@zlink-systems/framework 0.24.0 → 0.26.0

package/dist/runtime/foundation/service-maintenance-runtime.js

@@ -110,13 +110,28 @@ class ServiceMaintenanceRuntime {
     }
     async runUnits(signal, stopStartingSignal) {
         const pending = new Set();
+        // A unit failure is recorded before its promise leaves `pending`, so no
+        // failure is lost. Every started unit runs to its own terminal before the
+        // first failure is reported: the host result follows the settled
+        // authority of each unit (spec 30 §13).
+        const failures = [];
+        const reportFailure = async () => {
+            if (failures.length === 0)
+                return;
+            await Promise.allSettled(pending);
+            throw failures[0];
+        };
         for (;;) {
+            await reportFailure();
             const queued = await this.lane.run(() => this.units.length > 0);
-            if (!queued && pending.size === 0)
+            if (!queued && pending.size === 0) {
+                await reportFailure();
                 return;
+            }
             signal.throwIfAborted();
             if (stopStartingSignal?.aborted === true) {
                 await Promise.allSettled(pending);
+                await reportFailure();
                 stopStartingSignal.throwIfAborted();
             }
             let admitted = false;
@@ -142,7 +157,12 @@ class ServiceMaintenanceRuntime {
                     continue;
                 admitted = true;
                 let running;
-                running = startOutsideStateLane(() => unit.relocate(signal).finally(async () => {
+                running = startOutsideStateLane(() => unit
+                    .relocate(signal)
+                    .catch((error) => {
+                    failures.push(error);
+                })
+                    .finally(async () => {
                     const publication = await this.lane.run(() => {
                         this.activeOutbound--;
                         pending.delete(running);
@@ -154,6 +174,7 @@ class ServiceMaintenanceRuntime {
                 this.notify(claim.publication);
             }
             if (pending.size === 0) {
+                await reportFailure();
                 if (!admitted)
                     throw new Error('No relocation unit is ready to start.');
             }

package/dist/runtime/foundation/service-relocation-coordinator.d.ts

@@ -17,3 +17,12 @@ export declare class ServiceRelocationPostCommitError extends Error {
     readonly cause: unknown;
     constructor(authority: ZLinkAuthoritySnapshot, staging: ServiceRelocationStaging, cause: unknown);
 }
+/**
+ * A relocation whose settled authority leaves the host in `Error` with
+ * `Blocked/RelocationFailed` (spec 30 §13): the source owner lease ended
+ * before its Preserve fence succeeded, or units settled on both the source
+ * and the target.
+ */
+export declare class ServiceRelocationAuthorityError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}

package/dist/runtime/foundation/service-relocation-coordinator.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceRelocationPostCommitError = void 0;
+exports.ServiceRelocationAuthorityError = exports.ServiceRelocationPostCommitError = void 0;
 class ServiceRelocationPostCommitError extends Error {
     authority;
     staging;
@@ -14,3 +14,16 @@ class ServiceRelocationPostCommitError extends Error {
     }
 }
 exports.ServiceRelocationPostCommitError = ServiceRelocationPostCommitError;
+/**
+ * A relocation whose settled authority leaves the host in `Error` with
+ * `Blocked/RelocationFailed` (spec 30 §13): the source owner lease ended
+ * before its Preserve fence succeeded, or units settled on both the source
+ * and the target.
+ */
+class ServiceRelocationAuthorityError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ServiceRelocationAuthorityError';
+    }
+}
+exports.ServiceRelocationAuthorityError = ServiceRelocationAuthorityError;

package/dist/runtime/foundation/service-relocation-object-owner.d.ts

@@ -16,6 +16,8 @@ export interface ServiceRelocationCaptureUnit {
     captureApplicationState(signal?: AbortSignal): Promise<Uint8Array>;
     commitSeal(): Promise<void> | void;
     abortSeal(): Promise<void> | void;
+    /** Expired-owner terminal: pending requests fail once and dispatch stays closed. */
+    discardSeal?(reason: unknown): Promise<void> | void;
 }
 export declare class ServiceCapturedObjectRelocation {
     readonly envelope: ServiceRelocationEnvelope;
@@ -24,6 +26,12 @@ export declare class ServiceCapturedObjectRelocation {
     constructor(envelope: ServiceRelocationEnvelope, units: readonly ServiceRelocationCaptureUnit[]);
     commitSource(): Promise<void>;
     abortSource(): Promise<void>;
+    /**
+     * The source owner lease ended before the authority settled (spec 28 §4.4):
+     * the source neither resumes nor commits. Retained work is dropped and
+     * every pending request without a terminal fails once with `reason`.
+     */
+    discardSource(reason: unknown): Promise<void>;
 }
 /** Captures the two valid relocation units: User Spot aggregate or one Actor. */
 export declare class ServiceRelocationObjectCaptureOwner {

