@zlink-systems/framework 0.25.0 → 0.27.0

package/dist/runtime/streams/actor-session-binding-registry.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ZLinkActorSessionBindingRegistry = exports.ZLinkActorSessionBindingTermination = void 0;
-const framework_errors_internal_1 = require("../framework-errors-internal");
-const abort_1 = require("../abort");
+exports.ZLinkActorSessionBindingRegistry = exports.ZLinkActorSessionBindingTermination = exports.DEFAULT_TERMINAL_RELOCATION_CAPACITY = void 0;
 const node_async_hooks_1 = require("node:async_hooks");
+const ZLinkFrameworkException_1 = require("../../contracts/Errors/ZLinkFrameworkException");
+const Options_1 = require("../../contracts/Locations/Options");
+const abort_1 = require("../abort");
 const state_lane_1 = require("../execution/state-lane");
-const routing_id_1 = require("../routing-id");
+const framework_errors_internal_1 = require("../framework-errors-internal");
+exports.DEFAULT_TERMINAL_RELOCATION_CAPACITY = 4096;
 const detachedStateLaneResource = new node_async_hooks_1.AsyncResource('zlink:actor-session-binding-registry');
 var ZLinkActorSessionBindingTermination;
 (function (ZLinkActorSessionBindingTermination) {
@@ -14,7 +16,6 @@ var ZLinkActorSessionBindingTermination;
 })(ZLinkActorSessionBindingTermination || (exports.ZLinkActorSessionBindingTermination = ZLinkActorSessionBindingTermination = {}));
 class ZLinkActorSessionBindingRegistry {
     terminalRelocationCapacity;
-    outboundCapacity;
     sealWaitTimeoutMs;
     errorSink;
     lane = new state_lane_1.ZLinkStateLane();
@@ -24,24 +25,20 @@ class ZLinkActorSessionBindingRegistry {
     activeFrameWaiters = new Map();
     relocations = new Map();
     terminalRelocations = new Map();
-    constructor(terminalRelocationCapacity = 4096, outboundCapacity = 4096, 
+    constructor(terminalRelocationCapacity = exports.DEFAULT_TERMINAL_RELOCATION_CAPACITY, 
     //  Spec 06 — SessionRelocationSealTimeout bounds how long a session
     //  relocation seal may hold ingress (default 3,000 ms, finite only).
     //  Every wait on the seal (accept paths) and on active-frame drain
     //  (the sealing side) must observe that bound; an unbounded wait here
     //  turns a lost control or a lifecycle interlock into a silent stall
     //  (spec 48:205 — transport/deadline limits apply during relocation).
-    sealWaitTimeoutMs = 3_000, errorSink) {
+    sealWaitTimeoutMs = Options_1.zlinkDefaultLocationOptions.sessionRelocationSealTimeoutMs, errorSink) {
         this.terminalRelocationCapacity = terminalRelocationCapacity;
-        this.outboundCapacity = outboundCapacity;
         this.sealWaitTimeoutMs = sealWaitTimeoutMs;
         this.errorSink = errorSink;
         if (!Number.isSafeInteger(terminalRelocationCapacity) || terminalRelocationCapacity <= 0) {
             throw new RangeError('Session relocation terminal capacity must be a positive safe integer.');
         }
-        if (!Number.isSafeInteger(outboundCapacity) || outboundCapacity <= 0) {
-            throw new RangeError('Session relocation outbound capacity must be a positive safe integer.');
-        }
         if (!Number.isSafeInteger(sealWaitTimeoutMs) || sealWaitTimeoutMs <= 0) {
             throw new RangeError('Session relocation seal timeout must be a positive safe integer.');
         }
@@ -49,7 +46,7 @@ class ZLinkActorSessionBindingRegistry {
     async bind(context, actor, bindingToken, authorityFence, sessionIdentity, commitActor) {
         await this.lane.run(() => this.commitCore(undefined, context, actor, bindingToken, authorityFence, sessionIdentity, commitActor));
     }
-    async commitCore(previous, context, actor, bindingToken, authorityFence, sessionIdentity, commitActor) {
+    commitCore(previous, context, actor, bindingToken, authorityFence, sessionIdentity, commitActor) {
         const current = this.routes.get(actor.actorId);
         if (current !== previous) {
             throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorSessionNotBound, `Actor '${actor.actorId}' session binding changed before route commit.`, true);
@@ -76,7 +73,17 @@ class ZLinkActorSessionBindingRegistry {
                 }
             }
             if (!sameBinding && actorSlot !== undefined) {
-                await context.actorSlotControls.enqueueBound(actorSlot, actor.actorId);
+                // Session–Actor binding §5-2: `$zlink.actor.bound` enters the ordered
+                // STREAM queue before the slot is published; transport completion is
+                // not awaited inside the state lane (execution gate).
