@zlink-systems/framework 0.29.1 → 0.30.1

package/src/runtime/foundation/raw-service-mesh-runtime.ts

@@ -2,6 +2,7 @@ import { constants as osConstants } from 'node:os';
 import { ApplicationIngressRecordOwner } from '../application-jobs/application-ingress-record-owner';
 import type {
   ApplicationJobPermitPort,
+  ApplicationJobReceiveRotationPort,
   ApplicationJobQueuePort
 } from '../application-jobs/contracts';
 import type {
@@ -13,11 +14,11 @@ import type {
 import { submitToRequestResult } from '../messaging/submission-result';
 import { RequestResult, SubmitResult, isZLinkBackendResultError } from '../backend/runtime-values';
 import { enumWireRejectReason } from '../protocol/service_wire_codec.generated';
+import { SERVICE_WIRE_PREFIX_SIZE } from './service-wire-binary-primitives';
 import { OperationRegistry, type PendingOperation } from './operation-registry';
 import { ServiceLivenessRegistry, type ServiceLivenessTick } from './service-liveness-registry';
 import { ServiceMailbox, type ServiceMailboxRecord } from './service-mailbox';
 import {
-  sameServiceNodeDescriptor,
   ServiceTopologyRegistry,
   validateDescriptor,
   type AdmittedServicePeer,
@@ -84,6 +85,7 @@ type RawServiceChannelTargetSelection =
 type ServiceApplicationPayloadInput = ServiceApplicationPayload | Buffer;
 
 export interface RawServiceIngressRecord {
+  readonly onAdmitted?: () => void;
   readonly command: number;
   readonly flags: number;
   readonly sourceRoutingId: string;
@@ -100,6 +102,8 @@ export type RawServiceIngressHandler = (
 ) => RawServicePumpResult | undefined | Promise<RawServicePumpResult | undefined>;
 
 export interface RawServiceMeshRuntimeOptions {
+  readonly onReceiveReady?: () => void;
+  readonly infrastructureTaskRunner?: import('../spots/spot-actor-join-dispatch').ZLinkDetachedTaskRunner;
   readonly onPendingOperationsChanged?: () => void;
   readonly descriptor: ServiceNodeDescriptor;
   readonly resolveAdvertisedEndpoint?: (boundEndpoint: string) => string;
@@ -127,6 +131,7 @@ export interface RawServiceMeshRuntimeOptions {
 // Framework error code 13 (RequestTargetNotFound) is encoded as 14 on a
 // RequestResult.NotFound reply. Boundary transport results keep failureCode 0.
 const RAW_MESH_RECEIVE_RECORD_BUDGET = 64;
+const NODE_SEND_HEADER = encodeNodeSendHeader();
 const RAW_MESH_RECEIVE_BYTE_BUDGET = 4 * 1024 * 1024;
 export const RAW_MESH_RECEIVE_TIME_BUDGET_MS = 2;
 
@@ -138,6 +143,14 @@ const livenessCodec = createServiceWireCodec({
   commands: M6aServiceWireCommand
 });
 
+interface ControlSendState {
+  task?: Promise<boolean>;
+  next?: () => boolean | Promise<boolean>;
+  current?: () => boolean;
+  // Admission owns the first HELLO until ADMIT or route termination.
+  hello?: Uint8Array;
+}
+
 /**
  * RouteMesh M6A runtime built only on the public raw binding package.
  * It owns protocol, admission, mailbox, request and liveness state.
@@ -156,11 +169,11 @@ export class RawServiceMeshRuntime {
       readonly endpoint?: string;
       readonly securityIdentity?: string;
       readonly lifecycleGeneration?: bigint;
-      helloSubmittedGeneration?: bigint;
     }
   >();
   private readonly endpointOnlyPeers = new Set<string>();
   private readonly peerConnectionIntentRemoved = new Set<(nodeRoutingId: string) => void>();
+  private readonly peerRouteChanged = new Set<(nodeRoutingId: string) => void>();
   /**
    * The last observed Core selected route of each RID (Core ROUTER §10.1):
    * RID -> route generation. Only `observeSelectedRoutes` replaces it.
@@ -168,8 +181,16 @@ export class RawServiceMeshRuntime {
   private selectedRoutes = new Map<string, bigint>();
   private readonly bindingPort: ZLinkRawBindingPort;
   private readonly applicationJobQueue: ApplicationJobQueuePort;
+  private readonly nodeMailboxOwner: string;
   private readonly peerAdmissionSealed?: () => boolean;
   private readonly applicationJobStop = new AbortController();
+  private receiveAcquisition?: Promise<ApplicationJobPermitPort>;
+  private receivePermit?: ApplicationJobPermitPort;
+  private receiveRotation?: ApplicationJobReceiveRotationPort;
+  private readonly controlSends = new Map<string, ControlSendState>();
+  private infrastructureFailure?: { readonly error: unknown };
+  private readonly onReceiveReady?: () => void;
+  private readonly infrastructureTaskRunner?: RawServiceMeshRuntimeOptions['infrastructureTaskRunner'];
   private readonly onPeerNotRequired?: RawServiceMeshRuntimeOptions['onPeerNotRequired'];
   private readonly onPeerDisconnected?: RawServiceMeshRuntimeOptions['onPeerDisconnected'];
   private readonly onProtocolError?: RawServiceMeshRuntimeOptions['onProtocolError'];
@@ -180,11 +201,15 @@ export class RawServiceMeshRuntime {
   private router?: ZLinkRawRouterPort;
   private nextCorrelation = 1n;
   private serviceIngress?: RawServiceIngressHandler;
+  private serviceIngressAccepts?: (command: number) => boolean;
   private closed = false;
 
   constructor(options: RawServiceMeshRuntimeOptions) {
+    this.onReceiveReady = options.onReceiveReady;
+    this.infrastructureTaskRunner = options.infrastructureTaskRunner;
     this.operations = new OperationRegistry(undefined, options.onPendingOperationsChanged);
     this.descriptor = options.descriptor;
+    this.nodeMailboxOwner = `node:${options.descriptor.nodeRoutingId}`;
     this.topology = new ServiceTopologyRegistry(options.descriptor);
     this.mailbox = new ServiceMailbox(options.onMailboxReady);
     this.liveness = new ServiceLivenessRegistry(options.probeIntervalMs, options.peerTimeoutMs);
@@ -363,6 +388,36 @@ export class RawServiceMeshRuntime {
     };
   }
 