package/dist/runtime/foundation/service-relocation-object-owner.js

@@ -12,8 +12,8 @@ class ServiceCapturedObjectRelocation {
     async commitSource() {
         if (this.terminal === 'committed')
             return;
-        if (this.terminal === 'aborted') {
-            throw new Error('Relocation source capture was already aborted.');
+        if (this.terminal !== 'open') {
+            throw new Error(`Relocation source capture was already ${this.terminal}.`);
         }
         for (const unit of this.units)
             await unit.commitSeal();
@@ -22,8 +22,8 @@ class ServiceCapturedObjectRelocation {
     async abortSource() {
         if (this.terminal === 'aborted')
             return;
-        if (this.terminal === 'committed') {
-            throw new Error('Committed relocation source capture cannot be aborted.');
+        if (this.terminal !== 'open') {
+            throw new Error(`A ${this.terminal} relocation source capture cannot be aborted.`);
         }
         const failures = [];
         for (const unit of [...this.units].reverse()) {
@@ -39,6 +39,18 @@ class ServiceCapturedObjectRelocation {
             throw new AggregateError(failures, 'Relocation source rollback was incomplete.');
         }
     }
+    /**
+     * The source owner lease ended before the authority settled (spec 28 §4.4):
+     * the source neither resumes nor commits. Retained work is dropped and
+     * every pending request without a terminal fails once with `reason`.
+     */
+    async discardSource(reason) {
+        if (this.terminal !== 'open')
+            return;
+        this.terminal = 'discarded';
+        for (const unit of this.units)
+            await unit.discardSeal?.(reason);
+    }
 }
 exports.ServiceCapturedObjectRelocation = ServiceCapturedObjectRelocation;
 /** Captures the two valid relocation units: User Spot aggregate or one Actor. */

package/dist/runtime/foundation/service-session-binding-ingress-port.d.ts

@@ -2,22 +2,15 @@ export interface ServiceSessionBindingRetainedDelivery {
     deliver(): Promise<boolean>;
     fail(error: unknown): void;
 }
-export interface ServiceSessionBindingAdmissionClaim {
-    readonly actorId: string;
-    readonly objectGeneration: bigint;
-    readonly actorNodeRid: string;
-    readonly actorNodeGeneration: bigint;
-    readonly authorityOwnerGeneration: bigint;
-    readonly ownerLeaseGeneration: bigint;
-    readonly producerNodeRid: string;
-    readonly producerNodeGeneration: bigint;
-    readonly sessionIdentity: string;
-    readonly bindingGeneration: bigint;
-}
 export type ServiceSessionBindingAdmissionResult = 'passThrough' | 'retained' | 'rejected';
 export interface ServiceSessionBindingIngressPort {
     actorSlot(actorId: string, sessionRid: string): Promise<number | undefined>;
-    retainOutbound(claim: ServiceSessionBindingAdmissionClaim, delivery: ServiceSessionBindingRetainedDelivery): Promise<ServiceSessionBindingAdmissionResult>;
+    /**
+     * Holds a current-binding push while its relocation seal is open
+     * (Session–Actor binding §8.1). The caller has already decided that the push
+     * names the current binding.
+     */
+    retainOutbound(actorId: string, delivery: ServiceSessionBindingRetainedDelivery): Promise<ServiceSessionBindingAdmissionResult>;
     clearOutbound(actorId: string, error: unknown): Promise<void>;
 }
 export declare function registerServiceSessionBindingIngressPort(service: object, port: ServiceSessionBindingIngressPort): void;

