@zlink-systems/framework 0.26.0 → 0.27.0

package/src/runtime/streams/actor-session-binding-registry.ts

@@ -1,15 +1,21 @@
+import { AsyncResource } from 'node:async_hooks';
+import {
+  ZLinkFrameworkErrorKind,
+  ZLinkFrameworkException
+} from '../../contracts/Errors/ZLinkFrameworkException';
+import { zlinkDefaultLocationOptions } from '../../contracts/Locations/Options';
+import { createAbortError, throwIfAborted } from '../abort';
+import { ZLinkStateLane } from '../execution/state-lane';
 import {
   ZLinkFrameworkInternalErrorKind,
   createInternalFrameworkException
 } from '../framework-errors-internal';
-import { createAbortError, throwIfAborted } from '../abort';
-import { AsyncResource } from 'node:async_hooks';
-import { ZLinkStateLane } from '../execution/state-lane';
-import type { ServiceSessionBindingAdmissionResult } from '../foundation/service-session-binding-ingress-port';
+export const DEFAULT_TERMINAL_RELOCATION_CAPACITY = 4096;
 
 const detachedStateLaneResource = new AsyncResource('zlink:actor-session-binding-registry');
 export interface ZLinkActorSessionBindingActor {
   readonly actorId: string;
+  readonly ref: { readonly actorId: string; readonly bindingGeneration?: bigint };
 }
 
 export interface ZLinkActorSessionBindingContext<TActor extends ZLinkActorSessionBindingActor> {
@@ -46,11 +52,6 @@ export interface ZLinkActorSessionRelocationClaim {
   readonly sealId: string;
 }
 
-export interface ZLinkActorSessionRetainedOutbound {
-  deliver(): Promise<boolean>;
-  fail(error: unknown): void;
-}
-
 export interface ZLinkActorSessionRelocationSnapshot extends ZLinkActorSessionRelocationClaim {
   readonly phase: 'sealed' | 'applying' | 'applied' | 'terminal';
   readonly applyFingerprint?: string;
@@ -99,22 +100,16 @@ interface ZLinkActorSessionRelocationState {
   readonly resolveTerminal: () => void;
 }
 
-interface ZLinkActorSessionOutboundEntry {
-  readonly sealId?: string;
-  readonly operation: ZLinkActorSessionRetainedOutbound;
-  readonly arrivalOrder: bigint;
-  released: boolean;
-  settled: boolean;
-}
-
 interface ZLinkActorSessionRelocationQueue {
   readonly actorId: string;
   activeSealId?: string;
   readonly seals: Map<string, ZLinkActorSessionRelocationState>;
-  readonly outbound: ZLinkActorSessionOutboundEntry[];
-  nextArrivalOrder: bigint;
-  outboundCount: number;
-  drainPromise?: Promise<void>;
+  readonly ingress: Array<{
+    sealId?: string;
+    readonly deliver: () => Promise<void>;
+    readonly drop: (reason: 'stale_target' | 'target_closed' | 'shutdown', error?: unknown) => void;
+  }>;
+  ingressDrain?: Promise<void>;
 }
 
 export interface ZLinkActorSessionAuthorityFence {
@@ -151,24 +146,20 @@ export class ZLinkActorSessionBindingRegistry<
   private readonly terminalRelocations = new Map<ZLinkActorSessionRelocationState, true>();
 