+  observePeerRoute(
+    nodeRoutingId: string
+  ): import('./durable-service-request').PeerRouteObservation {
+    const selected = this.selectedRoutes.get(nodeRoutingId);
+    const admitted = this.topology.admittedPeer(nodeRoutingId)?.liveness?.connectionId;
+    return {
+      generation: selected ?? (typeof admitted === 'bigint' ? admitted : undefined),
+      ready: admitted !== undefined && (selected === undefined || admitted === selected)
+    };
+  }
+
+  get requestStopSignal(): AbortSignal {
+    return this.applicationJobStop.signal;
+  }
+
+  observePeerRouteChanged(listener: (nodeRoutingId: string) => void): () => void {
+    this.peerRouteChanged.add(listener);
+    return () => {
+      this.peerRouteChanged.delete(listener);
+    };
+  }
+
+  hasSelectedPeerRoute(nodeRoutingId: string): boolean {
+    return this.selectedRoutes.has(nodeRoutingId);
+  }
+
+  private notifyPeerRouteChanged(nodeRoutingId: string): void {
+    for (const listener of this.peerRouteChanged) listener(nodeRoutingId);
+  }
+
   private notifyPeerConnectionIntentRemoved(nodeRoutingId: string): void {
     // Only the logical owner's removal publishes lifecycle termination.
     // A physical disconnect alone retains the connection expectation.
@@ -371,37 +426,49 @@ export class RawServiceMeshRuntime {
     for (const listener of this.peerConnectionIntentRemoved) listener(nodeRoutingId);
   }
 
-  async announcePeer(nodeRoutingId: string): Promise<boolean> {
-    const expected = this.expectedPeers.get(nodeRoutingId);
+  announcePeer(nodeRoutingId: string): Promise<boolean> {
     const generation = this.selectedRoutes.get(nodeRoutingId);
-    if (
-      expected === undefined ||
-      generation === undefined ||
-      expected.helloSubmittedGeneration === generation ||
-      this.peerAdmissionSealed?.() === true
-    )
-      return false;
-    const accepted = await this.send(nodeRoutingId, [
-      encodeRouteMeshAdmission(M6aServiceWireCommand.hello, this.topology.localDescriptor())
-    ]);
-    if (
-      accepted &&
-      this.expectedPeers.get(nodeRoutingId) === expected &&
-      this.selectedRoutes.get(nodeRoutingId) === generation
-    )
-      expected.helloSubmittedGeneration = generation;
-    return accepted;
+    if (generation === undefined) return Promise.resolve(false);
+    const current = () => {
+      const admission = this.topology.routeAdmission(nodeRoutingId);
+      return (
+        this.selectedRoutes.get(nodeRoutingId) === generation &&
+        !(
+          admission?.connectionId === routeConnectionId(generation) &&
+          admission.remoteAdmitReceived === true
+        ) &&
+        this.peerAdmissionSealed?.() !== true
+      );
+    };
+    const key = controlSendKey(nodeRoutingId, M6aServiceWireCommand.hello);
+    if (!current()) {
+      this.controlSends.delete(key);
+      return Promise.resolve(false);
+    }
+    const existing = this.controlSends.get(key);
+    const hello =
+      existing?.current?.() === true
+        ? existing.hello!
+        : encodeRouteMeshAdmission(M6aServiceWireCommand.hello, this.topology.localDescriptor());
+    return Promise.resolve(
+      this.startControlSend(
+        nodeRoutingId,
+        M6aServiceWireCommand.hello,
+        () => this.submitControl(nodeRoutingId, [hello]),
+        current,
+        hello
+      )
+    );
   }
 
   isPeerRouteReady(nodeRoutingId: string, lifecycleGeneration?: bigint): boolean {
     // Admission is bound to the observed selected route: the route observer
     // removes the peer when that route ends or is replaced.
-    const peer = this.topology.peer(nodeRoutingId);
+    const peer = this.topology.admittedPeer(nodeRoutingId);
     return (
       peer !== undefined &&
       (lifecycleGeneration === undefined ||
-        peer.descriptor.lifecycleGeneration === lifecycleGeneration) &&
-      this.liveness.isReady(nodeRoutingId, peer.connectionId)
+        peer.descriptor.lifecycleGeneration === lifecycleGeneration)
     );
   }
 
@@ -444,12 +511,18 @@ export class RawServiceMeshRuntime {
     // placement and channel selectors therefore need the new mutable fields
     // on that same connection before the next request is selected; waiting for
     // a reconnect would leave a race where a drained node is selected again.
+    await this.publishLocalDescriptor(
+      this.topology.peers().map((peer) => peer.descriptor.nodeRoutingId)
+    );
+  }
+
+  private async publishLocalDescriptor(targets: readonly string[]): Promise<void> {
     const update = encodeRouteMeshAdmission(
       M6aServiceWireCommand.update,
       this.topology.localDescriptor()
     );
-    for (const peer of this.topology.peers()) {
-      await this.send(peer.descriptor.nodeRoutingId, [update]);
+    for (const target of targets) {
+      await this.sendService(target, [update]);
     }
   }
 
@@ -458,18 +531,14 @@ export class RawServiceMeshRuntime {
   }
 
   isObjectClientNodeDirectTarget(nodeRoutingId: string): boolean {
-    const descriptor =
-      nodeRoutingId === this.descriptor.nodeRoutingId
-        ? this.topology.localDescriptor()
-        : this.topology.knownDescriptor(nodeRoutingId);
-    return descriptor?.objectRole === 'client';
+    return this.topology.isObjectClientNodeDirectTarget(nodeRoutingId);
   }
 
-  async sendToNode(
+  sendToNode(
     targetNodeRoutingId: string,
     payload: ServiceApplicationPayloadInput
-  ): Promise<boolean> {
-    return this.send(targetNodeRoutingId, [encodeNodeSendHeader(), this.applicationFrame(payload)]);
+  ): boolean | Promise<boolean> {
+    return this.send(targetNodeRoutingId, [NODE_SEND_HEADER, this.applicationFrame(payload)]);
   }
 
   async sendToChannel(
@@ -491,15 +560,17 @@ export class RawServiceMeshRuntime {
   requestToNode(
     targetNodeRoutingId: string,
     payload: ServiceApplicationPayloadInput,
-    timeoutMs: number
+    timeoutMs: number,
+    onAdmitted?: () => void
   ): PendingOperation<RawServiceRequestResult> {
-    return this.requestToTarget(targetNodeRoutingId, payload, timeoutMs);
+    return this.requestToTarget(targetNodeRoutingId, payload, timeoutMs, undefined, onAdmitted);
   }
 
   requestToChannel(
     channelName: string,
     payload: ServiceApplicationPayloadInput,
-    timeoutMs: number
+    timeoutMs: number,
+    onAdmitted?: () => void
   ): PendingOperation<RawServiceRequestResult> {
     const selection = this.selectChannelTarget(channelName);
     if (selection.kind !== 'selected') {
@@ -511,7 +582,8 @@ export class RawServiceMeshRuntime {
       selection.peer.descriptor.nodeRoutingId,
       payload,
       timeoutMs,
-      channelName
+      channelName,
+      onAdmitted
     );
   }
 
