@zlink-systems/framework 0.30.0 → 0.30.2

package/dist/runtime/foundation/raw-service-mesh-runtime.js

@@ -6,6 +6,7 @@ const application_ingress_record_owner_1 = require("../application-jobs/applicat
 const submission_result_1 = require("../messaging/submission-result");
 const runtime_values_1 = require("../backend/runtime-values");
 const service_wire_codec_generated_1 = require("../protocol/service_wire_codec.generated");
+const service_wire_binary_primitives_1 = require("./service-wire-binary-primitives");
 const operation_registry_1 = require("./operation-registry");
 const service_liveness_registry_1 = require("./service-liveness-registry");
 const service_mailbox_1 = require("./service-mailbox");
@@ -17,6 +18,7 @@ const nativeErrnoValues = node_os_1.constants.errno;
 // Framework error code 13 (RequestTargetNotFound) is encoded as 14 on a
 // RequestResult.NotFound reply. Boundary transport results keep failureCode 0.
 const RAW_MESH_RECEIVE_RECORD_BUDGET = 64;
+const NODE_SEND_HEADER = (0, service_wire_m6a_codec_1.encodeNodeSendHeader)();
 const RAW_MESH_RECEIVE_BYTE_BUDGET = 4 * 1024 * 1024;
 exports.RAW_MESH_RECEIVE_TIME_BUDGET_MS = 2;
 const REQUEST_TARGET_NOT_FOUND_FAILURE_CODE = service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestTargetNotFound;
@@ -37,6 +39,7 @@ class RawServiceMeshRuntime {
     expectedPeers = new Map();
     endpointOnlyPeers = new Set();
     peerConnectionIntentRemoved = new Set();
+    peerRouteChanged = new Set();
     /**
      * The last observed Core selected route of each RID (Core ROUTER §10.1):
      * RID -> route generation. Only `observeSelectedRoutes` replaces it.
@@ -44,10 +47,12 @@ class RawServiceMeshRuntime {
     selectedRoutes = new Map();
     bindingPort;
     applicationJobQueue;
+    nodeMailboxOwner;
     peerAdmissionSealed;
     applicationJobStop = new AbortController();
     receiveAcquisition;
     receivePermit;
+    receiveRotation;
     controlSends = new Map();
     infrastructureFailure;
     onReceiveReady;
@@ -62,12 +67,14 @@ class RawServiceMeshRuntime {
     router;
     nextCorrelation = 1n;
     serviceIngress;
+    serviceIngressAccepts;
     closed = false;
     constructor(options) {
         this.onReceiveReady = options.onReceiveReady;
         this.infrastructureTaskRunner = options.infrastructureTaskRunner;
         this.operations = new operation_registry_1.OperationRegistry(undefined, options.onPendingOperationsChanged);
         this.descriptor = options.descriptor;
+        this.nodeMailboxOwner = `node:${options.descriptor.nodeRoutingId}`;
         this.topology = new service_topology_registry_1.ServiceTopologyRegistry(options.descriptor);
         this.mailbox = new service_mailbox_1.ServiceMailbox(options.onMailboxReady);
         this.liveness = new service_liveness_registry_1.ServiceLivenessRegistry(options.probeIntervalMs, options.peerTimeoutMs);
@@ -170,13 +177,15 @@ class RawServiceMeshRuntime {
                 router.disconnectRid(nodeRoutingId);
             }
             else {
-                router.disconnect(endpoint);
+                try {
+                    router.disconnect(endpoint);
+                }
+                catch (error) {
+                    if (!isAlreadyDisconnectedError(error))
+                        throw error;
+                }
             }
         }
-        catch (error) {
-            if (!isAlreadyDisconnectedError(error))
-                throw error;
-        }
         finally {
             if (current !== undefined)
                 this.removePeer(current);
@@ -222,6 +231,58 @@ class RawServiceMeshRuntime {
             this.peerConnectionIntentRemoved.delete(listener);
         };
     }
+    observePeerRoute(nodeRoutingId) {
+        const selected = this.selectedRoutes.get(nodeRoutingId);
+        const admitted = this.topology.admittedPeer(nodeRoutingId)?.liveness?.connectionId;
+        return {
+            generation: selected ?? (typeof admitted === 'bigint' ? admitted : undefined),
+            ready: admitted !== undefined && (selected === undefined || admitted === selected)
+        };
+    }
+    async waitForPeerRoute(nodeRoutingId, lifecycleGeneration, deadlineUnixMs, signal) {
+        const remaining = deadlineUnixMs - BigInt(Date.now());
+        if (remaining <= 0n)
+            throw new operation_registry_1.OperationTimeoutError(0n);
