Add federation worker and canonical handoffs

internal/federation/federation.go

@@ -42,6 +42,7 @@ func (r *Registry) init() {
 		r.cursors = map[string]uint64{}
 	}
 }
+
 // Register admits a worker. admitToken must match r.AdmitToken whenever one
 // is configured. Re-registering an ID that's already claimed requires that
 // worker's own current token, so a caller can't self-declare someone else's
@@ -118,6 +119,22 @@ func (r *Registry) Heartbeat(id string) error {
 	r.workers[id] = w
 	return nil
 }
+
+// Available refreshes TTL state and reports whether a registered worker owns
+// this harness id. Router admission uses it so a reachable TCP bridge alone
+// can never make an offline worker eligible for a lease.
+func (r *Registry) Available(id string) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.init()
+	w, ok := r.workers[id]
+	if !ok {
+		return false
+	}
+	w.Online = time.Since(w.LastSeen) <= r.TTL
+	r.workers[id] = w
+	return w.Online
+}
 func (r *Registry) Snapshot() []Worker {
 	r.mu.Lock()
 	defer r.mu.Unlock()