+                void context
+                    .actorSlotControls.enqueueBound(actorSlot, actor.actorId)
+                    .catch(async (error) => {
+                    this.errorSink?.()?.reportRuntimeTaskException('session actor bound', error);
+                    // The client never learned the slot, so the binding ends through
+                    // the one unbind path; no `$zlink.actor.unbound` follows.
+                    await this.unbind(actor.actorId, context, bindingToken, ZLinkActorSessionBindingTermination.PhysicalDisconnect).catch((unbindError) => this.errorSink?.()?.reportRuntimeTaskException('session actor bound', unbindError));
+                });
             }
         }
         catch (error) {
@@ -110,14 +117,14 @@ class ZLinkActorSessionBindingRegistry {
     async replaceAndReleaseSeal(previous, context, actor, bindingToken, sealId, authorityFence, sessionIdentity, commitActor) {
         await this.lane.run(() => this.replaceAndReleaseSealCore(previous, context, actor, bindingToken, sealId, authorityFence, sessionIdentity, commitActor));
     }
-    async replaceAndReleaseSealCore(previous, context, actor, bindingToken, sealId, authorityFence, sessionIdentity, commitActor) {
+    replaceAndReleaseSealCore(previous, context, actor, bindingToken, sealId, authorityFence, sessionIdentity, commitActor) {
         if (previous.sealId !== sealId) {
             throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale, `Actor '${actor.actorId}' route switch did not match its relocation seal.`, true);
         }
         // JavaScript cannot interleave another ingress turn between these two
         // synchronous mutations. The replacement preserves the seal, then the
         // exact release publishes the route to held ingress as one owner turn.
-        await this.commitCore(previous, context, actor, bindingToken, authorityFence, sessionIdentity, commitActor);
+        this.commitCore(previous, context, actor, bindingToken, authorityFence, sessionIdentity, commitActor);
         if (!this.abortSealCore(actor.actorId, sealId)) {
             throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale, `Actor '${actor.actorId}' route switch lost its relocation seal.`, true);
         }
@@ -131,6 +138,17 @@ class ZLinkActorSessionBindingRegistry {
     async route(actorId) {
         return await this.lane.run(() => this.routeCore(actorId));
     }
+    /** Selects the route only when it is the exact Session binding (§8.1 validation values). */
+    async routeForSessionBinding(actorId, sessionRid, bindingGeneration) {
+        return await this.lane.run(() => {
+            const route = this.routeCore(actorId);
+            const generation = route?.actor.ref.bindingGeneration;
+            return route?.sessionIdentity === sessionRid &&
+                (bindingGeneration === undefined || generation === bindingGeneration)
+                ? route
+                : undefined;
+        });
+    }
     routeCore(actorId) {
         return this.routes.get(actorId);
     }
@@ -145,9 +163,13 @@ class ZLinkActorSessionBindingRegistry {
         return Object.freeze({ context: route.context });
     }
     async unbind(actorId, context, bindingToken, termination = ZLinkActorSessionBindingTermination.BindingEnd) {
-        await this.lane.run(() => this.unbindCore(actorId, context, bindingToken, termination));
+        const { submission } = await this.lane.run(() => ({
+            submission: this.unbindCore(actorId, context, bindingToken, termination)
+        }));
+        await submission;
     }
-    async unbindCore(actorId, context, bindingToken, termination) {
+    /** Fixes the unbind order in the lane; the caller awaits transport completion outside it. */
+    unbindCore(actorId, context, bindingToken, termination) {
         const route = this.routes.get(actorId);
         if (route === undefined || route.context !== context || route.bindingToken !== bindingToken) {
             return;