   constructor(
-    private readonly terminalRelocationCapacity = 4096,
-    private readonly outboundCapacity = 4096,
+    private readonly terminalRelocationCapacity: number = DEFAULT_TERMINAL_RELOCATION_CAPACITY,
     //  Spec 06 — SessionRelocationSealTimeout bounds how long a session
     //  relocation seal may hold ingress (default 3,000 ms, finite only).
     //  Every wait on the seal (accept paths) and on active-frame drain
     //  (the sealing side) must observe that bound; an unbounded wait here
     //  turns a lost control or a lifecycle interlock into a silent stall
     //  (spec 48:205 — transport/deadline limits apply during relocation).
-    private readonly sealWaitTimeoutMs = 3_000,
+    private readonly sealWaitTimeoutMs: number = zlinkDefaultLocationOptions.sessionRelocationSealTimeoutMs,
     private readonly errorSink?: () =>
       { reportRuntimeTaskException(taskName: string, error: unknown): void } | undefined
   ) {
     if (!Number.isSafeInteger(terminalRelocationCapacity) || terminalRelocationCapacity <= 0) {
       throw new RangeError('Session relocation terminal capacity must be a positive safe integer.');
     }
-    if (!Number.isSafeInteger(outboundCapacity) || outboundCapacity <= 0) {
-      throw new RangeError('Session relocation outbound capacity must be a positive safe integer.');
-    }
     if (!Number.isSafeInteger(sealWaitTimeoutMs) || sealWaitTimeoutMs <= 0) {
       throw new RangeError('Session relocation seal timeout must be a positive safe integer.');
     }
@@ -195,7 +186,7 @@ export class ZLinkActorSessionBindingRegistry<
     );
   }
 
-  private async commitCore(
+  private commitCore(
     previous: ZLinkActorSessionRoute<TContext, TActor> | undefined,
     context: TContext,
     actor: TActor,
@@ -203,7 +194,7 @@ export class ZLinkActorSessionBindingRegistry<
     authorityFence?: ZLinkActorSessionAuthorityFence,
     sessionIdentity?: string,
     commitActor?: () => void
-  ): Promise<void> {
+  ): void {
     const current = this.routes.get(actor.actorId);
     if (current !== previous) {
       throw createInternalFrameworkException(
@@ -239,7 +230,24 @@ export class ZLinkActorSessionBindingRegistry<
       }
 
       if (!sameBinding && actorSlot !== undefined) {
-        await context.actorSlotControls!.enqueueBound(actorSlot, actor.actorId);
+        // Session–Actor binding §5-2: `$zlink.actor.bound` enters the ordered
+        // STREAM queue before the slot is published; transport completion is
+        // not awaited inside the state lane (execution gate).
+        void context
+          .actorSlotControls!.enqueueBound(actorSlot, actor.actorId)
+          .catch(async (error) => {
+            this.errorSink?.()?.reportRuntimeTaskException('session actor bound', error);
+            // The client never learned the slot, so the binding ends through
+            // the one unbind path; no `$zlink.actor.unbound` follows.
+            await this.unbind(
+              actor.actorId,
+              context,
+              bindingToken,
+              ZLinkActorSessionBindingTermination.PhysicalDisconnect
+            ).catch((unbindError) =>
+              this.errorSink?.()?.reportRuntimeTaskException('session actor bound', unbindError)
+            );
+          });
       }
     } catch (error) {
       context.unbindLocal(actor.actorId, bindingToken);
@@ -317,7 +325,7 @@ export class ZLinkActorSessionBindingRegistry<
     );
   }
 
-  private async replaceAndReleaseSealCore(
+  private replaceAndReleaseSealCore(
     previous: ZLinkActorSessionRoute<TContext, TActor>,
     context: TContext,
     actor: TActor,
@@ -326,7 +334,7 @@ export class ZLinkActorSessionBindingRegistry<
     authorityFence?: ZLinkActorSessionAuthorityFence,
     sessionIdentity?: string,
     commitActor?: () => void
-  ): Promise<void> {
+  ): void {
     if (previous.sealId !== sealId) {
       throw createInternalFrameworkException(
         ZLinkFrameworkInternalErrorKind.ActorLocationStale,
@@ -337,7 +345,7 @@ export class ZLinkActorSessionBindingRegistry<
     // JavaScript cannot interleave another ingress turn between these two
     // synchronous mutations. The replacement preserves the seal, then the
     // exact release publishes the route to held ingress as one owner turn.
-    await this.commitCore(
+    this.commitCore(
       previous,
       context,
       actor,
@@ -367,6 +375,22 @@ export class ZLinkActorSessionBindingRegistry<
     return await this.lane.run(() => this.routeCore(actorId));
   }
 
