Live-session port (2026-10-02→04): the packed courier codec (C19 closed — ALPN apns-pack-v1:4096:4096 negotiated live, packed chain anchors at the Apple Server Authentication CA intermediate, no TLS client cert on that path), the <Protocol>-span extraction for wrapped activation responses, the accepted Albert shapes (DeviceCertRequest as <data>(base64(PEM)), three-cert FairPlayCertChain), kebab-case sign-in response + client-id parsing, fresh anisette per SRP run and per 2FA call (the 434/-22421 fixes), the GSA postdata liveness client (fired AFTER the delegate sign-in, ptkn + hb-token binding), and the validation-stamp replay guard (one mint = one device record — the 409's true root cause); nullable next-hbi was already end-to-end

engine/src/main/kotlin/dev/fenn/imessage/engine/CourierConnection.kt

@@ -2,6 +2,7 @@ package dev.fenn.imessage.engine
 
 import dev.fenn.imessage.courier.CourierClient
 import dev.fenn.imessage.courier.CourierFrame
+import dev.fenn.imessage.courier.CourierPacked
 import java.io.Closeable
 import java.io.IOException
 import javax.net.ssl.KeyManager
@@ -77,11 +78,13 @@ class CourierConnection(
     private inner class ForwardingHandler(
         private val delegate: CourierClient.Handler,
     ) : CourierClient.Handler {
-        override fun onConnected() {
+        override fun onConnected(codec: CourierClient.Codec) {
             _state.value = State.CONNECTED
-            delegate.onConnected()
+            delegate.onConnected(codec)
         }
 
         override fun onFrame(frame: CourierFrame.Frame) = delegate.onFrame(frame)
+
+        override fun onPackedFrame(frame: CourierPacked.Frame) = delegate.onPackedFrame(frame)
     }
 }