+        const pending = this.operations.register(Number(remaining));
+        const check = () => {
+            if (this.isPeerRouteReady(nodeRoutingId, lifecycleGeneration)) {
+                this.operations.complete(pending.id, { terminalResult: runtime_values_1.RequestResult.Ok, failureCode: 0 });
+            }
+        };
+        const unsubscribe = this.observePeerRouteChanged((rid) => {
+            if (rid === nodeRoutingId)
+                check();
+        });
+        const abort = () => this.operations.fail(pending.id, signal?.reason);
+        signal?.addEventListener('abort', abort, { once: true });
+        try {
+            if (signal?.aborted === true)
+                abort();
+            else
+                check();
+            await pending.promise;
+        }
+        finally {
+            unsubscribe();
+            signal?.removeEventListener('abort', abort);
+        }
+    }
+    get requestStopSignal() {
+        return this.applicationJobStop.signal;
+    }
+    observePeerRouteChanged(listener) {
+        this.peerRouteChanged.add(listener);
+        return () => {
+            this.peerRouteChanged.delete(listener);
+        };
+    }
+    hasSelectedPeerRoute(nodeRoutingId) {
+        return this.selectedRoutes.has(nodeRoutingId);
+    }
+    notifyPeerRouteChanged(nodeRoutingId) {
+        for (const listener of this.peerRouteChanged)
+            listener(nodeRoutingId);
+    }
     notifyPeerConnectionIntentRemoved(nodeRoutingId) {
         // Only the logical owner's removal publishes lifecycle termination.
         // A physical disconnect alone retains the connection expectation.
@@ -231,26 +292,34 @@ class RawServiceMeshRuntime {
             listener(nodeRoutingId);
     }
     announcePeer(nodeRoutingId) {
-        const expected = this.expectedPeers.get(nodeRoutingId);
+        if (this.closed)
+            return false;
         const generation = this.selectedRoutes.get(nodeRoutingId);
-        if (expected === undefined ||
-            generation === undefined ||
-            expected.helloSubmittedGeneration === generation ||
-            this.peerAdmissionSealed?.() === true)
-            return Promise.resolve(false);
-        const current = () => this.expectedPeers.get(nodeRoutingId) === expected &&
-            this.selectedRoutes.get(nodeRoutingId) === generation;
-        return Promise.resolve(this.startControlSend(nodeRoutingId, service_wire_m6a_codec_1.M6aServiceWireCommand.hello, () => this.submitControl(nodeRoutingId, [
-            (0, service_wire_m6a_codec_1.encodeRouteMeshAdmission)(service_wire_m6a_codec_1.M6aServiceWireCommand.hello, this.topology.localDescriptor())
-        ], () => {
-            if (current())
-                expected.helloSubmittedGeneration = generation;
-        }), current));
+        if (generation === undefined)
+            return false;
+        const key = controlSendKey(nodeRoutingId, service_wire_m6a_codec_1.M6aServiceWireCommand.hello);
+        if (!this.isPeerAnnouncementCurrent(nodeRoutingId, generation)) {
+            this.controlSends.delete(key);
+            return false;
+        }
+        const current = () => this.isPeerAnnouncementCurrent(nodeRoutingId, generation);
+        const existing = this.controlSends.get(key);
+        const hello = existing?.current?.() === true
+            ? existing.hello
+            : (0, service_wire_m6a_codec_1.encodeRouteMeshAdmission)(service_wire_m6a_codec_1.M6aServiceWireCommand.hello, this.topology.localDescriptor());
+        return this.startControlSend(nodeRoutingId, service_wire_m6a_codec_1.M6aServiceWireCommand.hello, () => this.submitControl(nodeRoutingId, [hello]), current, hello);
+    }
+    isPeerAnnouncementCurrent(nodeRoutingId, generation) {
+        const admission = this.topology.routeAdmission(nodeRoutingId);
+        return (this.selectedRoutes.get(nodeRoutingId) === generation &&
+            !(admission?.connectionId === routeConnectionId(generation) &&
+                admission.remoteAdmitReceived === true) &&
+            this.peerAdmissionSealed?.() !== true);
     }
     isPeerRouteReady(nodeRoutingId, lifecycleGeneration) {
         // Admission is bound to the observed selected route: the route observer
         // removes the peer when that route ends or is replaced.