@@ -536,11 +608,15 @@ export class RawServiceMeshRuntime {
         };
   }
 
-  setServiceIngress(handler: RawServiceIngressHandler): void {
+  setServiceIngress(
+    handler: RawServiceIngressHandler,
+    accepts?: (command: number) => boolean
+  ): void {
     if (this.serviceIngress !== undefined && this.serviceIngress !== handler) {
       throw new Error('Raw service ingress is already registered.');
     }
     this.serviceIngress = handler;
+    this.serviceIngressAccepts = accepts;
   }
 
   async reserveLocalIngress(signal?: AbortSignal): Promise<ApplicationIngressRecordOwner> {
@@ -548,20 +624,33 @@ export class RawServiceMeshRuntime {
       signal === undefined
         ? this.applicationJobStop.signal
         : AbortSignal.any([this.applicationJobStop.signal, signal]);
-    const permit = await this.applicationJobQueue.acquire(waitSignal);
+    const permit = await this.applicationJobQueue.acquire(waitSignal, 'local');
     return ApplicationIngressRecordOwner.create(this.applicationJobQueue, permit, { close() {} });
   }
 
   async sendService(targetNodeRoutingId: string, parts: readonly Uint8Array[]): Promise<boolean> {
-    return this.send(targetNodeRoutingId, parts);
+    try {
+      await this.requireStarted().send(targetNodeRoutingId, parts);
+      return true;
+    } catch (error) {
+      return this.sendFailure(error);
+    }
   }
 
   requestService(
     targetNodeRoutingId: string,
     parts: readonly Uint8Array[],
-    timeoutMs: number
+    timeoutMs: number,
+    onAdmitted?: () => void
   ): Promise<readonly Buffer[]> {
-    return this.requireStarted().request(targetNodeRoutingId, parts, timeoutMs);
+    const admission = this.topology.admittedPeer(targetNodeRoutingId)?.liveness;
+    return this.requireStarted().request(
+      targetNodeRoutingId,
+      parts,
+      timeoutMs,
+      admission?.recordReceived,
+      onAdmitted
+    );
   }
 
   replyService(
@@ -607,6 +696,18 @@ export class RawServiceMeshRuntime {
     nowMs = performance.now(),
     observe?: RawServicePumpObserver
   ): Promise<RawServicePumpResult> {
+    const result = await this.receiveOne(nowMs, observe);
+    const acquisition = this.receiveAcquisition;
+    if (acquisition === undefined) return result;
+    // A single receive operation may await its FIFO grant. Infrastructure
+    // rounds use receiveOne directly and end while that grant is pending.
+    try {
+      await acquisition;
+    } catch (error) {
+      if (this.closed) return 'noData';
+      throw error;
+    }
+    if (this.closed) return 'noData';
     return this.receiveOne(nowMs, observe);
   }
 
@@ -616,6 +717,7 @@ export class RawServiceMeshRuntime {
 
   /** Returns whether a receive budget ended before no-data; idle ticks only maintain peers. */
   async pumpBatch(receiveReady = true, routeReady = false): Promise<boolean> {
+    this.observeInfrastructureFailure();
     if (routeReady) await this.observeSelectedRoutes();
     const startedAtMs = performance.now();
     let messages = 0;
@@ -623,42 +725,82 @@ export class RawServiceMeshRuntime {
     const observe: RawServicePumpObserver = (_source, byteCount) => {
       bytes += byteCount;
     };
-    while (receiveReady && messages < RAW_MESH_RECEIVE_RECORD_BUDGET && !this.closed) {
-      const result = await this.receiveOne(performance.now(), observe);
-      if (result === 'noData') {
-        receiveReady = false;
-        break;
+    const rotation = (this.receiveRotation ??= this.applicationJobQueue.createReceiveRotation(
+      RAW_MESH_RECEIVE_RECORD_BUDGET,
+      'remote'
+    ));
+    if (receiveReady) rotation.reserve();
+    try {
+      while (receiveReady && messages < RAW_MESH_RECEIVE_RECORD_BUDGET && !this.closed) {
+        const received = this.receiveOne(performance.now(), observe, rotation);
+        const result = received instanceof Promise ? await received : received;
+        if (result === 'noData') {
+          receiveReady = false;
+          break;
+        }
+        messages += 1;
+        // Core owns the per-peer fair-queue cursor. The Framework limit bounds
+        // the entire round, so changing peers does not renew its byte/count budget.
+        if (
+          bytes >= RAW_MESH_RECEIVE_BYTE_BUDGET ||
+          performance.now() - startedAtMs >= RAW_MESH_RECEIVE_TIME_BUDGET_MS
+        )
+          break;
       }
-      messages += 1;
-      // Core owns the per-peer fair-queue cursor. The Framework limit bounds
-      // the entire round, so changing peers does not renew its byte/count budget.
-      if (
-        bytes >= RAW_MESH_RECEIVE_BYTE_BUDGET ||
-        performance.now() - startedAtMs >= RAW_MESH_RECEIVE_TIME_BUDGET_MS
-      )
-        break;
+    } finally {
+      rotation.releaseUnused();
     }
     if (!this.closed) {
-      await this.announceExpectedPeers();
-      await this.tickLiveness();
+      this.tickLiveness();
     }
     return receiveReady && messages > 0;
   }
 
