterfacesArePorts(t *testing.T) {
546		}	605		}
547		}	606		}
548			607
			608	+	// TestSanitizeBrokerDisplayText pins the sanitizer to the display validator:
			609	+	// every result is valid UTF-8 and carries no rune validateBrokerDisplayText
			610	+	// refuses, so a producer can sanitize a derived presentation hint and never
			611	+	// publish a value its own contract rejects.
			612	+	func TestSanitizeBrokerDisplayText(t *testing.T) {
			613	+	tests := []struct {
			614	+	name string
			615	+	input string
			616	+	want string
			617	+	}{
			618	+	{name: "ordinary text is returned unchanged", input: "user@arch", want: "user@arch"},
			619	+	{name: "login-prefixed origin is returned unchanged", input: "user@host.example:2222", want: "user@host.example:2222"},
			620	+	{name: "accented and emoji text is kept intact", input: "caf\u00e9 \U0001f5a5", want: "caf\u00e9 \U0001f5a5"},
			621	+	{name: "right-to-left override is dropped", input: "sh\u202eell", want: "shell"},
			622	+	{name: "left-to-right embedding is dropped", input: "a\u202ab", want: "ab"},
			623	+	{name: "C0 control is dropped", input: "a\x00b\x1bc", want: "abc"},
			624	+	{name: "line separator is dropped", input: "a\u2028b", want: "ab"},
			625	+	{name: "paragraph separator is dropped", input: "a\u2029b", want: "ab"},
			626	+	{name: "invalid utf-8 is replaced", input: "ok\xff\xfe", want: "ok\ufffd\ufffd"},
			627	+	{name: "every rune disallowed yields empty", input: "\u202e\u2028\x00", want: ""},
			628	+	}
			629	+	for _, tc := range tests {
			630	+	t.Run(tc.name, func(t *testing.T) {
			631	+	got := SanitizeBrokerDisplayText(tc.input)
			632	+	require.Equal(t, tc.want, got)
			633	+	require.True(t, utf8.ValidString(got), "sanitized text must always be valid UTF-8")
			634	+	require.Equal(t, -1, strings.IndexFunc(got, func(r rune) bool { return !brokerDisplayRuneAllowed(r) }), "sanitized text must carry no disallowed rune")
			635	+	require.NoError(t, validateBrokerDisplayText(got, BrokerMaxDisplayOriginBytes, "display origin"))
			636	+	})
			637	+	}
			638	+	}
			639	+
			640	+	// TestBrokerSnapshotValidateLocalDaemonPlacement pins the wire placement rule:
			641	+	// the local daemon observation is carried at index zero only, a local
			642	+	// observation anywhere else is refused, and a local daemon is still refused
			643	+	// when it appears twice.
			644	+	func TestBrokerSnapshotValidateLocalDaemonPlacement(t *testing.T) {
			645	+	tests := []struct {
			646	+	name string
			647	+	daemons []BrokerDaemonObservation
			648	+	wantErrContains string
			649	+	}{
			650	+	{
			651	+	name: "local daemon first",
			652	+	daemons: []BrokerDaemonObservation{testLocalBrokerObservation(), testBrokerObservation("user@arch")},
			653	+	},
			654	+	{
			655	+	name: "local daemon at index one is refused",
			656	+	daemons: []BrokerDaemonObservation{testBrokerObservation("user@arch"), testLocalBrokerObservation()},
			657	+	wantErrContains: "local daemon at index 1",
			658	+	},
			659	+	{
			660	+	name: "local daemon after two remotes is refused",
			661	+	daemons: []BrokerDaemonObservation{testBrokerObservation("user@arch"), testBrokerObservation("user@other"), testLocalBrokerObservation()},
			662	+	wantErrContains: "local daemon at index 2",
			663	+	},
			664	+	{
			665	+	name: "two local daemons are refused",
			666	+	daemons: []BrokerDaemonObservation{testLocalBrokerObservation(), testLocalBrokerObservation()},
			667	+	wantErrContains: "more than one local daemon",
			668	+	},
			669	+	}
			670	+	for _, tc := range tests {
			671	+	t.Run(tc.name, func(t *testing.T) {
			672	+	snapshot := validBrokerSnapshot()
			673	+	snapshot.Daemons = tc.daemons
			674	+	err := snapshot.Validate()
			675	+	if tc.wantErrContains != "" {
			676	+	require.ErrorContains(t, err, tc.wantErrContains)
			677	+	return
			678	+	}
			679	+	require.NoError(t, err)
			680	+	})
			681	+	}
			682	+	}
			683	+
549		func TestBrokerStreamPurposeShapes(t *testing.T) {	684		func TestBrokerStreamPurposeShapes(t *testing.T) {
550		for _, tc := range []struct {	685		for _, tc := range []struct {
551	-	name string	686	+	name string
552	-	purpose BrokerStreamPurpose	687	+	purpose BrokerStreamPurpose
553	-	target bool	688	+	admission BrokerStreamAdmission
554	-	env bool	689	+	createName string
555	-	valid bool	690	+	target bool
			691	+	env bool
			692	+	valid bool
556		}{	693		}{
557	-	{"attachment", BrokerStreamAttachment, true, true, true},	694	+	{"attachment exact", BrokerStreamAttachment, BrokerAdmissionExact, "", true, true, true},
558	-	{"attachment missing target", BrokerStreamAttachment, false, false, false},	695	+	{"attachment missing target", BrokerStreamAttachment, BrokerAdmissionExact, "", false, false, false},
559	-	{"control", BrokerStreamControl, false, false, true},	696	+	{"attachment missing admission", BrokerStreamAttachment, 0, "", true, false, false},
560	-	{"observation", BrokerStreamObservation, false, false, true},	697	+	{"attachment named creation", BrokerStreamAttachment, BrokerAdmissionCreateNamed, "work", false, true, true},
561	-	{"control target", BrokerStreamControl, true, false, false},	698	+	{"attachment ephemeral creation", BrokerStreamAttachment, BrokerAdmissionCreateEphemeral, "", false, true, true},
562	-	{"observation env", BrokerStreamObservation, false, true, false},	699	+	{"control", BrokerStreamControl, 0, "", false, false, true},
563	-	{"unknown", 0, false, false, false},	700	+	{"observation", BrokerStreamObservation, 0, "", false, false, true},
			701	+	{"control target", BrokerStreamControl, 0, "", true, false, false},
			702	+	{"control admission", BrokerStreamControl, BrokerAdmissionExact, "", false, false, false},
			703	+	{"observation env", BrokerStreamObservation, 0, "", false, true, false},
			704	+	{"observation admission", BrokerStreamObservation, BrokerAdmissionCreateEphemeral, "", false, false, false},
			705	+	{"unknown", 0, 0, "", false, false, false},
564		} {	706		} {
565		t.Run(tc.name, func(t *testing.T) {	707		t.Run(tc.name, func(t *testing.T) {
566	-	r := BrokerOpenStreamRequest{Epoch: 1, Connection: BrokerConnectionID{1}, Stream: 1, Local: true, Purpose: tc.purpose, Policy: testBrokerPolicy()}	708	+	r := BrokerOpenStreamRequest{Epoch: 1, Connection: BrokerConnectionID{1}, Stream: 1, Local: true, Purpose: tc.purpose, Admission: tc.admission, Name: tc.createName, Policy: testBrokerPolicy()}
567		if tc.target {	709		if tc.target {
568		r.Target = testBrokerTarget()	710		r.Target = testBrokerTarget()
569		}	711		}

M internal/ports/mocks/broker_mock.go +8 -8


@@ -871,22 +871,22 @@ func (_m MockBrokerHostProbe) EXPECT() MockBrokerHostProbe_Expecter {
871		}	871		}
872			872
873		// Probe provides a mock function for the type MockBrokerHostProbe	873		// Probe provides a mock function for the type MockBrokerHostProbe
874	-	func (_mock *MockBrokerHostProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.RemoteHostSnapshot, error) {	874	+	func (_mock *MockBrokerHostProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerDaemonObservation, error) {
875		ret := _mock.Called(ctx, registration)	875		ret := _mock.Called(ctx, registration)
876			876
877		if len(ret) == 0 {	877		if len(ret) == 0 {
878		panic("no return value specified for Probe")	878		panic("no return value specified for Probe")
879		}	879		}
880			880
881	-	var r0 ports.RemoteHostSnapshot	881	+	var r0 ports.BrokerDaemonObservation
882		var r1 error	882		var r1 error
883	-	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.RemoteRegistration) (ports.RemoteHostSnapshot, error)); ok {	883	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.RemoteRegistration) (ports.BrokerDaemonObservation, error)); ok {
884		return returnFunc(ctx, registration)	884		return returnFunc(ctx, registration)
885		}	885		}
886	-	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.RemoteRegistration) ports.RemoteHostSnapshot); ok {	886	+	if returnFunc, ok := ret.Get(0).(func(context.Context, domain.RemoteRegistration) ports.BrokerDaemonObservation); ok {
887		r0 = returnFunc(ctx, registration)	887		r0 = returnFunc(ctx, registration)
888		} else {	888		} else {
889	-	r0 = ret.Get(0).(ports.RemoteHostSnapshot)	889	+	r0 = ret.Get(0).(ports.BrokerDaemonObservation)
890		}	890		}
891		if returnFunc, ok := ret.Get(1).(func(context.Context, domain.RemoteRegistration) error); ok {	891		if returnFunc, ok := ret.Get(1).(func(context.Context, domain.RemoteRegistration) error); ok {
892		r1 = returnFunc(ctx, registration)	892		r1 = returnFunc(ctx, registration)

@@ -926,12 +926,12 @@ func (_c *MockBrokerHostProbe_Probe_Call) Run(run func(ctx context.Context, regi
926		return _c	926		return _c
927		}	927		}
928			928
929	-	func (_c MockBrokerHostProbe_Probe_Call) Return(remoteHostSnapshot ports.RemoteHostSnapshot, err error) MockBrokerHostProbe_Probe_Call {	929	+	func (_c MockBrokerHostProbe_Probe_Call) Return(brokerDaemonObservation ports.BrokerDaemonObservation, err error) MockBrokerHostProbe_Probe_Call {
930	-	_c.Call.Return(remoteHostSnapshot, err)	930	+	_c.Call.Return(brokerDaemonObservation, err)
931		return _c	931		return _c
932		}	932		}
933			933
934	-	func (_c MockBrokerHostProbe_Probe_Call) RunAndReturn(run func(ctx context.Context, registration domain.RemoteRegistration) (ports.RemoteHostSnapshot, error)) MockBrokerHostProbe_Probe_Call {	934	+	func (_c MockBrokerHostProbe_Probe_Call) RunAndReturn(run func(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerDaemonObservation, error)) MockBrokerHostProbe_Probe_Call {
935		_c.Call.Return(run)	935		_c.Call.Return(run)
936		return _c	936		return _c
937		}	937		}

M internal/protocol/session.go +1 -1


@@ -16,7 +16,7 @@ import (
16		// daemonmux physical preamble conversation (multiplex.proto), whose	16		// daemonmux physical preamble conversation (multiplex.proto), whose
17		// negotiated ceilings and accepted daemon binding ride the same wire	17		// negotiated ceilings and accepted daemon binding ride the same wire
18		// version as the session and broker conversations.	18		// version as the session and broker conversations.
19	-	const Version uint16 = 54	19	+	const Version uint16 = 55
20			20
21		// HandshakeTimeout bounds every transport handshake from connect through the	21		// HandshakeTimeout bounds every transport handshake from connect through the
22		// first committed publication. It excludes the preceding client-local	22		// first committed publication. It excludes the preceding client-local

M internal/protocol/session_test.go +1 -1


@@ -10,7 +10,7 @@ import (
10		)	10		)
11			11
12		func TestVersionRemainsWireCompatible(t *testing.T) {	12		func TestVersionRemainsWireCompatible(t *testing.T) {
13	-	require.Equal(t, uint16(54), Version)	13	+	require.Equal(t, uint16(55), Version)
14		require.Equal(t, (16<<20)-407, MaxOutputDataLen)	14		require.Equal(t, (16<<20)-407, MaxOutputDataLen)
15		}	15		}
16			16

M internal/protocol/wire/broker.pb.go +223 -106 generated file: collapsed

load diff

M internal/protocol/wire/broker_test.go +16 -13

 		"registered": {Payload: &BrokerServerEnvelope_Registered{Registered: &Registered{Scope: brokerScope()}}},
 		"snapshot_part": {Payload: &BrokerServerEnvelope_SnapshotPart{SnapshotPart: &SnapshotPart{
 			Scope: brokerScope(), Generation: 2, Revision: 5, Index: 9,
-			Part: &SnapshotPart_Host{Host: &SnapshotHost{
+			Part: &SnapshotPart_Daemon{Daemon: &SnapshotDaemon{
 				HostIndex: 1, Endpoint: "dev@host:22", DisplayOrigin: "dev@host",
-				Rank: 2, Registration: brokerRegistration(), Availability: 1,
+				Rank: 2, Registration: brokerRegistration(), Policy: &BrokerWirePolicy{ProtocolVersion: 55},
+				DaemonIdentity: "authed-daemon", DaemonIncarnation: bytes.Repeat([]byte{0x9}, 16),
+				ProtocolVersion: 55, Capabilities: 1,
+				Availability:        1,
 				Checking:            true,
 				LastAttempt:         &BrokerTimestamp{Seconds: 1700000000, Nanos: 1},
 				LastSuccess:         &BrokerTimestamp{Seconds: 1700000001, Nanos: 2},
 		})
 	}
-	// The snapshot nested unions round-trip their non-host parts too, so
+	// The snapshot nested unions round-trip their non-daemon parts too, so
 	// every part tag is exercised.
 	for name, part := range map[string]*SnapshotPart{
-		"begin":     {Part: &SnapshotPart_Begin{Begin: &SnapshotBegin{HostCount: 1, SessionCount: 2, TombstoneCount: 3}}},
+		"begin":     {Part: &SnapshotPart_Begin{Begin: &SnapshotBegin{HostCount: 1, SessionCount: 2, TombstoneCount: 3, LocalPresent: true}}},
-		"session":   {Part: &SnapshotPart_Session{Session: &SnapshotSession{HostIndex: 1, SessionIndex: 2, Session: brokerCatalogSession()}}},
+		"session":   {Part: &SnapshotPart_Session{Session: &SnapshotSession{HostIndex: 1, SessionIndex: 2, Session: brokerCatalogSession(), Local: true}}},
 		"tombstone": {Part: &SnapshotPart_Tombstone{Tombstone: &SnapshotTombstone{TombstoneIndex: 3, Registration: brokerRegistration(), RetiredRevision: 4}}},
 		"end":       {Part: &SnapshotPart_End{End: &SnapshotEnd{}}},
 	} {
 	}
 	// The nested snapshot part union is exclusive as well.
-	host := mustMarshalBroker(t, &SnapshotPart{Part: &SnapshotPart_Host{Host: &SnapshotHost{Endpoint: "dev@host:22"}}})
+	daemon := mustMarshalBroker(t, &SnapshotPart{Part: &SnapshotPart_Daemon{Daemon: &SnapshotDaemon{Endpoint: "dev@host:22"}}})
 	end := mustMarshalBroker(t, &SnapshotPart{Part: &SnapshotPart_End{End: &SnapshotEnd{}}})
-	if err := ScanEnvelope(&SnapshotPart{}, append(append([]byte(nil), host...), end...)); !errors.Is(err, ErrScanDuplicate) {
+	if err := ScanEnvelope(&SnapshotPart{}, append(append([]byte(nil), daemon...), end...)); !errors.Is(err, ErrScanDuplicate) {
 		t.Fatalf("duplicate snapshot part = %v, want ErrScanDuplicate", err)
 	}
 }
 	}
 	// Unknown field inside a nested snapshot part message.
-	part := protowire.AppendTag(nil, 11, protowire.BytesType) // SnapshotPart.host
+	part := protowire.AppendTag(nil, 15, protowire.BytesType)  // SnapshotPart.daemon
-	host := protowire.AppendTag(nil, 2, protowire.BytesType)  // SnapshotHost.endpoint
+	daemon := protowire.AppendTag(nil, 3, protowire.BytesType) // SnapshotDaemon.endpoint
-	host = protowire.AppendBytes(host, []byte("dev@host:22"))
+	daemon = protowire.AppendBytes(daemon, []byte("dev@host:22"))
-	host = protowire.AppendTag(host, 99, protowire.VarintType)
+	daemon = protowire.AppendTag(daemon, 99, protowire.VarintType)
-	host = protowire.AppendVarint(host, 1)
+	daemon = protowire.AppendVarint(daemon, 1)
-	part = protowire.AppendBytes(part, host)
+	part = protowire.AppendBytes(part, daemon)
 	raw = protowire.AppendTag(nil, 202, protowire.BytesType) // BrokerServerEnvelope.snapshot_part
 	raw = protowire.AppendBytes(raw, part)
 	if err := ScanEnvelope(&BrokerServerEnvelope{}, raw); !errors.Is(err, ErrScanUnknown) {

