@zlink-systems/framework 0.30.0 → 0.30.1

package/src/runtime/foundation/raw-service-mesh-runtime.ts

@@ -2,6 +2,7 @@ import { constants as osConstants } from 'node:os';
 import { ApplicationIngressRecordOwner } from '../application-jobs/application-ingress-record-owner';
 import type {
   ApplicationJobPermitPort,
+  ApplicationJobReceiveRotationPort,
   ApplicationJobQueuePort
 } from '../application-jobs/contracts';
 import type {
@@ -13,11 +14,11 @@ import type {
 import { submitToRequestResult } from '../messaging/submission-result';
 import { RequestResult, SubmitResult, isZLinkBackendResultError } from '../backend/runtime-values';
 import { enumWireRejectReason } from '../protocol/service_wire_codec.generated';
+import { SERVICE_WIRE_PREFIX_SIZE } from './service-wire-binary-primitives';
 import { OperationRegistry, type PendingOperation } from './operation-registry';
 import { ServiceLivenessRegistry, type ServiceLivenessTick } from './service-liveness-registry';
 import { ServiceMailbox, type ServiceMailboxRecord } from './service-mailbox';
 import {
-  sameServiceNodeDescriptor,
   ServiceTopologyRegistry,
   validateDescriptor,
   type AdmittedServicePeer,
@@ -84,6 +85,7 @@ type RawServiceChannelTargetSelection =
 type ServiceApplicationPayloadInput = ServiceApplicationPayload | Buffer;
 
 export interface RawServiceIngressRecord {
+  readonly onAdmitted?: () => void;
   readonly command: number;
   readonly flags: number;
   readonly sourceRoutingId: string;
@@ -129,6 +131,7 @@ export interface RawServiceMeshRuntimeOptions {
 // Framework error code 13 (RequestTargetNotFound) is encoded as 14 on a
 // RequestResult.NotFound reply. Boundary transport results keep failureCode 0.
 const RAW_MESH_RECEIVE_RECORD_BUDGET = 64;
+const NODE_SEND_HEADER = encodeNodeSendHeader();
 const RAW_MESH_RECEIVE_BYTE_BUDGET = 4 * 1024 * 1024;
 export const RAW_MESH_RECEIVE_TIME_BUDGET_MS = 2;
 
@@ -140,6 +143,14 @@ const livenessCodec = createServiceWireCodec({
   commands: M6aServiceWireCommand
 });
 
+interface ControlSendState {
+  task?: Promise<boolean>;
+  next?: () => boolean | Promise<boolean>;
+  current?: () => boolean;
+  // Admission owns the first HELLO until ADMIT or route termination.
+  hello?: Uint8Array;
+}
+
 /**
  * RouteMesh M6A runtime built only on the public raw binding package.
  * It owns protocol, admission, mailbox, request and liveness state.
@@ -158,11 +169,11 @@ export class RawServiceMeshRuntime {
       readonly endpoint?: string;
       readonly securityIdentity?: string;
       readonly lifecycleGeneration?: bigint;
-      helloSubmittedGeneration?: bigint;
     }
   >();
   private readonly endpointOnlyPeers = new Set<string>();
   private readonly peerConnectionIntentRemoved = new Set<(nodeRoutingId: string) => void>();
+  private readonly peerRouteChanged = new Set<(nodeRoutingId: string) => void>();
   /**
    * The last observed Core selected route of each RID (Core ROUTER §10.1):
    * RID -> route generation. Only `observeSelectedRoutes` replaces it.
@@ -170,18 +181,13 @@ export class RawServiceMeshRuntime {
   private selectedRoutes = new Map<string, bigint>();
   private readonly bindingPort: ZLinkRawBindingPort;
   private readonly applicationJobQueue: ApplicationJobQueuePort;
+  private readonly nodeMailboxOwner: string;
   private readonly peerAdmissionSealed?: () => boolean;
   private readonly applicationJobStop = new AbortController();
   private receiveAcquisition?: Promise<ApplicationJobPermitPort>;
   private receivePermit?: ApplicationJobPermitPort;
-  private readonly controlSends = new Map<
-    string,
-    {
-      readonly task: Promise<boolean>;
-      next?: () => boolean | Promise<boolean>;
-      current?: () => boolean;
-    }
-  >();
+  private receiveRotation?: ApplicationJobReceiveRotationPort;
+  private readonly controlSends = new Map<string, ControlSendState>();
   private infrastructureFailure?: { readonly error: unknown };
   private readonly onReceiveReady?: () => void;
   private readonly infrastructureTaskRunner?: RawServiceMeshRuntimeOptions['infrastructureTaskRunner'];
@@ -195,6 +201,7 @@ export class RawServiceMeshRuntime {
   private router?: ZLinkRawRouterPort;
   private nextCorrelation = 1n;
   private serviceIngress?: RawServiceIngressHandler;
+  private serviceIngressAccepts?: (command: number) => boolean;
   private closed = false;
 
   constructor(options: RawServiceMeshRuntimeOptions) {
@@ -202,6 +209,7 @@ export class RawServiceMeshRuntime {
     this.infrastructureTaskRunner = options.infrastructureTaskRunner;
     this.operations = new OperationRegistry(undefined, options.onPendingOperationsChanged);
     this.descriptor = options.descriptor;
+    this.nodeMailboxOwner = `node:${options.descriptor.nodeRoutingId}`;
     this.topology = new ServiceTopologyRegistry(options.descriptor);
     this.mailbox = new ServiceMailbox(options.onMailboxReady);
     this.liveness = new ServiceLivenessRegistry(options.probeIntervalMs, options.peerTimeoutMs);
@@ -380,6 +388,36 @@ export class RawServiceMeshRuntime {
     };
   }
 
