@zlink-systems/framework 0.25.0 → 0.27.0

package/src/runtime/streams/actor-session-binding-registry.ts

@@ -1,19 +1,21 @@
+import { AsyncResource } from 'node:async_hooks';
+import {
+  ZLinkFrameworkErrorKind,
+  ZLinkFrameworkException
+} from '../../contracts/Errors/ZLinkFrameworkException';
+import { zlinkDefaultLocationOptions } from '../../contracts/Locations/Options';
+import { createAbortError, throwIfAborted } from '../abort';
+import { ZLinkStateLane } from '../execution/state-lane';
 import {
   ZLinkFrameworkInternalErrorKind,
   createInternalFrameworkException
 } from '../framework-errors-internal';
-import { createAbortError, throwIfAborted } from '../abort';
-import { AsyncResource } from 'node:async_hooks';
-import { ZLinkStateLane } from '../execution/state-lane';
-import { routingIdsEqual } from '../routing-id';
-import type {
-  ServiceSessionBindingAdmissionClaim,
-  ServiceSessionBindingAdmissionResult
-} from '../foundation/service-session-binding-ingress-port';
+export const DEFAULT_TERMINAL_RELOCATION_CAPACITY = 4096;
 
 const detachedStateLaneResource = new AsyncResource('zlink:actor-session-binding-registry');
 export interface ZLinkActorSessionBindingActor {
   readonly actorId: string;
+  readonly ref: { readonly actorId: string; readonly bindingGeneration?: bigint };
 }
 
 export interface ZLinkActorSessionBindingContext<TActor extends ZLinkActorSessionBindingActor> {
@@ -50,20 +52,6 @@ export interface ZLinkActorSessionRelocationClaim {
   readonly sealId: string;
 }
 
-export interface ZLinkActorSessionRetainedOutbound {
-  deliver(): Promise<boolean>;
-  fail(error: unknown): void;
-}
-
-export interface ZLinkActorSessionAcceptedProducerProof {
-  readonly actorId: string;
-  readonly objectGeneration: bigint;
-  readonly actorNodeRid: string;
-  readonly actorNodeGeneration: bigint;
-  readonly sessionIdentity: string;
-  readonly bindingGeneration: bigint;
-}
-
 export interface ZLinkActorSessionRelocationSnapshot extends ZLinkActorSessionRelocationClaim {
   readonly phase: 'sealed' | 'applying' | 'applied' | 'terminal';
   readonly applyFingerprint?: string;
@@ -107,30 +95,21 @@ interface ZLinkActorSessionRelocationState {
   phase: 'sealed' | 'applying' | 'applied' | 'terminal';
   applyFingerprint?: string;
   applyPromise?: Promise<void>;
-  acceptedProducerProof?: ZLinkActorSessionAcceptedProducerProof;
   readonly ready: Promise<void>;
   readonly terminal: Promise<void>;
   readonly resolveTerminal: () => void;
 }
 
-interface ZLinkActorSessionOutboundEntry {
-  readonly sealId?: string;
-  readonly operation: ZLinkActorSessionRetainedOutbound;
-  readonly arrivalOrder: bigint;
-  readonly claim?: ServiceSessionBindingAdmissionClaim;
-  readonly authorization: 'legacy' | 'source' | 'pendingTarget';
-  released: boolean;
-  settled: boolean;
-}
-
 interface ZLinkActorSessionRelocationQueue {
   readonly actorId: string;
   activeSealId?: string;
   readonly seals: Map<string, ZLinkActorSessionRelocationState>;
-  readonly outbound: ZLinkActorSessionOutboundEntry[];
-  nextArrivalOrder: bigint;
-  outboundCount: number;
-  drainPromise?: Promise<void>;
+  readonly ingress: Array<{
+    sealId?: string;
+    readonly deliver: () => Promise<void>;
+    readonly drop: (reason: 'stale_target' | 'target_closed' | 'shutdown', error?: unknown) => void;
+  }>;
+  ingressDrain?: Promise<void>;
 }
 
 export interface ZLinkActorSessionAuthorityFence {
@@ -167,24 +146,20 @@ export class ZLinkActorSessionBindingRegistry<
   private readonly terminalRelocations = new Map<ZLinkActorSessionRelocationState, true>();
 
   constructor(
-    private readonly terminalRelocationCapacity = 4096,
-    private readonly outboundCapacity = 4096,
+    private readonly terminalRelocationCapacity: number = DEFAULT_TERMINAL_RELOCATION_CAPACITY,
     //  Spec 06 — SessionRelocationSealTimeout bounds how long a session
     //  relocation seal may hold ingress (default 3,000 ms, finite only).
     //  Every wait on the seal (accept paths) and on active-frame drain
     //  (the sealing side) must observe that bound; an unbounded wait here
     //  turns a lost control or a lifecycle interlock into a silent stall
     //  (spec 48:205 — transport/deadline limits apply during relocation).
-    private readonly sealWaitTimeoutMs = 3_000,
+    private readonly sealWaitTimeoutMs: number = zlinkDefaultLocationOptions.sessionRelocationSealTimeoutMs,
     private readonly errorSink?: () =>
       { reportRuntimeTaskException(taskName: string, error: unknown): void } | undefined
   ) {
     if (!Number.isSafeInteger(terminalRelocationCapacity) || terminalRelocationCapacity <= 0) {
       throw new RangeError('Session relocation terminal capacity must be a positive safe integer.');
     }
-    if (!Number.isSafeInteger(outboundCapacity) || outboundCapacity <= 0) {
-      throw new RangeError('Session relocation outbound capacity must be a positive safe integer.');
-    }
     if (!Number.isSafeInteger(sealWaitTimeoutMs) || sealWaitTimeoutMs <= 0) {
       throw new RangeError('Session relocation seal timeout must be a positive safe integer.');
     }
@@ -211,7 +186,7 @@ export class ZLinkActorSessionBindingRegistry<
     );
   }
 
