@zlink-systems/framework 0.22.0 → 0.24.0

package/src/runtime/channels/dispatch-error-reporter.ts

@@ -13,6 +13,7 @@ import {
   type ZLinkDiagnosticsContext
 } from '../diagnostics';
 import type { ZLinkDispatchErrorSink } from '../diagnostics/dispatch-error-port';
+import { dispatchErrorDetails } from '../diagnostics/dispatch-error-details';
 
 export type { ZLinkDispatchErrorSink } from '../diagnostics/dispatch-error-port';
 
@@ -46,7 +47,6 @@ export class ZLinkDispatchErrorReporter {
 
   report(event: ZLinkRuntimeDispatchFailure): void {
     const normalized = normalizeDispatchFailure(event);
-    const tracePoint = this.flow.begin(ZLinkMessageFlowOutcome.Error);
     const dropReason = channelDropReason(normalized);
     if (dropReason !== undefined) {
       this.metrics?.count('zlink.mesh_node.messages.dropped', 1, {
@@ -55,8 +55,9 @@ export class ZLinkDispatchErrorReporter {
         reason: dropReason
       });
     }
+    const tracePoint = this.flow.begin(ZLinkMessageFlowOutcome.Error);
     if (tracePoint === undefined) return;
-    const errorInfo = dispatchErrorInfo(normalized);
+    const errorInfo = dispatchErrorDetails(normalized.error);
     this.reportedEvents += 1;
     tracePoint.trace({
       outcome: ZLinkMessageFlowOutcome.Error,
@@ -87,6 +88,10 @@ export class ZLinkDispatchErrorReporter {
     });
   }
 
+  captureEnabled(): boolean {
+    return this.flow.enabled(ZLinkMessageFlowOutcome.Error);
+  }
+
   get reportedCount(): number {
     return this.reportedEvents;
   }
@@ -123,46 +128,3 @@ function channelDropReason(event: ZLinkRuntimeDispatchFailure): string | undefin
       return undefined;
   }
 }
-
-function dispatchErrorInfo(event: ZLinkRuntimeDispatchFailure): {
-  readonly errorType?: string;
-  readonly errorMessage?: string;
-  readonly errorCauseType?: string;
-  readonly errorCauseMessage?: string;
-} {
-  if (event.errorType !== undefined || event.errorMessage !== undefined) {
-    return {
-      errorType: event.errorType,
-      errorMessage: event.errorMessage,
-      errorCauseType: event.errorCauseType,
-      errorCauseMessage: event.errorCauseMessage
-    };
-  }
-  if (event.error === undefined) {
-    return {};
-  }
-  if (event.error instanceof Error) {
-    const cause = deepestErrorCause(event.error);
-    return {
-      errorType: event.error.name,
-      errorMessage: event.error.message,
-      ...(cause === event.error
-        ? {}
-        : {
-            errorCauseType: cause instanceof Error ? cause.name : typeof cause,
-            errorCauseMessage: cause instanceof Error ? cause.message : String(cause)
-          })
-    };
-  }
-  return { errorType: typeof event.error, errorMessage: String(event.error) };
-}
-
-function deepestErrorCause(error: Error): unknown {
-  let current: unknown = error;
-  const seen = new Set<unknown>();
-  while (current instanceof Error && current.cause !== undefined && !seen.has(current)) {
-    seen.add(current);
-    current = current.cause;
-  }
-  return current;
-}