+  /** Selects the route only when it is the exact Session binding (§8.1 validation values). */
+  async routeForSessionBinding(
+    actorId: string,
+    sessionRid: string,
+    bindingGeneration?: bigint
+  ): Promise<ZLinkActorSessionRoute<TContext, TActor> | undefined> {
+    return await this.lane.run(() => {
+      const route = this.routeCore(actorId);
+      const generation = route?.actor.ref.bindingGeneration;
+      return route?.sessionIdentity === sessionRid &&
+        (bindingGeneration === undefined || generation === bindingGeneration)
+        ? route
+        : undefined;
+    });
+  }
+
   private routeCore(actorId: string): ZLinkActorSessionRoute<TContext, TActor> | undefined {
     return this.routes.get(actorId);
   }
@@ -399,15 +423,19 @@ export class ZLinkActorSessionBindingRegistry<
     bindingToken: string,
     termination = ZLinkActorSessionBindingTermination.BindingEnd
   ): Promise<void> {
-    await this.lane.run(() => this.unbindCore(actorId, context, bindingToken, termination));
+    const { submission } = await this.lane.run(() => ({
+      submission: this.unbindCore(actorId, context, bindingToken, termination)
+    }));
+    await submission;
   }
 
-  private async unbindCore(
+  /** Fixes the unbind order in the lane; the caller awaits transport completion outside it. */
+  private unbindCore(
     actorId: string,
     context: TContext,
     bindingToken: string,
     termination: ZLinkActorSessionBindingTermination
-  ): Promise<void> {
+  ): Promise<void> | undefined {
     const route = this.routes.get(actorId);
     if (route === undefined || route.context !== context || route.bindingToken !== bindingToken) {
       return;
@@ -422,29 +450,29 @@ export class ZLinkActorSessionBindingRegistry<
       actorId,
       new Error(`Actor '${actorId}' session binding was removed while accepted frames were active.`)
     );
-    this.clearRouteRelocation(
-      actorId,
-      route,
-      new Error(`Actor '${actorId}' session binding was removed.`)
-    );
+    this.clearRouteRelocation(actorId, route);
     if (
       termination === ZLinkActorSessionBindingTermination.BindingEnd &&
       route.actorSlot !== undefined
     ) {
-      await context.actorSlotControls?.enqueueUnbound(route.actorSlot);
+      return context.actorSlotControls?.enqueueUnbound(route.actorSlot);
     }
+    return undefined;
   }
 
   async unbindActor(actorId: string): Promise<void> {
-    await this.lane.run(() => this.unbindActorCore(actorId));
+    const { submission } = await this.lane.run(() => ({
+      submission: this.unbindActorCore(actorId)
+    }));
+    await submission;
   }
 
-  private async unbindActorCore(actorId: string): Promise<void> {
+  private unbindActorCore(actorId: string): Promise<void> | undefined {
     const route = this.routes.get(actorId);
     if (route === undefined) {
-      return;
+      return undefined;
     }
-    await this.unbindCore(
+    return this.unbindCore(
       actorId,
       route.context,
       route.bindingToken,
@@ -456,10 +484,10 @@ export class ZLinkActorSessionBindingRegistry<
     await this.lane.run(() => this.cleanupCore(context));
   }
 
-  private async cleanupCore(context: TContext): Promise<void> {
+  private cleanupCore(context: TContext): void {
     for (const route of [...this.routes.values()]) {
       if (route.context === context) {
-        await this.unbindCore(
+        this.unbindCore(
           route.actor.actorId,
           context,
           route.bindingToken,
@@ -523,6 +551,37 @@ export class ZLinkActorSessionBindingRegistry<
     }
   }
 