M internal/protocol/wire/envelope_inventory_test.go +2 -2


@@ -15,8 +15,8 @@ import (
15		// shares a payload type except route navigation failure, and the preamble	15		// shares a payload type except route navigation failure, and the preamble
16		// constants agree with the schema authority.	16		// constants agree with the schema authority.
17		func TestEnvelopeInventoryProvesDirectionAndSemanticPath(t *testing.T) {	17		func TestEnvelopeInventoryProvesDirectionAndSemanticPath(t *testing.T) {
18	-	if protocol.Version != 54 {	18	+	if protocol.Version != 55 {
19	-	t.Fatalf("protocol.Version = %d, want 54", protocol.Version)	19	+	t.Fatalf("protocol.Version = %d, want 55", protocol.Version)
20		}	20		}
21		if ProtocolEpoch != 1 {	21		if ProtocolEpoch != 1 {
22		t.Fatalf("ProtocolEpoch = %d, want 1", ProtocolEpoch)	22		t.Fatalf("ProtocolEpoch = %d, want 1", ProtocolEpoch)

M internal/protocol/wire/multiplex.pb.go +31 -9 generated file: collapsed

load diff

M internal/protocol/wire/schema/broker.proto +56 -21

 // OpenStream asks the broker to open one independently cancellable logical
 // stream to the owning daemon. env is the per-request session environment
 // and is never inherited from the broker process environment.
+//
+// admission is the closed attachment-admission taxonomy: an attachment
+// stream names exactly how the daemon must admit it, while control and
+// observation streams carry none (0). name is validated session-name
+// authority for create-named and is empty for every other variant.
 message OpenStream {
   BrokerStreamRef ref = 1;
   // Closed taxonomy: 1 = attachment, 2 = control, 3 = observation.
   bool local = 3;
   string endpoint = 4;
   RemoteRegistration registration = 5;
+  // Present only for exact attach/resume; the zero-value message is never
+  // sent for a creation admission.
   ExactTarget target = 6;
   repeated string env = 7;
   BrokerWirePolicy policy = 8;
+  // Closed admission taxonomy: 0 = none (control/observation), 1 = exact
+  // attach/resume, 2 = create named, 3 = create ephemeral.
+  uint32 admission = 9;
+  // Validated session name for create-named; empty otherwise.
+  string name = 10;
 }
 // ClientStreamData carries one opaque client-to-daemon stream frame.
   uint32 index = 4;
   oneof part {
     SnapshotBegin begin = 10;
-    SnapshotHost host = 11;
+    SnapshotDaemon daemon = 15;
     SnapshotSession session = 12;
     SnapshotTombstone tombstone = 13;
     SnapshotEnd end = 14;
 }
 // SnapshotBegin opens a snapshot publication with its element counts.
+// host_count counts every daemon part in the transfer (the local daemon plus
+// every remote host), and local_present reports whether daemon index 0 is the
+// local daemon. A publication carries at most one local daemon, always first.
 message SnapshotBegin {
   uint32 host_count = 1;
   uint32 session_count = 2;
   uint32 tombstone_count = 3;
+  bool local_present = 4;
 }
-// SnapshotHost is one host projection (ports.RemoteHostSnapshot). The
+// SnapshotDaemon is one daemon projection (ports.BrokerDaemonObservation),
-// endpoint and display origin stay separate: the latter is
+// local or remote. Configured authority (endpoint, registration, policy,
-// presentation-only. Sessions travel as separate SnapshotSession parts.
+// display origin, rank) stays separate from observed state (identity,
-message SnapshotHost {
+// incarnation, version, capabilities, availability, failure, freshness),
+// and observation never invents unknown values. registration is absent for
+// the local daemon; policy is always present. Sessions travel as separate
+// SnapshotSession parts.
+message SnapshotDaemon {
   uint32 host_index = 1;
-  string endpoint = 2;
+  bool local = 2;
-  string display_origin = 3;
+  string endpoint = 3;
-  uint32 rank = 4;
+  string display_origin = 4;
-  RemoteRegistration registration = 5;
+  uint32 rank = 5;
-  // Closed availability taxonomy; 0 is the zero value.
+  RemoteRegistration registration = 6;
-  uint32 availability = 6;
+  BrokerWirePolicy policy = 7;
-  bool checking = 7;
+  // Authenticated daemon identity; empty until observed.
-  BrokerTimestamp last_attempt = 8;
+  string daemon_identity = 8;
-  BrokerTimestamp last_success = 9;
+  // Daemon process incarnation; exactly 16 bytes when an identity is
-  BrokerTimestamp next_due = 10;
+  // present and absent otherwise.
-  uint64 consecutive_failures = 11;
+  bytes daemon_incarnation = 9;
-  uint64 failure_episode = 12;
+  // Observed daemon protocol version; 0 = unobserved.
+  uint32 protocol_version = 10;
+  // Observed capability bitmask (mirrors protocol.Capability* bits).
+  uint32 capabilities = 11;
+  // Closed availability taxonomy (domain.RemoteAvailability); 0 is
+  // invalid, an unobserved daemon carries RemoteAvailabilityUnknown.
+  uint32 availability = 12;
+  bool checking = 13;
+  BrokerTimestamp last_attempt = 14;
+  BrokerTimestamp last_success = 15;
+  BrokerTimestamp next_due = 16;
+  uint64 consecutive_failures = 17;
+  uint64 failure_episode = 18;
   // Closed cause taxonomy (domain.RemoteFailureKind); 0 = none.
-  uint32 failure_kind = 13;
+  uint32 failure_kind = 19;
-  bool inventory_known = 14;
+  bool inventory_known = 20;
-  uint32 session_count = 15;
+  uint32 session_count = 21;
 }
-// SnapshotSession is one catalogue session bound to its host by index.
+// SnapshotSession is one catalogue session bound to its daemon by index.
+// local marks a session of the local daemon; its host_index is then exactly
+// 0 and follows the local daemon part rather than a remote host index.
 message SnapshotSession {
   uint32 host_index = 1;
   uint32 session_index = 2;
   BrokerCatalogSession session = 3;
+  bool local = 4;
 }
 // SnapshotTombstone fences one retired host registration so a stale probe

M internal/protocol/wire/schema/multiplex.proto +5 -0


@@ -51,6 +51,11 @@ message MuxOpen {
51	ExactTarget target = 6;	51		ExactTarget target = 6;
52	repeated string env = 7;	52		repeated string env = 7;
53	BrokerWirePolicy policy = 8;	53		BrokerWirePolicy policy = 8;
		54	+	// Closed attachment-admission taxonomy (ports.BrokerStreamAdmission):
		55	+	// 0 = none (control/observation), 1 = exact attach/resume carrying
		56	+	// target, 2 = create named carrying name, 3 = create ephemeral.
		57	+	uint32 admission = 9;
		58	+	string name = 10;
54	}	59		}
55		60
56	// MuxOpened confirms one logical stream is established.	61		// MuxOpened confirms one logical stream is established.

M internal/usecase/broker/registry.go +260 -51


@@ -8,10 +8,12 @@ import (
8		"hash/fnv"	8		"hash/fnv"
9		"log/slog"	9		"log/slog"
10		"reflect"	10		"reflect"
			11	+	"slices"
11		"sort"	12		"sort"
12		"sync"	13		"sync"
13		"sync/atomic"	14		"sync/atomic"
14		"time"	15		"time"
			16	+	"unicode/utf8"
15			17
16		"github.com/bnema/vev/internal/domain"	18		"github.com/bnema/vev/internal/domain"
17		"github.com/bnema/vev/internal/ports"	19		"github.com/bnema/vev/internal/ports"

@@ -79,7 +81,15 @@ type Registry struct {
79		// completion is fenced even when the endpoint is removed and re-added with	81		// completion is fenced even when the endpoint is removed and re-added with
80		// the identical registration.	82		// the identical registration.
81		attempts uint64	83		attempts uint64
82	-	hosts map[string]ports.RemoteHostSnapshot	84	+	// hosts is the broker-native projection per endpoint. Configured
			85	+	// authority (endpoint, registration, policy, display origin, rank) is
			86	+	// stamped here from durable membership; probe results only supply observed
			87	+	// state and can never override it.
			88	+	hosts map[string]ports.BrokerDaemonObservation
			89	+	// order is the publication order of remote hosts: registration order from
			90	+	// durable membership. A snapshot carries the local daemon first (when a
			91	+	// producer exists) and then these remotes in this order.
			92	+	order []string
83		// inflight records the one admitted attempt per endpoint. The record	93		// inflight records the one admitted attempt per endpoint. The record
84		// carries the attempt's derived context cancel so a retired attempt is	94		// carries the attempt's derived context cancel so a retired attempt is
85		// released the moment its registration is replaced, removed, or the run	95		// released the moment its registration is replaced, removed, or the run

@@ -128,7 +138,7 @@ func NewRegistryWithConfig(epoch ports.BrokerEpoch, store ports.BrokerHostStore,
128		r := &Registry{	138		r := &Registry{
129		epoch: epoch, probe: probe, clock: clock, log: log,	139		epoch: epoch, probe: probe, clock: clock, log: log,
130		observationDisabled: cfg.ObservationDisabled,	140		observationDisabled: cfg.ObservationDisabled,
131	-	hosts: make(map[string]ports.RemoteHostSnapshot), inflight: make(map[string]*probeAttempt),	141	+	hosts: make(map[string]ports.BrokerDaemonObservation), inflight: make(map[string]*probeAttempt),
132		pending: make(map[string]bool), tombstones: make(map[string]ports.BrokerHostTombstone),	142		pending: make(map[string]bool), tombstones: make(map[string]ports.BrokerHostTombstone),
133		subs: make(map[*subscription]struct{}), wake: make(chan struct{}, 1),	143		subs: make(map[*subscription]struct{}), wake: make(chan struct{}, 1),
134		freshFor: defaultFreshFor, retryBase: defaultRetryBase, retryMax: defaultRetryLimit,	144		freshFor: defaultFreshFor, retryBase: defaultRetryBase, retryMax: defaultRetryLimit,

@@ -183,19 +193,87 @@ func (r *Registry) projectMembership(hosts ports.BrokerHosts) error {
183		if err := hosts.Validate(); err != nil {	193		if err := hosts.Validate(); err != nil {
184		return err	194		return err
185		}	195		}
186	-	next := make(map[string]ports.RemoteHostSnapshot, len(hosts.Hosts))	196	+	next := make(map[string]ports.BrokerDaemonObservation, len(hosts.Hosts))
187	-	for _, record := range hosts.Hosts {	197	+	order := make([]string, 0, len(hosts.Hosts))
			198	+	for rank, record := range hosts.Hosts {
188		registration := record.Registration	199		registration := record.Registration
189		restored, present := r.hosts[registration.Endpoint]	200		restored, present := r.hosts[registration.Endpoint]
190		if !present \|\| !restored.Registration.Equal(registration) {	201		if !present \|\| !restored.Registration.Equal(registration) {
191	-	restored = ports.RemoteHostSnapshot{Endpoint: registration.Endpoint, Registration: registration, Availability: domain.RemoteAvailabilityUnknown}	202	+	restored = ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnknown}
192		}	203		}
193	-	next[registration.Endpoint] = restored	204	+	projection := stampHostAuthority(restored, record, rank)
			205	+	// A durable membership whose projection cannot be published is refused
			206	+	// here, at the boundary that owns authority, instead of silently
			207	+	// leaving the registry unable to publish anything.
			208	+	if err := projection.Validate(); err != nil {
			209	+	return fmt.Errorf("broker: host record %q is not publishable: %w", registration.Endpoint, err)
			210	+	}
			211	+	next[registration.Endpoint] = projection
			212	+	order = append(order, registration.Endpoint)
194		}	213		}
195		r.hosts = next	214		r.hosts = next
			215	+	r.order = order
196		return nil	216		return nil
197		}	217		}
198			218
			219	+	// stampHostAuthority overwrites the configured authority fields of a daemon
			220	+	// projection with durable membership authority. Membership is the single
			221	+	// authority for endpoint, registration, policy, and the presentation hints
			222	+	// derived from them; a probe, a restored durable observation, or any other
			223	+	// producer can never supply or override them. The durable observation format
			224	+	// deliberately carries no policy (see durable), so this stamp is also what
			225	+	// gives every restored observation a valid policy.
			226	+	func stampHostAuthority(observation ports.BrokerDaemonObservation, record ports.BrokerHostRecord, rank int) ports.BrokerDaemonObservation {
			227	+	observation.Local = false
			228	+	observation.Endpoint = record.Registration.Endpoint
			229	+	observation.DisplayOrigin = hostDisplayOrigin(record.Registration.Endpoint)
			230	+	observation.Rank = rank
			231	+	observation.Registration = record.Registration
			232	+	observation.Policy = record.Policy
			233	+	if observation.Availability == 0 {
			234	+	// An unobserved daemon reports the explicit unknown availability; zero
			235	+	// is never a valid publication.
			236	+	observation.Availability = domain.RemoteAvailabilityUnknown
			237	+	}
			238	+	return observation
			239	+	}
			240	+
			241	+	// stampObservationAuthority copies the configured authority already stamped on
			242	+	// a live projection onto a fresh probe result. Probe results supply only
			243	+	// observed state, so their endpoint, registration, policy, display origin, and
			244	+	// rank fields are discarded wholesale.
			245	+	func stampObservationAuthority(observation, authority ports.BrokerDaemonObservation) ports.BrokerDaemonObservation {
			246	+	observation.Local = false
			247	+	observation.Endpoint = authority.Endpoint
			248	+	observation.DisplayOrigin = authority.DisplayOrigin
			249	+	observation.Rank = authority.Rank
			250	+	observation.Registration = authority.Registration
			251	+	observation.Policy = authority.Policy
			252	+	return observation
			253	+	}
			254	+
			255	+	// hostDisplayOrigin derives the presentation hint for a configured host. The
			256	+	// routing endpoint stays authoritative; the origin is only the login prefix
			257	+	// stripped for display, and an endpoint that carries none is its own origin.
			258	+	// The hint is sanitized to the display-text rule before it is clamped rune- and
			259	+	// byte-safely to the ports bound: an endpoint the routing validator accepts may
			260	+	// still carry bidi or control runes, and rendering those would let a derived
			261	+	// hint reorder the picker text around it. A derived hint carries no routing
			262	+	// authority, so the refused runes are dropped rather than the host rejected. A
			263	+	// target left with no displayable rune at all yields no origin, which its
			264	+	// caller refuses as unpublishable membership instead of inventing display text.
			265	+	func hostDisplayOrigin(endpoint string) string {
			266	+	origin := ports.SanitizeBrokerDisplayText(domain.RemoteDisplayOrigin(endpoint))
			267	+	if len(origin) <= ports.BrokerMaxDisplayOriginBytes {
			268	+	return origin
			269	+	}
			270	+	truncated := origin[:ports.BrokerMaxDisplayOriginBytes]
			271	+	for len(truncated) > 0 && !utf8.ValidString(truncated) {
			272	+	truncated = truncated[:len(truncated)-1]
			273	+	}
			274	+	return truncated
			275	+	}
			276	+
199		// restore adopts a validated durable snapshot. A zero-epoch snapshot is only	277		// restore adopts a validated durable snapshot. A zero-epoch snapshot is only
200		// the empty placeholder a store returns before its first write: any record	278		// the empty placeholder a store returns before its first write: any record
201		// without an epoch is rejected instead of silently dropped. A persisted	279		// without an epoch is rejected instead of silently dropped. A persisted