package/dist/runtime/foundation/service-stateful-runtime.d.ts

@@ -7,15 +7,11 @@ import { type ServiceActorRouteFence, type ServiceRetiredBoundSessionRouteFence,
 import { type ServiceApplicationPayload } from './service-wire-m6a-codec';
 import type { ServiceInstanceActivationRecoveryEnvelope } from './service-instance-activation-recovery-codec';
 import type { ServiceSessionBindingIngressPort } from './service-session-binding-ingress-port';
+import { ZLinkFrameworkRuntimeState } from '../../contracts/Locations';
 export interface ServiceSpotMessageFollowSeal {
     readonly key: string;
     readonly serial: bigint;
 }
-export interface ServiceBoundSessionSendFence {
-    readonly targetNodeGeneration: bigint;
-    readonly authorityOwnerGeneration: bigint;
-    readonly ownerLeaseGeneration: bigint;
-}
 export interface ServiceStatefulResult {
     readonly terminalResult: number;
     readonly failureCode: number;
@@ -223,11 +219,17 @@ export declare class ServiceStatefulRuntime {
     private messageFollowHandler?;
     private mailboxDropHandler?;
     private dispatchErrors?;
+    private spotAdmissionProvider?;
     private dispatchErrorMeshName?;
     private readonly admittedUserSpotOperations;
     private readonly pendingInstanceActivations;
     private closed;
     constructor(raw: RawServiceMeshRuntime, nodeRid: string, nodeGeneration: bigint);
+    setSpotAdmissionProvider(provider: {
+        readonly isClosing: (spotId: string) => boolean;
+        readonly runtimeState: () => ZLinkFrameworkRuntimeState;
+        readonly awaitCloseDecision?: (spotId: string) => Promise<void> | undefined;
+    }): void;
     setMailboxDropHandler(handler: (record: {
         readonly kind: 'spot_multicast' | 'actor_control' | 'actor_binding';
         readonly owner: string;
@@ -305,7 +307,7 @@ export declare class ServiceStatefulRuntime {
     sessionBindings(sessionRid: string): readonly ServiceSessionBinding[];
     allSessionBindings(): readonly ServiceSessionBinding[];
     sendSessionToActor(sessionRid: string, actor: ServiceActorRef, payload: ServiceApplicationPayload): Promise<number>;
-    sendBoundSession(actor: ServiceActorRef, expectedBindingGeneration: bigint, payload: ServiceApplicationPayload, senderFence?: ServiceBoundSessionSendFence): Promise<number>;
+    sendBoundSession(actor: ServiceActorRef, expectedBindingGeneration: bigint, payload: ServiceApplicationPayload): Promise<number>;
     close(): void;
     private ingress;
     private handleIngress;
@@ -349,6 +351,7 @@ export declare class ServiceStatefulRuntime {
     private enqueueSessionBindingTombstone;
     private enqueueSessionBindingRetirement;
     private deliverBoundSession;
+    private traceRejectedBoundSessionSend;
     private enqueueApplicationFrame;
     private enqueueLifecycleFrame;
     private enqueueFrame;
@@ -374,6 +377,7 @@ export declare class ServiceStatefulRuntime {
     private validateActorMessageFence;
     private validateSpotFence;
     private validateDirectSpotFence;
+    private requireDirectSpotAdmission;
     private holdOrRelaySpotMessage;
     private restoreSpotMessageFollowRecord;
     private drainSpotMessageFollow;
@@ -384,7 +388,6 @@ export declare class ServiceStatefulRuntime {
     private peekSpotMessageFollow;
     private takeSpotMessageFollow;
     private actorFence;
-    private tryBoundSessionSendFence;
     private tryActorFence;
     private acceptCanonicalActorFence;
     private trySpotFence;