+  observePeerRoute(
+    nodeRoutingId: string
+  ): import('./durable-service-request').PeerRouteObservation {
+    const selected = this.selectedRoutes.get(nodeRoutingId);
+    const admitted = this.topology.admittedPeer(nodeRoutingId)?.liveness?.connectionId;
+    return {
+      generation: selected ?? (typeof admitted === 'bigint' ? admitted : undefined),
+      ready: admitted !== undefined && (selected === undefined || admitted === selected)
+    };
+  }
+
+  get requestStopSignal(): AbortSignal {
+    return this.applicationJobStop.signal;
+  }
+
+  observePeerRouteChanged(listener: (nodeRoutingId: string) => void): () => void {
+    this.peerRouteChanged.add(listener);
+    return () => {
+      this.peerRouteChanged.delete(listener);
+    };
+  }
+
+  hasSelectedPeerRoute(nodeRoutingId: string): boolean {
+    return this.selectedRoutes.has(nodeRoutingId);
+  }
+
+  private notifyPeerRouteChanged(nodeRoutingId: string): void {
+    for (const listener of this.peerRouteChanged) listener(nodeRoutingId);
+  }
+
   private notifyPeerConnectionIntentRemoved(nodeRoutingId: string): void {
     // Only the logical owner's removal publishes lifecycle termination.
     // A physical disconnect alone retains the connection expectation.
@@ -389,33 +427,36 @@ export class RawServiceMeshRuntime {
   }
 
   announcePeer(nodeRoutingId: string): Promise<boolean> {
-    const expected = this.expectedPeers.get(nodeRoutingId);
     const generation = this.selectedRoutes.get(nodeRoutingId);
-    if (
-      expected === undefined ||
-      generation === undefined ||
-      expected.helloSubmittedGeneration === generation ||
-      this.peerAdmissionSealed?.() === true
-    )
+    if (generation === undefined) return Promise.resolve(false);
+    const current = () => {
+      const admission = this.topology.routeAdmission(nodeRoutingId);
+      return (
+        this.selectedRoutes.get(nodeRoutingId) === generation &&
+        !(
+          admission?.connectionId === routeConnectionId(generation) &&
+          admission.remoteAdmitReceived === true
+        ) &&
+        this.peerAdmissionSealed?.() !== true
+      );
+    };
+    const key = controlSendKey(nodeRoutingId, M6aServiceWireCommand.hello);
+    if (!current()) {
+      this.controlSends.delete(key);
       return Promise.resolve(false);
-    const current = () =>
-      this.expectedPeers.get(nodeRoutingId) === expected &&
-      this.selectedRoutes.get(nodeRoutingId) === generation;
+    }
+    const existing = this.controlSends.get(key);
+    const hello =
+      existing?.current?.() === true
+        ? existing.hello!
+        : encodeRouteMeshAdmission(M6aServiceWireCommand.hello, this.topology.localDescriptor());
     return Promise.resolve(
       this.startControlSend(
         nodeRoutingId,
         M6aServiceWireCommand.hello,
-        () =>
-          this.submitControl(
-            nodeRoutingId,
-            [
-              encodeRouteMeshAdmission(M6aServiceWireCommand.hello, this.topology.localDescriptor())
-            ],
-            () => {
-              if (current()) expected.helloSubmittedGeneration = generation;
-            }
-          ),
-        current
+        () => this.submitControl(nodeRoutingId, [hello]),
+        current,
+        hello
       )
     );
   }
@@ -423,7 +464,7 @@ export class RawServiceMeshRuntime {
   isPeerRouteReady(nodeRoutingId: string, lifecycleGeneration?: bigint): boolean {
     // Admission is bound to the observed selected route: the route observer
     // removes the peer when that route ends or is replaced.
-    const peer = this.topology.peer(nodeRoutingId);
+    const peer = this.topology.admittedPeer(nodeRoutingId);
     return (
       peer !== undefined &&
       (lifecycleGeneration === undefined ||
@@ -470,12 +511,18 @@ export class RawServiceMeshRuntime {
     // placement and channel selectors therefore need the new mutable fields
     // on that same connection before the next request is selected; waiting for
     // a reconnect would leave a race where a drained node is selected again.
+    await this.publishLocalDescriptor(
+      this.topology.peers().map((peer) => peer.descriptor.nodeRoutingId)
+    );
+  }
+
+  private async publishLocalDescriptor(targets: readonly string[]): Promise<void> {
     const update = encodeRouteMeshAdmission(
       M6aServiceWireCommand.update,
       this.topology.localDescriptor()
     );
-    for (const peer of this.topology.peers()) {
-      await this.send(peer.descriptor.nodeRoutingId, [update]);
+    for (const target of targets) {
+      await this.sendService(target, [update]);
     }
   }
 
@@ -484,18 +531,14 @@ export class RawServiceMeshRuntime {
   }
 
   isObjectClientNodeDirectTarget(nodeRoutingId: string): boolean {
-    const descriptor =
-      nodeRoutingId === this.descriptor.nodeRoutingId
-        ? this.topology.localDescriptor()
-        : this.topology.knownDescriptor(nodeRoutingId);
-    return descriptor?.objectRole === 'client';
+    return this.topology.isObjectClientNodeDirectTarget(nodeRoutingId);
   }
 
-  async sendToNode(
+  sendToNode(
     targetNodeRoutingId: string,
     payload: ServiceApplicationPayloadInput
-  ): Promise<boolean> {
-    return this.send(targetNodeRoutingId, [encodeNodeSendHeader(), this.applicationFrame(payload)]);
+  ): boolean | Promise<boolean> {
+    return this.send(targetNodeRoutingId, [NODE_SEND_HEADER, this.applicationFrame(payload)]);
   }
 
   async sendToChannel(
@@ -517,15 +560,17 @@ export class RawServiceMeshRuntime {
   requestToNode(
     targetNodeRoutingId: string,
     payload: ServiceApplicationPayloadInput,
-    timeoutMs: number
+    timeoutMs: number,
+    onAdmitted?: () => void
   ): PendingOperation<RawServiceRequestResult> {
-    return this.requestToTarget(targetNodeRoutingId, payload, timeoutMs);
+    return this.requestToTarget(targetNodeRoutingId, payload, timeoutMs, undefined, onAdmitted);
   }
 
   requestToChannel(
     channelName: string,
     payload: ServiceApplicationPayloadInput,
-    timeoutMs: number
+    timeoutMs: number,
+    onAdmitted?: () => void
   ): PendingOperation<RawServiceRequestResult> {
     const selection = this.selectChannelTarget(channelName);
     if (selection.kind !== 'selected') {
@@ -537,7 +582,8 @@ export class RawServiceMeshRuntime {
       selection.peer.descriptor.nodeRoutingId,
       payload,
       timeoutMs,
-      channelName
+      channelName,
+      onAdmitted
     );
   }
 