package/src/runtime/diagnostics/dispatch-error-details.ts

@@ -0,0 +1,62 @@
+const ERROR_MESSAGE_MAX_LENGTH = 512;
+
+const CREDENTIAL_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
+  [/Authorization\s*:\s*(?:(?:Bearer|Basic)\s+)?[^\s,;]+/gi, 'Authorization: <redacted>'],
+  [/Bearer\s+[^\s,;]+/gi, 'Bearer <redacted>'],
+  [/password\s*=\s*[^\s,;]+/gi, 'password=<redacted>'],
+  [/token\s*=\s*[^\s,;]+/gi, 'token=<redacted>']
+];
+
+export function dispatchErrorDetails(error: unknown): {
+  readonly errorType?: string;
+  readonly errorMessage?: string;
+  readonly errorCauseType?: string;
+  readonly errorCauseMessage?: string;
+} {
+  if (error === undefined || error === null) return {};
+  if (error instanceof Error) {
+    const cause = deepestErrorCause(error);
+    return {
+      errorType: error.name,
+      errorMessage: sanitizeErrorMessage(error.message),
+      ...(cause === error
+        ? {}
+        : {
+            errorCauseType: cause instanceof Error ? cause.name : typeof cause,
+            errorCauseMessage: sanitizeErrorMessage(
+              cause instanceof Error ? cause.message : String(cause)
+            )
+          })
+    };
+  }
+  const errorType = typeof error === 'object' ? error.constructor.name : typeof error;
+  const message =
+    typeof error === 'string' ||
+    typeof error === 'number' ||
+    typeof error === 'boolean' ||
+    typeof error === 'bigint'
+      ? `${error}`
+      : Object.prototype.toString.call(error);
+  return { errorType, errorMessage: sanitizeErrorMessage(message) };
+}
+
+function deepestErrorCause(error: Error): unknown {
+  let current: unknown = error;
+  const seen = new Set<unknown>();
+  while (current instanceof Error && current.cause !== undefined && !seen.has(current)) {
+    seen.add(current);
+    current = current.cause;
+  }
+  return current;
+}
+
+function sanitizeErrorMessage(message: string): string {
+  if (message.length === 0) return '';
+  const lineEnd = message.search(/[\r\n]/u);
+  let sanitized = lineEnd < 0 ? message : message.slice(0, lineEnd);
+  for (const [pattern, replacement] of CREDENTIAL_PATTERNS) {
+    pattern.lastIndex = 0;
+    sanitized = sanitized.replace(pattern, replacement);
+  }
+  return sanitized.slice(0, ERROR_MESSAGE_MAX_LENGTH);
+}

package/src/runtime/diagnostics/flow-context.ts

@@ -5,6 +5,7 @@ import type { ZLinkFlowOrigin } from '../../contracts';
 export interface ZLinkFlowContextValue {
   readonly flowId: string;
   readonly flowOrigin: ZLinkFlowOrigin;
+  readonly streamSessionId?: string;
 }
 
 const flowStorage = new AsyncLocalStorage<ZLinkFlowContextValue | undefined>();
@@ -71,14 +72,15 @@ export function runWithOutboundFlow<T>(enabled: boolean, callback: () => T): T {
 }
 
 export function createInboundFlow(
-  flowId?: string,
-  flowOrigin?: ZLinkFlowOrigin,
-  createIfAbsent = true
+  flowId: string | undefined,
+  flowOrigin: ZLinkFlowOrigin | undefined,
+  createIfAbsent: boolean,
+  streamSessionId: string | undefined
 ): ZLinkFlowContextValue | undefined {
   if (!createIfAbsent) {
     return undefined;
   }
-  return { flowId: flowId ?? createFlowId(), flowOrigin: flowOrigin ?? 'Inbound' };
+  return { flowId: flowId ?? createFlowId(), flowOrigin: flowOrigin ?? 'Inbound', streamSessionId };
 }
 
 function createFlowId(): string {

package/src/runtime/diagnostics/message-flow.ts

@@ -34,6 +34,7 @@ export const DEFAULT_ZLINK_DIAGNOSTICS: ZLinkDiagnosticsOptions = {
 
 const telemetryLogger = openTelemetryLogs.getLogger('@zlink-systems/framework');
 const telemetryTracer = openTelemetryTrace.getTracer('@zlink-systems/framework');
+const ERROR_MESSAGE_MAX_LENGTH = 512;
 let diagnosticsGeneration = 0n;
 
