@zlink-systems/framework 0.25.0 → 0.27.0

package/src/runtime/foundation/service-stateful-runtime.ts

@@ -1,5 +1,20 @@
+import { ZlinkStreamContentType } from '@zlink-systems/stream-wire';
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { ZLinkFrameworkException } from '../../contracts';
+import type { ZLinkAuthoritySnapshot } from '../locations/internal-location-contracts';
+import { decodeServiceClosingSpotAuthority } from './service-authority-payload-codec';
+import {
+  ZLinkRuntimeDispatchErrorAction as ZLinkDispatchErrorAction,
+  ZLinkRuntimeDispatchErrorReason as ZLinkDispatchErrorReason,
+  ZLinkDispatchErrorSurface,
+  ZLinkDispatchMessageKind,
+  ZLinkRuntimeMessageFlowOutcome as ZLinkMessageFlowOutcome
+} from '../../contracts/Dispatch/ZLinkDispatchOptions';
 import { awaitWithAbort } from '../abort';
+import { shouldCompactBackingArray } from '../admission';
+import { RequestResult, SubmitResult, isZLinkBackendResultError } from '../backend/runtime-values';
+import type { ZLinkDispatchErrorReporter } from '../channels/dispatch-error-reporter';
+import { flowIfEnabled } from '../diagnostics/message-flow';
 import { captureZLinkExecutionTurn } from '../execution';
 import {
   ZLinkFrameworkInternalErrorKind,
@@ -8,18 +23,26 @@ import {
   internalFrameworkWireReply,
   translateWireReplyDecodeError
 } from '../framework-errors-internal';
-import { RequestResult, SubmitResult, isZLinkBackendResultError } from '../backend/runtime-values';
-import type { ZLinkDispatchErrorReporter } from '../channels/dispatch-error-reporter';
 import {
-  ZLinkRuntimeDispatchErrorAction as ZLinkDispatchErrorAction,
-  ZLinkDispatchErrorSurface,
-  ZLinkDispatchMessageKind
-} from '../../contracts/Dispatch/ZLinkDispatchOptions';
+  decodeActorJoin28,
+  encodeActorJoin28,
+  type ActorJoin28
+} from '../protocol/service_wire_pilot_codec.generated';
+import { canonicalActorJoinHandoffId, routingIdBytes } from './actor-join-recovery-codec';
+import { OperationRegistry } from './operation-registry';
+import {
+  MessageFollowSuppressionRegistry,
+  type MessageFollowSuppressionFence
+} from './message-follow-suppression-registry';
+import { ZLINK_NATIVE_CORRELATION_OPERATION_NAMESPACE } from './operation-identity';
 import type {
   RawServiceIngressRecord,
   RawServiceMeshRuntime,
   RawServicePumpResult
 } from './raw-service-mesh-runtime';
+import type { ServiceInstanceActivationRecoveryEnvelope } from './service-instance-activation-recovery-codec';
+import type { ServiceMailboxRecord } from './service-mailbox';
+import { validateServiceMetadataFrame } from './service-metadata-codec';
 import {
   ActorLifecycleKind,
   OperationKind,
@@ -28,13 +51,9 @@ import {
   type ActorJoinCompletionPayload,
   type ActorLocation,
   type ReceiveKindData,
+  type ServiceStreamSessionBinding,
   type StreamSessionActorAuthorityFence
 } from './service-runtime-contracts';
-import type { ServiceMailboxRecord } from './service-mailbox';
-import {
-  MessageFollowSuppressionRegistry,
-  type MessageFollowSuppressionFence
-} from './message-follow-suppression-registry';
 import {
   ServiceStaleGenerationError,
   ServiceStatefulRegistry,
@@ -46,6 +65,8 @@ import {
   type ServiceSpotState
 } from './service-stateful-registry';
 import {
+  M6bServiceWireCommand,
+  M6bServiceWireFlag,
   decodeStatefulHeader,
   decodeStatefulReply,
   encodeActorCreateHeader,
@@ -63,43 +84,37 @@ import {
   encodeStatefulReply,
   encodeUserSpotCloseHeader,
   encodeUserSpotCreateHeader,
-  M6bServiceWireCommand,
-  M6bServiceWireFlag,
   sessionBindingFromWire,
+  type ServiceActorCreateRecord,
   type ServiceActorRouteFence,
   type ServiceBoundSessionActorAuthority,
-  type ServiceRetiredBoundSessionRouteFence,
-  type ServiceActorCreateRecord,
+  type ServiceDirectSpotRouteFence,
   type ServiceInstanceActivationTarget,
   type ServiceInstanceRouteFence,
   type ServiceMessageFollowRoute,
-  type ServiceDirectSpotRouteFence,
+  type ServiceRetiredBoundSessionRouteFence,
   type ServiceSpotRouteFence,
   type ServiceStatefulReplyTail,
   type ServiceStatefulWireRecord,
   type ServiceUserSpotCloseRecord,
   type ServiceUserSpotCreateRecord
 } from './service-stateful-wire-codec';
-import { routingIdsEqual } from '../routing-id';
 import {
-  decodeActorJoin28,
-  encodeActorJoin28,
-  type ActorJoin28
-} from '../protocol/service_wire_pilot_codec.generated';
-import { canonicalActorJoinHandoffId, routingIdBytes } from './actor-join-recovery-codec';
-
+  SERVICE_WIRE_COMMAND_OFFSET,
+  SERVICE_WIRE_FLAGS_OFFSET
+} from './service-wire-binary-primitives';
+import { SERVICE_WIRE_MAGIC, SERVICE_WIRE_MAJOR } from './service-wire-constants.generated';
 import {
+  ServiceWireProtocolError,
   decodeApplicationPayload,
+  decodeApplicationPayloadView,
   encodeApplicationPayload,
-  type ServiceApplicationPayload,
-  ServiceWireProtocolError
+  type ServiceApplicationPayload
 } from './service-wire-m6a-codec';
-import type { ServiceInstanceActivationRecoveryEnvelope } from './service-instance-activation-recovery-codec';
-import { validateServiceMetadataFrame } from './service-metadata-codec';
-import type { ServiceSessionBindingIngressPort } from './service-session-binding-ingress-port';
-import { ZLinkFrameworkException } from '../../contracts';
+const STATEFUL_OPERATION_RETRY_TICK_MS = 20;
+
+const MAX_NODE_TIMER_DELAY_MS = 2_147_483_647;
 
-const ACTOR_ROUTE_STALE = 21;
 const SPOT_MOVING = 34;
 const USER_SPOT_OPERATION_CAPACITY = 65_536;
 const USER_SPOT_OPERATION_REPLAY_RETENTION_MS = 5 * 60_000;
@@ -110,12 +125,6 @@ export interface ServiceSpotMessageFollowSeal {
   readonly serial: bigint;
 }
 
-export interface ServiceBoundSessionSendFence {
-  readonly targetNodeGeneration: bigint;
-  readonly authorityOwnerGeneration: bigint;
-  readonly ownerLeaseGeneration: bigint;
-}
-
 interface ServiceSpotMessageFollowRecord {
   readonly ingress: RawServiceIngressRecord;
   readonly wire: Extract<ServiceStatefulWireRecord, { readonly kind: 'spotSend' | 'spotRequest' }>;
@@ -172,7 +181,9 @@ export interface ServiceStatefulMailboxData {
   readonly isPending?: () => boolean;
   /** Carries the local operation deadline into the lifecycle dispatch lane. */
   readonly deadlineUnixMs?: bigint;
+  readonly activationRecord?: Extract<ServiceStatefulWireRecord, { readonly kind: 'instanceSpot' }>;
   readonly onTerminalCompletion?: () => void | Promise<void>;
+  readonly onHandlerTurnStarted?: () => void;
   /** Decoded only by the canonical command-28 generator path. */
   readonly canonicalApplicationPayload?: ServiceApplicationPayload;
   readonly reply?: (
@@ -196,9 +207,8 @@ export interface ServiceCanonicalActorJoinCandidate {
 
