@zlink-systems/framework 0.26.0 → 0.28.0

package/src/runtime/host/spot-node-runtime-options-factory.ts

@@ -51,7 +51,8 @@ export interface ZLinkSpotNodeRuntimeOptionsFactoryOptions {
 export class ZLinkSpotNodeRuntimeOptionsFactory {
   constructor(private readonly options: ZLinkSpotNodeRuntimeOptionsFactoryOptions) {}
 
-  create(): ZLinkSpotNodeRuntimeManagerOptions {
+  create(): Omit<ZLinkSpotNodeRuntimeManagerOptions, 'errorSink'> {
+    const spotRouterChannelIdForMesh = this.options.meshRouters.spotRouterChannelIdByMesh();
     return {
       registration: this.options.registration,
       primaryMeshName: this.options.meshRouters.primaryMeshName(),
@@ -59,7 +60,9 @@ export class ZLinkSpotNodeRuntimeOptionsFactory {
       context: this.options.context,
       channelClient: new DefaultZLinkChannelClient(
         this.options.registration,
-        this.options.channelTransport
+        this.options.channelTransport,
+        this.options.routeTransport,
+        spotRouterChannelIdForMesh
       ),
       fanoutClient: new DefaultZLinkFanoutClient(
         this.options.registration,
@@ -70,7 +73,7 @@ export class ZLinkSpotNodeRuntimeOptionsFactory {
         this.options.spotPublisherTransport
       ),
       routedTransport: this.options.routeTransport,
-      spotRouterChannelIdForMesh: this.options.meshRouters.spotRouterChannelIdByMesh(),
+      spotRouterChannelIdForMesh,
       providerResolver: this.options.providerResolver,
       dispatchErrors: this.options.dispatchErrors,
       runtimeEventPublisher: this.options.runtimeEventPublisher,

package/src/runtime/host/spot-runtime-options-factory.ts

@@ -51,18 +51,24 @@ export interface ZLinkSpotRuntimeOptionsFactoryOptions {
     meshName: string,
     spotId: string,
     onCommitted: () => void
-  ) => Promise<{ release(): Promise<void> } | undefined>;
+  ) => Promise<
+    import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+  >;
   readonly beginInstanceClosingAuthority: (
     meshName: string,
     spotId: string,
     onCommitted: () => void
-  ) => Promise<{ release(): Promise<void> } | undefined>;
+  ) => Promise<
+    import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+  >;
   readonly beginUserClosingAuthority: (
     meshName: string,
     spotId: string,
     objectGeneration: bigint,
     onCommitted: () => void
-  ) => Promise<{ release(): Promise<void> } | undefined>;
+  ) => Promise<
+    import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+  >;
   readonly createLocationSpotRouteResolver: () => ZLinkSpotRouteResolver | undefined;
   readonly boundSessionRelay: ZLinkBoundSessionRelay;
   readonly actorHandoff: ZLinkActorHandoffCoordinator;
@@ -71,13 +77,14 @@ export interface ZLinkSpotRuntimeOptionsFactoryOptions {
   readonly detachedTaskRunner: ZLinkDetachedTaskRunner;
   readonly metrics: import('../diagnostics').ZLinkRuntimeMetrics;
   readonly admission: ZLinkRuntimeAdmissionGate;
-  readonly statefulExecutionAllowed: () => boolean;
+  readonly statefulExecution: NonNullable<ZLinkSpotManagerOptions['statefulExecution']>;
 }
 
 export class ZLinkSpotRuntimeOptionsFactory {
   constructor(private readonly options: ZLinkSpotRuntimeOptionsFactoryOptions) {}
 