-  private async commitCore(
+  private commitCore(
     previous: ZLinkActorSessionRoute<TContext, TActor> | undefined,
     context: TContext,
     actor: TActor,
@@ -219,7 +194,7 @@ export class ZLinkActorSessionBindingRegistry<
     authorityFence?: ZLinkActorSessionAuthorityFence,
     sessionIdentity?: string,
     commitActor?: () => void
-  ): Promise<void> {
+  ): void {
     const current = this.routes.get(actor.actorId);
     if (current !== previous) {
       throw createInternalFrameworkException(
@@ -255,7 +230,24 @@ export class ZLinkActorSessionBindingRegistry<
       }
 
       if (!sameBinding && actorSlot !== undefined) {
-        await context.actorSlotControls!.enqueueBound(actorSlot, actor.actorId);
+        // Session–Actor binding §5-2: `$zlink.actor.bound` enters the ordered
+        // STREAM queue before the slot is published; transport completion is
+        // not awaited inside the state lane (execution gate).
+        void context
+          .actorSlotControls!.enqueueBound(actorSlot, actor.actorId)
+          .catch(async (error) => {
+            this.errorSink?.()?.reportRuntimeTaskException('session actor bound', error);
+            // The client never learned the slot, so the binding ends through
+            // the one unbind path; no `$zlink.actor.unbound` follows.
+            await this.unbind(
+              actor.actorId,
+              context,
+              bindingToken,
+              ZLinkActorSessionBindingTermination.PhysicalDisconnect
+            ).catch((unbindError) =>
+              this.errorSink?.()?.reportRuntimeTaskException('session actor bound', unbindError)
+            );
+          });
       }
     } catch (error) {
       context.unbindLocal(actor.actorId, bindingToken);
@@ -333,7 +325,7 @@ export class ZLinkActorSessionBindingRegistry<
     );
   }
 
-  private async replaceAndReleaseSealCore(
+  private replaceAndReleaseSealCore(
     previous: ZLinkActorSessionRoute<TContext, TActor>,
     context: TContext,
     actor: TActor,
@@ -342,7 +334,7 @@ export class ZLinkActorSessionBindingRegistry<
     authorityFence?: ZLinkActorSessionAuthorityFence,
     sessionIdentity?: string,
     commitActor?: () => void
-  ): Promise<void> {
+  ): void {
     if (previous.sealId !== sealId) {
       throw createInternalFrameworkException(
         ZLinkFrameworkInternalErrorKind.ActorLocationStale,
@@ -353,7 +345,7 @@ export class ZLinkActorSessionBindingRegistry<
     // JavaScript cannot interleave another ingress turn between these two
     // synchronous mutations. The replacement preserves the seal, then the
     // exact release publishes the route to held ingress as one owner turn.
-    await this.commitCore(
+    this.commitCore(
       previous,
       context,
       actor,
@@ -383,6 +375,22 @@ export class ZLinkActorSessionBindingRegistry<
     return await this.lane.run(() => this.routeCore(actorId));
   }
 
+  /** Selects the route only when it is the exact Session binding (§8.1 validation values). */
+  async routeForSessionBinding(
+    actorId: string,
+    sessionRid: string,
+    bindingGeneration?: bigint
+  ): Promise<ZLinkActorSessionRoute<TContext, TActor> | undefined> {
+    return await this.lane.run(() => {
+      const route = this.routeCore(actorId);
+      const generation = route?.actor.ref.bindingGeneration;
+      return route?.sessionIdentity === sessionRid &&
+        (bindingGeneration === undefined || generation === bindingGeneration)
+        ? route
+        : undefined;
+    });
+  }
+
   private routeCore(actorId: string): ZLinkActorSessionRoute<TContext, TActor> | undefined {
     return this.routes.get(actorId);
   }
@@ -415,15 +423,19 @@ export class ZLinkActorSessionBindingRegistry<
     bindingToken: string,
     termination = ZLinkActorSessionBindingTermination.BindingEnd
   ): Promise<void> {
-    await this.lane.run(() => this.unbindCore(actorId, context, bindingToken, termination));
+    const { submission } = await this.lane.run(() => ({
+      submission: this.unbindCore(actorId, context, bindingToken, termination)
+    }));
+    await submission;
   }
 