@@ -562,11 +608,15 @@ export class RawServiceMeshRuntime {
         };
   }
 
-  setServiceIngress(handler: RawServiceIngressHandler): void {
+  setServiceIngress(
+    handler: RawServiceIngressHandler,
+    accepts?: (command: number) => boolean
+  ): void {
     if (this.serviceIngress !== undefined && this.serviceIngress !== handler) {
       throw new Error('Raw service ingress is already registered.');
     }
     this.serviceIngress = handler;
+    this.serviceIngressAccepts = accepts;
   }
 
   async reserveLocalIngress(signal?: AbortSignal): Promise<ApplicationIngressRecordOwner> {
@@ -579,20 +629,27 @@ export class RawServiceMeshRuntime {
   }
 
   async sendService(targetNodeRoutingId: string, parts: readonly Uint8Array[]): Promise<boolean> {
-    return this.send(targetNodeRoutingId, parts);
+    try {
+      await this.requireStarted().send(targetNodeRoutingId, parts);
+      return true;
+    } catch (error) {
+      return this.sendFailure(error);
+    }
   }
 
   requestService(
     targetNodeRoutingId: string,
     parts: readonly Uint8Array[],
-    timeoutMs: number
+    timeoutMs: number,
+    onAdmitted?: () => void
   ): Promise<readonly Buffer[]> {
-    const admission = this.topology.peer(targetNodeRoutingId)?.liveness;
+    const admission = this.topology.admittedPeer(targetNodeRoutingId)?.liveness;
     return this.requireStarted().request(
       targetNodeRoutingId,
       parts,
       timeoutMs,
-      admission?.recordReceived
+      admission?.recordReceived,
+      onAdmitted
     );
   }
 
@@ -668,59 +725,71 @@ export class RawServiceMeshRuntime {
     const observe: RawServicePumpObserver = (_source, byteCount) => {
       bytes += byteCount;
     };
-    while (receiveReady && messages < RAW_MESH_RECEIVE_RECORD_BUDGET && !this.closed) {
-      const result = await this.receiveOne(performance.now(), observe);
-      if (result === 'noData') {
-        receiveReady = false;
-        break;
+    const rotation = (this.receiveRotation ??= this.applicationJobQueue.createReceiveRotation(
+      RAW_MESH_RECEIVE_RECORD_BUDGET,
+      'remote'
+    ));
+    if (receiveReady) rotation.reserve();
+    try {
+      while (receiveReady && messages < RAW_MESH_RECEIVE_RECORD_BUDGET && !this.closed) {
+        const received = this.receiveOne(performance.now(), observe, rotation);
+        const result = received instanceof Promise ? await received : received;
+        if (result === 'noData') {
+          receiveReady = false;
+          break;
+        }
+        messages += 1;
+        // Core owns the per-peer fair-queue cursor. The Framework limit bounds
+        // the entire round, so changing peers does not renew its byte/count budget.
+        if (
+          bytes >= RAW_MESH_RECEIVE_BYTE_BUDGET ||
+          performance.now() - startedAtMs >= RAW_MESH_RECEIVE_TIME_BUDGET_MS
+        )
+          break;
       }
-      messages += 1;
-      // Core owns the per-peer fair-queue cursor. The Framework limit bounds
-      // the entire round, so changing peers does not renew its byte/count budget.
-      if (
-        bytes >= RAW_MESH_RECEIVE_BYTE_BUDGET ||
-        performance.now() - startedAtMs >= RAW_MESH_RECEIVE_TIME_BUDGET_MS
-      )
-        break;
+    } finally {
+      rotation.releaseUnused();
     }
     if (!this.closed) {
-      for (const nodeRoutingId of this.expectedPeers.keys()) {
-        if (this.topology.peer(nodeRoutingId) === undefined) await this.announcePeer(nodeRoutingId);
-      }
       this.tickLiveness();
     }
     return receiveReady && messages > 0;
   }
 