@@ -156,29 +178,33 @@ class ZLinkActorSessionBindingRegistry {
         context.unbindLocal(actorId, bindingToken);
         this.rejectSealWaiters(actorId, new Error(`Actor '${actorId}' session binding was removed while ingress was held.`));
         this.rejectActiveFrameWaiters(actorId, new Error(`Actor '${actorId}' session binding was removed while accepted frames were active.`));
-        this.clearRouteRelocation(actorId, route, new Error(`Actor '${actorId}' session binding was removed.`));
+        this.clearRouteRelocation(actorId, route);
         if (termination === ZLinkActorSessionBindingTermination.BindingEnd &&
             route.actorSlot !== undefined) {
-            await context.actorSlotControls?.enqueueUnbound(route.actorSlot);
+            return context.actorSlotControls?.enqueueUnbound(route.actorSlot);
         }
+        return undefined;
     }
     async unbindActor(actorId) {
-        await this.lane.run(() => this.unbindActorCore(actorId));
+        const { submission } = await this.lane.run(() => ({
+            submission: this.unbindActorCore(actorId)
+        }));
+        await submission;
     }
-    async unbindActorCore(actorId) {
+    unbindActorCore(actorId) {
         const route = this.routes.get(actorId);
         if (route === undefined) {
-            return;
+            return undefined;
         }
-        await this.unbindCore(actorId, route.context, route.bindingToken, ZLinkActorSessionBindingTermination.BindingEnd);
+        return this.unbindCore(actorId, route.context, route.bindingToken, ZLinkActorSessionBindingTermination.BindingEnd);
     }
     async cleanup(context) {
         await this.lane.run(() => this.cleanupCore(context));
     }
-    async cleanupCore(context) {
+    cleanupCore(context) {
         for (const route of [...this.routes.values()]) {
             if (route.context === context) {
-                await this.unbindCore(route.actor.actorId, context, route.bindingToken, ZLinkActorSessionBindingTermination.PhysicalDisconnect);
+                this.unbindCore(route.actor.actorId, context, route.bindingToken, ZLinkActorSessionBindingTermination.PhysicalDisconnect);
             }
         }
     }
@@ -214,6 +240,25 @@ class ZLinkActorSessionBindingRegistry {
             throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale, `Actor '${actorId}' session ingress is sealed for relocation.`, true);
         }
     }
+    async acceptOneWay(actorId, bindingToken, prepare) {
+        return await this.lane.run(() => {
+            const route = this.requireRouteCore(actorId);
+            this.requireCurrentTokenCore(actorId, bindingToken);
+            const queue = this.relocations.get(actorId);
+            if (queue === undefined ||
+                (route.sealId === undefined &&
+                    queue.ingress.length === 0 &&
+                    queue.ingressDrain === undefined))
+                return false;
+            queue.ingress.push({
+                ...prepare(),
+                sealId: route.sealId
+            });
+            if (route.sealId === undefined)
+                this.startHeldOneWayDrain(actorId, queue);
+            return true;
+        });
+    }
     /**
      * Holds Session ingress accepted after a relocation seal until the target
      * route is published and the seal is released. The caller keeps the
@@ -350,6 +395,9 @@ class ZLinkActorSessionBindingRegistry {
             throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorSessionNotBound, `Actor '${actorId}' session route seal was fenced by its binding identity.`, true);
         }
         route.sealId = sealId;
+        if (!this.relocations.has(actorId)) {
+            this.relocations.set(actorId, { actorId, seals: new Map(), ingress: [] });
+        }
         // A pre-seal REQUEST is captured as part of installing command 42. Its
         // Session frame no longer gates the seal; its single submission attempt
         // and terminal continue under the request admission state above.