@@ -207,7 +285,7 @@ func (r *Registry) projectMembership(hosts ports.BrokerHosts) error {
207		// fencing state and never survive a restart.	285		// fencing state and never survive a restart.
208		func (r *Registry) restore(snapshot ports.BrokerSnapshot) error {	286		func (r *Registry) restore(snapshot ports.BrokerSnapshot) error {
209		if snapshot.Epoch == 0 {	287		if snapshot.Epoch == 0 {
210	-	if len(snapshot.Hosts) > 0 \|\| len(snapshot.Removed) > 0 \|\| snapshot.Revision != 0 {	288	+	if len(snapshot.Daemons) > 0 \|\| len(snapshot.Removed) > 0 \|\| snapshot.Revision != 0 {
211		return errors.New("broker: persisted snapshot has no epoch")	289		return errors.New("broker: persisted snapshot has no epoch")
212		}	290		}
213		return nil	291		return nil

@@ -215,17 +293,78 @@ func (r *Registry) restore(snapshot ports.BrokerSnapshot) error {
215		if snapshot.Epoch == r.epoch {	293		if snapshot.Epoch == r.epoch {
216		return errors.New("broker: persisted snapshot epoch matches the new registry epoch")	294		return errors.New("broker: persisted snapshot epoch matches the new registry epoch")
217		}	295		}
218	-	if err := snapshot.Validate(); err != nil {	296	+	if err := validateRestoredSnapshot(snapshot); err != nil {
219		return err	297		return err
220		}	298		}
221	-	for _, host := range snapshot.Hosts {	299	+	for _, daemon := range snapshot.Daemons {
222	-	host = host.Clone()	300	+	daemon = daemon.Clone()
223	-	host.Checking = false	301	+	daemon.Checking = false
224	-	r.hosts[host.Endpoint] = host	302	+	r.hosts[daemon.Endpoint] = daemon
225		}	303		}
226		return nil	304		return nil
227		}	305		}
228			306
			307	+	// validateRestoredSnapshot applies the durable shape rules to a snapshot read
			308	+	// back from a store: every observation must be a remote, non-local projection
			309	+	// of an exact valid registration whose endpoint matches, with a closed
			310	+	// availability/failure range and a catalogue-valid inventory. Policy and
			311	+	// display authority are deliberately not checked here because the durable
			312	+	// format omits policy and projectMembership stamps both from membership, so a
			313	+	// restored observation is always remote-only and always carries authority once
			314	+	// membership is projected.
			315	+	func validateRestoredSnapshot(snapshot ports.BrokerSnapshot) error {
			316	+	if snapshot.Revision == 0 {
			317	+	return errors.New("broker: persisted snapshot has no revision")
			318	+	}
			319	+	if len(snapshot.Daemons) > ports.BrokerMaxDaemonsPerSnapshot {
			320	+	return errors.New("broker: persisted snapshot has too many daemons")
			321	+	}
			322	+	seen := make(map[string]struct{}, len(snapshot.Daemons))
			323	+	for _, daemon := range snapshot.Daemons {
			324	+	if err := validateDurableObservation(daemon); err != nil {
			325	+	return err
			326	+	}
			327	+	if _, duplicate := seen[daemon.Endpoint]; duplicate {
			328	+	return fmt.Errorf("broker: persisted snapshot has duplicate host %q", daemon.Endpoint)
			329	+	}
			330	+	seen[daemon.Endpoint] = struct{}{}
			331	+	}
			332	+	if len(snapshot.Removed) > ports.BrokerMaxTombstones {
			333	+	return errors.New("broker: persisted snapshot has too many tombstones")
			334	+	}
			335	+	for _, tombstone := range snapshot.Removed {
			336	+	if err := tombstone.Validate(); err != nil {
			337	+	return err
			338	+	}
			339	+	if _, live := seen[tombstone.Endpoint]; live {
			340	+	return fmt.Errorf("broker: persisted snapshot carries live host %q as tombstone", tombstone.Endpoint)
			341	+	}
			342	+	}
			343	+	return nil
			344	+	}
			345	+
			346	+	// validateDurableObservation reports whether one observation satisfies the
			347	+	// durable shape shared with the offline store: remote-only, an exact valid
			348	+	// registration matching its endpoint, and the ports durable projection rules.
			349	+	func validateDurableObservation(daemon ports.BrokerDaemonObservation) error {
			350	+	if daemon.Local {
			351	+	return errors.New("broker: persisted local daemon observation")
			352	+	}
			353	+	if err := domain.ValidateRemoteHostTarget(daemon.Endpoint); err != nil {
			354	+	return fmt.Errorf("broker: persisted observation: %w", err)
			355	+	}
			356	+	if err := daemon.Registration.Validate(); err != nil {
			357	+	return fmt.Errorf("broker: persisted observation: %w", err)
			358	+	}
			359	+	if daemon.Endpoint != daemon.Registration.Endpoint {
			360	+	return errors.New("broker: persisted observation endpoint does not match registration")
			361	+	}
			362	+	if len(daemon.Sessions) > 0 && !daemon.InventoryKnown {
			363	+	return errors.New("broker: persisted observation carries sessions without known inventory")
			364	+	}
			365	+	return ports.ValidateDurableHostProjection(daemon)
			366	+	}
			367	+
229		// Snapshot returns a defensive immutable copy without I/O.	368		// Snapshot returns a defensive immutable copy without I/O.
230		func (r *Registry) Snapshot() ports.BrokerSnapshot { return r.current.Load().Clone() }	369		func (r *Registry) Snapshot() ports.BrokerSnapshot { return r.current.Load().Clone() }
231			370

@@ -262,10 +401,12 @@ func (r *Registry) ReplaceHosts(records []ports.BrokerHostRecord) error {
262		if err := ports.ValidateBrokerHostRecords(records); err != nil {	401		if err := ports.ValidateBrokerHostRecords(records); err != nil {
263		return err	402		return err
264		}	403		}
265	-	next := make(map[string]ports.RemoteHostSnapshot, len(records))	404	+	next := make(map[string]ports.BrokerDaemonObservation, len(records))
266	-	for _, record := range records {	405	+	order := make([]string, 0, len(records))
			406	+	for rank, record := range records {
267		reg := record.Registration	407		reg := record.Registration
268	-	next[reg.Endpoint] = ports.RemoteHostSnapshot{Endpoint: reg.Endpoint, Registration: reg, Availability: domain.RemoteAvailabilityUnknown}	408	+	next[reg.Endpoint] = stampHostAuthority(ports.BrokerDaemonObservation{}, record, rank)
			409	+	order = append(order, reg.Endpoint)
269		}	410		}
270		r.mu.Lock()	411		r.mu.Lock()
271		defer r.mu.Unlock()	412		defer r.mu.Unlock()

@@ -279,7 +420,7 @@ func (r *Registry) ReplaceHosts(records []ports.BrokerHostRecord) error {
279		return fmt.Errorf("broker: replace hosts: %w", err)	420		return fmt.Errorf("broker: replace hosts: %w", err)
280		}	421		}
281		r.authority = ports.BrokerHosts{Revision: r.authority.Revision + 1, Hosts: records}	422		r.authority = ports.BrokerHosts{Revision: r.authority.Revision + 1, Hosts: records}
282	-	r.setHostsLocked(next)	423	+	r.setHostsLocked(next, order)
283		return nil	424		return nil
284		}	425		}
285			426

@@ -291,19 +432,33 @@ func (r *Registry) ReplaceHosts(records []ports.BrokerHostRecord) error {
291		// Removed registrations retire bounded tombstones so a stale completion can	432		// Removed registrations retire bounded tombstones so a stale completion can
292		// never revive them; replaced or re-added endpoints are fenced by the	433		// never revive them; replaced or re-added endpoints are fenced by the
293		// registry attempt token instead.	434		// registry attempt token instead.
294	-	func (r *Registry) setHosts(registrations []domain.RemoteRegistration) error {	435	+	func (r *Registry) setHosts(records []ports.BrokerHostRecord) error {
295	-	if len(registrations) > ports.BrokerMaxHosts {	436	+	if len(records) > ports.BrokerMaxHosts {
296	-	return fmt.Errorf("broker: %d host registrations exceed the limit of %d", len(registrations), ports.BrokerMaxHosts)	437	+	return fmt.Errorf("broker: %d host registrations exceed the limit of %d", len(records), ports.BrokerMaxHosts)
297	-	}	438	+	}
298	-	next := make(map[string]ports.RemoteHostSnapshot, len(registrations))	439	+	next := make(map[string]ports.BrokerDaemonObservation, len(records))
299	-	for _, registration := range registrations {	440	+	order := make([]string, 0, len(records))
300	-	if err := registration.Validate(); err != nil {	441	+	for rank, record := range records {
			442	+	if err := record.Registration.Validate(); err != nil {
301		return err	443		return err
302		}	444		}
			445	+	if err := record.Policy.Validate(); err != nil {
			446	+	return err
			447	+	}
			448	+	registration := record.Registration
303		if _, duplicate := next[registration.Endpoint]; duplicate {	449		if _, duplicate := next[registration.Endpoint]; duplicate {
304		return errors.New("broker: duplicate host registration")	450		return errors.New("broker: duplicate host registration")
305		}	451		}
306	-	next[registration.Endpoint] = ports.RemoteHostSnapshot{Endpoint: registration.Endpoint, Registration: registration, Availability: domain.RemoteAvailabilityUnknown}	452	+	observation := stampHostAuthority(ports.BrokerDaemonObservation{}, record, rank)
			453	+	// Membership the registry cannot publish is a caller error, refused here
			454	+	// rather than left to freeze every later publication: an endpoint whose
			455	+	// derived display hint is empty after the display rule drops its runes
			456	+	// makes every snapshot carrying it invalid.
			457	+	if err := observation.Validate(); err != nil {
			458	+	return fmt.Errorf("broker: host record %q is not publishable: %w", registration.Endpoint, err)
			459	+	}
			460	+	next[registration.Endpoint] = observation
			461	+	order = append(order, registration.Endpoint)
307		}	462		}
308			463
309		r.mu.Lock()	464		r.mu.Lock()

@@ -311,21 +466,27 @@ func (r *Registry) setHosts(registrations []domain.RemoteRegistration) error {
311		if r.revisionExhaustedLocked() {	466		if r.revisionExhaustedLocked() {
312		return fmt.Errorf("broker: set hosts: %w", ports.ErrBrokerRevisionExhausted)	467		return fmt.Errorf("broker: set hosts: %w", ports.ErrBrokerRevisionExhausted)
313		}	468		}
314	-	r.setHostsLocked(next)	469	+	r.setHostsLocked(next, order)
315		return nil	470		return nil
316		}	471		}
317			472
318		// setHostsLocked applies only a projection; the public path commits authority	473		// setHostsLocked applies only a projection; the public path commits authority
319		// first. The caller holds mu through both steps, fencing probe completions.	474		// first. The caller holds mu through both steps, fencing probe completions.
320	-	func (r *Registry) setHostsLocked(next map[string]ports.RemoteHostSnapshot) {	475	+	// order is the registration order the projection was built from; it becomes
321	-	if registrationsUnchanged(r.hosts, next) {	476	+	// the publication order of remote daemons.
			477	+	func (r *Registry) setHostsLocked(next map[string]ports.BrokerDaemonObservation, order []string) {
			478	+	if registrationsUnchanged(r.hosts, next, r.order, order) {
322		return	479		return
323		}	480		}
324		for endpoint, current := range r.hosts {	481		for endpoint, current := range r.hosts {
325		candidate, present := next[endpoint]	482		candidate, present := next[endpoint]
326	-	if present && current.Registration.Equal(candidate.Registration) {	483	+	if present && current.Registration.Equal(candidate.Registration) && current.Policy == candidate.Policy {
327	-	// Unchanged registration: keep the live observation as is.	484	+	// Unchanged authority: keep the live observation as is. Rank is the
328	-	next[endpoint] = current	485	+	// one authority field that follows membership order rather than the
			486	+	// record, so it is re-stamped from the new projection.
			487	+	kept := current
			488	+	kept.Rank = candidate.Rank
			489	+	next[endpoint] = kept
329		continue	490		continue
330		}	491		}
331		// A retired registration owns no observation: cancelling its attempt	492		// A retired registration owns no observation: cancelling its attempt

@@ -351,6 +512,7 @@ func (r *Registry) setHostsLocked(next map[string]ports.RemoteHostSnapshot) {
351		delete(r.tombstones, endpoint)	512		delete(r.tombstones, endpoint)
352		}	513		}
353		r.hosts = next	514		r.hosts = next
			515	+	r.order = order
354		r.publishLocked(true)	516		r.publishLocked(true)
355		r.hint()	517		r.hint()
356		}	518		}

@@ -480,7 +642,7 @@ type probeResult struct {
480		endpoint string	642		endpoint string
481		registration domain.RemoteRegistration	643		registration domain.RemoteRegistration
482		attempt uint64	644		attempt uint64
483	-	snapshot ports.RemoteHostSnapshot	645	+	snapshot ports.BrokerDaemonObservation
484		err error	646		err error
485		at time.Time	647		at time.Time
486		}	648		}

@@ -547,9 +709,10 @@ func (r *Registry) apply(result probeResult) {
547			709
548		kind, availability, failed := observationOutcome(result)	710		kind, availability, failed := observationOutcome(result)
549		if !failed {	711		if !failed {
550	-	observed := result.snapshot.Clone()	712	+	// Configured authority comes only from the registry's own projection:
551	-	observed.Endpoint = result.endpoint	713	+	// a probe result supplies observed state, never endpoint, registration,
552	-	observed.Registration = result.registration	714	+	// policy, display origin, or rank.
			715	+	observed := stampObservationAuthority(result.snapshot.Clone(), current)
553		observed.Checking = false	716		observed.Checking = false
554		observed.LastAttempt = result.at	717		observed.LastAttempt = result.at
555		observed.LastSuccess = result.at	718		observed.LastSuccess = result.at

