@zlink-systems/framework 0.25.0 → 0.27.0

package/dist/runtime/host/user-spot-creation-coordinator.js

@@ -3,11 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ZLinkUserSpotCreationCoordinator = void 0;
 exports.encodeLocationCreationContent = encodeLocationCreationContent;
 exports.decodeLocationCreationContent = decodeLocationCreationContent;
-const framework_errors_internal_1 = require("../framework-errors-internal");
 const node_crypto_1 = require("node:crypto");
 const contracts_1 = require("../../contracts");
 const service_authority_payload_codec_1 = require("../foundation/service-authority-payload-codec");
+const framework_errors_internal_1 = require("../framework-errors-internal");
 const authority_key_codec_1 = require("../locations/authority-key-codec");
+const DEFAULT_USER_SPOT_CLEANUP_TIMEOUT_MS = 1_000;
+const DEFAULT_USER_SPOT_POLL_INTERVAL_MS = 10;
 /**
  * Makes generic Location Store reservation the only visibility barrier for a
  * User Spot. Only the reservation winner invokes application lifecycle code.
@@ -20,9 +22,10 @@ class ZLinkUserSpotCreationCoordinator {
         this.options = options;
     }
     async getOrCreate(request, materialize, discard) {
-        const deadline = createDeadline(request.timeoutMs, request.signal);
-        const deadlineMs = performance.now() + request.timeoutMs;
         const deadlineUnixMs = Date.now() + request.timeoutMs;
+        const remainingMs = Math.max(0, deadlineUnixMs - Date.now());
+        const deadline = createDeadline(remainingMs, request.signal);
+        const deadlineMs = performance.now() + remainingMs;
         const signal = deadline.signal;
         signal.throwIfAborted();
         const sha256 = (0, node_crypto_1.createHash)('sha256').update(request.requestPayload).digest();
@@ -85,7 +88,7 @@ class ZLinkUserSpotCreationCoordinator {
                             count: 1
                         }
                     }
-                }, signal);
+                }, signal, BigInt(deadlineUnixMs));
             }
             catch (error) {
                 deadline.close();
@@ -192,60 +195,35 @@ class ZLinkUserSpotCreationCoordinator {
             deadline.close();
         }
     }
-    async close(spot, closeOwner, signal, ownerPresent, ownerCanClose) {
+    async close(spot, closeOwner, signal) {
         const resolved = await this.resolveCloseTarget(spot, signal);
         if (resolved === undefined)
             return false;
         const { spot: currentRef, snapshot: current } = resolved;
         const key = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(spot.spotId));
-        if (ownerPresent?.(currentRef) === false) {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `User Spot '${String(spot.spotId)}' is missing from its authority owner.`, true);
-        }
-        if (ownerCanClose?.(currentRef) === false)
-            return false;
-        const closing = await this.beginClosing(key, current, String(spot.spotId), signal);
-        let closed;
-        try {
-            closed = await closeOwner(currentRef, closing);
-        }
-        catch (error) {
-            await this.restoreReady(key, closing, String(spot.spotId), signal);
-            throw error;
-        }
-        if (!closed) {
-            await this.restoreReady(key, closing, String(spot.spotId), signal);
-            return false;
-        }
-        const deleted = await this.options.store.compareExchangeAuthority(key, closing.storeVersion, { kind: 'delete' }, signal);
-        if (deleted.kind === 'deleted') {
-            this.forgetReadyRoute(currentRef.spotId, current);
-            return true;
-        }
-        if (deleted.kind === 'conflict') {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `User Spot '${String(spot.spotId)}' authority changed while closing.`, true);
-        }
-        throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale, `User Spot '${String(spot.spotId)}' generation cannot be closed.`);
+        return await closeOwner(currentRef, async (onCommitted) => this.commitCloseAuthority(key, current, String(spot.spotId), onCommitted));
+    }
+    /** Commits Closing for the owner's own incarnation when its context requests Close. */
+    async beginOwnerClose(spot, onCommitted) {
+        const resolved = await this.resolveCloseTarget(spot);
+        if (resolved === undefined)
+            return undefined;
+        const spotId = String(spot.spotId);
+        return await this.commitCloseAuthority((0, authority_key_codec_1.encodeAuthorityKey)('user_spot', spotId), resolved.snapshot, spotId, onCommitted);
     }
     async resolveCloseTarget(spot, signal) {
         const key = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(spot.spotId));
         const current = await this.options.store.readAuthority(key, signal);
         if (current.kind === 'missing')
             return undefined;
-        if (current.objectGeneration !== spot.objectGeneration) {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale, `User Spot '${String(spot.spotId)}' generation is stale.`);
-        }
-        const currentRef = spotRef(current, {