-  private async receiveOne(
+  private receiveOne(
     nowMs: number,
-    observe?: RawServicePumpObserver
-  ): Promise<RawServicePumpResult> {
+    observe?: RawServicePumpObserver,
+    rotation?: ApplicationJobReceiveRotationPort
+  ): RawServicePumpResult | Promise<RawServicePumpResult> {
     const router = this.requireStarted();
     this.observeInfrastructureFailure();
-    if (this.receivePermit === undefined && this.receiveAcquisition === undefined) {
-      let resolveAcquisition!: (permit: ApplicationJobPermitPort) => void;
-      let rejectAcquisition!: (error: unknown) => void;
-      const acquisition = new Promise<ApplicationJobPermitPort>((resolve, reject) => {
-        resolveAcquisition = resolve;
-        rejectAcquisition = reject;
-      });
-      const permit = this.applicationJobQueue.acquireOrResume(
+    let permit = this.receivePermit;
+    this.receivePermit = undefined;
+    permit ??= rotation?.take();
+    if (permit === undefined && this.receiveAcquisition === undefined) {
+      let resolveAcquisition: ((permit: ApplicationJobPermitPort) => void) | undefined;
+      let rejectAcquisition: ((error: unknown) => void) | undefined;
+      permit = this.applicationJobQueue.acquireOrResume(
         (permit) => {
           this.receiveAcquisition = undefined;
-          if (this.closed) permit.releaseAfterInternalProcessing();
-          else {
+          if (this.closed) {
+            permit.releaseAfterInternalProcessing();
+            permit.releaseStorage?.();
+          } else {
             this.receivePermit = permit;
             this.onReceiveReady?.();
           }
-          resolveAcquisition(permit);
+          resolveAcquisition?.(permit);
         },
-        rejectAcquisition,
+        (error) => rejectAcquisition?.(error),
         this.applicationJobStop.signal,
         'remote'
       );
-      if (permit !== undefined) this.receivePermit = permit;
-      else {
+      if (permit === undefined) {
+        const acquisition = new Promise<ApplicationJobPermitPort>((resolve, reject) => {
+          resolveAcquisition = resolve;
+          rejectAcquisition = reject;
+        });
         this.receiveAcquisition = acquisition;
         acquisition.catch((error) => {
           this.receiveAcquisition = undefined;
@@ -728,11 +797,10 @@ export class RawServiceMeshRuntime {
         });
       }
     }
-    const permit = this.receivePermit;
-    this.receivePermit = undefined;
     if (permit === undefined) return 'noData';
     if (this.closed) {
       permit.releaseAfterInternalProcessing();
+      permit.releaseStorage?.();
       return 'noData';
     }
     let received: ZLinkRawReceivedRecord | undefined;
@@ -740,10 +808,12 @@ export class RawServiceMeshRuntime {
       received = router.receive(true);
     } catch (error) {
       permit.releaseAfterInternalProcessing();
+      permit.releaseStorage?.();
       throw error;
     }
     if (received === undefined) {
       permit.releaseAfterInternalProcessing();
+      permit.releaseStorage?.();
       return 'noData';
     }
     const applicationJobOwner = ApplicationIngressRecordOwner.create(
@@ -751,18 +821,40 @@ export class RawServiceMeshRuntime {
       permit,
       received
     );
+    let result: RawServicePumpResult | Promise<RawServicePumpResult>;
+    try {
+      result = this.processReceived(received, nowMs, applicationJobOwner);
+    } catch (error) {
+      applicationJobOwner.close();
+      throw error;
+    }
+    return result instanceof Promise
+      ? result.then(
+          (value) => this.finishReceive(received, applicationJobOwner, observe, value),
+          (error) => {
+            applicationJobOwner.close();
+            throw error;
+          }
+        )
+      : this.finishReceive(received, applicationJobOwner, observe, result);
+  }
+
+  private finishReceive(
+    received: ZLinkRawReceivedRecord,
+    owner: ApplicationIngressRecordOwner,
+    observe: RawServicePumpObserver | undefined,
+    result: RawServicePumpResult
+  ): RawServicePumpResult {
     try {
-      const result = await this.processReceived(received, nowMs, applicationJobOwner);
-      if (result === 'protocolError') {
-        this.reportProtocolError(received);
+      if (result === 'protocolError') this.reportProtocolError(received);
+      if (observe !== undefined) {
+        let bytes = 0;
+        for (const part of received.parts) bytes += part.byteLength;
+        observe(received.sourceRid, bytes);
       }
-      observe?.(
-        received.sourceRid,
-        received.parts.reduce((sum, part) => sum + part.byteLength, 0)
-      );
       return result;
     } finally {
-      applicationJobOwner.close();
+      owner.close();
     }
   }
 
