@zlink-systems/framework 0.10.0

package/dist/runtime/foundation/service-stateful-runtime.js

@@ -0,0 +1,3898 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceStatefulRuntime = exports.ServiceInstanceActivationRedirectError = void 0;
+exports.statefulMailboxData = statefulMailboxData;
+const node_async_hooks_1 = require("node:async_hooks");
+const abort_1 = require("../abort");
+const execution_1 = require("../execution");
+const framework_errors_internal_1 = require("../framework-errors-internal");
+const runtime_values_1 = require("../backend/runtime-values");
+const service_runtime_contracts_1 = require("./service-runtime-contracts");
+const message_follow_suppression_registry_1 = require("./message-follow-suppression-registry");
+const service_stateful_registry_1 = require("./service-stateful-registry");
+const service_stateful_wire_codec_1 = require("./service-stateful-wire-codec");
+const routing_id_1 = require("../routing-id");
+const service_wire_pilot_codec_generated_1 = require("../protocol/service_wire_pilot_codec.generated");
+const actor_join_recovery_codec_1 = require("./actor-join-recovery-codec");
+const service_wire_m6a_codec_1 = require("./service-wire-m6a-codec");
+const service_metadata_codec_1 = require("./service-metadata-codec");
+const contracts_1 = require("../../contracts");
+const ACTOR_ROUTE_STALE = 21;
+const SPOT_MOVING = 34;
+const USER_SPOT_OPERATION_CAPACITY = 65_536;
+const USER_SPOT_OPERATION_REPLAY_RETENTION_MS = 5 * 60_000;
+const ACTOR_ROUTE_NOT_FOUND = 1;
+class ServiceInstanceActivationRedirectError extends Error {
+    route;
+    constructor(route) {
+        super(`Instance Spot '${route.targetSpotId}' is owned by '${route.targetNodeRid}'.`);
+        this.route = route;
+        this.name = 'ServiceInstanceActivationRedirectError';
+    }
+}
+exports.ServiceInstanceActivationRedirectError = ServiceInstanceActivationRedirectError;
+/**
+ * Owns M6B routing, identity fences and terminal operations. Application turns
+ * remain in the common mailbox, where a claimed Spot or Actor owner is serial.
+ */
+class ServiceStatefulRuntime {
+    raw;
+    nodeRid;
+    nodeGeneration;
+    //  Captured at module load, before any application turn exists: running a
+    //  callback through this snapshot detaches every AsyncLocalStorage context
+    //  (Spot serial turn, execution area, flow) so local loopback ingress
+    //  behaves exactly like a frame arriving from the receive pump.
+    static detachedIngressScope = node_async_hooks_1.AsyncLocalStorage.snapshot();
+    registry;
+    operations = new service_stateful_registry_1.ServiceTerminalOperationRegistry();
+    sessionDeliveries = new Map();
+    /**
+     * A local Actor owner can replace its own session binding before the
+     * replacement notice is looped back through ingress. Retain that exact old
+     * delivery until the old session performs its normal close cleanup.
+     */
+    retiredSessionDeliveries = new Map();
+    appliedReplacementNotices = new Set();
+    subscriptions = new Map();
+    instanceIntents = new Map();
+    admittedInstanceOperations = new Map();
+    pendingInstanceTerminals = new Map();
+    pendingInstanceAuthorityTerminals = new Map();
+    instanceApplicationWaiters = new Map();
+    canonicalActorJoinHandoffs = new Map();
+    actorRoutes = new Map();
+    // Direct application messages use the logical Spot ID. Actor joins and
+    // lifecycle controls use the exact Spot object generation. Keep both views
+    // so changing one routing contract cannot hide the other route fence.
+    spotRoutes = new Map();
+    directSpotRoutes = new Map();
+    spotMessageFollow = new Map();
+    spotMessageFollowSuppression = new message_follow_suppression_registry_1.MessageFollowSuppressionRegistry();
+    nextMessageFollowSerial = 1n;
+    nextMessageFollowOperation = 1n;
+    nextSpotId = 1n;
+    nextSessionSequence = 1n;
+    nextInstanceOperation = 1n;
+    nextUserSpotOperation = 1n;
+    instanceAuthority;
+    asyncInstanceAuthority;
+    instanceApplicationLifecycle;
+    userSpotOperationHandler;
+    messageFollowHandler;
+    mailboxDropHandler;
+    admittedUserSpotOperations = new Map();
+    pendingInstanceActivations = new Map();
+    closed = false;
+    constructor(raw, nodeRid, nodeGeneration) {
+        this.raw = raw;
+        this.nodeRid = nodeRid;
+        this.nodeGeneration = nodeGeneration;
+        this.registry = new service_stateful_registry_1.ServiceStatefulRegistry(nodeRid, nodeGeneration);
+        this.registry.createEntrySpot(nodeRid);
+        raw.setServiceIngress(record => this.ingress(record));
+    }
+    setMailboxDropHandler(handler) {
+        this.mailboxDropHandler = handler;
+    }
+    createSpot(routingId, kind = 'user', stableType = kind) {
+        this.requireOpen();
+        return this.registry.createSpot(routingId ?? `spot-${this.nodeRid}-${this.nextSpotId++}`, kind, stableType);
+    }
+    restoreUserSpotAuthority(spotId, stableType, generation, authorityOwnerGeneration) {
+        this.requireOpen();
+        return this.registry.restoreSpot({ spotId, generation }, 'user', stableType, authorityOwnerGeneration);
+    }
+    restoreSpotAuthority(spotId, objectKind, stableType, generation, authorityOwnerGeneration) {
+        this.requireOpen();
+        return this.registry.restoreSpot({ spotId, generation }, objectKind === 'user_spot' ? 'user' : 'instance', stableType, authorityOwnerGeneration);
+    }
+    entrySpot() {
+        return this.registry.createEntrySpot(this.nodeRid);
+    }
+    createActor(actorId, stableType = 'actor') {
+        this.requireOpen();
+        return this.registry.createActor(actorId, stableType);
+    }
+    restoreActorAuthority(actorId, stableType, generation, authorityOwnerGeneration, spotId, spotGeneration, membershipEpoch) {
+        this.requireOpen();
+        return this.registry.restoreActor({ nodeRid: this.nodeRid, actorId, generation }, stableType, { spotId, generation: spotGeneration }, membershipEpoch, authorityOwnerGeneration);
+    }
+    discardRelocatedActor(actor) {
+        this.requireOpen();
+        this.registry.destroyActor(actor);
+    }
+    restoreActorSessionBinding(actorRef, sessionNodeRid, sessionRid, bindingGeneration) {
+        this.requireOpen();
+        const actor = this.registry.actor(actorRef.actorId);
+        if (actor === undefined
+            || actor.ref.generation !== actorRef.generation
+            || actor.ref.nodeRid !== actorRef.nodeRid) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('actor', actorRef.actorId);
+        }
+        const current = this.registry.binding(actor.ref);
+        if (current?.bindingGeneration === bindingGeneration
+            && current.sessionOwnerNodeRid === sessionNodeRid
+            && current.sessionRid === sessionRid) {
+            return;
+        }
+        this.registry.installSessionBinding({
+            actor: actor.ref,
+            sessionRid,
+            sessionOwnerNodeRid: sessionNodeRid,
+            bindingGeneration,
+            membershipEpoch: actor.membershipEpoch
+        });
+    }
+    activateInstanceSpot(spotId, instanceType, attempt, authorityOwnerGeneration = attempt) {
+        this.requireOpen();
+        const current = this.registry.spot(spotId);
+        if (current !== undefined) {
+            if (current.kind !== 'instance' || current.stableType !== instanceType) {
+                throw new TypeError(`Instance Spot '${spotId}' is assigned to another type.`);
+            }
+            if (current.ref.generation > attempt) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', spotId);
+            }
+            if (current.ref.generation === attempt) {
+                return {
+                    spot: current.authorityOwnerGeneration === authorityOwnerGeneration
+                        ? current
+                        : this.registry.restoreSpot(current.ref, 'instance', instanceType, authorityOwnerGeneration),
+                    created: false
+                };
+            }
+            if (!this.registry.closeSpot(current.ref)) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', spotId);
+            }
+        }
+        return {
+            spot: this.registry.restoreSpot({ spotId, generation: attempt }, 'instance', instanceType, authorityOwnerGeneration),
+            created: true
+        };
+    }
+    registerInstanceIntent(instanceType, route, expectedCurrentRoute) {
+        if (route.targetNodeRid !== this.nodeRid || route.targetNodeGeneration !== this.nodeGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', route.targetSpotId);
+        }
+        const current = this.instanceIntents.get(route.targetSpotId);
+        if (current !== undefined) {
+            if (current.instanceType === instanceType && sameInstanceRoute(current.route, route)) {
+                return;
+            }
+            if (!matchesExpectedInstanceRoute(current.route, expectedCurrentRoute))
+                return;
+            if (current.route.objectGeneration < route.objectGeneration) {
+                this.instanceIntents.set(route.targetSpotId, Object.freeze({ instanceType, route: { ...route } }));
+                return;
+            }
+            if (current.route.objectGeneration > route.objectGeneration) {
+                return;
+            }
+            if (current.route.authorityOwnerGeneration > route.authorityOwnerGeneration) {
+                return;
+            }
+            if (current.route.authorityOwnerGeneration === route.authorityOwnerGeneration) {
+                if (!sameInstanceOwnerIdentity(current.route, route)) {
+                    throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', route.targetSpotId);
+                }
+                if (current.route.storeVersion === route.storeVersion) {
+                    throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', route.targetSpotId);
+                }
+            }
+        }
+        else if (!matchesExpectedInstanceRoute(undefined, expectedCurrentRoute)) {
+            return;
+        }
+        this.instanceIntents.set(route.targetSpotId, Object.freeze({ instanceType, route: { ...route } }));
+    }
+    instanceSpotApplicationTarget(spotId) {
+        const intent = this.instanceIntents.get(spotId);
+        const spot = this.registry.spot(spotId);
+        if (intent === undefined
+            || spot?.kind !== 'instance'
+            || spot.state !== 'ready'
+            || spot.ref.generation !== intent.route.objectGeneration) {
+            return undefined;
+        }
+        return {
+            stableType: intent.instanceType,
+            objectGeneration: intent.route.objectGeneration
+        };
+    }
+    forgetInstanceIntent(spotId, objectGeneration, authorityOwnerGeneration, storeVersion) {
+        const current = this.instanceIntents.get(spotId);
+        if (current?.route.objectGeneration === objectGeneration
+            && current.route.authorityOwnerGeneration === authorityOwnerGeneration
+            && (storeVersion === undefined || current.route.storeVersion === storeVersion)) {
+            this.instanceIntents.delete(spotId);
+        }
+    }
+    registerInstanceActivationAuthority(authority) {
+        this.requireOpen();
+        if (this.asyncInstanceAuthority !== undefined
+            || this.instanceAuthority !== undefined && this.instanceAuthority !== authority) {
+            throw new Error('Instance activation authority is already registered.');
+        }
+        this.instanceAuthority = authority;
+    }
+    registerAsyncInstanceActivationAuthority(authority) {
+        this.requireOpen();
+        if (this.instanceAuthority !== undefined
+            || this.asyncInstanceAuthority !== undefined
+                && this.asyncInstanceAuthority !== authority) {
+            throw new Error('Instance activation authority is already registered.');
+        }
+        this.asyncInstanceAuthority = authority;
+    }
+    registerInstanceApplicationLifecycle(lifecycle) {
+        if (this.instanceApplicationLifecycle !== undefined) {
+            throw new Error('Instance application lifecycle is already registered.');
+        }
+        this.instanceApplicationLifecycle = lifecycle;
+    }
+    registerUserSpotOperationHandler(handler) {
+        this.requireOpen();
+        if (this.userSpotOperationHandler !== undefined
+            && this.userSpotOperationHandler !== handler) {
+            throw new Error('User Spot operation handler is already registered.');
+        }
+        this.userSpotOperationHandler = handler;
+    }
+    requestUserSpotCreate(targetNodeRid, request, timeoutMs) {
+        const correlation = this.nextUserSpotOperation++;
+        const operation = {
+            high: this.nodeGeneration,
+            low: correlation
+        };
+        return this.requestUserSpotOperation(targetNodeRid, (0, service_stateful_wire_codec_1.encodeUserSpotCreateHeader)({
+            ...request,
+            sourceNodeRid: this.nodeRid,
+            sourceNodeGeneration: this.nodeGeneration,
+            correlation,
+            operation
+        }), correlation, 'userSpotCreate', timeoutMs);
+    }
+    requestUserSpotClose(targetNodeRid, request, timeoutMs) {
+        const correlation = this.nextUserSpotOperation++;
+        const operation = {
+            high: this.nodeGeneration,
+            low: correlation
+        };
+        return this.requestUserSpotOperation(targetNodeRid, (0, service_stateful_wire_codec_1.encodeUserSpotCloseHeader)({
+            ...request,
+            sourceNodeRid: this.nodeRid,
+            sourceNodeGeneration: this.nodeGeneration,
+            correlation,
+            operation
+        }), correlation, 'userSpotClose', timeoutMs);
+    }
+    requestActorCreate(targetNodeRid, request, timeoutMs) {
+        const correlation = this.nextUserSpotOperation++;
+        const operation = {
+            high: this.nodeGeneration,
+            low: correlation
+        };
+        return this.requestUserSpotOperation(targetNodeRid, (0, service_stateful_wire_codec_1.encodeActorCreateHeader)({
+            ...request,
+            sourceNodeRid: this.nodeRid,
+            sourceNodeGeneration: this.nodeGeneration,
+            correlation,
+            operation
+        }), correlation, 'actorCreate', timeoutMs);
+    }
+    async recoverInstanceActivation(envelope, route, expectedCurrentRoute) {
+        const target = envelope.target;
+        if (!matchesExpectedInstanceRoute(this.instanceIntents.get(target.targetSpotId)?.route, expectedCurrentRoute))
+            return false;
+        if (target.targetNodeRid !== this.nodeRid
+            || target.targetNodeGeneration !== this.nodeGeneration
+            || target.targetSpotId !== route.targetSpotId
+            || route.targetNodeRid !== this.nodeRid
+            || route.targetNodeGeneration !== this.nodeGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        const authority = this.asyncInstanceAuthority;
+        if (authority === undefined) {
+            throw new Error('Async Instance activation authority is not registered.');
+        }
+        await this.instanceApplicationLifecycle?.materialize(target, route.objectGeneration);
+        return this.finishRecoveredInstanceActivation(envelope, route, expectedCurrentRoute);
+    }
+    async finishRecoveredInstanceActivation(envelope, route, expectedCurrentRoute) {
+        const target = envelope.target;
+        const spot = this.registry.spot(target.targetSpotId)
+            ?? this.registry.restoreSpot({
+                spotId: target.targetSpotId,
+                generation: route.objectGeneration
+            }, 'instance', target.stableType, route.authorityOwnerGeneration);
+        if (spot.kind !== 'instance'
+            || spot.stableType !== target.stableType
+            || spot.ref.generation !== route.objectGeneration
+            || spot.authorityOwnerGeneration !== route.authorityOwnerGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        if (!matchesExpectedInstanceRoute(this.instanceIntents.get(target.targetSpotId)?.route, expectedCurrentRoute))
+            return false;
+        this.publishCommittedInstanceRoute(target.stableType, route, expectedCurrentRoute);
+        const record = {
+            kind: 'instanceSpot',
+            activation: 'missing',
+            target,
+            sourceNodeGeneration: envelope.sourceNodeGeneration,
+            sourceNodeRid: envelope.sourceNodeRid,
+            ...(envelope.sourceSpotId === undefined
+                ? {}
+                : { sourceSpotId: envelope.sourceSpotId }),
+            operationKind: envelope.operationKind,
+            operation: envelope.operation,
+            deadlineUnixMs: envelope.deadlineUnixMs,
+            ...(envelope.replyRouteId === undefined ? {} : { replyRouteId: envelope.replyRouteId })
+        };
+        const applicationJobOwner = await this.raw.reserveLocalIngress();
+        try {
+            const admitted = this.enqueueActivatedInstanceSpot({
+                command: service_stateful_wire_codec_1.M6bServiceWireCommand.instanceSpot,
+                flags: envelope.metadataFrame === undefined ? 0 : service_stateful_wire_codec_1.M6bServiceWireFlag.metadata,
+                sourceRoutingId: envelope.sourceNodeRid,
+                parts: [
+                    (0, service_stateful_wire_codec_1.encodeInstanceSpotActivationHeader)(target, envelope.sourceNodeGeneration, envelope.sourceNodeRid, envelope.sourceSpotId, envelope.operationKind, envelope.operation, envelope.deadlineUnixMs, envelope.replyRouteId, envelope.metadataFrame !== undefined)
+                ],
+                applicationJobOwner
+            }, record, Buffer.from(envelope.applicationPayloadFrame), spot, undefined, this.activationTerminalCompletion(target, route), envelope.metadataFrame === undefined
+                ? undefined
+                : (0, service_metadata_codec_1.validateServiceMetadataFrame)(envelope.metadataFrame), true, this.instanceApplicationTarget(record, route.objectGeneration));
+            if (admitted !== 'application') {
+                throw new Error('Recovered Instance activation was not admitted to the local queue.');
+            }
+            return true;
+        }
+        finally {
+            applicationJobOwner.close();
+        }
+    }
+    async recoverPendingInstanceActivation(envelope, pending, expectedCurrentRoute) {
+        const target = envelope.target;
+        if (!matchesExpectedInstanceRoute(this.instanceIntents.get(target.targetSpotId)?.route, expectedCurrentRoute))
+            return false;
+        if (target.targetNodeRid !== this.nodeRid
+            || target.targetNodeGeneration !== this.nodeGeneration
+            || pending.nodeRid !== this.nodeRid
+            || pending.nodeGeneration !== this.nodeGeneration
+            || pending.meshName !== envelope.targetMeshName) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        const authority = this.asyncInstanceAuthority;
+        if (authority === undefined) {
+            throw new Error('Async Instance activation authority is not registered.');
+        }
+        const reservation = await authority.resume(target, pending);
+        await this.instanceApplicationLifecycle?.materialize(target, pending.objectGeneration);
+        const spot = this.registry.restoreSpot({
+            spotId: target.targetSpotId,
+            generation: pending.objectGeneration
+        }, 'instance', target.stableType, pending.authorityOwnerGeneration);
+        const committed = await authority.commit(target, reservation, spot);
+        if (committed.kind !== 'committed') {
+            this.registry.closeSpot(spot.ref);
+            throw new ServiceInstanceActivationRedirectError(committed.route);
+        }
+        return this.finishRecoveredInstanceActivation(envelope, committed.route, expectedCurrentRoute);
+    }
+    async completeRecoveredInstanceActivation(target, route, expectedCurrentRoute) {
+        if (!matchesExpectedInstanceRoute(this.instanceIntents.get(target.targetSpotId)?.route, expectedCurrentRoute))
+            return undefined;
+        const authority = this.asyncInstanceAuthority;
+        if (authority === undefined) {
+            throw new Error('Async Instance activation authority is not registered.');
+        }
+        const released = await authority.complete(target, route);
+        const currentRoute = this.instanceIntents.get(target.targetSpotId)?.route;
+        if (!matchesExpectedInstanceRoute(currentRoute, expectedCurrentRoute))
+            return undefined;
+        if (currentRoute !== undefined && !sameInstanceRoute(currentRoute, route))
+            return undefined;
+        const authorityReleased = await this.instanceApplicationLifecycle?.completeTerminal({
+            targetSpotId: target.targetSpotId,
+            stableType: target.stableType,
+            objectGeneration: route.objectGeneration
+        })
+            ?? false;
+        if (!authorityReleased) {
+            if (currentRoute === undefined) {
+                this.publishCommittedInstanceRoute(target.stableType, released, null);
+            }
+            else if (!this.replaceCommittedInstanceRoute(target.stableType, route, released)) {
+                return undefined;
+            }
+        }
+        else {
+            this.forgetClosedInstanceRoute(released);
+        }
+        return released;
+    }
+    waitForInstanceApplicationQuiescence(spotId, signal) {
+        const key = String(spotId);
+        if ((this.pendingInstanceTerminals.get(key) ?? 0) === 0
+            && (this.pendingInstanceAuthorityTerminals.get(key) ?? 0) === 0) {
+            return Promise.resolve();
+        }
+        if (signal?.aborted === true) {
+            return Promise.reject(signal.reason);
+        }
+        return new Promise((resolve, reject) => {
+            const waiters = this.instanceApplicationWaiters.get(key) ?? new Set();
+            this.instanceApplicationWaiters.set(key, waiters);
+            const complete = () => {
+                signal?.removeEventListener('abort', abort);
+                resolve();
+            };
+            const abort = () => {
+                waiters.delete(complete);
+                if (waiters.size === 0)
+                    this.instanceApplicationWaiters.delete(key);
+                reject(signal?.reason);
+            };
+            waiters.add(complete);
+            signal?.addEventListener('abort', abort, { once: true });
+        });
+    }
+    rememberActorRoute(route) {
+        if (route.actor.nodeRid.length === 0) {
+            throw new TypeError('Actor route requires a target node.');
+        }
+        this.actorRoutes.set(actorKey(route.actor), Object.freeze({
+            actor: Object.freeze({ ...route.actor }),
+            targetNodeGeneration: route.targetNodeGeneration,
+            authorityOwnerGeneration: route.authorityOwnerGeneration,
+            ownerLeaseGeneration: route.ownerLeaseGeneration
+        }));
+    }
+    rememberSpotRoute(route, expectedCurrentRoute) {
+        // Direct application messages address the logical Spot ID. Keep one
+        // current owner route per ID so a same-owner reactivation can replace the
+        // old object generation without making the next application message
+        // stale. Message Follow and lifecycle controls keep using spotKey().
