Remove obsolete Gateway connection records and per-Sandbox routes

agentplane/app/README.md

@@ -671,7 +671,7 @@ snapshot, and changing the Environment incarnation or account discards the prior
 
 - **Connection direction:** the Runner Gateway dials the runner's private mTLS gRPC server
   ([runner control](../docs/runner_control.md)); the runner pushes journals to Event ingress.
-  Callers use the per-Sandbox control Service across Pod replacements.
+  Callers use the stable Runner Gateway Service across Pod replacements.
 - **Model credentials:** staging uses a dedicated key for OpenAI/Claude subscription and local
   Ollama chat routes; testing uses the `cheap-experiments` LiteLLM key. The Pod holds no
   key: the sidecar strips caller Authorization on the exact-origin SVID route, the central proxy

agentplane/app/internal/bridge/bridge.go

@@ -1,5 +1,5 @@
 // Package bridge adapts the app's named Sandbox and thread contracts to the
-// Session Dispatcher and the per-Sandbox Runner Gateway.
+// Session Dispatcher and the Runner Gateway's Sandbox proxy.
 package bridge
 
 import (
@@ -186,7 +186,7 @@ func ParseSessionSpec(defaults *sessionpb.SessionSpec, fields map[string]any) (*
 	return merged, nil
 }
 
-// RunnerConfig configures per-call control Service connections.
+// RunnerConfig configures per-call connections to the Runner Gateway's Sandbox proxy.
 type RunnerConfig struct {
 	TLS            *peertls.ClientTLS
 	Namespace      string

agentplane/app/internal/bridge/runner.go

@@ -11,8 +11,8 @@ import (
 	"github.com/agentydragon/ducktape/agentplane/sandboxes/environmentruntimeclient"
 )
 
-// GatewayRunnerProxy invokes informational Runner RPCs through the named
-// Sandbox's control Service and supplies its current identity on every call.
+// GatewayRunnerProxy invokes informational Runner RPCs through the stable Runner Gateway Service
+// and supplies the named Sandbox's identity on every call.
 type GatewayRunnerProxy struct{ config RunnerConfig }
 
 // NewGatewayRunnerProxy validates the per-Sandbox runner transport settings.
@@ -21,7 +21,7 @@ func NewGatewayRunnerProxy(config RunnerConfig) (*GatewayRunnerProxy, error) {
 		return nil, errors.New("runner namespace, token file, and positive timeout are required")
 	}
 	if config.TargetTemplate == "" {
-		config.TargetTemplate = sandboxapi.ControlServiceTargetTemplate()
+		config.TargetTemplate = sandboxapi.RunnerGatewayTargetTemplate()
 	}
 	return &GatewayRunnerProxy{config: config}, nil
 }

agentplane/app/internal/settings/config_test.go

@@ -46,7 +46,7 @@ action_federation:
   scope: actions:operator
 sandbox_namespace: sandboxes
 runner_gateway_target: runner-gateway:9090
-runner_gateway_control_target: '{sandbox}-control.{namespace}.svc:8080'
+runner_gateway_control_target: 'runner-gateway.{namespace}.svc:8080'
 session_dispatcher_target: session-dispatcher:9090
 history_service_target: history:9090
 notifications_url: http://notifications:9090
@@ -81,7 +81,7 @@ func validTestConfig() Config {
 		SandboxNamespace:                    "sandboxes",
 		RunnerGatewayTarget:                 "runner-gateway:9090",
 		SessionDispatcherTarget:             "session-dispatcher:9090",
-		RunnerGatewayControlTarget:          "{sandbox}-control.{namespace}.svc:8080",
+		RunnerGatewayControlTarget:          "runner-gateway.{namespace}.svc:8080",
 		HistoryServiceTarget:                "history:9090",
 		PolicyServiceTarget:                 "policy-controller:8082",
 		PolicyServiceTokenFile:              "/var/run/policy/token",

agentplane/app/settings.py

@@ -123,9 +123,8 @@ class Settings(BaseModel):
     policy_service_token_file: Path = Path("/var/run/secrets/agentplane-policy/token")
     runner_gateway_control_target: str = Field(
         min_length=1,
-        description="Each Sandbox's control Service, a template of `{sandbox}` and `{namespace}` such as "
-        "`{sandbox}-control.{namespace}.svc:8080`. Lifecycle calls go there, to the replica holding the "
-        "runner connection.",
+        description="Stable Runner Gateway Service target, typically `runner-gateway.{namespace}.svc:8080`; "
+        "the Gateway routes each lifecycle call using the Sandbox identity.",
     )
     history_service_target: str = Field(min_length=1)
     notifications_url: HttpEndpointUrl = Field(