package/dist/runtime/foundation/service-stateful-runtime.js

@@ -8,16 +8,17 @@ const execution_1 = require("../execution");
 const framework_errors_internal_1 = require("../framework-errors-internal");
 const runtime_values_1 = require("../backend/runtime-values");
 const ZLinkDispatchOptions_1 = require("../../contracts/Dispatch/ZLinkDispatchOptions");
+const message_flow_1 = require("../diagnostics/message-flow");
 const service_runtime_contracts_1 = require("./service-runtime-contracts");
 const message_follow_suppression_registry_1 = require("./message-follow-suppression-registry");
 const service_stateful_registry_1 = require("./service-stateful-registry");
 const service_stateful_wire_codec_1 = require("./service-stateful-wire-codec");
-const routing_id_1 = require("../routing-id");
 const service_wire_pilot_codec_generated_1 = require("../protocol/service_wire_pilot_codec.generated");
 const actor_join_recovery_codec_1 = require("./actor-join-recovery-codec");
 const service_wire_m6a_codec_1 = require("./service-wire-m6a-codec");
 const service_metadata_codec_1 = require("./service-metadata-codec");
 const contracts_1 = require("../../contracts");
+const Locations_1 = require("../../contracts/Locations");
 const ACTOR_ROUTE_STALE = 21;
 const SPOT_MOVING = 34;
 const USER_SPOT_OPERATION_CAPACITY = 65_536;
@@ -83,6 +84,7 @@ class ServiceStatefulRuntime {
     messageFollowHandler;
     mailboxDropHandler;
     dispatchErrors;
+    spotAdmissionProvider;
     dispatchErrorMeshName;
     admittedUserSpotOperations = new Map();
     pendingInstanceActivations = new Map();
@@ -95,6 +97,9 @@ class ServiceStatefulRuntime {
         this.registry.createEntrySpot(nodeRid);
         raw.setServiceIngress((record) => this.ingress(record));
     }
+    setSpotAdmissionProvider(provider) {
+        this.spotAdmissionProvider = provider;
+    }
     setMailboxDropHandler(handler) {
         this.mailboxDropHandler = handler;
     }
@@ -669,7 +674,10 @@ class ServiceStatefulRuntime {
         if (target === undefined) {
             return runtime_values_1.SubmitResult.NotFound;
         }
-        const header = (0, service_stateful_wire_codec_1.encodeSpotHeader)('spotSend', sourceSpotId, target);
+        const header = (0, service_stateful_wire_codec_1.encodeSpotHeader)('spotSend', sourceSpotId, target, undefined, {
+            high: this.nodeGeneration,
+            low: this.nextMessageFollowOperation++
+        });
         return this.submitOneWay(target.targetNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)]);
     }
     requestToSpot(sourceSpotId, requested, payload, timeoutMs) {
@@ -682,7 +690,10 @@ class ServiceStatefulRuntime {
             });
             return pending;
         }
-        const header = (0, service_stateful_wire_codec_1.encodeSpotHeader)('spotRequest', sourceSpotId, target, pending.id);
+        const header = (0, service_stateful_wire_codec_1.encodeSpotHeader)('spotRequest', sourceSpotId, target, pending.id, {
+            high: this.nodeGeneration,
+            low: this.nextMessageFollowOperation++
+        });
         this.submitRequest(pending, target.targetNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'spotRequest');
         return pending;
     }
@@ -695,7 +706,7 @@ class ServiceStatefulRuntime {
             : {
                 ...boundSession,
                 sequence: this.nextSessionSequence++
-            });
+            }, { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ });
         return this.submitOneWay(target.nodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)]);
     }
     requestToActor(target, _targetNodeGeneration, _authorityOwnerGeneration, payload, timeoutMs, sourceActor, boundSession) {
@@ -713,7 +724,7 @@ class ServiceStatefulRuntime {
             : {
                 ...boundSession,
                 sequence: this.nextSessionSequence++
-            });
+            }, { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ });
         this.submitRequest(pending, target.nodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'actorRequest');
         return pending;
     }
@@ -1008,7 +1019,11 @@ class ServiceStatefulRuntime {
             bindingGeneration: delivery.binding.bindingGeneration
         });
     }
-    async sendBoundSession(actor, expectedBindingGeneration, payload, senderFence) {
+    async sendBoundSession(actor, expectedBindingGeneration, payload) {
+        // Session–Actor binding §3 item 3: the source sends by binding identity to
+        // the registered route. The header's owner lifecycle fields are this node's
+        // current route values, not send conditions; the Session owner alone
+        // decides whether the binding is current.
         let binding;
         try {
             binding = this.registry.validateBoundSession(actor, expectedBindingGeneration);
@@ -1016,7 +1031,7 @@ class ServiceStatefulRuntime {
         catch {
             return runtime_values_1.SubmitResult.InvalidState;
         }
-        const actorFence = this.tryBoundSessionSendFence(actor, senderFence);
+        const actorFence = this.tryActorFence(actor);