 export interface ServiceSessionDelivery {
   readonly binding: ServiceSessionBinding;
-  readonly bindingIngress?: ServiceSessionBindingIngressPort;
   /**
-   * Delivers the retained M6A application frame after the binding fence has
+   * Delivers the M6A application frame after the binding fence has
    * been validated. The stream adapter owns multipart decoding at that point.
    */
   readonly deliver: (sessionRid: string, payloadFrame: Uint8Array) => Promise<boolean>;
@@ -233,7 +243,6 @@ export type ServiceInstanceApplicationTarget = ServiceInstanceApplicationIdentit
 export interface ServiceInstanceApplicationLifecycle {
   isMaterialized(target: ServiceInstanceApplicationIdentity): boolean;
   isMaterializing?(target: ServiceInstanceApplicationIdentity): boolean;
-  isClosing?(target: ServiceInstanceApplicationIdentity): boolean;
   isIdleEvicting?(target: ServiceInstanceApplicationIdentity): boolean;
   beginIdleEviction?(target: ServiceInstanceApplicationIdentity): boolean;
   materialize(target: ServiceInstanceApplicationIdentity, objectGeneration: bigint): Promise<void>;
@@ -263,8 +272,13 @@ export type ServiceInstanceAuthorityRead =
       readonly kind: 'creating';
       readonly objectGeneration: bigint;
       readonly authorityOwnerGeneration: bigint;
+      readonly authority?: ZLinkAuthoritySnapshot;
     }
-  | { readonly kind: 'ready'; readonly route: ServiceInstanceRouteFence };
+  | {
+      readonly kind: 'ready';
+      readonly route: ServiceInstanceRouteFence;
+      readonly authority?: ZLinkAuthoritySnapshot;
+    };
 
 export type ServiceInstanceAuthorityReserve =
   | { readonly kind: 'reserved'; readonly reservation: ServiceInstanceActivationReservation }
@@ -300,7 +314,8 @@ export interface ServiceInstanceActivationAuthority {
 export interface ServiceAsyncInstanceActivationAuthority {
   read(target: ServiceInstanceActivationTarget): Promise<ServiceInstanceAuthorityRead>;
   reserve(
-    activation: Omit<ServiceInstanceActivationRecoveryEnvelope, 'targetMeshName'>
+    activation: Omit<ServiceInstanceActivationRecoveryEnvelope, 'targetMeshName'>,
+    signal?: AbortSignal
   ): Promise<ServiceInstanceAuthorityReserve>;
   resume(
     target: ServiceInstanceActivationTarget,
@@ -309,7 +324,8 @@ export interface ServiceAsyncInstanceActivationAuthority {
   commit(
     target: ServiceInstanceActivationTarget,
     reservation: ServiceInstanceActivationReservation,
-    spot: ServiceSpotState
+    spot: ServiceSpotState,
+    deadlineUnixMs?: bigint
   ): Promise<{ readonly kind: 'committed' | 'lost'; readonly route: ServiceInstanceRouteFence }>;
   complete(
     target: ServiceInstanceActivationTarget,
@@ -366,7 +382,7 @@ export class ServiceStatefulRuntime {
 
   readonly registry: ServiceStatefulRegistry;
 
-  private readonly operations = new ServiceTerminalOperationRegistry<ServiceStatefulResult>();
+  private readonly operations: ServiceTerminalOperationRegistry<ServiceStatefulResult>;
   private readonly sessionDeliveries = new Map<string, ServiceSessionDelivery>();
   /**
    * A local Actor owner can replace its own session binding before the
@@ -378,7 +394,6 @@ export class ServiceStatefulRuntime {
   private readonly subscriptions = new Map<string, Set<string>>();
   private readonly instanceIntents = new Map<string, ServiceInstanceIntent>();
   private readonly admittedInstanceOperations = new Map<string, bigint>();
-  private readonly pendingInstanceTerminals = new Map<string, number>();
   private readonly pendingInstanceAuthorityTerminals = new Map<string, number>();
   private readonly instanceApplicationWaiters = new Map<string, Set<() => void>>();
   private readonly canonicalActorJoinHandoffs = new Map<bigint, string>();
@@ -421,7 +436,7 @@ export class ServiceStatefulRuntime {
   private readonly pendingInstanceActivations = new Map<
     string,
     Promise<{
-      readonly spot: ServiceSpotState;
+      readonly spot: Pick<ServiceSpotState, 'ref'>;
       readonly route: ServiceInstanceRouteFence;
     }>
   >();
@@ -430,8 +445,12 @@ export class ServiceStatefulRuntime {
   constructor(
     private readonly raw: RawServiceMeshRuntime,
     readonly nodeRid: string,
-    readonly nodeGeneration: bigint
+    readonly nodeGeneration: bigint,
+    onPendingOperationsChanged?: () => void
   ) {
+    this.operations = new ServiceTerminalOperationRegistry(
+      new OperationRegistry(undefined, onPendingOperationsChanged)
+    );
     this.registry = new ServiceStatefulRegistry(nodeRid, nodeGeneration);
     this.registry.createEntrySpot(nodeRid);
     raw.setServiceIngress((record) => this.ingress(record));
@@ -879,6 +898,7 @@ export class ServiceStatefulRuntime {
       ...(envelope.replyRouteId === undefined ? {} : { replyRouteId: envelope.replyRouteId })
     };
     const applicationJobOwner = await this.raw.reserveLocalIngress();
+    const terminal = this.activationTerminalCompletion(target, route);
     try {
       const admitted = this.enqueueActivatedInstanceSpot(
         {
@@ -904,11 +924,11 @@ export class ServiceStatefulRuntime {
         Buffer.from(envelope.applicationPayloadFrame),
         spot,
         undefined,
-        this.activationTerminalCompletion(target, route),
+        terminal.onTerminalCompletion,
         envelope.metadataFrame === undefined
           ? undefined
           : validateServiceMetadataFrame(envelope.metadataFrame),
-        true,
+        terminal.onHandlerTurnStarted,
         this.instanceApplicationTarget(record, route.objectGeneration)
       );
       if (admitted !== 'application') {
@@ -1003,12 +1023,10 @@ export class ServiceStatefulRuntime {
     return released;
   }
 
+  /** Resolves once every first terminal record of an activated Instance message is durable. */
   waitForInstanceApplicationQuiescence(spotId: string, signal?: AbortSignal): Promise<void> {
     const key = String(spotId);
-    if (
-      (this.pendingInstanceTerminals.get(key) ?? 0) === 0 &&
-      (this.pendingInstanceAuthorityTerminals.get(key) ?? 0) === 0
-    ) {
+    if ((this.pendingInstanceAuthorityTerminals.get(key) ?? 0) === 0) {
       return Promise.resolve();
     }
     if (signal?.aborted === true) {
@@ -1271,11 +1289,11 @@ export class ServiceStatefulRuntime {
           reporter.report({
             surface: ZLinkDispatchErrorSurface.SpotRoute,
             messageKind: ZLinkDispatchMessageKind.Send,
-            reason: serviceSpotPublishFailureReason(
-              undefined,
-              this.raw.isPeerRouteReady(target.descriptor.nodeRoutingId),
-              this.closed
-            ),
+            reason: this.closed
+              ? ZLinkDispatchErrorReason.Shutdown
+              : this.raw.isPeerRouteReady(target.descriptor.nodeRoutingId)
+                ? ZLinkDispatchErrorReason.Backpressure
+                : ZLinkDispatchErrorReason.StaleTarget,
             action: ZLinkDispatchErrorAction.Drop,
             meshName: this.dispatchErrorMeshName,
             channelName,
@@ -1296,7 +1314,10 @@ export class ServiceStatefulRuntime {
     if (target === undefined) {
       return SubmitResult.NotFound;
     }
-    const header = encodeSpotHeader('spotSend', sourceSpotId, target);
+    const header = encodeSpotHeader('spotSend', sourceSpotId, target, undefined, {
+      high: this.nodeGeneration,
+      low: this.nextMessageFollowOperation++
+    });
     return this.submitOneWay(target.targetNodeRid, [header, encodeApplicationPayload(payload)]);
   }
 