-  private async receiveOne(
+  private receiveOne(
     nowMs: number,
-    observe?: RawServicePumpObserver
-  ): Promise<RawServicePumpResult> {
+    observe?: RawServicePumpObserver,
+    rotation?: ApplicationJobReceiveRotationPort
+  ): RawServicePumpResult | Promise<RawServicePumpResult> {
     const router = this.requireStarted();
-    let permit: ApplicationJobPermitPort;
-    try {
-      permit = await this.applicationJobQueue.acquire(this.applicationJobStop.signal);
-    } catch (error) {
-      if (this.closed || this.applicationJobStop.signal.aborted) return 'noData';
-      throw error;
+    this.observeInfrastructureFailure();
+    let permit = this.receivePermit;
+    this.receivePermit = undefined;
+    permit ??= rotation?.take();
+    if (permit === undefined && this.receiveAcquisition === undefined) {
+      let resolveAcquisition: ((permit: ApplicationJobPermitPort) => void) | undefined;
+      let rejectAcquisition: ((error: unknown) => void) | undefined;
+      permit = this.applicationJobQueue.acquireOrResume(
+        (permit) => {
+          this.receiveAcquisition = undefined;
+          if (this.closed) {
+            permit.releaseAfterInternalProcessing();
+            permit.releaseStorage?.();
+          } else {
+            this.receivePermit = permit;
+            this.onReceiveReady?.();
+          }
+          resolveAcquisition?.(permit);
+        },
+        (error) => rejectAcquisition?.(error),
+        this.applicationJobStop.signal,
+        'remote'
+      );
+      if (permit === undefined) {
+        const acquisition = new Promise<ApplicationJobPermitPort>((resolve, reject) => {
+          resolveAcquisition = resolve;
+          rejectAcquisition = reject;
+        });
+        this.receiveAcquisition = acquisition;
+        acquisition.catch((error) => {
+          this.receiveAcquisition = undefined;
+          if (!this.applicationJobStop.signal.aborted) this.reportInfrastructureFailure(error);
+        });
+      }
     }
+    if (permit === undefined) return 'noData';
     if (this.closed) {
       permit.releaseAfterInternalProcessing();
+      permit.releaseStorage?.();
       return 'noData';
     }
     let received: ZLinkRawReceivedRecord | undefined;
@@ -666,10 +808,12 @@ export class RawServiceMeshRuntime {
       received = router.receive(true);
     } catch (error) {
       permit.releaseAfterInternalProcessing();
+      permit.releaseStorage?.();
       throw error;
     }
     if (received === undefined) {
       permit.releaseAfterInternalProcessing();
+      permit.releaseStorage?.();
       return 'noData';
     }
     const applicationJobOwner = ApplicationIngressRecordOwner.create(
@@ -677,18 +821,40 @@ export class RawServiceMeshRuntime {
       permit,
       received
     );
+    let result: RawServicePumpResult | Promise<RawServicePumpResult>;
     try {
-      const result = await this.processReceived(received, nowMs, applicationJobOwner);
-      if (result === 'protocolError') {
-        this.reportProtocolError(received);
+      result = this.processReceived(received, nowMs, applicationJobOwner);
+    } catch (error) {
+      applicationJobOwner.close();
+      throw error;
+    }
+    return result instanceof Promise
+      ? result.then(
+          (value) => this.finishReceive(received, applicationJobOwner, observe, value),
+          (error) => {
+            applicationJobOwner.close();
+            throw error;
+          }
+        )
+      : this.finishReceive(received, applicationJobOwner, observe, result);
+  }
+
+  private finishReceive(
+    received: ZLinkRawReceivedRecord,
+    owner: ApplicationIngressRecordOwner,
+    observe: RawServicePumpObserver | undefined,
+    result: RawServicePumpResult
+  ): RawServicePumpResult {
+    try {
+      if (result === 'protocolError') this.reportProtocolError(received);
+      if (observe !== undefined) {
+        let bytes = 0;
+        for (const part of received.parts) bytes += part.byteLength;
+        observe(received.sourceRid, bytes);
       }
-      observe?.(
-        received.sourceRid,
-        received.parts.reduce((sum, part) => sum + part.byteLength, 0)
-      );
       return result;
     } finally {
-      applicationJobOwner.close();
+      owner.close();
     }
   }
 