-  private async unbindCore(
+  /** Fixes the unbind order in the lane; the caller awaits transport completion outside it. */
+  private unbindCore(
     actorId: string,
     context: TContext,
     bindingToken: string,
     termination: ZLinkActorSessionBindingTermination
-  ): Promise<void> {
+  ): Promise<void> | undefined {
     const route = this.routes.get(actorId);
     if (route === undefined || route.context !== context || route.bindingToken !== bindingToken) {
       return;
@@ -438,29 +450,29 @@ export class ZLinkActorSessionBindingRegistry<
       actorId,
       new Error(`Actor '${actorId}' session binding was removed while accepted frames were active.`)
     );
-    this.clearRouteRelocation(
-      actorId,
-      route,
-      new Error(`Actor '${actorId}' session binding was removed.`)
-    );
+    this.clearRouteRelocation(actorId, route);
     if (
       termination === ZLinkActorSessionBindingTermination.BindingEnd &&
       route.actorSlot !== undefined
     ) {
-      await context.actorSlotControls?.enqueueUnbound(route.actorSlot);
+      return context.actorSlotControls?.enqueueUnbound(route.actorSlot);
     }
+    return undefined;
   }
 
   async unbindActor(actorId: string): Promise<void> {
-    await this.lane.run(() => this.unbindActorCore(actorId));
+    const { submission } = await this.lane.run(() => ({
+      submission: this.unbindActorCore(actorId)
+    }));
+    await submission;
   }
 
-  private async unbindActorCore(actorId: string): Promise<void> {
+  private unbindActorCore(actorId: string): Promise<void> | undefined {
     const route = this.routes.get(actorId);
     if (route === undefined) {
-      return;
+      return undefined;
     }
-    await this.unbindCore(
+    return this.unbindCore(
       actorId,
       route.context,
       route.bindingToken,
@@ -472,10 +484,10 @@ export class ZLinkActorSessionBindingRegistry<
     await this.lane.run(() => this.cleanupCore(context));
   }
 
-  private async cleanupCore(context: TContext): Promise<void> {
+  private cleanupCore(context: TContext): void {
     for (const route of [...this.routes.values()]) {
       if (route.context === context) {
-        await this.unbindCore(
+        this.unbindCore(
           route.actor.actorId,
           context,
           route.bindingToken,
@@ -539,6 +551,37 @@ export class ZLinkActorSessionBindingRegistry<
     }
   }
 
+  async acceptOneWay(
+    actorId: string,
+    bindingToken: string,
+    prepare: () => {
+      readonly deliver: () => Promise<void>;
+      readonly drop: (
+        reason: 'stale_target' | 'target_closed' | 'shutdown',
+        error?: unknown
+      ) => void;
+    }
+  ): Promise<boolean> {
+    return await this.lane.run(() => {
+      const route = this.requireRouteCore(actorId);
+      this.requireCurrentTokenCore(actorId, bindingToken);
+      const queue = this.relocations.get(actorId);
+      if (
+        queue === undefined ||
+        (route.sealId === undefined &&
+          queue.ingress.length === 0 &&
+          queue.ingressDrain === undefined)
+      )
+        return false;
+      queue.ingress.push({
+        ...prepare(),
+        sealId: route.sealId
+      });
+      if (route.sealId === undefined) this.startHeldOneWayDrain(actorId, queue);
+      return true;
+    });
+  }
+
   /**
    * Holds Session ingress accepted after a relocation seal until the target
    * route is published and the seal is released. The caller keeps the
@@ -714,6 +757,9 @@ export class ZLinkActorSessionBindingRegistry<
       );
     }
     route.sealId = sealId;
+    if (!this.relocations.has(actorId)) {
+      this.relocations.set(actorId, { actorId, seals: new Map(), ingress: [] });
+    }
     // A pre-seal REQUEST is captured as part of installing command 42. Its
     // Session frame no longer gates the seal; its single submission attempt
     // and terminal continue under the request admission state above.
@@ -786,13 +832,7 @@ export class ZLinkActorSessionBindingRegistry<
       resolveTerminal = resolve;
     });
     const ready = this.waitForActiveFramesCore(claim.actorId, signal);
-    const actorQueue: ZLinkActorSessionRelocationQueue = queue ?? {
-      actorId: claim.actorId,
-      seals: new Map(),
-      outbound: [],
-      nextArrivalOrder: 1n,
-      outboundCount: 0
-    };
+    const actorQueue = this.relocations.get(claim.actorId)!;
     const state: ZLinkActorSessionRelocationState = {
       ...claim,
       phase: 'sealed',
@@ -820,154 +860,14 @@ export class ZLinkActorSessionBindingRegistry<
     return this.relocations.get(actorId)?.seals.get(sealId);
   }
 
