@zlink-systems/framework 0.25.0 → 0.26.0

package/src/runtime/foundation/service-authority-payload-codec.ts

@@ -189,6 +189,16 @@ export function decodeServiceReadySpotAuthority(
   return decoded?.state === 'ready' && decoded.operationKind === 0 ? decoded : undefined;
 }
 
+export function decodeServiceClosingSpotAuthority(
+  payload: Uint8Array
+): ServiceReadySpotAuthority | undefined {
+  const decoded = decodeSpotAuthority(payload);
+  return decoded?.operationKind === 3 &&
+    (decoded.kind === 'user_spot' || decoded.state === 'closing')
+    ? decoded
+    : undefined;
+}
+
 export function decodeServiceInstanceAuthorityPayload(
   payload: Uint8Array
 ): ServiceDecodedInstanceAuthority | undefined {

package/src/runtime/foundation/service-maintenance-runtime.ts

@@ -145,12 +145,27 @@ export class ServiceMaintenanceRuntime {
 
   private async runUnits(signal: AbortSignal, stopStartingSignal?: AbortSignal): Promise<void> {
     const pending = new Set<Promise<void>>();
+    // A unit failure is recorded before its promise leaves `pending`, so no
+    // failure is lost. Every started unit runs to its own terminal before the
+    // first failure is reported: the host result follows the settled
+    // authority of each unit (spec 30 §13).
+    const failures: unknown[] = [];
+    const reportFailure = async (): Promise<void> => {
+      if (failures.length === 0) return;
+      await Promise.allSettled(pending);
+      throw failures[0];
+    };
     for (;;) {
+      await reportFailure();
       const queued = await this.lane.run(() => this.units.length > 0);
-      if (!queued && pending.size === 0) return;
+      if (!queued && pending.size === 0) {
+        await reportFailure();
+        return;
+      }
       signal.throwIfAborted();
       if (stopStartingSignal?.aborted === true) {
         await Promise.allSettled(pending);
+        await reportFailure();
         stopStartingSignal.throwIfAborted();
       }
       let admitted = false;
@@ -173,19 +188,25 @@ export class ServiceMaintenanceRuntime {
         admitted = true;
         let running!: Promise<void>;
         running = startOutsideStateLane(() =>
-          unit.relocate(signal).finally(async () => {
-            const publication = await this.lane.run(() => {
-              this.activeOutbound--;
-              pending.delete(running);
-              return this.publishCore();
-            });
-            this.notify(publication);
-          })
+          unit
+            .relocate(signal)
+            .catch((error: unknown) => {
+              failures.push(error);
+            })
+            .finally(async () => {
+              const publication = await this.lane.run(() => {
+                this.activeOutbound--;
+                pending.delete(running);
+                return this.publishCore();
+              });
+              this.notify(publication);
+            })
         );
         pending.add(running);
         this.notify(claim.publication);
       }
       if (pending.size === 0) {
+        await reportFailure();
         if (!admitted) throw new Error('No relocation unit is ready to start.');
       } else {
         await Promise.race(pending);

package/src/runtime/foundation/service-relocation-coordinator.ts

@@ -32,3 +32,16 @@ export class ServiceRelocationPostCommitError extends Error {
     this.name = 'ServiceRelocationPostCommitError';
   }
 }
+
+/**
+ * A relocation whose settled authority leaves the host in `Error` with
+ * `Blocked/RelocationFailed` (spec 30 §13): the source owner lease ended
+ * before its Preserve fence succeeded, or units settled on both the source
+ * and the target.
+ */
+export class ServiceRelocationAuthorityError extends Error {
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = 'ServiceRelocationAuthorityError';
+  }
+}

package/src/runtime/foundation/service-relocation-object-owner.ts

@@ -30,10 +30,12 @@ export interface ServiceRelocationCaptureUnit {
   captureApplicationState(signal?: AbortSignal): Promise<Uint8Array>;
   commitSeal(): Promise<void> | void;
   abortSeal(): Promise<void> | void;
+  /** Expired-owner terminal: pending requests fail once and dispatch stays closed. */
+  discardSeal?(reason: unknown): Promise<void> | void;
 }
 
 export class ServiceCapturedObjectRelocation {
-  private terminal: 'open' | 'committed' | 'aborted' = 'open';
+  private terminal: 'open' | 'committed' | 'aborted' | 'discarded' = 'open';
 