 interface ZLinkTelemetryRecord {
@@ -68,6 +69,7 @@ interface ZLinkTelemetryRecord {
   readonly instanceSpotType?: string;
   readonly activationState?: string;
   readonly actorId?: string;
+  readonly streamSessionId?: string;
   readonly commandId?: number;
   readonly messageSizeBytes?: number;
   readonly durationSeconds?: number;
@@ -226,12 +228,13 @@ export class ZLinkMessageFlowTracer {
     acceptedFlowId?: string,
     acceptedFlowOrigin?: ZLinkFlowOrigin
   ): void {
-    const ambient = acceptedFlowId === undefined ? currentFlowContext() : undefined;
+    const ambient = currentFlowContext();
     const flowId = flowInput.flowId ?? acceptedFlowId ?? ambient?.flowId;
     const flowOrigin = flowInput.flowOrigin ?? acceptedFlowOrigin ?? ambient?.flowOrigin;
     const flow: ZLinkRuntimeMessageFlowEvent = {
       ...flowInput,
       ...(flowId === undefined ? {} : { flowId, flowOrigin }),
+      streamSessionId: flowInput.streamSessionId ?? ambient?.streamSessionId,
       effectiveMode
     };
     this.tracedEvents += 1;
@@ -380,11 +383,12 @@ function toTelemetryRecord(
     instanceSpotType: flow.instanceSpotType,
     activationState: flow.activationState,
     actorId: flow.actorId,
+    streamSessionId: flow.streamSessionId,
     commandId: flow.commandId,
     messageSizeBytes,
     durationSeconds,
     errorType: flow.errorType,
-    errorMessage: boundedText(flow.errorMessage),
+    errorMessage: flow.errorMessage,
     errorCauseType: flow.errorCauseType,
     errorCauseMessage: boundedText(flow.errorCauseMessage)
   };
@@ -421,6 +425,7 @@ function structuredLogAttributes(record: ZLinkTelemetryRecord): Attributes {
     instance_spot_type: record.instanceSpotType,
     activation_state: record.activationState,
     actor_id: record.actorId,
+    stream_session_id: record.streamSessionId,
     correlation_id: record.correlationId,
     flow_id: record.flowId,
     flow_origin: record.flowOrigin,
@@ -456,11 +461,15 @@ function structuredLogBodyAttributes(record: ZLinkTelemetryRecord): Attributes {
     instance_type: record.instanceSpotType,
     activation_state: record.activationState,
     actor: record.actorId,
+    session: record.streamSessionId,
     corr: record.correlationId,
     flow: record.flowId,
     origin: record.flowOrigin,
     outcome: record.outcome,
     reason: record.reason,
+    action: record.action,
+    error_type: record.errorType,
+    error_message: record.errorMessage,
     size: record.messageSizeBytes
   });
 }
@@ -571,7 +580,7 @@ function hashFlowId(flowId: string): number {
 }
 
 function boundedText(value: string | undefined): string | undefined {
-  return value === undefined ? undefined : value.slice(0, 512);
+  return value === undefined ? undefined : value.slice(0, ERROR_MESSAGE_MAX_LENGTH);
 }
 
 function toSnakeCase(value: string): string {

package/src/runtime/foundation/actor-join-recovery-codec.ts

@@ -10,7 +10,6 @@ import { decodeServiceWireFrozenRecord } from './service-stateful-wire-codec';
 const RECOVERY_PACKET_NAME = '__zlink.actor.routed_join.recovery';
 const RECOVERY_CONTENT_TYPE = 'application/x-zlink-actor-routed-join-recovery-v1';
 const MAXIMUM_METADATA_BYTES = 256 * 1024;
-const MAXIMUM_MESSAGE_BYTES = 1024 * 1024;
 const FRAMEWORK_METADATA_UPPER_BOUND_BYTES = 64 * 1024;
 const ACCEPTED_JOURNAL_UPPER_BOUND_BYTES = 16 * 1024 * 1024;
 const SNAPSHOT_APPLICATION_STATE_RESERVATION_BYTES = 64 * 1024 * 1024;
@@ -124,9 +123,6 @@ export function encodeCanonicalActorJoinRecoverySavedWork(
   const operationId = input.operationId;
   const reply = operationId === undefined ? Buffer.alloc(0) : Buffer.from(input.reply ?? []);
   const request = Buffer.from(input.request);
-  if (request.byteLength > MAXIMUM_MESSAGE_BYTES || reply.byteLength > MAXIMUM_MESSAGE_BYTES) {
-    throw new RangeError('Actor Join recovery message exceeds 1 MiB.');
-  }
   const replyContentType =
     operationId === undefined
       ? null