         if (actorFence === undefined)
             return runtime_values_1.SubmitResult.InvalidState;
         const header = (0, service_stateful_wire_codec_1.encodeBoundSessionSendHeader)(actorFence, expectedBindingGeneration);
@@ -1094,7 +1109,8 @@ class ServiceStatefulRuntime {
                 decoded = statefulActorJoinFromCanonical(canonicalActorJoin);
             }
             else {
-                decoded = (0, service_stateful_wire_codec_1.decodeStatefulHeader)(record.parts[0]);
+                const metadata = (record.flags & service_stateful_wire_codec_1.M6bServiceWireFlag.metadata) !== 0;
+                decoded = (0, service_stateful_wire_codec_1.decodeStatefulHeader)(record.parts[0], record.parts[metadata ? 2 : 1], metadata ? record.parts[1] : undefined);
             }
             const hasPayload = [
                 'spotSend',
@@ -1106,19 +1122,26 @@ class ServiceStatefulRuntime {
                 'boundSessionSend'
             ].includes(decoded.kind);
             const instanceMetadata = decoded.kind === 'instanceSpot' && (record.flags & service_stateful_wire_codec_1.M6bServiceWireFlag.metadata) !== 0;
+            const statefulMetadata = (decoded.kind === 'spotSend' ||
+                decoded.kind === 'spotRequest' ||
+                decoded.kind === 'actorSend' ||
+                decoded.kind === 'actorRequest') &&
+                (record.flags & service_stateful_wire_codec_1.M6bServiceWireFlag.metadata) !== 0;
             const userSpotInfrastructure = decoded.kind === 'userSpotCreate' ||
                 decoded.kind === 'userSpotClose' ||
                 decoded.kind === 'actorCreate' ||
                 decoded.kind === 'messageFollow' ||
                 decoded.kind === 'boundSessionReplaced';
             if (record.parts.length < 1 ||
-                record.parts.length > (instanceMetadata ? 3 : 2) ||
-                (hasPayload && decoded.kind !== 'actorJoin' && record.parts.length !== 2) ||
+                record.parts.length > (instanceMetadata || statefulMetadata ? 3 : 2) ||
+                (hasPayload &&
+                    decoded.kind !== 'actorJoin' &&
+                    record.parts.length !== ((record.flags & service_stateful_wire_codec_1.M6bServiceWireFlag.metadata) !== 0 ? 3 : 2)) ||
                 (decoded.kind === 'instanceSpot' && record.parts.length !== (instanceMetadata ? 3 : 2)) ||
                 (userSpotInfrastructure && record.parts.length !== 1)) {
                 return 'protocolError';
             }
-            const metadataFrame = instanceMetadata
+            const metadataFrame = instanceMetadata || statefulMetadata
                 ? (0, service_metadata_codec_1.validateServiceMetadataFrame)(record.parts[1])
                 : undefined;
             const canonicalPayload = canonicalActorJoin?.payload === undefined
@@ -1201,6 +1224,8 @@ class ServiceStatefulRuntime {
             }
             case 'spotSend':
             case 'spotRequest': {
+                await this.spotAdmissionProvider?.awaitCloseDecision?.(record.target.spot.spotId);
+                this.requireDirectSpotAdmission(record.target.spot.spotId);
                 const followed = this.holdOrRelaySpotMessage(ingress, record);
                 if (followed !== undefined)
                     return followed;
@@ -2232,13 +2257,17 @@ class ServiceStatefulRuntime {
         return accepted;
     }
     async deliverBoundSession(ingress, record, payloadFrame) {
+        // Session–Actor binding §3 item 3, §8.1: this Session owner's binding
+        // record alone decides whether command 36 names the current binding
+        // (ActorId, ObjectGeneration, binding generation; SessionRid is the
+        // record's own). The transport boundary has already authenticated the
+        // source peer, and the header's route fields are not compared here.
+        if (payloadFrame === undefined)
+            return 'protocolError';
         const delivery = this.sessionDeliveries.get(actorKey(record.actor.actor));
         if (delivery === undefined ||
-            delivery.binding.bindingGeneration !== record.expectedBindingGeneration ||
-            payloadFrame === undefined ||
-            ingress.sourceNodeGeneration === undefined ||
-            !(0, routing_id_1.routingIdsEqual)(ingress.sourceRoutingId, record.actor.actor.nodeRid) ||
-            ingress.sourceNodeGeneration !== record.actor.targetNodeGeneration) {
+            delivery.binding.bindingGeneration !== record.expectedBindingGeneration) {
+            this.traceRejectedBoundSessionSend(ingress, record, payloadFrame);
             return 'protocolError';
         }
         const sessionRid = delivery.binding.sessionRid;
@@ -2264,18 +2293,7 @@ class ServiceStatefulRuntime {
                 settle();
             }
         };
-        const decision = await delivery.bindingIngress?.retainOutbound({
-            actorId: record.actor.actor.actorId,
-            objectGeneration: record.actor.actor.generation,
-            actorNodeRid: record.actor.actor.nodeRid,
-            actorNodeGeneration: record.actor.targetNodeGeneration,