-  async retainRelocationOutbound(
-    actorId: string,
-    operation: ZLinkActorSessionRetainedOutbound,
-    sealId?: string
-  ): Promise<ServiceSessionBindingAdmissionResult> {
-    return await this.lane.run(() =>
-      this.retainRelocationOutboundCorePublic(actorId, operation, sealId)
-    );
-  }
-
-  private retainRelocationOutboundCorePublic(
-    actorId: string,
-    operation: ZLinkActorSessionRetainedOutbound,
-    sealId?: string
-  ): ServiceSessionBindingAdmissionResult {
-    if (sealId !== undefined) {
-      const queue = this.relocations.get(actorId);
-      const state = queue?.seals.get(sealId);
-      if (
-        queue === undefined ||
-        state === undefined ||
-        (queue.activeSealId !== sealId &&
-          !(queue.activeSealId === undefined && state.phase === 'terminal'))
-      ) {
-        failRetainedOutbound(
-          operation,
-          new Error(`Actor '${actorId}' Session outbound did not match its exact relocation seal.`)
-        );
-        return 'rejected';
-      }
-    }
-    return this.retainRelocationOutboundCore(actorId, operation, 'legacy');
-  }
-
-  async admitRelocationOutbound(
-    claim: ServiceSessionBindingAdmissionClaim,
-    operation: ZLinkActorSessionRetainedOutbound
-  ): Promise<ServiceSessionBindingAdmissionResult> {
-    return await this.lane.run(() => this.admitRelocationOutboundCore(claim, operation));
-  }
-
-  private admitRelocationOutboundCore(
-    claim: ServiceSessionBindingAdmissionClaim,
-    operation: ZLinkActorSessionRetainedOutbound
-  ): ServiceSessionBindingAdmissionResult {
-    const queue = this.relocations.get(claim.actorId);
-    const state =
-      queue?.activeSealId === undefined ? undefined : queue.seals.get(queue.activeSealId);
-    const error = this.outboundAdmissionError(claim);
-    if (error !== undefined) {
-      failRetainedOutbound(operation, error);
-      return 'rejected';
-    }
-    if (queue === undefined || state === undefined) {
-      if (!this.matchesCurrentProducerNode(claim)) {
-        failRetainedOutbound(
-          operation,
-          new Error(
-            `Actor '${claim.actorId}' Session outbound admission was fenced by its current binding.`
-          )
-        );
-        return 'rejected';
-      }
-      if (queue === undefined) return 'passThrough';
-      return this.retainRelocationOutboundCore(claim.actorId, operation, 'source', claim);
-    }
-    if (state.phase === 'sealed' || state.phase === 'applying') {
-      const matchesSource = matchesRelocationSourceProof(state, claim);
-      const matchesCurrent = this.matchesCurrentProducerNode(claim);
-      const authorization = matchesSource || matchesCurrent ? 'source' : 'pendingTarget';
-      return this.retainRelocationOutboundCore(claim.actorId, operation, authorization, claim);
-    }
-    const acceptedProof = state.acceptedProducerProof;
-    if (acceptedProof === undefined || !matchesAcceptedProducerProof(acceptedProof, claim)) {
-      failRetainedOutbound(
-        operation,
-        new Error(
-          `Actor '${claim.actorId}' Session outbound admission did not match its accepted producer proof.`
-        )
-      );
-      return 'rejected';
-    }
-    return this.retainRelocationOutboundCore(claim.actorId, operation, 'source', claim);
-  }
-
-  private retainRelocationOutboundCore(
-    actorId: string,
-    operation: ZLinkActorSessionRetainedOutbound,
-    authorization: ZLinkActorSessionOutboundEntry['authorization'],
-    claim?: ServiceSessionBindingAdmissionClaim
-  ): ServiceSessionBindingAdmissionResult {
-    const queue = this.relocations.get(actorId);
-    const state =
-      queue?.activeSealId === undefined ? undefined : queue.seals.get(queue.activeSealId);
-    if (queue === undefined) return 'passThrough';
-    if (state === undefined || state.phase === 'applied' || state.phase === 'terminal') {
-      if (queue.drainPromise === undefined && queue.outbound.length === 0) return 'passThrough';
-      if (!this.reserveOutbound(queue, operation)) return 'rejected';
-      queue.outbound.push({
-        operation,
-        authorization,
-        arrivalOrder: queue.nextArrivalOrder++,
-        ...(claim === undefined ? {} : { claim }),
-        released: true,
-        settled: false
-      });
-      this.startOutboundDrain(queue);
-      return 'retained';
-    }
-    if (!this.reserveOutbound(queue, operation)) return 'rejected';
-    queue.outbound.push({
-      sealId: state.sealId,
-      operation,
-      authorization,
-      arrivalOrder: queue.nextArrivalOrder++,
-      ...(claim === undefined ? {} : { claim }),
-      released: false,
-      settled: false
-    });
-    return 'retained';
-  }
-
-  async discardRelocationOutbound(actorId: string, sealId: string, error: unknown): Promise<void> {
-    await this.lane.run(() => this.discardRelocationOutboundCore(actorId, sealId, error));
-  }
-
-  private discardRelocationOutboundCore(actorId: string, sealId: string, error: unknown): void {
-    const queue = this.relocations.get(actorId);
-    if (queue === undefined) return;
-    for (let index = queue.outbound.length - 1; index >= 0; index--) {
-      const entry = queue.outbound[index]!;
-      if (entry.sealId !== sealId) continue;
-      queue.outbound.splice(index, 1);
-      this.failOutbound(queue, entry, error);
-    }
-    this.deleteEmptyRelocationQueue(queue);
-  }
-
   async applyRelocation(
     actorId: string,
     sealId: string,
     applyFingerprint: string,
-    action: 'commit' | 'abort',
-    commitOwnerTransition: () => Promise<void>,
-    acceptedProducerProof?: ZLinkActorSessionAcceptedProducerProof
+    commitOwnerTransition: () => Promise<void>
   ): Promise<void> {
     const prepared = await this.lane.run(() =>
-      this.prepareRelocationApply(actorId, sealId, applyFingerprint, action, acceptedProducerProof)
+      this.prepareRelocationApply(actorId, sealId, applyFingerprint)
     );
     if (prepared.applyPromise !== undefined) {
       await prepared.applyPromise;
@@ -991,20 +891,13 @@ export class ZLinkActorSessionBindingRegistry<
   private prepareRelocationApply(
     actorId: string,
     sealId: string,
-    applyFingerprint: string,
-    action: 'commit' | 'abort',
-    acceptedProducerProof?: ZLinkActorSessionAcceptedProducerProof
+    applyFingerprint: string
   ): {
-    readonly queue: ZLinkActorSessionRelocationQueue;
     readonly state: ZLinkActorSessionRelocationState;
     readonly applyPromise?: Promise<void>;
-    readonly action?: 'commit' | 'abort';
-    readonly acceptedProducerProof?: ZLinkActorSessionAcceptedProducerProof;
     readonly promise?: Promise<void>;
     readonly resolve?: () => void;
     readonly reject?: (error: unknown) => void;
-    readonly actorId?: string;
-    readonly sealId?: string;
   } {
     const queue = this.relocations.get(actorId);
     const state = queue?.seals.get(sealId);
@@ -1023,25 +916,7 @@ export class ZLinkActorSessionBindingRegistry<
           true
         );
       }
-      return { queue, state, applyPromise: state.applyPromise };
-    }
-    if (
-      action === 'commit' &&
-      acceptedProducerProof !== undefined &&
-      !validAcceptedTargetProof(state, acceptedProducerProof)
-    ) {
-      throw createInternalFrameworkException(
-        ZLinkFrameworkInternalErrorKind.ActorLocationStale,
-        `Actor '${actorId}' command 44 target producer proof did not match its Session seal.`,
-        true
-      );
-    }
-    if (action === 'abort' && acceptedProducerProof !== undefined) {
-      throw createInternalFrameworkException(
-        ZLinkFrameworkInternalErrorKind.ActorLocationStale,
-        `Actor '${actorId}' abort route supplied a target producer proof.`,
-        true
-      );
+      return { state, applyPromise: state.applyPromise };
     }
 