@@ -1309,13 +1330,16 @@ export class ServiceStatefulRuntime {
     const pending = this.operations.register(timeoutMs);
     const target = this.acceptSpotAuthority(requested);
     if (target === undefined) {
-      this.operations.reply(pending.id, {
-        terminalResult: RequestResult.NotFound,
-        failureCode: ACTOR_ROUTE_STALE
-      });
+      this.operations.reply(
+        pending.id,
+        internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.ActorLocationStale)
+      );
       return pending;
     }
-    const header = encodeSpotHeader('spotRequest', sourceSpotId, target, pending.id);
+    const header = encodeSpotHeader('spotRequest', sourceSpotId, target, pending.id, {
+      high: this.nodeGeneration,
+      low: this.nextMessageFollowOperation++
+    });
     this.submitRequest(
       pending,
       target.targetNodeRid,
@@ -1346,7 +1370,8 @@ export class ServiceStatefulRuntime {
         : {
             ...boundSession,
             sequence: this.nextSessionSequence++
-          }
+          },
+      { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ }
     );
     return this.submitOneWay(target.nodeRid, [header, encodeApplicationPayload(payload)]);
   }
@@ -1363,10 +1388,10 @@ export class ServiceStatefulRuntime {
     const pending = this.operations.register(timeoutMs);
     const route = this.tryActorFence(target);
     if (route === undefined) {
-      this.operations.reply(pending.id, {
-        terminalResult: RequestResult.NotFound,
-        failureCode: ACTOR_ROUTE_STALE
-      });
+      this.operations.reply(
+        pending.id,
+        internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.ActorLocationStale)
+      );
       return pending;
     }
     const header = encodeActorHeader(
@@ -1379,7 +1404,8 @@ export class ServiceStatefulRuntime {
         : {
             ...boundSession,
             sequence: this.nextSessionSequence++
-          }
+          },
+      { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ }
     );
     this.submitRequest(
       pending,
@@ -1395,7 +1421,8 @@ export class ServiceStatefulRuntime {
     route: ServiceInstanceRouteFence,
     payload: ServiceApplicationPayload,
     sourceSpotId?: string,
-    metadataFrame?: Uint8Array
+    metadataFrame?: Uint8Array,
+    instanceIntent = false
   ): Promise<number> {
     return this.submitOneWay(
       route.targetNodeRid,
@@ -1409,7 +1436,8 @@ export class ServiceStatefulRuntime {
             'send',
             { high: 0n, low: 0n },
             undefined,
-            metadataFrame !== undefined
+            metadataFrame !== undefined,
+            instanceIntent
           ),
           encodeApplicationPayload(payload)
         ],
@@ -1469,7 +1497,8 @@ export class ServiceStatefulRuntime {
     payload: ServiceApplicationPayload,
     timeoutMs: number,
     sourceSpotId?: string,
-    metadataFrame?: Uint8Array
+    metadataFrame?: Uint8Array,
+    instanceIntent = false
   ): ServiceStatefulPendingOperation {
     const pending = this.operations.register(timeoutMs);
     this.submitRequest(
@@ -1483,9 +1512,10 @@ export class ServiceStatefulRuntime {
             this.nodeRid,
             sourceSpotId,
             'request',
-            { high: 2n, low: pending.id },
+            { high: ZLINK_NATIVE_CORRELATION_OPERATION_NAMESPACE, low: pending.id },
             pending.id,
-            metadataFrame !== undefined
+            metadataFrame !== undefined,
+            instanceIntent
           ),
           encodeApplicationPayload(payload)
         ],
@@ -1716,7 +1746,6 @@ export class ServiceStatefulRuntime {
     timeoutMs: number,
     deliver: ServiceSessionDelivery['deliver'],
     onBindingReplaced?: ServiceSessionDelivery['onBindingReplaced'],
-    bindingIngress?: ServiceSessionBindingIngressPort,
     actorAuthority?: StreamSessionActorAuthorityFence
   ): ServiceStatefulPendingOperation {
     const deadlineMs = performance.now() + timeoutMs;
@@ -1735,7 +1764,6 @@ export class ServiceStatefulRuntime {
     const delivery: ServiceSessionDelivery = {
       binding: localBinding,
       deliver,
-      ...(bindingIngress === undefined ? {} : { bindingIngress }),
       ...(onBindingReplaced === undefined ? {} : { onBindingReplaced })
     };
     const deliveryKey = actorKey(actor);
@@ -1876,10 +1904,10 @@ export class ServiceStatefulRuntime {
       delivery.binding.sessionRid !== sessionRid ||
       delivery.binding.bindingGeneration !== expectedBindingGeneration
     ) {
-      this.operations.reply(pending.id, {
-        terminalResult: RequestResult.NotFound,
-        failureCode: ACTOR_ROUTE_STALE
-      });
+      this.operations.reply(
+        pending.id,
+        internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.ActorLocationStale)
+      );
       return pending;
     }
     this.sessionDeliveries.delete(actorKey(actor));
@@ -1900,10 +1928,19 @@ export class ServiceStatefulRuntime {
     return pending;
   }
 
-  sessionBindings(sessionRid: string): readonly ServiceSessionBinding[] {
+  sessionBindings(sessionRid: string): readonly ServiceStreamSessionBinding[] {
     return [...this.sessionDeliveries.values()]
       .map((value) => value.binding)
-      .filter((binding) => binding.sessionRid === sessionRid);
+      .filter((binding) => binding.sessionRid === sessionRid)
+      .map((binding) => {
+        const owner = requireSessionOwnerIdentity(binding);
+        return {
+          ...binding,
+          sessionOwnerNodeGeneration: owner.nodeGeneration,
+          sessionOwnerId: owner.ownerId,
+          sessionOwnerLeaseGeneration: owner.leaseGeneration
+        };
+      });
   }
 
   allSessionBindings(): readonly ServiceSessionBinding[] {
@@ -1935,16 +1972,20 @@ export class ServiceStatefulRuntime {
   async sendBoundSession(
     actor: ServiceActorRef,
     expectedBindingGeneration: bigint,
-    payload: ServiceApplicationPayload,
-    senderFence?: ServiceBoundSessionSendFence
+    payload: ServiceApplicationPayload
   ): Promise<number> {
+    // Session–Actor binding §3 item 3: the source sends by binding identity to
+    // the registered route. The header's owner lifecycle fields are this node's
+    // current route values, not send conditions; the Session owner alone
+    // decides whether the binding is current.
     let binding: ServiceSessionBinding;
     try {
       binding = this.registry.validateBoundSession(actor, expectedBindingGeneration);
-    } catch {
-      return SubmitResult.InvalidState;
+    } catch (error) {
+      if (error instanceof ServiceStaleGenerationError) return SubmitResult.NotFound;
+      throw error;
     }
-    const actorFence = this.tryBoundSessionSendFence(actor, senderFence);
+    const actorFence = this.tryActorFence(actor);
     if (actorFence === undefined) return SubmitResult.InvalidState;
     const header = encodeBoundSessionSendHeader(actorFence, expectedBindingGeneration);
     return this.submitOneWay(binding.sessionOwnerNodeRid, [
@@ -1953,27 +1994,22 @@ export class ServiceStatefulRuntime {
     ]);
   }
 