   constructor(
     readonly envelope: ServiceRelocationEnvelope,
@@ -42,8 +44,8 @@ export class ServiceCapturedObjectRelocation {
 
   async commitSource(): Promise<void> {
     if (this.terminal === 'committed') return;
-    if (this.terminal === 'aborted') {
-      throw new Error('Relocation source capture was already aborted.');
+    if (this.terminal !== 'open') {
+      throw new Error(`Relocation source capture was already ${this.terminal}.`);
     }
     for (const unit of this.units) await unit.commitSeal();
     this.terminal = 'committed';
@@ -51,8 +53,8 @@ export class ServiceCapturedObjectRelocation {
 
   async abortSource(): Promise<void> {
     if (this.terminal === 'aborted') return;
-    if (this.terminal === 'committed') {
-      throw new Error('Committed relocation source capture cannot be aborted.');
+    if (this.terminal !== 'open') {
+      throw new Error(`A ${this.terminal} relocation source capture cannot be aborted.`);
     }
     const failures: unknown[] = [];
     for (const unit of [...this.units].reverse()) {
@@ -67,6 +69,17 @@ export class ServiceCapturedObjectRelocation {
       throw new AggregateError(failures, 'Relocation source rollback was incomplete.');
     }
   }
+
+  /**
+   * The source owner lease ended before the authority settled (spec 28 §4.4):
+   * the source neither resumes nor commits. Retained work is dropped and
+   * every pending request without a terminal fails once with `reason`.
+   */
+  async discardSource(reason: unknown): Promise<void> {
+    if (this.terminal !== 'open') return;
+    this.terminal = 'discarded';
+    for (const unit of this.units) await unit.discardSeal?.(reason);
+  }
 }
 
 /** Captures the two valid relocation units: User Spot aggregate or one Actor. */

package/src/runtime/foundation/service-session-binding-ingress-port.ts

@@ -3,25 +3,17 @@ export interface ServiceSessionBindingRetainedDelivery {
   fail(error: unknown): void;
 }
 
-export interface ServiceSessionBindingAdmissionClaim {
-  readonly actorId: string;
-  readonly objectGeneration: bigint;
-  readonly actorNodeRid: string;
-  readonly actorNodeGeneration: bigint;
-  readonly authorityOwnerGeneration: bigint;
-  readonly ownerLeaseGeneration: bigint;
-  readonly producerNodeRid: string;
-  readonly producerNodeGeneration: bigint;
-  readonly sessionIdentity: string;
-  readonly bindingGeneration: bigint;
-}
-
 export type ServiceSessionBindingAdmissionResult = 'passThrough' | 'retained' | 'rejected';
 
 export interface ServiceSessionBindingIngressPort {
   actorSlot(actorId: string, sessionRid: string): Promise<number | undefined>;
+  /**
+   * Holds a current-binding push while its relocation seal is open
+   * (Session–Actor binding §8.1). The caller has already decided that the push
+   * names the current binding.
+   */
   retainOutbound(
-    claim: ServiceSessionBindingAdmissionClaim,
+    actorId: string,
     delivery: ServiceSessionBindingRetainedDelivery
   ): Promise<ServiceSessionBindingAdmissionResult>;
   clearOutbound(actorId: string, error: unknown): Promise<void>;

package/src/runtime/foundation/service-stateful-runtime.ts

@@ -12,9 +12,12 @@ import { RequestResult, SubmitResult, isZLinkBackendResultError } from '../backe
 import type { ZLinkDispatchErrorReporter } from '../channels/dispatch-error-reporter';
 import {
   ZLinkRuntimeDispatchErrorAction as ZLinkDispatchErrorAction,
+  ZLinkRuntimeDispatchErrorReason as ZLinkDispatchErrorReason,
+  ZLinkRuntimeMessageFlowOutcome as ZLinkMessageFlowOutcome,
   ZLinkDispatchErrorSurface,
   ZLinkDispatchMessageKind
 } from '../../contracts/Dispatch/ZLinkDispatchOptions';
+import { flowIfEnabled } from '../diagnostics/message-flow';
 import type {
   RawServiceIngressRecord,
   RawServiceMeshRuntime,
@@ -80,7 +83,6 @@ import {
   type ServiceUserSpotCloseRecord,
   type ServiceUserSpotCreateRecord
 } from './service-stateful-wire-codec';
-import { routingIdsEqual } from '../routing-id';
 import {
   decodeActorJoin28,
   encodeActorJoin28,
@@ -90,6 +92,7 @@ import { canonicalActorJoinHandoffId, routingIdBytes } from './actor-join-recove
 