+        const key = directSpotKey(route.spot.spotId);
+        const current = this.directSpotRoutes.get(key);
+        if (current !== undefined && sameDirectSpotRoute(current, route)) {
+            this.spotRoutes.set(spotKey(route.spot), current);
+            return;
+        }
+        if (expectedCurrentRoute !== undefined
+            && !matchesExpectedDirectSpotRoute(current, expectedCurrentRoute))
+            return;
+        if (current !== undefined) {
+            if (current.spot.generation < route.spot.generation) {
+                const next = freezeDirectSpotRoute(route);
+                this.directSpotRoutes.set(key, next);
+                this.spotRoutes.set(spotKey(route.spot), next);
+                return;
+            }
+            if (current.spot.generation > route.spot.generation) {
+                return;
+            }
+            if (current.authorityOwnerGeneration > route.authorityOwnerGeneration) {
+                return;
+            }
+            if (current.authorityOwnerGeneration === route.authorityOwnerGeneration) {
+                // StoreVersion is the mutable CAS fence for the same object and
+                // owner. A Preserve or membership update can advance it without
+                // changing the route identity. Keep the exact fence used by the
+                // latest authority projection instead of treating that update as a
+                // new object generation.
+                if (sameDirectSpotOwnerIdentity(current, route)) {
+                    const next = freezeDirectSpotRoute(route);
+                    this.directSpotRoutes.set(key, next);
+                    this.spotRoutes.set(spotKey(route.spot), next);
+                    return;
+                }
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', route.spot.spotId);
+            }
+        }
+        const next = freezeDirectSpotRoute(route);
+        this.directSpotRoutes.set(key, next);
+        this.spotRoutes.set(spotKey(route.spot), next);
+    }
+    async sendMessageFollowNotification(targetNodeRid, record) {
+        this.requireOpen();
+        return await this.raw.sendService(targetNodeRid, [(0, service_stateful_wire_codec_1.encodeMessageFollowHeader)(record)]);
+    }
+    setMessageFollowHandler(handler) {
+        this.messageFollowHandler = handler;
+    }
+    sealSpotMessageFollowIngress(source) {
+        this.requireOpen();
+        if (source.targetNodeRid !== this.nodeRid
+            || source.targetNodeGeneration !== this.nodeGeneration) {
+            return undefined;
+        }
+        const key = spotKey(source.spot);
+        if (this.spotMessageFollow.has(key))
+            return undefined;
+        const sourceSpot = this.registry.requireSpot(source.spot);
+        const seal = Object.freeze({ key, serial: this.nextMessageFollowSerial++ });
+        this.spotMessageFollow.set(key, {
+            seal,
+            objectKind: sourceSpot.kind === 'user' ? 'userSpot' : 'instanceSpot',
+            source: freezeDirectSpotRoute(source),
+            queued: [],
+            queuedHead: 0,
+            queuedCount: 0,
+            queuedBytes: 0,
+            draining: false
+        });
+        return seal;
+    }
+    abortSpotMessageFollowIngress(seal) {
+        const state = this.exactSpotMessageFollow(seal);
+        if (state === undefined || state.target !== undefined)
+            return false;
+        this.removeSpotMessageFollow(state);
+        try {
+            while (state.queuedCount > 0) {
+                const record = this.peekSpotMessageFollow(state);
+                const result = this.restoreSpotMessageFollowRecord(record);
+                if (result !== 'application') {
+                    throw new Error('Aborted Spot ingress could not be restored to its source queue.');
+                }
+                this.takeSpotMessageFollow(state);
+            }
+            return true;
+        }
+        catch (error) {
+            while (state.queuedCount > 0)
+                this.takeSpotMessageFollow(state);
+            throw error;
+        }
+    }
+    async commitSpotMessageFollowIngress(seal, target, durationMs) {
+        const state = this.exactSpotMessageFollow(seal);
+        if (state === undefined || state.target !== undefined)
+            return false;
+        if (!Number.isSafeInteger(durationMs) || durationMs < 0) {
+            throw new RangeError('Message Follow duration must be a non-negative safe integer.');
+        }
+        if (target.spot.spotId !== state.source.spot.spotId
+            || target.spot.generation !== state.source.spot.generation
+            || target.authorityOwnerGeneration <= state.source.authorityOwnerGeneration
+            || target.targetNodeRid === this.nodeRid) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', state.source.spot.spotId);
+        }
+        state.target = freezeDirectSpotRoute(target);
+        state.suppressionFence = spotMessageFollowSuppressionFence(state.objectKind, state.source, state.target);
+        this.spotMessageFollowSuppression.retainRoute(state.suppressionFence);
+        state.expiresAtMs = durationMs === 0
+            ? Number.MAX_SAFE_INTEGER
+            : performance.now() + durationMs;
+        await this.drainSpotMessageFollow(state);
+        if (durationMs === 0)
+            this.removeSpotMessageFollow(state);
+        return true;
+    }
+    forgetSpotRoute(spot, authorityOwnerGeneration, storeVersion) {
+        const exactKey = spotKey(spot);
+        const exact = this.spotRoutes.get(exactKey);
+        const current = this.directSpotRoutes.get(directSpotKey(spot.spotId));
+        if (exact?.authorityOwnerGeneration === authorityOwnerGeneration
+            && (storeVersion === undefined || exact.storeVersion === storeVersion)) {
+            this.spotRoutes.delete(exactKey);
+        }
+        const key = directSpotKey(spot.spotId);
+        if (current?.authorityOwnerGeneration === authorityOwnerGeneration
+            && current.spot.generation === spot.generation
+            && (storeVersion === undefined || current.storeVersion === storeVersion)) {
+            this.directSpotRoutes.delete(key);
+        }
+    }
+    actor(actorId) {
+        return this.registry.actor(actorId);
+    }
+    setSubscription(spot, channelName, topicFilter) {
+        this.registry.requireSpot(spot.ref);
+        if (spot.kind === 'instance') {
+            throw new Error('Instance Spots do not support logical multicast subscriptions.');
+        }
+        const key = subscriptionKey(channelName, topicFilter);
+        const subscriptions = this.subscriptions.get(spot.ref.spotId) ?? new Set();
+        subscriptions.add(key);
+        this.subscriptions.set(spot.ref.spotId, subscriptions);
+    }
+    unsetSubscription(spot, channelName, topicFilter) {
+        const subscriptions = this.subscriptions.get(spot.ref.spotId);
+        if (subscriptions === undefined)
+            return;
+        subscriptions.delete(subscriptionKey(channelName, topicFilter));
+        if (subscriptions.size === 0)
+            this.subscriptions.delete(spot.ref.spotId);
+    }
+    clearSubscriptions(spotId) {
+        this.subscriptions.delete(spotId);
+    }
+    async publishLogicalMulticast(channelName, topic, payload, sourceSpotId = this.nodeRid) {
+        await this.enqueueLogicalMulticast(channelName, topic, sourceSpotId, payload);
+        const targets = this.raw.topology.peers()
+            .filter(peer => peer.descriptor.channels.some(channel => channel.name === channelName && channel.weight > 0));
+        const header = (0, service_stateful_wire_codec_1.encodeLogicalMulticastHeader)(channelName, topic, sourceSpotId);
+        const payloadFrame = (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload);
+        for (const target of targets) {
+            // Remote admission ends at the source outbound transport queue. The
+            // receiver's Spot queue and handler completion are not publish results.
+            await this.raw.sendService(target.descriptor.nodeRoutingId, [header, payloadFrame]);
+        }
+    }
+    async sendToSpot(sourceSpotId, requested, payload) {
+        const target = this.acceptSpotAuthority(requested);
+        if (target === undefined) {
+            return runtime_values_1.SubmitResult.NotFound;
+        }
+        const header = (0, service_stateful_wire_codec_1.encodeSpotHeader)('spotSend', sourceSpotId, target);
+        return this.submitOneWay(target.targetNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)]);
+    }
+    requestToSpot(sourceSpotId, requested, payload, timeoutMs) {
+        const pending = this.operations.reserve(timeoutMs);
+        const target = this.acceptSpotAuthority(requested);
+        if (target === undefined) {
+            this.operations.reply(pending.id, {
+                terminalResult: runtime_values_1.RequestResult.NotFound,
+                failureCode: ACTOR_ROUTE_STALE
+            });
+            return pending;
+        }
+        const header = (0, service_stateful_wire_codec_1.encodeSpotHeader)('spotRequest', sourceSpotId, target, pending.id);
+        this.submitRequest(pending, target.targetNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'spotRequest');
+        return pending;
+    }
+    async sendToActor(target, _targetNodeGeneration, _authorityOwnerGeneration, payload, sourceActor, boundSession) {
+        const route = this.tryActorFence(target);
+        if (route === undefined)
+            return runtime_values_1.SubmitResult.NotFound;
+        const header = (0, service_stateful_wire_codec_1.encodeActorHeader)('actorSend', route, undefined, sourceActor, boundSession === undefined
+            ? undefined
+            : {
+                ...boundSession,
+                sequence: this.nextSessionSequence++
+            });
+        return this.submitOneWay(target.nodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)]);
+    }
+    requestToActor(target, _targetNodeGeneration, _authorityOwnerGeneration, payload, timeoutMs, sourceActor, boundSession) {
+        const pending = this.operations.reserve(timeoutMs);
+        const route = this.tryActorFence(target);
+        if (route === undefined) {
+            this.operations.reply(pending.id, {
+                terminalResult: runtime_values_1.RequestResult.NotFound,
+                failureCode: ACTOR_ROUTE_STALE
+            });
+            return pending;
+        }
+        const header = (0, service_stateful_wire_codec_1.encodeActorHeader)('actorRequest', route, pending.id, sourceActor, boundSession === undefined
+            ? undefined
+            : {
+                ...boundSession,
+                sequence: this.nextSessionSequence++
+            });
+        this.submitRequest(pending, target.nodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'actorRequest');
+        return pending;
+    }
+    async sendToInstanceSpot(route, payload, sourceSpotId, metadataFrame) {
+        return this.submitOneWay(route.targetNodeRid, instanceOperationParts([
+            (0, service_stateful_wire_codec_1.encodeInstanceSpotHeader)(route, this.nodeGeneration, this.nodeRid, sourceSpotId, 'send', { high: 0n, low: 0n }, undefined, metadataFrame !== undefined),
+            (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)
+        ], metadataFrame));
+    }
+    async sendToMissingInstanceSpot(target, payload, deadlineUnixMs, sourceSpotId, metadataFrame) {
+        return await this.sendToMissingInstanceSpotFrame(target, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload), deadlineUnixMs, sourceSpotId, metadataFrame);
+    }
+    async sendToMissingInstanceSpotFrame(target, payloadFrame, deadlineUnixMs, sourceSpotId, metadataFrame) {
+        const operation = { high: this.nodeGeneration, low: this.nextInstanceOperation++ };
+        return await this.submitOneWay(target.targetNodeRid, instanceOperationParts([
+            (0, service_stateful_wire_codec_1.encodeInstanceSpotActivationHeader)(target, this.nodeGeneration, this.nodeRid, sourceSpotId, 'send', operation, deadlineUnixMs, undefined, metadataFrame !== undefined),
+            payloadFrame
+        ], metadataFrame));
+    }
+    requestToInstanceSpot(route, payload, timeoutMs, sourceSpotId, metadataFrame) {
+        const pending = this.operations.reserve(timeoutMs);
+        this.submitRequest(pending, route.targetNodeRid, instanceOperationParts([
+            (0, service_stateful_wire_codec_1.encodeInstanceSpotHeader)(route, this.nodeGeneration, this.nodeRid, sourceSpotId, 'request', { high: 2n, low: pending.id }, pending.id, metadataFrame !== undefined),
+            (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)
+        ], metadataFrame), timeoutMs, 'instanceSpotRequest');
+        return pending;
+    }
+    requestToMissingInstanceSpot(target, payload, timeoutMs, sourceSpotId, metadataFrame) {
+        const deadlineUnixMs = BigInt(Date.now() + timeoutMs);
+        const payloadFrame = (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload);
+        return this.requestToMissingInstanceSpotFrame(target, payloadFrame, deadlineUnixMs, sourceSpotId, metadataFrame);
+    }
+    requestToMissingInstanceSpotFrame(target, payloadFrame, deadlineUnixMs, sourceSpotId, metadataFrame) {
+        const timeoutMs = remainingDeadlineMs(deadlineUnixMs);
+        const pending = this.operations.reserve(timeoutMs);
+        this.submitRequest(pending, target.targetNodeRid, instanceOperationParts([
+            (0, service_stateful_wire_codec_1.encodeInstanceSpotActivationHeader)(target, this.nodeGeneration, this.nodeRid, sourceSpotId, 'request', { high: this.nodeGeneration, low: pending.id }, deadlineUnixMs, pending.id, metadataFrame !== undefined),
+            payloadFrame
+        ], metadataFrame), timeoutMs, 'instanceSpotRequest');
+        return pending;
+    }
+    lookupRemoteActor(targetNodeRid, actorId, timeoutMs) {
+        const pending = this.operations.reserve(timeoutMs);
+        this.submitRequest(pending, targetNodeRid, [(0, service_stateful_wire_codec_1.encodeActorLookupHeader)(pending.id, actorId)], timeoutMs, 'actorLookup');
+        return pending;
+    }
+    destroyActor(actor, timeoutMs) {
+        const pending = this.operations.reserve(timeoutMs);
+        const local = actor.nodeRid === this.nodeRid;
+        if (local) {
+            queueMicrotask(() => {
+                try {
+                    this.registry.destroyActor(actor);
+                    this.operations.reply(pending.id, { terminalResult: runtime_values_1.RequestResult.Ok, failureCode: 0 });
+                }
+                catch (error) {
+                    this.operations.reply(pending.id, failure(error));
+                }
+            });
+            return pending;
+        }
+        const header = (0, service_stateful_wire_codec_1.encodeActorDestroyHeader)(pending.id, this.actorFence(actor));
+        this.submitRequest(pending, actor.nodeRid, [header], timeoutMs, 'actorDestroy');
+        return pending;
+    }
+    joinActor(actor, targetNodeRid, targetSpot, targetSpotGeneration, payload, timeoutMs) {
+        const deadlineMs = performance.now() + timeoutMs;
+        const pending = this.operations.reserve(timeoutMs, targetNodeRid === this.nodeRid ? 'registry' : 'sender');
+        const target = this.trySpotFence(targetNodeRid, {
+            ...targetSpot,
+            generation: targetSpotGeneration
+        });
+        this.submitActorJoin(pending, actor, targetNodeRid, target, payload, deadlineMs);
+        return pending;
+    }
+    joinActorCanonical(actor, targetNodeRid, targetSpot, targetSpotGeneration, request, actorFence, local, timeoutMs) {
+        const deadlineMs = performance.now() + timeoutMs;
+        const pending = this.operations.reserve(timeoutMs, targetNodeRid === this.nodeRid ? 'registry' : 'sender');
+        const target = this.trySpotFence(targetNodeRid, {
+            ...targetSpot,
+            generation: targetSpotGeneration
+        });
+        this.submitActorJoin(pending, actor, targetNodeRid, target, request, deadlineMs, { request, actorFence, local });
+        return pending;
+    }
+    joinActorEntrySpot(actor, targetNodeRid, payload, timeoutMs) {
+        const deadlineMs = performance.now() + timeoutMs;
+        const pending = this.operations.reserve(timeoutMs, targetNodeRid === this.nodeRid ? 'registry' : 'sender');
+        this.submitActorJoin(pending, actor, targetNodeRid, this.tryEntrySpotFence(targetNodeRid), payload, deadlineMs);
+        return pending;
+    }
+    joinActorEntrySpotCanonical(actor, targetNodeRid, request, actorFence, local, timeoutMs) {
+        const deadlineMs = performance.now() + timeoutMs;
+        const pending = this.operations.reserve(timeoutMs, targetNodeRid === this.nodeRid ? 'registry' : 'sender');
+        this.submitActorJoin(pending, actor, targetNodeRid, this.tryEntrySpotFence(targetNodeRid), request, deadlineMs, { request, actorFence, local });
+        return pending;
+    }
+    leaveActor(actor, expectedMembershipEpoch, timeoutMs) {
+        const pending = this.operations.reserve(timeoutMs);
+        queueMicrotask(() => {
+            try {
+                const transition = this.registry.leaveActor(actor, expectedMembershipEpoch);
+                this.enqueueActorControl(transition.actor.spot.spotId, {
+                    kind: 'actorControl',
+                    lifecycleKind: service_runtime_contracts_1.ActorLifecycleKind.Left,
+                    previousActor: transition.actor.ref,
+                    currentActor: transition.actor.ref,
+                    previousSpotId: transition.previousSpot.spotId,
+                    currentSpotId: transition.currentSpot.spotId,
+                    previousSpotGeneration: transition.previousSpot.generation,
+                    currentSpotGeneration: transition.currentSpot.generation,
+                    previousMembershipEpoch: transition.previousMembershipEpoch,
+                    currentMembershipEpoch: transition.currentMembershipEpoch,
+                    resultCode: 0
+                });
+                this.operations.reply(pending.id, { terminalResult: runtime_values_1.RequestResult.Ok, failureCode: 0 });
+            }
+            catch (error) {
+                this.operations.reply(pending.id, failure(error));
+            }
+        });
+        return pending;
+    }
+    bindSession(sessionRid, actor, timeoutMs, deliver, onBindingReplaced, bindingIngress, actorAuthority) {
+        const deadlineMs = performance.now() + timeoutMs;
+        const pending = this.operations.reserve(timeoutMs, 'sender');
+        const generation = this.nextSessionSequence++;
+        const localBinding = {
+            actor,
+            sessionRid,
+            sessionOwnerNodeRid: this.nodeRid,
+            sessionOwnerNodeGeneration: this.nodeGeneration,
+            sessionOwnerId: this.nodeRid,
+            sessionOwnerLeaseGeneration: this.nodeGeneration,
+            bindingGeneration: generation,
+            membershipEpoch: this.registry.actor(actor.actorId)?.membershipEpoch ?? 1n
+        };
+        const delivery = {
+            binding: localBinding,
+            deliver,
+            ...(bindingIngress === undefined ? {} : { bindingIngress }),
+            ...(onBindingReplaced === undefined ? {} : { onBindingReplaced })
+        };
+        const deliveryKey = actorKey(actor);
+        if (actor.nodeRid === this.nodeRid) {
+            let installedDelivery;
+            try {
+                const previous = this.registry.binding(actor);
+                if (previous !== undefined && sameSessionIdentity(previous, localBinding)) {
+                    const currentDelivery = this.sessionDeliveries.get(deliveryKey);
+                    if (currentDelivery !== undefined && sameSessionBinding(currentDelivery.binding, previous)) {
+                        this.sessionDeliveries.set(deliveryKey, {
+                            ...delivery,
+                            binding: previous
+                        });
+                    }
+                    else {
+                        this.sessionDeliveries.set(deliveryKey, { ...delivery, binding: previous });
+                    }
+                    this.operations.reply(pending.id, {
+                        terminalResult: runtime_values_1.RequestResult.Ok,
+                        failureCode: 0
+                    });
+                    return pending;
+                }
+                const previousDelivery = this.sessionDeliveries.get(deliveryKey);
+                const binding = this.registry.bindSession(actor, sessionRid, this.nodeRid, this.nodeGeneration, this.nodeRid, this.nodeGeneration);
+                if (previousDelivery !== undefined && previous !== undefined) {
+                    this.retiredSessionDeliveries.set(sessionDeliveryKey(previous), previousDelivery);
+                }
+                installedDelivery = { ...delivery, binding };
+                this.sessionDeliveries.set(deliveryKey, installedDelivery);
+                this.operations.reply(pending.id, {
+                    terminalResult: runtime_values_1.RequestResult.Ok,
+                    failureCode: 0,
+                    kindData: undefined
+                });
+                if (previous !== undefined) {
+                    this.sendBoundSessionReplacement(previous, actorAuthorityFromRoute(this.tryActorFence(actor) ?? {
+                        actor,
+                        targetNodeGeneration: this.nodeGeneration,
+                        authorityOwnerGeneration: this.registry.actor(actor.actorId)?.authorityOwnerGeneration
+                            ?? actor.generation,
+                        ownerLeaseGeneration: this.nodeGeneration
+                    }));
+                }
+            }
+            catch (error) {
+                if (installedDelivery !== undefined && this.sessionDeliveries.get(deliveryKey) === installedDelivery) {
+                    this.sessionDeliveries.delete(deliveryKey);
+                }
+                this.operations.reply(pending.id, failure(error));
+            }
+            return pending;
+        }
+        const previousDelivery = this.sessionDeliveries.get(deliveryKey);
+        let bindingActorFence;
+        let header;
+        try {
+            bindingActorFence = actorAuthority === undefined
+                ? this.actorFence(actor)
+                : { actor, ...actorAuthority };
+            header = (0, service_stateful_wire_codec_1.encodeBoundSessionBindHeader)(pending.id, bindingActorFence, sessionRid, { state: 'active', generation });
+        }
+        catch (error) {
+            this.operations.fail(pending.id, error);
+            return pending;
+        }
+        void this.requestDurableOperation(actor.nodeRid, [header], pending.id, 'streamBind', deadlineMs).then(reply => this.completeRemoteReply(pending, actor.nodeRid, 'streamBind', undefined, reply), error => this.operations.fail(pending.id, error));
+        return {
+            id: pending.id,
+            promise: pending.promise.then(result => {
+                if (result.terminalResult === runtime_values_1.RequestResult.Ok && result.streamBinding !== undefined) {
+                    const committed = {
+                        ...delivery,
+                        binding: {
+                            ...delivery.binding,
+                            bindingGeneration: result.streamBinding.bindingGeneration
+                        }
+                    };
+                    const current = this.sessionDeliveries.get(deliveryKey);
+                    if (current === previousDelivery
+                        || current === undefined
+                        || sameSessionOwnerIdentity(current.binding, committed.binding)
+                            && current.binding.bindingGeneration < committed.binding.bindingGeneration) {
+                        if (current !== undefined && !sameSessionBinding(current.binding, committed.binding)) {
+                            this.retiredSessionDeliveries.set(sessionDeliveryKey(current.binding), current);
+                        }
+                        // Publish the exact Location authority used by command 38 in the
+                        // same Session-owner completion turn as the binding route. Actor
+                        // lookup only carries a peer-lifecycle fallback for owner lease.