@@ -734,22 +900,15 @@ export class RawServiceMeshRuntime {
     }
   }
 
-  private async processReceived(
+  private processReceived(
     received: ZLinkRawReceivedRecord,
     nowMs: number,
     applicationJobOwner: ApplicationIngressRecordOwner
-  ): Promise<RawServicePumpResult> {
-    if (
-      received.parts.length === 0 ||
-      (received.parts.length === 1 && received.parts[0]!.byteLength === 0)
-    ) {
-      if (this.peerAdmissionSealed?.() === true) return 'dropped';
-      return (await this.send(received.sourceRid, [
-        encodeRouteMeshAdmission(M6aServiceWireCommand.hello, this.topology.localDescriptor())
-      ]))
-        ? 'infrastructure'
-        : 'dropped';
-    }
+  ): RawServicePumpResult | Promise<RawServicePumpResult> {
+    const peer = this.topology.admittedPeer(received.sourceRid);
+    const currentSource =
+      peer?.liveness !== undefined && peer.liveness.connectionId === received.routeGeneration;
+    if (received.parts.length === 0) return currentSource ? 'protocolError' : 'dropped';
     try {
       const header = decodeHeader(received.parts[0]!);
       if (header.command === M6aServiceWireCommand.hello && this.peerAdmissionSealed?.() === true) {
@@ -757,105 +916,186 @@ export class RawServiceMeshRuntime {
       }
       if (
         header.command === M6aServiceWireCommand.hello ||
-        header.command === M6aServiceWireCommand.admit ||
-        header.command === M6aServiceWireCommand.update
+        header.command === M6aServiceWireCommand.admit
       ) {
-        if (received.parts.length !== 1) return 'protocolError';
-        const descriptor = decodeRouteMeshAdmission(
-          received.parts[0]!,
-          header.command,
-          received.sourceRid
+        return this.processAdmission(received, header, nowMs).catch((error) =>
+          this.receiveProtocolFailure(error)
         );
-        const expected = this.expectedPeers.get(received.sourceRid);
-        if (
-          expected !== undefined &&
-          (expected.meshName !== descriptor.meshName ||
-            expected.nodeRoutingId !== descriptor.nodeRoutingId)
-        ) {
-          await this.send(received.sourceRid, [
-            encodeReject(enumWireRejectReason('identityMismatch'))
-          ]);
-          return 'infrastructure';
-        }
-        const result = this.admitPeer(
-          descriptor,
-          routeConnectionId(received.routeGeneration),
-          nowMs,
-          expected
-        );
-        if (result !== 'admitted' && result !== 'notRequired') {
-          const detail =
-            result === 'invalidDescriptor'
-              ? describeInvalidAdmissionDescriptor(
-                  descriptor,
-                  expected,
-                  this.topology.peer(descriptor.nodeRoutingId)?.descriptor
-                )
-              : undefined;
-          console.warn(
-            `RouteMesh admission rejected peer '${received.sourceRid}' as ${result}` +
-              (detail === undefined ? '.' : ` (${detail}).`)
-          );
-          await this.send(received.sourceRid, [encodeReject(admissionReason(result))]);
-          return 'infrastructure';
-        }
-        if (result === 'admitted') this.selectBilateralConnection(descriptor);
-        if (header.command === M6aServiceWireCommand.hello) {
-          // Hello supplies only the sender's descriptor. Even NotRequired
-          // peers must receive ours before the intent owner closes transport;
-          // submitting a response does not guarantee delivery before close.
-          await this.send(received.sourceRid, [
-            encodeRouteMeshAdmission(M6aServiceWireCommand.admit, this.topology.localDescriptor())
-          ]);
-        } else if (result === 'notRequired') {
-          this.retireNotRequiredExpectedPeer(received.sourceRid, descriptor.advertisedEndpoint);
-        }
-        return 'infrastructure';
       }
       if (header.command === M6aServiceWireCommand.reject) {
         if (received.parts.length !== 1) return 'protocolError';
         decodeReject(received.parts[0]!);
         return 'infrastructure';
       }
-      const peer = this.topology.peer(received.sourceRid);
-      if (peer === undefined) return 'protocolError';
+      if (!currentSource) return 'dropped';
+      this.liveness.recordReceived(peer.liveness, nowMs);
+      if (header.command === M6aServiceWireCommand.update) {
+        return this.processAdmission(received, header, nowMs).catch((error) =>
+          this.receiveProtocolFailure(error)
+        );
+      }
       if (
         header.command === M6aServiceWireCommand.livenessProbe ||
         header.command === M6aServiceWireCommand.livenessAck
       ) {
-        if (received.parts.length !== 1) return 'protocolError';
-        const record = livenessCodec.decodeLivenessRecord(received.parts[0]!);
-        if (record.command === M6aServiceWireCommand.livenessProbe) {
-          const ack = this.liveness.acknowledgeProbe(
-            received.sourceRid,
-            peer.connectionId,
-            record.probeId
-          );
-          if (ack === undefined) return 'protocolError';
-          const sent = await this.send(received.sourceRid, [
-            livenessCodec.encodeLivenessRecord({
-              command: M6aServiceWireCommand.livenessAck,
-              probeId: record.probeId
-            })
-          ]);
-          if (!sent) return 'dropped';
-        } else {
-          this.liveness.acknowledge(received.sourceRid, peer.connectionId, record.probeId, nowMs);
-        }
-        return 'infrastructure';
+        return this.processLiveness(received, nowMs).catch((error) =>
+          this.receiveProtocolFailure(error)
+        );
       }
-      const stateful = await this.serviceIngress?.({
-        command: header.command,
-        flags: header.flags,
-        sourceRoutingId: received.sourceRid,
-        sourceNodeGeneration: peer.descriptor.lifecycleGeneration,
-        sourceRoute: received.sourceRoute,
-        ...(received.reply === undefined ? {} : { reply: received.reply }),
-        ...(received.requestSeq === undefined ? {} : { requestSequence: received.requestSeq }),
-        parts: received.parts,
-        applicationJobOwner
-      });
+      const stateful =
+        this.serviceIngress !== undefined && this.serviceIngressAccepts?.(header.command) !== false
+          ? this.serviceIngress({
+              command: header.command,
+              flags: header.flags,
+              sourceRoutingId: received.sourceRid,
+              sourceNodeGeneration: peer.descriptor.lifecycleGeneration,
+              sourceRoute: received.sourceRoute,
+              ...(received.reply === undefined ? {} : { reply: received.reply }),
+              ...(received.requestSeq === undefined
+                ? {}
+                : { requestSequence: received.requestSeq }),
+              parts: received.parts,
+              applicationJobOwner
+            })
+          : undefined;
+      if (stateful instanceof Promise)
+        return stateful.then(
+          (result) =>
+            result ?? this.processApplicationReceived(received, header, applicationJobOwner),
+          (error) => this.receiveProtocolFailure(error)
+        );
       if (stateful !== undefined) return stateful;
+      return this.processApplicationReceived(received, header, applicationJobOwner);
+    } catch (error) {
+      if (!currentSource && error instanceof ServiceWireProtocolError) return 'dropped';
+      return this.receiveProtocolFailure(error);
+    }
+  }
+
+  private receiveProtocolFailure(error: unknown): RawServicePumpResult {
+    if (error instanceof ServiceWireProtocolError) return 'protocolError';
+    throw error;
+  }
+
+  private async processAdmission(
+    received: ZLinkRawReceivedRecord,
+    header: ReturnType<typeof decodeHeader>,
+    nowMs: number
+  ): Promise<RawServicePumpResult> {
+    if (received.parts.length !== 1) return 'protocolError';
+    const descriptor = decodeRouteMeshAdmission(
+      received.parts[0]!,
+      header.command,
+      received.sourceRid
+    );
+    const expected = this.expectedPeers.get(received.sourceRid);
+    if (
+      expected !== undefined &&
+      (expected.meshName !== descriptor.meshName ||
+        expected.nodeRoutingId !== descriptor.nodeRoutingId)