@@ -557,10 +720,16 @@ func (r *Registry) apply(result probeResult) {
557		observed.ConsecutiveFailures = 0	720		observed.ConsecutiveFailures = 0
558		observed.LastFailure = domain.RemoteFailure{}	721		observed.LastFailure = domain.RemoteFailure{}
559		observed.FailureEpisode = current.FailureEpisode	722		observed.FailureEpisode = current.FailureEpisode
560	-	// A projection the durable store would reject is an invalid response,	723	+	// The published observation must be fully valid once authority is
561	-	// not an observation: publishing it would leave the registry valid but	724	+	// stamped: a probe that invents partial identity (identity without a
562	-	// permanently unpersisted. The store applies the same rule.	725	+	// protocol version) or an inventory without a known catalogue is an
563	-	if err := ports.ValidateDurableHostProjection(observed); err != nil {	726	+	// invalid response, never a published observation. The durable rule is
			727	+	// re-checked too: a projection the offline store would reject is never
			728	+	// published as if it had persisted. The store applies the same rule.
			729	+	if err := observed.Validate(); err != nil {
			730	+	r.log.Debug("broker: observation is invalid", "endpoint", result.endpoint, "err", err)
			731	+	kind, availability, failed = domain.RemoteFailureInvalidResponse, domain.RemoteAvailabilityInvalidResponse, true
			732	+	} else if err := ports.ValidateDurableHostProjection(observed); err != nil {
564		r.log.Debug("broker: observation is not persistable", "endpoint", result.endpoint, "err", err)	733		r.log.Debug("broker: observation is not persistable", "endpoint", result.endpoint, "err", err)
565		kind, availability, failed = domain.RemoteFailureInvalidResponse, domain.RemoteAvailabilityInvalidResponse, true	734		kind, availability, failed = domain.RemoteFailureInvalidResponse, domain.RemoteAvailabilityInvalidResponse, true
566		} else {	735		} else {

@@ -687,16 +856,23 @@ func (r *Registry) nextDelay(now time.Time) time.Duration {
687		return 0	856		return 0
688		}	857		}
689			858
690	-	// registrationsUnchanged reports exact membership equality: the same	859	+	// registrationsUnchanged reports exact membership equality: the same endpoints
691	-	// endpoints bound to the same registration identities. Projection fields such	860	+	// in the same registration order, bound to the same registration identities and
692	-	// as availability, checking, or inventory never participate.	861	+	// policy. Publication order and presentation rank are functions of durable
693	-	func registrationsUnchanged(current, next map[string]ports.RemoteHostSnapshot) bool {	862	+	// membership order, so a reordering of identical records is a membership change
			863	+	// that must republish; otherwise the same durable state yields different
			864	+	// publications depending on process history. Projection fields such as
			865	+	// availability, checking, or inventory never participate.
			866	+	func registrationsUnchanged(current, next map[string]ports.BrokerDaemonObservation, currentOrder, nextOrder []string) bool {
694		if len(current) != len(next) {	867		if len(current) != len(next) {
695		return false	868		return false
696		}	869		}
			870	+	if !slices.Equal(currentOrder, nextOrder) {
			871	+	return false
			872	+	}
697		for endpoint, candidate := range next {	873		for endpoint, candidate := range next {
698		existing, ok := current[endpoint]	874		existing, ok := current[endpoint]
699	-	if !ok \|\| !existing.Registration.Equal(candidate.Registration) {	875	+	if !ok \|\| !existing.Registration.Equal(candidate.Registration) \|\| existing.Policy != candidate.Policy {
700		return false	876		return false
701		}	877		}
702		}	878		}

@@ -782,13 +958,28 @@ func (r *Registry) publishLocked(persist bool) {
782		if r.revisionExhaustedLocked() {	958		if r.revisionExhaustedLocked() {
783		return	959		return
784		}	960		}
785	-	r.revision++	961	+	// Remote daemons are published in registration order. The local daemon,
786	-	hosts := make([]ports.RemoteHostSnapshot, 0, len(r.hosts))	962	+	// when a producer exists (Plan 001 P5.3a), is prepended ahead of these;
787	-	for _, host := range r.hosts {	963	+	// the registry produces no local observation yet and never invents one.
788	-	hosts = append(hosts, host.Clone())	964	+	daemons := make([]ports.BrokerDaemonObservation, 0, len(r.hosts))
			965	+	for _, endpoint := range r.order {
			966	+	host, ok := r.hosts[endpoint]
			967	+	if !ok {
			968	+	continue
			969	+	}
			970	+	daemons = append(daemons, host.Clone())
789		}	971		}
790	-	sort.Slice(hosts, func(i, j int) bool { return hosts[i].Endpoint < hosts[j].Endpoint })	972	+	snapshot := ports.BrokerSnapshot{Epoch: r.epoch, Revision: r.revision + 1, Daemons: daemons, Removed: r.tombstonesLocked()}
791	-	snapshot := ports.BrokerSnapshot{Epoch: r.epoch, Revision: r.revision, Hosts: hosts, Removed: r.tombstonesLocked()}	973	+	if err := snapshot.Validate(); err != nil {
			974	+	// Fail closed: a publication the wire refuses aborts every client
			975	+	// connection on subscribe, so an invalid projection is never published.
			976	+	// The last valid snapshot stays current, nothing is persisted, and the
			977	+	// revision series does not advance past a publication that never
			978	+	// happened.
			979	+	r.log.Error("broker: refused invalid snapshot publication", "revision", r.revision+1, "err", err)
			980	+	return
			981	+	}
			982	+	r.revision = snapshot.Revision
792		r.current.Store(&snapshot)	983		r.current.Store(&snapshot)
793		if persist {	984		if persist {
794		// enqueue only stages an immutable publication: rendering the durable	985		// enqueue only stages an immutable publication: rendering the durable

@@ -807,12 +998,30 @@ func (r *Registry) publishLocked(persist bool) {
807		// they retire registrations only for this process lifetime and a restart never	998		// they retire registrations only for this process lifetime and a restart never
808		// adopts them, so persisting them would leak stale authority into durable	999		// adopts them, so persisting them would leak stale authority into durable
809		// state. Removed is therefore cleared before persistence.	1000		// state. Removed is therefore cleared before persistence.
			1001	+	//
			1002	+	// Policy is membership authority, not observation state, so the durable format
			1003	+	// deliberately omits it: membership is the single policy authority, and the
			1004	+	// loader re-stamps every restored observation from the matching
			1005	+	// ports.BrokerHostRecord (see stampHostAuthority). Persisting it would create a
			1006	+	// second, stale authority that a later membership change could contradict.
			1007	+	//
			1008	+	// Only remote observations are durable: a local daemon observation is
			1009	+	// process-local state and is dropped here (the store also rejects one), so a
			1010	+	// future local producer can never break durable persistence.
810		func durable(snapshot ports.BrokerSnapshot) ports.BrokerSnapshot {	1011		func durable(snapshot ports.BrokerSnapshot) ports.BrokerSnapshot {
811		out := snapshot.Clone()	1012		out := snapshot.Clone()
812		out.Removed = nil	1013		out.Removed = nil
813	-	for i := range out.Hosts {	1014	+	daemons := out.Daemons[:0]
814	-	out.Hosts[i].Checking = false	1015	+	for _, daemon := range out.Daemons {
			1016	+	if daemon.Local {
			1017	+	continue
			1018	+	}
			1019	+	daemon.Checking = false
			1020	+	daemon.LastFailure.Err = nil
			1021	+	daemon.Policy = ports.BrokerPolicy{}
			1022	+	daemons = append(daemons, daemon)
815		}	1023		}
			1024	+	out.Daemons = daemons
816		return out	1025		return out
817		}	1026		}
818			1027

M internal/usecase/broker/registry_durable_test.go +68 -6


@@ -10,6 +10,7 @@ import (
10		"github.com/bnema/vev/internal/domain"	10		"github.com/bnema/vev/internal/domain"
11		"github.com/bnema/vev/internal/ports"	11		"github.com/bnema/vev/internal/ports"
12		portsmocks "github.com/bnema/vev/internal/ports/mocks"	12		portsmocks "github.com/bnema/vev/internal/ports/mocks"
			13	+	"github.com/bnema/vev/internal/protocol"
13		"github.com/stretchr/testify/require"	14		"github.com/stretchr/testify/require"
14		)	15		)
15			16

@@ -38,22 +39,22 @@ func TestRegistryDurableReplaceHostsRestart(t *testing.T) {
38		require.NoError(t, err)	39		require.NoError(t, err)
39		defer r.settle()	40		defer r.settle()
40		require.Equal(t, previous, r.authority.Hosts)	41		require.Equal(t, previous, r.authority.Hosts)
41	-	require.Len(t, r.Snapshot().Hosts, len(previous))	42	+	require.Len(t, r.Snapshot().Daemons, len(previous))
42		if len(previous) > 0 {	43		if len(previous) > 0 {
43	-	require.True(t, r.Snapshot().Hosts[0].InventoryKnown, "advisory observation must also survive restart")	44	+	require.True(t, r.Snapshot().Daemons[0].InventoryKnown, "advisory observation must also survive restart")
44		}	45		}
45		require.NoError(t, r.ReplaceHosts(stage.records))	46		require.NoError(t, r.ReplaceHosts(stage.records))
46		authority, err := store.LoadHosts()	47		authority, err := store.LoadHosts()
47		require.NoError(t, err)	48		require.NoError(t, err)
48		require.Equal(t, r.authority, authority)	49		require.Equal(t, r.authority, authority)
49		require.Equal(t, stage.records, authority.Hosts)	50		require.Equal(t, stage.records, authority.Hosts)
50	-	require.Len(t, r.Snapshot().Hosts, len(stage.records))	51	+	require.Len(t, r.Snapshot().Daemons, len(stage.records))
51		if len(stage.records) > 0 {	52		if len(stage.records) > 0 {
52		reg := stage.records[0].Registration	53		reg := stage.records[0].Registration
53		ctx, cancel := context.WithCancel(context.Background())	54		ctx, cancel := context.WithCancel(context.Background())
54		defer cancel()	55		defer cancel()
55		r.inflight[reg.Endpoint] = &probeAttempt{token: 1, cancel: cancel}	56		r.inflight[reg.Endpoint] = &probeAttempt{token: 1, cancel: cancel}
56	-	r.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: 1, at: r.clock.Now(), snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable, InventoryKnown: true}})	57	+	r.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: 1, at: r.clock.Now(), snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable, InventoryKnown: true}})
57		require.ErrorIs(t, ctx.Err(), context.Canceled)	58		require.ErrorIs(t, ctx.Err(), context.Canceled)
58		}	59		}
59		r.settle() // flush before inspecting persisted projection	60		r.settle() // flush before inspecting persisted projection

@@ -121,7 +122,7 @@ func TestRegistryReplaceHostsAfterShutdownIsTyped(t *testing.T) {
121		store := newTestStore()	122		store := newTestStore()
122		r := newTestRegistry(t, 1, store, newTestProbe(1), newManualClock(time.Unix(100, 0)))	123		r := newTestRegistry(t, 1, store, newTestProbe(1), newManualClock(time.Unix(100, 0)))
123		record := ports.BrokerHostRecord{Registration: registration(t, "host", 1), Pinned: true, Policy: poolPolicy()}	124		record := ports.BrokerHostRecord{Registration: registration(t, "host", 1), Pinned: true, Policy: poolPolicy()}
124	-	require.NoError(t, r.setHosts([]domain.RemoteRegistration{record.Registration}))	125	+	require.NoError(t, r.setHosts(hostRecords(record.Registration)))
125		r.settle()	126		r.settle()
126			127
127		before := r.Snapshot()	128		before := r.Snapshot()

@@ -150,7 +151,7 @@ func TestRegistryDurableChurnFlushesLatestMembership(t *testing.T) {
150		record.Registration.Generation++	151		record.Registration.Generation++
151		record.Policy.Trust = "replacement-trust"	152		record.Policy.Trust = "replacement-trust"
152		require.NoError(t, r.ReplaceHosts([]ports.BrokerHostRecord{record}))	153		require.NoError(t, r.ReplaceHosts([]ports.BrokerHostRecord{record}))
153	-	require.Equal(t, record.Registration, r.Snapshot().Hosts[0].Registration)	154	+	require.Equal(t, record.Registration, r.Snapshot().Daemons[0].Registration)
154		if i < 20 {	155		if i < 20 {
155		require.NoError(t, r.ReplaceHosts(nil))	156		require.NoError(t, r.ReplaceHosts(nil))
156		}	157		}

@@ -163,3 +164,64 @@ func TestRegistryDurableChurnFlushesLatestMembership(t *testing.T) {
163		require.NoError(t, err)	164		require.NoError(t, err)
164		require.Equal(t, r.authority, authority)	165		require.Equal(t, r.authority, authority)
165		}	166		}
			167	+
			168	+	// TestRegistryDurableRoundTripObservedIdentity proves the durable format carries
			169	+	// observed daemon identity, incarnation, protocol version, and capabilities
			170	+	// across a restart. The durable copy deliberately omits policy; the loader
			171	+	// re-stamps it from the matching membership record, which remains the single
			172	+	// policy authority.
			173	+	func TestRegistryDurableRoundTripObservedIdentity(t *testing.T) {
			174	+	dir := filepath.Join(t.TempDir(), "broker")
			175	+	record := ports.BrokerHostRecord{Registration: registration(t, "host", 1), Pinned: true, Policy: poolPolicy()}
			176	+
			177	+	store, err := brokerstore.OpenOffline(brokerstore.Options{Dir: dir})
			178	+	require.NoError(t, err)
			179	+	r, err := NewRegistry(1, store, newTestProbe(1), newManualClock(time.Unix(100, 0)), nil)
			180	+	require.NoError(t, err)
			181	+	require.NoError(t, r.ReplaceHosts([]ports.BrokerHostRecord{record}))
			182	+
			183	+	reg := record.Registration
			184	+	ctx, cancel := context.WithCancel(context.Background())
			185	+	defer cancel()
			186	+	r.inflight[reg.Endpoint] = &probeAttempt{token: 1, cancel: cancel}
			187	+	r.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: 1, at: r.clock.Now(), snapshot: ports.BrokerDaemonObservation{
			188	+	Identity: "authed-daemon",
			189	+	Incarnation: ports.BrokerDaemonIncarnation{4, 5},
			190	+	ProtocolVersion: protocol.Version,
			191	+	Capabilities: protocol.CapabilityResume,
			192	+	Availability: domain.RemoteAvailabilityReachable,
			193	+	}})
			194	+	observed, ok := r.Snapshot().Find(reg.Endpoint)
			195	+	require.True(t, ok)
			196	+	require.Equal(t, ports.BrokerDaemonIdentity("authed-daemon"), observed.Identity)
			197	+	require.ErrorIs(t, ctx.Err(), context.Canceled, "applying the result retires the attempt context")
			198	+	// Policy is membership authority, never durable observation state.
			199	+	require.Equal(t, ports.BrokerPolicy{}, durable(r.Snapshot()).Daemons[0].Policy)
			200	+
			201	+	r.settle() // flush before reopening
			202	+	require.NoError(t, store.Close())
			203	+
			204	+	reopened, err := brokerstore.OpenOffline(brokerstore.Options{Dir: dir})
			205	+	require.NoError(t, err)
			206	+	defer reopened.Close()
			207	+	persisted, err := reopened.Load()
			208	+	require.NoError(t, err)
			209	+	require.Len(t, persisted.Daemons, 1)
			210	+	require.Equal(t, ports.BrokerPolicy{}, persisted.Daemons[0].Policy, "the durable format omits policy")
			211	+	require.Equal(t, ports.BrokerDaemonIdentity("authed-daemon"), persisted.Daemons[0].Identity)
			212	+	require.Equal(t, ports.BrokerDaemonIncarnation{4, 5}, persisted.Daemons[0].Incarnation)
			213	+	require.Equal(t, protocol.Version, persisted.Daemons[0].ProtocolVersion)
			214	+	require.Equal(t, protocol.CapabilityResume, persisted.Daemons[0].Capabilities)
			215	+	r2, err := NewRegistry(2, reopened, newTestProbe(1), newManualClock(time.Unix(200, 0)), nil)
			216	+	require.NoError(t, err)
			217	+	defer r2.settle()
			218	+
			219	+	restored, ok := r2.Snapshot().Find(reg.Endpoint)
			220	+	require.True(t, ok)
			221	+	require.Equal(t, observed.Identity, restored.Identity)
			222	+	require.Equal(t, observed.Incarnation, restored.Incarnation)
			223	+	require.Equal(t, observed.ProtocolVersion, restored.ProtocolVersion)
			224	+	require.Equal(t, observed.Capabilities, restored.Capabilities)
			225	+	require.Equal(t, domain.RemoteAvailabilityReachable, restored.Availability)
			226	+	require.Equal(t, poolPolicy(), restored.Policy, "the loader re-stamps policy from membership")
			227	+	}