+  expireOperations(nowMs: number, turnDeadlineMs: number): number {
+    return this.operations.expire(nowMs, turnDeadlineMs);
+  }
+
+  get pendingOperationCount(): number {
+    return this.operations.size;
+  }
+
   close(): void {
     if (this.closed) return;
     this.closed = true;
     this.operations.close();
-    const clearedActors = new Set<string>();
-    for (const deliveries of [this.sessionDeliveries, this.retiredSessionDeliveries]) {
-      for (const delivery of deliveries.values()) {
-        const actorId = delivery.binding.actor.actorId;
-        if (clearedActors.has(actorId)) continue;
-        clearedActors.add(actorId);
-        delivery.bindingIngress?.clearOutbound(
-          actorId,
-          new Error(`Actor '${actorId}' Session service closed with retained outbound delivery.`)
-        );
-      }
-    }
     this.sessionDeliveries.clear();
     this.retiredSessionDeliveries.clear();
     this.appliedReplacementNotices.clear();
     this.instanceIntents.clear();
-    this.pendingInstanceTerminals.clear();
     this.pendingInstanceAuthorityTerminals.clear();
     for (const waiters of this.instanceApplicationWaiters.values()) {
       for (const waiter of waiters) waiter();
@@ -2026,7 +2062,12 @@ export class ServiceStatefulRuntime {
         }
         decoded = statefulActorJoinFromCanonical(canonicalActorJoin);
       } else {
-        decoded = decodeStatefulHeader(record.parts[0]!);
+        const metadata = (record.flags & M6bServiceWireFlag.metadata) !== 0;
+        decoded = decodeStatefulHeader(
+          record.parts[0]!,
+          record.parts[metadata ? 2 : 1],
+          metadata ? record.parts[1] : undefined
+        );
       }
       const hasPayload = [
         'spotSend',
@@ -2039,6 +2080,12 @@ export class ServiceStatefulRuntime {
       ].includes(decoded.kind);
       const instanceMetadata =
         decoded.kind === 'instanceSpot' && (record.flags & M6bServiceWireFlag.metadata) !== 0;
+      const statefulMetadata =
+        (decoded.kind === 'spotSend' ||
+          decoded.kind === 'spotRequest' ||
+          decoded.kind === 'actorSend' ||
+          decoded.kind === 'actorRequest') &&
+        (record.flags & M6bServiceWireFlag.metadata) !== 0;
       const userSpotInfrastructure =
         decoded.kind === 'userSpotCreate' ||
         decoded.kind === 'userSpotClose' ||
@@ -2047,16 +2094,19 @@ export class ServiceStatefulRuntime {
         decoded.kind === 'boundSessionReplaced';
       if (
         record.parts.length < 1 ||
-        record.parts.length > (instanceMetadata ? 3 : 2) ||
-        (hasPayload && decoded.kind !== 'actorJoin' && record.parts.length !== 2) ||
+        record.parts.length > (instanceMetadata || statefulMetadata ? 3 : 2) ||
+        (hasPayload &&
+          decoded.kind !== 'actorJoin' &&
+          record.parts.length !== ((record.flags & M6bServiceWireFlag.metadata) !== 0 ? 3 : 2)) ||
         (decoded.kind === 'instanceSpot' && record.parts.length !== (instanceMetadata ? 3 : 2)) ||
         (userSpotInfrastructure && record.parts.length !== 1)
       ) {
         return 'protocolError';
       }
-      const metadataFrame = instanceMetadata
-        ? validateServiceMetadataFrame(record.parts[1]!)
-        : undefined;
+      const metadataFrame =
+        instanceMetadata || statefulMetadata
+          ? validateServiceMetadataFrame(record.parts[1]!)
+          : undefined;
       const canonicalPayload =
         canonicalActorJoin?.payload === undefined
           ? undefined
@@ -2095,6 +2145,22 @@ export class ServiceStatefulRuntime {
             kind === ZLinkFrameworkInternalErrorKind.SpotMoving ||
             kind === ZLinkFrameworkInternalErrorKind.SpotGenerationStale
           ) {
+            const reporter = this.dispatchErrors;
+            if (decoded.kind === 'instanceSpot' && reporter?.captureEnabled() === true) {
+              reporter.report({
+                surface: ZLinkDispatchErrorSurface.InstanceSpot,
+                messageKind: ZLinkDispatchMessageKind.Send,
+                reason: ZLinkDispatchErrorReason.StaleTarget,
+                action: ZLinkDispatchErrorAction.Drop,
+                meshName: this.dispatchErrorMeshName,
+                sourceRid: decoded.sourceNodeRid,
+                spotId:
+                  decoded.activation === 'ready'
+                    ? decoded.route.targetSpotId
+                    : decoded.target.targetSpotId,
+                error
+              });
+            }
             return 'protocolError';
           }
         }
@@ -2349,11 +2415,6 @@ export class ServiceStatefulRuntime {
       targetSpotId: record.route.targetSpotId,
       stableType: intent.instanceType
     };
-    // A close seals execution only after the current application count reaches
-    // zero. A new Instance message must wait for that close even while the old
-    // activation is still materialized; otherwise it can be admitted after
-    // the close quiescence check and be removed with the old activation.
-    if (lifecycle.isClosing?.(applicationTarget) === true) return true;
     return !lifecycle.isMaterialized(applicationTarget);
   }
 
@@ -2361,11 +2422,11 @@ export class ServiceStatefulRuntime {
     ingress: RawServiceIngressRecord,
     record: Extract<ServiceStatefulWireRecord, { readonly kind: 'instanceSpot' }>,
     payloadFrame: Buffer,
-    spot: ServiceSpotState,
+    spot: Pick<ServiceSpotState, 'ref'>,
     localReply?: NonNullable<ServiceStatefulMailboxData['reply']>,
     onTerminalCompletion?: NonNullable<ServiceStatefulMailboxData['onTerminalCompletion']>,
     metadataFrame?: Buffer,
-    activationTerminal = false,
+    onHandlerTurnStarted?: () => void,
     applicationTargetOverride?: ServiceInstanceApplicationTarget
   ): RawServicePumpResult {
     let operationKey: string | undefined;
@@ -2395,10 +2456,6 @@ export class ServiceStatefulRuntime {
       onTerminalCompletion === undefined
         ? undefined
         : async () => {
-            // The application turn has returned before authority cleanup starts.
-            // Mark it quiescent first so a close requested by that turn can finish
-            // its local cleanup and release the exact authority fence below.
-            this.completeInstanceApplicationOperation(applicationTarget.targetSpotId);
             try {
               await onTerminalCompletion();
             } finally {
@@ -2413,8 +2470,11 @@ export class ServiceStatefulRuntime {
       ...(record.operationKind === 'request' ? { correlation: record.replyRouteId } : {}),
       ...(record.sourceSpotId === undefined ? {} : { sourceSpotId: record.sourceSpotId }),
       targetSpot: spot.ref,
+      activationRecord: record,
+      ...(record.activation === 'missing' ? { deadlineUnixMs: record.deadlineUnixMs } : {}),
       ...(metadataFrame === undefined ? {} : { applicationMetadata: metadataFrame }),
       ...(terminalCompletion === undefined ? {} : { onTerminalCompletion: terminalCompletion }),
+      ...(onHandlerTurnStarted === undefined ? {} : { onHandlerTurnStarted }),
       ...(record.operationKind === 'request'
         ? {
             reply:
@@ -2431,10 +2491,6 @@ export class ServiceStatefulRuntime {
       this.admittedInstanceOperations.set(operationKey, record.deadlineUnixMs);
     }
     if (onTerminalCompletion !== undefined && result === 'application') {
-      this.beginInstanceApplicationOperation(applicationTarget.targetSpotId);
-      if (activationTerminal) {
-        this.beginInstanceAuthorityOperation(applicationTarget.targetSpotId);
-      }
       this.instanceApplicationLifecycle?.beginTerminal(applicationTarget);
     }
     return result;
@@ -2458,15 +2514,16 @@ export class ServiceStatefulRuntime {
         metadataFrame
       );
       if (this.closed) return;
+      const terminal = this.activationTerminalCompletion(record.target, activation.route);
       const admitted = this.enqueueActivatedInstanceSpot(
         ingress,
         record,
         payloadFrame,
         activation.spot,
         localReply,
-        this.activationTerminalCompletion(record.target, activation.route),
+        terminal.onTerminalCompletion,
         metadataFrame,
-        true,
+        terminal.onHandlerTurnStarted,
         this.instanceApplicationTarget(record, activation.route.objectGeneration)
       );
       if (admitted !== 'application') {
@@ -2534,12 +2591,14 @@ export class ServiceStatefulRuntime {
       const spot = this.requireInstanceActivation(ingress, refreshedRecord);
       const admitted = this.enqueueActivatedInstanceSpot(
         ingress,
-        refreshedRecord,
+        record,
         payloadFrame,
         spot,
         undefined,
         this.instanceApplicationTerminalCompletion(this.instanceApplicationTarget(refreshedRecord)),
-        metadataFrame
+        metadataFrame,
+        undefined,
+        this.instanceApplicationTarget(refreshedRecord)
       );
       if (admitted !== 'application') {
         throw new Error('Rematerialized Instance message was not admitted to the local queue.');
@@ -2551,23 +2610,39 @@ export class ServiceStatefulRuntime {
     }
   }
 