+    ) {
+      await this.sendControl(received.sourceRid, [
+        encodeReject(enumWireRejectReason('identityMismatch'))
+      ]);
+      return 'infrastructure';
+    }
+    const helloKey = controlSendKey(received.sourceRid, M6aServiceWireCommand.hello);
+    const exchange = this.controlSends.get(helloKey);
+    const result = this.admitPeer(
+      descriptor,
+      received.routeGeneration,
+      nowMs,
+      expected,
+      header.command,
+      received.parts[0]!.subarray(SERVICE_WIRE_PREFIX_SIZE)
+    );
+    if (result !== 'admitted' && result !== 'notRequired') {
+      const detail =
+        result === 'invalidDescriptor'
+          ? describeInvalidAdmissionDescriptor(
+              descriptor,
+              expected,
+              this.topology.peer(descriptor.nodeRoutingId)?.descriptor
+            )
+          : undefined;
+      console.warn(
+        `RouteMesh admission rejected peer '${received.sourceRid}' as ${result}` +
+          (detail === undefined ? '.' : ` (${detail}).`)
+      );
+      await this.sendControl(received.sourceRid, [encodeReject(admissionReason(result))]);
+      return 'infrastructure';
+    }
+    if (result === 'admitted') this.selectBilateralConnection(descriptor);
+    if (header.command === M6aServiceWireCommand.hello) {
+      // Hello supplies only the sender's descriptor. Even NotRequired
+      // peers must receive ours before the intent owner closes transport;
+      // submitting a response does not guarantee delivery before close.
+      const local =
+        exchange?.current?.() === true && exchange.hello !== undefined
+          ? decodeRouteMeshAdmission(
+              exchange.hello,
+              M6aServiceWireCommand.hello,
+              this.descriptor.nodeRoutingId
+            )
+          : this.topology.localDescriptor();
+      await this.sendControl(received.sourceRid, [
+        encodeRouteMeshAdmission(M6aServiceWireCommand.admit, local)
+      ]);
+    } else if (header.command === M6aServiceWireCommand.admit) {
+      this.controlSends.delete(helloKey);
+      if (result === 'notRequired') {
+        this.retireNotRequiredExpectedPeer(received.sourceRid, descriptor.advertisedEndpoint);
+      } else if (
+        exchange?.hello !== undefined &&
+        decodeRouteMeshAdmission(
+          exchange.hello,
+          M6aServiceWireCommand.hello,
+          this.descriptor.nodeRoutingId
+        ).descriptorRevision < this.descriptor.descriptorRevision
+      ) {
+        await this.publishLocalDescriptor([received.sourceRid]);
+      }
+    }
+    return 'infrastructure';
+  }
+
+  private async processLiveness(
+    received: ZLinkRawReceivedRecord,
+    nowMs: number
+  ): Promise<RawServicePumpResult> {
+    if (received.parts.length !== 1) return 'protocolError';
+    const record = livenessCodec.decodeLivenessRecord(received.parts[0]!);
+    if (record.command === M6aServiceWireCommand.livenessProbe) {
+      const ack = this.liveness.acknowledgeProbe(
+        received.sourceRid,
+        received.routeGeneration,
+        record.probeId
+      );
+      if (ack === undefined) return 'protocolError';
+      const sent = await this.sendControl(received.sourceRid, [
+        livenessCodec.encodeLivenessRecord({
+          command: M6aServiceWireCommand.livenessAck,
+          probeId: record.probeId
+        })
+      ]);
+      if (!sent) return 'dropped';
+    } else {
+      this.liveness.acknowledge(
+        received.sourceRid,
+        received.routeGeneration,
+        record.probeId,
+        nowMs
+      );
+    }
+    return 'infrastructure';
+  }
+
+  private processApplicationReceived(
+    received: ZLinkRawReceivedRecord,
+    header: ReturnType<typeof decodeHeader>,
+    applicationJobOwner: ApplicationIngressRecordOwner
+  ): RawServicePumpResult | Promise<RawServicePumpResult> {
+    try {
       if (
         header.flags === 0 &&
         // A bare infrastructure control is normally exactly one frame, but a
@@ -873,7 +1113,7 @@ export class RawServiceMeshRuntime {
         isBareInfrastructureControl(header.command)
       ) {
         const accepted = this.mailbox.tryEnqueue({
-          owner: `node:${this.descriptor.nodeRoutingId}`,
+          owner: this.nodeMailboxOwner,
           domain: 'infrastructure',
           parts: received.parts,
           sourceRoutingId: received.sourceRid,
@@ -898,48 +1138,58 @@ export class RawServiceMeshRuntime {
       let owner: string;
       let correlation: bigint | undefined;
       if (header.command === M6aServiceWireCommand.nodeSend) {
-        owner = `node:${this.descriptor.nodeRoutingId}`;
+        owner = this.nodeMailboxOwner;
       } else if (header.command === M6aServiceWireCommand.nodeRequest) {
-        owner = `node:${this.descriptor.nodeRoutingId}`;
-        correlation = decodeNodeRequestHeader(received.parts[0]!);
+        owner = this.nodeMailboxOwner;
+        correlation = decodeNodeRequestHeader(received.parts[0]!, header);
       } else if (header.command === M6aServiceWireCommand.channelSend) {
-        owner = `channel:${decodeChannelSendHeader(received.parts[0]!)}`;
+        owner = `channel:${decodeChannelSendHeader(received.parts[0]!, header)}`;
       } else {
-        const channel = decodeChannelRequestHeader(received.parts[0]!);
+        const channel = decodeChannelRequestHeader(received.parts[0]!, header);
         owner = `channel:${channel.channelName}`;
         correlation = channel.correlation;
       }
-      const applicationJob = await applicationJobOwner.acquire('application');
-      const accepted = this.mailbox.tryEnqueue({
-        owner,
-        domain: 'application',
-        parts: received.parts,
-        sourceRoutingId: received.sourceRid,
-        sourceRoute: received.sourceRoute,
-        ...(received.reply === undefined ? {} : { reply: received.reply }),
-        requestSequence: received.requestSeq,
-        ...(correlation === undefined ? {} : { correlation }),
-        applicationJob
-      });
-      if (accepted) return 'application';
-      applicationJob.close();
-      if (correlation !== undefined && received.requestSeq !== undefined) {
-        this.replyService(
-          {
-            sourceRoutingId: received.sourceRid,
-            sourceRoute: received.sourceRoute,
-            requestSequence: received.requestSeq,
-            ...(received.reply === undefined ? {} : { reply: received.reply })
-          },
-          [encodeReplyHeader(correlation, RequestResult.NotConnected, 0)]
-        );
-        return 'infrastructure';
-      }
-      return 'dropped';
+      const job = applicationJobOwner.acquire('application');
+      return job instanceof Promise
+        ? job.then((permit) => this.enqueueOrdinaryRecord(received, owner, correlation, permit))
+        : this.enqueueOrdinaryRecord(received, owner, correlation, job);
     } catch (error) {
-      if (error instanceof ServiceWireProtocolError) return 'protocolError';
-      throw error;
+      return this.receiveProtocolFailure(error);
+    }
+  }
+
+  private enqueueOrdinaryRecord(
+    received: ZLinkRawReceivedRecord,
+    owner: string,
+    correlation: bigint | undefined,
+    applicationJob: import('../application-jobs/application-ingress-record-owner').ApplicationJobRecordLease
+  ): RawServicePumpResult {
+    const accepted = this.mailbox.tryEnqueue({
+      owner,
+      domain: 'application',
+      parts: received.parts,
+      sourceRoutingId: received.sourceRid,
+      sourceRoute: received.sourceRoute,
+      ...(received.reply === undefined ? {} : { reply: received.reply }),
+      requestSequence: received.requestSeq,
+      ...(correlation === undefined ? {} : { correlation }),
+      applicationJob
+    });
+    if (accepted) return 'application';
+    applicationJob.close();
+    if (correlation !== undefined && received.requestSeq !== undefined) {
+      this.replyService(
+        {
+          sourceRoutingId: received.sourceRid,
+          sourceRoute: received.sourceRoute,
+          requestSequence: received.requestSeq,
+          ...(received.reply === undefined ? {} : { reply: received.reply })
+        },
+        [encodeReplyHeader(correlation, RequestResult.NotConnected, 0)]
+      );
+      return 'infrastructure';
     }
+    return 'dropped';
   }
 