   create(actorTransferRuntime: ZLinkActorTransferRuntime): Partial<ZLinkSpotManagerOptions> {
+    const spotRouterChannelIdForMesh = this.options.meshRouters.spotRouterChannelIdByMesh();
     return {
       nodeRid: undefined,
       nodeRidProvider: (meshName) => this.meshNodeRoutingId(meshName),
@@ -128,9 +135,20 @@ export class ZLinkSpotRuntimeOptionsFactory {
         }
         await runtime.dispatchEntryActorJoin(meshName, actor, handoffBacklog);
       },
+      executeEntryActor: (meshName, actorId, operation) => {
+        const runtime = this.options.spotNodeRuntime();
+        if (runtime === undefined) {
+          throw new ZLinkConfigurationException(
+            'Entry Spot Actor completion requires the MeshNode runtime.'
+          );
+        }
+        return runtime.executeEntryActor(meshName, actorId, operation);
+      },
       channelClient: new DefaultZLinkChannelClient(
         this.options.registration,
-        this.options.channelTransport
+        this.options.channelTransport,
+        this.options.routeTransport,
+        spotRouterChannelIdForMesh
       ),
       fanoutClient: new DefaultZLinkFanoutClient(
         this.options.registration,
@@ -142,15 +160,7 @@ export class ZLinkSpotRuntimeOptionsFactory {
       ),
       routedTransport: this.options.routeTransport,
       addressTransport: this.options.addressTransport,
-      spotRouterChannelIdForMesh: this.options.meshRouters.spotRouterChannelIdByMesh(),
-      channelMeshNameForChannel: (channelName) => {
-        const matches = [...this.options.registration.spotNodes.entries()]
-          .filter(([, node]) =>
-            Object.prototype.hasOwnProperty.call(node.meshChannels ?? {}, channelName)
-          )
-          .map(([meshName]) => meshName);
-        return matches.length === 1 ? matches[0] : undefined;
-      },
+      spotRouterChannelIdForMesh,
       messageSerializers: this.options.registration.messageSerializers,
       runtimeEventPublisher: this.options.runtimeEventPublisher,
       detachedTaskRunner: this.options.detachedTaskRunner,
@@ -159,8 +169,54 @@ export class ZLinkSpotRuntimeOptionsFactory {
         this.options.releaseInstanceAuthority(meshName, String(spotId), objectGeneration),
       beginInstanceIdleClosingAuthority: (meshName, spotId, onCommitted) =>
         this.options.beginInstanceIdleClosingAuthority(meshName, String(spotId), onCommitted),
-      beginInstanceClosingAuthority: (meshName, spotId, onCommitted) =>
-        this.options.beginInstanceClosingAuthority(meshName, String(spotId), onCommitted),
+      beginInstanceClosingAuthority: async (meshName, spotId, onCommitted, objectGeneration) => {
+        const authority = await this.options.beginInstanceClosingAuthority(
+          meshName,
+          String(spotId),
+          onCommitted
+        );
+        if (authority === undefined) return undefined;
+        // A Close without Reincarnate ends this incarnation. The Instance authority
+        // release also forgets the node's Ready projection, so a request on a cached
+        // Ready route is refused instead of rematerializing the closed generation.
+        const release = () =>
+          this.options.releaseInstanceAuthority(meshName, String(spotId), objectGeneration);
+        if (authority.reincarnate === undefined) return { release };
+        return {
+          release,
+          reincarnate: async (initialize) => {
+            const current = await authority.reincarnate!(initialize);
+            const node = this.options.spotNodeRuntime()?.meshNode(meshName);
+            const route = {
+              targetSpotId: String(spotId),
+              targetNodeRid: String(current.allocation.descriptor.rid),
+              targetNodeGeneration: current.allocation.descriptorLifecycleGeneration,
+              objectGeneration: current.objectGeneration,
+              authorityOwnerGeneration: current.authorityOwnerGeneration,
+              ownerId: current.ownerId,
+              leaseGeneration: current.ownerLeaseGeneration,
+              storeVersion: current.storeVersion.value
+            };
+            node?.restoreSpotAuthority?.(
+              String(spotId),
+              'instance_spot',
+              current.stableType,
+              current.objectGeneration,
+              current.authorityOwnerGeneration
+            );
+            node?.registerInstanceIntent?.(current.stableType, route);
+            node?.rememberSpotRoute?.({
+              spot: { spotId: String(spotId), generation: current.objectGeneration },
+              targetNodeRid: route.targetNodeRid,
+              targetNodeGeneration: route.targetNodeGeneration,
+              authorityOwnerGeneration: route.authorityOwnerGeneration,
+              ownerLeaseGeneration: route.leaseGeneration,
+              storeVersion: route.storeVersion
+            });
+            return current;
+          }
+        };
+      },
       beginUserClosingAuthority: (meshName, spotId, objectGeneration, onCommitted) =>
         this.options.beginUserClosingAuthority(
           meshName,
@@ -274,17 +330,12 @@ export class ZLinkSpotRuntimeOptionsFactory {
           ZLinkSpotRelocationCoordinationMode.FrameworkManaged
         );
       },
-      actorBindingGenerationObserver: (actorId, generation) =>
-        this.options
-          .actorManager()
-          ?.getState(actorId)
-          ?.setBoundSessionBindingGeneration(generation),
       actorTransferRuntime,
       boundSessionRuntime: this.options.boundSessionRelay.boundSessions,
       actorHandoffRuntime: this.options.actorHandoff,
       metrics: this.options.metrics,
       admission: this.options.admission,
-      statefulExecutionAllowed: this.options.statefulExecutionAllowed,
+      statefulExecution: this.options.statefulExecution,
       closeErrorSink: this.options.runtimeOrPreStartErrorSink,
       dispatchErrors: this.options.dispatchErrorReporter(this.options.runtimeOrPreStartErrorSink)
     };