@@ -398,13 +446,7 @@ class ZLinkActorSessionBindingRegistry {
             resolveTerminal = resolve;
         });
         const ready = this.waitForActiveFramesCore(claim.actorId, signal);
-        const actorQueue = queue ?? {
-            actorId: claim.actorId,
-            seals: new Map(),
-            outbound: [],
-            nextArrivalOrder: 1n,
-            outboundCount: 0
-        };
+        const actorQueue = this.relocations.get(claim.actorId);
         const state = {
             ...claim,
             phase: 'sealed',
@@ -423,108 +465,8 @@ class ZLinkActorSessionBindingRegistry {
     relocationSnapshotCore(actorId, sealId) {
         return this.relocations.get(actorId)?.seals.get(sealId);
     }
-    async retainRelocationOutbound(actorId, operation, sealId) {
-        return await this.lane.run(() => this.retainRelocationOutboundCorePublic(actorId, operation, sealId));
-    }
-    retainRelocationOutboundCorePublic(actorId, operation, sealId) {
-        if (sealId !== undefined) {
-            const queue = this.relocations.get(actorId);
-            const state = queue?.seals.get(sealId);
-            if (queue === undefined ||
-                state === undefined ||
-                (queue.activeSealId !== sealId &&
-                    !(queue.activeSealId === undefined && state.phase === 'terminal'))) {
-                failRetainedOutbound(operation, new Error(`Actor '${actorId}' Session outbound did not match its exact relocation seal.`));
-                return 'rejected';
-            }
-        }
-        return this.retainRelocationOutboundCore(actorId, operation, 'legacy');
-    }
-    async admitRelocationOutbound(claim, operation) {
-        return await this.lane.run(() => this.admitRelocationOutboundCore(claim, operation));
-    }
-    admitRelocationOutboundCore(claim, operation) {
-        const queue = this.relocations.get(claim.actorId);
-        const state = queue?.activeSealId === undefined ? undefined : queue.seals.get(queue.activeSealId);
-        const error = this.outboundAdmissionError(claim);
-        if (error !== undefined) {
-            failRetainedOutbound(operation, error);
-            return 'rejected';
-        }
-        if (queue === undefined || state === undefined) {
-            if (!this.matchesCurrentProducerNode(claim)) {
-                failRetainedOutbound(operation, new Error(`Actor '${claim.actorId}' Session outbound admission was fenced by its current binding.`));
-                return 'rejected';
-            }
-            if (queue === undefined)
-                return 'passThrough';
-            return this.retainRelocationOutboundCore(claim.actorId, operation, 'source', claim);
-        }
-        if (state.phase === 'sealed' || state.phase === 'applying') {
-            const matchesSource = matchesRelocationSourceProof(state, claim);
-            const matchesCurrent = this.matchesCurrentProducerNode(claim);
-            const authorization = matchesSource || matchesCurrent ? 'source' : 'pendingTarget';
-            return this.retainRelocationOutboundCore(claim.actorId, operation, authorization, claim);
-        }
-        const acceptedProof = state.acceptedProducerProof;
-        if (acceptedProof === undefined || !matchesAcceptedProducerProof(acceptedProof, claim)) {
-            failRetainedOutbound(operation, new Error(`Actor '${claim.actorId}' Session outbound admission did not match its accepted producer proof.`));
-            return 'rejected';
-        }
-        return this.retainRelocationOutboundCore(claim.actorId, operation, 'source', claim);
-    }
-    retainRelocationOutboundCore(actorId, operation, authorization, claim) {
-        const queue = this.relocations.get(actorId);
-        const state = queue?.activeSealId === undefined ? undefined : queue.seals.get(queue.activeSealId);
-        if (queue === undefined)
-            return 'passThrough';
-        if (state === undefined || state.phase === 'applied' || state.phase === 'terminal') {
-            if (queue.drainPromise === undefined && queue.outbound.length === 0)
-                return 'passThrough';
-            if (!this.reserveOutbound(queue, operation))
-                return 'rejected';
-            queue.outbound.push({
-                operation,
-                authorization,
-                arrivalOrder: queue.nextArrivalOrder++,
-                ...(claim === undefined ? {} : { claim }),
-                released: true,
-                settled: false
-            });
-            this.startOutboundDrain(queue);
-            return 'retained';
-        }
-        if (!this.reserveOutbound(queue, operation))
-            return 'rejected';
-        queue.outbound.push({
-            sealId: state.sealId,
-            operation,
-            authorization,
-            arrivalOrder: queue.nextArrivalOrder++,
-            ...(claim === undefined ? {} : { claim }),
-            released: false,
-            settled: false
-        });
-        return 'retained';
-    }
-    async discardRelocationOutbound(actorId, sealId, error) {
-        await this.lane.run(() => this.discardRelocationOutboundCore(actorId, sealId, error));
-    }
-    discardRelocationOutboundCore(actorId, sealId, error) {
-        const queue = this.relocations.get(actorId);
-        if (queue === undefined)
-            return;
-        for (let index = queue.outbound.length - 1; index >= 0; index--) {
-            const entry = queue.outbound[index];
-            if (entry.sealId !== sealId)