+  async acceptOneWay(
+    actorId: string,
+    bindingToken: string,
+    prepare: () => {
+      readonly deliver: () => Promise<void>;
+      readonly drop: (
+        reason: 'stale_target' | 'target_closed' | 'shutdown',
+        error?: unknown
+      ) => void;
+    }
+  ): Promise<boolean> {
+    return await this.lane.run(() => {
+      const route = this.requireRouteCore(actorId);
+      this.requireCurrentTokenCore(actorId, bindingToken);
+      const queue = this.relocations.get(actorId);
+      if (
+        queue === undefined ||
+        (route.sealId === undefined &&
+          queue.ingress.length === 0 &&
+          queue.ingressDrain === undefined)
+      )
+        return false;
+      queue.ingress.push({
+        ...prepare(),
+        sealId: route.sealId
+      });
+      if (route.sealId === undefined) this.startHeldOneWayDrain(actorId, queue);
+      return true;
+    });
+  }
+
   /**
    * Holds Session ingress accepted after a relocation seal until the target
    * route is published and the seal is released. The caller keeps the
@@ -698,6 +757,9 @@ export class ZLinkActorSessionBindingRegistry<
       );
     }
     route.sealId = sealId;
+    if (!this.relocations.has(actorId)) {
+      this.relocations.set(actorId, { actorId, seals: new Map(), ingress: [] });
+    }
     // A pre-seal REQUEST is captured as part of installing command 42. Its
     // Session frame no longer gates the seal; its single submission attempt
     // and terminal continue under the request admission state above.
@@ -770,13 +832,7 @@ export class ZLinkActorSessionBindingRegistry<
       resolveTerminal = resolve;
     });
     const ready = this.waitForActiveFramesCore(claim.actorId, signal);
-    const actorQueue: ZLinkActorSessionRelocationQueue = queue ?? {
-      actorId: claim.actorId,
-      seals: new Map(),
-      outbound: [],
-      nextArrivalOrder: 1n,
-      outboundCount: 0
-    };
+    const actorQueue = this.relocations.get(claim.actorId)!;
     const state: ZLinkActorSessionRelocationState = {
       ...claim,
       phase: 'sealed',
@@ -804,93 +860,6 @@ export class ZLinkActorSessionBindingRegistry<
     return this.relocations.get(actorId)?.seals.get(sealId);
   }
 
-  async retainRelocationOutbound(
-    actorId: string,
-    operation: ZLinkActorSessionRetainedOutbound,
-    sealId?: string
-  ): Promise<ServiceSessionBindingAdmissionResult> {
-    return await this.lane.run(() =>
-      this.retainRelocationOutboundCorePublic(actorId, operation, sealId)
-    );
-  }
-
-  private retainRelocationOutboundCorePublic(
-    actorId: string,
-    operation: ZLinkActorSessionRetainedOutbound,
-    sealId?: string
-  ): ServiceSessionBindingAdmissionResult {
-    if (sealId !== undefined) {
-      const queue = this.relocations.get(actorId);
-      const state = queue?.seals.get(sealId);
-      if (
-        queue === undefined ||
-        state === undefined ||
-        (queue.activeSealId !== sealId &&
-          !(queue.activeSealId === undefined && state.phase === 'terminal'))
-      ) {
-        failRetainedOutbound(
-          operation,
-          new Error(`Actor '${actorId}' Session outbound did not match its exact relocation seal.`)
-        );
-        return 'rejected';
-      }
-    }
-    return this.retainRelocationOutboundCore(actorId, operation);
-  }
-
-  /**
-   * Session–Actor binding §8.1: the Session owner holds a push only while the
-   * binding's relocation seal is open, and keeps it behind earlier held pushes.
-   * Whether the push names the current binding was decided once by the Session
-   * owner's binding record before this call.
-   */
-  private retainRelocationOutboundCore(
-    actorId: string,
-    operation: ZLinkActorSessionRetainedOutbound
-  ): ServiceSessionBindingAdmissionResult {
-    const queue = this.relocations.get(actorId);
-    const state =
-      queue?.activeSealId === undefined ? undefined : queue.seals.get(queue.activeSealId);
-    if (queue === undefined) return 'passThrough';
-    if (state === undefined || state.phase === 'applied' || state.phase === 'terminal') {
-      if (queue.drainPromise === undefined && queue.outbound.length === 0) return 'passThrough';
-      if (!this.reserveOutbound(queue, operation)) return 'rejected';
-      queue.outbound.push({
-        operation,
-        arrivalOrder: queue.nextArrivalOrder++,
-        released: true,
-        settled: false
-      });
-      this.startOutboundDrain(queue);
-      return 'retained';
-    }
-    if (!this.reserveOutbound(queue, operation)) return 'rejected';
-    queue.outbound.push({
-      sealId: state.sealId,
-      operation,
-      arrivalOrder: queue.nextArrivalOrder++,
-      released: false,
-      settled: false
-    });
-    return 'retained';
-  }
-
-  async discardRelocationOutbound(actorId: string, sealId: string, error: unknown): Promise<void> {
-    await this.lane.run(() => this.discardRelocationOutboundCore(actorId, sealId, error));
-  }
-
-  private discardRelocationOutboundCore(actorId: string, sealId: string, error: unknown): void {
-    const queue = this.relocations.get(actorId);
-    if (queue === undefined) return;
-    for (let index = queue.outbound.length - 1; index >= 0; index--) {
-      const entry = queue.outbound[index]!;
-      if (entry.sealId !== sealId) continue;
-      queue.outbound.splice(index, 1);
-      this.failOutbound(queue, entry, error);
-    }
-    this.deleteEmptyRelocationQueue(queue);
-  }
-
   async applyRelocation(
     actorId: string,
     sealId: string,
@@ -924,13 +893,11 @@ export class ZLinkActorSessionBindingRegistry<
     sealId: string,
     applyFingerprint: string
   ): {
-    readonly queue: ZLinkActorSessionRelocationQueue;
     readonly state: ZLinkActorSessionRelocationState;
     readonly applyPromise?: Promise<void>;
     readonly promise?: Promise<void>;
     readonly resolve?: () => void;
     readonly reject?: (error: unknown) => void;
-    readonly sealId?: string;
   } {
     const queue = this.relocations.get(actorId);
     const state = queue?.seals.get(sealId);
@@ -949,7 +916,7 @@ export class ZLinkActorSessionBindingRegistry<
           true
         );
       }
-      return { queue, state, applyPromise: state.applyPromise };
+      return { state, applyPromise: state.applyPromise };
     }
 