@@ -808,22 +900,15 @@ export class RawServiceMeshRuntime {
     }
   }
 
-  private async processReceived(
+  private processReceived(
     received: ZLinkRawReceivedRecord,
     nowMs: number,
     applicationJobOwner: ApplicationIngressRecordOwner
-  ): Promise<RawServicePumpResult> {
-    if (
-      received.parts.length === 0 ||
-      (received.parts.length === 1 && received.parts[0]!.byteLength === 0)
-    ) {
-      if (this.peerAdmissionSealed?.() === true) return 'dropped';
-      return (await this.sendControl(received.sourceRid, [
-        encodeRouteMeshAdmission(M6aServiceWireCommand.hello, this.topology.localDescriptor())
-      ]))
-        ? 'infrastructure'
-        : 'dropped';
-    }
+  ): RawServicePumpResult | Promise<RawServicePumpResult> {
+    const peer = this.topology.admittedPeer(received.sourceRid);
+    const currentSource =
+      peer?.liveness !== undefined && peer.liveness.connectionId === received.routeGeneration;
+    if (received.parts.length === 0) return currentSource ? 'protocolError' : 'dropped';
     try {
       const header = decodeHeader(received.parts[0]!);
       if (header.command === M6aServiceWireCommand.hello && this.peerAdmissionSealed?.() === true) {
@@ -831,107 +916,186 @@ export class RawServiceMeshRuntime {
       }
       if (
         header.command === M6aServiceWireCommand.hello ||
-        header.command === M6aServiceWireCommand.admit ||
-        header.command === M6aServiceWireCommand.update
+        header.command === M6aServiceWireCommand.admit
       ) {
-        if (received.parts.length !== 1) return 'protocolError';
-        const descriptor = decodeRouteMeshAdmission(
-          received.parts[0]!,
-          header.command,
-          received.sourceRid
+        return this.processAdmission(received, header, nowMs).catch((error) =>
+          this.receiveProtocolFailure(error)
         );
-        const expected = this.expectedPeers.get(received.sourceRid);
-        if (
-          expected !== undefined &&
-          (expected.meshName !== descriptor.meshName ||
-            expected.nodeRoutingId !== descriptor.nodeRoutingId)
-        ) {
-          await this.sendControl(received.sourceRid, [
-            encodeReject(enumWireRejectReason('identityMismatch'))
-          ]);
-          return 'infrastructure';
-        }
-        const result = this.admitPeer(descriptor, received.routeGeneration, nowMs, expected);
-        if (result !== 'admitted' && result !== 'notRequired') {
-          const detail =
-            result === 'invalidDescriptor'
-              ? describeInvalidAdmissionDescriptor(
-                  descriptor,
-                  expected,
-                  this.topology.peer(descriptor.nodeRoutingId)?.descriptor
-                )
-              : undefined;
-          console.warn(
-            `RouteMesh admission rejected peer '${received.sourceRid}' as ${result}` +
-              (detail === undefined ? '.' : ` (${detail}).`)
-          );
-          await this.sendControl(received.sourceRid, [encodeReject(admissionReason(result))]);
-          return 'infrastructure';
-        }
-        if (result === 'admitted') this.selectBilateralConnection(descriptor);
-        if (header.command === M6aServiceWireCommand.hello) {
-          // Hello supplies only the sender's descriptor. Even NotRequired
-          // peers must receive ours before the intent owner closes transport;
-          // submitting a response does not guarantee delivery before close.
-          await this.sendControl(received.sourceRid, [
-            encodeRouteMeshAdmission(M6aServiceWireCommand.admit, this.topology.localDescriptor())
-          ]);
-        } else if (result === 'notRequired') {
-          this.retireNotRequiredExpectedPeer(received.sourceRid, descriptor.advertisedEndpoint);
-        }
-        return 'infrastructure';
       }
       if (header.command === M6aServiceWireCommand.reject) {
         if (received.parts.length !== 1) return 'protocolError';
         decodeReject(received.parts[0]!);
         return 'infrastructure';
       }
-      const peer = this.topology.peer(received.sourceRid);
-      if (peer === undefined) return 'protocolError';
-      if (peer.liveness !== undefined && peer.liveness.connectionId === received.routeGeneration)
-        this.liveness.recordReceived(peer.liveness, nowMs);
+      if (!currentSource) return 'dropped';
+      this.liveness.recordReceived(peer.liveness, nowMs);
+      if (header.command === M6aServiceWireCommand.update) {
+        return this.processAdmission(received, header, nowMs).catch((error) =>
+          this.receiveProtocolFailure(error)
+        );
+      }
       if (
         header.command === M6aServiceWireCommand.livenessProbe ||
         header.command === M6aServiceWireCommand.livenessAck
       ) {
-        if (received.parts.length !== 1) return 'protocolError';
-        const record = livenessCodec.decodeLivenessRecord(received.parts[0]!);
-        if (record.command === M6aServiceWireCommand.livenessProbe) {
-          const ack = this.liveness.acknowledgeProbe(
-            received.sourceRid,
-            received.routeGeneration,
-            record.probeId
-          );
-          if (ack === undefined) return 'protocolError';
-          const sent = await this.sendControl(received.sourceRid, [
-            livenessCodec.encodeLivenessRecord({
-              command: M6aServiceWireCommand.livenessAck,
-              probeId: record.probeId
-            })
-          ]);
-          if (!sent) return 'dropped';
-        } else {
-          this.liveness.acknowledge(
-            received.sourceRid,
-            received.routeGeneration,
-            record.probeId,
-            nowMs
-          );
-        }
-        return 'infrastructure';
+        return this.processLiveness(received, nowMs).catch((error) =>
+          this.receiveProtocolFailure(error)
+        );
       }
-      const stateful = await this.serviceIngress?.({
-        command: header.command,
-        flags: header.flags,
-        sourceRoutingId: received.sourceRid,
-        sourceNodeGeneration: peer.descriptor.lifecycleGeneration,
-        sourceRoute: received.sourceRoute,
-        ...(received.reply === undefined ? {} : { reply: received.reply }),
-        ...(received.requestSeq === undefined ? {} : { requestSequence: received.requestSeq }),
-        parts: received.parts,
-        applicationJobOwner
-      });
+      const stateful =
+        this.serviceIngress !== undefined && this.serviceIngressAccepts?.(header.command) !== false
+          ? this.serviceIngress({
+              command: header.command,
+              flags: header.flags,
+              sourceRoutingId: received.sourceRid,
+              sourceNodeGeneration: peer.descriptor.lifecycleGeneration,
+              sourceRoute: received.sourceRoute,
+              ...(received.reply === undefined ? {} : { reply: received.reply }),
+              ...(received.requestSeq === undefined
+                ? {}
+                : { requestSequence: received.requestSeq }),
+              parts: received.parts,
+              applicationJobOwner
+            })
+          : undefined;
+      if (stateful instanceof Promise)
+        return stateful.then(
+          (result) =>
+            result ?? this.processApplicationReceived(received, header, applicationJobOwner),
+          (error) => this.receiveProtocolFailure(error)
+        );
       if (stateful !== undefined) return stateful;
+      return this.processApplicationReceived(received, header, applicationJobOwner);
+    } catch (error) {
+      if (!currentSource && error instanceof ServiceWireProtocolError) return 'dropped';
+      return this.receiveProtocolFailure(error);
+    }
+  }
+