package/src/runtime/foundation/raw-service-mesh-runtime.ts

@@ -7,7 +7,7 @@ import type {
   ZLinkRawReceivedRecord,
   ZLinkRawRouterPort
 } from '../backend/raw-binding-port';
-import { RequestResult } from '../backend/runtime-values';
+import { RequestResult, SubmitResult } from '../backend/runtime-values';
 import type {
   ApplicationJobPermitPort,
   ApplicationJobQueuePort
@@ -63,6 +63,19 @@ export interface RawServiceRequestResult {
   readonly payload?: ServiceApplicationPayload;
 }
 
+type RawServiceChannelTargetSelection =
+  | { readonly kind: 'selected'; readonly peer: AdmittedServicePeer }
+  | {
+      readonly kind: 'noMember';
+      readonly submitResult: typeof SubmitResult.NotFound;
+      readonly requestResult: RawServiceRequestResult;
+    }
+  | {
+      readonly kind: 'knownButNotReady';
+      readonly submitResult: typeof SubmitResult.NotConnected;
+      readonly requestResult: RawServiceRequestResult;
+    };
+
 /** An M6A application frame already owned by the Framework runtime. */
 type ServiceApplicationPayloadInput = ServiceApplicationPayload | Buffer;
 
@@ -463,11 +476,10 @@ export class RawServiceMeshRuntime {
   async sendToChannel(
     channelName: string,
     payload: ServiceApplicationPayloadInput
-  ): Promise<boolean> {
-    const selected = this.topology.selectChannel(channelName, (peer) =>
-      this.isLocalOrReadyPeer(peer.descriptor.nodeRoutingId)
-    );
-    if (selected === undefined) return false;
+  ): Promise<SubmitResult> {
+    const selection = this.selectChannelTarget(channelName);
+    if (selection.kind !== 'selected') return selection.submitResult;
+    const selected = selection.peer;
     const applicationFrame = this.applicationFrame(payload);
     if (selected.descriptor.nodeRoutingId === this.descriptor.nodeRoutingId) {
       const applicationJobOwner = await this.reserveLocalIngress();
@@ -481,15 +493,17 @@ export class RawServiceMeshRuntime {
           applicationJob
         });
         if (!accepted) applicationJob.close();
-        return accepted;
+        return accepted ? SubmitResult.Ok : SubmitResult.NotAdmitted;
       } finally {
         applicationJobOwner.close();
       }
     }
-    return this.send(selected.descriptor.nodeRoutingId, [
+    return (await this.send(selected.descriptor.nodeRoutingId, [
       encodeChannelSendHeader(channelName),
       applicationFrame
-    ]);
+    ]))
+      ? SubmitResult.Ok
+      : SubmitResult.NotConnected;
   }
 