+                        this.rememberActorRoute(bindingActorFence);
+                        this.sessionDeliveries.set(deliveryKey, committed);
+                    }
+                }
+                return result;
+            })
+        };
+    }
+    unbindSession(sessionRid, actor, expectedBindingGeneration, timeoutMs) {
+        const pending = this.operations.reserve(timeoutMs);
+        const delivery = this.sessionDeliveries.get(actorKey(actor));
+        if (delivery === undefined
+            || delivery.binding.sessionRid !== sessionRid
+            || delivery.binding.bindingGeneration !== expectedBindingGeneration) {
+            this.operations.reply(pending.id, {
+                terminalResult: runtime_values_1.RequestResult.NotFound,
+                failureCode: ACTOR_ROUTE_STALE
+            });
+            return pending;
+        }
+        this.sessionDeliveries.delete(actorKey(actor));
+        if (actor.nodeRid === this.nodeRid) {
+            try {
+                this.registry.unbindSession(actor, expectedBindingGeneration);
+                this.operations.reply(pending.id, { terminalResult: runtime_values_1.RequestResult.Ok, failureCode: 0 });
+            }
+            catch (error) {
+                this.operations.reply(pending.id, failure(error));
+            }
+            return pending;
+        }
+        const header = (0, service_stateful_wire_codec_1.encodeBoundSessionBindHeader)(pending.id, this.actorFence(actor), sessionRid, { state: 'tombstone', retiredGeneration: expectedBindingGeneration });
+        this.submitRequest(pending, actor.nodeRid, [header], timeoutMs, 'streamUnbind');
+        return pending;
+    }
+    sessionBindings(sessionRid) {
+        return [...this.sessionDeliveries.values()]
+            .map(value => value.binding)
+            .filter(binding => binding.sessionRid === sessionRid);
+    }
+    allSessionBindings() {
+        return [...this.sessionDeliveries.values()].map(value => value.binding);
+    }
+    async sendSessionToActor(sessionRid, actor, payload) {
+        const delivery = this.sessionDeliveries.get(actorKey(actor));
+        if (delivery === undefined || delivery.binding.sessionRid !== sessionRid) {
+            return runtime_values_1.SubmitResult.NotFound;
+        }
+        return this.sendToActor(actor, this.peerGeneration(actor.nodeRid), actor.generation, payload, undefined, {
+            sessionRid,
+            bindingGeneration: delivery.binding.bindingGeneration
+        });
+    }
+    async sendBoundSession(actor, expectedBindingGeneration, payload, senderFence) {
+        let binding;
+        try {
+            binding = this.registry.validateBoundSession(actor, expectedBindingGeneration);
+        }
+        catch {
+            return runtime_values_1.SubmitResult.InvalidState;
+        }
+        const actorFence = this.tryBoundSessionSendFence(actor, senderFence);
+        if (actorFence === undefined)
+            return runtime_values_1.SubmitResult.InvalidState;
+        const header = (0, service_stateful_wire_codec_1.encodeBoundSessionSendHeader)(actorFence, expectedBindingGeneration);
+        return this.submitOneWay(binding.sessionOwnerNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)]);
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.operations.close();
+        const clearedActors = new Set();
+        for (const deliveries of [this.sessionDeliveries, this.retiredSessionDeliveries]) {
+            for (const delivery of deliveries.values()) {
+                const actorId = delivery.binding.actor.actorId;
+                if (clearedActors.has(actorId))
+                    continue;
+                clearedActors.add(actorId);
+                delivery.bindingIngress?.clearOutbound(actorId, new Error(`Actor '${actorId}' Session service closed with retained outbound delivery.`));
+            }
+        }
+        this.sessionDeliveries.clear();
+        this.retiredSessionDeliveries.clear();
+        this.appliedReplacementNotices.clear();
+        this.instanceIntents.clear();
+        this.pendingInstanceTerminals.clear();
+        this.pendingInstanceAuthorityTerminals.clear();
+        for (const waiters of this.instanceApplicationWaiters.values()) {
+            for (const waiter of waiters)
+                waiter();
+        }
+        this.instanceApplicationWaiters.clear();
+        this.admittedUserSpotOperations.clear();
+        this.actorRoutes.clear();
+        this.spotRoutes.clear();
+        this.directSpotRoutes.clear();
+        for (const state of this.spotMessageFollow.values()) {
+            while (state.queuedCount > 0)
+                this.takeSpotMessageFollow(state);
+        }
+        this.spotMessageFollow.clear();
+    }
+    async ingress(record) {
+        // These frozen relocation controls overlap the legacy stateful command
+        // number range (30-34). They are bare infrastructure records and must
+        // fall through to RawServiceMeshRuntime's relocation ingress instead of
+        // being decoded as stateful actor/spot work.
+        if (record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationReady
+            || record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationData
+            || record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelay
+            || record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationCutover) {
+            return undefined;
+        }
+        if (record.command < service_stateful_wire_codec_1.M6bServiceWireCommand.spotSend
+            || (record.command > service_stateful_wire_codec_1.M6bServiceWireCommand.instanceSpot
+                && record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.userSpotCreate
+                && record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.userSpotClose
+                && record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.actorCreate
+                && record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.messageFollow
+                && record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.boundSessionReplaced)) {
+            return undefined;
+        }
+        let decoded;
+        let canonicalActorJoin;
+        try {
+            if (record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.actorJoin) {
+                try {
+                    canonicalActorJoin = (0, service_wire_pilot_codec_generated_1.decodeActorJoin28)(record.parts);
+                }
+                catch {
+                    return 'protocolError';
+                }
+                decoded = statefulActorJoinFromCanonical(canonicalActorJoin);
+            }
+            else {
+                decoded = (0, service_stateful_wire_codec_1.decodeStatefulHeader)(record.parts[0]);
+            }
+            const hasPayload = [
+                'spotSend',
+                'spotRequest',
+                'logicalMulticast',
+                'actorSend',
+                'actorRequest',
+                'actorJoin',
+                'boundSessionSend'
+            ].includes(decoded.kind);
+            const instanceMetadata = decoded.kind === 'instanceSpot'
+                && (record.flags & service_stateful_wire_codec_1.M6bServiceWireFlag.metadata) !== 0;
+            const userSpotInfrastructure = decoded.kind === 'userSpotCreate'
+                || decoded.kind === 'userSpotClose'
+                || decoded.kind === 'actorCreate'
+                || decoded.kind === 'messageFollow'
+                || decoded.kind === 'boundSessionReplaced';
+            if (record.parts.length < 1
+                || record.parts.length > (instanceMetadata ? 3 : 2)
+                || (hasPayload && decoded.kind !== 'actorJoin' && record.parts.length !== 2)
+                || (decoded.kind === 'instanceSpot'
+                    && record.parts.length !== (instanceMetadata ? 3 : 2))
+                || (userSpotInfrastructure && record.parts.length !== 1)) {
+                return 'protocolError';
+            }
+            const metadataFrame = instanceMetadata
+                ? (0, service_metadata_codec_1.validateServiceMetadataFrame)(record.parts[1])
+                : undefined;
+            const canonicalPayload = canonicalActorJoin?.payload === undefined
+                ? undefined
+                : {
+                    packetName: canonicalActorJoin.payload.packetName,
+                    contentType: canonicalActorJoin.payload.contentType,
+                    payload: Buffer.from(canonicalActorJoin.payload.payload)
+                };
+            const payloadFrame = canonicalPayload === undefined
+                ? (record.parts.length >= 2 ? record.parts[record.parts.length - 1] : undefined)
+                : (0, service_wire_m6a_codec_1.encodeApplicationPayload)(canonicalPayload);
+            try {
+                return await this.handleIngress(record, decoded, payloadFrame, metadataFrame, canonicalActorJoin, canonicalPayload);
+            }
+            catch (error) {
+                const correlation = statefulCorrelation(decoded);
+                if (correlation !== undefined) {
+                    const result = failure(error);
+                    this.replyWire(record, correlation, result.terminalResult, result.failureCode);
+                    return 'infrastructure';
+                }
+                if (error instanceof service_stateful_registry_1.ServiceStaleGenerationError)
+                    return 'protocolError';
+                if (error instanceof contracts_1.ZLinkFrameworkException) {
+                    const kind = (0, framework_errors_internal_1.internalFrameworkErrorKind)(error);
+                    if (kind === framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound
+                        || kind === framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving
+                        || kind === framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale) {
+                        return 'protocolError';
+                    }
+                }
+                throw error;
+            }
+        }
+        catch (error) {
+            if (error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError)
+                return 'protocolError';
+            throw error;
+        }
+    }
+    async handleIngress(ingress, record, payloadFrame, metadataFrame, canonicalActorJoin, canonicalActorJoinPayload) {
+        switch (record.kind) {
+            case 'messageFollow': {
+                if (record.source.kind !== record.target.kind
+                    || record.target.authorityOwnerGeneration
+                        <= record.source.authorityOwnerGeneration) {
+                    throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Message Follow target owner generation must increase at every hop.');
+                }
+                if (record.source.targetNodeRid !== ingress.sourceRoutingId) {
+                    throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Message Follow sender does not match the source route target.');
+                }
+                const admitted = this.raw.topology.peer(record.source.targetNodeRid);
+                if (admitted?.descriptor.lifecycleGeneration !== record.source.targetNodeGeneration) {
+                    throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Message Follow source route is not the current admitted peer.');
+                }
+                const targetGeneration = record.target.targetNodeRid === this.nodeRid
+                    ? this.nodeGeneration
+                    : this.raw.topology.peer(record.target.targetNodeRid)?.descriptor
+                        .lifecycleGeneration;
+                if (targetGeneration !== record.target.targetNodeGeneration) {
+                    throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Message Follow target route is not the current topology target.');
+                }
+                if (record.source.kind === 'actor') {
+                    this.messageFollowHandler?.(record);
+                }
+                else {
+                    const directKey = directSpotKey(record.source.spot.spotId);
+                    const current = this.directSpotRoutes.get(directKey);
+                    if (current !== undefined
+                        && sameMessageFollowSpotSource(current, record.source)) {
+                        this.directSpotRoutes.delete(directKey);
+                        const exactKey = spotKey(record.source.spot);
+                        const exact = this.spotRoutes.get(exactKey);
+                        if (exact !== undefined && sameMessageFollowSpotSource(exact, record.source)) {
+                            this.spotRoutes.delete(exactKey);
+                        }
+                    }
+                }
+                return 'infrastructure';
+            }
+            case 'spotSend':
+            case 'spotRequest': {
+                const followed = this.holdOrRelaySpotMessage(ingress, record);
+                if (followed !== undefined)
+                    return followed;
+                this.validateDirectSpotFence(record.target);
+                return this.enqueueApplicationFrame(ingress, `spot:${record.target.spot.spotId}`, payloadFrame, {
+                    receiveKind: record.kind === 'spotSend' ? service_runtime_contracts_1.ReceiveKind.SpotSend : service_runtime_contracts_1.ReceiveKind.SpotRequest,
+                    operationKind: record.kind === 'spotRequest' ? service_runtime_contracts_1.OperationKind.SpotRequest : 0,
+                    ...(record.correlation === undefined ? {} : { correlation: record.correlation }),
+                    sourceSpotId: record.sourceSpotId,
+                    targetSpot: record.target.spot,
+                    ...(record.kind === 'spotRequest'
+                        ? { reply: this.replyPort(ingress, record.correlation, 'spotRequest') }
+                        : {})
+                });
+            }
+            case 'actorSend':
+            case 'actorRequest': {
+                const actor = record.boundSession === undefined
+                    ? this.validateActorMessageFence(record.target)
+                    : this.validateActorFence(record.target);
+                if (record.boundSession !== undefined) {
+                    const binding = this.registry.validateBoundSession(record.target.actor, record.boundSession.bindingGeneration);
+                    if (binding.sessionRid !== record.boundSession.sessionRid
+                        || binding.sessionOwnerNodeRid !== ingress.sourceRoutingId) {
+                        throw new service_stateful_registry_1.ServiceStaleGenerationError('binding', record.target.actor.actorId);
+                    }
+                }
+                return this.enqueueApplicationFrame(ingress, `actor:${actor.ref.actorId}\0${actor.ref.generation}`, payloadFrame, {
+                    receiveKind: record.kind === 'actorSend' ? service_runtime_contracts_1.ReceiveKind.ActorSend : service_runtime_contracts_1.ReceiveKind.ActorRequest,
+                    operationKind: record.kind === 'actorRequest' ? service_runtime_contracts_1.OperationKind.ActorRequest : 0,
+                    ...(record.correlation === undefined ? {} : { correlation: record.correlation }),
+                    ...(record.sourceActor === undefined
+                        ? {}
+                        : { sourceActor: { ...record.sourceActor, nodeRid: ingress.sourceRoutingId } }),
+                    ...(record.boundSession === undefined
+                        ? {}
+                        : { sourceBindingGeneration: record.boundSession.bindingGeneration }),
+                    targetActor: actor.ref,
+                    messageFollowOrigin: {
+                        sourceNodeRid: ingress.sourceRoutingId,
+                        originalOperation: {
+                            high: this.peerGeneration(ingress.sourceRoutingId),
+                            low: record.correlation ?? this.nextMessageFollowOperation++
+                        },
+                        originalReplyRouteId: ingress.requestSequence ?? 0n
+                    },
+                    ...(record.kind === 'actorRequest'
+                        ? { reply: this.replyPort(ingress, record.correlation, 'actorRequest') }
+                        : {})
+                });
+            }
+            case 'logicalMulticast':
+                await this.enqueueLogicalMulticastFrame(record.channelName, record.topic, record.sourceSpotId, payloadFrame, ingress.sourceRoutingId, requireApplicationJobOwner(ingress));
+                return 'application';
+            case 'actorLookup':
+                return this.replyLookup(ingress, record);
+            case 'actorDestroy':
+                return this.replyDestroy(ingress, record);
+            case 'actorJoin':
+                // Canonical command-28 is a request/reply control.  A one-way ingress
+                // cannot carry its typed terminal, so report it as a protocol error
+                // through RawServiceMeshRuntime rather than attempting replyWire().
+                if (canonicalActorJoin !== undefined && ingress.requestSequence === undefined) {
+                    return 'protocolError';
+                }
+                this.validateSpotFence(record.target);
+                return this.enqueueActorJoin(ingress, record, payloadFrame, canonicalActorJoin, canonicalActorJoinPayload);
+            case 'boundSessionBind':
+                return this.replySessionBind(ingress, record);
+            case 'boundSessionReplaced':
+                return this.handleBoundSessionReplaced(ingress, record);
+            case 'boundSessionSend':
+                return await this.deliverBoundSession(ingress, record, payloadFrame);
+            case 'instanceSpot':
+                return this.enqueueInstanceSpot(ingress, record, payloadFrame, metadataFrame);
+            case 'userSpotCreate':
+            case 'userSpotClose':
+            case 'actorCreate':
+                return this.handleUserSpotOperation(ingress, record);
+        }
+    }
+    enqueueInstanceSpot(ingress, record, payloadFrame, metadataFrame) {
+        if (record.activation === 'missing' && this.asyncInstanceAuthority !== undefined) {
+            const ownedIngress = shareIngressOwnership(ingress);
+            void this.continueMissingInstanceActivation(ownedIngress, record, payloadFrame, undefined, metadataFrame).finally(() => ownedIngress.applicationJobOwner?.close());
+            return 'infrastructure';
+        }
+        if (record.activation === 'ready'
+            && this.needsInstanceApplicationMaterialization(ingress, record)) {
+            const ownedIngress = shareIngressOwnership(ingress);
+            void this.continueReadyInstanceMaterialization(ownedIngress, record, payloadFrame, metadataFrame).finally(() => ownedIngress.applicationJobOwner?.close());
+            return 'infrastructure';
+        }
+        const spot = this.requireInstanceActivation(ingress, record);
+        const applicationTarget = record.activation === 'missing'
+            ? {
+                targetSpotId: record.target.targetSpotId,
+                stableType: record.target.stableType,
+                objectGeneration: spot.ref.generation
+            }
+            : this.instanceApplicationTarget(record);
+        return this.enqueueActivatedInstanceSpot(ingress, record, payloadFrame, spot, undefined, this.instanceApplicationTerminalCompletion(applicationTarget), metadataFrame);
+    }
+    needsInstanceApplicationMaterialization(ingress, record) {
+        const lifecycle = this.instanceApplicationLifecycle;
+        if (lifecycle === undefined)
+            return false;
+        const { intent } = this.requireReadyInstanceApplicationRoute(ingress, record);
+        if (this.instanceApplicationLifecycle?.isIdleEvicting?.({
+            targetSpotId: record.route.targetSpotId,
+            stableType: intent.instanceType
+        }) === true) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Instance Spot '${record.route.targetSpotId}' is entering idle eviction.`);
+        }
+        const applicationTarget = {
+            targetSpotId: record.route.targetSpotId,
+            stableType: intent.instanceType
+        };
+        // A close seals execution only after the current application count reaches
+        // zero. A new Instance message must wait for that close even while the old
+        // activation is still materialized; otherwise it can be admitted after
+        // the close quiescence check and be removed with the old activation.
+        if (lifecycle.isClosing?.(applicationTarget) === true)
+            return true;
+        return !lifecycle.isMaterialized(applicationTarget);
+    }
+    enqueueActivatedInstanceSpot(ingress, record, payloadFrame, spot, localReply, onTerminalCompletion, metadataFrame, activationTerminal = false, applicationTargetOverride) {
+        let operationKey;
+        if (record.activation === 'missing') {
+            const now = BigInt(Date.now());
+            for (const [key, deadline] of this.admittedInstanceOperations) {
+                if (deadline < now)
+                    this.admittedInstanceOperations.delete(key);
+            }
+            operationKey = instanceOperationKey(record);
+            if (this.admittedInstanceOperations.has(operationKey))
+                return 'application';
+        }
+        const directReply = record.operationKind === 'request'
+            ? localReply ?? this.replyPort(ingress, record.replyRouteId, 'instanceSpotRequest')
+            : undefined;
+        const applicationTarget = applicationTargetOverride
+            ?? (record.activation === 'missing'
+                ? {
+                    targetSpotId: record.target.targetSpotId,
+                    stableType: record.target.stableType,
+                    objectGeneration: spot.ref.generation
+                }
+                : this.instanceApplicationTarget(record));
+        let deferredReply;
+        const terminalCompletion = onTerminalCompletion === undefined
+            ? undefined
+            : async () => {
+                // The application turn has returned before authority cleanup starts.
+                // Mark it quiescent first so a close requested by that turn can finish
+                // its local cleanup and release the exact authority fence below.
+                this.completeInstanceApplicationOperation(applicationTarget.targetSpotId);
+                try {
+                    await onTerminalCompletion();
+                }
+                finally {
+                    if (deferredReply !== undefined && directReply !== undefined) {
+                        directReply(...deferredReply);
+                    }
+                }
+            };
+        const result = this.enqueueApplicationFrame(ingress, `spot:${spot.ref.spotId}`, payloadFrame, {
+            receiveKind: service_runtime_contracts_1.ReceiveKind.InstanceSpotActivation,
+            operationKind: record.operationKind === 'request' ? service_runtime_contracts_1.OperationKind.InstanceSpotRequest : 0,
+            ...(record.operationKind === 'request' ? { correlation: record.replyRouteId } : {}),
+            ...(record.sourceSpotId === undefined ? {} : { sourceSpotId: record.sourceSpotId }),
+            targetSpot: spot.ref,
+            ...(metadataFrame === undefined ? {} : { applicationMetadata: metadataFrame }),
+            ...(terminalCompletion === undefined ? {} : { onTerminalCompletion: terminalCompletion }),
+            ...(record.operationKind === 'request'
+                ? {
+                    reply: onTerminalCompletion === undefined
+                        ? directReply
+                        : ((...reply) => {
+                            deferredReply = reply;
+                            return true;
+                        })
+                }
+                : {})
+        });
+        if (operationKey !== undefined && result === 'application' && record.activation === 'missing') {
+            this.admittedInstanceOperations.set(operationKey, record.deadlineUnixMs);
+        }
+        if (onTerminalCompletion !== undefined && result === 'application') {
+            this.beginInstanceApplicationOperation(applicationTarget.targetSpotId);
+            if (activationTerminal) {
+                this.beginInstanceAuthorityOperation(applicationTarget.targetSpotId);
+            }
+            this.instanceApplicationLifecycle?.beginTerminal(applicationTarget);
+        }
+        return result;
+    }
+    async continueMissingInstanceActivation(ingress, record, payloadFrame, localReply, metadataFrame) {
+        try {
+            this.validateInstanceIngress(ingress, record);
+            const activation = await this.activateMissingInstanceAsync(record, payloadFrame, metadataFrame);
+            if (this.closed)
+                return;
+            const admitted = this.enqueueActivatedInstanceSpot(ingress, record, payloadFrame, activation.spot, localReply, this.activationTerminalCompletion(record.target, activation.route), metadataFrame, true, this.instanceApplicationTarget(record, activation.route.objectGeneration));
+            if (admitted !== 'application') {
+                throw new Error('Activated Instance message was not admitted to the local queue.');
+            }
+        }
+        catch (error) {
+            let terminalError = error;
+            if (error instanceof ServiceInstanceActivationRedirectError && !this.closed) {
+                try {
+                    await this.relayMissingInstanceActivation(record, payloadFrame, error.route, ingress, localReply, metadataFrame);
+                    return;
+                }
+                catch (relayError) {
+                    terminalError = relayError;
+                }
+            }
+            if (record.operationKind !== 'request')
+                return;
+            const result = failure(terminalError);
+            if (localReply !== undefined) {
+                localReply(result.terminalResult, result.failureCode);
+            }
+            else {
+                if (record.replyRouteId === undefined)
+                    return;
+                this.replyWire(ingress, record.replyRouteId, result.terminalResult, result.failureCode);
+            }
+        }
+    }
+    async continueReadyInstanceMaterialization(ingress, record, payloadFrame, metadataFrame) {
+        try {
+            if (!this.acceptsLocalMissingInstancePlacement()) {
+                // A stale Ready route must not rematerialize an Instance Spot on a
+                // node that has already withdrawn placement admission for relocation.