package/src/runtime/host/user-spot-creation-coordinator.ts

@@ -1,10 +1,29 @@
+import { createHash } from 'node:crypto';
+import {
+  type RoutingId,
+  type SpotRef,
+  type ZLinkSpotCreateResult,
+  ZLinkFrameworkException,
+  ZLinkSpotCreateState
+} from '../../contracts';
+
+import {
+  decodeServiceClosingSpotAuthority,
+  decodeServiceReadySpotAuthority,
+  encodeServiceUserSpotAuthorityPayload
+} from '../foundation/service-authority-payload-codec';
+import type { ServiceUserSpotOperationResult } from '../foundation/service-stateful-runtime';
+import type {
+  ServiceDirectSpotRouteFence,
+  ServiceUserSpotCloseRecord,
+  ServiceUserSpotCreateRecord
+} from '../foundation/service-stateful-wire-codec';
 import {
   ZLinkFrameworkInternalErrorKind,
   createInternalFrameworkException,
   wireReplyFailureException
 } from '../framework-errors-internal';
-import { createHash } from 'node:crypto';
-import type { RoutingId, SpotRef, ZLinkSpotCreateResult } from '../../contracts';
+import { encodeAuthorityKey } from '../locations/authority-key-codec';
 import type {
   ZLinkAuthoritySnapshot,
   ZLinkLocationOwnerToken,
@@ -14,20 +33,9 @@ import type {
   ZLinkAuthorityStore,
   ZLinkObjectCreationStore
 } from '../locations/internal-store-contracts';
-import { ZLinkFrameworkException, ZLinkSpotCreateState } from '../../contracts';
-import {
-  decodeServiceReadySpotAuthority,
-  decodeServiceClosingSpotAuthority,
-  encodeServiceUserSpotAuthorityPayload
-} from '../foundation/service-authority-payload-codec';
-import { encodeAuthorityKey } from '../locations/authority-key-codec';
 import type { ZLinkLocalSpotCreateResult } from '../spots/spot-manager-internal-contracts';
-import type { ServiceUserSpotOperationResult } from '../foundation/service-stateful-runtime';
-import type {
-  ServiceUserSpotCloseRecord,
-  ServiceUserSpotCreateRecord,
-  ServiceDirectSpotRouteFence
-} from '../foundation/service-stateful-wire-codec';
+const DEFAULT_USER_SPOT_CLEANUP_TIMEOUT_MS = 1_000;
+const DEFAULT_USER_SPOT_POLL_INTERVAL_MS = 10;
 