-            meshName: current.allocation.descriptor.meshName,
-            spotId: spot.spotId,
-            stableType: current.allocation.stableType,
-            requestPayload: Buffer.alloc(0),
-            timeoutMs: 1
-        });
-        if (String(current.allocation.descriptor.rid) !== String(spot.nodeRid) ||
-            current.allocation.descriptor.meshName !== spot.meshName) {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale, `User Spot '${String(spot.spotId)}' owner route is stale.`);
-        }
-        return { spot: currentRef, snapshot: current };
+        return {
+            spot: requireCloseTarget(current, String(spot.spotId), {
+                objectGeneration: spot.objectGeneration,
+                nodeRid: String(spot.nodeRid),
+                meshName: spot.meshName
+            }),
+            snapshot: current
+        };
     }
     async handleRemoteCreate(record, materialize, discard, signal) {
         const key = `${record.spotId}\0${record.reservation.reservationId}`;
@@ -348,7 +326,7 @@ class ZLinkUserSpotCreationCoordinator {
                             leaseGeneration: current.ownerLeaseGeneration
                         }
                     }
-                }, signal);
+                }, signal, record.deadlineUnixMs);
                 await discard?.(signal);
                 return {
                     result: { spot, state: local.state, reply: local.reply },
@@ -380,7 +358,7 @@ class ZLinkUserSpotCreationCoordinator {
                         ownerNodeRid: String(current.allocation.descriptor.rid),
                         ownerNodeGeneration: current.allocation.descriptorLifecycleGeneration
                     })
-                }, signal);
+                }, signal, record.deadlineUnixMs);
             }
             catch (error) {
                 throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestFailed, 'User Spot Ready commit Store operation failed.', false, error);
@@ -401,7 +379,7 @@ class ZLinkUserSpotCreationCoordinator {
         }
         catch (error) {
             local?.publication?.abort();
-            const cleanupDeadline = createDeadline(this.options.cleanupTimeoutMs ?? 1_000);
+            const cleanupDeadline = createDeadline(this.options.cleanupTimeoutMs ?? DEFAULT_USER_SPOT_CLEANUP_TIMEOUT_MS);
             const cleanupSignal = cleanupDeadline.signal;
             const cleanup = await Promise.allSettled([
                 waitForAbort(this.options.store.abort({
@@ -430,52 +408,50 @@ class ZLinkUserSpotCreationCoordinator {
             throw error;
         }
     }
-    async handleRemoteClose(record, closeOwner, signal) {
+    async handleRemoteClose(record, closeOwner, signal, canResume) {
         const key = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', record.target.spotId);
         const current = await this.options.store.readAuthority(key, signal);
         if (current.kind === 'missing')
             return false;
-        if (current.objectGeneration !== record.target.objectGeneration) {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale, `User Spot '${record.target.spotId}' generation is stale.`);
-        }
-        if (current.authorityOwnerGeneration !== record.target.authorityOwnerGeneration ||
-            current.storeVersion.value !== record.target.expectedStoreVersion ||
-            String(current.allocation.descriptor.rid) !== record.target.targetNodeRid ||
-            current.allocation.descriptorLifecycleGeneration !== record.target.targetNodeGeneration ||
-            current.allocation.objectKind !== 'user_spot' ||
-            current.allocation.state !== 'active') {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `User Spot '${record.target.spotId}' close authority is moving.`, true);
-        }
-        const spot = {
+        const candidate = {
             spotId: record.target.spotId,
             objectGeneration: current.objectGeneration,
             meshName: current.allocation.descriptor.meshName,
             nodeRid: current.allocation.descriptor.rid
         };
-        const closing = await this.beginClosing(key, current, record.target.spotId, signal);
-        let closed;
-        try {
-            closed = await closeOwner(spot, signal);
-        }
-        catch (error) {
-            await this.restoreReady(key, closing, record.target.spotId, signal);
-            throw error;
-        }
-        if (!closed) {
-            await this.restoreReady(key, closing, record.target.spotId, signal);
-            return false;
-        }
-        const deleted = await this.options.store.compareExchangeAuthority(key, closing.storeVersion, { kind: 'delete' }, signal);
-        if (deleted.kind === 'deleted') {
-            this.forgetReadyRoute(record.target.spotId, current);
-            return true;
-        }
-        throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `User Spot '${record.target.spotId}' authority changed while closing.`, true);
+        // A Closing committed by this owner is resumed, so its store version has
+        // advanced past the one the source observed.