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', record.route.targetSpotId);
+            }
+            const { intent, route } = this.requireReadyInstanceApplicationRoute(ingress, record);
+            const applicationTarget = {
+                targetSpotId: record.route.targetSpotId,
+                stableType: intent.instanceType,
+                objectGeneration: route.objectGeneration
+            };
+            await this.instanceApplicationLifecycle?.materialize(applicationTarget, route.objectGeneration);
+            if (this.closed)
+                return;
+            const latestRoute = this.instanceIntents.get(record.route.targetSpotId)?.route;
+            const refreshedRecord = latestRoute !== undefined
+                && sameInstanceApplicationOwner(latestRoute, record.route)
+                ? { ...record, route: latestRoute }
+                : record;
+            const spot = this.requireInstanceActivation(ingress, refreshedRecord);
+            const admitted = this.enqueueActivatedInstanceSpot(ingress, refreshedRecord, payloadFrame, spot, undefined, this.instanceApplicationTerminalCompletion(this.instanceApplicationTarget(refreshedRecord)), metadataFrame);
+            if (admitted !== 'application') {
+                throw new Error('Rematerialized Instance message was not admitted to the local queue.');
+            }
+        }
+        catch (error) {
+            if (record.operationKind !== 'request' || record.replyRouteId === undefined)
+                return;
+            const result = failure(error);
+            this.replyWire(ingress, record.replyRouteId, result.terminalResult, result.failureCode);
+        }
+    }
+    activationTerminalCompletion(target, route) {
+        let completion;
+        const applicationTarget = {
+            targetSpotId: target.targetSpotId,
+            stableType: target.stableType,
+            objectGeneration: route.objectGeneration
+        };
+        return () => completion ??= (async () => {
+            let authorityCompletionSignaled = false;
+            try {
+                const released = await this.asyncInstanceAuthority?.complete(target, route);
+                this.completeInstanceAuthorityOperation(target.targetSpotId);
+                authorityCompletionSignaled = true;
+                if (released !== undefined) {
+                    const authorityReleased = await this.instanceApplicationLifecycle?.completeTerminal(applicationTarget)
+                        ?? false;
+                    if (!authorityReleased) {
+                        this.replaceCommittedInstanceRoute(target.stableType, route, released);
+                    }
+                    else {
+                        this.forgetClosedInstanceRoute(released);
+                    }
+                }
+            }
+            finally {
+                if (!authorityCompletionSignaled) {
+                    this.completeInstanceAuthorityOperation(target.targetSpotId);
+                }
+            }
+        })();
+    }
+    instanceApplicationTerminalCompletion(target) {
+        return async () => {
+            const authorityReleased = await this.instanceApplicationLifecycle?.completeTerminal(target)
+                ?? false;
+            if (!authorityReleased)
+                return;
+            const current = this.instanceIntents.get(target.targetSpotId);
+            if (current?.instanceType === target.stableType
+                && current.route.objectGeneration === target.objectGeneration) {
+                this.forgetClosedInstanceRoute(current.route);
+            }
+        };
+    }
+    instanceApplicationTarget(record, missingObjectGeneration) {
+        if (record.activation === 'missing') {
+            if (missingObjectGeneration === undefined) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', record.target.targetSpotId);
+            }
+            return {
+                targetSpotId: record.target.targetSpotId,
+                stableType: record.target.stableType,
+                objectGeneration: missingObjectGeneration
+            };
+        }
+        const intent = this.instanceIntents.get(record.route.targetSpotId);
+        if (intent === undefined) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', record.route.targetSpotId);
+        }
+        return {
+            targetSpotId: record.route.targetSpotId,
+            stableType: intent.instanceType,
+            objectGeneration: record.route.objectGeneration
+        };
+    }
+    beginInstanceApplicationOperation(spotId) {
+        const key = String(spotId);
+        this.pendingInstanceTerminals.set(key, (this.pendingInstanceTerminals.get(key) ?? 0) + 1);
+    }
+    beginInstanceAuthorityOperation(spotId) {
+        const key = String(spotId);
+        this.pendingInstanceAuthorityTerminals.set(key, (this.pendingInstanceAuthorityTerminals.get(key) ?? 0) + 1);
+    }
+    completeInstanceApplicationOperation(spotId) {
+        const key = String(spotId);
+        const pending = this.pendingInstanceTerminals.get(key);
+        if (pending === undefined || pending <= 1) {
+            this.pendingInstanceTerminals.delete(key);
+            this.completeInstanceApplicationWaitersIfQuiescent(key);
+            return;
+        }
+        this.pendingInstanceTerminals.set(key, pending - 1);
+    }
+    completeInstanceAuthorityOperation(spotId) {
+        const key = String(spotId);
+        const pending = this.pendingInstanceAuthorityTerminals.get(key);
+        if (pending === undefined || pending <= 1) {
+            this.pendingInstanceAuthorityTerminals.delete(key);
+            this.completeInstanceApplicationWaitersIfQuiescent(key);
+            return;
+        }
+        this.pendingInstanceAuthorityTerminals.set(key, pending - 1);
+    }
+    completeInstanceApplicationWaitersIfQuiescent(key) {
+        if ((this.pendingInstanceTerminals.get(key) ?? 0) !== 0
+            || (this.pendingInstanceAuthorityTerminals.get(key) ?? 0) !== 0)
+            return;
+        const waiters = this.instanceApplicationWaiters.get(key);
+        if (waiters === undefined)
+            return;
+        this.instanceApplicationWaiters.delete(key);
+        for (const waiter of waiters)
+            waiter();
+    }
+    async relayMissingInstanceActivation(record, payloadFrame, route, ingress, localReply, metadataFrame) {
+        const remainingMs = Number(record.deadlineUnixMs - BigInt(Date.now()));
+        if (remainingMs <= 0) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', route.targetSpotId);
+        }
+        const redirectedTarget = {
+            ...record.target,
+            targetNodeRid: route.targetNodeRid,
+            targetNodeGeneration: route.targetNodeGeneration,
+            targetSpotId: route.targetSpotId
+        };
+        if (record.operationKind === 'send') {
+            const submitted = await this.submitOneWay(route.targetNodeRid, instanceOperationParts([
+                (0, service_stateful_wire_codec_1.encodeInstanceSpotActivationHeader)(redirectedTarget, this.nodeGeneration, this.nodeRid, record.sourceSpotId, 'send', record.operation, record.deadlineUnixMs, undefined, metadataFrame !== undefined),
+                payloadFrame
+            ], metadataFrame));
+            if (submitted !== runtime_values_1.SubmitResult.Ok) {
+                throw new Error(`Instance activation redirect was not admitted: ${submitted}.`);
+            }
+            return;
+        }
+        const pending = this.operations.reserve(remainingMs);
+        this.submitRequest(pending, route.targetNodeRid, instanceOperationParts([
+            (0, service_stateful_wire_codec_1.encodeInstanceSpotActivationHeader)(redirectedTarget, this.nodeGeneration, this.nodeRid, record.sourceSpotId, 'request', record.operation, record.deadlineUnixMs, pending.id, metadataFrame !== undefined),
+            payloadFrame
+        ], metadataFrame), remainingMs, 'instanceSpotRequest');
+        const result = await pending.promise;
+        if (localReply !== undefined) {
+            localReply(result.terminalResult, result.failureCode, result.payload);
+            return;
+        }
+        if (record.replyRouteId !== undefined) {
+            this.replyWire(ingress, record.replyRouteId, result.terminalResult, result.failureCode, result.payload);
+        }
+    }
+    requireInstanceActivation(ingress, record) {
+        const readyRoute = record.activation === 'ready' ? record.route : undefined;
+        const spotId = readyRoute?.targetSpotId
+            ?? (record.activation === 'missing' ? record.target.targetSpotId : undefined);
+        if (spotId === undefined)
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', 'unknown');
+        this.validateInstanceIngress(ingress, record);
+        if (record.activation === 'missing') {
+            return this.activateMissingInstance(record);
+        }
+        const { intent, route } = this.requireReadyInstanceApplicationRoute(ingress, record);
+        const spot = this.registry.spot(route.targetSpotId)
+            ?? this.registry.restoreSpot({
+                spotId: route.targetSpotId,
+                generation: route.objectGeneration
+            }, 'instance', intent.instanceType, route.authorityOwnerGeneration);
+        if (spot.state !== 'ready'
+            || spot.kind !== 'instance'
+            || spot.stableType !== intent.instanceType
+            || spot.ref.generation !== route.objectGeneration
+            || spot.authorityOwnerGeneration !== route.authorityOwnerGeneration) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Instance Spot '${route.targetSpotId}' is not projected from its current Ready authority.`);
+        }
+        return spot;
+    }
+    requireReadyInstanceApplicationRoute(ingress, record) {
+        this.validateInstanceIngress(ingress, record);
+        let intent = this.instanceIntents.get(record.route.targetSpotId);
+        if (intent === undefined) {
+            // The authority commit is externally visible before the asynchronous
+            // activation continuation can publish its in-memory intent. If the
+            // local ready projection already carries the exact object and owner
+            // fence from the received route, publish that validated projection
+            // instead of exposing a transient NotFound result to a following
+            // request. A mismatched or absent local projection remains NotFound.
+            const local = this.registry.spot(record.route.targetSpotId);
+            if (local?.kind === 'instance'
+                && local.state === 'ready'
+                && routeMatchesLocal(record.route, local, this.nodeRid, this.nodeGeneration)) {
+                this.publishCommittedInstanceRoute(local.stableType, record.route);
+                intent = this.instanceIntents.get(record.route.targetSpotId);
+            }
+        }
+        if (intent === undefined) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound, `Instance Spot '${record.route.targetSpotId}' has no current Ready authority.`);
+        }
+        const current = intent.route;
+        if (current.objectGeneration < record.route.objectGeneration) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale, `Instance Spot '${record.route.targetSpotId}' is behind the requested object generation.`);
+        }
+        if (!sameInstanceApplicationOwner(current, record.route)) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Instance Spot '${record.route.targetSpotId}' is owned by a different current route.`);
+        }
+        if (current.objectGeneration === record.route.objectGeneration
+            && current.authorityOwnerGeneration !== record.route.authorityOwnerGeneration) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Instance Spot '${record.route.targetSpotId}' has a different authority owner fence.`);
+        }
+        return { intent, route: current };
+    }
+    validateInstanceIngress(ingress, record) {
+        const expectedSourceGeneration = this.peerGeneration(record.sourceNodeRid);
+        if (record.sourceNodeRid !== ingress.sourceRoutingId
+            || record.sourceNodeGeneration !== expectedSourceGeneration) {
+            if (record.activation === 'ready') {
+                throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Instance Spot '${record.route.targetSpotId}' received a stale source lifecycle fence.`);
+            }
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', record.target.targetSpotId);
+        }
+    }
+    activateMissingInstance(record) {
+        const target = record.target;
+        if (target.targetNodeRid !== this.nodeRid
+            || target.targetNodeGeneration !== this.nodeGeneration
+            || record.deadlineUnixMs < BigInt(Date.now())) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        if (this.instanceApplicationLifecycle?.isIdleEvicting?.(target) === true) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        const authority = this.instanceAuthority;
+        if (authority === undefined) {
+            throw new Error('Instance activation authority is not registered.');
+        }
+        const local = this.registry.spot(target.targetSpotId);
+        const current = authority.read(target);
+        if (local !== undefined) {
+            if (local.kind !== 'instance'
+                || local.stableType !== target.stableType
+                || current.kind !== 'ready'
+                || !routeMatchesLocal(current.route, local, this.nodeRid, this.nodeGeneration)) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+            }
+            return local;
+        }
+        if (current.kind === 'ready') {
+            throw new ServiceInstanceActivationRedirectError(current.route);
+        }
+        const reserved = authority.reserve(target, record.operation, record.deadlineUnixMs);
+        if (reserved.kind === 'ready') {
+            throw new ServiceInstanceActivationRedirectError(reserved.route);
+        }
+        let activation;
+        try {
+            activation = this.activateInstanceSpot(target.targetSpotId, target.stableType, reserved.reservation.attempt, reserved.reservation.authorityOwnerGeneration);
+        }
+        catch (error) {
+            authority.abort(target, reserved.reservation);
+            throw error;
+        }
+        const committed = authority.commit(target, reserved.reservation, activation.spot);
+        if (committed.kind === 'lost') {
+            if (activation.created)
+                this.registry.closeSpot(activation.spot.ref);
+            throw new ServiceInstanceActivationRedirectError(committed.route);
+        }
+        if (!routeMatchesLocal(committed.route, activation.spot, this.nodeRid, this.nodeGeneration)) {
+            if (activation.created)
+                this.registry.closeSpot(activation.spot.ref);
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        return activation.spot;
+    }
+    activateMissingInstanceAsync(record, payloadFrame, metadataFrame) {
+        const key = instanceActivationKey(record);
+        const pending = this.pendingInstanceActivations.get(key);
+        if (pending !== undefined)
+            return pending;
+        const activation = this.runMissingInstanceActivation(record, payloadFrame, metadataFrame);
+        this.pendingInstanceActivations.set(key, activation);
+        const clear = () => {
+            if (this.pendingInstanceActivations.get(key) === activation) {
+                this.pendingInstanceActivations.delete(key);
+            }
+        };
+        void activation.then(clear, clear);
+        return activation;
+    }
+    async runMissingInstanceActivation(record, payloadFrame, metadataFrame) {
+        const target = record.target;
+        if (target.targetNodeRid !== this.nodeRid
+            || target.targetNodeGeneration !== this.nodeGeneration
+            || record.deadlineUnixMs < BigInt(Date.now())) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        const authority = this.asyncInstanceAuthority;
+        if (authority === undefined) {
+            throw new Error('Async Instance activation authority is not registered.');
+        }
+        const local = this.registry.spot(target.targetSpotId);
+        const current = await authority.read(target);
+        if (!this.acceptsLocalMissingInstancePlacement()) {
+            if (current.kind === 'ready' && current.route.targetNodeRid !== this.nodeRid) {
+                throw new ServiceInstanceActivationRedirectError(current.route);
+            }
+            // A draining or retiring node must not create a successor generation
+            // from a stale client route while relocation is publishing its target.
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        if (current.kind === 'ready') {
+            if (current.route.targetNodeRid !== this.nodeRid) {
+                throw new ServiceInstanceActivationRedirectError(current.route);
+            }
+            if (current.route.targetNodeGeneration !== this.nodeGeneration) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+            }
+            if (local !== undefined
+                && (local.kind !== 'instance'
+                    || local.stableType !== target.stableType)) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+            }
+            if (local !== undefined
+                && routeMatchesLocal(current.route, local, this.nodeRid, this.nodeGeneration)) {
+                return { spot: local, route: current.route };
+            }
+            return await this.reconcileReadyInstanceProjection(target, current.route, authority);
+        }
+        if (local !== undefined) {
+            const lifecycle = this.instanceApplicationLifecycle;
+            const closing = lifecycle?.isClosing?.(target) === true;
+            let materialized = lifecycle === undefined
+                ? undefined
+                : lifecycle.isMaterialized(target);
+            const materializing = lifecycle?.isMaterializing?.(target) === true;
+            if (local.kind !== 'instance'
+                || local.stableType !== target.stableType) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+            }
+            const joinsCreating = current.kind === 'creating'
+                && local.ref.generation === current.objectGeneration
+                && local.authorityOwnerGeneration === current.authorityOwnerGeneration;
+            const replacesClosingProjection = current.kind === 'creating' && closing;
+            if (current.kind === 'missing'
+                && !closing
+                && !materializing
+                && materialized === true
+                && lifecycle !== undefined) {
+                // The durable authority is the ownership source of truth. Its removal
+                // can become visible before the route reconciler has discarded the
+                // previous application projection. Converge that orphan here before
+                // reserving a successor generation; otherwise every activation keeps
+                // returning a stale terminal while no owner can make progress.
+                await lifecycle.discard(target);
+                materialized = lifecycle.isMaterialized(target);
+            }
+            // The authority can still be in a Creating reservation after the local
+            // registry exposes the activation. Allow the authority reserve operation
+            // to join that attempt instead of treating the local projection as stale.
+            // A newer reservation can also become visible after an explicit close
+            // releases authority but before local disposal removes the old
+            // projection. The close gate serializes that replacement; rejecting it
+            // here turns a valid next-generation Instance intent into a stale-route
+            // failure.
+            // If disposal did not remove an orphaned materialization, keep fencing
+            // it instead of admitting work into two application generations.
+            if ((!joinsCreating && !replacesClosingProjection && current.kind !== 'missing')
+                || (!joinsCreating && !closing && materialized !== false && !materializing)) {
+                throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+            }
+        }
+        const reserved = await authority.reserve({
+            target,
+            sourceNodeRid: record.sourceNodeRid,
+            sourceNodeGeneration: record.sourceNodeGeneration,
+            ...(record.sourceSpotId === undefined ? {} : { sourceSpotId: record.sourceSpotId }),
+            operationKind: record.operationKind,
+            operation: record.operation,
+            ...(record.replyRouteId === undefined ? {} : { replyRouteId: record.replyRouteId }),
+            deadlineUnixMs: record.deadlineUnixMs,
+            ...(metadataFrame === undefined ? {} : { metadataFrame }),
+            applicationPayloadFrame: payloadFrame
+        });
+        if (reserved.kind === 'ready') {
+            throw new ServiceInstanceActivationRedirectError(reserved.route);
+        }
+        if (this.closed || record.deadlineUnixMs < BigInt(Date.now())) {
+            await authority.abort(target, reserved.reservation);
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        let activation;
+        try {
+            await this.instanceApplicationLifecycle?.materialize(target, reserved.reservation.attempt);
+            activation = this.activateInstanceSpot(target.targetSpotId, target.stableType, reserved.reservation.attempt, reserved.reservation.authorityOwnerGeneration);
+        }
+        catch (error) {
+            await authority.abort(target, reserved.reservation);
+            await this.instanceApplicationLifecycle?.discard(target);
+            throw error;
+        }
+        let committed;
+        try {
+            committed = await authority.commit(target, reserved.reservation, activation.spot);
+        }
+        catch (error) {
+            if (activation.created)
+                this.registry.closeSpot(activation.spot.ref);
+            await this.instanceApplicationLifecycle?.discard(target);
+            throw error;
+        }
+        if (committed.kind === 'lost') {
+            if (activation.created)
+                this.registry.closeSpot(activation.spot.ref);
+            await this.instanceApplicationLifecycle?.discard(target);
+            throw new ServiceInstanceActivationRedirectError(committed.route);
+        }
+        if (!routeMatchesLocal(committed.route, activation.spot, this.nodeRid, this.nodeGeneration)) {
+            if (activation.created)
+                this.registry.closeSpot(activation.spot.ref);
+            await this.instanceApplicationLifecycle?.discard(target);
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        this.publishCommittedInstanceRoute(target.stableType, committed.route);
+        return { spot: activation.spot, route: committed.route };
+    }
+    acceptsLocalMissingInstancePlacement() {
+        const topology = this.raw.topology;
+        const descriptor = topology.localDescriptor?.();
+        return descriptor === undefined
+            || (descriptor.state === 'serving' && descriptor.placementWeight > 0);
+    }
+    async reconcileReadyInstanceProjection(target, route, authority) {
+        await this.instanceApplicationLifecycle?.materialize(target, route.objectGeneration);
+        const activation = this.activateInstanceSpot(target.targetSpotId, target.stableType, route.objectGeneration, route.authorityOwnerGeneration);
+        if (!routeMatchesLocal(route, activation.spot, this.nodeRid, this.nodeGeneration)) {
+            if (activation.created)
+                this.registry.closeSpot(activation.spot.ref);
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        this.publishCommittedInstanceRoute(target.stableType, route);
+        const confirmed = await authority.read(target);
+        if (confirmed.kind !== 'ready' || !sameInstanceRoute(confirmed.route, route)) {
+            if (confirmed.kind === 'ready'
+                && confirmed.route.targetNodeRid !== this.nodeRid) {
+                throw new ServiceInstanceActivationRedirectError(confirmed.route);
+            }
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        const current = this.registry.spot(target.targetSpotId);
+        if (current === undefined
+            || !routeMatchesLocal(confirmed.route, current, this.nodeRid, this.nodeGeneration)) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+        }
+        return { spot: current, route: confirmed.route };
+    }
+    publishCommittedInstanceRoute(stableType, route, expectedCurrentRoute) {
+        const directRoute = instanceRouteAsDirectRoute(route);
+        const expectedDirectRoute = expectedCurrentRoute === undefined
+            ? undefined
+            : expectedCurrentRoute === null
+                ? null
+                : instanceRouteAsDirectRoute(expectedCurrentRoute);
+        this.rememberSpotRoute(directRoute, expectedDirectRoute);
+        this.registerInstanceIntent(stableType, route, expectedCurrentRoute);
+    }
+    replaceCommittedInstanceRoute(stableType, previous, next) {
+        const current = this.instanceIntents.get(previous.targetSpotId);
+        if (current === undefined || !sameInstanceRoute(current.route, previous)) {
+            return false;
+        }
+        // A terminal completion can advance only the durable StoreVersion while
+        // the same authority owner continues to serve the same Instance. Remove
+        // the exact previous cache entry before publishing that validated result;
+        // rememberSpotRoute must continue rejecting an unrelated same-generation
+        // stale route.