 export interface ZLinkUserSpotCreationCoordinatorOptions {
   readonly store: ZLinkObjectCreationStore & ZLinkAuthorityStore;
@@ -109,9 +117,10 @@ export class ZLinkUserSpotCreationCoordinator {
     ) => Promise<ZLinkLocalSpotCreateResult>,
     discard?: (signal?: AbortSignal) => Promise<void>
   ): Promise<ZLinkUserSpotCreationResult> {
-    const deadline = createDeadline(request.timeoutMs, request.signal);
-    const deadlineMs = performance.now() + request.timeoutMs;
     const deadlineUnixMs = Date.now() + request.timeoutMs;
+    const remainingMs = Math.max(0, deadlineUnixMs - Date.now());
+    const deadline = createDeadline(remainingMs, request.signal);
+    const deadlineMs = performance.now() + remainingMs;
     const signal = deadline.signal;
     signal.throwIfAborted();
     const sha256 = createHash('sha256').update(request.requestPayload).digest();
@@ -187,7 +196,8 @@ export class ZLinkUserSpotCreationCoordinator {
               }
             }
           },
-          signal
+          signal,
+          BigInt(deadlineUnixMs)
         );
       } catch (error) {
         deadline.close();
@@ -530,7 +540,8 @@ export class ZLinkUserSpotCreationCoordinator {
               }
             }
           },
-          signal
+          signal,
+          record.deadlineUnixMs
         );
         await discard?.(signal);
         return {
@@ -565,7 +576,8 @@ export class ZLinkUserSpotCreationCoordinator {
               ownerNodeGeneration: current.allocation.descriptorLifecycleGeneration
             })
           },
-          signal
+          signal,
+          record.deadlineUnixMs
         );
       } catch (error) {
         throw createInternalFrameworkException(
@@ -596,7 +608,9 @@ export class ZLinkUserSpotCreationCoordinator {
       };
     } catch (error) {
       local?.publication?.abort();
-      const cleanupDeadline = createDeadline(this.options.cleanupTimeoutMs ?? 1_000);
+      const cleanupDeadline = createDeadline(
+        this.options.cleanupTimeoutMs ?? DEFAULT_USER_SPOT_CLEANUP_TIMEOUT_MS
+      );
       const cleanupSignal = cleanupDeadline.signal;
       const cleanup = await Promise.allSettled([
         waitForAbort(
@@ -760,7 +774,7 @@ export class ZLinkUserSpotCreationCoordinator {
       if (current.kind === 'snapshot' && current.allocation.state === 'active') {
         return spotRef(current, request);
       }
-      await wait(this.options.pollIntervalMs ?? 10, signal);
+      await wait(this.options.pollIntervalMs ?? DEFAULT_USER_SPOT_POLL_INTERVAL_MS, signal);
     }
   }
 

package/src/runtime/locations/aggregate-inventory-store.ts

@@ -1,12 +1,15 @@
 import { createHash, timingSafeEqual } from 'node:crypto';
 import type { ZLinkLocationStore, ZLinkStoreKey, ZLinkStoreReadResult } from '../../contracts';
+import { SHA256_DIGEST_BYTES } from '../foundation/actor-join-recovery-codec';
+import { PROVIDER_STORAGE_NAMESPACE_PREFIX, storeKey } from './in-memory-provider-location-store';
 import type {
   ZLinkAggregateFence,
   ZLinkAggregatePrepareRequest
 } from './internal-location-contracts';
-import { storeKey } from './in-memory-provider-location-store';
 