     state.phase = 'applying';
@@ -962,31 +929,17 @@ export class ZLinkActorSessionBindingRegistry<
     });
     state.applyPromise = promise;
     return {
-      queue,
       state,
       promise,
       resolve,
-      reject,
-      sealId
+      reject
     };
   }
 
-  /**
-   * Command 44 commit or abort releases every push held under this seal in
-   * arrival order (Session–Actor binding §8.1). The held pushes were admitted
-   * by the current binding; the route change does not judge them again.
-   */
   private completeRelocationApply(prepared: {
-    readonly queue: ZLinkActorSessionRelocationQueue;
     readonly state: ZLinkActorSessionRelocationState;
-    readonly sealId?: string;
   }): void {
-    const { queue, state, sealId } = prepared;
-    for (const entry of queue.outbound) {
-      if (entry.sealId === sealId) entry.released = true;
-    }
-    this.startOutboundDrain(queue);
-    state.phase = 'applied';
+    prepared.state.phase = 'applied';
   }
 
   private failRelocationApply(prepared: {
@@ -1038,7 +991,7 @@ export class ZLinkActorSessionBindingRegistry<
 
   /**
    * Actor-wide relocation teardown: every seal (active and terminal-retained)
-   * and every held outbound entry for `actorId` is discarded unconditionally.
+   * for `actorId` is discarded unconditionally.
    * Reserved for paths where the Actor itself is gone or being torn down
    * (destroy, ownership clear, relocation-seal expiry/failure) — never for a
    * single physical route's disconnect, which must not disturb a relocation
@@ -1051,8 +1004,18 @@ export class ZLinkActorSessionBindingRegistry<
   private clearRelocationCore(actorId: string, error: unknown): void {
     const queue = this.relocations.get(actorId);
     if (queue === undefined) return;
+    this.rejectSealWaiters(
+      actorId,
+      error,
+      error instanceof ZLinkFrameworkException &&
+        error.kind === ZLinkFrameworkErrorKind.DeadlineExceeded
+        ? 'target_closed'
+        : error instanceof ZLinkFrameworkException &&
+            error.kind === ZLinkFrameworkErrorKind.ShuttingDown
+          ? 'shutdown'
+          : 'stale_target'
+    );
     this.relocations.delete(actorId);
-    for (const entry of queue.outbound.splice(0)) this.failOutbound(queue, entry, error);
     for (const state of queue.seals.values()) {
       this.terminalRelocations.delete(state);
       if (state.phase !== 'terminal') state.resolveTerminal();
@@ -1063,7 +1026,7 @@ export class ZLinkActorSessionBindingRegistry<
    * Spec 48 §137: a relocation seal's lifecycle is independent of any single
    * physical route's binding. Unbinding one physical route (a disconnect)
    * must retire only the still-open (nonterminal) relocation seal that this
-   * exact route's Session owns, and the outbound held against that seal — it
+   * exact route's Session owns — it
    * must never reach into a seal that has already reached 'terminal' (its
    * bounded retention exists precisely so a late same-seal relay can still
    * pass on a successor route) nor into a different Session's active seal
@@ -1072,8 +1035,7 @@ export class ZLinkActorSessionBindingRegistry<
    */
   private clearRouteRelocation(
     actorId: string,
-    route: ZLinkActorSessionRoute<TContext, TActor>,
-    error: unknown
+    route: ZLinkActorSessionRoute<TContext, TActor>
   ): void {
     const queue = this.relocations.get(actorId);
     if (queue === undefined) return;
@@ -1089,12 +1051,6 @@ export class ZLinkActorSessionBindingRegistry<
       this.deleteEmptyRelocationQueue(queue);
       return;
     }
-    for (let index = queue.outbound.length - 1; index >= 0; index--) {
-      const entry = queue.outbound[index]!;