+        this.forgetSpotRoute({
+            spotId: previous.targetSpotId,
+            generation: previous.objectGeneration
+        }, previous.authorityOwnerGeneration, previous.storeVersion);
+        this.publishCommittedInstanceRoute(stableType, next, previous);
+        return true;
+    }
+    forgetClosedInstanceRoute(route) {
+        const local = this.registry.spot(route.targetSpotId);
+        if (local?.kind === 'instance'
+            && local.ref.generation === route.objectGeneration
+            && local.authorityOwnerGeneration === route.authorityOwnerGeneration) {
+            this.registry.closeSpot(local.ref);
+        }
+        this.forgetSpotRoute({ spotId: route.targetSpotId, generation: route.objectGeneration }, route.authorityOwnerGeneration, route.storeVersion);
+        this.forgetInstanceIntent(route.targetSpotId, route.objectGeneration, route.authorityOwnerGeneration);
+    }
+    enqueueActorJoin(ingress, record, payloadFrame, canonicalActorJoin, canonicalApplicationPayload) {
+        const current = this.registry.actor(record.actor.actor.actorId);
+        const previousEpoch = current?.membershipEpoch ?? 0n;
+        const actor = {
+            ...record.actor.actor,
+            nodeRid: this.nodeRid
+        };
+        const control = {
+            kind: 'actorControl',
+            lifecycleKind: service_runtime_contracts_1.ActorLifecycleKind.Joined,
+            previousActor: current?.ref ?? record.actor.actor,
+            currentActor: actor,
+            previousSpotId: current?.spot.spotId ?? null,
+            currentSpotId: record.target.spot.spotId,
+            previousSpotGeneration: current?.spot.generation ?? 0n,
+            currentSpotGeneration: record.target.spot.generation,
+            previousMembershipEpoch: previousEpoch,
+            currentMembershipEpoch: previousEpoch + 1n,
+            resultCode: 0,
+            ...(canonicalActorJoin === undefined
+                ? {}
+                : {
+                    canonicalActorJoin: {
+                        handoffId: (0, actor_join_recovery_codec_1.canonicalActorJoinHandoffId)({
+                            sourceActorNodeRid: canonicalActorJoin.actor.targetNodeRid,
+                            actorId: record.actor.actor.actorId,
+                            actorGeneration: record.actor.actor.generation,
+                            sourceActorNodeGeneration: record.actor.targetNodeGeneration,
+                            correlation: record.correlation
+                        }),
+                        actorNodeRid: record.actor.actor.nodeRid,
+                        actorGeneration: record.actor.actor.generation,
+                        actorNodeGeneration: record.actor.targetNodeGeneration,
+                        authorityOwnerGeneration: record.actor.authorityOwnerGeneration,
+                        ownerLeaseGeneration: record.actor.ownerLeaseGeneration
+                    }
+                })
+        };
+        const applicationFrame = payloadFrame ?? (0, service_wire_m6a_codec_1.encodeApplicationPayload)(emptyPayload());
+        return this.enqueueLifecycleFrame(ingress, `spot:${record.target.spot.spotId}`, applicationFrame, {
+            receiveKind: service_runtime_contracts_1.ReceiveKind.SpotControl,
+            operationKind: service_runtime_contracts_1.OperationKind.ActorJoin,
+            correlation: record.correlation,
+            targetSpot: record.target.spot,
+            targetActor: actor,
+            kindData: control,
+            ...(canonicalApplicationPayload === undefined ? {} : { canonicalApplicationPayload }),
+            reply: (terminalResult, failureCode, replyPayload, tail) => {
+                return this.replyPort(ingress, record.correlation, 'actorJoin')(terminalResult, failureCode, replyPayload, tail);
+            }
+        });
+    }
+    replyLookup(ingress, record) {
+        const actor = this.registry.actor(record.actorId);
+        if (actor === undefined) {
+            this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.NotFound, ACTOR_ROUTE_NOT_FOUND);
+        }
+        else {
+            this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Ok, 0, undefined, {
+                kind: 'actorLookup',
+                actor: actor.ref,
+                spot: actor.spot,
+                membershipEpoch: actor.membershipEpoch,
+                authorityOwnerGeneration: actor.authorityOwnerGeneration
+            });
+        }
+        return 'infrastructure';
+    }
+    replyDestroy(ingress, record) {
+        try {
+            this.validateActorFence(record.actor);
+            this.registry.destroyActor(record.actor.actor);
+            this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Ok, 0);
+        }
+        catch (error) {
+            const result = failure(error);
+            this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+        }
+        return 'infrastructure';
+    }
+    replySessionBind(ingress, record) {
+        try {
+            if (record.binding.state === 'active') {
+                const actor = this.validateActorFence(record.actor);
+                const previous = this.registry.binding(actor.ref);
+                const sourceGeneration = ingress.sourceNodeGeneration
+                    ?? this.peerGeneration(ingress.sourceRoutingId);
+                const binding = (0, service_stateful_wire_codec_1.sessionBindingFromWire)(actor.ref, record.sessionRid, ingress.sourceRoutingId, record.binding.generation, actor.membershipEpoch, sourceGeneration, ingress.sourceRoutingId, sourceGeneration);
+                if (previous !== undefined && sameSessionIdentity(previous, binding)) {
+                    // Registry publication is the last step of the first binding owner
+                    // turn, so an observable same-Session binding already has every
+                    // Actor route projection installed and can complete idempotently.
+                    this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Ok, 0, undefined, {
+                        kind: 'streamBind',
+                        bindingGeneration: previous.bindingGeneration,
+                        authorityOwnerGeneration: actor.authorityOwnerGeneration
+                    });
+                    return 'infrastructure';
+                }
+                const accepted = this.enqueueActorBindingControl(ingress, binding, record.actor, (terminalResult, failureCode) => {
+                    let completedBinding = binding;
+                    let replacedBinding;
+                    if (terminalResult === runtime_values_1.RequestResult.Ok) {
+                        // This callback runs inside the Actor binding control turn,
+                        // after the Host has installed its Actor-to-session projection.
+                        // Publish the authority-owned registry view in that same turn
+                        // before making the terminal reply observable.
+                        const turnCurrent = this.registry.binding(actor.ref);
+                        if (turnCurrent !== undefined && sameSessionIdentity(turnCurrent, binding)) {
+                            completedBinding = turnCurrent;
+                        }
+                        else {
+                            replacedBinding = turnCurrent;
+                            this.registry.installSessionBinding(binding);
+                        }
+                    }
+                    this.replyWire(ingress, record.correlation, terminalResult, failureCode, undefined, terminalResult === runtime_values_1.RequestResult.Ok
+                        ? {
+                            kind: 'streamBind',
+                            bindingGeneration: completedBinding.bindingGeneration,
+                            authorityOwnerGeneration: actor.authorityOwnerGeneration
+                        }
+                        : undefined);
+                    if (terminalResult === runtime_values_1.RequestResult.Ok
+                        && replacedBinding !== undefined
+                        && !sameSessionBinding(replacedBinding, completedBinding)) {
+                        this.sendBoundSessionReplacement(replacedBinding, actorAuthorityFromRoute({
+                            ...record.actor,
+                            ownerLeaseGeneration: record.actor.ownerLeaseGeneration
+                        }));
+                    }
+                    return true;
+                });
+                if (!accepted) {
+                    const result = failure((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Actor '${actor.ref.actorId}' no longer accepts session bindings.`));
+                    this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+                }
+            }
+            else {
+                this.enqueueSessionBindingTombstone(ingress, record);
+            }
+        }
+        catch (error) {
+            const result = failure(error);
+            this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+        }
+        return 'infrastructure';
+    }
+    /**
+     * Handles the replacement notice at the retired session owner.  This path
+     * intentionally never calls validateActorFence(): the notice is authorized
+     * by its transport source and exact retired session identity, not by a
+     * local Actor registry entry.
+     */
+    handleBoundSessionReplaced(ingress, record) {
+        const authority = record.actorAuthority;
+        if (authority.actor.nodeRid !== ingress.sourceRoutingId) {
+            return 'protocolError';
+        }
+        const sourceGeneration = ingress.sourceNodeGeneration
+            ?? this.tryPeerGeneration(ingress.sourceRoutingId);
+        if (sourceGeneration === undefined)
+            return 'infrastructure';
+        if (sourceGeneration !== authority.targetNodeGeneration) {
+            // A notice from a restarted authority is stale. It must not tear down a
+            // session that belongs to the new lifecycle.
+            return 'infrastructure';
+        }
+        if (record.retiredSession.sessionOwnerNodeRid !== this.nodeRid
+            || record.retiredSession.sessionOwnerNodeGeneration !== this.nodeGeneration
+            || record.retiredSession.sessionOwnerId !== this.nodeRid
+            || record.retiredSession.sessionOwnerLeaseGeneration !== this.nodeGeneration) {
+            return 'infrastructure';
+        }
+        const actor = authority.actor;
+        const key = replacementNoticeKey(record);
+        if (this.appliedReplacementNotices.has(key))
+            return 'infrastructure';
+        const deliveryKey = actorKey(actor);
+        const current = this.sessionDeliveries.get(deliveryKey);
+        const retired = this.retiredSessionDeliveries.get(sessionDeliveryKey({
+            actor,
+            sessionRid: record.retiredSession.sessionRid,
+            sessionOwnerNodeRid: this.nodeRid,
+            sessionOwnerNodeGeneration: record.retiredSession.sessionOwnerNodeGeneration,
+            sessionOwnerId: record.retiredSession.sessionOwnerId,
+            sessionOwnerLeaseGeneration: record.retiredSession.sessionOwnerLeaseGeneration,
+            bindingGeneration: record.retiredSession.retiredBindingGeneration,
+        }));
+        const delivery = current !== undefined
+            && exactRetiredDelivery(current.binding, record.retiredSession)
+            ? current
+            : retired !== undefined
+                && exactRetiredDelivery(retired.binding, record.retiredSession)
+                ? retired
+                : undefined;
+        if (delivery === undefined)
+            return 'infrastructure';
+        this.appliedReplacementNotices.add(key);
+        delivery.onBindingReplaced?.(actor.actorId, record.retiredSession, actor);
+        if (retired !== undefined) {
+            this.retiredSessionDeliveries.delete(sessionDeliveryKey(retired.binding));
+        }
+        return 'infrastructure';
+    }
+    sendBoundSessionReplacement(previous, actorAuthority) {
+        const ownerGeneration = previous.sessionOwnerNodeGeneration
+            ?? this.tryPeerGeneration(previous.sessionOwnerNodeRid);
+        if (ownerGeneration === undefined)
+            return;
+        const header = (0, service_stateful_wire_codec_1.encodeBoundSessionReplacedHeader)(actorAuthority, {
+            sessionOwnerNodeRid: previous.sessionOwnerNodeRid,
+            sessionOwnerNodeGeneration: ownerGeneration,
+            sessionOwnerId: previous.sessionOwnerId ?? previous.sessionOwnerNodeRid,
+            sessionOwnerLeaseGeneration: previous.sessionOwnerLeaseGeneration ?? ownerGeneration,
+            sessionRid: previous.sessionRid,
+            retiredBindingGeneration: previous.bindingGeneration
+        });
+        // submitOneWay owns the normal transport admission timeout. A replacement
+        // notice is one-way, so an unsuccessful admission has no caller terminal
+        // to complete and must not delay the already-completed bind.
+        void this.submitOneWay(previous.sessionOwnerNodeRid, [header]).catch(() => { });
+    }
+    enqueueSessionBindingTombstone(ingress, record) {
+        if (record.binding.state !== 'tombstone')
+            return;
+        const actor = record.actor.actor;
+        const current = this.registry.binding(actor);
+        const sourceGeneration = ingress.sourceNodeGeneration
+            ?? this.tryPeerGeneration(ingress.sourceRoutingId);
+        if (current === undefined
+            || sourceGeneration === undefined
+            || current.bindingGeneration !== record.binding.retiredGeneration
+            || current.sessionRid !== record.sessionRid
+            || current.sessionOwnerNodeRid !== ingress.sourceRoutingId
+            || current.sessionOwnerNodeGeneration !== sourceGeneration
+            || current.sessionOwnerId !== ingress.sourceRoutingId
+            || current.sessionOwnerLeaseGeneration !== sourceGeneration) {
+            this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Ok, 0);
+            return;
+        }
+        const delivery = this.sessionDeliveries.get(actorKey(actor));
+        const currentDelivery = delivery !== undefined
+            && sameSessionBinding(delivery.binding, current)
+            ? delivery
+            : undefined;
+        const accepted = this.enqueueSessionBindingRetirement(ingress, current, record.actor, (terminalResult, failureCode) => {
+            if (terminalResult === runtime_values_1.RequestResult.Ok) {
+                const turnCurrent = this.registry.binding(actor);
+                if (turnCurrent !== undefined && sameSessionBinding(turnCurrent, current)) {
+                    this.registry.unbindSession(actor, current.bindingGeneration, current.sessionRid, current.sessionOwnerNodeRid);
+                }
+                if (currentDelivery !== undefined
+                    && this.sessionDeliveries.get(actorKey(actor)) === currentDelivery) {
+                    this.sessionDeliveries.delete(actorKey(actor));
+                }
+            }
+            this.replyWire(ingress, record.correlation, terminalResult, failureCode);
+            return true;
+        });
+        if (!accepted) {
+            const result = failure((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Actor '${actor.actorId}' no longer accepts session binding tombstones.`));
+            this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+        }
+    }
+    enqueueSessionBindingRetirement(ingress, binding, actorAuthority, reply) {
+        const actor = binding.actor;
+        const sessionOwner = requireSessionOwnerIdentity(binding);
+        const applicationJob = requireApplicationJobOwner(ingress).takeInitial('infrastructure');
+        const accepted = this.raw.mailbox.tryEnqueue({
+            owner: `actor:${actor.actorId}\0${actor.generation}`,
+            domain: 'infrastructure',
+            parts: [Buffer.from([0x5a, 0x4d, 1, service_stateful_wire_codec_1.M6bServiceWireCommand.boundSessionBind, 0])],
+            sourceRoutingId: binding.sessionOwnerNodeRid,
+            stateful: {
+                receiveKind: service_runtime_contracts_1.ReceiveKind.ActorBinding,
+                operationKind: service_runtime_contracts_1.OperationKind.StreamUnbind,
+                targetActor: actor,
+                kindData: {
+                    kind: 'actorBinding',
+                    transition: 'tombstone',
+                    actor,
+                    actorNodeGeneration: actorAuthority.targetNodeGeneration,
+                    authorityOwnerGeneration: actorAuthority.authorityOwnerGeneration,
+                    ownerLeaseGeneration: actorAuthority.ownerLeaseGeneration,
+                    bindingGeneration: binding.bindingGeneration,
+                    sessionNodeRid: binding.sessionOwnerNodeRid,
+                    sessionRid: binding.sessionRid,
+                    sessionOwnerNodeGeneration: sessionOwner.nodeGeneration,
+                    sessionOwnerId: sessionOwner.ownerId,
+                    sessionOwnerLeaseGeneration: sessionOwner.leaseGeneration
+                },
+                reply
+            },
+            applicationJob
+        });
+        if (!accepted)
+            applicationJob.close();
+        return accepted;
+    }
+    async deliverBoundSession(ingress, record, payloadFrame) {
+        const delivery = this.sessionDeliveries.get(actorKey(record.actor.actor));
+        if (delivery === undefined
+            || delivery.binding.bindingGeneration !== record.expectedBindingGeneration
+            || payloadFrame === undefined
+            || ingress.sourceNodeGeneration === undefined
+            || !(0, routing_id_1.routingIdsEqual)(ingress.sourceRoutingId, record.actor.actor.nodeRid)
+            || ingress.sourceNodeGeneration !== record.actor.targetNodeGeneration) {
+            return 'protocolError';
+        }
+        const sessionRid = delivery.binding.sessionRid;
+        let retainedPayload = payloadFrame;
+        let settled = false;
+        const settle = () => {
+            if (settled)
+                return false;
+            settled = true;
+            retainedPayload = undefined;
+            return true;
+        };
+        const operation = {
+            deliver: async () => {
+                if (settled || retainedPayload === undefined)
+                    return false;
+                const delivered = await delivery.deliver(sessionRid, retainedPayload);
+                if (delivered)
+                    settle();
+                return delivered;
+            },
+            fail: (_error) => {
+                settle();
+            }
+        };
+        const decision = await delivery.bindingIngress?.retainOutbound({
+            actorId: record.actor.actor.actorId,
+            objectGeneration: record.actor.actor.generation,
+            actorNodeRid: record.actor.actor.nodeRid,
+            actorNodeGeneration: record.actor.targetNodeGeneration,
+            authorityOwnerGeneration: record.actor.authorityOwnerGeneration,
+            ownerLeaseGeneration: record.actor.ownerLeaseGeneration,
+            producerNodeRid: ingress.sourceRoutingId,
+            producerNodeGeneration: ingress.sourceNodeGeneration,
+            sessionIdentity: sessionRid,
+            bindingGeneration: record.expectedBindingGeneration
+        }, operation);
+        if (decision === 'retained')
+            return 'application';
+        if (decision === 'rejected') {
+            return 'protocolError';
+        }
+        try {
+            const delivered = await delivery.deliver(sessionRid, retainedPayload);
+            settle();
+            if (!delivered)
+                return 'protocolError';
+        }
+        catch (error) {
+            operation.fail(error);
+            // Remote command 36 is one-way: its source transport admission has
+            // already completed, so a later client delivery terminal is local to
+            // this session owner. Local fast paths still preserve the typed result.