 import {
   decodeApplicationPayload,
+  decodeApplicationPayloadView,
   encodeApplicationPayload,
   type ServiceApplicationPayload,
   ServiceWireProtocolError
@@ -98,6 +101,7 @@ import type { ServiceInstanceActivationRecoveryEnvelope } from './service-instan
 import { validateServiceMetadataFrame } from './service-metadata-codec';
 import type { ServiceSessionBindingIngressPort } from './service-session-binding-ingress-port';
 import { ZLinkFrameworkException } from '../../contracts';
+import { ZLinkFrameworkRuntimeState } from '../../contracts/Locations';
 
 const ACTOR_ROUTE_STALE = 21;
 const SPOT_MOVING = 34;
@@ -110,12 +114,6 @@ export interface ServiceSpotMessageFollowSeal {
   readonly serial: bigint;
 }
 
-export interface ServiceBoundSessionSendFence {
-  readonly targetNodeGeneration: bigint;
-  readonly authorityOwnerGeneration: bigint;
-  readonly ownerLeaseGeneration: bigint;
-}
-
 interface ServiceSpotMessageFollowRecord {
   readonly ingress: RawServiceIngressRecord;
   readonly wire: Extract<ServiceStatefulWireRecord, { readonly kind: 'spotSend' | 'spotRequest' }>;
@@ -408,6 +406,11 @@ export class ServiceStatefulRuntime {
     readonly owner: string;
   }) => void;
   private dispatchErrors?: ZLinkDispatchErrorReporter;
+  private spotAdmissionProvider?: {
+    readonly isClosing: (spotId: string) => boolean;
+    readonly runtimeState: () => ZLinkFrameworkRuntimeState;
+    readonly awaitCloseDecision?: (spotId: string) => Promise<void> | undefined;
+  };
   private dispatchErrorMeshName?: string;
   private readonly admittedUserSpotOperations = new Map<
     string,
@@ -437,6 +440,14 @@ export class ServiceStatefulRuntime {
     raw.setServiceIngress((record) => this.ingress(record));
   }
 
+  setSpotAdmissionProvider(provider: {
+    readonly isClosing: (spotId: string) => boolean;
+    readonly runtimeState: () => ZLinkFrameworkRuntimeState;
+    readonly awaitCloseDecision?: (spotId: string) => Promise<void> | undefined;
+  }): void {
+    this.spotAdmissionProvider = provider;
+  }
+
   setMailboxDropHandler(
     handler: (record: {
       readonly kind: 'spot_multicast' | 'actor_control' | 'actor_binding';
@@ -1296,7 +1307,10 @@ export class ServiceStatefulRuntime {
     if (target === undefined) {
       return SubmitResult.NotFound;
     }
-    const header = encodeSpotHeader('spotSend', sourceSpotId, target);
+    const header = encodeSpotHeader('spotSend', sourceSpotId, target, undefined, {
+      high: this.nodeGeneration,
+      low: this.nextMessageFollowOperation++
+    });
     return this.submitOneWay(target.targetNodeRid, [header, encodeApplicationPayload(payload)]);
   }
 