   expireOperations(nowMs: number, turnDeadlineMs: number): number {
@@ -950,21 +1200,25 @@ export class RawServiceMeshRuntime {
     return this.operations.size;
   }
 
-  async tickLiveness(nowMs = performance.now()): Promise<ServiceLivenessTick> {
+  tickLiveness(nowMs = performance.now()): ServiceLivenessTick {
     const result = this.liveness.tick(nowMs);
     this.requireStarted();
+    for (const nodeRoutingId of this.selectedRoutes.keys()) void this.announcePeer(nodeRoutingId);
     for (const probe of result.probes) {
-      await this.send(probe.nodeRoutingId, [
+      const parts = [
         livenessCodec.encodeLivenessRecord({
           command: M6aServiceWireCommand.livenessProbe,
           probeId: probe.probeId
         })
-      ]);
+      ];
+      this.startControlSend(probe.nodeRoutingId, M6aServiceWireCommand.livenessProbe, () =>
+        this.submitControl(probe.nodeRoutingId, parts)
+      );
     }
     for (const nodeRoutingId of result.timedOutNodes) {
       const peer = this.topology.peer(nodeRoutingId);
       if (peer === undefined) continue;
-      // Liveness timeout is a semantic peer removal of the admitted route.
+      this.requireStarted().disconnectRid!(nodeRoutingId);
       this.removePeer(peer);
     }
     return result;
@@ -986,11 +1240,10 @@ export class RawServiceMeshRuntime {
     let changes = 0;
     for (const [nodeRoutingId, generation] of this.selectedRoutes) {
       if (observed.get(nodeRoutingId) === generation) continue;
+      this.controlSends.delete(controlSendKey(nodeRoutingId, M6aServiceWireCommand.hello));
       changes++;
-      const expected = this.expectedPeers.get(nodeRoutingId);
-      if (expected !== undefined) delete expected.helloSubmittedGeneration;
       const peer = this.topology.peer(nodeRoutingId);
-      if (peer !== undefined && peer.connectionId === routeConnectionId(generation)) {
+      if (peer?.liveness?.connectionId === generation) {
         this.removePeer(peer);
       }
     }
@@ -1001,6 +1254,7 @@ export class RawServiceMeshRuntime {
       selected.push(nodeRoutingId);
     }
     this.selectedRoutes = observed;
+    for (const nodeRoutingId of selected) this.notifyPeerRouteChanged(nodeRoutingId);
     // A new selected route admits only through a new handshake.
     for (const nodeRoutingId of selected) await this.announcePeer(nodeRoutingId);
     return changes;
@@ -1008,9 +1262,15 @@ export class RawServiceMeshRuntime {
 
   close(): void {
     if (this.closed) return;
+    this.closed = true;
     this.applicationJobStop.abort(
       new Error('Raw service runtime application job admission stopped.')
     );
+    this.receivePermit?.releaseAfterInternalProcessing();
+    this.receivePermit?.releaseStorage?.();
+    this.receivePermit = undefined;
+    for (const send of this.controlSends.values()) delete send.next;
+    this.controlSends.clear();
     this.mailbox.close();
     this.operations.close('Raw service runtime closed.');
     this.serviceIngress = undefined;
@@ -1022,14 +1282,14 @@ export class RawServiceMeshRuntime {
     if (host !== undefined) host.close();
     this.router = undefined;
     this.host = undefined;
-    this.closed = true;
   }
 
   private requestToTarget(
     targetNodeRoutingId: string,
     payload: ServiceApplicationPayloadInput,
     timeoutMs: number,
-    channelName?: string
+    channelName?: string,
+    onAdmitted?: () => void
   ): PendingOperation<RawServiceRequestResult> {
     const correlation = this.nextCorrelation++;
     const header =
@@ -1100,6 +1360,8 @@ export class RawServiceMeshRuntime {
               terminalResult: RequestResult.NotConnected,
               failureCode: 0
             });
+          } else {
+            onAdmitted?.();
           }
         } finally {
           applicationJobOwner.close();
@@ -1107,7 +1369,8 @@ export class RawServiceMeshRuntime {
       })().catch((error) => this.operations.fail(pending.id, error));
       return pending;
     }
-    if (this.topology.peer(selectedTargetNodeRoutingId) === undefined) {
+    const selectedPeer = this.topology.admittedPeer(selectedTargetNodeRoutingId);
+    if (selectedPeer === undefined) {
       // Logical target selection is the requester's decision: an RID that is
       // not an admitted peer is not a target. Whether an admitted target's
       // route can carry the request is Core's REQUEST result.
@@ -1118,11 +1381,15 @@ export class RawServiceMeshRuntime {
       return pending;
     }
     const parts = [header, encodedPayload];
-    let router: ZLinkRawRouterPort;
     let request: Promise<readonly Uint8Array[]>;
     try {
-      router = this.requireStarted();
-      request = router.request(selectedTargetNodeRoutingId, parts, timeoutMs);
+      request = this.requireStarted().request(
+        selectedTargetNodeRoutingId,
+        parts,
+        timeoutMs,
+        selectedPeer.liveness?.recordReceived,
+        onAdmitted
+      );
     } catch (error) {
       this.operations.fail(pending.id, error);
       return pending;
@@ -1182,33 +1449,43 @@ export class RawServiceMeshRuntime {
 
   private admitPeer(
     descriptor: ServiceNodeDescriptor,
-    connectionId: string,
+    connectionId: string | bigint,
     nowMs: number,
     expected?: {
       readonly endpoint?: string;
       readonly securityIdentity?: string;
       readonly lifecycleGeneration?: bigint;
-    }
+    },
+    command: number = M6aServiceWireCommand.hello,
+    descriptorBytes?: Uint8Array
   ): PeerAdmissionResult {
     const previous = this.topology.peer(descriptor.nodeRoutingId);
-    if (
-      previous !== undefined &&
-      previous.descriptor.lifecycleGeneration === descriptor.lifecycleGeneration &&
-      (descriptor.descriptorRevision < previous.descriptor.descriptorRevision ||
-        (descriptor.descriptorRevision === previous.descriptor.descriptorRevision &&
-          !sameServiceNodeDescriptor(previous.descriptor, descriptor)))
-    ) {
+    const topologyConnectionId =
+      typeof connectionId === 'bigint' ? routeConnectionId(connectionId) : connectionId;
+    const result = this.topology.admit(
+      descriptor,
+      topologyConnectionId,
+      expected,
+      () => {
+        const admission = this.liveness.admit(descriptor.nodeRoutingId, connectionId, nowMs);
+        this.liveness.recordReceived(admission, nowMs);
+        return admission;
+      },
+      command,
+      descriptorBytes
+    );
+    if (result === 'staleDescriptor') {
       throw new ServiceWireProtocolError(
         `RouteMesh peer '${descriptor.nodeRoutingId}' descriptor revision is stale or conflicting.`
       );
     }
-    const result = this.topology.admit(descriptor, connectionId, expected);
-    if (result === 'admitted') {
-      this.liveness.admit(descriptor.nodeRoutingId, connectionId, nowMs);
-      this.liveness.requestProbe(descriptor.nodeRoutingId, connectionId, nowMs);
-    } else if (result === 'notRequired' && previous !== undefined) {
-      this.liveness.disconnect(descriptor.nodeRoutingId, previous.connectionId);
+    if (result === 'notRequired' && previous !== undefined) {
+      this.liveness.disconnect(
+        descriptor.nodeRoutingId,
+        previous.liveness?.connectionId ?? previous.connectionId
+      );
     }
+    if (result === 'admitted') this.notifyPeerRouteChanged(descriptor.nodeRoutingId);
     return result;
   }
 