+        const resuming = canResume?.(candidate) === true &&
+            (0, service_authority_payload_codec_1.decodeServiceClosingSpotAuthority)(current.payload)?.kind === 'user_spot';
+        const spot = requireCloseTarget(current, record.target.spotId, {
+            objectGeneration: record.target.objectGeneration,
+            nodeRid: record.target.targetNodeRid,
+            nodeGeneration: record.target.targetNodeGeneration,
+            authorityOwnerGeneration: record.target.authorityOwnerGeneration,
+            storeVersion: resuming ? undefined : record.target.expectedStoreVersion
+        });
+        return await closeOwner(spot, async (onCommitted) => this.commitCloseAuthority(key, current, record.target.spotId, onCommitted), signal);
+    }
+    async commitCloseAuthority(key, current, spotId, onCommitted) {
+        const closing = await this.beginClosing(key, current, spotId);
+        const authority = {
+            release: async () => {
+                this.forgetReadyRoute(spotId, current);
+                const deleted = await this.options.store.compareExchangeAuthority(key, closing.storeVersion, {
+                    kind: 'delete'
+                });
+                if (deleted.kind !== 'deleted') {
+                    throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `User Spot '${spotId}' authority changed while closing.`, true);
+                }
+            }
+        };
+        onCommitted();
+        return authority;
     }
     forgetReadyRoute(spotId, snapshot) {
         this.options.forgetReadyRoute?.(snapshot.allocation.descriptor.meshName, readySpotRoute(spotId, snapshot));
     }
-    async beginClosing(key, current, spotId, signal) {
+    async beginClosing(key, current, spotId) {
         const ready = (0, service_authority_payload_codec_1.decodeServiceReadySpotAuthority)(current.payload);
         if (ready?.kind !== 'user_spot' ||
             ready.spotId !== spotId ||
@@ -486,23 +462,13 @@ class ZLinkUserSpotCreationCoordinator {
             kind: 'put',
             payload: userSpotAuthorityPayload(current, spotId, 'closing'),
             generationTransition: 'preserve'
-        }, signal);
+        }, undefined);
         if (closing.kind === 'stored') {
             const { kind: _kind, ...snapshot } = closing;
             return { kind: 'snapshot', ...snapshot };
         }
         throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `User Spot authority changed while entering Closing.`, true);
     }
-    async restoreReady(key, closing, spotId, signal) {
-        const restored = await this.options.store.compareExchangeAuthority(key, closing.storeVersion, {
-            kind: 'put',
-            payload: userSpotAuthorityPayload(closing, spotId, 'ready'),
-            generationTransition: 'preserve'
-        }, signal);
-        if (restored.kind !== 'stored') {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, 'User Spot Ready authority could not be restored after close was declined.', true);
-        }
-    }
     async awaitReady(request, signal) {
         const key = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(request.spotId));
         for (;;) {
@@ -511,7 +477,7 @@ class ZLinkUserSpotCreationCoordinator {
             if (current.kind === 'snapshot' && current.allocation.state === 'active') {
                 return spotRef(current, request);
             }
-            await wait(this.options.pollIntervalMs ?? 10, signal);
+            await wait(this.options.pollIntervalMs ?? DEFAULT_USER_SPOT_POLL_INTERVAL_MS, signal);
         }
     }
     async remoteCreate(request, snapshot, targetNodeRid, targetNodeGeneration, deadlineUnixMs, deadlineMs) {
@@ -588,6 +554,41 @@ function readySpotRoute(spotId, snapshot) {
         storeVersion: snapshot.storeVersion.value
     };
 }
+/**
+ * The single classifier of a Close target (§7, §9): another ObjectGeneration is
+ * SpotGenerationStale; any owner fence difference or an authority that is not
+ * in a Framework-owned Ready or Closing state is SpotMoving.