+  /**
+   * Spot messaging §4 step 12 with §7 step 1: a Close waits for the first terminal
+   * record only of a message whose handler turn started before it; a message queued
+   * behind that Close is not counted, so it cannot hold the Close it follows.
+   */
   private activationTerminalCompletion(
     target: ServiceInstanceActivationTarget,
     route: ServiceInstanceRouteFence
-  ): () => Promise<void> {
+  ): {
+    readonly onTerminalCompletion: () => Promise<void>;
+    readonly onHandlerTurnStarted: () => void;
+  } {
     let completion: Promise<void> | undefined;
+    let started = false;
     const applicationTarget: ServiceInstanceApplicationTarget = {
       targetSpotId: target.targetSpotId,
       stableType: target.stableType,
       objectGeneration: route.objectGeneration
     };
-    return () =>
+    const onHandlerTurnStarted = (): void => {
+      if (started || completion !== undefined) return;
+      started = true;
+      this.beginInstanceAuthorityOperation(target.targetSpotId);
+    };
+    const onTerminalCompletion = (): Promise<void> =>
       (completion ??= (async () => {
-        let authorityCompletionSignaled = false;
+        let authorityCompletionSignaled = !started;
         try {
           const released = await this.asyncInstanceAuthority?.complete(target, route);
-          this.completeInstanceAuthorityOperation(target.targetSpotId);
-          authorityCompletionSignaled = true;
+          if (!authorityCompletionSignaled) {
+            this.completeInstanceAuthorityOperation(target.targetSpotId);
+            authorityCompletionSignaled = true;
+          }
           if (released !== undefined) {
             const authorityReleased =
               (await this.instanceApplicationLifecycle?.completeTerminal(applicationTarget)) ??
@@ -2584,6 +2659,7 @@ export class ServiceStatefulRuntime {
           }
         }
       })());
+    return { onTerminalCompletion, onHandlerTurnStarted };
   }
 
   private instanceApplicationTerminalCompletion(
@@ -2628,11 +2704,6 @@ export class ServiceStatefulRuntime {
     };
   }
 
-  private beginInstanceApplicationOperation(spotId: string): void {
-    const key = String(spotId);
-    this.pendingInstanceTerminals.set(key, (this.pendingInstanceTerminals.get(key) ?? 0) + 1);
-  }
-
   private beginInstanceAuthorityOperation(spotId: string): void {
     const key = String(spotId);
     this.pendingInstanceAuthorityTerminals.set(
@@ -2641,17 +2712,6 @@ export class ServiceStatefulRuntime {
     );
   }
 
-  private completeInstanceApplicationOperation(spotId: string): void {
-    const key = String(spotId);
-    const pending = this.pendingInstanceTerminals.get(key);
-    if (pending === undefined || pending <= 1) {
-      this.pendingInstanceTerminals.delete(key);
-      this.completeInstanceApplicationWaitersIfQuiescent(key);
-      return;
-    }
-    this.pendingInstanceTerminals.set(key, pending - 1);
-  }
-
   private completeInstanceAuthorityOperation(spotId: string): void {
     const key = String(spotId);
     const pending = this.pendingInstanceAuthorityTerminals.get(key);
@@ -2664,11 +2724,7 @@ export class ServiceStatefulRuntime {
   }
 
   private completeInstanceApplicationWaitersIfQuiescent(key: string): void {
-    if (
-      (this.pendingInstanceTerminals.get(key) ?? 0) !== 0 ||
-      (this.pendingInstanceAuthorityTerminals.get(key) ?? 0) !== 0
-    )
-      return;
+    if ((this.pendingInstanceAuthorityTerminals.get(key) ?? 0) !== 0) return;
     const waiters = this.instanceApplicationWaiters.get(key);
     if (waiters === undefined) return;
     this.instanceApplicationWaiters.delete(key);
@@ -2817,8 +2873,8 @@ export class ServiceStatefulRuntime {
       // activation continuation can publish its in-memory intent. If the
       // local ready projection already carries the exact object and owner
       // fence from the received route, publish that validated projection
-      // instead of exposing a transient NotFound result to a following
-      // request. A mismatched or absent local projection remains NotFound.
+      // instead of rejecting a following request while publication finishes.
+      // An absent Ready projection cannot validate the received owner fence.
       const local = this.registry.spot(record.route.targetSpotId);
       if (
         local?.kind === 'instance' &&
@@ -2831,7 +2887,7 @@ export class ServiceStatefulRuntime {
     }
     if (intent === undefined) {
       throw createInternalFrameworkException(
-        ZLinkFrameworkInternalErrorKind.RequestTargetNotFound,
+        ZLinkFrameworkInternalErrorKind.SpotMoving,
         `Instance Spot '${record.route.targetSpotId}' has no current Ready authority.`
       );
     }
@@ -2954,7 +3010,10 @@ export class ServiceStatefulRuntime {
     >,
     payloadFrame: Buffer,
     metadataFrame?: Buffer
-  ): Promise<{ readonly spot: ServiceSpotState; readonly route: ServiceInstanceRouteFence }> {
+  ): Promise<{
+    readonly spot: Pick<ServiceSpotState, 'ref'>;
+    readonly route: ServiceInstanceRouteFence;
+  }> {
     const key = instanceActivationKey(record);
     const pending = this.pendingInstanceActivations.get(key);
     if (pending !== undefined) return pending;
@@ -2976,7 +3035,10 @@ export class ServiceStatefulRuntime {
     >,
     payloadFrame: Buffer,
     metadataFrame?: Buffer
-  ): Promise<{ readonly spot: ServiceSpotState; readonly route: ServiceInstanceRouteFence }> {
+  ): Promise<{
+    readonly spot: Pick<ServiceSpotState, 'ref'>;
+    readonly route: ServiceInstanceRouteFence;
+  }> {
     const target = record.target;
     if (
       target.targetNodeRid !== this.nodeRid ||
@@ -2992,6 +3054,46 @@ export class ServiceStatefulRuntime {
 