+            if (ingress.sourceRoutingId !== this.nodeRid
+                && (0, runtime_values_1.isZLinkBackendResultError)(error)
+                && error.operation === 'submit') {
+                return 'application';
+            }
+            throw error;
+        }
+        return 'application';
+    }
+    enqueueApplicationFrame(ingress, owner, payloadFrame, stateful) {
+        return this.enqueueFrame('application', ingress, owner, payloadFrame, stateful);
+    }
+    enqueueLifecycleFrame(ingress, owner, payloadFrame, stateful) {
+        return this.enqueueFrame('infrastructure', ingress, owner, payloadFrame, stateful);
+    }
+    enqueueFrame(domain, ingress, owner, payloadFrame, stateful) {
+        const applicationJob = requireApplicationJobOwner(ingress).takeInitial(domain);
+        const accepted = this.raw.mailbox.tryEnqueue({
+            owner,
+            domain,
+            parts: [ingress.parts[0], payloadFrame],
+            sourceRoutingId: ingress.sourceRoutingId,
+            sourceRoute: ingress.sourceRoute,
+            ...(ingress.reply === undefined ? {} : { reply: ingress.reply }),
+            ...(ingress.requestSequence === undefined ? {} : { requestSequence: ingress.requestSequence }),
+            ...(stateful.correlation === undefined ? {} : { correlation: stateful.correlation }),
+            stateful,
+            applicationJob
+        });
+        if (accepted)
+            return domain;
+        applicationJob.close();
+        if (stateful.reply !== undefined) {
+            const result = failure((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Mailbox owner '${owner}' no longer accepts work on this runtime.`));
+            stateful.reply(result.terminalResult, result.failureCode);
+            return 'infrastructure';
+        }
+        return 'protocolError';
+    }
+    async enqueueLogicalMulticast(channelName, topic, sourceSpotId, payload, sourceNodeRid = this.nodeRid) {
+        const applicationJobOwner = await this.raw.reserveLocalIngress();
+        try {
+            await this.enqueueLogicalMulticastFrame(channelName, topic, sourceSpotId, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload), sourceNodeRid, applicationJobOwner);
+        }
+        finally {
+            applicationJobOwner.close();
+        }
+    }
+    async enqueueLogicalMulticastFrame(channelName, topic, sourceSpotId, payloadFrame, sourceNodeRid, applicationJobOwner) {
+        const targets = [...this.subscriptions.entries()]
+            .filter(([, values]) => [...values].some(value => {
+            const separator = value.indexOf('\0');
+            return value.slice(0, separator) === channelName
+                && topicMatches(value.slice(separator + 1), topic);
+        }))
+            .map(([spotId]) => spotId)
+            .sort();
+        for (const spotId of targets) {
+            const spot = this.registry.spot(spotId);
+            if (spot === undefined)
+                continue;
+            const applicationJob = await applicationJobOwner.acquire('application');
+            const accepted = this.raw.mailbox.tryEnqueue({
+                owner: `spot:${spotId}`,
+                domain: 'application',
+                parts: [
+                    (0, service_stateful_wire_codec_1.encodeLogicalMulticastHeader)(channelName, topic, sourceSpotId),
+                    payloadFrame
+                ],
+                sourceRoutingId: sourceNodeRid,
+                stateful: {
+                    receiveKind: service_runtime_contracts_1.ReceiveKind.SpotMulticast,
+                    operationKind: 0,
+                    sourceSpotId,
+                    channelName,
+                    topic,
+                    targetSpot: spot.ref
+                },
+                applicationJob
+            });
+            if (!accepted) {
+                applicationJob.close();
+                this.mailboxDropHandler?.({ kind: 'spot_multicast', owner: spotId });
+            }
+        }
+    }
+    enqueueActorControl(spotId, control, onTerminalCompletion) {
+        const header = Buffer.from([0x5a, 0x4d, 1, service_stateful_wire_codec_1.M6bServiceWireCommand.actorJoined, 0]);
+        let terminalAttempted = false;
+        void (async () => {
+            const applicationJobOwner = await this.raw.reserveLocalIngress();
+            let accepted = false;
+            try {
+                const applicationJob = applicationJobOwner.takeInitial('infrastructure');
+                accepted = this.raw.mailbox.tryEnqueue({
+                    owner: `spot:${spotId}`,
+                    domain: 'infrastructure',
+                    parts: [header],
+                    sourceRoutingId: this.nodeRid,
+                    stateful: {
+                        receiveKind: service_runtime_contracts_1.ReceiveKind.SpotControl,
+                        operationKind: 0,
+                        targetSpot: this.registry.spot(spotId)?.ref,
+                        kindData: control,
+                        ...(onTerminalCompletion === undefined ? {} : { onTerminalCompletion })
+                    },
+                    applicationJob
+                });
+                if (!accepted)
+                    applicationJob.close();
+            }
+            finally {
+                applicationJobOwner.close();
+            }
+            if (accepted)
+                return;
+            this.mailboxDropHandler?.({ kind: 'actor_control', owner: spotId });
+            terminalAttempted = true;
+            await onTerminalCompletion?.();
+        })().catch(async () => {
+            this.mailboxDropHandler?.({ kind: 'actor_control', owner: spotId });
+            if (!terminalAttempted) {
+                terminalAttempted = true;
+                await onTerminalCompletion?.();
+            }
+        });
+    }
+    enqueueActorBindingControl(ingress, binding, actorAuthority, reply) {
+        const actor = binding.actor;
+        const sessionOwner = requireSessionOwnerIdentity(binding);
+        const header = Buffer.from([0x5a, 0x4d, 1, service_stateful_wire_codec_1.M6bServiceWireCommand.boundSessionBind, 0]);
+        const applicationJob = requireApplicationJobOwner(ingress).takeInitial('infrastructure');
+        const accepted = this.raw.mailbox.tryEnqueue({
+            owner: `actor:${actor.actorId}\0${actor.generation}`,
+            domain: 'infrastructure',
+            parts: [header],
+            sourceRoutingId: this.nodeRid,
+            stateful: {
+                receiveKind: service_runtime_contracts_1.ReceiveKind.ActorBinding,
+                operationKind: 0,
+                targetActor: actor,
+                kindData: {
+                    kind: 'actorBinding',
+                    transition: 'active',
+                    actor,
+                    actorNodeGeneration: actorAuthority.targetNodeGeneration,
+                    authorityOwnerGeneration: actorAuthority.authorityOwnerGeneration,
+                    ownerLeaseGeneration: actorAuthority.ownerLeaseGeneration,
+                    bindingGeneration: binding.bindingGeneration,
+                    sessionNodeRid: binding.sessionOwnerNodeRid,
+                    sessionRid: binding.sessionRid,
+                    sessionOwnerNodeGeneration: sessionOwner.nodeGeneration,
+                    sessionOwnerId: sessionOwner.ownerId,
+                    sessionOwnerLeaseGeneration: sessionOwner.leaseGeneration
+                },
+                reply
+            },
+            applicationJob
+        });
+        if (!accepted) {
+            applicationJob.close();
+            this.mailboxDropHandler?.({ kind: 'actor_binding', owner: actor.actorId });
+        }
+        return accepted;
+    }
+    replyPort(ingress, correlation, operationKind) {
+        if (correlation === undefined)
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Request correlation is missing.');
+        return (terminalResult, failureCode, payload, tail) => {
+            this.replyWire(ingress, correlation, terminalResult, failureCode, payload, tail);
+            void operationKind;
+            return true;
+        };
+    }
+    replyWire(ingress, correlation, terminalResult, failureCode, payload, tail) {
+        this.raw.replyService(ingress, [
+            (0, service_stateful_wire_codec_1.encodeStatefulReply)(correlation, terminalResult, failureCode, tail),
+            ...(payload === undefined ? [] : [(0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)])
+        ]);
+    }
+    handleUserSpotOperation(ingress, record) {
+        if (ingress.requestSequence === undefined
+            || record.sourceNodeRid !== ingress.sourceRoutingId
+            || record.sourceNodeGeneration !== this.peerGeneration(ingress.sourceRoutingId)
+            || (record.kind === 'actorCreate' && record.reservation.pendingCapacityDelta !== 1)) {
+            return 'protocolError';
+        }
+        const target = record.kind === 'userSpotCreate' || record.kind === 'actorCreate'
+            ? record.reservation
+            : record.target;
+        if (target.targetNodeRid !== this.nodeRid
+            || target.targetNodeGeneration !== this.nodeGeneration) {
+            this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Conflict, SPOT_MOVING);
+            return 'infrastructure';
+        }
+        const operationKey = [
+            record.sourceNodeRid,
+            record.sourceNodeGeneration,
+            record.operation.high,
+            record.operation.low
+        ].join('\0');
+        const encodedRequest = userSpotOperationFingerprint(record);
+        let admitted = this.admittedUserSpotOperations.get(operationKey);
+        if (admitted?.settled === true
+            && operationReplayExpired(admitted.replayExpiresAtMs)) {
+            this.admittedUserSpotOperations.delete(operationKey);
+            admitted = undefined;
+        }
+        if (admitted !== undefined && admitted.request !== encodedRequest) {
+            return 'protocolError';
+        }
+        if (admitted === undefined) {
+            if (record.deadlineUnixMs < BigInt(Date.now())) {
+                this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.TimedOut, 0);
+                return 'infrastructure';
+            }
+            if (this.admittedUserSpotOperations.size >= USER_SPOT_OPERATION_CAPACITY) {
+                this.releaseExpiredUserSpotOperations();
+            }
+            if (this.admittedUserSpotOperations.size >= USER_SPOT_OPERATION_CAPACITY) {
+                this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Busy, 0);
+                return 'infrastructure';
+            }
+            const replayExpiresAtMs = performance.now()
+                + Number(record.deadlineUnixMs - BigInt(Date.now()))
+                + USER_SPOT_OPERATION_REPLAY_RETENTION_MS;
+            const handler = this.userSpotOperationHandler;
+            const result = handler === undefined
+                ? Promise.resolve({
+                    terminalResult: runtime_values_1.RequestResult.InvalidState,
+                    failureCode: 0
+                })
+                : this.executeUserSpotOperation(handler, record);
+            admitted = {
+                request: encodedRequest,
+                replayExpiresAtMs,
+                result,
+                settled: false
+            };
+            this.admittedUserSpotOperations.set(operationKey, admitted);
+            void result.finally(() => {
+                const current = this.admittedUserSpotOperations.get(operationKey);
+                if (current?.result === result)
+                    current.settled = true;
+            }).catch(() => undefined);
+        }
+        void admitted.result.then(result => {
+            if (this.closed)
+                return;
+            this.raw.replyService(ingress, [
+                (0, service_stateful_wire_codec_1.encodeStatefulReply)(record.correlation, result.terminalResult, result.failureCode, result.tail),
+                ...(result.payload === undefined
+                    ? []
+                    : [(0, service_wire_m6a_codec_1.encodeApplicationPayload)(result.payload)])
+            ]);
+        }, error => {
+            if (this.closed)
+                return;
+            const failed = failure(error);
+            this.replyWire(ingress, record.correlation, failed.terminalResult, failed.failureCode);
+        });
+        return 'infrastructure';
+    }
+    releaseExpiredUserSpotOperations() {
+        for (const [key, operation] of this.admittedUserSpotOperations) {
+            if (operation.settled && operationReplayExpired(operation.replayExpiresAtMs)) {
+                this.admittedUserSpotOperations.delete(key);
+            }
+        }
+    }
+    async executeUserSpotOperation(handler, record) {
+        const deadline = userSpotDeadline(record.deadlineUnixMs);
+        try {
+            const result = record.kind === 'userSpotCreate'
+                ? await handler.create(record, deadline.signal)
+                : record.kind === 'userSpotClose'
+                    ? await handler.close(record, deadline.signal)
+                    : handler.createActor === undefined
+                        ? {
+                            terminalResult: runtime_values_1.RequestResult.InvalidState,
+                            failureCode: 0
+                        }
+                        : await handler.createActor(record, deadline.signal);
+            if (result.terminalResult === runtime_values_1.RequestResult.Ok
+                && (result.tail === undefined
+                    || result.tail.kind !== record.kind)) {
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError('User Spot success result omits its operation tail.');
+            }
+            return result;
+        }
+        catch (error) {
+            const failed = failure(error);
+            return failed;
+        }
+        finally {
+            deadline.close();
+        }
+    }
+    async requestUserSpotOperation(targetNodeRid, header, correlation, operationKind, timeoutMs) {
+        const parts = await this.requestDurableOperation(targetNodeRid, [header], correlation, operationKind, performance.now() + Math.max(1, timeoutMs));
+        // A received envelope, including a decode failure, ends sender replay.
+        try {
+            if (parts.length < 1 || parts.length > 2) {
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Invalid creation operation reply parts.');
+            }
+            const decoded = (0, service_stateful_wire_codec_1.decodeStatefulReply)(parts[0], correlation, operationKind, parts.length >= 2);
+            if (decoded.terminalResult !== runtime_values_1.RequestResult.Ok
+                && parts.length !== 1) {
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Failed creation operation reply carries a payload.');
+            }
+            if (operationKind === 'userSpotClose'
+                && parts.length !== 1) {
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError('User Spot close reply carries a payload.');
+            }
+            return {
+                terminalResult: decoded.terminalResult,
+                failureCode: decoded.failureCode,
+                ...(decoded.tail === undefined ? {} : { tail: decoded.tail }),
+                ...(parts.length === 2
+                    ? { payload: (0, service_wire_m6a_codec_1.decodeApplicationPayload)(parts[1]) }
+                    : {})
+            };
+        }
+        catch (error) {
+            throw (0, framework_errors_internal_1.translateWireReplyDecodeError)(error);
+        }
+    }
+    async requestDurableOperation(targetNodeRid, parts, correlation, operationKind, deadlineMs) {
+        const stop = new AbortController();
+        const unobserve = this.raw.observePeerConnectionIntentRemoved(nodeRoutingId => {
+            if (nodeRoutingId === targetNodeRid) {
+                stop.abort((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `${operationKind} target node lifecycle ended.`, true));
+            }
+        });
+        let wasAdmitted = false;
+        try {
+            // Only durable lifecycle operations replay these frozen frames. Received
+            // envelopes leave this loop before decoding, including failure terminals.
+            for (;;) {
+                this.requireOpen();
+                stop.signal.throwIfAborted();
+                const remainingMs = Math.ceil(deadlineMs - performance.now());
+                if (remainingMs <= 0)
+                    throw durableOperationExhausted(operationKind, wasAdmitted);
+                try {
+                    return await (0, abort_1.awaitWithAbort)(targetNodeRid === this.nodeRid
+                        ? this.requestLocalInfrastructure(parts[0], correlation, remainingMs)
+                        : this.raw.requestService(targetNodeRid, parts, remainingMs), stop.signal);
+                }
+                catch (error) {
+                    stop.signal.throwIfAborted();
+                    if (!durableRequestCanReplay(error))
+                        throw error;
+                    if (durableRequestWasAdmitted(error))
+                        wasAdmitted = true;
+                    const retryDelayMs = Math.min(20, deadlineMs - performance.now());
+                    if (retryDelayMs <= 0) {
+                        throw durableOperationExhausted(operationKind, wasAdmitted, error);
+                    }
+                    let timer;
+                    try {
+                        await (0, abort_1.awaitWithAbort)(new Promise(resolve => {
+                            timer = setTimeout(resolve, retryDelayMs);
+                        }), stop.signal);
+                    }
+                    finally {
+                        if (timer !== undefined)
+                            clearTimeout(timer);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            stop.signal.throwIfAborted();
+            throw error;
+        }
+        finally {
+            unobserve();
+        }
+    }
+    requestLocalInfrastructure(header, requestSequence, timeoutMs) {
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const fail = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(error);
+            };
+            const timer = setTimeout(() => {
+                fail(new Error('Local infrastructure request timed out.'));
+            }, timeoutMs);
+            const finish = (parts) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve(parts.map(part => Buffer.from(part)));
+            };
+            void (async () => {
+                const applicationJobOwner = await this.raw.reserveLocalIngress();
+                try {
+                    const result = await this.ingress({
+                        command: header[3],
+                        flags: header[4],
+                        sourceRoutingId: this.nodeRid,
+                        requestSequence,
+                        reply: finish,
+                        parts: [header],
+                        applicationJobOwner
+                    });
+                    if (result !== 'infrastructure') {
+                        fail(new service_wire_m6a_codec_1.ServiceWireProtocolError(`Local infrastructure request was rejected as '${result ?? 'unsupported'}'.`));
+                    }
+                }
+                finally {
+                    applicationJobOwner.close();
+                }
+            })().catch(fail);
+        });
+    }
+    async submitOneWay(targetNodeRid, parts) {
+        this.requireOpen();
+        if (targetNodeRid === this.nodeRid) {
+            const applicationJobOwner = await this.raw.reserveLocalIngress();
+            if ((0, execution_1.captureZLinkExecutionTurn)() !== undefined) {
+                //  The sender is inside a Spot serial turn. Running ingress inline
+                //  would inherit that turn, so a send to an object of the same
+                //  serial owner nests a turn and is rejected with "cannot
+                //  implicitly execute another turn for the same owner". A one-way
+                //  submit completes at admission, exactly like the remote path
+                //  (sendService returns once the transport accepts the frame), so
+                //  run the ingress detached like a frame arriving on the receive
+                //  pump (spec 26 §2.1 `sent` boundary; spec 33 pre-handler flow).
+                void ServiceStatefulRuntime.detachedIngressScope(async () => {
+                    try {
+                        await this.ingress({
+                            command: parts[0][3],
+                            flags: parts[0][4],
+                            sourceRoutingId: this.nodeRid,
+                            sourceNodeGeneration: this.nodeGeneration,
+                            parts,
+                            applicationJobOwner
+                        });
+                    }
+                    catch {
+                        //  Dispatch failures already produced their
+                        //  zlink.dispatch_error record; a one-way submit has no caller
+                        //  completion to fail, matching the remote pump's handling.
+                    }
+                    finally {
+                        applicationJobOwner.close();
+                    }
+                });
+                return runtime_values_1.SubmitResult.Ok;
+            }
+            try {
+                const result = await this.ingress({
+                    command: parts[0][3],
+                    flags: parts[0][4],
+                    sourceRoutingId: this.nodeRid,
+                    sourceNodeGeneration: this.nodeGeneration,
+                    parts,
+                    applicationJobOwner
+                });
+                return result === 'application' || result === 'infrastructure'
+                    ? runtime_values_1.SubmitResult.Ok
+                    : runtime_values_1.SubmitResult.InvalidState;
+            }
+            catch (error) {
+                if ((0, runtime_values_1.isZLinkBackendResultError)(error) && error.operation === 'submit') {
+                    return error.result;
+                }
+                throw error;
+            }
+            finally {
+                applicationJobOwner.close();
+            }
+        }
+        return await this.raw.sendService(targetNodeRid, parts)
+            ? runtime_values_1.SubmitResult.Ok
+            : runtime_values_1.SubmitResult.NotConnected;
+    }
+    submitRequest(pending, targetNodeRid, parts, timeoutMs, operationKind, actor) {
+        if (targetNodeRid === this.nodeRid) {
+            const deadlineUnixMs = BigInt(Date.now() + Math.max(0, timeoutMs));
+            void (async () => {
+                const applicationJobOwner = await this.raw.reserveLocalIngress();
+                const localIngress = {
+                    command: parts[0][3],
+                    flags: parts[0][4],
+                    sourceRoutingId: this.nodeRid,
+                    requestSequence: pending.id,
+                    parts,
+                    applicationJobOwner
+                };
+                try {
+                    this.submitLocalRequest(localIngress, pending, operationKind, actor, deadlineUnixMs);
+                }
+                catch (error) {
+                    this.operations.reply(pending.id, failure(error));
+                }
+                finally {
+                    applicationJobOwner.close();
+                }
+            })().catch(error => this.operations.reply(pending.id, failure(error)));
+            return;
+        }
+        void this.raw.requestService(targetNodeRid, parts, timeoutMs).then(reply => this.completeRemoteReply(pending, targetNodeRid, operationKind, actor, reply), error => this.operations.fail(pending.id, error));
+    }
+    submitActorJoin(pending, actor, targetNodeRid, target, payload, deadlineMs, canonical) {
+        const actorRoute = canonical === undefined
+            ? this.tryActorFence(actor)
+            : this.acceptCanonicalActorFence(actor, canonical.actorFence);
+        if (target === undefined || actorRoute === undefined) {
+            this.operations.reply(pending.id, {
+                terminalResult: runtime_values_1.RequestResult.NotFound,
+                failureCode: ACTOR_ROUTE_STALE
+            });
+            return;
+        }
+        if (canonical !== undefined) {
+            this.canonicalActorJoinHandoffs.set(pending.id, (0, actor_join_recovery_codec_1.canonicalActorJoinHandoffId)({
+                sourceActorNodeRid: (0, actor_join_recovery_codec_1.routingIdBytes)(actor.nodeRid),
+                actorId: actor.actorId,
+                actorGeneration: actor.generation,
+                sourceActorNodeGeneration: actorRoute.targetNodeGeneration,
+                correlation: pending.id
+            }));
+        }
+        let parts;
+        try {
+            parts = (0, service_wire_pilot_codec_generated_1.encodeActorJoin28)({
+                correlation: pending.id,
+                actor: {
+                    id: actor.actorId,
+                    generation: actor.generation,
+                    targetNodeRid: (0, actor_join_recovery_codec_1.routingIdBytes)(actor.nodeRid),
+                    targetNodeGeneration: actorRoute.targetNodeGeneration,
+                    expectedAuthorityOwnerGeneration: actorRoute.authorityOwnerGeneration,
+                    expectedOwnerLeaseGeneration: actorRoute.ownerLeaseGeneration
+                },
+                entry: target.spot.spotId === targetNodeRid,
+                targetSpot: {
+                    id: target.spot.spotId,
+                    generation: target.spot.generation,
+                    targetNodeRid: (0, actor_join_recovery_codec_1.routingIdBytes)(target.targetNodeRid),
+                    targetNodeGeneration: target.targetNodeGeneration,
+                    expectedAuthorityOwnerGeneration: target.authorityOwnerGeneration,
+                    expectedOwnerLeaseGeneration: target.ownerLeaseGeneration
+                },
+                ...(payload === undefined ? {} : { payload })
+            }).map(frame => Buffer.from(frame));
+        }
+        catch (error) {
+            this.canonicalActorJoinHandoffs.delete(pending.id);
+            this.operations.fail(pending.id, error);
+            return;
+        }
+        if (targetNodeRid === this.nodeRid) {
+            this.submitRequest(pending, targetNodeRid, parts, Math.max(0, Math.ceil(deadlineMs - performance.now())), 'actorJoin', actor);
+            return;
+        }
+        void this.requestDurableOperation(targetNodeRid, parts, pending.id, 'actorJoin', deadlineMs).then(reply => this.completeRemoteReply(pending, targetNodeRid, 'actorJoin', actor, reply), error => {
+            this.canonicalActorJoinHandoffs.delete(pending.id);
+            this.operations.fail(pending.id, error);
+        });
+    }
+    submitLocalRequest(ingress, pending, operationKind, actor, deadlineUnixMs) {
+        const canonicalActorJoin = operationKind === 'actorJoin'
+            ? (0, service_wire_pilot_codec_generated_1.decodeActorJoin28)(ingress.parts)
+            : undefined;
+        const decoded = canonicalActorJoin === undefined
+            ? (0, service_stateful_wire_codec_1.decodeStatefulHeader)(ingress.parts[0])
+            : statefulActorJoinFromCanonical(canonicalActorJoin);
+        const payloadFrame = canonicalActorJoin?.payload === undefined
+            ? (ingress.parts.length < 2 ? undefined : ingress.parts[1])
+            : (0, service_wire_m6a_codec_1.encodeApplicationPayload)({
+                packetName: canonicalActorJoin.payload.packetName,
+                contentType: canonicalActorJoin.payload.contentType,
+                payload: Buffer.from(canonicalActorJoin.payload.payload)
+            });
+        if (decoded.kind === 'actorLookup') {
+            const found = this.registry.actor(decoded.actorId);
+            this.operations.reply(pending.id, found === undefined
+                ? { terminalResult: runtime_values_1.RequestResult.NotFound, failureCode: ACTOR_ROUTE_NOT_FOUND }
+                : {
+                    terminalResult: runtime_values_1.RequestResult.Ok,
+                    failureCode: 0,
+                    kindData: lookupKindData(found)
+                });
+            return;
+        }
+        if (decoded.kind === 'actorDestroy') {
+            try {
+                this.registry.destroyActor(decoded.actor.actor);
+                this.operations.reply(pending.id, { terminalResult: runtime_values_1.RequestResult.Ok, failureCode: 0 });
+            }
+            catch (error) {
+                this.operations.reply(pending.id, failure(error));
+            }
+            return;
+        }
+        const localReply = (terminalResult, failureCode, replyPayload, tail) => this.operations.reply(pending.id, this.resultFromReply(terminalResult, failureCode, replyPayload, tail, this.nodeRid, actor));
+        if (decoded.kind === 'spotRequest') {
+            this.validateDirectSpotFence(decoded.target);
+            this.enqueueApplicationFrame(ingress, `spot:${decoded.target.spot.spotId}`, payloadFrame, {
+                receiveKind: service_runtime_contracts_1.ReceiveKind.SpotRequest,
+                operationKind: service_runtime_contracts_1.OperationKind.SpotRequest,
+                correlation: decoded.correlation,
+                sourceSpotId: decoded.sourceSpotId,
+                targetSpot: decoded.target.spot,
+                reply: localReply
+            });
+            return;
+        }
+        if (decoded.kind === 'actorRequest') {
+            const current = decoded.boundSession === undefined
+                ? this.validateActorMessageFence(decoded.target)
+                : this.validateActorFence(decoded.target);
+            this.enqueueApplicationFrame(ingress, `actor:${current.ref.actorId}\0${current.ref.generation}`, payloadFrame, {
+                receiveKind: service_runtime_contracts_1.ReceiveKind.ActorRequest,
+                operationKind: service_runtime_contracts_1.OperationKind.ActorRequest,
+                correlation: decoded.correlation,
+                targetActor: current.ref,
+                ...(decoded.sourceActor === undefined ? {} : { sourceActor: decoded.sourceActor }),
+                ...(decoded.boundSession === undefined
+                    ? {}
+                    : { sourceBindingGeneration: decoded.boundSession.bindingGeneration }),
+                reply: localReply
+            });
+            return;
+        }
+        if (decoded.kind === 'actorJoin') {
+            this.validateSpotFence(decoded.target);
+            const previous = this.registry.actor(decoded.actor.actor.actorId);
+            const targetSpotKind = this.registry.spot(decoded.target.spot.spotId)?.kind;
+            let actorJoinReplyAccepted = false;
+            let completeOnJoinDispatchTerminal;
+            const control = {
+                kind: 'actorControl',
+                lifecycleKind: service_runtime_contracts_1.ActorLifecycleKind.Joined,
+                previousActor: previous?.ref ?? decoded.actor.actor,
+                currentActor: decoded.actor.actor,
+                previousSpotId: previous?.spot.spotId ?? null,
+                currentSpotId: decoded.target.spot.spotId,
+                previousSpotGeneration: previous?.spot.generation ?? 0n,
+                currentSpotGeneration: decoded.target.spot.generation,
+                previousMembershipEpoch: previous?.membershipEpoch ?? 0n,
+                currentMembershipEpoch: (previous?.membershipEpoch ?? 0n) + 1n,
+                resultCode: 0
+            };
+            this.enqueueLifecycleFrame(ingress, `spot:${decoded.target.spot.spotId}`, payloadFrame ?? (0, service_wire_m6a_codec_1.encodeApplicationPayload)(emptyPayload()), {
+                receiveKind: service_runtime_contracts_1.ReceiveKind.SpotControl,
+                operationKind: service_runtime_contracts_1.OperationKind.ActorJoin,
+                correlation: decoded.correlation,
+                targetSpot: decoded.target.spot,
+                targetActor: decoded.actor.actor,
+                kindData: control,
+                ...(canonicalActorJoin?.payload === undefined
+                    ? {}
+                    : {
+                        canonicalApplicationPayload: {
+                            packetName: canonicalActorJoin.payload.packetName,
+                            contentType: canonicalActorJoin.payload.contentType,
+                            payload: Buffer.from(canonicalActorJoin.payload.payload)
+                        }
+                    }),
+                isPending: () => this.operations.isPending(pending.id),
+                ...(deadlineUnixMs === undefined ? {} : { deadlineUnixMs }),
+                onTerminalCompletion: () => completeOnJoinDispatchTerminal?.(),
+                reply: (terminalResult, failureCode, replyPayload, tail) => {
+                    if (actorJoinReplyAccepted)
+                        return false;
+                    const acceptedJoin = terminalResult === runtime_values_1.RequestResult.Ok
+                        && tail?.kind === 'actorJoin'
+                        && tail.joinResult === 0;
+                    if (acceptedJoin && this.operations.isPending(pending.id)) {
+                        // Commit membership now, but keep the source operation behind
+                        // target OnJoinedActor. Entry finishes on this record; User
+                        // Spot lifecycle finishes on the Joined control below.