-            authorityOwnerGeneration: record.actor.authorityOwnerGeneration,
-            ownerLeaseGeneration: record.actor.ownerLeaseGeneration,
-            producerNodeRid: ingress.sourceRoutingId,
-            producerNodeGeneration: ingress.sourceNodeGeneration,
-            sessionIdentity: sessionRid,
-            bindingGeneration: record.expectedBindingGeneration
-        }, operation);
+        const decision = await delivery.bindingIngress?.retainOutbound(record.actor.actor.actorId, operation);
         if (decision === 'retained')
             return 'application';
         if (decision === 'rejected') {
@@ -2301,6 +2319,35 @@ class ServiceStatefulRuntime {
         }
         return 'application';
     }
+    //  Session–Actor binding §3 item 4: a push refused as not current is
+    //  recorded with the closed flow vocabulary (dropped, stream_session, send,
+    //  stale_target) instead of disappearing. Nothing is built while tracing is
+    //  off.
+    traceRejectedBoundSessionSend(ingress, record, payloadFrame) {
+        const tracePoint = (0, message_flow_1.flowIfEnabled)(this.dispatchErrors?.flow, ZLinkDispatchOptions_1.ZLinkRuntimeMessageFlowOutcome.Dropped);
+        if (tracePoint === undefined)
+            return;
+        let packetName;
+        try {
+            packetName = (0, service_wire_m6a_codec_1.decodeApplicationPayloadView)(payloadFrame).packetName;
+        }
+        catch (error) {
+            // A malformed payload is still a refused push; it is traced without a
+            // packet name.
+            if (!(error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError))
+                throw error;
+        }
+        tracePoint.trace({
+            outcome: ZLinkDispatchOptions_1.ZLinkRuntimeMessageFlowOutcome.Dropped,
+            surface: ZLinkDispatchOptions_1.ZLinkDispatchErrorSurface.StreamSession,
+            messageKind: ZLinkDispatchOptions_1.ZLinkDispatchMessageKind.Send,
+            ...(packetName === undefined ? {} : { packetName }),
+            ...(this.dispatchErrorMeshName === undefined ? {} : { meshName: this.dispatchErrorMeshName }),
+            sourceRid: ingress.sourceRoutingId,
+            actorId: record.actor.actor.actorId,
+            errorReason: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.StaleTarget
+        });
+    }
     enqueueApplicationFrame(ingress, owner, payloadFrame, stateful) {
         return this.enqueueFrame('application', ingress, owner, payloadFrame, stateful);
     }
@@ -2783,7 +2830,7 @@ class ServiceStatefulRuntime {
                     applicationJobOwner
                 };
                 try {
-                    this.submitLocalRequest(localIngress, pending, operationKind, actor, deadlineUnixMs);
+                    await this.submitLocalRequest(localIngress, pending, operationKind, actor, deadlineUnixMs);
                 }
                 catch (error) {
                     this.operations.reply(pending.id, failure(error));
@@ -2854,7 +2901,7 @@ class ServiceStatefulRuntime {
             this.operations.fail(pending.id, error);
         });
     }
-    submitLocalRequest(ingress, pending, operationKind, actor, deadlineUnixMs) {
+    async submitLocalRequest(ingress, pending, operationKind, actor, deadlineUnixMs) {
         const canonicalActorJoin = operationKind === 'actorJoin' ? (0, service_wire_pilot_codec_generated_1.decodeActorJoin28)(ingress.parts) : undefined;
         const decoded = canonicalActorJoin === undefined
             ? (0, service_stateful_wire_codec_1.decodeStatefulHeader)(ingress.parts[0])
@@ -2891,6 +2938,7 @@ class ServiceStatefulRuntime {
         }
         const localReply = (terminalResult, failureCode, replyPayload, tail) => this.operations.reply(pending.id, this.resultFromReply(terminalResult, failureCode, replyPayload, tail, this.nodeRid, actor));
         if (decoded.kind === 'spotRequest') {
+            await this.spotAdmissionProvider?.awaitCloseDecision?.(decoded.target.spot.spotId);
             this.validateDirectSpotFence(decoded.target);
             this.enqueueApplicationFrame(ingress, `spot:${decoded.target.spot.spotId}`, payloadFrame, {
                 receiveKind: service_runtime_contracts_1.ReceiveKind.SpotRequest,
@@ -2911,7 +2959,9 @@ class ServiceStatefulRuntime {
                 operationKind: service_runtime_contracts_1.OperationKind.ActorRequest,
                 correlation: decoded.correlation,
                 targetActor: current.ref,
-                ...(decoded.sourceActor === undefined ? {} : { sourceActor: decoded.sourceActor }),
+                ...(decoded.sourceActor === undefined
+                    ? {}
+                    : { sourceActor: { ...decoded.sourceActor, nodeRid: ingress.sourceRoutingId } }),
                 ...(decoded.boundSession === undefined
                     ? {}
                     : { sourceBindingGeneration: decoded.boundSession.bindingGeneration }),
@@ -3147,6 +3197,11 @@ class ServiceStatefulRuntime {
         return spot;
     }
     validateDirectSpotFence(fence) {