   requestToNode(
@@ -504,13 +518,40 @@ export class RawServiceMeshRuntime {
     channelName: string,
     payload: ServiceApplicationPayloadInput,
     timeoutMs: number
-  ): PendingOperation<RawServiceRequestResult> | undefined {
+  ): PendingOperation<RawServiceRequestResult> {
+    const selection = this.selectChannelTarget(channelName);
+    if (selection.kind !== 'selected') {
+      const pending = this.operations.register(timeoutMs);
+      this.operations.complete(pending.id, selection.requestResult);
+      return pending;
+    }
+    return this.requestToTarget(
+      selection.peer.descriptor.nodeRoutingId,
+      payload,
+      timeoutMs,
+      channelName
+    );
+  }
+
+  private selectChannelTarget(channelName: string): RawServiceChannelTargetSelection {
     const selected = this.topology.selectChannel(channelName, (peer) =>
       this.isLocalOrReadyPeer(peer.descriptor.nodeRoutingId)
     );
-    return selected === undefined
-      ? undefined
-      : this.requestToTarget(selected.descriptor.nodeRoutingId, payload, timeoutMs, channelName);
+    if (selected !== undefined) return { kind: 'selected', peer: selected };
+    return this.topology.hasKnownChannelTarget(channelName)
+      ? {
+          kind: 'knownButNotReady',
+          submitResult: SubmitResult.NotConnected,
+          requestResult: { terminalResult: RequestResult.NotConnected, failureCode: 0 }
+        }
+      : {
+          kind: 'noMember',
+          submitResult: SubmitResult.NotFound,
+          requestResult: {
+            terminalResult: RequestResult.NotFound,
+            failureCode: REQUEST_TARGET_NOT_FOUND_FAILURE_CODE
+          }
+        };
   }
 
   private isLocalOrReadyPeer(nodeRoutingId: string): boolean {

package/src/runtime/foundation/service-session-binding-ingress-port.ts

@@ -19,6 +19,7 @@ export interface ServiceSessionBindingAdmissionClaim {
 export type ServiceSessionBindingAdmissionResult = 'passThrough' | 'retained' | 'rejected';
 
 export interface ServiceSessionBindingIngressPort {
+  actorSlot(actorId: string, sessionRid: string): Promise<number | undefined>;
   retainOutbound(
     claim: ServiceSessionBindingAdmissionClaim,
     delivery: ServiceSessionBindingRetainedDelivery

package/src/runtime/foundation/service-stateful-runtime.ts

@@ -9,6 +9,12 @@ import {
   translateWireReplyDecodeError
 } from '../framework-errors-internal';
 import { RequestResult, SubmitResult, isZLinkBackendResultError } from '../backend/runtime-values';
+import type { ZLinkDispatchErrorReporter } from '../channels/dispatch-error-reporter';
+import {
+  ZLinkRuntimeDispatchErrorAction as ZLinkDispatchErrorAction,
+  ZLinkDispatchErrorSurface,
+  ZLinkDispatchMessageKind
+} from '../../contracts/Dispatch/ZLinkDispatchOptions';
 import type {
   RawServiceIngressRecord,
   RawServiceMeshRuntime,
@@ -401,6 +407,8 @@ export class ServiceStatefulRuntime {
     readonly kind: 'spot_multicast' | 'actor_control' | 'actor_binding';
     readonly owner: string;
   }) => void;
+  private dispatchErrors?: ZLinkDispatchErrorReporter;
+  private dispatchErrorMeshName?: string;
   private readonly admittedUserSpotOperations = new Map<
     string,
     {
@@ -438,6 +446,11 @@ export class ServiceStatefulRuntime {
     this.mailboxDropHandler = handler;
   }
 
+  setDispatchErrorReporter(reporter: ZLinkDispatchErrorReporter, meshName: string): void {
+    this.dispatchErrors = reporter;
+    this.dispatchErrorMeshName = meshName;
+  }
+
   createSpot(
     routingId?: string,
     kind: 'user' | 'instance' = 'user',
@@ -673,6 +686,13 @@ export class ServiceStatefulRuntime {
     }
   }
 