-                continue;
-            queue.outbound.splice(index, 1);
-            this.failOutbound(queue, entry, error);
-        }
-        this.deleteEmptyRelocationQueue(queue);
-    }
-    async applyRelocation(actorId, sealId, applyFingerprint, action, commitOwnerTransition, acceptedProducerProof) {
-        const prepared = await this.lane.run(() => this.prepareRelocationApply(actorId, sealId, applyFingerprint, action, acceptedProducerProof));
+    async applyRelocation(actorId, sealId, applyFingerprint, commitOwnerTransition) {
+        const prepared = await this.lane.run(() => this.prepareRelocationApply(actorId, sealId, applyFingerprint));
         if (prepared.applyPromise !== undefined) {
             await prepared.applyPromise;
             return;
@@ -544,7 +486,7 @@ class ZLinkActorSessionBindingRegistry {
         });
         await prepared.promise;
     }
-    prepareRelocationApply(actorId, sealId, applyFingerprint, action, acceptedProducerProof) {
+    prepareRelocationApply(actorId, sealId, applyFingerprint) {
         const queue = this.relocations.get(actorId);
         const state = queue?.seals.get(sealId);
         if (queue === undefined || state === undefined) {
@@ -554,15 +496,7 @@ class ZLinkActorSessionBindingRegistry {
             if (state.applyFingerprint !== applyFingerprint || state.applyPromise === undefined) {
                 throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale, `Actor '${actorId}' Session seal received a conflicting route apply.`, true);
             }
-            return { queue, state, applyPromise: state.applyPromise };
-        }
-        if (action === 'commit' &&
-            acceptedProducerProof !== undefined &&
-            !validAcceptedTargetProof(state, acceptedProducerProof)) {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale, `Actor '${actorId}' command 44 target producer proof did not match its Session seal.`, true);
-        }
-        if (action === 'abort' && acceptedProducerProof !== undefined) {
-            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale, `Actor '${actorId}' abort route supplied a target producer proof.`, true);
+            return { state, applyPromise: state.applyPromise };
         }
         state.phase = 'applying';
         state.applyFingerprint = applyFingerprint;
@@ -574,69 +508,19 @@ class ZLinkActorSessionBindingRegistry {
         });
         state.applyPromise = promise;
         return {
-            queue,
             state,
-            action,
-            acceptedProducerProof,
             promise,
             resolve,
-            reject,
-            actorId,
-            sealId
+            reject
         };
     }
     completeRelocationApply(prepared) {
-        const { queue, state, action, acceptedProducerProof, actorId, sealId } = prepared;
-        const proof = action === 'commit'
-            ? (acceptedProducerProof ?? this.currentProducerProof(actorId))
-            : relocationSourceProof(state);
-        state.acceptedProducerProof = proof;
-        for (let index = queue.outbound.length - 1; index >= 0; index--) {
-            const entry = queue.outbound[index];
-            if (entry.sealId !== sealId)
-                continue;
-            if (entry.authorization !== 'pendingTarget') {
-                entry.released = true;
-                continue;
-            }
-            if (action === 'commit' &&
-                proof !== undefined &&
-                entry.claim !== undefined &&
-                matchesAcceptedProducerProof(proof, entry.claim)) {
-                entry.released = true;
-                continue;
-            }
-            queue.outbound.splice(index, 1);
-            this.failOutbound(queue, entry, new Error(`Actor '${actorId}' pending Session producer did not match command 44 proof.`));
-        }
-        this.startOutboundDrain(queue);
-        state.phase = 'applied';
+        prepared.state.phase = 'applied';
     }
     failRelocationApply(prepared) {
         prepared.state.phase = 'sealed';
         prepared.state.applyFingerprint = undefined;
         prepared.state.applyPromise = undefined;
-        prepared.state.acceptedProducerProof = undefined;
-    }
-    currentProducerProof(actorId) {
-        const route = this.routes.get(actorId);
-        const actorRef = (route?.actor).ref;
-        const sessionIdentity = route?.sessionIdentity;
-        if (route === undefined ||
-            actorRef === undefined ||
-            sessionIdentity === undefined ||
-            actorRef.ownerNodeGeneration === undefined)
-            return undefined;
-        return {
-            actorId,
-            objectGeneration: BigInt(actorRef.objectGeneration ??
-                actorRef.generation ??
-                -1),
-            actorNodeRid: String(actorRef.nodeRid ?? ''),
-            actorNodeGeneration: BigInt(actorRef.ownerNodeGeneration),
-            sessionIdentity: String(sessionIdentity),
-            bindingGeneration: BigInt(actorRef.bindingGeneration ?? -1)
-        };
     }
     async observeRelocationTerminal(actorId, sealId, applyFingerprint) {
         await this.lane.run(() => this.observeRelocationTerminalCore(actorId, sealId, applyFingerprint));
@@ -662,7 +546,7 @@ class ZLinkActorSessionBindingRegistry {
     }
     /**
      * Actor-wide relocation teardown: every seal (active and terminal-retained)
-     * and every held outbound entry for `actorId` is discarded unconditionally.