-const PREFIX = 'zlink:v11:aggregate-inventory:';
+const INVENTORY_PAGE_KIND = 'aggregate-inventory-page-v1';
+const INVENTORY_ROOT_KIND = 'aggregate-inventory-root-v1';
+const PREFIX = `${PROVIDER_STORAGE_NAMESPACE_PREFIX}aggregate-inventory:`;
 const MAX_PAGE_ENTRIES = 1_024;
 const MAX_PAGE_BYTES = 1_024 * 1_024;
 const MAX_TREE_LEVELS = 32;
@@ -30,7 +33,7 @@ interface InventoryReference {
 }
 
 interface InventoryPage {
-  readonly kind: 'aggregate-inventory-page-v1';
+  readonly kind: typeof INVENTORY_PAGE_KIND;
   readonly level: number;
   readonly index: number;
   readonly startIndex: number;
@@ -40,7 +43,7 @@ interface InventoryPage {
 }
 
 interface InventoryRoot {
-  readonly kind: 'aggregate-inventory-root-v1';
+  readonly kind: typeof INVENTORY_ROOT_KIND;
   readonly totalCount: number;
   readonly digest: string;
   readonly declaredDigest: string;
@@ -209,8 +212,8 @@ function buildTree(request: ZLinkAggregatePrepareRequest): InventoryTree {
   if (request.participants.length < 1) {
     throw new RangeError('Aggregate inventory requires at least one participant.');
   }
-  if (request.inventoryDigest.byteLength !== 32) {
-    throw new TypeError('Aggregate inventory digest must contain 32 bytes.');
+  if (request.inventoryDigest.byteLength !== SHA256_DIGEST_BYTES) {
+    throw new TypeError(`Aggregate inventory digest must contain ${SHA256_DIGEST_BYTES} bytes.`);
   }
   const entries = request.participants.map((participant, index): InventoryEntry => ({
     index,
@@ -240,7 +243,7 @@ function buildTree(request: ZLinkAggregatePrepareRequest): InventoryTree {
   ) {
     level++;
     if (level >= MAX_TREE_LEVELS) {
-      throw new RangeError('Aggregate inventory tree exceeds 32 levels.');
+      throw new RangeError(`Aggregate inventory tree exceeds ${MAX_TREE_LEVELS} levels.`);
     }
     references = packIndexPages(level, references, pages);
   }
@@ -269,7 +272,7 @@ function packLeafPages(
     let bytes: Uint8Array;
     do {
       page = {
-        kind: 'aggregate-inventory-page-v1',
+        kind: INVENTORY_PAGE_KIND,
         level: 0,
         index: references.length,
         startIndex: offset,
@@ -304,7 +307,7 @@ function packIndexPages(
     do {
       const selected = children.slice(offset, offset + count);
       page = {
-        kind: 'aggregate-inventory-page-v1',
+        kind: INVENTORY_PAGE_KIND,
         level,
         index: references.length,
         startIndex: selected[0]!.startIndex,
@@ -339,7 +342,7 @@ function rootCandidate(
     if (page.level <= topLevel) pageCountsByLevel[page.level]!++;
   }
   return {
-    kind: 'aggregate-inventory-root-v1',
+    kind: INVENTORY_ROOT_KIND,
     totalCount,
     digest,
     declaredDigest,
@@ -456,7 +459,7 @@ function decodeRoot(bytes: Uint8Array): InventoryRoot {
     value === null ||
     typeof value !== 'object' ||
     !('kind' in value) ||
-    value.kind !== 'aggregate-inventory-root-v1'
+    value.kind !== INVENTORY_ROOT_KIND
   ) {
     throw new Error('Invalid inventory root.');
   }
@@ -469,7 +472,7 @@ function decodePage(bytes: Uint8Array): InventoryPage {
     value === null ||
     typeof value !== 'object' ||
     !('kind' in value) ||
-    value.kind !== 'aggregate-inventory-page-v1' ||
+    value.kind !== INVENTORY_PAGE_KIND ||
     !('entries' in value) ||
     !Array.isArray(value.entries) ||
     !('children' in value) ||
@@ -524,7 +527,7 @@ function isSha256(value: unknown): value is string {
 function sameHash(expected: string, actual: Uint8Array): boolean {
   return (
     isSha256(expected) &&
-    actual.byteLength === 32 &&
+    actual.byteLength === SHA256_DIGEST_BYTES &&
     timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual))
   );
 }