-      if (entry.sealId !== activeSealId) continue;
-      queue.outbound.splice(index, 1);
-      this.failOutbound(queue, entry, error);
-    }
     queue.activeSealId = undefined;
     queue.seals.delete(activeSealId!);
     this.terminalRelocations.delete(activeState);
@@ -1303,90 +1259,6 @@ export class ZLinkActorSessionBindingRegistry<
     for (const waiter of waiters) waiter.reject(error);
   }
 
-  private startOutboundDrain(queue: ZLinkActorSessionRelocationQueue): void {
-    if (queue.drainPromise !== undefined) return;
-    const drain = startOutsideStateLane(async () => {
-      for (;;) {
-        const entry = await this.lane.run(() => {
-          const current = queue.outbound.at(0);
-          if (current === undefined || !current.released) return undefined;
-          if (current.settled) {
-            queue.outbound.shift();
-            return null;
-          }
-          return current;
-        });
-        if (entry === undefined) return;
-        if (entry === null) continue;
-        try {
-          const delivered = await entry.operation.deliver();
-          await this.lane.run(() => {
-            if (delivered) this.settleOutbound(queue, entry);
-            else
-              this.failOutbound(
-                queue,
-                entry,
-                new Error(
-                  `Actor '${queue.actorId}' retained Session outbound delivery was rejected.`
-                )
-              );
-            if (queue.outbound[0] === entry) queue.outbound.shift();
-          });
-        } catch (error) {
-          await this.lane.run(() => {
-            this.failOutbound(queue, entry, error);
-            if (queue.outbound[0] === entry) queue.outbound.shift();
-          });
-        }
-      }
-    });
-    startOutsideStateLane(() => {
-      void drain.finally(
-        async () =>
-          await this.lane.run(() => {
-            if (queue.drainPromise === drain) queue.drainPromise = undefined;
-            if (queue.outbound[0]?.released === true) this.startOutboundDrain(queue);
-            else this.deleteEmptyRelocationQueue(queue);
-          })
-      );
-    });
-    queue.drainPromise = drain;
-  }
-
-  private reserveOutbound(
-    queue: ZLinkActorSessionRelocationQueue,
-    operation: ZLinkActorSessionRetainedOutbound
-  ): boolean {
-    if (queue.outboundCount < this.outboundCapacity) {
-      queue.outboundCount++;
-      return true;
-    }
-    failRetainedOutbound(
-      operation,
-      new Error(`Actor '${queue.actorId}' Session relocation outbound capacity was exhausted.`)
-    );
-    return false;
-  }
-
-  private settleOutbound(
-    queue: ZLinkActorSessionRelocationQueue,
-    entry: ZLinkActorSessionOutboundEntry
-  ): void {
-    if (entry.settled) return;
-    entry.settled = true;
-    queue.outboundCount--;
-  }
-
-  private failOutbound(
-    queue: ZLinkActorSessionRelocationQueue,
-    entry: ZLinkActorSessionOutboundEntry,
-    error: unknown
-  ): void {
-    if (entry.settled) return;
-    this.settleOutbound(queue, entry);
-    failRetainedOutbound(entry.operation, error);
-  }
-
   private rememberTerminalRelocation(state: ZLinkActorSessionRelocationState): void {
     this.terminalRelocations.delete(state);
     this.terminalRelocations.set(state, true);
@@ -1407,27 +1279,74 @@ export class ZLinkActorSessionBindingRegistry<
     if (
       queue.activeSealId === undefined &&
       queue.seals.size === 0 &&
-      queue.outbound.length === 0 &&
-      queue.drainPromise === undefined &&
+      queue.ingress.length === 0 &&
+      queue.ingressDrain === undefined &&
       this.relocations.get(queue.actorId) === queue
     ) {
       this.relocations.delete(queue.actorId);
     }
   }
 