M internal/usecase/broker/registry_store_test.go +9 -9


@@ -17,7 +17,7 @@ func TestRegistryRestoresAuthoritativeMembership(t *testing.T) {
17		old := registration(t, "host", 1)	17		old := registration(t, "host", 1)
18		current := old	18		current := old
19		store := portsmocks.NewMockBrokerHostStore(t)	19		store := portsmocks.NewMockBrokerHostStore(t)
20	-	snapshot := ports.BrokerSnapshot{Epoch: 1, Revision: 9, Hosts: []ports.RemoteHostSnapshot{{Endpoint: "host", Registration: old, Availability: domain.RemoteAvailabilityReachable, InventoryKnown: true}}}	20	+	snapshot := ports.BrokerSnapshot{Epoch: 1, Revision: 9, Daemons: []ports.BrokerDaemonObservation{{Endpoint: "host", Registration: old, Availability: domain.RemoteAvailabilityReachable, InventoryKnown: true}}}
21		hosts := ports.BrokerHosts{Revision: 4}	21		hosts := ports.BrokerHosts{Revision: 4}
22		if mode == "replaced" {	22		if mode == "replaced" {
23		current.Generation++	23		current.Generation++

@@ -36,12 +36,12 @@ func TestRegistryRestoresAuthoritativeMembership(t *testing.T) {
36		require.Equal(t, ports.BrokerEpoch(2), got.Epoch)	36		require.Equal(t, ports.BrokerEpoch(2), got.Epoch)
37		require.Equal(t, ports.BrokerRevision(1), got.Revision)	37		require.Equal(t, ports.BrokerRevision(1), got.Revision)
38		if mode == "removed" {	38		if mode == "removed" {
39	-	require.Empty(t, got.Hosts)	39	+	require.Empty(t, got.Daemons)
40		return	40		return
41		}	41		}
42	-	require.Len(t, got.Hosts, 1)	42	+	require.Len(t, got.Daemons, 1)
43	-	require.Equal(t, current, got.Hosts[0].Registration)	43	+	require.Equal(t, current, got.Daemons[0].Registration)
44	-	require.Equal(t, mode == "matching", got.Hosts[0].InventoryKnown)	44	+	require.Equal(t, mode == "matching", got.Daemons[0].InventoryKnown)
45		})	45		})
46		}	46		}
47		}	47		}

@@ -98,7 +98,7 @@ func TestRegistryRestoreIsReadOnlyAndPublicationLocal(t *testing.T) {
98		clock := newManualClock(time.Unix(100, 0))	98		clock := newManualClock(time.Unix(100, 0))
99		reg := registration(t, "host", 1)	99		reg := registration(t, "host", 1)
100		store := portsmocks.NewMockBrokerHostStore(t)	100		store := portsmocks.NewMockBrokerHostStore(t)
101	-	store.EXPECT().Load().Return(ports.BrokerSnapshot{Epoch: 5, Revision: 4096, Hosts: []ports.RemoteHostSnapshot{{	101	+	store.EXPECT().Load().Return(ports.BrokerSnapshot{Epoch: 5, Revision: 4096, Daemons: []ports.BrokerDaemonObservation{{
102		Endpoint: reg.Endpoint, Registration: reg, Availability: domain.RemoteAvailabilityReachable, InventoryKnown: true,	102		Endpoint: reg.Endpoint, Registration: reg, Availability: domain.RemoteAvailabilityReachable, InventoryKnown: true,
103		}}}, nil).Once()	103		}}}, nil).Once()
104		store.EXPECT().LoadHosts().Return(ports.BrokerHosts{Revision: 99, Hosts: []ports.BrokerHostRecord{{Registration: reg, Pinned: true, Policy: poolPolicy()}}}, nil).Once()	104		store.EXPECT().LoadHosts().Return(ports.BrokerHosts{Revision: 99, Hosts: []ports.BrokerHostRecord{{Registration: reg, Pinned: true, Policy: poolPolicy()}}}, nil).Once()

@@ -110,7 +110,7 @@ func TestRegistryRestoreIsReadOnlyAndPublicationLocal(t *testing.T) {
110		require.Equal(t, ports.BrokerEpoch(6), snapshot.Epoch)	110		require.Equal(t, ports.BrokerEpoch(6), snapshot.Epoch)
111		// Restoring reuses the matching observation but never republishes it: a	111		// Restoring reuses the matching observation but never republishes it: a
112		// fresh process adopts authority and rewrites only when it observes.	112		// fresh process adopts authority and rewrites only when it observes.
113	-	require.Len(t, snapshot.Hosts, 1)	113	+	require.Len(t, snapshot.Daemons, 1)
114	-	require.True(t, snapshot.Hosts[0].InventoryKnown)	114	+	require.True(t, snapshot.Daemons[0].InventoryKnown)
115	-	require.Equal(t, domain.RemoteAvailabilityReachable, snapshot.Hosts[0].Availability)	115	+	require.Equal(t, domain.RemoteAvailabilityReachable, snapshot.Daemons[0].Availability)
116		}	116		}