+  private receiveProtocolFailure(error: unknown): RawServicePumpResult {
+    if (error instanceof ServiceWireProtocolError) return 'protocolError';
+    throw error;
+  }
+
+  private async processAdmission(
+    received: ZLinkRawReceivedRecord,
+    header: ReturnType<typeof decodeHeader>,
+    nowMs: number
+  ): Promise<RawServicePumpResult> {
+    if (received.parts.length !== 1) return 'protocolError';
+    const descriptor = decodeRouteMeshAdmission(
+      received.parts[0]!,
+      header.command,
+      received.sourceRid
+    );
+    const expected = this.expectedPeers.get(received.sourceRid);
+    if (
+      expected !== undefined &&
+      (expected.meshName !== descriptor.meshName ||
+        expected.nodeRoutingId !== descriptor.nodeRoutingId)
+    ) {
+      await this.sendControl(received.sourceRid, [
+        encodeReject(enumWireRejectReason('identityMismatch'))
+      ]);
+      return 'infrastructure';
+    }
+    const helloKey = controlSendKey(received.sourceRid, M6aServiceWireCommand.hello);
+    const exchange = this.controlSends.get(helloKey);
+    const result = this.admitPeer(
+      descriptor,
+      received.routeGeneration,
+      nowMs,
+      expected,
+      header.command,
+      received.parts[0]!.subarray(SERVICE_WIRE_PREFIX_SIZE)
+    );
+    if (result !== 'admitted' && result !== 'notRequired') {
+      const detail =
+        result === 'invalidDescriptor'
+          ? describeInvalidAdmissionDescriptor(
+              descriptor,
+              expected,
+              this.topology.peer(descriptor.nodeRoutingId)?.descriptor
+            )
+          : undefined;
+      console.warn(
+        `RouteMesh admission rejected peer '${received.sourceRid}' as ${result}` +
+          (detail === undefined ? '.' : ` (${detail}).`)
+      );
+      await this.sendControl(received.sourceRid, [encodeReject(admissionReason(result))]);
+      return 'infrastructure';
+    }
+    if (result === 'admitted') this.selectBilateralConnection(descriptor);
+    if (header.command === M6aServiceWireCommand.hello) {
+      // Hello supplies only the sender's descriptor. Even NotRequired
+      // peers must receive ours before the intent owner closes transport;
+      // submitting a response does not guarantee delivery before close.
+      const local =
+        exchange?.current?.() === true && exchange.hello !== undefined
+          ? decodeRouteMeshAdmission(
+              exchange.hello,
+              M6aServiceWireCommand.hello,
+              this.descriptor.nodeRoutingId
+            )
+          : this.topology.localDescriptor();
+      await this.sendControl(received.sourceRid, [
+        encodeRouteMeshAdmission(M6aServiceWireCommand.admit, local)
+      ]);
+    } else if (header.command === M6aServiceWireCommand.admit) {
+      this.controlSends.delete(helloKey);
+      if (result === 'notRequired') {
+        this.retireNotRequiredExpectedPeer(received.sourceRid, descriptor.advertisedEndpoint);
+      } else if (
+        exchange?.hello !== undefined &&
+        decodeRouteMeshAdmission(
+          exchange.hello,
+          M6aServiceWireCommand.hello,
+          this.descriptor.nodeRoutingId
+        ).descriptorRevision < this.descriptor.descriptorRevision
+      ) {
+        await this.publishLocalDescriptor([received.sourceRid]);
+      }
+    }
+    return 'infrastructure';
+  }
+
+  private async processLiveness(
+    received: ZLinkRawReceivedRecord,
+    nowMs: number
+  ): Promise<RawServicePumpResult> {
+    if (received.parts.length !== 1) return 'protocolError';
+    const record = livenessCodec.decodeLivenessRecord(received.parts[0]!);
+    if (record.command === M6aServiceWireCommand.livenessProbe) {
+      const ack = this.liveness.acknowledgeProbe(
+        received.sourceRid,
+        received.routeGeneration,
+        record.probeId
+      );
+      if (ack === undefined) return 'protocolError';
+      const sent = await this.sendControl(received.sourceRid, [
+        livenessCodec.encodeLivenessRecord({
+          command: M6aServiceWireCommand.livenessAck,
+          probeId: record.probeId
+        })
+      ]);
+      if (!sent) return 'dropped';
+    } else {
+      this.liveness.acknowledge(
+        received.sourceRid,
+        received.routeGeneration,
+        record.probeId,
+        nowMs
+      );
+    }
+    return 'infrastructure';
+  }
+
+  private processApplicationReceived(
+    received: ZLinkRawReceivedRecord,
+    header: ReturnType<typeof decodeHeader>,
+    applicationJobOwner: ApplicationIngressRecordOwner
+  ): RawServicePumpResult | Promise<RawServicePumpResult> {
+    try {
       if (
         header.flags === 0 &&
         // A bare infrastructure control is normally exactly one frame, but a
@@ -949,7 +1113,7 @@ export class RawServiceMeshRuntime {
         isBareInfrastructureControl(header.command)
       ) {
         const accepted = this.mailbox.tryEnqueue({
-          owner: `node:${this.descriptor.nodeRoutingId}`,
+          owner: this.nodeMailboxOwner,
           domain: 'infrastructure',
           parts: received.parts,
           sourceRoutingId: received.sourceRid,
@@ -974,50 +1138,60 @@ export class RawServiceMeshRuntime {
       let owner: string;
       let correlation: bigint | undefined;
       if (header.command === M6aServiceWireCommand.nodeSend) {
-        owner = `node:${this.descriptor.nodeRoutingId}`;
+        owner = this.nodeMailboxOwner;
       } else if (header.command === M6aServiceWireCommand.nodeRequest) {
-        owner = `node:${this.descriptor.nodeRoutingId}`;
-        correlation = decodeNodeRequestHeader(received.parts[0]!);
+        owner = this.nodeMailboxOwner;
+        correlation = decodeNodeRequestHeader(received.parts[0]!, header);
       } else if (header.command === M6aServiceWireCommand.channelSend) {
-        owner = `channel:${decodeChannelSendHeader(received.parts[0]!)}`;
+        owner = `channel:${decodeChannelSendHeader(received.parts[0]!, header)}`;
       } else {
-        const channel = decodeChannelRequestHeader(received.parts[0]!);
+        const channel = decodeChannelRequestHeader(received.parts[0]!, header);
         owner = `channel:${channel.channelName}`;
         correlation = channel.correlation;
       }
-      const applicationJob = await applicationJobOwner.acquire('application');
-      const accepted = this.mailbox.tryEnqueue({
-        owner,
-        domain: 'application',
-        parts: received.parts,
-        sourceRoutingId: received.sourceRid,
-        sourceRoute: received.sourceRoute,
-        ...(received.reply === undefined ? {} : { reply: received.reply }),
-        requestSequence: received.requestSeq,
-        ...(correlation === undefined ? {} : { correlation }),
-        applicationJob
-      });
-      if (accepted) return 'application';
-      applicationJob.close();
-      if (correlation !== undefined && received.requestSeq !== undefined) {
-        this.replyService(
-          {
-            sourceRoutingId: received.sourceRid,
-            sourceRoute: received.sourceRoute,
-            requestSequence: received.requestSeq,
-            ...(received.reply === undefined ? {} : { reply: received.reply })
-          },
-          [encodeReplyHeader(correlation, RequestResult.NotConnected, 0)]
-        );
-        return 'infrastructure';
-      }
-      return 'dropped';
+      const job = applicationJobOwner.acquire('application');
+      return job instanceof Promise
+        ? job.then((permit) => this.enqueueOrdinaryRecord(received, owner, correlation, permit))
+        : this.enqueueOrdinaryRecord(received, owner, correlation, job);
     } catch (error) {
-      if (error instanceof ServiceWireProtocolError) return 'protocolError';
-      throw error;
+      return this.receiveProtocolFailure(error);
     }
   }
 