+  completeClosedInstance(spotId: string, objectGeneration: bigint): void {
+    const current = this.instanceIntents.get(spotId);
+    if (current !== undefined && current.route.objectGeneration === objectGeneration) {
+      this.forgetClosedInstanceRoute(current.route);
+    }
+  }
+
   registerInstanceActivationAuthority(authority: ServiceInstanceActivationAuthority): void {
     this.requireOpen();
     if (
@@ -1229,17 +1249,41 @@ export class ServiceStatefulRuntime {
     await this.enqueueLogicalMulticast(channelName, topic, sourceSpotId, payload);
     const targets = this.raw.topology
       .peers()
-      .filter((peer) =>
-        peer.descriptor.channels.some(
-          (channel) => channel.name === channelName && channel.weight > 0
-        )
+      .filter(
+        (peer) =>
+          peer.descriptor.channels.some(
+            (channel) => channel.name === channelName && channel.weight > 0
+          ) && this.raw.isPeerRouteReady(peer.descriptor.nodeRoutingId)
       );
     const header = encodeLogicalMulticastHeader(channelName, topic, sourceSpotId);
     const payloadFrame = encodeApplicationPayload(payload);
+    const reporter = this.dispatchErrors;
+    const captureFailures = reporter?.captureEnabled() === true;
     for (const target of targets) {
       // Remote admission ends at the source outbound transport queue. The
       // receiver's Spot queue and handler completion are not publish results.
-      await this.raw.sendService(target.descriptor.nodeRoutingId, [header, payloadFrame]);
+      const accepted = await this.raw.sendService(target.descriptor.nodeRoutingId, [
+        header,
+        payloadFrame
+      ]);
+      if (!accepted) {
+        if (captureFailures) {
+          reporter.report({
+            surface: ZLinkDispatchErrorSurface.SpotRoute,
+            messageKind: ZLinkDispatchMessageKind.Send,
+            reason: serviceSpotPublishFailureReason(
+              undefined,
+              this.raw.isPeerRouteReady(target.descriptor.nodeRoutingId),
+              this.closed
+            ),
+            action: ZLinkDispatchErrorAction.Drop,
+            meshName: this.dispatchErrorMeshName,
+            channelName,
+            topic,
+            targetRid: target.descriptor.nodeRoutingId
+          });
+        }
+      }
     }
   }
 
@@ -5251,6 +5295,28 @@ export class ServiceStatefulRuntime {
   }
 }
 
+function serviceSpotPublishFailureReason(
+  result: number | undefined,
+  routeReady: boolean,
+  closed: boolean
+): 'stale_target' | 'backpressure' | 'shutdown' {
+  if (closed || result === SubmitResult.Terminated) return 'shutdown';
+  switch (result) {
+    case SubmitResult.Backpressured:
+      return 'backpressure';
+    case SubmitResult.NotAdmitted:
+    case SubmitResult.NotConnected:
+    case SubmitResult.NotFound:
+    case SubmitResult.InvalidHandle:
+      return 'stale_target';
+    default:
+      // RawServiceMeshRuntime exposes failed Core submissions as false. A
+      // ready route therefore identifies queue admission failure; a route
+      // that became unready after selection is a stale target.
+      return routeReady ? 'backpressure' : 'stale_target';
+  }
+}
+
 function isEntrySpotFence(fence: ServiceDirectSpotRouteFence): boolean {
   return (
     fence.spot.spotId === fence.targetNodeRid &&

package/src/runtime/foundation/service-topology-registry.ts

@@ -257,6 +257,13 @@ export class ServiceTopologyRegistry {
     return descriptor === undefined ? undefined : cloneDescriptor(descriptor);
   }
 