     state.phase = 'applying';
@@ -1054,57 +929,17 @@ export class ZLinkActorSessionBindingRegistry<
     });
     state.applyPromise = promise;
     return {
-      queue,
       state,
-      action,
-      acceptedProducerProof,
       promise,
       resolve,
-      reject,
-      actorId,
-      sealId
+      reject
     };
   }
 
   private completeRelocationApply(prepared: {
-    readonly queue: ZLinkActorSessionRelocationQueue;
     readonly state: ZLinkActorSessionRelocationState;
-    readonly action?: 'commit' | 'abort';
-    readonly acceptedProducerProof?: ZLinkActorSessionAcceptedProducerProof;
-    readonly actorId?: string;
-    readonly sealId?: string;
   }): void {
-    const { queue, state, action, acceptedProducerProof, actorId, sealId } = prepared;
-    const proof =
-      action === 'commit'
-        ? (acceptedProducerProof ?? this.currentProducerProof(actorId!))
-        : relocationSourceProof(state);
-    state.acceptedProducerProof = proof;
-    for (let index = queue.outbound.length - 1; index >= 0; index--) {
-      const entry = queue.outbound[index]!;
-      if (entry.sealId !== sealId) continue;
-      if (entry.authorization !== 'pendingTarget') {
-        entry.released = true;
-        continue;
-      }
-      if (
-        action === 'commit' &&
-        proof !== undefined &&
-        entry.claim !== undefined &&
-        matchesAcceptedProducerProof(proof, entry.claim)
-      ) {
-        entry.released = true;
-        continue;
-      }
-      queue.outbound.splice(index, 1);
-      this.failOutbound(
-        queue,
-        entry,
-        new Error(`Actor '${actorId}' pending Session producer did not match command 44 proof.`)
-      );
-    }
-    this.startOutboundDrain(queue);
-    state.phase = 'applied';
+    prepared.state.phase = 'applied';
   }
 
   private failRelocationApply(prepared: {
@@ -1113,49 +948,6 @@ export class ZLinkActorSessionBindingRegistry<
     prepared.state.phase = 'sealed';
     prepared.state.applyFingerprint = undefined;
     prepared.state.applyPromise = undefined;
-    prepared.state.acceptedProducerProof = undefined;
-  }
-
-  private currentProducerProof(
-    actorId: string
-  ): ZLinkActorSessionAcceptedProducerProof | undefined {
-    const route = this.routes.get(actorId);
-    const actorRef = (
-      route?.actor as TActor & {
-        readonly ref?: {
-          readonly actorId?: unknown;
-          readonly objectGeneration?: unknown;
-          readonly generation?: unknown;
-          readonly nodeRid?: unknown;
-          readonly ownerNodeGeneration?: unknown;
-          readonly bindingGeneration?: unknown;
-        };
-      }
-    ).ref;
-    const sessionIdentity = route?.sessionIdentity;
-    if (
-      route === undefined ||
-      actorRef === undefined ||
-      sessionIdentity === undefined ||
-      actorRef.ownerNodeGeneration === undefined
-    )
-      return undefined;
-    return {
-      actorId,
-      objectGeneration: BigInt(
-        (actorRef.objectGeneration as bigint | number | string | boolean | undefined) ??
-          (actorRef.generation as bigint | number | string | boolean | undefined) ??
-          -1
-      ),
-      actorNodeRid: String(actorRef.nodeRid ?? ''),
-      actorNodeGeneration: BigInt(
-        actorRef.ownerNodeGeneration as bigint | number | string | boolean
-      ),
-      sessionIdentity: String(sessionIdentity),
-      bindingGeneration: BigInt(
-        (actorRef.bindingGeneration as bigint | number | string | boolean | undefined) ?? -1
-      )
-    };
   }
 