M internal/usecase/broker/registry_test.go +464 -178

 	"sync"
 	"testing"
 	"time"
+	"unicode/utf8"
 	"github.com/bnema/vev/internal/domain"
 	"github.com/bnema/vev/internal/ports"
+	"github.com/bnema/vev/internal/protocol"
 	"github.com/bnema/vev/internal/protocol/catalogue"
 	"github.com/stretchr/testify/require"
 )
 		return s.hosts, nil
 	}
 	authority := ports.BrokerHosts{Revision: 1}
-	for _, host := range s.loaded.Hosts {
+	for _, host := range s.loaded.Daemons {
 		authority.Hosts = append(authority.Hosts, ports.BrokerHostRecord{Registration: host.Registration, Pinned: true, Policy: poolPolicy()})
 	}
 	return authority, nil
 }
 type probeAnswer struct {
-	snapshot ports.RemoteHostSnapshot
+	snapshot ports.BrokerDaemonObservation
 	err      error
 }
-func (p *testProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.RemoteHostSnapshot, error) {
+func (p *testProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerDaemonObservation, error) {
 	call := probeCall{registration: registration, result: make(chan probeAnswer, 1)}
 	select {
 	case p.calls <- call:
 	case <-ctx.Done():
 		p.noteCanceled()
-		return ports.RemoteHostSnapshot{}, ctx.Err()
+		return ports.BrokerDaemonObservation{}, ctx.Err()
 	}
 	select {
 	case answer := <-call.result:
 		return answer.snapshot, answer.err
 	case <-ctx.Done():
 		p.noteCanceled()
-		return ports.RemoteHostSnapshot{}, ctx.Err()
+		return ports.BrokerDaemonObservation{}, ctx.Err()
 	}
 }
 	}
 }
-func (p *churnProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.RemoteHostSnapshot, error) {
+func (p *churnProbe) Probe(ctx context.Context, registration domain.RemoteRegistration) (ports.BrokerDaemonObservation, error) {
 	p.mu.Lock()
 	live := 0
 	for other, endpoint := range p.contexts {
 	case <-ctx.Done():
 	case <-p.release:
 	}
-	return ports.RemoteHostSnapshot{}, ctx.Err()
+	return ports.BrokerDaemonObservation{}, ctx.Err()
 }
 // openRelease lets every still-blocked probe return, so a failing test never
 	return result
 }
+// hostRecord builds one pinned authority record with the shared test policy.
+// The projection-only setHosts seam takes records now, so membership carries
+// the same configured authority (registration plus policy) as production.
+func hostRecord(reg domain.RemoteRegistration) ports.BrokerHostRecord {
+	return ports.BrokerHostRecord{Registration: reg, Pinned: true, Policy: poolPolicy()}
+}
+func hostRecords(registrations ...domain.RemoteRegistration) []ports.BrokerHostRecord {
+	records := make([]ports.BrokerHostRecord, 0, len(registrations))
+	for _, reg := range registrations {
+		records = append(records, hostRecord(reg))
+	}
+	return records
+}
 // hostSession builds one catalogue-valid session. The registry applies the
 // same durable projection rules as the store before adopting an observation, so
 // a fixture session must carry a non-zero lifecycle identity and a non-nil tab
 	}
 }
-func waitHost(t *testing.T, r *Registry, endpoint string, predicate func(ports.RemoteHostSnapshot) bool) ports.RemoteHostSnapshot {
+func waitHost(t *testing.T, r *Registry, endpoint string, predicate func(ports.BrokerDaemonObservation) bool) ports.BrokerDaemonObservation {
 	t.Helper()
 	snapshot := waitSnapshot(t, r, func(snapshot ports.BrokerSnapshot) bool {
 		host, ok := snapshot.Find(endpoint)
 // requireHostStableWithin asserts a stale completion has no delayed effect:
 // the published host stays exactly as observed for a bounded window, and any
 // intervening publication fails immediately.
-func requireHostStableWithin(t *testing.T, r *Registry, endpoint string, want ports.RemoteHostSnapshot, window time.Duration) {
+func requireHostStableWithin(t *testing.T, r *Registry, endpoint string, want ports.BrokerDaemonObservation, window time.Duration) {
 	t.Helper()
 	sub := r.Subscribe()
 	defer sub.Close()
 func TestRegistryRestoresPersistedSnapshotUnderFreshEpoch(t *testing.T) {
 	reg := registration(t, "example.test", 1)
 	sessions := []catalogue.RemoteCatalogSession{{
-		Name:  "work",
+		LifecycleID: domain.SessionLifecycleID{1},
-		State: catalogue.RemoteCatalogSessionUp,
+		Name:        "work",
-		Tabs:  []catalogue.RemoteCatalogTab{{ID: "tab-1", Name: "shell"}},
+		State:       catalogue.RemoteCatalogSessionUp,
+		Tabs:        []catalogue.RemoteCatalogTab{{ID: "tab-1", Name: "shell"}},
 	}}
 	stored := ports.BrokerSnapshot{
 		Epoch:    7,
 		Revision: 9,
-		Hosts: []ports.RemoteHostSnapshot{{
+		Daemons: []ports.BrokerDaemonObservation{{
 			Endpoint:       reg.Endpoint,
 			Registration:   reg,
 			Availability:   domain.RemoteAvailabilityReachable,
 	// A restored broker process starts a fresh revision series: revisions
 	// never compare across epochs.
 	require.Equal(t, ports.BrokerRevision(1), snapshot.Revision)
-	require.Len(t, snapshot.Hosts, 1)
+	require.Len(t, snapshot.Daemons, 1)
 	require.Empty(t, snapshot.Removed)
-	host := snapshot.Hosts[0]
+	host := snapshot.Daemons[0]
 	require.True(t, host.Registration.Equal(reg))
 	require.Equal(t, domain.RemoteAvailabilityReachable, host.Availability)
 	require.Equal(t, time.Unix(80, 0), host.NextDue)
 	require.Error(t, err)
 	// A durable record without an epoch is inconsistent, never silently empty.
-	_, err = NewRegistry(1, &testStore{loaded: ports.BrokerSnapshot{Epoch: 0, Hosts: []ports.RemoteHostSnapshot{{Endpoint: reg.Endpoint, Registration: reg}}}}, newTestProbe(1), clock, nil)
+	_, err = NewRegistry(1, &testStore{loaded: ports.BrokerSnapshot{Epoch: 0, Daemons: []ports.BrokerDaemonObservation{{Endpoint: reg.Endpoint, Registration: reg}}}}, newTestProbe(1), clock, nil)
 	require.Error(t, err)
 	_, err = NewRegistry(1, &testStore{loaded: ports.BrokerSnapshot{Epoch: 0, Removed: []ports.BrokerHostTombstone{{Endpoint: reg.Endpoint, Registration: reg, RetiredRevision: 3}}}}, newTestProbe(1), clock, nil)
 	require.Error(t, err)
 	empty, err := NewRegistry(1, &testStore{}, newTestProbe(1), clock, nil)
 	require.NoError(t, err)
 	require.Equal(t, ports.BrokerRevision(1), empty.Snapshot().Revision)
-	require.Empty(t, empty.Snapshot().Hosts)
+	require.Empty(t, empty.Snapshot().Daemons)
 }
 func TestRegistryRestoreRejectsPersistedSnapshotFromItsOwnEpoch(t *testing.T) {
 	currentEpoch := ports.BrokerSnapshot{
 		Epoch:    7,
 		Revision: 9,
-		Hosts: []ports.RemoteHostSnapshot{{
+		Daemons: []ports.BrokerDaemonObservation{{
 			Endpoint:     reg.Endpoint,
 			Registration: reg,
 			Availability: domain.RemoteAvailabilityReachable,
 	// A different epoch is still adopted normally.
 	registry, err := NewRegistry(8, &testStore{loaded: currentEpoch}, newTestProbe(1), clock, nil)
 	require.NoError(t, err)
-	require.Len(t, registry.Snapshot().Hosts, 1)
+	require.Len(t, registry.Snapshot().Daemons, 1)
 }
 func TestRegistrySetHostsRejectsInvalidRegistrations(t *testing.T) {
 	registry := newTestRegistry(t, 1, newTestStore(), newTestProbe(1), newManualClock(time.Unix(100, 0)))
 	reg := registration(t, "example.test", 1)
-	require.Error(t, registry.setHosts([]domain.RemoteRegistration{reg, reg}))
+	require.Error(t, registry.setHosts(hostRecords(reg, reg)))
-	require.Error(t, registry.setHosts([]domain.RemoteRegistration{{Endpoint: reg.Endpoint}}))
+	require.Error(t, registry.setHosts(hostRecords(domain.RemoteRegistration{Endpoint: reg.Endpoint})))
-	require.Empty(t, registry.Snapshot().Hosts)
+	require.Empty(t, registry.Snapshot().Daemons)
 }
 func TestRegistrySetHostsRejectsHostLimitWithoutMutation(t *testing.T) {
 	registry := newTestRegistry(t, 1, newTestStore(), newTestProbe(1), newManualClock(time.Unix(100, 0)))
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
-	oversized := make([]domain.RemoteRegistration, 0, ports.BrokerMaxHosts+1)
+	oversized := make([]ports.BrokerHostRecord, 0, ports.BrokerMaxHosts+1)
 	for index := 0; index <= ports.BrokerMaxHosts; index++ {
-		oversized = append(oversized, registration(t, fmt.Sprintf("host-%d.test", index), byte(index+1)))
+		oversized = append(oversized, hostRecord(registration(t, fmt.Sprintf("host-%d.test", index), byte(index+1))))
 	}
 	before := registry.Snapshot()
 	require.Error(t, registry.setHosts(oversized))
 	// The boundary itself is accepted.
 	require.NoError(t, registry.setHosts(oversized[:ports.BrokerMaxHosts]))
-	require.Len(t, registry.Snapshot().Hosts, ports.BrokerMaxHosts)
+	require.Len(t, registry.Snapshot().Daemons, ports.BrokerMaxHosts)
 }
-func TestRegistryUnchangedSetHostsIsNoOp(t *testing.T) {
+func TestRegistryUnchangedSetHostsIsNoOpAndReorderRepublishes(t *testing.T) {
 	clock := newManualClock(time.Unix(100, 0))
 	probe := newTestProbe(2)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	first := registration(t, "example.test", 1)
 	second := registration(t, "other.test", 2)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{first, second}))
+	require.NoError(t, registry.setHosts(hostRecords(first, second)))
 	startRegistry(t, registry)
 	// Every configured host is observed exactly once.
 	}
 	require.Len(t, calls, 2)
 	before := registry.Snapshot()
-	for _, host := range before.Hosts {
+	for _, host := range before.Daemons {
 		require.True(t, host.Checking)
 	}
-	// Identical membership, including in a different order, never republishes
+	// Identical membership in the same order never republishes and never
-	// and never restarts an in-flight observation.
+	// restarts an in-flight observation.
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{second, first}))
+	require.NoError(t, registry.setHosts(hostRecords(first, second)))
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{first, second}))
 	require.Equal(t, before, registry.Snapshot())
 	requireNoProbeWithin(t, probe, probeGrace)
+	// A reordering of identical records is a membership change: publication
+	// order and the presentation rank stamped from it follow durable membership
+	// authority, so the registry republishes both without cancelling the
+	// in-flight observation.
+	require.NoError(t, registry.setHosts(hostRecords(second, first)))
+	reordered := registry.Snapshot()
+	require.Greater(t, reordered.Revision, before.Revision)
+	require.Equal(t, []string{"other.test", "example.test"}, []string{reordered.Daemons[0].Endpoint, reordered.Daemons[1].Endpoint})
+	require.Equal(t, 0, reordered.Daemons[0].Rank)
+	require.Equal(t, 1, reordered.Daemons[1].Rank)
+	for _, host := range reordered.Daemons {
+		require.True(t, host.Checking)
+	}
+	requireNoProbeWithin(t, probe, probeGrace)
+	// Restoring the configured order restores the published order and ranks.
+	require.NoError(t, registry.setHosts(hostRecords(first, second)))
+	require.Equal(t, before.Daemons, registry.Snapshot().Daemons)
+	requireNoProbeWithin(t, probe, probeGrace)
 	// The in-flight observations still complete normally.
 	for endpoint, call := range calls {
-		call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+		call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-		waitHost(t, registry, endpoint, func(host ports.RemoteHostSnapshot) bool {
+		waitHost(t, registry, endpoint, func(host ports.BrokerDaemonObservation) bool {
 			return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 		})
 	}
 }
+// TestRegistrySanitizesDerivedDisplayOrigin pins the boundary between routing
+// authority and presentation: a target the routing validator accepts may carry
+// bidi controls or line separators, and a hint the registry derives from it must
+// never render them. The sanitized hint is published, satisfies the contract
+// gate, and leaves the host observable.
+func TestRegistrySanitizesDerivedDisplayOrigin(t *testing.T) {
+	tests := []struct {
+		name     string
+		endpoint string
+		want     string
+	}{
+		{name: "login prefix strips the bidi rune from the origin", endpoint: "user@ho\u202est.test", want: "host.test"},
+		{name: "bare target drops the bidi rune", endpoint: "ho\u202est.test", want: "host.test"},
+		{name: "right-to-left mark dropped", endpoint: "user@ho\u200fst.test", want: "host.test"},
+		{name: "ordinary target unchanged", endpoint: "user@host.test", want: "host.test"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			clock := newManualClock(time.Unix(100, 0))
+			probe := newTestProbe(1)
+			registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
+			require.NoError(t, registry.setHosts(hostRecords(registration(t, tc.endpoint, 1))))
+			host := registry.Snapshot().Daemons[0]
+			require.Equal(t, tc.endpoint, host.Endpoint, "the routing target stays authoritative")
+			require.Equal(t, tc.want, host.DisplayOrigin)
+			require.NoError(t, host.Validate())
+			require.NoError(t, registry.Snapshot().Validate())
+			// Sanitizing the hint never makes the host unobservable.
+			startRegistry(t, registry)
+			call := receiveCall(t, probe)
+			call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
+			waitHost(t, registry, tc.endpoint, func(host ports.BrokerDaemonObservation) bool {
+				return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
+			})
+		})
+	}
+}
+// TestRegistryRefusesUnpublishableMembership pins the fail-closed membership
+// boundary: a target whose derived hint holds only refused runes has no
+// displayable origin, and membership that cannot be published is refused where
+// authority is owned instead of freezing every later publication.
+func TestRegistryRefusesUnpublishableMembership(t *testing.T) {
+	registry := newTestRegistry(t, 1, newTestStore(), newTestProbe(1), newManualClock(time.Unix(100, 0)))
+	err := registry.setHosts(hostRecords(registration(t, "user@\u202e", 1)))
+	require.ErrorContains(t, err, "not publishable")
+	require.Empty(t, registry.Snapshot().Daemons)
+}
+// TestRegistryRefusesInvalidPublication pins the last-resort publication guard:
+// a projection that reached the live set unpublished is never published, because
+// a snapshot the wire refuses aborts every client connection on subscribe, and a
+// refused publication never advances the revision series.
+func TestRegistryRefusesInvalidPublication(t *testing.T) {
+	registry := newTestRegistry(t, 1, newTestStore(), newTestProbe(1), newManualClock(time.Unix(100, 0)))
+	require.NoError(t, registry.setHosts(hostRecords(registration(t, "example.test", 1))))
+	before := registry.Snapshot()
+	// Inject behind the membership boundary, which now refuses such a record.
+	registry.mu.Lock()
+	broken := before.Daemons[0].Clone()
+	broken.DisplayOrigin = ""
+	registry.hosts[broken.Endpoint] = broken
+	registry.publishLocked(false)
+	registry.mu.Unlock()
+	require.Equal(t, before, registry.Snapshot())
+}
 func TestRegistrySnapshotIsImmutable(t *testing.T) {
 	clock := newManualClock(time.Unix(100, 0))
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
+		InventoryKnown: true,
 		Sessions: []catalogue.RemoteCatalogSession{{
 			LifecycleID: domain.SessionLifecycleID{1},
 			Name:        "work",
 			Tabs:        []catalogue.RemoteCatalogTab{{ID: "tab-1", Name: "shell"}},
 		}},
 	}}
-	observed := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	observed := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && len(host.Sessions) == 1
 	})
 	require.Equal(t, "work", observed.Sessions[0].Name)
 	observed.Sessions[0].Name = "mutated"
 	observed.Sessions[0].Tabs[0].Name = "mutated"
 	current := registry.Snapshot()
-	require.Equal(t, reg.Endpoint, current.Hosts[0].Endpoint)
+	require.Equal(t, reg.Endpoint, current.Daemons[0].Endpoint)
-	require.Equal(t, "work", current.Hosts[0].Sessions[0].Name)
+	require.Equal(t, "work", current.Daemons[0].Sessions[0].Name)
-	require.Equal(t, "shell", current.Hosts[0].Sessions[0].Tabs[0].Name)
+	require.Equal(t, "shell", current.Daemons[0].Sessions[0].Tabs[0].Name)
 	// A later publication never mutates a snapshot already handed out.
 	earlier := registry.Snapshot()
 	registry.RequestProbe(reg.Endpoint)
 	next := receiveCall(t, probe)
-	next.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	next.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
-		Sessions:     []catalogue.RemoteCatalogSession{hostSession("other")},
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{hostSession("other")},
 	}}
-	waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && len(host.Sessions) == 1 && host.Sessions[0].Name == "other"
 	})
-	require.Equal(t, "work", earlier.Hosts[0].Sessions[0].Name)
+	require.Equal(t, "work", earlier.Daemons[0].Sessions[0].Name)
 }
 func TestRegistrySchedulesFreshObservationAfterSuccess(t *testing.T) {
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	require.Equal(t, start, host.LastAttempt)
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-	waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	probe := newTestProbe(2)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
 		t.Fatalf("concurrent demand started a duplicate probe for %q", duplicate.registration.Endpoint)
 	default:
 	}
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return host.Availability == domain.RemoteAvailabilityReachable && host.LastSuccess.Equal(start)
 	})
 	require.Equal(t, start.Add(defaultFreshFor), host.NextDue)
 	// The single coalesced follow-up is admitted once the first completes.
 	followUp := receiveCall(t, probe)
 	require.True(t, followUp.registration.Equal(reg))
-	followUp.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	followUp.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-	waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 }
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	registry.RequestProbe("unknown.test")
 	startRegistry(t, registry)
 	store := &testStore{}
 	registry := newTestRegistry(t, 3, store, probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
 		Availability:   domain.RemoteAvailabilityReachable,
 		InventoryKnown: true,
 		Sessions:       []catalogue.RemoteCatalogSession{hostSession("work")},
 	})
 	stored := waitStored(t, store, func(stored ports.BrokerSnapshot) bool {
-		return stored.Revision >= snapshot.Revision && len(stored.Hosts) == 1
+		return stored.Revision >= snapshot.Revision && len(stored.Daemons) == 1
 	})
 	require.Equal(t, ports.BrokerEpoch(3), stored.Epoch)
-	require.Len(t, stored.Hosts, 1)
+	require.Len(t, stored.Daemons, 1)
-	require.Equal(t, "work", stored.Hosts[0].Sessions[0].Name)
+	require.Equal(t, "work", stored.Daemons[0].Sessions[0].Name)
-	require.Equal(t, reg.Endpoint, stored.Hosts[0].Endpoint)
+	require.Equal(t, reg.Endpoint, stored.Daemons[0].Endpoint)
-	require.False(t, stored.Hosts[0].Checking)
+	require.False(t, stored.Daemons[0].Checking)
 }
 func TestRegistryNonReachableOutcomesUseTypedFailureBackoff(t *testing.T) {
 	}{
 		{
 			name:             "unreachable without error",
-			answer:           probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityUnreachable}},
+			answer:           probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityUnreachable}},
 			wantAvailability: domain.RemoteAvailabilityUnreachable,
 			wantKind:         domain.RemoteFailureTransport,
 		},
 		{
 			name:             "unknown outcome is not reachability",
-			answer:           probeAnswer{snapshot: ports.RemoteHostSnapshot{}},
+			answer:           probeAnswer{snapshot: ports.BrokerDaemonObservation{}},
 			wantAvailability: domain.RemoteAvailabilityUnreachable,
 			wantKind:         domain.RemoteFailureTransport,
 		},
 		{
 			name:             "incompatible",
-			answer:           probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityIncompatible}},
+			answer:           probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityIncompatible}},
 			wantAvailability: domain.RemoteAvailabilityIncompatible,
 			wantKind:         domain.RemoteFailureIncompatible,
 		},
 		{
 			name:             "authentication",
-			answer:           probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityAuthFailed}},
+			answer:           probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityAuthFailed}},
 			wantAvailability: domain.RemoteAvailabilityAuthFailed,
 			wantKind:         domain.RemoteFailureAuthentication,
 		},
 		{
 			name:             "invalid response",
-			answer:           probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityInvalidResponse}},
+			answer:           probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityInvalidResponse}},
 			wantAvailability: domain.RemoteAvailabilityInvalidResponse,
 			wantKind:         domain.RemoteFailureInvalidResponse,
 		},
 			probe := newTestProbe(1)
 			registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 			reg := registration(t, "example.test", 1)
-			require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+			require.NoError(t, registry.setHosts(hostRecords(reg)))
 			startRegistry(t, registry)
 			call := receiveCall(t, probe)
 			call.result <- tt.answer
-			host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+			host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 				return !host.Checking && host.ConsecutiveFailures == 1
 			})
 			require.Equal(t, tt.wantAvailability, host.Availability)
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	sub := registry.Subscribe()
 	defer sub.Close()
 	// A reachable observation establishes the last-known inventory.
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
-		Sessions:     []catalogue.RemoteCatalogSession{hostSession("work")},
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{hostSession("work")},
 	}}
-	waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	// never pass unnoticed.
 	clock.Advance(defaultFreshFor)
 	call = receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
-		Sessions:     hostSessions(ports.BrokerMaxSessionsPerHost + 1),
+		InventoryKnown: true,
+		Sessions:       hostSessions(ports.BrokerMaxSessionsPerHost + 1),
 	}}
 	deadline := time.After(time.Second)
-	var host ports.RemoteHostSnapshot
+	var host ports.BrokerDaemonObservation
 	for {
 		snapshot := registry.Snapshot()
 		require.NoError(t, snapshot.Validate())
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	// The bound itself is valid: exactly BrokerMaxSessionsPerHost sessions are
 	// accepted and published, and the resulting snapshot validates.
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
-		Sessions:     hostSessions(ports.BrokerMaxSessionsPerHost),
+		InventoryKnown: true,
+		Sessions:       hostSessions(ports.BrokerMaxSessionsPerHost),
 	}}
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	require.Len(t, host.Sessions, ports.BrokerMaxSessionsPerHost)
 	require.Zero(t, host.ConsecutiveFailures)
 	snapshot := registry.Snapshot()
 	require.NoError(t, snapshot.Validate())
-	require.Len(t, snapshot.Hosts[0].Sessions, ports.BrokerMaxSessionsPerHost)
+	require.Len(t, snapshot.Daemons[0].Sessions, ports.BrokerMaxSessionsPerHost)
 }
 // TestRegistryRejectsNonDurableObservation proves the registry and the durable
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
-		Sessions:     []catalogue.RemoteCatalogSession{hostSession("work")},
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{hostSession("work")},
 	}}
-	waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	// a zero lifecycle identity and an absent tab list) is a malformed response.
 	clock.Advance(defaultFreshFor)
 	call = receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
-		Sessions:     []catalogue.RemoteCatalogSession{{Name: "work", State: catalogue.RemoteCatalogSessionUp}},
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{{Name: "work", State: catalogue.RemoteCatalogSessionUp}},
 	}}
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.ConsecutiveFailures == 1
 	})
 	require.Equal(t, domain.RemoteAvailabilityInvalidResponse, host.Availability)
 	require.Equal(t, start, host.LastSuccess)
 	snapshot := registry.Snapshot()
 	require.NoError(t, snapshot.Validate())
-	require.NoError(t, ports.ValidateDurableHostProjection(snapshot.Hosts[0]))
+	require.NoError(t, ports.ValidateDurableHostProjection(snapshot.Daemons[0]))
 }
 // TestRegistryRevisionOverflowFailsClosed pins the revision series: zero is not
 	registry, err := NewRegistry(1, newTestStore(), newTestProbe(1), newManualClock(time.Unix(100, 0)), logger)
 	require.NoError(t, err)
 	first := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{first}))
+	require.NoError(t, registry.setHosts(hostRecords(first)))
 	before := registry.Snapshot()
 	require.NoError(t, before.Validate())
 	require.Equal(t, ports.BrokerRevision(2), before.Revision)
 	// Both mutation paths refuse the change before touching the store or the
 	// projection, so neither durable authority nor the publication series moves.
-	require.ErrorIs(t, registry.setHosts([]domain.RemoteRegistration{registration(t, "other.test", 2)}), ports.ErrBrokerRevisionExhausted)
+	require.ErrorIs(t, registry.setHosts(hostRecords(registration(t, "other.test", 2))), ports.ErrBrokerRevisionExhausted)
 	require.ErrorIs(t, registry.ReplaceHosts([]ports.BrokerHostRecord{{Registration: first, Pinned: true, Policy: poolPolicy()}}), ports.ErrBrokerRevisionExhausted)
 	require.Equal(t, authority, registry.authority)
 	require.NoError(t, after.Validate())
 	require.Greater(t, after.Revision, ports.BrokerRevision(0))
 	require.Equal(t, ^ports.BrokerRevision(0), registry.revision)
-	require.Equal(t, first, after.Hosts[0].Registration)
+	require.Equal(t, first, after.Daemons[0].Registration)
 	// The refusal is observable: an exhausted series logs instead of failing
 	// silently behind a frozen snapshot.
 	require.Contains(t, logs.String(), "revision series exhausted")
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	// A successful observation owns the success time and opens no episode.
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityReachable,
+		Availability:   domain.RemoteAvailabilityReachable,
-		Sessions:     []catalogue.RemoteCatalogSession{hostSession("work")},
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{hostSession("work")},
 	}}
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	require.Equal(t, start, host.LastSuccess)