+ */
+function requireCloseTarget(current, spotId, fence) {
+    if (current.objectGeneration !== fence.objectGeneration) {
+        throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale, `User Spot '${spotId}' generation is stale.`);
+    }
+    // A committed Closing stays the close target: its owner resumes that Close.
+    const decoded = (0, service_authority_payload_codec_1.decodeServiceReadySpotAuthority)(current.payload) ??
+        (0, service_authority_payload_codec_1.decodeServiceClosingSpotAuthority)(current.payload);
+    const allocation = current.allocation;
+    if (decoded?.kind !== 'user_spot' ||
+        decoded.spotId !== spotId ||
+        decoded.ownerId !== current.ownerId ||
+        decoded.ownerLeaseGeneration !== current.ownerLeaseGeneration ||
+        allocation.objectKind !== 'user_spot' ||
+        allocation.state !== 'active' ||
+        String(allocation.descriptor.rid) !== fence.nodeRid ||
+        (fence.meshName !== undefined && allocation.descriptor.meshName !== fence.meshName) ||
+        (fence.nodeGeneration !== undefined &&
+            allocation.descriptorLifecycleGeneration !== fence.nodeGeneration) ||
+        (fence.authorityOwnerGeneration !== undefined &&
+            current.authorityOwnerGeneration !== fence.authorityOwnerGeneration) ||
+        (fence.storeVersion !== undefined && current.storeVersion.value !== fence.storeVersion)) {
+        throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `User Spot '${spotId}' owner fence changed or the Spot is moving.`, true);
+    }
+    return {
+        spotId: spotId,
+        objectGeneration: current.objectGeneration,
+        meshName: allocation.descriptor.meshName,
+        nodeRid: allocation.descriptor.rid
+    };
+}
 function spotRef(snapshot, request, allowPending = false) {
     const decoded = (0, service_authority_payload_codec_1.decodeServiceReadySpotAuthority)(snapshot.payload);
     if (allowPending

package/dist/runtime/locations/aggregate-inventory-store.js

@@ -2,8 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ZLinkAggregateInventoryStore = void 0;
 const node_crypto_1 = require("node:crypto");
+const actor_join_recovery_codec_1 = require("../foundation/actor-join-recovery-codec");
 const in_memory_provider_location_store_1 = require("./in-memory-provider-location-store");
-const PREFIX = 'zlink:v11:aggregate-inventory:';
+const INVENTORY_PAGE_KIND = 'aggregate-inventory-page-v1';
+const INVENTORY_ROOT_KIND = 'aggregate-inventory-root-v1';
+const PREFIX = `${in_memory_provider_location_store_1.PROVIDER_STORAGE_NAMESPACE_PREFIX}aggregate-inventory:`;
 const MAX_PAGE_ENTRIES = 1_024;
 const MAX_PAGE_BYTES = 1_024 * 1_024;
 const MAX_TREE_LEVELS = 32;
@@ -135,8 +138,8 @@ function buildTree(request) {
     if (request.participants.length < 1) {
         throw new RangeError('Aggregate inventory requires at least one participant.');
     }
-    if (request.inventoryDigest.byteLength !== 32) {
-        throw new TypeError('Aggregate inventory digest must contain 32 bytes.');
+    if (request.inventoryDigest.byteLength !== actor_join_recovery_codec_1.SHA256_DIGEST_BYTES) {
+        throw new TypeError(`Aggregate inventory digest must contain ${actor_join_recovery_codec_1.SHA256_DIGEST_BYTES} bytes.`);
     }
     const entries = request.participants.map((participant, index) => ({
         index,
@@ -162,7 +165,7 @@ function buildTree(request) {
             MAX_PAGE_BYTES) {
         level++;
