fix(gateway): identity survives restore, relay, callbacks and thread hops (#88715 phase 5)

[teknium1]

A multiplexed gateway now remembers which bot received each conversation across a restart, so a revived lane delivers through that bot (or fails closed) instead of falling back to the default bot by heuristic — and the relay echoes the routed profile so the connector can keep a routed chat's next interaction in the same profile.

Phase 5 of #88715 (stacked on PR-1 ad651b8250 / PR-2 c07708671d, both on main).

What changed

• SessionEntry.transport_profile (routing JSON) + nullable sessions.transport_profile (SCHEMA_SQL, added by the existing column-reconcile path — no version bump; agent:main keys and standalone gateways untouched: they write nothing). Stamped from the pinned RoutingIdentity at create, reset/switch, DB recovery and every peer refresh; compression forks inherit it with the other routing columns.
• session_identity.restore_identity() re-pins a RoutingIdentity(transport=None) from the persisted bot (the restored/synthetic row of PR-4's transport matrix). authz_mixin._restored_source(entry) is the one seam every revive path reads entry.origin through: auto-resume (run_startup), heartbeat restore, plugin injection (run_inbound), background-process events (run_notifications).
• _adapter_for_source / _adapter_profile_for_source honour a restored identity — the persisted bot's adapter or None, never the default bot. Entries written before the column exist (transport_profile absent) keep the old _is_shared_bot_satellite chain.
• Relay: _capture_scope remembers the routed profile per chat; _with_scope echoes metadata.profile on every chat-addressed frame and send_follow_up derives it from the agent:<profile>: key namespace. Single-profile gateways emit no key (frames byte-identical). Contract doc §4 documents the round-trip.
• Ambient reads: run.py::_session_key_for_source reads the identity first; the remaining get_active_profile_name() reads in gateway/ are boot-only and marked # launch profile, pre-identity (adapter boot, cron ticker homes, startup log, advertised model name). Callback capture (/model picker → profile_home at command time) and _run_in_executor_with_context already carry the scope; verified, not rewritten.
• Docs: gateway/AGENTS.md § Profile scope, multiplexing-gateway.md § Restore, relay, callbacks and thread hops, session-storage.md, relay-connector-contract.md §4.

Root cause

The routing index persisted the runtime profile (key namespace) but not the receiving bot, so after a restart the only way to pick an adapter was a heuristic on the runtime profile — wrong whenever the runtime profile is a satellite of a different bot than the one that received the lane.

Validation

Check	Result
tests/gateway/test_session_identity_restore.py (2 invariants: team_b-received lane routed to ops → after restart delivers via team_b, fails closed when team_b is offline, satellite lane keeps default egress, pre-column entry unchanged; standalone control: nothing persisted, agent:main byte-stable)	red on base (AttributeError: transport_profile), green on head
tests/gateway/relay/test_relay_passthrough.py::test_routed_profile_round_trips_on_every_egress_frame	red on base (metadata has no profile), green on head
A→B→A E2E (real GatewayRunner handlers _stamp_event_profile/_admit_primary_source, real SessionStore over two homes' state.db, fresh runner reload from gateway_routing, executor hop keeps HERMES_HOME scope)	team_b lane → TEAM_B; satellite → PRIMARY; team_b offline → None; legacy entry → heuristic unchanged
scripts/run_tests.sh tests/gateway tests/hermes_state tests/plugins/platforms	10974 passed / 6 failed → all 6 fixed or re-run green (3 bare-__new__ relay adapters: lazy _profile_by_chat; 1 test lambda signature; test_session_hygiene 2.4s>2.0s timing under 40 workers — passes alone) ; re-run of tests/hermes_state + session files: 1475 passed
check_profile_scope_patterns.py --base origin/main	2 advisory hits, both docstring mentions of agent:main
ruff, check-windows-footguns --all, check_compat_pointers, git diff --check	clean

Not covered (lane NOT_COVERED.md): connector-side stamping of the echoed profile (connector repo); backfill of transport_profile on pre-existing rows (PR-6 repair-profiles); live two-token Telegram rig.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 7b31433 — fix(gateway): a restored lane whose receiving bot is offline}

debug info

CI timings

CI timings · View report · View job

Wall time 19m17s vs 24m35s (-21.6%). 7 job(s) slower, 4 faster, 2 unchanged.

• Python lints / Windows footguns (blocking): +12.0s
• Python lints / ruff enforcement (blocking): +7.0s
• Python tests / e2e: -6.0s
• OS-specific tests / macOS-only tests: +5.0s
• OS-specific tests / Windows-only tests: +5.0s