   async observeRelocationTerminal(
@@ -1199,7 +991,7 @@ export class ZLinkActorSessionBindingRegistry<
 
   /**
    * Actor-wide relocation teardown: every seal (active and terminal-retained)
-   * and every held outbound entry for `actorId` is discarded unconditionally.
+   * for `actorId` is discarded unconditionally.
    * Reserved for paths where the Actor itself is gone or being torn down
    * (destroy, ownership clear, relocation-seal expiry/failure) — never for a
    * single physical route's disconnect, which must not disturb a relocation
@@ -1212,8 +1004,18 @@ export class ZLinkActorSessionBindingRegistry<
   private clearRelocationCore(actorId: string, error: unknown): void {
     const queue = this.relocations.get(actorId);
     if (queue === undefined) return;
+    this.rejectSealWaiters(
+      actorId,
+      error,
+      error instanceof ZLinkFrameworkException &&
+        error.kind === ZLinkFrameworkErrorKind.DeadlineExceeded
+        ? 'target_closed'
+        : error instanceof ZLinkFrameworkException &&
+            error.kind === ZLinkFrameworkErrorKind.ShuttingDown
+          ? 'shutdown'
+          : 'stale_target'
+    );
     this.relocations.delete(actorId);
-    for (const entry of queue.outbound.splice(0)) this.failOutbound(queue, entry, error);
     for (const state of queue.seals.values()) {
       this.terminalRelocations.delete(state);
       if (state.phase !== 'terminal') state.resolveTerminal();
@@ -1224,7 +1026,7 @@ export class ZLinkActorSessionBindingRegistry<
    * Spec 48 §137: a relocation seal's lifecycle is independent of any single
    * physical route's binding. Unbinding one physical route (a disconnect)
    * must retire only the still-open (nonterminal) relocation seal that this
-   * exact route's Session owns, and the outbound held against that seal — it
+   * exact route's Session owns — it
    * must never reach into a seal that has already reached 'terminal' (its
    * bounded retention exists precisely so a late same-seal relay can still
    * pass on a successor route) nor into a different Session's active seal
@@ -1233,8 +1035,7 @@ export class ZLinkActorSessionBindingRegistry<
    */
   private clearRouteRelocation(
     actorId: string,
-    route: ZLinkActorSessionRoute<TContext, TActor>,
-    error: unknown
+    route: ZLinkActorSessionRoute<TContext, TActor>
   ): void {
     const queue = this.relocations.get(actorId);
     if (queue === undefined) return;
@@ -1250,12 +1051,6 @@ export class ZLinkActorSessionBindingRegistry<
       this.deleteEmptyRelocationQueue(queue);
       return;
     }
-    for (let index = queue.outbound.length - 1; index >= 0; index--) {
-      const entry = queue.outbound[index]!;
-      if (entry.sealId !== activeSealId) continue;
-      queue.outbound.splice(index, 1);
-      this.failOutbound(queue, entry, error);
-    }
     queue.activeSealId = undefined;
     queue.seals.delete(activeSealId!);
     this.terminalRelocations.delete(activeState);
@@ -1464,155 +1259,6 @@ export class ZLinkActorSessionBindingRegistry<
     for (const waiter of waiters) waiter.reject(error);
   }
 