package/src/runtime/locations/authority-key-codec.ts

@@ -1,3 +1,4 @@
+import { ZLINK_MAX_IDENTITY_TEXT_BYTES } from '../../contracts/Common/CoreTypes';
 import type {
   ZLinkAuthorityKey,
   ZLinkPlacementObjectKind
@@ -8,8 +9,10 @@ export function encodeAuthorityKey(
   globalId: string
 ): ZLinkAuthorityKey {
   const bytes = Buffer.from(globalId);
-  if (bytes.byteLength < 1 || bytes.byteLength > 255) {
-    throw new RangeError('Authority identity must contain 1..255 UTF-8 bytes.');
+  if (bytes.byteLength < 1 || bytes.byteLength > ZLINK_MAX_IDENTITY_TEXT_BYTES) {
+    throw new RangeError(
+      `Authority identity must contain 1..${ZLINK_MAX_IDENTITY_TEXT_BYTES} UTF-8 bytes.`
+    );
   }
   const discriminator = kind === 'actor' ? 'a' : 's';
   return {
@@ -27,7 +30,8 @@ export function decodeAuthorityKey(key: ZLinkAuthorityKey): {
   const match = /^zla1:([as]):([1-9][0-9]{0,2}):(.*)$/.exec(key.value);
   if (match === null) throw new TypeError('Authority key is not canonical.');
   const declaredLength = Number(match[2]);
-  if (declaredLength > 255) throw new TypeError('Authority key identity exceeds the byte limit.');
+  if (declaredLength > ZLINK_MAX_IDENTITY_TEXT_BYTES)
+    throw new TypeError('Authority key identity exceeds the byte limit.');
   const encoded = match[3]!;
   const bytes: number[] = [];
   for (let index = 0; index < encoded.length;) {

package/src/runtime/locations/auto-connect-reconciler.ts

@@ -13,6 +13,8 @@ import { ZLinkLocationKeyCodec } from './key-codec';
 import { normalizeEndpoint } from '../../contracts/Configuration/EndpointNotation';
 import { ZLinkAutoConnectPlanner } from './auto-connect-planner';
 import { ZLinkStateLane } from '../execution/state-lane';
+import { ConnectError } from '@zlink-systems/zlink';
+import type { ZLinkDispatchErrorSink } from '../diagnostics/dispatch-error-port';
 import type {
   IZLinkAutoConnectExecutor,
   IZLinkAutoConnectPeerPublisher,
@@ -33,6 +35,7 @@ export interface ZLinkAutoConnectReconcilerOptions {
   readonly events?: ZLinkAutoConnectEventSink;
   readonly options?: ZLinkLocationOptionOverrides;
   readonly monotonicNowMs?: () => number;
+  readonly errorSink: ZLinkDispatchErrorSink;
 }
 
 export class ZLinkAutoConnectReconciler {
@@ -46,6 +49,7 @@ export class ZLinkAutoConnectReconciler {
   private readonly events?: ZLinkAutoConnectEventSink;
   private readonly options: Required<ZLinkLocationOptionOverrides>;
   private readonly monotonicNowMs: () => number;
+  private readonly errorSink: ZLinkDispatchErrorSink;
   private readonly active = new Map<string, ZLinkAutoConnectTarget>();
   private readonly pendingDisconnects = new Map<string, ZLinkAutoConnectTarget>();
   private readonly failedEndpoints = new Set<string>();
@@ -73,6 +77,7 @@ export class ZLinkAutoConnectReconciler {
     this.events = options.events;
     this.options = { ...zlinkRuntimeDefaultLocationOptions, ...options.options };
     this.monotonicNowMs = options.monotonicNowMs ?? (() => performance.now());
+    this.errorSink = options.errorSink;
     this.executor.onDisconnected?.((endpoint) => this.recordDisconnectedEndpoint(endpoint));
   }
 