@@ -1315,7 +1329,10 @@ export class ServiceStatefulRuntime {
       });
       return pending;
     }
-    const header = encodeSpotHeader('spotRequest', sourceSpotId, target, pending.id);
+    const header = encodeSpotHeader('spotRequest', sourceSpotId, target, pending.id, {
+      high: this.nodeGeneration,
+      low: this.nextMessageFollowOperation++
+    });
     this.submitRequest(
       pending,
       target.targetNodeRid,
@@ -1346,7 +1363,8 @@ export class ServiceStatefulRuntime {
         : {
             ...boundSession,
             sequence: this.nextSessionSequence++
-          }
+          },
+      { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ }
     );
     return this.submitOneWay(target.nodeRid, [header, encodeApplicationPayload(payload)]);
   }
@@ -1379,7 +1397,8 @@ export class ServiceStatefulRuntime {
         : {
             ...boundSession,
             sequence: this.nextSessionSequence++
-          }
+          },
+      { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ }
     );
     this.submitRequest(
       pending,
@@ -1935,16 +1954,19 @@ export class ServiceStatefulRuntime {
   async sendBoundSession(
     actor: ServiceActorRef,
     expectedBindingGeneration: bigint,
-    payload: ServiceApplicationPayload,
-    senderFence?: ServiceBoundSessionSendFence
+    payload: ServiceApplicationPayload
   ): Promise<number> {
+    // Session–Actor binding §3 item 3: the source sends by binding identity to
+    // the registered route. The header's owner lifecycle fields are this node's
+    // current route values, not send conditions; the Session owner alone
+    // decides whether the binding is current.
     let binding: ServiceSessionBinding;
     try {
       binding = this.registry.validateBoundSession(actor, expectedBindingGeneration);
     } catch {
       return SubmitResult.InvalidState;
     }
-    const actorFence = this.tryBoundSessionSendFence(actor, senderFence);
+    const actorFence = this.tryActorFence(actor);
     if (actorFence === undefined) return SubmitResult.InvalidState;
     const header = encodeBoundSessionSendHeader(actorFence, expectedBindingGeneration);
     return this.submitOneWay(binding.sessionOwnerNodeRid, [
@@ -2026,7 +2048,12 @@ export class ServiceStatefulRuntime {
         }
         decoded = statefulActorJoinFromCanonical(canonicalActorJoin);
       } else {
-        decoded = decodeStatefulHeader(record.parts[0]!);
+        const metadata = (record.flags & M6bServiceWireFlag.metadata) !== 0;
+        decoded = decodeStatefulHeader(
+          record.parts[0]!,
+          record.parts[metadata ? 2 : 1],
+          metadata ? record.parts[1] : undefined
+        );
       }
       const hasPayload = [
         'spotSend',
@@ -2039,6 +2066,12 @@ export class ServiceStatefulRuntime {
       ].includes(decoded.kind);
       const instanceMetadata =
         decoded.kind === 'instanceSpot' && (record.flags & M6bServiceWireFlag.metadata) !== 0;
+      const statefulMetadata =
+        (decoded.kind === 'spotSend' ||
+          decoded.kind === 'spotRequest' ||
+          decoded.kind === 'actorSend' ||
+          decoded.kind === 'actorRequest') &&
+        (record.flags & M6bServiceWireFlag.metadata) !== 0;
       const userSpotInfrastructure =
         decoded.kind === 'userSpotCreate' ||
         decoded.kind === 'userSpotClose' ||
@@ -2047,16 +2080,19 @@ export class ServiceStatefulRuntime {
         decoded.kind === 'boundSessionReplaced';
       if (
         record.parts.length < 1 ||
-        record.parts.length > (instanceMetadata ? 3 : 2) ||
-        (hasPayload && decoded.kind !== 'actorJoin' && record.parts.length !== 2) ||
+        record.parts.length > (instanceMetadata || statefulMetadata ? 3 : 2) ||
+        (hasPayload &&
+          decoded.kind !== 'actorJoin' &&
+          record.parts.length !== ((record.flags & M6bServiceWireFlag.metadata) !== 0 ? 3 : 2)) ||
         (decoded.kind === 'instanceSpot' && record.parts.length !== (instanceMetadata ? 3 : 2)) ||
         (userSpotInfrastructure && record.parts.length !== 1)
       ) {
         return 'protocolError';
       }
-      const metadataFrame = instanceMetadata
-        ? validateServiceMetadataFrame(record.parts[1]!)
-        : undefined;
+      const metadataFrame =
+        instanceMetadata || statefulMetadata
+          ? validateServiceMetadataFrame(record.parts[1]!)
+          : undefined;
       const canonicalPayload =
         canonicalActorJoin?.payload === undefined
           ? undefined
@@ -2162,6 +2198,8 @@ export class ServiceStatefulRuntime {
       }
       case 'spotSend':
       case 'spotRequest': {
+        await this.spotAdmissionProvider?.awaitCloseDecision?.(record.target.spot.spotId);
+        this.requireDirectSpotAdmission(record.target.spot.spotId);
         const followed = this.holdOrRelaySpotMessage(ingress, record);
         if (followed !== undefined) return followed;
         this.validateDirectSpotFence(record.target);
@@ -3627,15 +3665,18 @@ export class ServiceStatefulRuntime {
     record: Extract<ServiceStatefulWireRecord, { readonly kind: 'boundSessionSend' }>,
     payloadFrame: Uint8Array | undefined
   ): Promise<RawServicePumpResult> {
+    // Session–Actor binding §3 item 3, §8.1: this Session owner's binding
+    // record alone decides whether command 36 names the current binding
+    // (ActorId, ObjectGeneration, binding generation; SessionRid is the
+    // record's own). The transport boundary has already authenticated the
+    // source peer, and the header's route fields are not compared here.
+    if (payloadFrame === undefined) return 'protocolError';
     const delivery = this.sessionDeliveries.get(actorKey(record.actor.actor));
     if (
       delivery === undefined ||
-      delivery.binding.bindingGeneration !== record.expectedBindingGeneration ||
-      payloadFrame === undefined ||
-      ingress.sourceNodeGeneration === undefined ||
-      !routingIdsEqual(ingress.sourceRoutingId, record.actor.actor.nodeRid) ||
-      ingress.sourceNodeGeneration !== record.actor.targetNodeGeneration
+      delivery.binding.bindingGeneration !== record.expectedBindingGeneration
     ) {
+      this.traceRejectedBoundSessionSend(ingress, record, payloadFrame);
       return 'protocolError';
     }
     const sessionRid = delivery.binding.sessionRid;
@@ -3659,18 +3700,7 @@ export class ServiceStatefulRuntime {
       }
     };
     const decision = await delivery.bindingIngress?.retainOutbound(
-      {
-        actorId: record.actor.actor.actorId,
-        objectGeneration: record.actor.actor.generation,
-        actorNodeRid: record.actor.actor.nodeRid,
-        actorNodeGeneration: record.actor.targetNodeGeneration,
-        authorityOwnerGeneration: record.actor.authorityOwnerGeneration,
-        ownerLeaseGeneration: record.actor.ownerLeaseGeneration,
-        producerNodeRid: ingress.sourceRoutingId,
-        producerNodeGeneration: ingress.sourceNodeGeneration,
-        sessionIdentity: sessionRid,
-        bindingGeneration: record.expectedBindingGeneration
-      },
+      record.actor.actor.actorId,
       operation
     );
     if (decision === 'retained') return 'application';
@@ -3698,6 +3728,37 @@ export class ServiceStatefulRuntime {
     return 'application';
   }
 