agentplane/central_sampler/README.md

@@ -107,10 +107,10 @@ sampler's durable intent journal; they do not deduplicate or cache server result
 retained native session during a Gateway outage, independently of the first-open and typed RPC
 timeouts. An outage longer than the exec-server's detached-session lifetime can return a definitive
 native loss response when Gateway recovers; the sampler then records a model notice before later work.
-Set `gateway_target` to `{sandbox}-control.{namespace}.svc:8080` for the per-Sandbox control Service:
-it selects the Gateway replica holding that Runner's observation Lease. A load-balanced Gateway
-Service is unsuitable when there are multiple replicas. Fixed targets support single-process
-fixtures. Templates accept DNS-label executor names and only these two placeholders. A fixed
+Set `gateway_target` to `runner-gateway.{namespace}.svc:8080` for the stable shared Runner Gateway Service.
+Each Gateway replica observes Runtimes independently, so the load-balanced Service works with
+multiple replicas. Fixed targets support single-process fixtures. Templates accept DNS-label
+executor names and only these two placeholders. A fixed
 `direct_executor_target` supports standalone fixtures without Gateway only when
 `direct_executor_insecure_localtest` is explicitly true and the target is a loopback IP address.
 Choose exactly one Gateway or direct execution target. Production execution uses Gateway bearer

agentplane/central_sampler/SPEC.md

@@ -614,9 +614,9 @@ above; this operator path remains for a blocked Session. See [blocked Session re
 The sampler uses one generated typed `Executor` client for direct local-test and Gateway targets.
 The `Executor` service contract terminates at the Sandbox's Runner, which reaches only its configured
 loopback adapter; Gateway proxies the same service after authorizing the sampler and checking the
-Sandbox UID and incarnation. The configured Gateway target selects the per-Sandbox control Service
-and thus the Gateway replica holding that Runner's observation Lease. No caller-chosen executor URL
-crosses the API. The Runner's adapter holds its local WebSocket on the server-streaming
+Sandbox UID and incarnation. The configured Gateway target is the stable `runner-gateway` Service;
+each replica routes to its local Runner connection using the Sandbox UID and incarnation. No
+caller-chosen executor URL crosses the API. The Runner's adapter holds its local WebSocket on the server-streaming
 `OpenSession` connection. An active stream blocks executor Sandbox autosuspend until it closes.
 Dispatcher does not relay tools.
 

agentplane/central_sampler/cmd/main_test.go

@@ -78,7 +78,7 @@ func validStartupDiagnosticSettings(t *testing.T) samplersettings.Settings {
 		"code_mode_host": "/usr/local/bin/codex-code-mode-host",
 		"executor_codex": "/usr/local/bin/codex",
 		"logs": "/tmp/sampler-logs",
-		"gateway_target": "sandbox-control.{namespace}.svc:8080",
+		"gateway_target": "runner-gateway.{namespace}.svc:8080",
 		"gateway_token_file": "/var/run/secrets/gateway/token",
 		"max_live_sessions": 1,
 		"rpc_timeout_seconds": 1,

agentplane/central_sampler/internal/settings/settings_test.go

@@ -658,10 +658,10 @@ func TestGatewayTemplateCannotInjectAddress(t *testing.T) {
 	s := fixtureSettings()
 	s.DirectExecutorTarget = ""
 	s.DirectExecutorInsecureLocaltest = false
-	s.GatewayTarget = "{sandbox}-control.{namespace}.svc.cluster.local:8080"
+	s.GatewayTarget = "runner-gateway.{namespace}.svc.cluster.local:8080"
 	s.GatewayTokenFile = "/fixture/token"
 	address, err := s.GatewayAddress("test", "executor")
-	if err != nil || address != "executor-control.test.svc.cluster.local:8080" {
+	if err != nil || address != "runner-gateway.test.svc.cluster.local:8080" {
 		t.Fatalf("address=%q err=%v", address, err)
 	}
 	for _, name := range []string{"bad.example", "UPPER", "", strings.Repeat("a", 64), "../other", "elsewhere:1234/"} {