+                        actorJoinReplyAccepted = true;
+                        let completed = false;
+                        const completeReply = () => {
+                            if (completed)
+                                return;
+                            completed = true;
+                            localReply(terminalResult, failureCode, replyPayload, tail);
+                        };
+                        this.commitJoinedActor(decoded.actor.actor, decoded.target.spot, control.currentMembershipEpoch, targetSpotKind === 'user' ? completeReply : undefined);
+                        if (targetSpotKind === 'entry') {
+                            completeOnJoinDispatchTerminal = completeReply;
+                        }
+                        else if (targetSpotKind !== 'user') {
+                            completeReply();
+                        }
+                        return true;
+                    }
+                    const acceptedReply = localReply(terminalResult, failureCode, replyPayload, tail);
+                    if (acceptedReply)
+                        actorJoinReplyAccepted = true;
+                    return acceptedReply;
+                }
+            });
+            return;
+        }
+        if (decoded.kind === 'boundSessionBind') {
+            try {
+                const current = this.validateActorFence(decoded.actor);
+                if (decoded.binding.state === 'active') {
+                    this.registry.installSessionBinding((0, service_stateful_wire_codec_1.sessionBindingFromWire)(current.ref, decoded.sessionRid, this.nodeRid, decoded.binding.generation, current.membershipEpoch));
+                }
+                else {
+                    this.registry.unbindSession(current.ref, decoded.binding.retiredGeneration, decoded.sessionRid, this.nodeRid);
+                }
+                this.operations.reply(pending.id, { terminalResult: runtime_values_1.RequestResult.Ok, failureCode: 0 });
+            }
+            catch (error) {
+                this.operations.reply(pending.id, failure(error));
+            }
+            return;
+        }
+        if (decoded.kind === 'instanceSpot') {
+            if (decoded.activation === 'missing' && this.asyncInstanceAuthority !== undefined) {
+                void this.continueMissingInstanceActivation(ingress, decoded, payloadFrame, localReply);
+                return;
+            }
+            try {
+                const activation = this.requireInstanceActivation(ingress, decoded);
+                this.enqueueApplicationFrame(ingress, `spot:${activation.ref.spotId}`, payloadFrame, {
+                    receiveKind: service_runtime_contracts_1.ReceiveKind.InstanceSpotActivation,
+                    operationKind: service_runtime_contracts_1.OperationKind.InstanceSpotRequest,
+                    correlation: pending.id,
+                    ...(decoded.sourceSpotId === undefined ? {} : { sourceSpotId: decoded.sourceSpotId }),
+                    targetSpot: activation.ref,
+                    reply: localReply
+                });
+            }
+            catch (error) {
+                this.operations.reply(pending.id, failure(error));
+            }
+            return;
+        }
+        this.operations.reply(pending.id, {
+            terminalResult: runtime_values_1.RequestResult.ProtocolError,
+            failureCode: 0
+        });
+        void operationKind;
+    }
+    completeRemoteReply(pending, targetNodeRid, operationKind, actor, reply) {
+        const canonicalActorJoinHandoffId = operationKind === 'actorJoin'
+            ? this.canonicalActorJoinHandoffs.get(pending.id)
+            : undefined;
+        try {
+            if (reply.length < 1 || reply.length > 2)
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Invalid M6B reply parts.');
+            const decoded = (0, service_stateful_wire_codec_1.decodeStatefulReply)(reply[0], pending.id, operationKind, reply.length >= 2);
+            const payload = reply.length < 2 ? undefined : (0, service_wire_m6a_codec_1.decodeApplicationPayload)(reply[1]);
+            this.operations.reply(pending.id, this.resultFromReply(decoded.terminalResult, decoded.failureCode, payload, decoded.tail, targetNodeRid, actor, canonicalActorJoinHandoffId));
+        }
+        catch (error) {
+            //  Spec 32-framework-error-model:58-60, 91-92 — an unprocessable remote
+            //  reply (decode/shape failure) fails the awaiting operation with a
+            //  Framework ProtocolError instead of leaking the codec's plain Error.
+            this.operations.fail(pending.id, (0, framework_errors_internal_1.translateWireReplyDecodeError)(error));
+        }
+        finally {
+            if (operationKind === 'actorJoin') {
+                this.canonicalActorJoinHandoffs.delete(pending.id);
+            }
+        }
+    }
+    resultFromReply(terminalResult, failureCode, payload, tail, targetNodeRid, actor, canonicalActorJoinHandoffId) {
+        let kindData;
+        if (tail?.kind === 'actorLookup') {
+            const resolvedActor = { ...tail.actor, nodeRid: targetNodeRid };
+            this.rememberActorRoute({
+                actor: resolvedActor,
+                targetNodeGeneration: this.peerGeneration(targetNodeRid),
+                authorityOwnerGeneration: tail.authorityOwnerGeneration,
+                ownerLeaseGeneration: this.peerGeneration(targetNodeRid)
+            });
+            kindData = {
+                kind: 'actorLookupCompletion',
+                location: {
+                    actor: resolvedActor,
+                    spotId: tail.spot.spotId,
+                    spotGeneration: tail.spot.generation,
+                    membershipEpoch: tail.membershipEpoch
+                }
+            };
+        }
+        else if (tail?.kind === 'actorJoin' && actor !== undefined) {
+            const joinedActor = { ...actor, nodeRid: targetNodeRid };
+            const spot = tail.spot;
+            kindData = {
+                kind: 'actorJoinCompletion',
+                joinResult: tail.joinResult,
+                actor: joinedActor,
+                location: {
+                    actor: joinedActor,
+                    spotId: spot?.spotId ?? null,
+                    spotGeneration: spot?.generation ?? 0n,
+                    membershipEpoch: tail.membershipEpoch ?? 1n
+                },
+                ...(tail.receiveChunkLimitBytes === undefined
+                    ? {}
+                    : { receiveChunkLimitBytes: tail.receiveChunkLimitBytes }),
+                ...(payload === undefined ? {} : { replyContentType: payload.contentType }),
+                ...(canonicalActorJoinHandoffId === undefined
+                    ? {}
+                    : { canonicalHandoffId: canonicalActorJoinHandoffId })
+            };
+        }
+        return {
+            terminalResult,
+            failureCode,
+            ...(payload === undefined ? {} : { payload }),
+            ...(tail?.kind === 'streamBind'
+                ? {
+                    streamBinding: {
+                        bindingGeneration: tail.bindingGeneration,
+                        authorityOwnerGeneration: tail.authorityOwnerGeneration
+                    }
+                }
+                : {}),
+            ...(kindData === undefined ? {} : { kindData })
+        };
+    }
+    validateActorFence(fence) {
+        if (fence.actor.nodeRid !== this.nodeRid || fence.targetNodeGeneration !== this.nodeGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('actor', fence.actor.actorId);
+        }
+        const actor = this.registry.requireActor(fence.actor);
+        if (actor.authorityOwnerGeneration !== fence.authorityOwnerGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('actor', fence.actor.actorId);
+        }
+        return actor;
+    }
+    validateActorMessageFence(fence) {
+        if (fence.actor.nodeRid !== this.nodeRid || fence.targetNodeGeneration !== this.nodeGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('actor', fence.actor.actorId);
+        }
+        const actor = this.registry.actor(fence.actor.actorId);
+        if (actor === undefined) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound, `Actor '${fence.actor.actorId}' has no current Ready authority.`);
+        }
+        return actor;
+    }
+    validateSpotFence(fence) {
+        if (fence.targetNodeRid !== this.nodeRid || fence.targetNodeGeneration !== this.nodeGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', fence.spot.spotId);
+        }
+        const spot = this.registry.requireSpot(fence.spot);
+        if (spot.authorityOwnerGeneration !== fence.authorityOwnerGeneration) {
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', fence.spot.spotId);
+        }
+        return spot;
+    }
+    validateDirectSpotFence(fence) {
+        const spot = this.registry.spot(fence.spot.spotId);
+        if (spot === undefined) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound, `Spot '${fence.spot.spotId}' has no current Ready authority.`);
+        }
+        if (spot.state !== 'ready') {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${fence.spot.spotId}' is not Ready.`);
+        }
+        if (fence.targetNodeRid !== this.nodeRid || fence.targetNodeGeneration !== this.nodeGeneration) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${fence.spot.spotId}' targets an unavailable owner route.`);
+        }
+        if (spot.kind === 'entry') {
+            if (!isEntrySpotFence(fence)) {
+                throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Entry Spot '${fence.spot.spotId}' has an invalid owner fence.`);
+            }
+            return spot;
+        }
+        const current = this.directSpotRoutes.get(directSpotKey(spot.ref.spotId));
+        if (current === undefined) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${fence.spot.spotId}' has no current owner route.`);
+        }
+        if (current.targetNodeRid !== this.nodeRid
+            || current.targetNodeGeneration !== this.nodeGeneration
+            || current.ownerLeaseGeneration !== fence.ownerLeaseGeneration
+            || (current.spot.generation === fence.spot.generation
+                && (current.authorityOwnerGeneration !== fence.authorityOwnerGeneration))) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${fence.spot.spotId}' has a stale owner fence.`);
+        }
+        return spot;
+    }
+    holdOrRelaySpotMessage(ingress, wire) {
+        const state = this.spotMessageFollow.get(spotKey(wire.target.spot));
+        if (state === undefined || !sameDirectSpotRoute(state.source, wire.target)) {
+            return undefined;
+        }
+        if (state.expiresAtMs !== undefined && state.expiresAtMs <= performance.now()) {
+            this.failExpiredSpotMessageFollow(state);
+            return undefined;
+        }
+        const bytes = ingress.parts.reduce((sum, part) => sum + part.byteLength, 0);
+        state.queued.push({
+            ingress: shareIngressOwnership(ingress),
+            wire,
+            bytes
+        });
+        state.queuedCount += 1;
+        state.queuedBytes += bytes;
+        if (state.target !== undefined)
+            void this.drainSpotMessageFollow(state);
+        return 'application';
+    }
+    restoreSpotMessageFollowRecord(retained) {
+        const { ingress, wire } = retained;
+        this.validateDirectSpotFence(wire.target);
+        return this.enqueueApplicationFrame(ingress, `spot:${wire.target.spot.spotId}`, ingress.parts[1], {
+            receiveKind: wire.kind === 'spotSend' ? service_runtime_contracts_1.ReceiveKind.SpotSend : service_runtime_contracts_1.ReceiveKind.SpotRequest,
+            operationKind: wire.kind === 'spotRequest' ? service_runtime_contracts_1.OperationKind.SpotRequest : 0,
+            ...(wire.correlation === undefined ? {} : { correlation: wire.correlation }),
+            sourceSpotId: wire.sourceSpotId,
+            targetSpot: wire.target.spot,
+            ...(wire.kind === 'spotRequest'
+                ? { reply: this.replyPort(ingress, wire.correlation, 'spotRequest') }
+                : {})
+        });
+    }
+    async drainSpotMessageFollow(state) {
+        if (state.draining || state.target === undefined)
+            return;
+        state.draining = true;
+        try {
+            while (state.queuedCount > 0 && this.spotMessageFollow.get(state.seal.key) === state) {
+                if (state.expiresAtMs === undefined || state.expiresAtMs <= performance.now()) {
+                    this.failExpiredSpotMessageFollow(state);
+                    return;
+                }
+                const current = this.peekSpotMessageFollow(state);
+                try {
+                    const parts = [
+                        (0, service_stateful_wire_codec_1.encodeSpotHeader)(current.wire.kind, current.wire.sourceSpotId, state.target, current.wire.correlation),
+                        current.ingress.parts[1]
+                    ];
+                    if (current.wire.kind === 'spotSend') {
+                        if (!await this.raw.sendService(state.target.targetNodeRid, parts))
+                            continue;
+                    }
+                    else {
+                        try {
+                            const remainingMs = Math.max(1, Math.min(30_000, Math.ceil(state.expiresAtMs - performance.now())));
+                            const reply = await this.raw.requestService(state.target.targetNodeRid, parts, remainingMs);
+                            this.raw.replyService(current.ingress, reply);
+                        }
+                        catch (error) {
+                            const result = failure(error);
+                            this.replyWire(current.ingress, current.wire.correlation, result.terminalResult, result.failureCode);
+                        }
+                    }
+                    await this.notifySpotMessageFollowSource(state, current);
+                }
+                finally {
+                    if (this.peekSpotMessageFollow(state) === current) {
+                        this.takeSpotMessageFollow(state);
+                        state.queuedBytes -= current.bytes;
+                    }
+                }
+            }
+        }
+        finally {
+            state.draining = false;
+        }
+    }
+    async notifySpotMessageFollowSource(state, current) {
+        const target = state.target;
+        const suppressionFence = state.suppressionFence;
+        if (target === undefined || suppressionFence === undefined)
+            return;
+        const claim = this.spotMessageFollowSuppression.begin(suppressionFence);
+        if (claim === undefined)
+            return;
+        const operationLow = current.ingress.requestSequence !== undefined
+            && current.ingress.requestSequence !== 0n
+            ? current.ingress.requestSequence
+            : this.nextMessageFollowOperation++;
+        const accepted = await this.raw.sendService(current.ingress.sourceRoutingId, [(0, service_stateful_wire_codec_1.encodeMessageFollowHeader)({
+                source: messageFollowSpotRoute(state.source),
+                target: messageFollowSpotRoute(target),
+                hopCount: 1,
+                queuedMessages: Math.min(state.queuedCount, 0xffff_ffff),
+                queuedBytes: Math.min(state.queuedBytes, 0xffff_ffff),
+                originalOperation: {
+                    high: this.nodeGeneration,
+                    low: operationLow
+                },
+                originalReplyRouteId: current.ingress.requestSequence ?? 0n
+            })]);
+        if (accepted) {
+            this.spotMessageFollowSuppression.markSent(claim);
+        }
+        else {
+            this.spotMessageFollowSuppression.abort(claim);
+        }
+    }
+    failExpiredSpotMessageFollow(state) {
+        this.removeSpotMessageFollow(state);
+        while (state.queuedCount > 0) {
+            const current = this.peekSpotMessageFollow(state);
+            if (current.wire.kind === 'spotRequest') {
+                const result = failure(new service_stateful_registry_1.ServiceStaleGenerationError('spot', current.wire.target.spot.spotId));
+                this.replyWire(current.ingress, current.wire.correlation, result.terminalResult, result.failureCode);
+            }
+            this.takeSpotMessageFollow(state);
+        }
+    }
+    exactSpotMessageFollow(seal) {
+        const state = this.spotMessageFollow.get(seal.key);
+        return state?.seal.serial === seal.serial ? state : undefined;
+    }
+    removeSpotMessageFollow(state) {
+        if (this.spotMessageFollow.get(state.seal.key) === state) {
+            this.spotMessageFollow.delete(state.seal.key);
+        }
+        if (state.suppressionFence !== undefined) {
+            this.spotMessageFollowSuppression.expireRoute(state.suppressionFence);
+        }
+    }
+    peekSpotMessageFollow(state) {
+        while (state.queuedHead < state.queued.length && state.queued[state.queuedHead] === undefined) {
+            state.queuedHead += 1;
+        }
+        return state.queued[state.queuedHead];
+    }
+    takeSpotMessageFollow(state) {
+        const current = this.peekSpotMessageFollow(state);
+        if (current === undefined)
+            return;
+        current.ingress.applicationJobOwner?.close();
+        state.queued[state.queuedHead] = undefined;
+        state.queuedHead += 1;
+        state.queuedCount -= 1;
+        if (state.queuedCount === 0) {
+            state.queued.length = 0;
+            state.queuedHead = 0;
+        }
+        else if (state.queuedHead >= 1024 && state.queuedHead * 2 >= state.queued.length) {
+            state.queued.splice(0, state.queuedHead);
+            state.queuedHead = 0;
+        }
+    }
+    actorFence(actor) {
+        const route = this.tryActorFence(actor);
+        if (route === undefined)
+            throw new service_stateful_registry_1.ServiceStaleGenerationError('actor', actor.actorId);
+        return route;
+    }
+    tryBoundSessionSendFence(actor, senderFence) {
+        if (senderFence === undefined
+            || senderFence.targetNodeGeneration !== this.nodeGeneration
+            || senderFence.authorityOwnerGeneration <= 0n
+            || senderFence.ownerLeaseGeneration <= 0n) {
+            return undefined;
+        }
+        const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
+        if (local === undefined
+            || !sameActorRef(local.ref, actor)
+            || local.authorityOwnerGeneration !== senderFence.authorityOwnerGeneration) {
+            return undefined;
+        }
+        return {
+            actor,
+            targetNodeGeneration: senderFence.targetNodeGeneration,
+            authorityOwnerGeneration: senderFence.authorityOwnerGeneration,
+            ownerLeaseGeneration: senderFence.ownerLeaseGeneration
+        };
+    }
+    tryActorFence(actor) {
+        const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
+        if (local !== undefined && sameActorRef(local.ref, actor)) {
+            return {
+                actor,
+                targetNodeGeneration: this.nodeGeneration,
+                authorityOwnerGeneration: local.authorityOwnerGeneration,
+                ownerLeaseGeneration: this.nodeGeneration
+            };
+        }
+        const route = this.actorRoutes.get(actorKey(actor));
+        return route !== undefined && sameActorRef(route.actor, actor) ? route : undefined;
+    }
+    acceptCanonicalActorFence(actor, fence) {
+        // Canonical command 28 carries the current Location Store authority
+        // snapshot selected for this attempt. A private Core route may describe a
+        // previous visit to the same owner, so it cannot veto that snapshot; the
+        // receiving runtime validates every field against the Store before
+        // application admission (spec 15 section 4.2 / spec 51 section 9).
+        // Object/authority/lease are bounded counters.  Node lifecycle is a
+        // full-range opaque token, where only zero represents absence.