+  hasKnownChannelTarget(channelName: string): boolean {
+    requireText(channelName, 'channelName');
+    return [this.local, ...this.knownByRid.values()].some(
+      (descriptor) => selectableChannel(descriptor, channelName) !== undefined
+    );
+  }
+
   private remember(descriptor: ServiceNodeDescriptor): void {
     const current = this.knownByRid.get(descriptor.nodeRoutingId);
     if (
@@ -285,7 +292,7 @@ export class ServiceTopologyRegistry {
         return [local, ...this.peersByRid.values()]
           .map((peer) => ({
             peer: clonePeer(peer),
-            channel: findChannel(peer.descriptor, channelName)
+            channel: selectableChannel(peer.descriptor, channelName)
           }))
           .filter(
             (
@@ -293,10 +300,7 @@ export class ServiceTopologyRegistry {
             ): value is {
               peer: AdmittedServicePeer;
               channel: ServiceChannelDescriptor;
-            } =>
-              value.channel !== undefined &&
-              value.peer.descriptor.state === 'serving' &&
-              value.channel.weight > 0
+            } => value.channel !== undefined
           );
       },
       (value) => value.channel.weight,
@@ -519,6 +523,15 @@ function findChannel(
   return descriptor.channels.find((channel) => channel.name === channelName);
 }
 
+function selectableChannel(
+  descriptor: ServiceNodeDescriptor,
+  channelName: string
+): ServiceChannelDescriptor | undefined {
+  if (descriptor.state !== 'serving') return undefined;
+  const channel = findChannel(descriptor, channelName);
+  return channel !== undefined && channel.weight > 0 ? channel : undefined;
+}
+
 function requireText(value: string, field: string): void {
   if (value.length === 0 || value.includes('\0')) {
     throw new TypeError(`${field} must be non-empty text without NUL.`);

package/src/runtime/host/index.ts

@@ -1982,9 +1982,16 @@ export class ZLinkFrameworkRuntimeHost
         // coordinator after application initialization. The legacy location
         // claim would expose a Creating object before that Ready barrier.
         locationLifecycle: () => undefined,
-        releaseInstanceAuthority: (meshName, spotId, objectGeneration) =>
-          this.locationOwner.currentLifecycle?.releaseSpot(meshName, spotId, objectGeneration) ??
-          Promise.resolve(),
+        releaseInstanceAuthority: async (meshName, spotId, objectGeneration) => {
+          await this.locationOwner.currentLifecycle?.releaseSpot(
+            meshName,
+            spotId,
+            objectGeneration
+          );
+          this.spotNodeRuntime
+            ?.meshNode(meshName)
+            ?.completeClosedInstance?.(spotId, objectGeneration);
+        },
         beginInstanceIdleClosingAuthority: (meshName, spotId) =>
           this.locationOwner.currentLifecycle?.beginInstanceSpotClosing(meshName, spotId) ??
           Promise.resolve(undefined),
@@ -3047,7 +3054,7 @@ export class ZLinkFrameworkRuntimeHost
     const flow =
       current?.flowOrigin === 'Lifecycle'
         ? current
-        : createInboundFlow(undefined, 'Lifecycle', this.flowCreationEnabled());
+        : createInboundFlow(undefined, 'Lifecycle', this.flowCreationEnabled(), undefined);
     return runWithFlow(flow, operation);
   }
 

package/src/runtime/locations/in-memory-location-store.ts

@@ -278,6 +278,13 @@ export class ZLinkInMemoryLocationStore
     ) {
       return stored(this.meshNodes.generations.get(key) ?? 1n, current.updatedAt);
     }
+    if (
+      intent === ZLinkLocationWriteIntent.NewClaim &&
+      currentLease !== undefined &&
+      currentLease.leaseExpiresAt.getTime() > updatedAt.getTime()
+    ) {
+      return rejectedConflict();
+    }
     if (
       current.ownerId !== descriptor.ownerId ||
       current.leaseGeneration !== descriptor.leaseGeneration ||

package/src/runtime/locations/location-store-repository.ts

@@ -2329,7 +2329,10 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
       const renew = intent === 2 && canRenew(stored, descriptor);
       if (!takeover && !renew) {
         return {
-          status: WriteStatus.IgnoredStale,
+          status:
+            intent === ZLinkLocationWriteIntent.NewClaim && currentLeaseGeneration !== undefined
+              ? WriteStatus.RejectedConflict
+              : WriteStatus.IgnoredStale,
           generation,
           updatedAt: current.value.storeNow
         };