+  private enqueueOrdinaryRecord(
+    received: ZLinkRawReceivedRecord,
+    owner: string,
+    correlation: bigint | undefined,
+    applicationJob: import('../application-jobs/application-ingress-record-owner').ApplicationJobRecordLease
+  ): RawServicePumpResult {
+    const accepted = this.mailbox.tryEnqueue({
+      owner,
+      domain: 'application',
+      parts: received.parts,
+      sourceRoutingId: received.sourceRid,
+      sourceRoute: received.sourceRoute,
+      ...(received.reply === undefined ? {} : { reply: received.reply }),
+      requestSequence: received.requestSeq,
+      ...(correlation === undefined ? {} : { correlation }),
+      applicationJob
+    });
+    if (accepted) return 'application';
+    applicationJob.close();
+    if (correlation !== undefined && received.requestSeq !== undefined) {
+      this.replyService(
+        {
+          sourceRoutingId: received.sourceRid,
+          sourceRoute: received.sourceRoute,
+          requestSequence: received.requestSeq,
+          ...(received.reply === undefined ? {} : { reply: received.reply })
+        },
+        [encodeReplyHeader(correlation, RequestResult.NotConnected, 0)]
+      );
+      return 'infrastructure';
+    }
+    return 'dropped';
+  }
+
   expireOperations(nowMs: number, turnDeadlineMs: number): number {
     return this.operations.expire(nowMs, turnDeadlineMs);
   }
@@ -1029,6 +1203,7 @@ export class RawServiceMeshRuntime {
   tickLiveness(nowMs = performance.now()): ServiceLivenessTick {
     const result = this.liveness.tick(nowMs);
     this.requireStarted();
+    for (const nodeRoutingId of this.selectedRoutes.keys()) void this.announcePeer(nodeRoutingId);
     for (const probe of result.probes) {
       const parts = [
         livenessCodec.encodeLivenessRecord({
@@ -1065,9 +1240,8 @@ export class RawServiceMeshRuntime {
     let changes = 0;
     for (const [nodeRoutingId, generation] of this.selectedRoutes) {
       if (observed.get(nodeRoutingId) === generation) continue;
+      this.controlSends.delete(controlSendKey(nodeRoutingId, M6aServiceWireCommand.hello));
       changes++;
-      const expected = this.expectedPeers.get(nodeRoutingId);
-      if (expected !== undefined) delete expected.helloSubmittedGeneration;
       const peer = this.topology.peer(nodeRoutingId);
       if (peer?.liveness?.connectionId === generation) {
         this.removePeer(peer);
@@ -1080,6 +1254,7 @@ export class RawServiceMeshRuntime {
       selected.push(nodeRoutingId);
     }
     this.selectedRoutes = observed;
+    for (const nodeRoutingId of selected) this.notifyPeerRouteChanged(nodeRoutingId);
     // A new selected route admits only through a new handshake.
     for (const nodeRoutingId of selected) await this.announcePeer(nodeRoutingId);
     return changes;
@@ -1092,8 +1267,10 @@ export class RawServiceMeshRuntime {
       new Error('Raw service runtime application job admission stopped.')
     );
     this.receivePermit?.releaseAfterInternalProcessing();
+    this.receivePermit?.releaseStorage?.();
     this.receivePermit = undefined;
     for (const send of this.controlSends.values()) delete send.next;
+    this.controlSends.clear();
     this.mailbox.close();
     this.operations.close('Raw service runtime closed.');
     this.serviceIngress = undefined;
@@ -1111,7 +1288,8 @@ export class RawServiceMeshRuntime {
     targetNodeRoutingId: string,
     payload: ServiceApplicationPayloadInput,
     timeoutMs: number,
-    channelName?: string
+    channelName?: string,
+    onAdmitted?: () => void
   ): PendingOperation<RawServiceRequestResult> {
     const correlation = this.nextCorrelation++;
     const header =
@@ -1182,6 +1360,8 @@ export class RawServiceMeshRuntime {
               terminalResult: RequestResult.NotConnected,
               failureCode: 0
             });
+          } else {
+            onAdmitted?.();
           }
         } finally {
           applicationJobOwner.close();
@@ -1189,7 +1369,7 @@ export class RawServiceMeshRuntime {
       })().catch((error) => this.operations.fail(pending.id, error));
       return pending;
     }
-    const selectedPeer = this.topology.peer(selectedTargetNodeRoutingId);
+    const selectedPeer = this.topology.admittedPeer(selectedTargetNodeRoutingId);
     if (selectedPeer === undefined) {
       // Logical target selection is the requester's decision: an RID that is
       // not an admitted peer is not a target. Whether an admitted target's
@@ -1207,7 +1387,8 @@ export class RawServiceMeshRuntime {
         selectedTargetNodeRoutingId,
         parts,
         timeoutMs,
-        selectedPeer.liveness?.recordReceived
+        selectedPeer.liveness?.recordReceived,
+        onAdmitted
       );
     } catch (error) {
       this.operations.fail(pending.id, error);
@@ -1274,33 +1455,37 @@ export class RawServiceMeshRuntime {
       readonly endpoint?: string;
       readonly securityIdentity?: string;
       readonly lifecycleGeneration?: bigint;
-    }
+    },
+    command: number = M6aServiceWireCommand.hello,
+    descriptorBytes?: Uint8Array
   ): PeerAdmissionResult {
     const previous = this.topology.peer(descriptor.nodeRoutingId);
-    if (
-      previous !== undefined &&
-      previous.descriptor.lifecycleGeneration === descriptor.lifecycleGeneration &&
-      (descriptor.descriptorRevision < previous.descriptor.descriptorRevision ||
-        (descriptor.descriptorRevision === previous.descriptor.descriptorRevision &&
-          !sameServiceNodeDescriptor(previous.descriptor, descriptor)))
-    ) {
+    const topologyConnectionId =
+      typeof connectionId === 'bigint' ? routeConnectionId(connectionId) : connectionId;
+    const result = this.topology.admit(
+      descriptor,
+      topologyConnectionId,
+      expected,
+      () => {
+        const admission = this.liveness.admit(descriptor.nodeRoutingId, connectionId, nowMs);
+        this.liveness.recordReceived(admission, nowMs);
+        return admission;
+      },
+      command,
+      descriptorBytes
+    );
+    if (result === 'staleDescriptor') {
       throw new ServiceWireProtocolError(
         `RouteMesh peer '${descriptor.nodeRoutingId}' descriptor revision is stale or conflicting.`
       );
     }
-    const topologyConnectionId =
-      typeof connectionId === 'bigint' ? `route:${connectionId}` : connectionId;
-    const result = this.topology.admit(descriptor, topologyConnectionId, expected, () => {
-      const admission = this.liveness.admit(descriptor.nodeRoutingId, connectionId, nowMs);
-      this.liveness.recordReceived(admission, nowMs);
-      return admission;
-    });
     if (result === 'notRequired' && previous !== undefined) {
       this.liveness.disconnect(
         descriptor.nodeRoutingId,
         previous.liveness?.connectionId ?? previous.connectionId
       );
     }
+    if (result === 'admitted') this.notifyPeerRouteChanged(descriptor.nodeRoutingId);
     return result;
   }
 