+  //  Session–Actor binding §3 item 4: a push refused as not current is
+  //  recorded with the closed flow vocabulary (dropped, stream_session, send,
+  //  stale_target) instead of disappearing. Nothing is built while tracing is
+  //  off.
+  private traceRejectedBoundSessionSend(
+    ingress: RawServiceIngressRecord,
+    record: Extract<ServiceStatefulWireRecord, { readonly kind: 'boundSessionSend' }>,
+    payloadFrame: Uint8Array
+  ): void {
+    const tracePoint = flowIfEnabled(this.dispatchErrors?.flow, ZLinkMessageFlowOutcome.Dropped);
+    if (tracePoint === undefined) return;
+    let packetName: string | undefined;
+    try {
+      packetName = decodeApplicationPayloadView(payloadFrame).packetName;
+    } catch (error) {
+      // A malformed payload is still a refused push; it is traced without a
+      // packet name.
+      if (!(error instanceof ServiceWireProtocolError)) throw error;
+    }
+    tracePoint.trace({
+      outcome: ZLinkMessageFlowOutcome.Dropped,
+      surface: ZLinkDispatchErrorSurface.StreamSession,
+      messageKind: ZLinkDispatchMessageKind.Send,
+      ...(packetName === undefined ? {} : { packetName }),
+      ...(this.dispatchErrorMeshName === undefined ? {} : { meshName: this.dispatchErrorMeshName }),
+      sourceRid: ingress.sourceRoutingId,
+      actorId: record.actor.actor.actorId,
+      errorReason: ZLinkDispatchErrorReason.StaleTarget
+    });
+  }
+
   private enqueueApplicationFrame(
     ingress: RawServiceIngressRecord,
     owner: string,
@@ -4311,7 +4372,13 @@ export class ServiceStatefulRuntime {
           applicationJobOwner
         };
         try {
-          this.submitLocalRequest(localIngress, pending, operationKind, actor, deadlineUnixMs);
+          await this.submitLocalRequest(
+            localIngress,
+            pending,
+            operationKind,
+            actor,
+            deadlineUnixMs
+          );
         } catch (error) {
           this.operations.reply(pending.id, failure(error));
         } finally {
@@ -4412,7 +4479,7 @@ export class ServiceStatefulRuntime {
     );
   }
 