+     * for `actorId` is discarded unconditionally.
      * Reserved for paths where the Actor itself is gone or being torn down
      * (destroy, ownership clear, relocation-seal expiry/failure) — never for a
      * single physical route's disconnect, which must not disturb a relocation
@@ -675,9 +559,14 @@ class ZLinkActorSessionBindingRegistry {
         const queue = this.relocations.get(actorId);
         if (queue === undefined)
             return;
+        this.rejectSealWaiters(actorId, error, error instanceof ZLinkFrameworkException_1.ZLinkFrameworkException &&
+            error.kind === ZLinkFrameworkException_1.ZLinkFrameworkErrorKind.DeadlineExceeded
+            ? 'target_closed'
+            : error instanceof ZLinkFrameworkException_1.ZLinkFrameworkException &&
+                error.kind === ZLinkFrameworkException_1.ZLinkFrameworkErrorKind.ShuttingDown
+                ? 'shutdown'
+                : 'stale_target');
         this.relocations.delete(actorId);
-        for (const entry of queue.outbound.splice(0))
-            this.failOutbound(queue, entry, error);
         for (const state of queue.seals.values()) {
             this.terminalRelocations.delete(state);
             if (state.phase !== 'terminal')
@@ -688,14 +577,14 @@ class ZLinkActorSessionBindingRegistry {
      * Spec 48 §137: a relocation seal's lifecycle is independent of any single
      * physical route's binding. Unbinding one physical route (a disconnect)
      * must retire only the still-open (nonterminal) relocation seal that this
-     * exact route's Session owns, and the outbound held against that seal — it
+     * exact route's Session owns — it
      * must never reach into a seal that has already reached 'terminal' (its
      * bounded retention exists precisely so a late same-seal relay can still
      * pass on a successor route) nor into a different Session's active seal
      * (a concurrent successor that already re-sealed before this stale route
      * noticed the disconnect).
      */
-    clearRouteRelocation(actorId, route, error) {
+    clearRouteRelocation(actorId, route) {
         const queue = this.relocations.get(actorId);
         if (queue === undefined)
             return;
@@ -710,13 +599,6 @@ class ZLinkActorSessionBindingRegistry {
             this.deleteEmptyRelocationQueue(queue);
             return;
         }
-        for (let index = queue.outbound.length - 1; index >= 0; index--) {
-            const entry = queue.outbound[index];
-            if (entry.sealId !== activeSealId)
-                continue;
-            queue.outbound.splice(index, 1);
-            this.failOutbound(queue, entry, error);
-        }
         queue.activeSealId = undefined;
         queue.seals.delete(activeSealId);
         this.terminalRelocations.delete(activeState);
@@ -900,113 +782,6 @@ class ZLinkActorSessionBindingRegistry {
         for (const waiter of waiters)
             waiter.reject(error);
     }
-    startOutboundDrain(queue) {
-        if (queue.drainPromise !== undefined)
-            return;
-        const drain = startOutsideStateLane(async () => {
-            for (;;) {
-                const entry = await this.lane.run(() => {
-                    const current = queue.outbound.at(0);
-                    if (current === undefined || !current.released)
-                        return undefined;
-                    if (current.settled) {
-                        queue.outbound.shift();
-                        return null;
-                    }
-                    return current;
-                });
-                if (entry === undefined)
-                    return;
-                if (entry === null)
-                    continue;
-                try {
-                    const delivered = await entry.operation.deliver();
-                    await this.lane.run(() => {
-                        if (delivered)
-                            this.settleOutbound(queue, entry);
-                        else
-                            this.failOutbound(queue, entry, new Error(`Actor '${queue.actorId}' retained Session outbound delivery was rejected.`));
-                        if (queue.outbound[0] === entry)
-                            queue.outbound.shift();
-                    });
-                }
-                catch (error) {
-                    await this.lane.run(() => {
-                        this.failOutbound(queue, entry, error);
-                        if (queue.outbound[0] === entry)
-                            queue.outbound.shift();