     const local = this.registry.spot(target.targetSpotId);
     const current = await authority.read(target);
+    if (
+      current.kind === 'creating' &&
+      current.authority?.allocation.state === 'active' &&
+      this.instanceApplicationLifecycle?.isMaterializing?.(target) === true
+    ) {
+      return {
+        spot: { ref: { spotId: target.targetSpotId, generation: current.objectGeneration } },
+        route: {
+          targetSpotId: target.targetSpotId,
+          targetNodeRid: this.nodeRid,
+          targetNodeGeneration: this.nodeGeneration,
+          objectGeneration: current.objectGeneration,
+          authorityOwnerGeneration: current.authorityOwnerGeneration,
+          ownerId: current.authority.ownerId,
+          leaseGeneration: current.authority.ownerLeaseGeneration,
+          storeVersion: current.authority.storeVersion.value
+        }
+      };
+    }
+    if (
+      current.kind === 'ready' &&
+      current.authority !== undefined &&
+      decodeServiceClosingSpotAuthority(current.authority.payload) !== undefined
+    ) {
+      if (current.route.targetNodeRid !== this.nodeRid) {
+        throw new ServiceInstanceActivationRedirectError(current.route);
+      }
+      if (
+        current.route.targetNodeGeneration !== this.nodeGeneration ||
+        (local !== undefined &&
+          !routeMatchesLocal(current.route, local, this.nodeRid, this.nodeGeneration)) ||
+        (local === undefined && this.instanceApplicationLifecycle?.isMaterialized(target) !== true)
+      ) {
+        throw new ServiceStaleGenerationError('spot', target.targetSpotId);
+      }
+      return {
+        spot: { ref: { spotId: target.targetSpotId, generation: current.route.objectGeneration } },
+        route: current.route
+      };
+    }
     if (!this.acceptsLocalMissingInstancePlacement()) {
       if (current.kind === 'ready' && current.route.targetNodeRid !== this.nodeRid) {
         throw new ServiceInstanceActivationRedirectError(current.route);
@@ -3023,7 +3125,6 @@ export class ServiceStatefulRuntime {
     }
     if (local !== undefined) {
       const lifecycle = this.instanceApplicationLifecycle;
-      const closing = lifecycle?.isClosing?.(target) === true;
       let materialized = lifecycle === undefined ? undefined : lifecycle.isMaterialized(target);
       const materializing = lifecycle?.isMaterializing?.(target) === true;
       if (local.kind !== 'instance' || local.stableType !== target.stableType) {
@@ -3033,10 +3134,8 @@ export class ServiceStatefulRuntime {
         current.kind === 'creating' &&
         local.ref.generation === current.objectGeneration &&
         local.authorityOwnerGeneration === current.authorityOwnerGeneration;
-      const replacesClosingProjection = current.kind === 'creating' && closing;
       if (
         current.kind === 'missing' &&
-        !closing &&
         !materializing &&
         materialized === true &&
         lifecycle !== undefined
@@ -3060,24 +3159,33 @@ export class ServiceStatefulRuntime {
       // If disposal did not remove an orphaned materialization, keep fencing
       // it instead of admitting work into two application generations.
       if (
-        (!joinsCreating && !replacesClosingProjection && current.kind !== 'missing') ||
-        (!joinsCreating && !closing && materialized !== false && !materializing)
+        (!joinsCreating && current.kind !== 'missing') ||
+        (!joinsCreating && materialized !== false && !materializing)
       ) {
         throw new ServiceStaleGenerationError('spot', target.targetSpotId);
       }
     }
-    const reserved = await authority.reserve({
-      target,
-      sourceNodeRid: record.sourceNodeRid,
-      sourceNodeGeneration: record.sourceNodeGeneration,
-      ...(record.sourceSpotId === undefined ? {} : { sourceSpotId: record.sourceSpotId }),
-      operationKind: record.operationKind,
-      operation: record.operation,
-      ...(record.replyRouteId === undefined ? {} : { replyRouteId: record.replyRouteId }),
-      deadlineUnixMs: record.deadlineUnixMs,
-      ...(metadataFrame === undefined ? {} : { metadataFrame }),
-      applicationPayloadFrame: payloadFrame
-    });
+    const deadline = operationDeadline(record.deadlineUnixMs);
+    let reserved: ServiceInstanceAuthorityReserve;
+    try {
+      reserved = await authority.reserve(
+        {
+          target,
+          sourceNodeRid: record.sourceNodeRid,
+          sourceNodeGeneration: record.sourceNodeGeneration,
+          ...(record.sourceSpotId === undefined ? {} : { sourceSpotId: record.sourceSpotId }),
+          operationKind: record.operationKind,
+          operation: record.operation,
+          ...(record.replyRouteId === undefined ? {} : { replyRouteId: record.replyRouteId }),
+          deadlineUnixMs: record.deadlineUnixMs,
+          ...(metadataFrame === undefined ? {} : { metadataFrame }),
+          applicationPayloadFrame: payloadFrame
+        },
+        deadline.signal
+      );
+    } finally {
+      deadline.close();
+    }
     if (reserved.kind === 'ready') {
       throw new ServiceInstanceActivationRedirectError(reserved.route);
     }
@@ -3102,7 +3210,12 @@ export class ServiceStatefulRuntime {
     }
     let committed: Awaited<ReturnType<ServiceAsyncInstanceActivationAuthority['commit']>>;
     try {
-      committed = await authority.commit(target, reserved.reservation, activation.spot);
+      committed = await authority.commit(
+        target,
+        reserved.reservation,
+        activation.spot,
+        record.deadlineUnixMs
+      );
     } catch (error) {
       if (activation.created) this.registry.closeSpot(activation.spot.ref);
       await this.instanceApplicationLifecycle?.discard(target);
@@ -3594,7 +3707,15 @@ export class ServiceStatefulRuntime {
     const accepted = this.raw.mailbox.tryEnqueue({
       owner: `actor:${actor.actorId}\0${actor.generation}`,
       domain: 'infrastructure',
-      parts: [Buffer.from([0x5a, 0x4d, 1, M6bServiceWireCommand.boundSessionBind, 0])],
+      parts: [
+        Buffer.from([
+          SERVICE_WIRE_MAGIC[0],
+          SERVICE_WIRE_MAGIC[1],
+          SERVICE_WIRE_MAJOR,
+          M6bServiceWireCommand.boundSessionBind,
+          0
+        ])
+      ],
       sourceRoutingId: binding.sessionOwnerNodeRid,
       stateful: {
         receiveKind: ReceiveKind.ActorBinding,
@@ -3627,62 +3748,25 @@ export class ServiceStatefulRuntime {
     record: Extract<ServiceStatefulWireRecord, { readonly kind: 'boundSessionSend' }>,
     payloadFrame: Uint8Array | undefined
   ): Promise<RawServicePumpResult> {
+    // Session–Actor binding §3 item 3, §8.1: this Session owner's binding
+    // record alone decides whether command 36 names the current binding
+    // (ActorId, ObjectGeneration, binding generation; SessionRid is the
+    // record's own). The transport boundary has already authenticated the
+    // source peer, and the header's route fields are not compared here.
+    if (payloadFrame === undefined) return 'protocolError';
     const delivery = this.sessionDeliveries.get(actorKey(record.actor.actor));
     if (
       delivery === undefined ||
-      delivery.binding.bindingGeneration !== record.expectedBindingGeneration ||
-      payloadFrame === undefined ||
-      ingress.sourceNodeGeneration === undefined ||
-      !routingIdsEqual(ingress.sourceRoutingId, record.actor.actor.nodeRid) ||
-      ingress.sourceNodeGeneration !== record.actor.targetNodeGeneration
+      delivery.binding.bindingGeneration !== record.expectedBindingGeneration
     ) {
+      this.traceRejectedBoundSessionSend(ingress, record, payloadFrame);
       return 'protocolError';
     }
     const sessionRid = delivery.binding.sessionRid;
-    let retainedPayload: Uint8Array | undefined = payloadFrame;
-    let settled = false;
-    const settle = () => {
-      if (settled) return false;
-      settled = true;
-      retainedPayload = undefined;
-      return true;
-    };
-    const operation = {
-      deliver: async () => {
-        if (settled || retainedPayload === undefined) return false;
-        const delivered = await delivery.deliver(sessionRid, retainedPayload);
-        if (delivered) settle();
-        return delivered;
-      },
-      fail: (_error: unknown) => {
-        settle();
-      }
-    };
-    const decision = await delivery.bindingIngress?.retainOutbound(
-      {
-        actorId: record.actor.actor.actorId,
-        objectGeneration: record.actor.actor.generation,
-        actorNodeRid: record.actor.actor.nodeRid,
-        actorNodeGeneration: record.actor.targetNodeGeneration,
-        authorityOwnerGeneration: record.actor.authorityOwnerGeneration,
-        ownerLeaseGeneration: record.actor.ownerLeaseGeneration,
-        producerNodeRid: ingress.sourceRoutingId,
-        producerNodeGeneration: ingress.sourceNodeGeneration,
-        sessionIdentity: sessionRid,
-        bindingGeneration: record.expectedBindingGeneration
-      },
-      operation
-    );
-    if (decision === 'retained') return 'application';
-    if (decision === 'rejected') {
-      return 'protocolError';
-    }
     try {
-      const delivered = await delivery.deliver(sessionRid, retainedPayload);
-      settle();
+      const delivered = await delivery.deliver(sessionRid, payloadFrame);
       if (!delivered) return 'protocolError';
     } catch (error) {
-      operation.fail(error);
       // Remote command 36 is one-way: its source transport admission has
       // already completed, so a later client delivery terminal is local to
       // this session owner. Local fast paths still preserve the typed result.
@@ -3698,6 +3782,37 @@ export class ServiceStatefulRuntime {
     return 'application';
   }
 
