[jayleaton]

Summary

The orchestrator's run.updated handler runs serially and also starts every thread's next queued run. It used to ask a connected app how a remote parent card settled. That call can take 60 s per hop, up to 16 hops, so a slow or missing relay stalled queued runs and completions on every thread.

 Orchestrator.handleRunUpdate (serial, all threads)
   finalizeDelegatedCompletionDelivery
   startNextQueuedRun
   settleCompletedSubRun
-    remote parent? -> await RemoteParentSettlement.manualSettledAt (relay, 60 s/hop)
+    remote parent? -> return

+RemoteParentSettlement.layer (reactor in runtimeLayer)
+  run.updated / turn-item.updated / provider-thread.updated
+    -> FiberMap per sub-run: broker.call("getThread") walk
+    -> dispatch thread.sub-run.settle { parentSettledAt }

Relay calls the server makes for itself now go through one typed client, McpGatewayBroker.call(method, args). The argument and answer schemas live in packages/contracts (McpGatewayRelayCalls), so an app that answers in another shape fails at the broker instead of in the caller. RemoteSettlementCascade, ThreadTaskTransport and remoteThreads now use those schemas instead of their own. The gateway tool catalog's pass-through is renamed forward and typed by keyof GatewayRuntimePort. remoteThreads now runs relay calls with its own services instead of calling Effect.runPromise inside an Effect.

Evidence

Scenario: a sub-run under a remote card ends while that card's app never answers. Then an unrelated thread finishes its active run with a follow-up queued behind it.

• Before (origin/main 5c5b58a, same scenario with a RemoteParentSettlement stub that never returns): × PROOF main: a relay that never answers holds up no other thread's run endings — Test timed out in 20000ms. The queued run never starts.
• After (this branch): ✓ a relay that never answers holds up no other thread's run endings. The queued run starts, and the stalled sub-run stays unsettled.

vp run check:changed: lint, knip, typecheck (30 packages) and tests (11 files, 143 tests) pass. Format was fixed after that run.

Merge Danger

Door: two-way. No migration, and the wire protocol is unchanged (still {method, args}), so older apps and servers interoperate.

Blast Radius: server

• Remote sub-run settle-follow now happens asynchronously, after the run ending is handled.
• Relay answers that don't match the contract now fail at the broker (the same schemas the callers used before).
• The gateway catalog's relayed calls now run under the calling fiber's services, Clock included.

Opus 5.5 · Claude Code (T3 Code)

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 5c5b58a · PR result: 266be2a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.