-                    });
-                }
-            }
-        });
-        startOutsideStateLane(() => {
-            void drain.finally(async () => await this.lane.run(() => {
-                if (queue.drainPromise === drain)
-                    queue.drainPromise = undefined;
-                if (queue.outbound[0]?.released === true)
-                    this.startOutboundDrain(queue);
-                else
-                    this.deleteEmptyRelocationQueue(queue);
-            }));
-        });
-        queue.drainPromise = drain;
-    }
-    reserveOutbound(queue, operation) {
-        if (queue.outboundCount < this.outboundCapacity) {
-            queue.outboundCount++;
-            return true;
-        }
-        failRetainedOutbound(operation, new Error(`Actor '${queue.actorId}' Session relocation outbound capacity was exhausted.`));
-        return false;
-    }
-    settleOutbound(queue, entry) {
-        if (entry.settled)
-            return;
-        entry.settled = true;
-        queue.outboundCount--;
-    }
-    failOutbound(queue, entry, error) {
-        if (entry.settled)
-            return;
-        this.settleOutbound(queue, entry);
-        failRetainedOutbound(entry.operation, error);
-    }
-    outboundAdmissionError(claim) {
-        if (claim.actorId.length === 0 ||
-            claim.objectGeneration <= 0n ||
-            claim.actorNodeRid.length === 0 ||
-            claim.actorNodeGeneration <= 0n ||
-            claim.producerNodeRid.length === 0 ||
-            claim.producerNodeGeneration <= 0n ||
-            claim.bindingGeneration <= 0n ||
-            claim.sessionIdentity.length === 0 ||
-            !(0, routing_id_1.routingIdsEqual)(claim.producerNodeRid, claim.actorNodeRid) ||
-            claim.producerNodeGeneration !== claim.actorNodeGeneration) {
-            return new Error(`Actor '${claim.actorId}' Session outbound admission claim is invalid.`);
-        }
-        const route = this.routes.get(claim.actorId);
-        const ref = route?.actor;
-        const actorRef = ref?.ref;
-        const routeSessionIdentity = route?.sessionIdentity;
-        if (route === undefined ||
-            actorRef === undefined ||
-            String(actorRef.actorId ?? claim.actorId) !== claim.actorId ||
-            BigInt(actorRef.objectGeneration ??
-                actorRef.generation ??
-                -1) !== claim.objectGeneration ||
-            BigInt(actorRef.bindingGeneration ?? -1) !== claim.bindingGeneration ||
-            String(routeSessionIdentity ?? '') !== claim.sessionIdentity) {
-            return new Error(`Actor '${claim.actorId}' Session outbound admission was fenced by its current binding.`);
-        }
-        return undefined;
-    }
-    matchesCurrentProducerNode(claim) {
-        const route = this.routes.get(claim.actorId);
-        const actorRef = (route?.actor).ref;
-        return (route !== undefined &&
-            actorRef !== undefined &&
-            (0, routing_id_1.routingIdsEqual)(String(actorRef.nodeRid ?? ''), claim.actorNodeRid));
-    }
     rememberTerminalRelocation(state) {
         this.terminalRelocations.delete(state);
         this.terminalRelocations.set(state, true);
@@ -1025,13 +800,21 @@ class ZLinkActorSessionBindingRegistry {
     deleteEmptyRelocationQueue(queue) {
         if (queue.activeSealId === undefined &&
             queue.seals.size === 0 &&
-            queue.outbound.length === 0 &&
-            queue.drainPromise === undefined &&
+            queue.ingress.length === 0 &&
+            queue.ingressDrain === undefined &&
             this.relocations.get(queue.actorId) === queue) {
             this.relocations.delete(queue.actorId);
         }
     }
-    resolveSealWaiters(actorId, _sealId) {
+    resolveSealWaiters(actorId, sealId) {
+        const queue = this.relocations.get(actorId);
+        if (queue !== undefined) {
+            for (const entry of queue.ingress) {
+                if (entry.sealId === sealId)
+                    entry.sealId = undefined;
+            }
+            this.startHeldOneWayDrain(actorId, queue);
+        }
         const waiters = this.sealWaiters.get(actorId);
         if (waiters === undefined)
             return;
@@ -1039,7 +822,12 @@ class ZLinkActorSessionBindingRegistry {
         for (const waiter of waiters)
             waiter.resolve();
     }
-    rejectSealWaiters(actorId, error) {
+    rejectSealWaiters(actorId, error, reason = 'target_closed') {
+        const queue = this.relocations.get(actorId);