+  //  Session–Actor binding §3 item 4: a push refused as not current is
+  //  recorded with the closed flow vocabulary (dropped, stream_session, send,
+  //  stale_target) instead of disappearing. Nothing is built while tracing is
+  //  off.
+  private traceRejectedBoundSessionSend(
+    ingress: RawServiceIngressRecord,
+    record: Extract<ServiceStatefulWireRecord, { readonly kind: 'boundSessionSend' }>,
+    payloadFrame: Uint8Array
+  ): void {
+    const tracePoint = flowIfEnabled(this.dispatchErrors?.flow, ZLinkMessageFlowOutcome.Dropped);
+    if (tracePoint === undefined) return;
+    let packetName: string | undefined;
+    try {
+      packetName = decodeApplicationPayloadView(payloadFrame).packetName;
+    } catch (error) {
+      // A malformed payload is still a refused push; it is traced without a
+      // packet name.
+      if (!(error instanceof ServiceWireProtocolError)) throw error;
+    }
+    tracePoint.trace({
+      outcome: ZLinkMessageFlowOutcome.Dropped,
+      surface: ZLinkDispatchErrorSurface.StreamSession,
+      messageKind: ZLinkDispatchMessageKind.Send,
+      ...(packetName === undefined ? {} : { packetName }),
+      ...(this.dispatchErrorMeshName === undefined ? {} : { meshName: this.dispatchErrorMeshName }),
+      sourceRid: ingress.sourceRoutingId,
+      actorId: record.actor.actor.actorId,
+      errorReason: ZLinkDispatchErrorReason.StaleTarget
+    });
+  }
+
   private enqueueApplicationFrame(
     ingress: RawServiceIngressRecord,
     owner: string,
@@ -3826,7 +3941,13 @@ export class ServiceStatefulRuntime {
     control: ActorControlPayload,
     onTerminalCompletion?: () => void | Promise<void>
   ): void {
-    const header = Buffer.from([0x5a, 0x4d, 1, M6bServiceWireCommand.actorJoined, 0]);
+    const header = Buffer.from([
+      SERVICE_WIRE_MAGIC[0],
+      SERVICE_WIRE_MAGIC[1],
+      SERVICE_WIRE_MAJOR,
+      M6bServiceWireCommand.actorJoined,
+      0
+    ]);
     let terminalAttempted = false;
     void (async () => {
       const applicationJobOwner = await this.raw.reserveLocalIngress();
@@ -3872,7 +3993,13 @@ export class ServiceStatefulRuntime {
   ): boolean {
     const actor = binding.actor;
     const sessionOwner = requireSessionOwnerIdentity(binding);
-    const header = Buffer.from([0x5a, 0x4d, 1, M6bServiceWireCommand.boundSessionBind, 0]);
+    const header = Buffer.from([
+      SERVICE_WIRE_MAGIC[0],
+      SERVICE_WIRE_MAGIC[1],
+      SERVICE_WIRE_MAJOR,
+      M6bServiceWireCommand.boundSessionBind,
+      0
+    ]);
     const applicationJob = requireApplicationJobOwner(ingress).takeInitial('infrastructure');
     const accepted = this.raw.mailbox.tryEnqueue({
       owner: `actor:${actor.actorId}\0${actor.generation}`,
@@ -4046,7 +4173,7 @@ export class ServiceStatefulRuntime {
     handler: ServiceUserSpotOperationHandler,
     record: ServiceUserSpotCreateRecord | ServiceUserSpotCloseRecord | ServiceActorCreateRecord
   ): Promise<ServiceUserSpotOperationResult> {
-    const deadline = userSpotDeadline(record.deadlineUnixMs);
+    const deadline = operationDeadline(record.deadlineUnixMs);
     try {
       const result =
         record.kind === 'userSpotCreate'
@@ -4150,7 +4277,10 @@ export class ServiceStatefulRuntime {
           stop.signal.throwIfAborted();
           if (!durableRequestCanReplay(error)) throw error;
           if (durableRequestWasAdmitted(error)) wasAdmitted = true;
-          const retryDelayMs = Math.min(20, deadlineMs - performance.now());
+          const retryDelayMs = Math.min(
+            STATEFUL_OPERATION_RETRY_TICK_MS,
+            deadlineMs - performance.now()
+          );
           if (retryDelayMs <= 0) {
             throw durableOperationExhausted(operationKind, wasAdmitted, error);
           }
@@ -4201,8 +4331,8 @@ export class ServiceStatefulRuntime {
         const applicationJobOwner = await this.raw.reserveLocalIngress();
         try {
           const result = await this.ingress({
-            command: header[3]!,
-            flags: header[4]!,
+            command: header[SERVICE_WIRE_COMMAND_OFFSET]!,
+            flags: header[SERVICE_WIRE_FLAGS_OFFSET]!,
             sourceRoutingId: this.nodeRid,
             requestSequence,
             reply: finish,
@@ -4239,8 +4369,8 @@ export class ServiceStatefulRuntime {
         void ServiceStatefulRuntime.detachedIngressScope(async () => {
           try {
             await this.ingress({
-              command: parts[0]![3]!,
-              flags: parts[0]![4]!,
+              command: parts[0]![SERVICE_WIRE_COMMAND_OFFSET]!,
+              flags: parts[0]![SERVICE_WIRE_FLAGS_OFFSET]!,
               sourceRoutingId: this.nodeRid,
               sourceNodeGeneration: this.nodeGeneration,
               parts,
@@ -4258,8 +4388,8 @@ export class ServiceStatefulRuntime {
       }
       try {
         const result = await this.ingress({
-          command: parts[0]![3]!,
-          flags: parts[0]![4]!,
+          command: parts[0]![SERVICE_WIRE_COMMAND_OFFSET]!,
+          flags: parts[0]![SERVICE_WIRE_FLAGS_OFFSET]!,
           sourceRoutingId: this.nodeRid,
           sourceNodeGeneration: this.nodeGeneration,
           parts,
@@ -4300,18 +4430,30 @@ export class ServiceStatefulRuntime {
   ): void {
     if (targetNodeRid === this.nodeRid) {
       const deadlineUnixMs = BigInt(Date.now() + Math.max(0, timeoutMs));
+      const capacityStop = new AbortController();
+      void pending.promise.then(
+        () => capacityStop.abort(),
+        () => capacityStop.abort()
+      );
       void (async () => {
-        const applicationJobOwner = await this.raw.reserveLocalIngress();
-        const localIngress: RawServiceIngressRecord = {
-          command: parts[0]![3]!,
-          flags: parts[0]![4]!,
-          sourceRoutingId: this.nodeRid,
-          requestSequence: pending.id,
-          parts,
-          applicationJobOwner
-        };
+        const applicationJobOwner = await this.raw.reserveLocalIngress(capacityStop.signal);
         try {
-          this.submitLocalRequest(localIngress, pending, operationKind, actor, deadlineUnixMs);
+          if (!this.operations.isPending(pending.id)) return;
+          const localIngress: RawServiceIngressRecord = {
+            command: parts[0]![SERVICE_WIRE_COMMAND_OFFSET]!,
+            flags: parts[0]![SERVICE_WIRE_FLAGS_OFFSET]!,
+            sourceRoutingId: this.nodeRid,
+            requestSequence: pending.id,
+            parts,
+            applicationJobOwner
+          };
+          await this.submitLocalRequest(
+            localIngress,
+            pending,
+            operationKind,
+            actor,
+            deadlineUnixMs
+          );
         } catch (error) {
           this.operations.reply(pending.id, failure(error));
         } finally {
@@ -4340,10 +4482,10 @@ export class ServiceStatefulRuntime {
         ? this.tryActorFence(actor)
         : this.acceptCanonicalActorFence(actor, canonical.actorFence);
     if (target === undefined || actorRoute === undefined) {
-      this.operations.reply(pending.id, {
-        terminalResult: RequestResult.NotFound,
-        failureCode: ACTOR_ROUTE_STALE
-      });
+      this.operations.reply(
+        pending.id,
+        internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.ActorLocationStale)
+      );
       return;
     }
     if (canonical !== undefined) {
@@ -4412,7 +4554,7 @@ export class ServiceStatefulRuntime {
     );
   }
 
-  private submitLocalRequest(
+  private async submitLocalRequest(
     ingress: RawServiceIngressRecord,
     pending: ServiceStatefulPendingOperation,
     operationKind:
@@ -4426,7 +4568,7 @@ export class ServiceStatefulRuntime {
       | 'instanceSpotRequest',
     actor?: ServiceActorRef,
     deadlineUnixMs?: bigint
-  ): void {
+  ): Promise<void> {
     const canonicalActorJoin =
       operationKind === 'actorJoin' ? decodeActorJoin28(ingress.parts) : undefined;
     const decoded =
@@ -4502,7 +4644,9 @@ export class ServiceStatefulRuntime {
           operationKind: OperationKind.ActorRequest,
           correlation: decoded.correlation,
           targetActor: current.ref,
-          ...(decoded.sourceActor === undefined ? {} : { sourceActor: decoded.sourceActor }),
+          ...(decoded.sourceActor === undefined
+            ? {}
+            : { sourceActor: { ...decoded.sourceActor, nodeRid: ingress.sourceRoutingId } }),
           ...(decoded.boundSession === undefined
             ? {}
             : { sourceBindingGeneration: decoded.boundSession.bindingGeneration }),
@@ -4801,7 +4945,16 @@ export class ServiceStatefulRuntime {
     return spot;
   }
 