-  private resolveSealWaiters(actorId: string, _sealId: string): void {
+  private resolveSealWaiters(actorId: string, sealId: string): void {
+    const queue = this.relocations.get(actorId);
+    if (queue !== undefined) {
+      for (const entry of queue.ingress) {
+        if (entry.sealId === sealId) entry.sealId = undefined;
+      }
+      this.startHeldOneWayDrain(actorId, queue);
+    }
     const waiters = this.sealWaiters.get(actorId);
     if (waiters === undefined) return;
     this.sealWaiters.delete(actorId);
     for (const waiter of waiters) waiter.resolve();
   }
 
-  private rejectSealWaiters(actorId: string, error: unknown): void {
+  private rejectSealWaiters(
+    actorId: string,
+    error: unknown,
+    reason: 'stale_target' | 'target_closed' | 'shutdown' = 'target_closed'
+  ): void {
+    const queue = this.relocations.get(actorId);
+    if (queue !== undefined) {
+      for (const delivery of queue.ingress.splice(0)) delivery.drop(reason, error);
+    }
     const waiters = this.sealWaiters.get(actorId);
     if (waiters === undefined) return;
     this.sealWaiters.delete(actorId);
     for (const waiter of waiters) waiter.reject(error);
   }
+
+  private startHeldOneWayDrain(actorId: string, queue: ZLinkActorSessionRelocationQueue): void {
+    if (queue.ingressDrain !== undefined) return;
+    const drain = startOutsideStateLane(async () => {
+      for (;;) {
+        const next = await this.lane.run(() => {
+          if (this.relocations.get(actorId) !== queue) return undefined;
+          const first = queue.ingress.at(0);
+          if (first === undefined || first.sealId !== undefined) return undefined;
+          return queue.ingress.shift();
+        });
+        if (next === undefined) return;
+        try {
+          await next.deliver();
+        } catch (error) {
+          next.drop('stale_target', error);
+        }
+      }
+    });
+    queue.ingressDrain = drain;
+    startOutsideStateLane(() => {
+      void drain.finally(async () => {
+        await this.lane.run(() => {
+          if (queue.ingressDrain !== drain) return;
+          queue.ingressDrain = undefined;
+          if (queue.ingress.at(0)?.sealId === undefined && queue.ingress.length > 0)
+            this.startHeldOneWayDrain(actorId, queue);
+          else this.deleteEmptyRelocationQueue(queue);
+        });
+      });
+    });
+  }
 }
 
 function assertRelocationClaim(
@@ -1453,15 +1372,6 @@ function startOutsideStateLane<T>(work: () => T): T {
   return detachedStateLaneResource.runInAsyncScope(work);
 }
 
-function failRetainedOutbound(operation: ZLinkActorSessionRetainedOutbound, error: unknown): void {
-  try {
-    operation.fail(error);
-  } catch {
-    // The aggregate has already removed the entry. A failure observer cannot
-    // retain or settle the same delivery a second time.
-  }
-}
-
 function assertSuccessorSessionIdentity(
   predecessor: ZLinkActorSessionRelocationState,
   successor: ZLinkActorSessionRelocationClaim