@@ -1244,7 +1521,10 @@ export class RawServiceMeshRuntime {
 
   private removePeer(peer: AdmittedServicePeer): void {
     this.topology.disconnect(peer.descriptor.nodeRoutingId, peer.connectionId);
-    this.liveness.disconnect(peer.descriptor.nodeRoutingId, peer.connectionId);
+    this.liveness.disconnect(
+      peer.descriptor.nodeRoutingId,
+      peer.liveness?.connectionId ?? peer.connectionId
+    );
     this.onPeerDisconnected?.(
       peer.descriptor.nodeRoutingId,
       peer.descriptor.advertisedEndpoint,
@@ -1257,19 +1537,136 @@ export class RawServiceMeshRuntime {
     return this.router;
   }
 
-  private async send(targetNodeRoutingId: string, parts: readonly Uint8Array[]): Promise<boolean> {
+  private async sendControl(
+    targetNodeRoutingId: string,
+    parts: readonly Uint8Array[]
+  ): Promise<boolean> {
+    return this.startControlSend(targetNodeRoutingId, decodeHeader(parts[0]!).command, () =>
+      this.submitControl(targetNodeRoutingId, parts)
+    );
+  }
+
+  private submitControl(target: string, parts: readonly Uint8Array[]): boolean | Promise<boolean> {
+    let submission;
     try {
-      await this.requireStarted().send(targetNodeRoutingId, parts);
-      return true;
+      submission = this.requireStarted().submitSend(target, parts);
     } catch (error) {
-      if (isZLinkBackendResultError(error) && error.operation === 'submit') {
-        const terminal = submitToRequestResult(error.result, error.phase);
-        if (terminal === RequestResult.NotConnected || terminal === RequestResult.NotFound)
-          return false;
+      return this.sendFailure(error);
+    }
+    if (submission.result === SubmitResult.Ok) return true;
+    return submission.admitted.then(
+      () => true,
+      (error) => this.sendFailure(error)
+    );
+  }
+
+  private startControlSend(
+    target: string,
+    command: number,
+    attempt: () => boolean | Promise<boolean>,
+    current?: () => boolean,
+    hello?: Uint8Array
+  ): boolean {
+    const key = controlSendKey(target, command);
+    const existing = this.controlSends.get(key);
+    if (
+      existing !== undefined &&
+      existing.task !== undefined &&
+      (command !== M6aServiceWireCommand.hello || existing.current?.() === true)
+    ) {
+      if (command !== M6aServiceWireCommand.hello) {
+        existing.next = attempt;
+        existing.current = current;
       }
-      throw error;
+      return true;
+    }
+    const first = attempt();
+    if (typeof first === 'boolean') {
+      if (hello !== undefined) this.controlSends.set(key, { current, hello });
+      return first;
+    }
+    const owner = this;
+    const state: ControlSendState = { current, hello };
+    const completeSend = () => {
+      if (owner.controlSends.get(key) !== state) return;
+      if (hello !== undefined && current?.() === true) delete state.task;
+      else owner.controlSends.delete(key);
+    };
+    const task = first.then(function drain(accepted): boolean | Promise<boolean> {
+      if (!owner.closed && state.next !== undefined) {
+        const next = state.next;
+        delete state.next;
+        return Promise.resolve(next()).then(drain);
+      }
+      completeSend();
+      return accepted;
+    });
+    state.task = task;
+    this.controlSends.set(key, state);
+    task.then(
+      () => {},
+      (error) => {
+        completeSend();
+        if (this.infrastructureTaskRunner === undefined) this.reportInfrastructureFailure(error);
+      }
+    );
+    this.infrastructureTaskRunner?.runDetached('RouteMesh control SEND', async () => {
+      await task;
+    });
+    return true;
+  }
+
+  private reportInfrastructureFailure(error: unknown): void {
+    this.infrastructureFailure = {
+      error:
+        this.infrastructureFailure === undefined
+          ? error
+          : new AggregateError(
+              [this.infrastructureFailure.error, error],
+              'RouteMesh infrastructure failed.'
+            )
+    };
+    this.onReceiveReady?.();
+  }
+
+  private observeInfrastructureFailure(): void {
+    const failure = this.infrastructureFailure;
+    this.infrastructureFailure = undefined;
+    if (failure !== undefined) throw failure.error;
+  }
+
+  private send(
+    targetNodeRoutingId: string,
+    parts: readonly Uint8Array[]
+  ): boolean | Promise<boolean> {
+    try {
+      const submission = this.requireStarted().submitSend(targetNodeRoutingId, parts);
+      if (submission.result === SubmitResult.Ok) return true;
+      return submission.admitted.then(
+        () => true,
+        (error) => this.sendFailure(error)
+      );
+    } catch (error) {
+      return this.sendFailure(error);
     }
   }
+
+  private sendFailure(error: unknown): false {
+    if (isZLinkBackendResultError(error) && error.operation === 'submit') {
+      const terminal = submitToRequestResult(error.result, error.phase);
+      if (terminal === RequestResult.NotConnected || terminal === RequestResult.NotFound)
+        return false;
+    }
+    throw error;
+  }
+}
+
+function controlSendKey(target: string, command: number): string {
+  return JSON.stringify([target, command]);
+}
+
+function routeConnectionId(generation: bigint): string {
+  return `route:${generation}`;
 }
 
 /**
@@ -1309,14 +1706,6 @@ function isAlreadyDisconnectedError(error: unknown): boolean {
   return (error as { readonly nativeErrno?: unknown }).nativeErrno === nativeErrnoValues.ENOENT;
 }
 
-/**
- * An admission belongs to one Core selected route. Its connection identity is
- * that route's generation, an opaque token compared only for equality.
- */
-function routeConnectionId(routeGeneration: bigint): string {
-  return `route:${routeGeneration.toString()}`;
-}
-
 function describeInvalidAdmissionDescriptor(
   descriptor: ServiceNodeDescriptor,
   expected: ServicePeerAdmissionExpectation | undefined,