+        if (actor.generation <= 0n
+            || fence.targetNodeGeneration === 0n
+            || fence.authorityOwnerGeneration <= 0n
+            || fence.ownerLeaseGeneration <= 0n) {
+            return undefined;
+        }
+        return {
+            actor,
+            targetNodeGeneration: fence.targetNodeGeneration,
+            authorityOwnerGeneration: fence.authorityOwnerGeneration,
+            ownerLeaseGeneration: fence.ownerLeaseGeneration
+        };
+    }
+    trySpotFence(targetNodeRid, spot) {
+        const local = targetNodeRid === this.nodeRid ? this.registry.spot(spot.spotId) : undefined;
+        if (local !== undefined && sameSpotRef(local.ref, spot)) {
+            return {
+                spot,
+                targetNodeRid,
+                targetNodeGeneration: this.nodeGeneration,
+                authorityOwnerGeneration: local.authorityOwnerGeneration,
+                ownerLeaseGeneration: this.nodeGeneration
+            };
+        }
+        const route = this.spotRoutes.get(spotKey(spot));
+        return route !== undefined
+            && route.targetNodeRid === targetNodeRid
+            && sameSpotRef(route.spot, spot)
+            ? route
+            : undefined;
+    }
+    tryEntrySpotFence(targetNodeRid) {
+        const targetNodeGeneration = targetNodeRid === this.nodeRid
+            ? this.nodeGeneration
+            : this.raw.topology.peer(targetNodeRid)?.descriptor.lifecycleGeneration;
+        if (targetNodeGeneration === undefined)
+            return undefined;
+        return {
+            spot: {
+                spotId: targetNodeRid,
+                generation: targetNodeGeneration
+            },
+            targetNodeRid,
+            targetNodeGeneration,
+            authorityOwnerGeneration: targetNodeGeneration,
+            ownerLeaseGeneration: targetNodeGeneration,
+            storeVersion: `entry:${targetNodeGeneration}`
+        };
+    }
+    acceptSpotAuthority(requested) {
+        const { targetNodeRid, spot, targetNodeGeneration } = requested;
+        if (targetNodeRid === this.nodeRid) {
+            const local = this.registry.spot(spot.spotId);
+            if (local?.kind === 'entry'
+                && sameSpotRef(local.ref, spot)
+                && targetNodeGeneration === this.nodeGeneration
+                && requested.authorityOwnerGeneration === local.authorityOwnerGeneration
+                && isEntrySpotFence(requested)) {
+                return requested;
+            }
+            const current = this.directSpotRoutes.get(directSpotKey(spot.spotId));
+            return local !== undefined
+                && local.state === 'ready'
+                && targetNodeGeneration === this.nodeGeneration
+                && current !== undefined
+                && current.targetNodeRid === this.nodeRid
+                && current.targetNodeGeneration === this.nodeGeneration
+                && current.ownerLeaseGeneration === requested.ownerLeaseGeneration
+                && (current.spot.generation !== requested.spot.generation
+                    || (current.authorityOwnerGeneration === requested.authorityOwnerGeneration))
+                ? current
+                : undefined;
+        }
+        const peer = this.raw.topology.peer(targetNodeRid);
+        if (peer?.descriptor.lifecycleGeneration !== targetNodeGeneration) {
+            return undefined;
+        }
+        this.rememberSpotRoute(requested);
+        return this.directSpotRoutes.get(directSpotKey(spot.spotId));
+    }
+    peerGeneration(nodeRid) {
+        const generation = this.tryPeerGeneration(nodeRid);
+        if (generation === undefined) {
+            throw new Error(`Node '${nodeRid}' has no admitted lifecycle generation.`);
+        }
+        return generation;
+    }
+    tryPeerGeneration(nodeRid) {
+        if (nodeRid === this.nodeRid)
+            return this.nodeGeneration;
+        return this.raw.topology.peer(nodeRid)?.descriptor.lifecycleGeneration;
+    }
+    commitJoinedActor(actor, spot, membershipEpoch, onTargetLifecycleCompleted) {
+        const current = this.registry.actor(actor.actorId);
+        const previousActor = current?.ref ?? actor;
+        const previousSpot = current?.spot;
+        const previousSpotState = previousSpot === undefined
+            ? undefined
+            : this.registry.spot(previousSpot.spotId);
+        const previousMembershipEpoch = current?.membershipEpoch ?? membershipEpoch - 1n;
+        if (current === undefined) {
+            this.registry.restoreActor({ ...actor, nodeRid: this.nodeRid }, 'actor', spot, membershipEpoch);
+        }
+        else {
+            this.registry.joinActor(current.ref, spot);
+        }
+        const committed = this.registry.requireActor({
+            ...actor,
+            nodeRid: this.nodeRid
+        });
+        const targetSpot = this.registry.spot(spot.spotId);
+        if (targetSpot?.kind !== 'entry') {
+            this.enqueueActorControl(spot.spotId, {
+                kind: 'actorControl',
+                lifecycleKind: service_runtime_contracts_1.ActorLifecycleKind.Joined,
+                previousActor,
+                currentActor: committed.ref,
+                previousSpotId: previousSpot?.spotId ?? null,
+                currentSpotId: spot.spotId,
+                previousSpotGeneration: previousSpot?.generation ?? 0n,
+                currentSpotGeneration: spot.generation,
+                previousMembershipEpoch,
+                currentMembershipEpoch: committed.membershipEpoch,
+                resultCode: 0
+            }, onTargetLifecycleCompleted);
+        }
+        if (actor.nodeRid === this.nodeRid
+            && previousSpot !== undefined
+            && previousSpot.spotId !== spot.spotId
+            && previousSpotState?.ref.generation === previousSpot.generation
+            && (previousSpotState.kind === 'entry' || previousSpotState.kind === 'user')) {
+            // A same-node Core join commits the target membership and publishes
+            // the source LEFT control separately. Remote joins use the formal
+            // transfer source terminal instead; the wire ActorRef still identifies
+            // the source owner, so a remote target must not publish a second LEFT.
+            this.enqueueActorControl(previousSpot.spotId, {
+                kind: 'actorControl',
+                lifecycleKind: service_runtime_contracts_1.ActorLifecycleKind.Left,
+                previousActor,
+                currentActor: previousActor,
+                previousSpotId: previousSpot.spotId,
+                currentSpotId: spot.spotId,
+                previousSpotGeneration: previousSpot.generation,
+                currentSpotGeneration: spot.generation,
+                previousMembershipEpoch,
+                currentMembershipEpoch: committed.membershipEpoch,
+                resultCode: 0
+            });
+        }
+    }
+    requireOpen() {
+        if (this.closed)
+            throw new Error('Stateful runtime is closed.');
+    }
+}
+exports.ServiceStatefulRuntime = ServiceStatefulRuntime;
+function isEntrySpotFence(fence) {
+    return fence.spot.spotId === fence.targetNodeRid
+        && fence.spot.generation === fence.targetNodeGeneration
+        && fence.authorityOwnerGeneration === fence.targetNodeGeneration
+        && fence.ownerLeaseGeneration === fence.targetNodeGeneration
+        && fence.storeVersion === `entry:${fence.targetNodeGeneration}`;
+}
+function userSpotDeadline(deadlineUnixMs) {
+    const controller = new AbortController();
+    const delay = Number(deadlineUnixMs - BigInt(Date.now()));
+    const timeout = setTimeout(() => controller.abort(new Error('User Spot operation deadline exceeded.')), Math.max(0, Math.min(delay, 0x7fff_ffff)));
+    return {
+        signal: controller.signal,
+        close: () => clearTimeout(timeout)
+    };
+}
+function operationReplayExpired(replayExpiresAtMs) {
+    return performance.now() > replayExpiresAtMs;
+}
+function durableRequestWasAdmitted(error) {
+    // Request NotConnected includes Core handover of an admitted request. The
+    // submit/request phase, rather than the result number, owns this distinction.
+    return (0, runtime_values_1.isZLinkBackendResultError)(error) && error.operation === 'request';
+}
+function durableOperationExhausted(operationKind, wasAdmitted, cause) {
+    return (0, framework_errors_internal_1.createInternalFrameworkException)(wasAdmitted
+        ? framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded
+        : framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `${operationKind} exhausted its end-to-end deadline.`, true, cause);
+}
+function durableRequestCanReplay(error) {
+    if (!(0, runtime_values_1.isZLinkBackendResultError)(error))
+        return false;
+    return error.operation === 'request'
+        ? error.result === runtime_values_1.RequestResult.NotConnected || error.result === runtime_values_1.RequestResult.TimedOut
+        : error.result === runtime_values_1.SubmitResult.NotConnected
+            || error.result === runtime_values_1.SubmitResult.NotFound
+            || error.result === runtime_values_1.SubmitResult.NotAdmitted
+            || error.result === runtime_values_1.SubmitResult.Backpressured;
+}
+function remainingDeadlineMs(deadlineUnixMs) {
+    const remainingMs = deadlineUnixMs - BigInt(Date.now());
+    if (remainingMs <= 0n) {
+        throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, 'Stateful request exceeded its end-to-end deadline.', true);
+    }
+    return Number(remainingMs);
+}
+function userSpotOperationFingerprint(record) {
+    const { correlation: _correlation, ...semantic } = record;
+    return JSON.stringify(semantic, (_key, value) => typeof value === 'bigint' ? `${value}n` : value);
+}
+function lookupKindData(actor) {
+    return {
+        kind: 'actorLookupCompletion',
+        location: actorLocation(actor)
+    };
+}
+function actorLocation(actor) {
+    return {
+        actor: actor.ref,
+        spotId: actor.spot.spotId,
+        spotGeneration: actor.spot.generation,
+        membershipEpoch: actor.membershipEpoch
+    };
+}
+function failure(error) {
+    if (error instanceof service_stateful_registry_1.ServiceStaleGenerationError) {
+        return { terminalResult: runtime_values_1.RequestResult.NotFound, failureCode: ACTOR_ROUTE_STALE };
+    }
+    if (error instanceof contracts_1.ZLinkFrameworkException) {
+        return (0, framework_errors_internal_1.internalFrameworkWireReply)(error);
+    }
+    return { terminalResult: runtime_values_1.RequestResult.InternalError, failureCode: 17 };
+}
+function actorKey(actor) {
+    return `${actor.actorId}\0${actor.generation}`;
+}
+function sameSessionBinding(left, right) {
+    return sameActorRef(left.actor, right.actor)
+        && left.sessionRid === right.sessionRid
+        && sameSessionOwnerIdentity(left, right)
+        && left.bindingGeneration === right.bindingGeneration;
+}
+function sameSessionIdentity(left, right) {
+    return sameActorRef(left.actor, right.actor)
+        && left.sessionRid === right.sessionRid
+        && sameSessionOwnerIdentity(left, right);
+}
+function sameSessionOwnerIdentity(left, right) {
+    return left.sessionOwnerNodeRid === right.sessionOwnerNodeRid
+        && left.sessionOwnerNodeGeneration === right.sessionOwnerNodeGeneration
+        && left.sessionOwnerId === right.sessionOwnerId
+        && left.sessionOwnerLeaseGeneration === right.sessionOwnerLeaseGeneration;
+}
+function requireSessionOwnerIdentity(binding) {
+    if (binding.sessionOwnerNodeGeneration === undefined
+        || binding.sessionOwnerId === undefined
+        || binding.sessionOwnerLeaseGeneration === undefined) {
+        throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session binding '${binding.sessionRid}' omits its owner lifecycle identity.`);
+    }
+    return {
+        nodeGeneration: binding.sessionOwnerNodeGeneration,
+        ownerId: binding.sessionOwnerId,
+        leaseGeneration: binding.sessionOwnerLeaseGeneration
+    };
+}
+function sessionDeliveryKey(binding) {
+    return `${actorKey(binding.actor)}\0${binding.sessionOwnerNodeRid}\0${binding.sessionRid}`
+        + `\0${binding.sessionOwnerNodeGeneration ?? ''}`
+        + `\0${binding.sessionOwnerId ?? ''}`
+        + `\0${binding.sessionOwnerLeaseGeneration ?? ''}`
+        + `\0${binding.bindingGeneration}`;
+}
+function exactRetiredDelivery(binding, retired) {
+    return binding.sessionRid === retired.sessionRid
+        && binding.sessionOwnerNodeRid === retired.sessionOwnerNodeRid
+        && binding.sessionOwnerNodeGeneration === retired.sessionOwnerNodeGeneration
+        && binding.sessionOwnerId === retired.sessionOwnerId
+        && binding.sessionOwnerLeaseGeneration === retired.sessionOwnerLeaseGeneration
+        && binding.bindingGeneration === retired.retiredBindingGeneration;
+}
+function replacementNoticeKey(record) {
+    return `${actorKey(record.actorAuthority.actor)}\0${record.retiredSession.sessionOwnerNodeRid}`
+        + `\0${record.actorAuthority.targetNodeGeneration}`
+        + `\0${record.actorAuthority.authorityOwnerGeneration}`
+        + `\0${record.actorAuthority.ownerLeaseGeneration}`
+        + `\0${record.retiredSession.sessionOwnerNodeGeneration}`
+        + `\0${record.retiredSession.sessionOwnerId}`
+        + `\0${record.retiredSession.sessionOwnerLeaseGeneration}`
+        + `\0${record.retiredSession.sessionRid}`
+        + `\0${record.retiredSession.retiredBindingGeneration}`;
+}
+function actorAuthorityFromRoute(route) {
+    return {
+        actor: route.actor,
+        targetNodeGeneration: route.targetNodeGeneration,
+        authorityOwnerGeneration: route.authorityOwnerGeneration,
+        ownerLeaseGeneration: route.ownerLeaseGeneration
+    };
+}
+function spotKey(spot) {
+    return `${spot.spotId}\0${spot.generation}`;
+}
+function directSpotKey(spotId) {
+    return spotId;
+}
+function sameActorRef(left, right) {
+    return left.nodeRid === right.nodeRid
+        && left.actorId === right.actorId
+        && left.generation === right.generation;
+}
+function sameSpotRef(left, right) {
+    return left.spotId === right.spotId && left.generation === right.generation;
+}
+function freezeSpotRoute(route) {
+    return Object.freeze({
+        spot: Object.freeze({ ...route.spot }),
+        targetNodeRid: route.targetNodeRid,
+        targetNodeGeneration: route.targetNodeGeneration,
+        authorityOwnerGeneration: route.authorityOwnerGeneration,
+        ownerLeaseGeneration: route.ownerLeaseGeneration
+    });
+}
+function freezeDirectSpotRoute(route) {
+    return Object.freeze({
+        ...freezeSpotRoute(route),
+        ownerLeaseGeneration: route.ownerLeaseGeneration,
+        storeVersion: route.storeVersion
+    });
+}
+function shareIngressOwnership(record) {
+    // Raw binding ingress already owns stable Buffer values. Relocation follow
+    // queues retain the same record until the route decision completes.
+    const applicationJobOwner = requireApplicationJobOwner(record).retain();
+    return { ...record, applicationJobOwner };
+}
+function requireApplicationJobOwner(record) {
+    if (record.applicationJobOwner === undefined) {
+        throw new Error('Service ingress requires the host Application Job Queue owner.');
+    }
+    return record.applicationJobOwner;
+}
+function statefulCorrelation(record) {
+    if ('correlation' in record)
+        return record.correlation;
+    return record.kind === 'instanceSpot' && record.operationKind === 'request'
+        ? record.replyRouteId
+        : undefined;
+}
+function matchesExpectedInstanceRoute(current, expected) {
+    if (expected === undefined)
+        return true;
+    return expected === null
+        ? current === undefined
+        : current !== undefined && sameInstanceRoute(current, expected);
+}
+function sameInstanceRoute(left, right) {
+    return left.targetNodeRid === right.targetNodeRid
+        && left.targetNodeGeneration === right.targetNodeGeneration
+        && left.targetSpotId === right.targetSpotId
+        && left.objectGeneration === right.objectGeneration
+        && left.ownerId === right.ownerId
+        && left.authorityOwnerGeneration === right.authorityOwnerGeneration
+        && left.leaseGeneration === right.leaseGeneration
+        && left.storeVersion === right.storeVersion;
+}
+function sameInstanceOwnerIdentity(left, right) {
+    return left.targetNodeRid === right.targetNodeRid
+        && left.targetNodeGeneration === right.targetNodeGeneration
+        && left.targetSpotId === right.targetSpotId
+        && left.objectGeneration === right.objectGeneration
+        && left.ownerId === right.ownerId
+        && left.authorityOwnerGeneration === right.authorityOwnerGeneration
+        && left.leaseGeneration === right.leaseGeneration;
+}
+function sameInstanceApplicationOwner(left, right) {
+    return left.targetNodeRid === right.targetNodeRid
+        && left.targetNodeGeneration === right.targetNodeGeneration
+        && left.targetSpotId === right.targetSpotId
+        && left.ownerId === right.ownerId
+        && left.leaseGeneration === right.leaseGeneration;
+}
+function matchesExpectedDirectSpotRoute(current, expected) {
+    return expected === null
+        ? current === undefined
+        : current !== undefined && sameDirectSpotRoute(current, expected);
+}
+function instanceRouteAsDirectRoute(route) {
+    return {
+        spot: {
+            spotId: route.targetSpotId,
+            generation: route.objectGeneration
+        },
+        targetNodeRid: route.targetNodeRid,
+        targetNodeGeneration: route.targetNodeGeneration,
+        authorityOwnerGeneration: route.authorityOwnerGeneration,
+        ownerLeaseGeneration: route.leaseGeneration,
+        storeVersion: route.storeVersion
+    };
+}
+function sameDirectSpotRoute(left, right) {
+    return sameDirectSpotRouteIdentity(left, right)
+        && left.storeVersion === right.storeVersion;
+}
+function messageFollowSpotRoute(route) {
+    return {
+        kind: 'spot',
+        spot: route.spot,
+        targetNodeRid: route.targetNodeRid,
+        targetNodeGeneration: route.targetNodeGeneration,
+        authorityOwnerGeneration: route.authorityOwnerGeneration,
+        ownerLeaseGeneration: route.ownerLeaseGeneration
+    };
+}
+function spotMessageFollowSuppressionFence(objectKind, source, target) {
+    return Object.freeze({
+        objectKind,
+        logicalObjectId: source.spot.spotId,
+        objectGeneration: source.spot.generation.toString(),
+        sourceNodeRid: source.targetNodeRid,
+        sourceNodeGeneration: source.targetNodeGeneration.toString(),
+        sourceAuthorityOwnerGeneration: source.authorityOwnerGeneration.toString(),
+        sourceOwnerLeaseGeneration: source.ownerLeaseGeneration.toString(),
+        targetNodeRid: target.targetNodeRid,
+        targetNodeGeneration: target.targetNodeGeneration.toString(),
+        targetAuthorityOwnerGeneration: target.authorityOwnerGeneration.toString(),
+        targetOwnerLeaseGeneration: target.ownerLeaseGeneration.toString()
+    });
+}
+function sameMessageFollowSpotSource(current, source) {
+    return current.spot.spotId === source.spot.spotId
+        && current.spot.generation === source.spot.generation
+        && current.targetNodeRid === source.targetNodeRid
+        && current.targetNodeGeneration === source.targetNodeGeneration
+        && current.authorityOwnerGeneration === source.authorityOwnerGeneration
+        && current.ownerLeaseGeneration === source.ownerLeaseGeneration;
+}
+function sameDirectSpotRouteIdentity(left, right) {
+    return sameDirectSpotOwnerIdentity(left, right)
+        && left.spot.generation === right.spot.generation;
+}
+function sameDirectSpotOwnerIdentity(left, right) {
+    return left.spot.spotId === right.spot.spotId
+        && left.targetNodeRid === right.targetNodeRid
+        && left.targetNodeGeneration === right.targetNodeGeneration
+        && left.authorityOwnerGeneration === right.authorityOwnerGeneration
+        && left.ownerLeaseGeneration === right.ownerLeaseGeneration;
+}
+function routeMatchesLocal(route, spot, nodeRid, nodeGeneration) {
+    return route.targetNodeRid === nodeRid
+        && route.targetNodeGeneration === nodeGeneration
+        && route.targetSpotId === spot.ref.spotId
+        && route.objectGeneration === spot.ref.generation
+        && route.authorityOwnerGeneration === spot.authorityOwnerGeneration;
+}
+function instanceOperationKey(record) {
+    return `${record.sourceNodeRid}\0${record.sourceNodeGeneration}\0`
+        + `${record.operation.high}\0${record.operation.low}`;
+}
+function instanceActivationKey(record) {
+    return `${record.target.targetNodeRid}\0${record.target.targetNodeGeneration}\0`
+        + `${record.target.targetSpotId}\0${record.target.stableType}`;
+}
+function subscriptionKey(channelName, topicFilter) {
+    if (channelName.length === 0 || topicFilter.length === 0) {
+        throw new TypeError('Channel name and topic filter must be non-empty.');
+    }
+    return `${channelName}\0${topicFilter}`;
+}
+function topicMatches(filter, topic) {
+    if (filter === '*' || filter === '#')
+        return true;
+    if (filter.endsWith('*'))
+        return topic.startsWith(filter.slice(0, -1));
+    return filter === topic;
+}
+function emptyPayload() {
+    return {
+        packetName: 'ZLinkFrameworkEmpty',
+        contentType: 'application/octet-stream',
+        payload: Buffer.alloc(0)
+    };
+}
+/**
+ * The generated command-28 decoder is the canonical wire authority.  Keep
+ * the stateful mailbox's internal record shape as an adapter only; it must
+ * not re-parse the canonical bytes with the legacy hand-written decoder.
+ */
+function statefulActorJoinFromCanonical(value) {
+    return {
+        kind: 'actorJoin',
+        correlation: value.correlation,
+        actor: {
+            actor: {
+                actorId: value.actor.id,
+                generation: value.actor.generation,
+                nodeRid: decodeCanonicalRoutingId(value.actor.targetNodeRid)
+            },
+            targetNodeGeneration: value.actor.targetNodeGeneration,
+            authorityOwnerGeneration: value.actor.expectedAuthorityOwnerGeneration,
+            ownerLeaseGeneration: value.actor.expectedOwnerLeaseGeneration
+        },
+        entry: value.entry,
+        target: {
+            spot: {
+                spotId: value.targetSpot.id,
+                generation: value.targetSpot.generation
+            },
+            targetNodeRid: decodeCanonicalRoutingId(value.targetSpot.targetNodeRid),
+            targetNodeGeneration: value.targetSpot.targetNodeGeneration,
+            authorityOwnerGeneration: value.targetSpot.expectedAuthorityOwnerGeneration,
+            ownerLeaseGeneration: value.targetSpot.expectedOwnerLeaseGeneration
+        }
+    };
+}
+function decodeCanonicalRoutingId(bytes) {
+    return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString('utf8');
+}
+function instanceOperationParts(headerAndPayload, metadataFrame) {
+    if (headerAndPayload.length !== 2) {
+        throw new TypeError('Instance operation requires one header and one payload frame.');
+    }
+    if (metadataFrame === undefined)
+        return headerAndPayload;
+    return [
+        headerAndPayload[0],
+        (0, service_metadata_codec_1.validateServiceMetadataFrame)(metadataFrame),
+        headerAndPayload[1]
+    ];
+}
+function statefulMailboxData(record) {
+    return record.stateful;
+}