@@ -155,13 +160,6 @@ export class ZLinkAutoConnectReconciler {
       await this.lane.run(() => {
         this.storeFailedValue = false;
         this.storeFailureStartedAtMs = undefined;
-        // After a store restart, owners may need one full lease interval to
-        // reclaim their token and republish a descriptor. Do not interpret the
-        // incomplete post-restart scan as a definitive removal.
-        // Keep the existing transport set through one lease interval while
-        // owners reclaim their tokens and republish descriptors. This deferral
-        // applies only after a Store operation failed; a successful empty scan
-        // is authoritative and must remove stale peers promptly.
         this.recoveryDeferUntilMs = this.monotonicNowMs() + this.options.ownerLeaseTtlMs;
       });
     }
@@ -175,7 +173,6 @@ export class ZLinkAutoConnectReconciler {
       );
     });
     const candidates = ZLinkAutoConnectPlanner.computeCandidates(this.local, rows);
-    const nowMs = this.monotonicNowMs();
     this.executor.expectPeers?.([...candidates.values()]);
     this.executor.replaceNotRequired?.(
       ZLinkAutoConnectPlanner.computeNotRequired(this.local, rows)
@@ -196,6 +193,18 @@ export class ZLinkAutoConnectReconciler {
     for (const [key, target] of existingTargets) {
       if (activeKeys.has(key)) desired.set(key, target);
     }
+    const deferringMissingTargets =
+      this.monotonicNowMs() < (await this.lane.run(() => this.recoveryDeferUntilMs));
+    let staleCandidates = candidates;
+    if (deferringMissingTargets) {
+      const retainedCandidates = new Map(candidates);
+      const lastDesired = await this.lane.run(() => [...this.lastDesired]);
+      for (const [key, target] of lastDesired) {
+        if (!desired.has(key)) desired.set(key, target);
+        if (!retainedCandidates.has(key)) retainedCandidates.set(key, target);
+      }
+      staleCandidates = retainedCandidates;
+    }
     await this.lane.run(() => {
       this.lastDesired = new Map(desired);
     });
@@ -226,14 +235,13 @@ export class ZLinkAutoConnectReconciler {
         await this.lane.run(() => {
           this.pendingDisconnects.delete(key);
         });
-        const connected = await this.executor.connect(target);
-        if (connected) {
+        await this.connectTarget(target, async () => {
           connectedEndpoints.push(target.endpoint);
           await this.lane.run(() => {
             this.active.set(key, target);
             this.failedEndpoints.delete(target.endpoint);
           });
-        }
+        });
         continue;
       }
 
@@ -252,27 +260,17 @@ export class ZLinkAutoConnectReconciler {
         await this.lane.run(() => {
           this.pendingDisconnects.delete(key);
         });
-        const connected = await this.executor.connect(target);
-        if (connected) {
+        await this.connectTarget(target, async () => {
           connectedEndpoints.push(target.endpoint);
           await this.lane.run(() => {
             this.active.set(key, target);
             this.failedEndpoints.delete(target.endpoint);
           });
-        }
+        });
       }
     }
 