-  private submitLocalRequest(
+  private async submitLocalRequest(
     ingress: RawServiceIngressRecord,
     pending: ServiceStatefulPendingOperation,
     operationKind:
@@ -4426,7 +4493,7 @@ export class ServiceStatefulRuntime {
       | 'instanceSpotRequest',
     actor?: ServiceActorRef,
     deadlineUnixMs?: bigint
-  ): void {
+  ): Promise<void> {
     const canonicalActorJoin =
       operationKind === 'actorJoin' ? decodeActorJoin28(ingress.parts) : undefined;
     const decoded =
@@ -4477,6 +4544,7 @@ export class ServiceStatefulRuntime {
         this.resultFromReply(terminalResult, failureCode, replyPayload, tail, this.nodeRid, actor)
       );
     if (decoded.kind === 'spotRequest') {
+      await this.spotAdmissionProvider?.awaitCloseDecision?.(decoded.target.spot.spotId);
       this.validateDirectSpotFence(decoded.target);
       this.enqueueApplicationFrame(ingress, `spot:${decoded.target.spot.spotId}`, payloadFrame!, {
         receiveKind: ReceiveKind.SpotRequest,
@@ -4502,7 +4570,9 @@ export class ServiceStatefulRuntime {
           operationKind: OperationKind.ActorRequest,
           correlation: decoded.correlation,
           targetActor: current.ref,
-          ...(decoded.sourceActor === undefined ? {} : { sourceActor: decoded.sourceActor }),
+          ...(decoded.sourceActor === undefined
+            ? {}
+            : { sourceActor: { ...decoded.sourceActor, nodeRid: ingress.sourceRoutingId } }),
           ...(decoded.boundSession === undefined
             ? {}
             : { sourceBindingGeneration: decoded.boundSession.bindingGeneration }),
@@ -4801,7 +4871,17 @@ export class ServiceStatefulRuntime {
     return spot;
   }
 
-  private validateDirectSpotFence(fence: ServiceDirectSpotRouteFence): ServiceSpotState {
+  private validateDirectSpotFence(fence: ServiceSpotRouteFence): ServiceSpotState {
+    if (
+      fence.targetNodeRid !== this.nodeRid ||
+      fence.targetNodeGeneration !== this.nodeGeneration
+    ) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.SpotMoving,
+        `Spot '${fence.spot.spotId}' targets an unavailable owner route.`
+      );
+    }
+    this.requireDirectSpotAdmission(fence.spot.spotId);
     const spot = this.registry.spot(fence.spot.spotId);
     if (spot === undefined) {
       throw createInternalFrameworkException(
@@ -4815,15 +4895,6 @@ export class ServiceStatefulRuntime {
         `Spot '${fence.spot.spotId}' is not Ready.`
       );
     }
-    if (
-      fence.targetNodeRid !== this.nodeRid ||
-      fence.targetNodeGeneration !== this.nodeGeneration
-    ) {
-      throw createInternalFrameworkException(
-        ZLinkFrameworkInternalErrorKind.SpotMoving,
-        `Spot '${fence.spot.spotId}' targets an unavailable owner route.`
-      );
-    }
     if (spot.kind === 'entry') {
       if (!isEntrySpotFence(fence)) {
         throw createInternalFrameworkException(
@@ -4855,12 +4926,27 @@ export class ServiceStatefulRuntime {
     return spot;
   }
 