         if (level >= MAX_TREE_LEVELS) {
-            throw new RangeError('Aggregate inventory tree exceeds 32 levels.');
+            throw new RangeError(`Aggregate inventory tree exceeds ${MAX_TREE_LEVELS} levels.`);
         }
         references = packIndexPages(level, references, pages);
     }
@@ -180,7 +183,7 @@ function packLeafPages(entries, pages) {
         let bytes;
         do {
             page = {
-                kind: 'aggregate-inventory-page-v1',
+                kind: INVENTORY_PAGE_KIND,
                 level: 0,
                 index: references.length,
                 startIndex: offset,
@@ -211,7 +214,7 @@ function packIndexPages(level, children, pages) {
         do {
             const selected = children.slice(offset, offset + count);
             page = {
-                kind: 'aggregate-inventory-page-v1',
+                kind: INVENTORY_PAGE_KIND,
                 level,
                 index: references.length,
                 startIndex: selected[0].startIndex,
@@ -240,7 +243,7 @@ function rootCandidate(totalCount, topLevel, topPages, pages, digest, declaredDi
             pageCountsByLevel[page.level]++;
     }
     return {
-        kind: 'aggregate-inventory-root-v1',
+        kind: INVENTORY_ROOT_KIND,
         totalCount,
         digest,
         declaredDigest,
@@ -325,7 +328,7 @@ function decodeRoot(bytes) {
     if (value === null ||
         typeof value !== 'object' ||
         !('kind' in value) ||
-        value.kind !== 'aggregate-inventory-root-v1') {
+        value.kind !== INVENTORY_ROOT_KIND) {
         throw new Error('Invalid inventory root.');
     }
     return value;
@@ -335,7 +338,7 @@ function decodePage(bytes) {
     if (value === null ||
         typeof value !== 'object' ||
         !('kind' in value) ||
-        value.kind !== 'aggregate-inventory-page-v1' ||
+        value.kind !== INVENTORY_PAGE_KIND ||
         !('entries' in value) ||
         !Array.isArray(value.entries) ||
         !('children' in value) ||
@@ -379,7 +382,7 @@ function isSha256(value) {
 }
 function sameHash(expected, actual) {
     return (isSha256(expected) &&
-        actual.byteLength === 32 &&
+        actual.byteLength === actor_join_recovery_codec_1.SHA256_DIGEST_BYTES &&
         (0, node_crypto_1.timingSafeEqual)(Buffer.from(expected, 'hex'), Buffer.from(actual)));
 }
 function dataLost(fence, reason) {

package/dist/runtime/locations/authority-key-codec.js

@@ -2,10 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encodeAuthorityKey = encodeAuthorityKey;
 exports.decodeAuthorityKey = decodeAuthorityKey;
+const CoreTypes_1 = require("../../contracts/Common/CoreTypes");
 function encodeAuthorityKey(kind, globalId) {
     const bytes = Buffer.from(globalId);
-    if (bytes.byteLength < 1 || bytes.byteLength > 255) {
-        throw new RangeError('Authority identity must contain 1..255 UTF-8 bytes.');
+    if (bytes.byteLength < 1 || bytes.byteLength > CoreTypes_1.ZLINK_MAX_IDENTITY_TEXT_BYTES) {
+        throw new RangeError(`Authority identity must contain 1..${CoreTypes_1.ZLINK_MAX_IDENTITY_TEXT_BYTES} UTF-8 bytes.`);
     }
     const discriminator = kind === 'actor' ? 'a' : 's';
     return {
@@ -20,7 +21,7 @@ function decodeAuthorityKey(key) {
     if (match === null)
         throw new TypeError('Authority key is not canonical.');
     const declaredLength = Number(match[2]);
-    if (declaredLength > 255)
+    if (declaredLength > CoreTypes_1.ZLINK_MAX_IDENTITY_TEXT_BYTES)