-  private startOutboundDrain(queue: ZLinkActorSessionRelocationQueue): void {
-    if (queue.drainPromise !== undefined) return;
-    const drain = startOutsideStateLane(async () => {
-      for (;;) {
-        const entry = await this.lane.run(() => {
-          const current = queue.outbound.at(0);
-          if (current === undefined || !current.released) return undefined;
-          if (current.settled) {
-            queue.outbound.shift();
-            return null;
-          }
-          return current;
-        });
-        if (entry === undefined) return;
-        if (entry === null) continue;
-        try {
-          const delivered = await entry.operation.deliver();
-          await this.lane.run(() => {
-            if (delivered) this.settleOutbound(queue, entry);
-            else
-              this.failOutbound(
-                queue,
-                entry,
-                new Error(
-                  `Actor '${queue.actorId}' retained Session outbound delivery was rejected.`
-                )
-              );
-            if (queue.outbound[0] === entry) queue.outbound.shift();
-          });
-        } catch (error) {
-          await this.lane.run(() => {
-            this.failOutbound(queue, entry, error);
-            if (queue.outbound[0] === entry) queue.outbound.shift();
-          });
-        }
-      }
-    });
-    startOutsideStateLane(() => {
-      void drain.finally(
-        async () =>
-          await this.lane.run(() => {
-            if (queue.drainPromise === drain) queue.drainPromise = undefined;
-            if (queue.outbound[0]?.released === true) this.startOutboundDrain(queue);
-            else this.deleteEmptyRelocationQueue(queue);
-          })
-      );
-    });
-    queue.drainPromise = drain;
-  }
-
-  private reserveOutbound(
-    queue: ZLinkActorSessionRelocationQueue,
-    operation: ZLinkActorSessionRetainedOutbound
-  ): boolean {
-    if (queue.outboundCount < this.outboundCapacity) {
-      queue.outboundCount++;
-      return true;
-    }
-    failRetainedOutbound(
-      operation,
-      new Error(`Actor '${queue.actorId}' Session relocation outbound capacity was exhausted.`)
-    );
-    return false;
-  }
-
-  private settleOutbound(
-    queue: ZLinkActorSessionRelocationQueue,
-    entry: ZLinkActorSessionOutboundEntry
-  ): void {
-    if (entry.settled) return;
-    entry.settled = true;
-    queue.outboundCount--;
-  }
-
-  private failOutbound(
-    queue: ZLinkActorSessionRelocationQueue,
-    entry: ZLinkActorSessionOutboundEntry,
-    error: unknown
-  ): void {
-    if (entry.settled) return;
-    this.settleOutbound(queue, entry);
-    failRetainedOutbound(entry.operation, error);
-  }
-
-  private outboundAdmissionError(claim: ServiceSessionBindingAdmissionClaim): Error | undefined {
-    if (
-      claim.actorId.length === 0 ||
-      claim.objectGeneration <= 0n ||
-      claim.actorNodeRid.length === 0 ||
-      claim.actorNodeGeneration <= 0n ||
-      claim.producerNodeRid.length === 0 ||
-      claim.producerNodeGeneration <= 0n ||
-      claim.bindingGeneration <= 0n ||
-      claim.sessionIdentity.length === 0 ||
-      !routingIdsEqual(claim.producerNodeRid, claim.actorNodeRid) ||
-      claim.producerNodeGeneration !== claim.actorNodeGeneration
-    ) {
-      return new Error(`Actor '${claim.actorId}' Session outbound admission claim is invalid.`);
-    }
-    const route = this.routes.get(claim.actorId);
-    const ref = route?.actor as
-      | (TActor & {
-          readonly ref?: {
-            readonly actorId?: unknown;
-            readonly objectGeneration?: unknown;
-            readonly generation?: unknown;
-            readonly bindingGeneration?: unknown;
-          };
-        })
-      | undefined;
-    const actorRef = ref?.ref;
-    const routeSessionIdentity = route?.sessionIdentity;
-    if (
-      route === undefined ||
-      actorRef === undefined ||
-      String(actorRef.actorId ?? claim.actorId) !== claim.actorId ||
-      BigInt(
-        (actorRef.objectGeneration as bigint | number | string | boolean | undefined) ??
-          (actorRef.generation as bigint | number | string | boolean | undefined) ??
-          -1
-      ) !== claim.objectGeneration ||
-      BigInt(
-        (actorRef.bindingGeneration as bigint | number | string | boolean | undefined) ?? -1
-      ) !== claim.bindingGeneration ||
-      String(routeSessionIdentity ?? '') !== claim.sessionIdentity
-    ) {
-      return new Error(
-        `Actor '${claim.actorId}' Session outbound admission was fenced by its current binding.`
-      );
-    }
-    return undefined;
-  }
-
-  private matchesCurrentProducerNode(claim: ServiceSessionBindingAdmissionClaim): boolean {
-    const route = this.routes.get(claim.actorId);
-    const actorRef = (
-      route?.actor as TActor & {
-        readonly ref?: {
-          readonly nodeRid?: unknown;
-        };
-      }
-    ).ref;
-    return (
-      route !== undefined &&
-      actorRef !== undefined &&
-      routingIdsEqual(String(actorRef.nodeRid ?? ''), claim.actorNodeRid)
-    );
-  }
-
   private rememberTerminalRelocation(state: ZLinkActorSessionRelocationState): void {
     this.terminalRelocations.delete(state);
     this.terminalRelocations.set(state, true);
@@ -1633,27 +1279,74 @@ export class ZLinkActorSessionBindingRegistry<
     if (
       queue.activeSealId === undefined &&
       queue.seals.size === 0 &&
-      queue.outbound.length === 0 &&
-      queue.drainPromise === undefined &&
+      queue.ingress.length === 0 &&
+      queue.ingressDrain === undefined &&
       this.relocations.get(queue.actorId) === queue
     ) {
       this.relocations.delete(queue.actorId);
     }
   }
 
-  private resolveSealWaiters(actorId: string, _sealId: string): void {
+  private resolveSealWaiters(actorId: string, sealId: string): void {
+    const queue = this.relocations.get(actorId);
+    if (queue !== undefined) {
+      for (const entry of queue.ingress) {
+        if (entry.sealId === sealId) entry.sealId = undefined;
+      }
+      this.startHeldOneWayDrain(actorId, queue);
+    }
     const waiters = this.sealWaiters.get(actorId);
     if (waiters === undefined) return;
     this.sealWaiters.delete(actorId);
     for (const waiter of waiters) waiter.resolve();
   }
 