-    if (nowMs < (await this.lane.run(() => this.recoveryDeferUntilMs))) {
-      this.publishDesiredSetChange(connectedEndpoints, disconnectedEndpoints);
-      return;
-    }
-
-    // A store restart can expose an incomplete descriptor set while peers are
-    // reclaiming their owner leases. Preserve existing transport connections
-    // during that recovery window; stale-peer cleanup is safe after the
-    // deferred reconciliation has completed.
-    this.executor.disconnectStalePeers?.([...candidates.values()]);
+    this.executor.disconnectStalePeers?.([...staleCandidates.values()]);
 
     const activeTargets = await this.lane.run(() => [...this.active]);
     for (const [key, target] of activeTargets) {
@@ -409,10 +407,25 @@ export class ZLinkAutoConnectReconciler {
     const retryTargets = await this.lane.run(() => this.beginStoreFailureCore());
     if (retryTargets === undefined) return;
     for (const [key, target] of retryTargets) {
-      if (await this.executor.connect(target)) {
+      await this.connectTarget(target, async () => {
         await this.lane.run(() => this.completeStoreFailureConnectCore(key, target));
-      }
+      });
+    }
+  }
+
+  private async connectTarget(
+    target: ZLinkAutoConnectTarget,
+    accept: () => Promise<void>
+  ): Promise<void> {
+    let accepted: boolean;
+    try {
+      accepted = await this.executor.connect(target);
+    } catch (error) {
+      if (!(error instanceof ConnectError)) throw error;
+      this.errorSink.reportRuntimeTaskException('auto-connect', error);
+      return;
     }
+    if (accepted) await accept();
   }
 
   private beginStoreFailureCore():

package/src/runtime/locations/creation-operation-id.ts

@@ -1,12 +1,15 @@
+import { UINT64_BYTES } from '@zlink-systems/stream-wire';
+import { OPERATION_IDENTITY_BYTES } from '../foundation/operation-identity';
 import { randomBytes } from 'node:crypto';
 
-export function randomOperationId(entropy: Uint8Array = randomBytes(16)): {
+export function randomOperationId(entropy: Uint8Array = randomBytes(OPERATION_IDENTITY_BYTES)): {
   readonly high: bigint;
   readonly low: bigint;
 } {
-  if (entropy.byteLength !== 16) throw new RangeError('Operation ID entropy must be 16 bytes.');
+  if (entropy.byteLength !== OPERATION_IDENTITY_BYTES)
+    throw new RangeError(`Operation ID entropy must be ${OPERATION_IDENTITY_BYTES} bytes.`);
   const bytes = Buffer.from(entropy);
   const high = bytes.readBigUInt64BE(0);
-  const low = bytes.readBigUInt64BE(8);
+  const low = bytes.readBigUInt64BE(UINT64_BYTES);
   return high === 0n && low === 0n ? { high, low: 1n } : { high, low };
 }

package/src/runtime/locations/domain-store-contract.ts

@@ -128,14 +128,23 @@ export interface ZLinkDomainLocationStore {
   ): Promise<ZLinkCreationTerminalReadResult>;
   reserve(
     request: ZLinkObjectReserveRequest,
-    signal?: AbortSignal
+    signal?: AbortSignal,
+    deadlineUnixMs?: bigint
   ): Promise<ZLinkObjectReserveResult>;
-  commit(request: ZLinkObjectCommitRequest, signal?: AbortSignal): Promise<ZLinkObjectCommitResult>;
+  commit(
+    request: ZLinkObjectCommitRequest,
+    signal?: AbortSignal,
+    deadlineUnixMs?: bigint
+  ): Promise<ZLinkObjectCommitResult>;
   completeCreation(
     request: ZLinkObjectCreationCompleteRequest,
     signal?: AbortSignal
   ): Promise<ZLinkObjectCreationCompleteResult>;
-  abort(request: ZLinkObjectAbortRequest, signal?: AbortSignal): Promise<ZLinkObjectAbortResult>;
+  abort(
+    request: ZLinkObjectAbortRequest,
+    signal?: AbortSignal,
+    deadlineUnixMs?: bigint
+  ): Promise<ZLinkObjectAbortResult>;
 
   prepareAggregate(
     request: ZLinkAggregatePrepareRequest,