         throw new TypeError('Authority key identity exceeds the byte limit.');
     const encoded = match[3];
     const bytes = [];

package/dist/runtime/locations/auto-connect-reconciler.d.ts

@@ -1,6 +1,7 @@
 import { type ZLinkLocationOptionOverrides } from '../../contracts/Locations/Options';
 import type { RoutingId } from '../../contracts/Common';
 import { type ZLinkPeerLocationResolver, type ZLinkPeerLocation } from './internal-location-contracts';
+import type { ZLinkDispatchErrorSink } from '../diagnostics/dispatch-error-port';
 import type { IZLinkAutoConnectExecutor, IZLinkAutoConnectPeerPublisher, ZLinkAutoConnectEventSink, ZLinkAutoConnectLocal, ZLinkAutoConnectTarget } from './auto-connect-types';
 export interface ZLinkAutoConnectReconcilerOptions {
     readonly local: ZLinkAutoConnectLocal;
@@ -12,6 +13,7 @@ export interface ZLinkAutoConnectReconcilerOptions {
     readonly events?: ZLinkAutoConnectEventSink;
     readonly options?: ZLinkLocationOptionOverrides;
     readonly monotonicNowMs?: () => number;
+    readonly errorSink: ZLinkDispatchErrorSink;
 }
 export declare class ZLinkAutoConnectReconciler {
     private readonly lane;
@@ -24,6 +26,7 @@ export declare class ZLinkAutoConnectReconciler {
     private readonly events?;
     private readonly options;
     private readonly monotonicNowMs;
+    private readonly errorSink;
     private readonly active;
     private readonly pendingDisconnects;
     private readonly failedEndpoints;
@@ -50,6 +53,7 @@ export declare class ZLinkAutoConnectReconciler {
     private completePublishClaimCore;
     private preparePublishRenewalCore;
     private recordStoreFailure;
+    private connectTarget;
     private beginStoreFailureCore;
     private completeStoreFailureConnectCore;
     private recordDisconnectedEndpoint;

package/dist/runtime/locations/auto-connect-reconciler.js

@@ -7,6 +7,7 @@ const key_codec_1 = require("./key-codec");
 const EndpointNotation_1 = require("../../contracts/Configuration/EndpointNotation");
 const auto_connect_planner_1 = require("./auto-connect-planner");
 const state_lane_1 = require("../execution/state-lane");
+const zlink_1 = require("@zlink-systems/zlink");
 const encodeRoutingIdHex = key_codec_1.ZLinkLocationKeyCodec.encodeRoutingIdHex;
 class ZLinkAutoConnectReconciler {
     lane = new state_lane_1.ZLinkStateLane();
@@ -19,6 +20,7 @@ class ZLinkAutoConnectReconciler {
     events;
     options;
     monotonicNowMs;
+    errorSink;
     active = new Map();
     pendingDisconnects = new Map();
     failedEndpoints = new Set();
@@ -45,6 +47,7 @@ class ZLinkAutoConnectReconciler {
         this.events = options.events;
         this.options = { ...Options_1.zlinkRuntimeDefaultLocationOptions, ...options.options };
         this.monotonicNowMs = options.monotonicNowMs ?? (() => performance.now());
+        this.errorSink = options.errorSink;
         this.executor.onDisconnected?.((endpoint) => this.recordDisconnectedEndpoint(endpoint));
     }
     get storeFailed() {
@@ -116,13 +119,6 @@ class ZLinkAutoConnectReconciler {
             await this.lane.run(() => {
                 this.storeFailedValue = false;
                 this.storeFailureStartedAtMs = undefined;
-                // After a store restart, owners may need one full lease interval to
-                // reclaim their token and republish a descriptor. Do not interpret the
-                // incomplete post-restart scan as a definitive removal.