 	// A failure preserves the last success and opens exactly one episode.
 	clock.Advance(defaultFreshFor)
 	call = receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
-		Availability: domain.RemoteAvailabilityIncompatible,
+		Availability:   domain.RemoteAvailabilityIncompatible,
-		Sessions:     []catalogue.RemoteCatalogSession{{Name: "stale", State: catalogue.RemoteCatalogSessionUp}},
+		InventoryKnown: true,
+		Sessions:       []catalogue.RemoteCatalogSession{{Name: "stale", State: catalogue.RemoteCatalogSessionUp}},
 	}}
-	host = waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host = waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.ConsecutiveFailures == 1
 	})
 	require.Equal(t, start, host.LastSuccess)
 	clock.Advance(defaultRetryBase)
 	call = receiveCall(t, probe)
 	call.result <- probeAnswer{err: errors.New("offline")}
-	host = waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host = waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.ConsecutiveFailures == 2
 	})
 	require.Equal(t, start, host.LastSuccess)
 	clock.Advance(2 * defaultRetryBase)
 	recovered := clock.Now()
 	call = receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-	host = waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host = waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.ConsecutiveFailures == 0
 	})
 	require.Equal(t, recovered, host.LastSuccess)
 	probe := newTestProbe(1)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	probeErr := errors.New("offline")
 		call := receiveCall(t, probe)
 		at := clock.Now()
 		call.result <- probeAnswer{err: probeErr}
-		host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+		host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 			return !host.Checking && host.ConsecutiveFailures == uint(index+1)
 		})
 		require.Equal(t, domain.RemoteAvailabilityUnreachable, host.Availability)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	registry.jitter = func(base time.Duration, _ string, _ uint64) time.Duration { return base / 2 }
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
 	call.result <- probeAnswer{err: errors.New("offline")}
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityUnreachable
 	})
 	require.Equal(t, start.Add(defaultRetryBase/2), host.NextDue)
 	clock.Advance(defaultRetryBase / 2)
 	next := receiveCall(t, probe)
 	successAt := clock.Now()
-	next.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	next.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-	host = waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host = waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	// The healthy refresh is jittered too: a fleet of hosts never converges
 func TestRegistryFencesStaleCompletionAcrossRegistrationChanges(t *testing.T) {
 	replacementAnswer := func(name string) probeAnswer {
-		return probeAnswer{snapshot: ports.RemoteHostSnapshot{
+		return probeAnswer{snapshot: ports.BrokerDaemonObservation{
-			Availability: domain.RemoteAvailabilityReachable,
+			Availability:   domain.RemoteAvailabilityReachable,
-			Sessions:     []catalogue.RemoteCatalogSession{hostSession(name)},
+			InventoryKnown: true,
+			Sessions:       []catalogue.RemoteCatalogSession{hostSession(name)},
 		}}
 	}
 	assertFenced := func(t *testing.T, current, replacement domain.RemoteRegistration) {
 		clock := newManualClock(time.Unix(100, 0))
 		probe := newTestProbe(2)
 		registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
-		require.NoError(t, registry.setHosts([]domain.RemoteRegistration{current}))
+		require.NoError(t, registry.setHosts(hostRecords(current)))
 		startRegistry(t, registry)
 		currentCall := receiveCall(t, probe)
 		require.True(t, currentCall.registration.Equal(current))
-		require.NoError(t, registry.setHosts([]domain.RemoteRegistration{replacement}))
+		require.NoError(t, registry.setHosts(hostRecords(replacement)))
 		replacementCall := receiveCall(t, probe)
 		require.True(t, replacementCall.registration.Equal(replacement))
 		// The replacement completes and becomes authoritative...
 		replacementCall.result <- replacementAnswer("replacement")
-		applied := waitHost(t, registry, replacement.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+		applied := waitHost(t, registry, replacement.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 			return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable && len(host.Sessions) == 1
 		})
 		require.True(t, applied.Registration.Equal(replacement))
 		next := receiveCall(t, probe)
 		require.True(t, next.registration.Equal(replacement))
 		next.result <- replacementAnswer("next")
-		waitHost(t, registry, replacement.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+		waitHost(t, registry, replacement.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 			return !host.Checking && len(host.Sessions) == 1 && host.Sessions[0].Name == "next"
 		})
 	}
 	probe := newTestProbe(2)
 	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 	// Removal retires a bounded tombstone and drops the in-flight token.
 	require.NoError(t, registry.setHosts(nil))
 	removed := registry.Snapshot()
-	require.Empty(t, removed.Hosts)
+	require.Empty(t, removed.Daemons)
 	require.Len(t, removed.Removed, 1)
 	require.Equal(t, removed.Revision, removed.Removed[0].RetiredRevision)
 	require.True(t, removed.Removed[0].Fences(reg))
 	require.NoError(t, removed.Validate())
 	// The retired attempt can never revive a removed endpoint.
-	registry.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: retired, snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}, at: clock.Now()})
+	registry.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: retired, snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}, at: clock.Now()})
-	require.Empty(t, registry.Snapshot().Hosts)
+	require.Empty(t, registry.Snapshot().Daemons)
 	require.Len(t, registry.Snapshot().Removed, 1)
 	// Re-adding the identical registration supersedes the tombstone, so only
 	// the attempt token can fence the retired completion.
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	require.Empty(t, registry.Snapshot().Removed)
 	dispatch()
 	freshCall := receiveCall(t, probe)
 	fresh := attemptFor(registry, reg.Endpoint)
 	require.Greater(t, fresh, retired)
-	registry.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: retired, snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}, at: clock.Now()})
+	registry.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: retired, snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}, at: clock.Now()})
 	stale, ok := registry.Snapshot().Find(reg.Endpoint)
 	require.True(t, ok)
 	require.True(t, stale.Checking)
 	require.Equal(t, domain.RemoteAvailabilityUnknown, stale.Availability)
-	registry.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: fresh, snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}, at: clock.Now()})
+	registry.apply(probeResult{endpoint: reg.Endpoint, registration: reg, attempt: fresh, snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}, at: clock.Now()})
 	applied, ok := registry.Snapshot().Find(reg.Endpoint)
 	require.True(t, ok)
 	require.False(t, applied.Checking)
 	replacement := registration(t, "example.test", 2)
 	tests := []struct {
 		name string
-		next []domain.RemoteRegistration
+		next []ports.BrokerHostRecord
 	}{
-		{name: "replacement", next: []domain.RemoteRegistration{replacement}},
+		{name: "replacement", next: []ports.BrokerHostRecord{hostRecord(replacement)}},
 		{name: "removal", next: nil},
 	}
 	for _, tt := range tests {
 			clock := newManualClock(time.Unix(100, 0))
 			probe := newTestProbe(2)
 			registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
-			require.NoError(t, registry.setHosts([]domain.RemoteRegistration{current}))
+			require.NoError(t, registry.setHosts(hostRecords(current)))
 			startRegistry(t, registry)
 			call := receiveCall(t, probe)
 	first := registration(t, "example.test", 1)
 	second := registration(t, "example.test", 2)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{first}))
+	require.NoError(t, registry.setHosts(hostRecords(first)))
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 		if round%2 == 0 {
 			next = second
 		}
-		require.NoError(t, registry.setHosts([]domain.RemoteRegistration{next}))
+		require.NoError(t, registry.setHosts(hostRecords(next)))
 		select {
 		case <-probe.startedSig:
 		case <-time.After(time.Second):
 				if (worker+round)%2 == 0 {
 					next = second
 				}
-				if err := registry.setHosts([]domain.RemoteRegistration{next}); err != nil {
+				if err := registry.setHosts(hostRecords(next)); err != nil {
 					failures[worker] = err
 					return
 				}
 	// Two full membership rounds with distinct endpoints: without pruning the
 	// retired set would double.
 	for round := 0; round < 2; round++ {
-		registrations := make([]domain.RemoteRegistration, 0, ports.BrokerMaxHosts)
+		registrations := make([]ports.BrokerHostRecord, 0, ports.BrokerMaxHosts)
 		for index := 0; index < ports.BrokerMaxHosts; index++ {
-			registrations = append(registrations, registration(t, fmt.Sprintf("round-%d-host-%d.test", round, index), byte(round*ports.BrokerMaxHosts+index+1)))
+			registrations = append(registrations, hostRecord(registration(t, fmt.Sprintf("round-%d-host-%d.test", round, index), byte(round*ports.BrokerMaxHosts+index+1))))
 		}
 		require.NoError(t, registry.setHosts(registrations))
 		require.NoError(t, registry.setHosts(nil))
 	defer registry.store.close()
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	// The writer is now blocked inside the first durable write.
 	first := <-store.entered
 	require.Equal(t, ports.BrokerRevision(2), first)
 		defer close(published)
 		for generation := domain.RemoteGeneration(2); generation <= 6; generation++ {
 			reg.Generation = generation
-			if err := registry.setHosts([]domain.RemoteRegistration{reg}); err != nil {
+			if err := registry.setHosts(hostRecords(reg)); err != nil {
 				setErr = err
 				return
 			}
 	require.NoError(t, err)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	call := receiveCall(t, probe)
-	require.True(t, waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	require.True(t, waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return host.Checking
 	}).Checking)
 	select {
 	case snapshot := <-observed:
 		require.NoError(t, snapshot.Validate())
-		require.Len(t, snapshot.Hosts, 1)
+		require.Len(t, snapshot.Daemons, 1)
-		require.Equal(t, reg, snapshot.Hosts[0].Registration)
+		require.Equal(t, reg, snapshot.Daemons[0].Registration)
 	case <-time.After(time.Second):
 		t.Fatal("Snapshot blocked behind the durable membership CAS")
 	}
 	// parked: applying the result needs the registry lock, so the in-flight
 	// projection must stay exactly as published until membership commits.
 	registry.hint()
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
 	pending, ok := registry.Snapshot().Find(reg.Endpoint)
 	require.True(t, ok)
 	require.True(t, pending.Checking)
 	// applies the observation and resumes scheduling the next one.
 	store.releaseCAS()
 	require.NoError(t, <-replaced)
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 	})
 	require.Equal(t, clock.Now(), host.LastSuccess)
 	defer registry.store.close()
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	waitForLog(t, logs, "durable snapshot write failed")
 	require.Contains(t, logs.String(), storeErr.Error())
 	// A failed write is not fatal and never blocks the next publication.
 	store.setStoreErr(nil)
 	reg.Generation++
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	stored := waitStored(t, store, func(snapshot ports.BrokerSnapshot) bool {
 		return snapshot.Revision == registry.Snapshot().Revision
 	})
-	require.Len(t, stored.Hosts, 1)
+	require.Len(t, stored.Daemons, 1)
-	require.True(t, stored.Hosts[0].Registration.Equal(reg))
+	require.True(t, stored.Daemons[0].Registration.Equal(reg))
 }
 func TestRegistryPersistedCopyClearsChecking(t *testing.T) {
 	store := &testStore{}
 	registry := newTestRegistry(t, 3, store, probe, clock)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	startRegistry(t, registry)
 	// The observation is in flight: the published projection carries Checking,
 	// the durable copy never does.
-	require.True(t, waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	require.True(t, waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return host.Checking
 	}).Checking)
 	stored := waitStored(t, store, func(snapshot ports.BrokerSnapshot) bool {
-		return len(snapshot.Hosts) == 1
+		return len(snapshot.Daemons) == 1
 	})
-	require.False(t, stored.Hosts[0].Checking)
+	require.False(t, stored.Daemons[0].Checking)
 	// Completing the observation persists the settled projection.
 	call := receiveCall(t, probe)
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
 	settled := waitStored(t, store, func(snapshot ports.BrokerSnapshot) bool {
-		return len(snapshot.Hosts) == 1 && snapshot.Hosts[0].Availability == domain.RemoteAvailabilityReachable
+		return len(snapshot.Daemons) == 1 && snapshot.Daemons[0].Availability == domain.RemoteAvailabilityReachable
 	})
-	require.False(t, settled.Hosts[0].Checking)
+	require.False(t, settled.Daemons[0].Checking)
 }
 // TestRegistryNeverPersistsRetirementTombstones proves retirement tombstones
 	defer registry.store.close()
 	reg := registration(t, "retired.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	require.NoError(t, registry.setHosts(nil))
 	// Removal publishes a bounded tombstone and drops the live host in memory.
-	require.Empty(t, registry.Snapshot().Hosts)
+	require.Empty(t, registry.Snapshot().Daemons)
 	require.Len(t, registry.Snapshot().Removed, 1)
 	// The durable copy drops the tombstone before the store ever sees it.
 	stored := waitStored(t, store, func(snapshot ports.BrokerSnapshot) bool {
-		return len(snapshot.Hosts) == 0 && snapshot.Revision == registry.Snapshot().Revision
+		return len(snapshot.Daemons) == 0 && snapshot.Revision == registry.Snapshot().Revision
 	})
 	require.Empty(t, stored.Removed)
 	// stale tombstone.
 	reopened, err := NewRegistry(2, &testStore{loaded: stored}, newTestProbe(1), clock, nil)
 	require.NoError(t, err)
-	require.Empty(t, reopened.Snapshot().Hosts)
+	require.Empty(t, reopened.Snapshot().Daemons)
 	require.Empty(t, reopened.Snapshot().Removed)
 }
 	reg := registration(t, "example.test", 1)
 	for generation := domain.RemoteGeneration(1); generation <= 10; generation++ {
 		reg.Generation = generation
-		require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+		require.NoError(t, registry.setHosts(hostRecords(reg)))
 	}
 	// A subscriber that never drains is bounded to one pending wake and
 	// never blocks publication.
 	sub.Close()
 	sub.Close()
 	reg.Generation++
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	select {
 	case <-sub.Changed():
 		t.Fatal("closed subscription received a notification")
 		t.Fatal("in-flight probe did not observe cancellation")
 	}
 	// Cleanup settles the projection: no host stays in flight.
-	host := waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking
 	})
 	require.Equal(t, domain.RemoteAvailabilityUnknown, host.Availability)
 	registry, err := NewRegistry(1, store, probe, clock, logger)
 	require.NoError(t, err)
 	reg := registration(t, "example.test", 1)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{reg}))
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan struct{})
 	go func() { defer close(done); registry.Run(ctx) }()
 	call := receiveCall(t, probe)
-	require.True(t, waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	require.True(t, waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return host.Checking
 	}).Checking)
 		t.Fatal("registry did not stop after cancellation")
 	}
 	// Cleanup publishes the settled projection: nothing stays in flight.
-	require.False(t, waitHost(t, registry, reg.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+	require.False(t, waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 		return !host.Checking
 	}).Checking)
 	// The retired completion can never be applied once the run is over.
-	call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
 	settled := registry.Snapshot()
-	require.Equal(t, domain.RemoteAvailabilityUnknown, settled.Hosts[0].Availability)
+	require.Equal(t, domain.RemoteAvailabilityUnknown, settled.Daemons[0].Availability)
-	require.Zero(t, settled.Hosts[0].ConsecutiveFailures)
+	require.Zero(t, settled.Daemons[0].ConsecutiveFailures)
 	// Persistence is flushed before shutdown and no write outlives it.
 	stored := waitStored(t, store, func(snapshot ports.BrokerSnapshot) bool {
 		return snapshot.Revision >= settled.Revision
 	})
 	require.Equal(t, settled.Revision, stored.Revision)
-	require.False(t, stored.Hosts[0].Checking)
+	require.False(t, stored.Daemons[0].Checking)
 	writes := store.writeCount()
 	require.NoError(t, registry.setHosts(nil))
 	require.Equal(t, writes, store.writeCount())
 	first := registration(t, "a.test", 1)
 	second := registration(t, "b.test", 2)
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{first}))
+	require.NoError(t, registry.setHosts(hostRecords(first)))
 	observe()
-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{first, second}))
+	require.NoError(t, registry.setHosts(hostRecords(first, second)))
 	observe()
 	startRegistry(t, registry)
 	for range 2 {
 		call := receiveCall(t, probe)
-		call.result <- probeAnswer{snapshot: ports.RemoteHostSnapshot{Availability: domain.RemoteAvailabilityReachable}}
+		call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{Availability: domain.RemoteAvailabilityReachable}}
-		waitHost(t, registry, call.registration.Endpoint, func(host ports.RemoteHostSnapshot) bool {
+		waitHost(t, registry, call.registration.Endpoint, func(host ports.BrokerDaemonObservation) bool {
 			return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
 		})
 		observe()
 	}
 }
+// TestRegistryProbeCannotOverrideConfiguredAuthority proves the ownership rule:
+// a probe supplies observed state only. Configured authority (local flag,
+// endpoint, registration, policy, display origin, rank) is stamped by the
+// registry from its own host records and a hostile probe result can never
+// override it.
+func TestRegistryProbeCannotOverrideConfiguredAuthority(t *testing.T) {
+	clock := newManualClock(time.Unix(100, 0))
+	probe := newTestProbe(1)
+	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
+	reg := registration(t, "user@host:22", 1)
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
+	startRegistry(t, registry)
+	call := receiveCall(t, probe)
+	require.True(t, call.registration.Equal(reg))
+	// Every authority field is invented by the probe, including a local flag,
+	// a foreign endpoint and registration, a different policy, and display/rank
+	// hints. None of it may reach the published projection.
+	hostilePolicy := poolPolicy()
+	hostilePolicy.Trust = "attacker"
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
+		Local:         true,
+		Endpoint:      "attacker@evil",
+		DisplayOrigin: "evil",
+		Rank:          42,
+		Registration:  registration(t, "attacker@evil", 9),
+		Policy:        hostilePolicy,
+		Availability:  domain.RemoteAvailabilityReachable,
+	}}
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
+		return !host.Checking && host.Availability == domain.RemoteAvailabilityReachable
+	})
+	require.False(t, host.Local)
+	require.Equal(t, reg.Endpoint, host.Endpoint)
+	require.Equal(t, domain.RemoteDisplayOrigin(reg.Endpoint), host.DisplayOrigin)
+	require.Zero(t, host.Rank)
+	require.True(t, host.Registration.Equal(reg))
+	require.Equal(t, poolPolicy(), host.Policy)
+	require.NotEqual(t, hostilePolicy, host.Policy)
+	require.Len(t, registry.Snapshot().Daemons, 1)
+}
+// TestRegistryPublishesObservedDaemonIdentity proves observed identity,
+// incarnation, protocol version, and capabilities flow from a probe result into
+// the published snapshot; configured authority is stamped alongside them.
+func TestRegistryPublishesObservedDaemonIdentity(t *testing.T) {
+	clock := newManualClock(time.Unix(100, 0))
+	probe := newTestProbe(1)
+	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
+	reg := registration(t, "user@host:22", 1)
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
+	startRegistry(t, registry)
+	call := receiveCall(t, probe)
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
+		Identity:        "authed-daemon",
+		Incarnation:     ports.BrokerDaemonIncarnation{7, 11},
+		ProtocolVersion: protocol.Version,
+		Capabilities:    protocol.CapabilityResume | protocol.CapabilityUDP,
+		Availability:    domain.RemoteAvailabilityReachable,
+	}}
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
+		return !host.Checking && host.Identity != ""
+	})
+	require.Equal(t, ports.BrokerDaemonIdentity("authed-daemon"), host.Identity)
+	require.Equal(t, ports.BrokerDaemonIncarnation{7, 11}, host.Incarnation)
+	require.Equal(t, protocol.Version, host.ProtocolVersion)
+	require.Equal(t, protocol.CapabilityResume|protocol.CapabilityUDP, host.Capabilities)
+	require.Equal(t, poolPolicy(), host.Policy)
+	require.NoError(t, registry.Snapshot().Validate())
+}
+// TestRegistryRejectsObservedIdentityWithoutProtocolVersion pins the partial
+// identity rule: an observation that reports identity and incarnation without a
+// protocol version fails ports validation and is classified as an invalid
+// response, so it never publishes a half-observed daemon.
+func TestRegistryRejectsObservedIdentityWithoutProtocolVersion(t *testing.T) {
+	// The contract itself rejects partial identity.
+	require.Error(t, (ports.BrokerDaemonObservation{
+		DisplayOrigin: "host",
+		Policy:        poolPolicy(),
+		Identity:      "authed-daemon",
+		Incarnation:   ports.BrokerDaemonIncarnation{7},
+		Availability:  domain.RemoteAvailabilityReachable,
+	}).Validate())
+	clock := newManualClock(time.Unix(100, 0))
+	probe := newTestProbe(1)
+	registry := newTestRegistry(t, 1, newTestStore(), probe, clock)
+	reg := registration(t, "user@host:22", 1)
+	require.NoError(t, registry.setHosts(hostRecords(reg)))
+	startRegistry(t, registry)
+	call := receiveCall(t, probe)
+	call.result <- probeAnswer{snapshot: ports.BrokerDaemonObservation{
+		Identity:     "authed-daemon",
+		Incarnation:  ports.BrokerDaemonIncarnation{7},
+		Availability: domain.RemoteAvailabilityReachable,
+	}}
+	host := waitHost(t, registry, reg.Endpoint, func(host ports.BrokerDaemonObservation) bool {
+		return !host.Checking && host.ConsecutiveFailures == 1
+	})
+	require.Equal(t, domain.RemoteAvailabilityInvalidResponse, host.Availability)
+	require.Equal(t, domain.RemoteFailureInvalidResponse, host.LastFailure.Kind)
+	require.Empty(t, host.Identity, "partial identity must never be published")
+	require.True(t, host.Incarnation.IsZero())
+}
+// TestRegistryPublishesRemoteDaemonsInRegistrationOrder pins the publication
+// invariant: remote daemons appear in durable membership registration order (no
+// local producer exists yet, so the snapshot carries remotes only).
+func TestRegistryPublishesRemoteDaemonsInRegistrationOrder(t *testing.T) {
+	registry := newTestRegistry(t, 1, newTestStore(), newTestProbe(1), newManualClock(time.Unix(100, 0)))
+	first := registration(t, "a.test", 1)
+	second := registration(t, "b.test", 2)
+	third := registration(t, "c.test", 3)
+	require.NoError(t, registry.setHosts(hostRecords(first, second)))
+	require.Equal(t, []string{"a.test", "b.test"}, daemonEndpoints(registry.Snapshot()))
+	// Membership changes publish in the new registration order, not sorted and
+	// not map order.
+	require.NoError(t, registry.setHosts(hostRecords(third, second, first)))
+	require.Equal(t, []string{"c.test", "b.test", "a.test"}, daemonEndpoints(registry.Snapshot()))
+}
+func daemonEndpoints(snapshot ports.BrokerSnapshot) []string {
+	endpoints := make([]string, 0, len(snapshot.Daemons))
+	for _, daemon := range snapshot.Daemons {
+		endpoints = append(endpoints, daemon.Endpoint)
+	}
+	return endpoints
+}
+// TestDurableProjectionDropsLocalObservationAndPolicy pins the durable format
+// decision: the persistable copy carries remote observations only (a local
+// daemon observation is process-local) and omits policy, because membership is
+// the single policy authority and the loader re-stamps it.
+func TestDurableProjectionDropsLocalObservationAndPolicy(t *testing.T) {
+	reg := registration(t, "user@host:22", 1)
+	snapshot := ports.BrokerSnapshot{Epoch: 1, Revision: 1, Daemons: []ports.BrokerDaemonObservation{
+		{Local: true, DisplayOrigin: "local", Policy: poolPolicy(), Availability: domain.RemoteAvailabilityReachable},
+		{Endpoint: reg.Endpoint, DisplayOrigin: domain.RemoteDisplayOrigin(reg.Endpoint), Registration: reg, Policy: poolPolicy(), Availability: domain.RemoteAvailabilityReachable},
+	}}
+	out := durable(snapshot)
+	require.Len(t, out.Daemons, 1)
+	require.False(t, out.Daemons[0].Local)
+	require.Equal(t, reg.Endpoint, out.Daemons[0].Endpoint)
+	require.Equal(t, ports.BrokerPolicy{}, out.Daemons[0].Policy)
+	require.Nil(t, out.Removed)
+	// The published snapshot the caller handed in is untouched.
+	require.Len(t, snapshot.Daemons, 2)
+	require.Equal(t, poolPolicy(), snapshot.Daemons[0].Policy)
+}
+// TestHostDisplayOriginIsBounded pins the presentation-hint bound: a derived
+// origin is clamped rune-safely at the ports limit so an over-long configured
+// endpoint still yields a valid publication instead of an unobservable host.
+func TestHostDisplayOriginIsBounded(t *testing.T) {
+	require.Equal(t, "host:22", hostDisplayOrigin("user@host:22"))
+	require.Equal(t, "plain.test", hostDisplayOrigin("plain.test"))
+	origin := hostDisplayOrigin("user@" + strings.Repeat("€", 100))
+	require.LessOrEqual(t, len(origin), ports.BrokerMaxDisplayOriginBytes)
+	require.True(t, utf8.ValidString(origin))
+	require.NotEmpty(t, origin)
+}