@@ -1361,26 +1546,16 @@ export class RawServiceMeshRuntime {
     );
   }
 
-  private submitControl(
-    target: string,
-    parts: readonly Uint8Array[],
-    accepted?: () => void
-  ): boolean | Promise<boolean> {
+  private submitControl(target: string, parts: readonly Uint8Array[]): boolean | Promise<boolean> {
     let submission;
     try {
       submission = this.requireStarted().submitSend(target, parts);
     } catch (error) {
       return this.sendFailure(error);
     }
-    if (submission.result === SubmitResult.Ok) {
-      accepted?.();
-      return true;
-    }
+    if (submission.result === SubmitResult.Ok) return true;
     return submission.admitted.then(
-      () => {
-        accepted?.();
-        return true;
-      },
+      () => true,
       (error) => this.sendFailure(error)
     );
   }
@@ -1389,12 +1564,14 @@ export class RawServiceMeshRuntime {
     target: string,
     command: number,
     attempt: () => boolean | Promise<boolean>,
-    current?: () => boolean
+    current?: () => boolean,
+    hello?: Uint8Array
   ): boolean {
-    const key = JSON.stringify([target, command]);
+    const key = controlSendKey(target, command);
     const existing = this.controlSends.get(key);
     if (
       existing !== undefined &&
+      existing.task !== undefined &&
       (command !== M6aServiceWireCommand.hello || existing.current?.() === true)
     ) {
       if (command !== M6aServiceWireCommand.hello) {
@@ -1404,34 +1581,37 @@ export class RawServiceMeshRuntime {
       return true;
     }
     const first = attempt();
-    if (typeof first === 'boolean') return first;
+    if (typeof first === 'boolean') {
+      if (hello !== undefined) this.controlSends.set(key, { current, hello });
+      return first;
+    }
     const owner = this;
-    const state: {
-      task: Promise<boolean>;
-      next?: () => boolean | Promise<boolean>;
-      current?: () => boolean;
-    } = {
-      current,
-      task: first.then(function drain(accepted): boolean | Promise<boolean> {
-        if (!owner.closed && state.next !== undefined) {
-          const next = state.next;
-          delete state.next;
-          return Promise.resolve(next()).then(drain);
-        }
-        if (owner.controlSends.get(key) === state) owner.controlSends.delete(key);
-        return accepted;
-      })
+    const state: ControlSendState = { current, hello };
+    const completeSend = () => {
+      if (owner.controlSends.get(key) !== state) return;
+      if (hello !== undefined && current?.() === true) delete state.task;
+      else owner.controlSends.delete(key);
     };
+    const task = first.then(function drain(accepted): boolean | Promise<boolean> {
+      if (!owner.closed && state.next !== undefined) {
+        const next = state.next;
+        delete state.next;
+        return Promise.resolve(next()).then(drain);
+      }
+      completeSend();
+      return accepted;
+    });
+    state.task = task;
     this.controlSends.set(key, state);
-    state.task.then(
+    task.then(
       () => {},
       (error) => {
-        if (this.controlSends.get(key) === state) this.controlSends.delete(key);
+        completeSend();
         if (this.infrastructureTaskRunner === undefined) this.reportInfrastructureFailure(error);
       }
     );
     this.infrastructureTaskRunner?.runDetached('RouteMesh control SEND', async () => {
-      await state.task;
+      await task;
     });
     return true;
   }
@@ -1455,17 +1635,20 @@ export class RawServiceMeshRuntime {
     if (failure !== undefined) throw failure.error;
   }
 
-  private send(targetNodeRoutingId: string, parts: readonly Uint8Array[]): Promise<boolean> {
-    return this.requireStarted()
-      .send(targetNodeRoutingId, parts)
-      .then(
-        () => {
-          return true;
-        },
-        (error) => {
-          return this.sendFailure(error);
-        }
+  private send(
+    targetNodeRoutingId: string,
+    parts: readonly Uint8Array[]
+  ): boolean | Promise<boolean> {
+    try {
+      const submission = this.requireStarted().submitSend(targetNodeRoutingId, parts);
+      if (submission.result === SubmitResult.Ok) return true;
+      return submission.admitted.then(
+        () => true,
+        (error) => this.sendFailure(error)
       );
+    } catch (error) {
+      return this.sendFailure(error);
+    }
   }
 
   private sendFailure(error: unknown): false {
@@ -1478,6 +1661,14 @@ export class RawServiceMeshRuntime {
   }
 }
 
+function controlSendKey(target: string, command: number): string {
+  return JSON.stringify([target, command]);
+}
+
+function routeConnectionId(generation: bigint): string {
+  return `route:${generation}`;
+}
+
 /**
  * Relocation and bound-Session controls are service-wire records themselves,
  * not application NodeSend(16) envelopes. Keep this list closed: a bare