+        if (queue !== undefined) {
+            for (const delivery of queue.ingress.splice(0))
+                delivery.drop(reason, error);
+        }
         const waiters = this.sealWaiters.get(actorId);
         if (waiters === undefined)
             return;
@@ -1047,6 +835,44 @@ class ZLinkActorSessionBindingRegistry {
         for (const waiter of waiters)
             waiter.reject(error);
     }
+    startHeldOneWayDrain(actorId, queue) {
+        if (queue.ingressDrain !== undefined)
+            return;
+        const drain = startOutsideStateLane(async () => {
+            for (;;) {
+                const next = await this.lane.run(() => {
+                    if (this.relocations.get(actorId) !== queue)
+                        return undefined;
+                    const first = queue.ingress.at(0);
+                    if (first === undefined || first.sealId !== undefined)
+                        return undefined;
+                    return queue.ingress.shift();
+                });
+                if (next === undefined)
+                    return;
+                try {
+                    await next.deliver();
+                }
+                catch (error) {
+                    next.drop('stale_target', error);
+                }
+            }
+        });
+        queue.ingressDrain = drain;
+        startOutsideStateLane(() => {
+            void drain.finally(async () => {
+                await this.lane.run(() => {
+                    if (queue.ingressDrain !== drain)
+                        return;
+                    queue.ingressDrain = undefined;
+                    if (queue.ingress.at(0)?.sealId === undefined && queue.ingress.length > 0)
+                        this.startHeldOneWayDrain(actorId, queue);
+                    else
+                        this.deleteEmptyRelocationQueue(queue);
+                });
+            });
+        });
+    }
 }
 exports.ZLinkActorSessionBindingRegistry = ZLinkActorSessionBindingRegistry;
 function assertRelocationClaim(state, claim) {
@@ -1061,54 +887,6 @@ function assertRelocationClaim(state, claim) {
 function startOutsideStateLane(work) {
     return detachedStateLaneResource.runInAsyncScope(work);
 }
-function matchesRelocationSourceProof(state, claim) {
-    return (state.actorId === claim.actorId &&
-        state.actorGeneration === claim.objectGeneration &&
-        state.bindingGeneration === claim.bindingGeneration &&
-        state.sessionIdentity === claim.sessionIdentity &&
-        state.actorNodeRid !== undefined &&
-        (0, routing_id_1.routingIdsEqual)(state.actorNodeRid, claim.actorNodeRid) &&
-        state.actorNodeGeneration === claim.actorNodeGeneration);
-}
-function matchesAcceptedProducerProof(proof, claim) {
-    return (proof.actorId === claim.actorId &&
-        proof.objectGeneration === claim.objectGeneration &&
-        (0, routing_id_1.routingIdsEqual)(proof.actorNodeRid, claim.actorNodeRid) &&
-        proof.actorNodeGeneration === claim.actorNodeGeneration &&
-        proof.sessionIdentity === claim.sessionIdentity &&
-        proof.bindingGeneration === claim.bindingGeneration);
-}
-function validAcceptedTargetProof(state, proof) {
-    return (proof.actorId === state.actorId &&
-        proof.objectGeneration === state.actorGeneration &&
-        proof.actorNodeRid.length > 0 &&
-        proof.actorNodeGeneration > 0n &&
-        proof.sessionIdentity === state.sessionIdentity &&
-        proof.bindingGeneration === state.bindingGeneration);
-}
-function relocationSourceProof(state) {
-    if (state.sessionIdentity === undefined ||
-        state.actorNodeRid === undefined ||
-        state.actorNodeGeneration === undefined)
-        return undefined;
-    return {
-        actorId: state.actorId,
-        objectGeneration: state.actorGeneration,
-        actorNodeRid: state.actorNodeRid,
-        actorNodeGeneration: state.actorNodeGeneration,
-        sessionIdentity: state.sessionIdentity,
-        bindingGeneration: state.bindingGeneration
-    };
-}
-function failRetainedOutbound(operation, error) {
-    try {
-        operation.fail(error);
-    }
-    catch {
-        // The aggregate has already removed the entry. A failure observer cannot
-        // retain or settle the same delivery a second time.
-    }
-}
 function assertSuccessorSessionIdentity(predecessor, successor) {
     if (predecessor.actorGeneration !== successor.actorGeneration ||
         predecessor.bindingGeneration !== successor.bindingGeneration ||