M internal/usecase/broker/service_test.go +7 -7


@@ -110,8 +110,8 @@ func TestAuthorityAdmissionContextNotRetained(t *testing.T) {
110		// The admission context is discarded: the connection keeps serving after the	110		// The admission context is discarded: the connection keeps serving after the
111		// caller's setup deadline expires.	111		// caller's setup deadline expires.
112		cancel()	112		cancel()
113	-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{registration(t, "user@host:22", 1)}))	113	+	require.NoError(t, registry.setHosts(hostRecords(registration(t, "user@host:22", 1))))
114	-	require.Len(t, service.Snapshot().Hosts, 1)	114	+	require.Len(t, service.Snapshot().Daemons, 1)
115			115
116		stream, err := service.OpenStream(context.Background(), poolRequest(service.ConnectionID(), 1))	116		stream, err := service.OpenStream(context.Background(), poolRequest(service.ConnectionID(), 1))
117		require.NoError(t, err)	117		require.NoError(t, err)

@@ -251,14 +251,14 @@ func TestServiceSnapshotDelegates(t *testing.T) {
251		require.NoError(t, err)	251		require.NoError(t, err)
252		defer sub.Close()	252		defer sub.Close()
253			253
254	-	require.NoError(t, registry.setHosts([]domain.RemoteRegistration{registration(t, "user@host:22", 1)}))	254	+	require.NoError(t, registry.setHosts(hostRecords(registration(t, "user@host:22", 1))))
255		select {	255		select {
256		case <-sub.Changed():	256		case <-sub.Changed():
257		case <-time.After(time.Second):	257		case <-time.After(time.Second):
258		t.Fatal("the connection subscription must observe a registry publication")	258		t.Fatal("the connection subscription must observe a registry publication")
259		}	259		}
260		require.Equal(t, registry.Snapshot(), service.Snapshot())	260		require.Equal(t, registry.Snapshot(), service.Snapshot())
261	-	require.Len(t, service.Snapshot().Hosts, 1)	261	+	require.Len(t, service.Snapshot().Daemons, 1)
262		}	262		}
263			263
264		func TestServiceOperationLeaseLifetime(t *testing.T) {	264		func TestServiceOperationLeaseLifetime(t *testing.T) {

@@ -443,7 +443,7 @@ func TestServiceOfflineMembershipRefusal(t *testing.T) {
443		require.False(t, removed)	443		require.False(t, removed)
444		require.ErrorIs(t, err, ErrOfflineMembership)	444		require.ErrorIs(t, err, ErrOfflineMembership)
445			445
446	-	require.Empty(t, registry.Snapshot().Hosts, "a refused mutation must not touch authority")	446	+	require.Empty(t, registry.Snapshot().Daemons, "a refused mutation must not touch authority")
447		before := registry.Snapshot()	447		before := registry.Snapshot()
448		service.RequestReconcile("new@host:22")	448		service.RequestReconcile("new@host:22")
449		require.Equal(t, before, registry.Snapshot(), "reconcile must be a no-op")	449		require.Equal(t, before, registry.Snapshot(), "reconcile must be a no-op")

@@ -456,7 +456,7 @@ func TestRegistryObservationDisabledRestoresAndPublishes(t *testing.T) {
456		store.loaded = ports.BrokerSnapshot{	456		store.loaded = ports.BrokerSnapshot{
457		Epoch: 9,	457		Epoch: 9,
458		Revision: 4,	458		Revision: 4,
459	-	Hosts: []ports.RemoteHostSnapshot{{	459	+	Daemons: []ports.BrokerDaemonObservation{{
460		Endpoint: endpoint,	460		Endpoint: endpoint,
461		Registration: registration(t, endpoint, 1),	461		Registration: registration(t, endpoint, 1),
462		Availability: domain.RemoteAvailabilityReachable,	462		Availability: domain.RemoteAvailabilityReachable,

@@ -482,7 +482,7 @@ func TestRegistryObservationDisabledIssuesNoProbesOrTimers(t *testing.T) {
482		probe := newTestProbe(4)	482		probe := newTestProbe(4)
483		r, err := NewRegistryWithConfig(1, store, probe, clock, nil, RegistryConfig{ObservationDisabled: true})	483		r, err := NewRegistryWithConfig(1, store, probe, clock, nil, RegistryConfig{ObservationDisabled: true})
484		require.NoError(t, err)	484		require.NoError(t, err)
485	-	require.NoError(t, r.setHosts([]domain.RemoteRegistration{registration(t, "user@host:22", 1)}))	485	+	require.NoError(t, r.setHosts(hostRecords(registration(t, "user@host:22", 1))))
486			486
487		ctx, cancel := context.WithCancel(context.Background())	487		ctx, cancel := context.WithCancel(context.Background())
488		done := make(chan struct{})	488		done := make(chan struct{})