-  private rejectSealWaiters(actorId: string, error: unknown): void {
+  private rejectSealWaiters(
+    actorId: string,
+    error: unknown,
+    reason: 'stale_target' | 'target_closed' | 'shutdown' = 'target_closed'
+  ): void {
+    const queue = this.relocations.get(actorId);
+    if (queue !== undefined) {
+      for (const delivery of queue.ingress.splice(0)) delivery.drop(reason, error);
+    }
     const waiters = this.sealWaiters.get(actorId);
     if (waiters === undefined) return;
     this.sealWaiters.delete(actorId);
     for (const waiter of waiters) waiter.reject(error);
   }
+
+  private startHeldOneWayDrain(actorId: string, queue: ZLinkActorSessionRelocationQueue): void {
+    if (queue.ingressDrain !== undefined) return;
+    const drain = startOutsideStateLane(async () => {
+      for (;;) {
+        const next = await this.lane.run(() => {
+          if (this.relocations.get(actorId) !== queue) return undefined;
+          const first = queue.ingress.at(0);
+          if (first === undefined || first.sealId !== undefined) return undefined;
+          return queue.ingress.shift();
+        });
+        if (next === undefined) return;
+        try {
+          await next.deliver();
+        } catch (error) {
+          next.drop('stale_target', error);
+        }
+      }
+    });
+    queue.ingressDrain = drain;
+    startOutsideStateLane(() => {
+      void drain.finally(async () => {
+        await this.lane.run(() => {
+          if (queue.ingressDrain !== drain) return;
+          queue.ingressDrain = undefined;
+          if (queue.ingress.at(0)?.sealId === undefined && queue.ingress.length > 0)
+            this.startHeldOneWayDrain(actorId, queue);
+          else this.deleteEmptyRelocationQueue(queue);
+        });
+      });
+    });
+  }
 }
 
 function assertRelocationClaim(
@@ -1679,77 +1372,6 @@ function startOutsideStateLane<T>(work: () => T): T {
   return detachedStateLaneResource.runInAsyncScope(work);
 }
 
-function matchesRelocationSourceProof(
-  state: ZLinkActorSessionRelocationState,
-  claim: ServiceSessionBindingAdmissionClaim
-): boolean {
-  return (
-    state.actorId === claim.actorId &&
-    state.actorGeneration === claim.objectGeneration &&
-    state.bindingGeneration === claim.bindingGeneration &&
-    state.sessionIdentity === claim.sessionIdentity &&
-    state.actorNodeRid !== undefined &&
-    routingIdsEqual(state.actorNodeRid, claim.actorNodeRid) &&
-    state.actorNodeGeneration === claim.actorNodeGeneration
-  );
-}
-
-function matchesAcceptedProducerProof(
-  proof: ZLinkActorSessionAcceptedProducerProof,
-  claim: ServiceSessionBindingAdmissionClaim
-): boolean {
-  return (
-    proof.actorId === claim.actorId &&
-    proof.objectGeneration === claim.objectGeneration &&
-    routingIdsEqual(proof.actorNodeRid, claim.actorNodeRid) &&
-    proof.actorNodeGeneration === claim.actorNodeGeneration &&
-    proof.sessionIdentity === claim.sessionIdentity &&
-    proof.bindingGeneration === claim.bindingGeneration
-  );
-}
-
-function validAcceptedTargetProof(
-  state: ZLinkActorSessionRelocationState,
-  proof: ZLinkActorSessionAcceptedProducerProof
-): boolean {
-  return (
-    proof.actorId === state.actorId &&
-    proof.objectGeneration === state.actorGeneration &&
-    proof.actorNodeRid.length > 0 &&
-    proof.actorNodeGeneration > 0n &&
-    proof.sessionIdentity === state.sessionIdentity &&
-    proof.bindingGeneration === state.bindingGeneration
-  );
-}
-
-function relocationSourceProof(
-  state: ZLinkActorSessionRelocationState
-): ZLinkActorSessionAcceptedProducerProof | undefined {
-  if (
-    state.sessionIdentity === undefined ||
-    state.actorNodeRid === undefined ||
-    state.actorNodeGeneration === undefined
-  )
-    return undefined;
-  return {
-    actorId: state.actorId,
-    objectGeneration: state.actorGeneration,
-    actorNodeRid: state.actorNodeRid,
-    actorNodeGeneration: state.actorNodeGeneration,
-    sessionIdentity: state.sessionIdentity,
-    bindingGeneration: state.bindingGeneration
-  };
-}
-
-function failRetainedOutbound(operation: ZLinkActorSessionRetainedOutbound, error: unknown): void {
-  try {
-    operation.fail(error);
-  } catch {
-    // The aggregate has already removed the entry. A failure observer cannot
-    // retain or settle the same delivery a second time.
-  }
-}
-
 function assertSuccessorSessionIdentity(
   predecessor: ZLinkActorSessionRelocationState,
   successor: ZLinkActorSessionRelocationClaim