-  private validateDirectSpotFence(fence: ServiceDirectSpotRouteFence): ServiceSpotState {
+  private validateDirectSpotFence(fence: ServiceSpotRouteFence): ServiceSpotState {
+    if (
+      fence.targetNodeRid !== this.nodeRid ||
+      fence.targetNodeGeneration !== this.nodeGeneration
+    ) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.SpotMoving,
+        `Spot '${fence.spot.spotId}' targets an unavailable owner route.`
+      );
+    }
     const spot = this.registry.spot(fence.spot.spotId);
     if (spot === undefined) {
       throw createInternalFrameworkException(
@@ -4815,15 +4968,6 @@ export class ServiceStatefulRuntime {
         `Spot '${fence.spot.spotId}' is not Ready.`
       );
     }
-    if (
-      fence.targetNodeRid !== this.nodeRid ||
-      fence.targetNodeGeneration !== this.nodeGeneration
-    ) {
-      throw createInternalFrameworkException(
-        ZLinkFrameworkInternalErrorKind.SpotMoving,
-        `Spot '${fence.spot.spotId}' targets an unavailable owner route.`
-      );
-    }
     if (spot.kind === 'entry') {
       if (!isEntrySpotFence(fence)) {
         throw createInternalFrameworkException(
@@ -4860,7 +5004,7 @@ export class ServiceStatefulRuntime {
     wire: Extract<ServiceStatefulWireRecord, { readonly kind: 'spotSend' | 'spotRequest' }>
   ): RawServicePumpResult | undefined {
     const state = this.spotMessageFollow.get(spotKey(wire.target.spot));
-    if (state === undefined || !sameDirectSpotRoute(state.source, wire.target)) {
+    if (state === undefined || !sameDirectSpotRouteIdentity(state.source, wire.target)) {
       return undefined;
     }
     if (state.expiresAtMs !== undefined && state.expiresAtMs <= performance.now()) {
@@ -4912,14 +5056,22 @@ export class ServiceStatefulRuntime {
         }
         const current = this.peekSpotMessageFollow(state)!;
         try {
+          const metadata =
+            (current.ingress.parts[0]![SERVICE_WIRE_FLAGS_OFFSET]! &
+              M6bServiceWireFlag.metadata) !==
+            0;
           const parts = [
             encodeSpotHeader(
               current.wire.kind,
               current.wire.sourceSpotId,
               state.target,
-              current.wire.correlation!
+              current.wire.correlation,
+              current.wire.operation,
+              current.wire.messageFollowHopCount + 1,
+              metadata ? current.ingress.parts[1] : undefined
             ),
-            current.ingress.parts[1]!
+            ...(metadata ? [current.ingress.parts[1]!] : []),
+            current.ingress.parts[metadata ? 2 : 1]!
           ];
           if (current.wire.kind === 'spotSend') {
             if (!(await this.raw.sendService(state.target.targetNodeRid, parts))) continue;
@@ -5046,7 +5198,7 @@ export class ServiceStatefulRuntime {
     if (state.queuedCount === 0) {
       state.queued.length = 0;
       state.queuedHead = 0;
-    } else if (state.queuedHead >= 1024 && state.queuedHead * 2 >= state.queued.length) {
+    } else if (shouldCompactBackingArray(state.queuedHead, state.queued.length)) {
       state.queued.splice(0, state.queuedHead);
       state.queuedHead = 0;
     }
@@ -5058,34 +5210,6 @@ export class ServiceStatefulRuntime {
     return route;
   }
 
-  private tryBoundSessionSendFence(
-    actor: ServiceActorRef,
-    senderFence: ServiceBoundSessionSendFence | undefined
-  ): ServiceActorRouteFence | undefined {
-    if (
-      senderFence === undefined ||
-      senderFence.targetNodeGeneration !== this.nodeGeneration ||
-      senderFence.authorityOwnerGeneration <= 0n ||
-      senderFence.ownerLeaseGeneration <= 0n
-    ) {
-      return undefined;
-    }
-    const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
-    if (
-      local === undefined ||
-      !sameActorRef(local.ref, actor) ||
-      local.authorityOwnerGeneration !== senderFence.authorityOwnerGeneration
-    ) {
-      return undefined;
-    }
-    return {
-      actor,
-      targetNodeGeneration: senderFence.targetNodeGeneration,
-      authorityOwnerGeneration: senderFence.authorityOwnerGeneration,
-      ownerLeaseGeneration: senderFence.ownerLeaseGeneration
-    };
-  }
-
   private tryActorFence(actor: ServiceActorRef): ServiceActorRouteFence | undefined {
     const local = actor.nodeRid === this.nodeRid ? this.registry.actor(actor.actorId) : undefined;
     if (local !== undefined && sameActorRef(local.ref, actor)) {
@@ -5295,48 +5419,32 @@ export class ServiceStatefulRuntime {
   }
 }
 
-function serviceSpotPublishFailureReason(
-  result: number | undefined,
-  routeReady: boolean,
-  closed: boolean
-): 'stale_target' | 'backpressure' | 'shutdown' {
-  if (closed || result === SubmitResult.Terminated) return 'shutdown';
-  switch (result) {
-    case SubmitResult.Backpressured:
-      return 'backpressure';
-    case SubmitResult.NotAdmitted:
-    case SubmitResult.NotConnected:
-    case SubmitResult.NotFound:
-    case SubmitResult.InvalidHandle:
-      return 'stale_target';
-    default:
-      // RawServiceMeshRuntime exposes failed Core submissions as false. A
-      // ready route therefore identifies queue admission failure; a route
-      // that became unready after selection is a stale target.
-      return routeReady ? 'backpressure' : 'stale_target';
-  }
-}
-
-function isEntrySpotFence(fence: ServiceDirectSpotRouteFence): boolean {
+function isEntrySpotFence(fence: ServiceSpotRouteFence): boolean {
   return (
     fence.spot.spotId === fence.targetNodeRid &&
     fence.spot.generation === fence.targetNodeGeneration &&
     fence.authorityOwnerGeneration === fence.targetNodeGeneration &&
-    fence.ownerLeaseGeneration === fence.targetNodeGeneration &&
-    fence.storeVersion === `entry:${fence.targetNodeGeneration}`
+    fence.ownerLeaseGeneration === fence.targetNodeGeneration
   );
 }
 
-function userSpotDeadline(deadlineUnixMs: bigint): {
+function operationDeadline(deadlineUnixMs: bigint): {
   readonly signal: AbortSignal;
   close(): void;
 } {
   const controller = new AbortController();
   const delay = Number(deadlineUnixMs - BigInt(Date.now()));
-  const timeout = setTimeout(
-    () => controller.abort(new Error('User Spot operation deadline exceeded.')),
-    Math.max(0, Math.min(delay, 0x7fff_ffff))
-  );
+  const expire = () =>
+    controller.abort(
+      createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.DeadlineExceeded,
+        'Operation deadline exceeded.'
+      )
+    );
+  const timeout =
+    delay <= 0
+      ? (expire(), undefined)
+      : setTimeout(expire, Math.min(delay, MAX_NODE_TIMER_DELAY_MS));
   return {
     signal: controller.signal,
     close: () => clearTimeout(timeout)
@@ -5417,12 +5525,12 @@ function actorLocation(actor: ServiceActorState): ActorLocation {
 
 function failure(error: unknown): ServiceStatefulResult {
   if (error instanceof ServiceStaleGenerationError) {
-    return { terminalResult: RequestResult.NotFound, failureCode: ACTOR_ROUTE_STALE };
+    return internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.ActorLocationStale);
   }
   if (error instanceof ZLinkFrameworkException) {
     return internalFrameworkWireReply(error);
   }
-  return { terminalResult: RequestResult.InternalError, failureCode: 17 };
+  return internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.RequestFailed);
 }
 
 function actorKey(actor: ServiceActorRef): string {
@@ -5744,15 +5852,15 @@ function sameMessageFollowSpotSource(
 }
 
 function sameDirectSpotRouteIdentity(
-  left: ServiceDirectSpotRouteFence,
-  right: ServiceDirectSpotRouteFence
+  left: ServiceSpotRouteFence,
+  right: ServiceSpotRouteFence
 ): boolean {
   return sameDirectSpotOwnerIdentity(left, right) && left.spot.generation === right.spot.generation;
 }
 
 function sameDirectSpotOwnerIdentity(
-  left: ServiceDirectSpotRouteFence,
-  right: ServiceDirectSpotRouteFence
+  left: ServiceSpotRouteFence,
+  right: ServiceSpotRouteFence
 ): boolean {
   return (
     left.spot.spotId === right.spot.spotId &&
@@ -5815,7 +5923,7 @@ function topicMatches(filter: string, topic: string): boolean {
 function emptyPayload(): ServiceApplicationPayload {
   return {
     packetName: 'ZLinkFrameworkEmpty',
-    contentType: 'application/octet-stream',
+    contentType: ZlinkStreamContentType.Raw,
     payload: Buffer.alloc(0)
   };
 }