-                // Keep the existing transport set through one lease interval while
-                // owners reclaim their tokens and republish descriptors. This deferral
-                // applies only after a Store operation failed; a successful empty scan
-                // is authoritative and must remove stale peers promptly.
                 this.recoveryDeferUntilMs = this.monotonicNowMs() + this.options.ownerLeaseTtlMs;
             });
         }
@@ -133,7 +129,6 @@ class ZLinkAutoConnectReconciler {
                 .map((nodeRid) => encodeRoutingIdHex(nodeRid)));
         });
         const candidates = auto_connect_planner_1.ZLinkAutoConnectPlanner.computeCandidates(this.local, rows);
-        const nowMs = this.monotonicNowMs();
         this.executor.expectPeers?.([...candidates.values()]);
         this.executor.replaceNotRequired?.(auto_connect_planner_1.ZLinkAutoConnectPlanner.computeNotRequired(this.local, rows));
         const desired = new Map(auto_connect_planner_1.ZLinkAutoConnectPlanner.computeDesired(this.local, rows));
@@ -152,6 +147,19 @@ class ZLinkAutoConnectReconciler {
             if (activeKeys.has(key))
                 desired.set(key, target);
         }
+        const deferringMissingTargets = this.monotonicNowMs() < (await this.lane.run(() => this.recoveryDeferUntilMs));
+        let staleCandidates = candidates;
+        if (deferringMissingTargets) {
+            const retainedCandidates = new Map(candidates);
+            const lastDesired = await this.lane.run(() => [...this.lastDesired]);
+            for (const [key, target] of lastDesired) {
+                if (!desired.has(key))
+                    desired.set(key, target);
+                if (!retainedCandidates.has(key))
+                    retainedCandidates.set(key, target);
+            }
+            staleCandidates = retainedCandidates;
+        }
         await this.lane.run(() => {
             this.lastDesired = new Map(desired);
         });
@@ -178,14 +186,13 @@ class ZLinkAutoConnectReconciler {
                 await this.lane.run(() => {
                     this.pendingDisconnects.delete(key);
                 });
-                const connected = await this.executor.connect(target);
-                if (connected) {
+                await this.connectTarget(target, async () => {
                     connectedEndpoints.push(target.endpoint);
                     await this.lane.run(() => {
                         this.active.set(key, target);
                         this.failedEndpoints.delete(target.endpoint);
                     });
-                }
+                });
                 continue;
             }
             if (current.endpoint !== target.endpoint || current.ownerId !== target.ownerId) {
@@ -203,25 +210,16 @@ class ZLinkAutoConnectReconciler {
                 await this.lane.run(() => {
                     this.pendingDisconnects.delete(key);
                 });
-                const connected = await this.executor.connect(target);
-                if (connected) {
+                await this.connectTarget(target, async () => {
                     connectedEndpoints.push(target.endpoint);
                     await this.lane.run(() => {
                         this.active.set(key, target);
                         this.failedEndpoints.delete(target.endpoint);
                     });
-                }
+                });
             }
         }
-        if (nowMs < (await this.lane.run(() => this.recoveryDeferUntilMs))) {
-            this.publishDesiredSetChange(connectedEndpoints, disconnectedEndpoints);
-            return;
-        }
-        // A store restart can expose an incomplete descriptor set while peers are
-        // reclaiming their owner leases. Preserve existing transport connections
-        // during that recovery window; stale-peer cleanup is safe after the
-        // deferred reconciliation has completed.