+        if (fence.targetNodeRid !== this.nodeRid ||
+            fence.targetNodeGeneration !== this.nodeGeneration) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${fence.spot.spotId}' targets an unavailable owner route.`);
+        }
+        this.requireDirectSpotAdmission(fence.spot.spotId);
         const spot = this.registry.spot(fence.spot.spotId);
         if (spot === undefined) {
             throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound, `Spot '${fence.spot.spotId}' has no current Ready authority.`);
@@ -3154,10 +3209,6 @@ class ServiceStatefulRuntime {
         if (spot.state !== 'ready') {
             throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${fence.spot.spotId}' is not Ready.`);
         }
-        if (fence.targetNodeRid !== this.nodeRid ||
-            fence.targetNodeGeneration !== this.nodeGeneration) {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${fence.spot.spotId}' targets an unavailable owner route.`);
-        }
         if (spot.kind === 'entry') {
             if (!isEntrySpotFence(fence)) {
                 throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Entry Spot '${fence.spot.spotId}' has an invalid owner fence.`);
@@ -3177,9 +3228,17 @@ class ServiceStatefulRuntime {
         }
         return spot;
     }
+    requireDirectSpotAdmission(spotId) {
+        if (this.spotAdmissionProvider?.runtimeState() === Locations_1.ZLinkFrameworkRuntimeState.Draining) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RuntimeShutdown, `Spot '${spotId}' owner is Draining.`);
+        }
+        if (this.spotAdmissionProvider?.isClosing(spotId) === true) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestRejected, `Spot '${spotId}' authority is Closing.`);
+        }
+    }
     holdOrRelaySpotMessage(ingress, wire) {
         const state = this.spotMessageFollow.get(spotKey(wire.target.spot));
-        if (state === undefined || !sameDirectSpotRoute(state.source, wire.target)) {
+        if (state === undefined || !sameDirectSpotRouteIdentity(state.source, wire.target)) {
             return undefined;
         }
         if (state.expiresAtMs !== undefined && state.expiresAtMs <= performance.now()) {
@@ -3224,9 +3283,11 @@ class ServiceStatefulRuntime {
                 }
                 const current = this.peekSpotMessageFollow(state);
                 try {
+                    const metadata = (current.ingress.parts[0][4] & service_stateful_wire_codec_1.M6bServiceWireFlag.metadata) !== 0;
                     const parts = [
-                        (0, service_stateful_wire_codec_1.encodeSpotHeader)(current.wire.kind, current.wire.sourceSpotId, state.target, current.wire.correlation),
-                        current.ingress.parts[1]
+                        (0, service_stateful_wire_codec_1.encodeSpotHeader)(current.wire.kind, current.wire.sourceSpotId, state.target, current.wire.correlation, current.wire.operation, current.wire.messageFollowHopCount + 1, metadata ? current.ingress.parts[1] : undefined),
+                        ...(metadata ? [current.ingress.parts[1]] : []),
+                        current.ingress.parts[metadata ? 2 : 1]
                     ];
                     if (current.wire.kind === 'spotSend') {
                         if (!(await this.raw.sendService(state.target.targetNodeRid, parts)))
@@ -3341,26 +3402,6 @@ class ServiceStatefulRuntime {
             throw new service_stateful_registry_1.ServiceStaleGenerationError('actor', actor.actorId);
         return route;
     }
-    tryBoundSessionSendFence(actor, senderFence) {
-        if (senderFence === undefined ||
-            senderFence.targetNodeGeneration !== this.nodeGeneration ||
-            senderFence.authorityOwnerGeneration <= 0n ||
-            senderFence.ownerLeaseGeneration <= 0n) {
-            return undefined;
-        }
-        const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
-        if (local === undefined ||
-            !sameActorRef(local.ref, actor) ||
-            local.authorityOwnerGeneration !== senderFence.authorityOwnerGeneration) {
-            return undefined;
-        }
-        return {
-            actor,
-            targetNodeGeneration: senderFence.targetNodeGeneration,
-            authorityOwnerGeneration: senderFence.authorityOwnerGeneration,
-            ownerLeaseGeneration: senderFence.ownerLeaseGeneration
-        };
-    }
     tryActorFence(actor) {
         const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
         if (local !== undefined && sameActorRef(local.ref, actor)) {
@@ -3558,8 +3599,7 @@ function isEntrySpotFence(fence) {
     return (fence.spot.spotId === fence.targetNodeRid &&
         fence.spot.generation === fence.targetNodeGeneration &&
         fence.authorityOwnerGeneration === fence.targetNodeGeneration &&
-        fence.ownerLeaseGeneration === fence.targetNodeGeneration &&
-        fence.storeVersion === `entry:${fence.targetNodeGeneration}`);
+        fence.ownerLeaseGeneration === fence.targetNodeGeneration);
 }
 function userSpotDeadline(deadlineUnixMs) {
     const controller = new AbortController();