+  private requireDirectSpotAdmission(spotId: string): void {
+    if (this.spotAdmissionProvider?.runtimeState() === ZLinkFrameworkRuntimeState.Draining) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.RuntimeShutdown,
+        `Spot '${spotId}' owner is Draining.`
+      );
+    }
+    if (this.spotAdmissionProvider?.isClosing(spotId) === true) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.RequestRejected,
+        `Spot '${spotId}' authority is Closing.`
+      );
+    }
+  }
+
   private holdOrRelaySpotMessage(
     ingress: RawServiceIngressRecord,
     wire: Extract<ServiceStatefulWireRecord, { readonly kind: 'spotSend' | 'spotRequest' }>
   ): RawServicePumpResult | undefined {
     const state = this.spotMessageFollow.get(spotKey(wire.target.spot));
-    if (state === undefined || !sameDirectSpotRoute(state.source, wire.target)) {
+    if (state === undefined || !sameDirectSpotRouteIdentity(state.source, wire.target)) {
       return undefined;
     }
     if (state.expiresAtMs !== undefined && state.expiresAtMs <= performance.now()) {
@@ -4912,14 +4998,19 @@ export class ServiceStatefulRuntime {
         }
         const current = this.peekSpotMessageFollow(state)!;
         try {
+          const metadata = (current.ingress.parts[0]![4]! & M6bServiceWireFlag.metadata) !== 0;
           const parts = [
             encodeSpotHeader(
               current.wire.kind,
               current.wire.sourceSpotId,
               state.target,
-              current.wire.correlation!
+              current.wire.correlation,
+              current.wire.operation,
+              current.wire.messageFollowHopCount + 1,
+              metadata ? current.ingress.parts[1] : undefined
             ),
-            current.ingress.parts[1]!
+            ...(metadata ? [current.ingress.parts[1]!] : []),
+            current.ingress.parts[metadata ? 2 : 1]!
           ];
           if (current.wire.kind === 'spotSend') {
             if (!(await this.raw.sendService(state.target.targetNodeRid, parts))) continue;
@@ -5058,34 +5149,6 @@ export class ServiceStatefulRuntime {
     return route;
   }
 
-  private tryBoundSessionSendFence(
-    actor: ServiceActorRef,
-    senderFence: ServiceBoundSessionSendFence | undefined
-  ): ServiceActorRouteFence | undefined {
-    if (
-      senderFence === undefined ||
-      senderFence.targetNodeGeneration !== this.nodeGeneration ||
-      senderFence.authorityOwnerGeneration <= 0n ||
-      senderFence.ownerLeaseGeneration <= 0n
-    ) {
-      return undefined;
-    }
-    const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
-    if (
-      local === undefined ||
-      !sameActorRef(local.ref, actor) ||
-      local.authorityOwnerGeneration !== senderFence.authorityOwnerGeneration
-    ) {
-      return undefined;
-    }
-    return {
-      actor,
-      targetNodeGeneration: senderFence.targetNodeGeneration,
-      authorityOwnerGeneration: senderFence.authorityOwnerGeneration,
-      ownerLeaseGeneration: senderFence.ownerLeaseGeneration
-    };
-  }
-
   private tryActorFence(actor: ServiceActorRef): ServiceActorRouteFence | undefined {
     const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
     if (local !== undefined && sameActorRef(local.ref, actor)) {
@@ -5317,13 +5380,12 @@ function serviceSpotPublishFailureReason(
   }
 }
 
-function isEntrySpotFence(fence: ServiceDirectSpotRouteFence): boolean {
+function isEntrySpotFence(fence: ServiceSpotRouteFence): boolean {
   return (
     fence.spot.spotId === fence.targetNodeRid &&
     fence.spot.generation === fence.targetNodeGeneration &&
     fence.authorityOwnerGeneration === fence.targetNodeGeneration &&
-    fence.ownerLeaseGeneration === fence.targetNodeGeneration &&
-    fence.storeVersion === `entry:${fence.targetNodeGeneration}`
+    fence.ownerLeaseGeneration === fence.targetNodeGeneration
   );
 }
 
@@ -5744,15 +5806,15 @@ function sameMessageFollowSpotSource(
 }
 
 function sameDirectSpotRouteIdentity(
-  left: ServiceDirectSpotRouteFence,
-  right: ServiceDirectSpotRouteFence
+  left: ServiceSpotRouteFence,
+  right: ServiceSpotRouteFence
 ): boolean {
   return sameDirectSpotOwnerIdentity(left, right) && left.spot.generation === right.spot.generation;
 }
 
 function sameDirectSpotOwnerIdentity(
-  left: ServiceDirectSpotRouteFence,
-  right: ServiceDirectSpotRouteFence
+  left: ServiceSpotRouteFence,
+  right: ServiceSpotRouteFence
 ): boolean {
   return (
     left.spot.spotId === right.spot.spotId &&