-        this.executor.disconnectStalePeers?.([...candidates.values()]);
+        this.executor.disconnectStalePeers?.([...staleCandidates.values()]);
         const activeTargets = await this.lane.run(() => [...this.active]);
         for (const [key, target] of activeTargets) {
             if (!desired.has(key)) {
@@ -330,10 +328,24 @@ class ZLinkAutoConnectReconciler {
         if (retryTargets === undefined)
             return;
         for (const [key, target] of retryTargets) {
-            if (await this.executor.connect(target)) {
+            await this.connectTarget(target, async () => {
                 await this.lane.run(() => this.completeStoreFailureConnectCore(key, target));
-            }
+            });
+        }
+    }
+    async connectTarget(target, accept) {
+        let accepted;
+        try {
+            accepted = await this.executor.connect(target);
+        }
+        catch (error) {
+            if (!(error instanceof zlink_1.ConnectError))
+                throw error;
+            this.errorSink.reportRuntimeTaskException('auto-connect', error);
+            return;
         }
+        if (accepted)
+            await accept();
     }
     beginStoreFailureCore() {
         const nowMs = this.monotonicNowMs();

package/dist/runtime/locations/creation-operation-id.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.randomOperationId = randomOperationId;
+const stream_wire_1 = require("@zlink-systems/stream-wire");
+const operation_identity_1 = require("../foundation/operation-identity");
 const node_crypto_1 = require("node:crypto");
-function randomOperationId(entropy = (0, node_crypto_1.randomBytes)(16)) {
-    if (entropy.byteLength !== 16)
-        throw new RangeError('Operation ID entropy must be 16 bytes.');
+function randomOperationId(entropy = (0, node_crypto_1.randomBytes)(operation_identity_1.OPERATION_IDENTITY_BYTES)) {
+    if (entropy.byteLength !== operation_identity_1.OPERATION_IDENTITY_BYTES)
+        throw new RangeError(`Operation ID entropy must be ${operation_identity_1.OPERATION_IDENTITY_BYTES} bytes.`);
     const bytes = Buffer.from(entropy);
     const high = bytes.readBigUInt64BE(0);
-    const low = bytes.readBigUInt64BE(8);
+    const low = bytes.readBigUInt64BE(stream_wire_1.UINT64_BYTES);
     return high === 0n && low === 0n ? { high, low: 1n } : { high, low };
 }

package/dist/runtime/locations/domain-store-contract.d.ts

@@ -22,10 +22,10 @@ export interface ZLinkDomainLocationStore {
     compareExchangeAuthority(key: ZLinkAuthorityKey, expectedStoreVersion: ZLinkAuthorityStoreVersion, mutation: ZLinkAuthorityMutation, signal?: AbortSignal): Promise<ZLinkAuthorityCompareExchangeResult>;
     listAuthorities(prefix: string, cursor: ZLinkAuthorityScanCursor | undefined, limit: number, signal?: AbortSignal): Promise<ZLinkAuthorityScanResult>;
     readCreationTerminal(operation: ZLinkCreationOperationIdentity, signal?: AbortSignal): Promise<ZLinkCreationTerminalReadResult>;
-    reserve(request: ZLinkObjectReserveRequest, signal?: AbortSignal): Promise<ZLinkObjectReserveResult>;
-    commit(request: ZLinkObjectCommitRequest, signal?: AbortSignal): Promise<ZLinkObjectCommitResult>;
+    reserve(request: ZLinkObjectReserveRequest, signal?: AbortSignal, deadlineUnixMs?: bigint): Promise<ZLinkObjectReserveResult>;
+    commit(request: ZLinkObjectCommitRequest, signal?: AbortSignal, deadlineUnixMs?: bigint): Promise<ZLinkObjectCommitResult>;
     completeCreation(request: ZLinkObjectCreationCompleteRequest, signal?: AbortSignal): Promise<ZLinkObjectCreationCompleteResult>;
-    abort(request: ZLinkObjectAbortRequest, signal?: AbortSignal): Promise<ZLinkObjectAbortResult>;
+    abort(request: ZLinkObjectAbortRequest, signal?: AbortSignal, deadlineUnixMs?: bigint): Promise<ZLinkObjectAbortResult>;
     prepareAggregate(request: ZLinkAggregatePrepareRequest, signal?: AbortSignal): Promise<ZLinkAggregatePrepareResult>;
     commitAggregate(fence: ZLinkAggregateFence, signal?: AbortSignal): Promise<ZLinkAggregateCommitResult>;
     abortAggregate(fence: ZLinkAggregateFence, signal?: AbortSignal): Promise<ZLinkAggregateAbortResult>;