package/dist/runtime/foundation/service-stateful-wire-codec.d.ts

@@ -278,6 +278,7 @@ export type ServiceSessionRelocationRoute = {
         readonly targetAuthorityOwnerGeneration: bigint;
         readonly targetNodeRid: string;
         readonly targetNodeGeneration: bigint;
+        readonly targetOwnerLeaseGeneration: bigint;
     };
 } | {
     readonly relocation: ServiceWireOperationId;
@@ -414,8 +415,10 @@ export type ServiceBoundSessionTransition = {
 export type ServiceStatefulWireRecord = {
     readonly kind: 'spotSend' | 'spotRequest';
     readonly correlation?: bigint;
+    readonly operation: ServiceWireOperationId;
+    readonly messageFollowHopCount: number;
     readonly sourceSpotId: string;
-    readonly target: ServiceDirectSpotRouteFence;
+    readonly target: ServiceSpotRouteFence;
 } | {
     readonly kind: 'logicalMulticast';
     readonly channelName: string;
@@ -424,6 +427,8 @@ export type ServiceStatefulWireRecord = {
 } | {
     readonly kind: 'actorSend' | 'actorRequest';
     readonly correlation?: bigint;
+    readonly operation: ServiceWireOperationId;
+    readonly messageFollowHopCount: number;
     readonly sourceActor?: ServiceActorRef;
     readonly target: ServiceActorRouteFence;
     readonly boundSession?: ServiceBoundSessionSource;
@@ -521,8 +526,8 @@ export interface ServiceStatefulReply {
     readonly failureCode: number;
     readonly tail?: ServiceStatefulReplyTail;
 }
-export declare function encodeSpotHeader(kind: 'spotSend' | 'spotRequest', sourceSpotId: string, target: ServiceDirectSpotRouteFence, correlation?: bigint): Buffer;
-export declare function encodeActorHeader(kind: 'actorSend' | 'actorRequest', target: ServiceActorRouteFence, correlation?: bigint, sourceActor?: ServiceActorRef, boundSession?: ServiceBoundSessionSource): Buffer;
+export declare function encodeSpotHeader(kind: 'spotSend' | 'spotRequest', sourceSpotId: string, target: ServiceDirectSpotRouteFence, correlation?: bigint, operation?: ServiceWireOperationId, messageFollowHopCount?: number, metadataFrame?: Uint8Array): Buffer;
+export declare function encodeActorHeader(kind: 'actorSend' | 'actorRequest', target: ServiceActorRouteFence, correlation?: bigint, sourceActor?: ServiceActorRef, boundSession?: ServiceBoundSessionSource, operation?: ServiceWireOperationId, messageFollowHopCount?: number): Buffer;
 export declare function encodeLogicalMulticastHeader(channelName: string, topic: string, sourceSpotId: string): Buffer;
 export declare function encodeActorLookupHeader(correlation: bigint, actorId: string): Buffer;
 export declare function encodeActorDestroyHeader(correlation: bigint, actor: ServiceActorRouteFence): Buffer;
@@ -553,7 +558,7 @@ export declare function encodeUserSpotCreateHeader(record: Omit<ServiceUserSpotC
 export declare function encodeActorCreateHeader(record: Omit<ServiceActorCreateRecord, 'kind'>): Buffer;
 export declare function encodeUserSpotCloseHeader(record: Omit<ServiceUserSpotCloseRecord, 'kind'>): Buffer;
 export declare function encodeMessageFollowHeader(record: Omit<ServiceMessageFollowRecord, 'kind'>): Buffer;
-export declare function decodeStatefulHeader(frame: Uint8Array): ServiceStatefulWireRecord;
+export declare function decodeStatefulHeader(frame: Uint8Array, payloadFrame?: Uint8Array, metadataFrame?: Uint8Array): ServiceStatefulWireRecord;
 export declare function encodeStatefulReply(correlation: bigint, terminalResult: number, failureCode: number, tail?: ServiceStatefulReplyTail): Buffer;
 /** Encodes canonical maintenance relocation commands 30, 31, 34, 40, 52, and 53. */
 export declare function encodeMaintenanceRelocationControl(value: ServiceMaintenanceRelocationControl): Buffer;