-        const peer = this.topology.peer(nodeRoutingId);
+        const peer = this.topology.admittedPeer(nodeRoutingId);
         return (peer !== undefined &&
             (lifecycleGeneration === undefined ||
                 peer.descriptor.lifecycleGeneration === lifecycleGeneration));
@@ -287,22 +356,22 @@ class RawServiceMeshRuntime {
         // placement and channel selectors therefore need the new mutable fields
         // on that same connection before the next request is selected; waiting for
         // a reconnect would leave a race where a drained node is selected again.
+        await this.publishLocalDescriptor(this.topology.peers().map((peer) => peer.descriptor.nodeRoutingId));
+    }
+    async publishLocalDescriptor(targets) {
         const update = (0, service_wire_m6a_codec_1.encodeRouteMeshAdmission)(service_wire_m6a_codec_1.M6aServiceWireCommand.update, this.topology.localDescriptor());
-        for (const peer of this.topology.peers()) {
-            await this.send(peer.descriptor.nodeRoutingId, [update]);
+        for (const target of targets) {
+            await this.sendService(target, [update]);
         }
     }
     replaceDiscoveredNotRequired(descriptors) {
         this.topology.replaceDiscoveredNotRequired(descriptors);
     }
     isObjectClientNodeDirectTarget(nodeRoutingId) {
-        const descriptor = nodeRoutingId === this.descriptor.nodeRoutingId
-            ? this.topology.localDescriptor()
-            : this.topology.knownDescriptor(nodeRoutingId);
-        return descriptor?.objectRole === 'client';
+        return this.topology.isObjectClientNodeDirectTarget(nodeRoutingId);
     }
-    async sendToNode(targetNodeRoutingId, payload) {
-        return this.send(targetNodeRoutingId, [(0, service_wire_m6a_codec_1.encodeNodeSendHeader)(), this.applicationFrame(payload)]);
+    sendToNode(targetNodeRoutingId, payload) {
+        return this.send(targetNodeRoutingId, [NODE_SEND_HEADER, this.applicationFrame(payload)]);
     }
     async sendToChannel(channelName, payload) {
         const selection = this.selectChannelTarget(channelName);
@@ -317,17 +386,42 @@ class RawServiceMeshRuntime {
             ? runtime_values_1.SubmitResult.Ok
             : runtime_values_1.SubmitResult.NotConnected;
     }
-    requestToNode(targetNodeRoutingId, payload, timeoutMs) {
-        return this.requestToTarget(targetNodeRoutingId, payload, timeoutMs);
+    requestToNode(targetNodeRoutingId, payload, timeoutMs, onAdmitted, observer, operationKind) {
+        return this.requestToTarget(targetNodeRoutingId, payload, timeoutMs, undefined, onAdmitted, observer, operationKind);
     }
-    requestToChannel(channelName, payload, timeoutMs) {
+    requestToChannel(channelName, payload, timeoutMs, onAdmitted, observer, operationKind) {
         const selection = this.selectChannelTarget(channelName);
         if (selection.kind !== 'selected') {
-            const pending = this.operations.register(timeoutMs);
-            this.operations.complete(pending.id, selection.requestResult);
+            const pending = this.registerRequest(timeoutMs, observer, operationKind);
+            this.completeRequest(pending, selection.requestResult);
             return pending;
         }
-        return this.requestToTarget(selection.peer.descriptor.nodeRoutingId, payload, timeoutMs, channelName);
+        return this.requestToTarget(selection.peer.descriptor.nodeRoutingId, payload, timeoutMs, channelName, onAdmitted, observer, operationKind);
+    }
+    /**
+     * One pending entry per request: an observed request reports its terminal
+     * to the caller's observer; any other request keeps the Promise contract.
+     */
+    registerRequest(timeoutMs, observer, operationKind) {
+        return observer === undefined
+            ? this.operations.register(timeoutMs)
+            : { id: this.operations.registerObserved(timeoutMs, observer, operationKind) };
+    }
+    /**
+     * An observed caller learns the operation id only when the request call
+     * returns, so a terminal decided inside that call is delivered after it.
+     */
+    completeRequest(pending, result) {
+        if (pending.promise === undefined)
+            queueMicrotask(() => this.operations.complete(pending.id, result));
+        else
+            this.operations.complete(pending.id, result);
+    }
+    failRequest(pending, error) {
+        if (pending.promise === undefined)
+            queueMicrotask(() => this.operations.fail(pending.id, error));
+        else
+            this.operations.fail(pending.id, error);
     }
     selectChannelTarget(channelName) {
         const selected = this.topology.selectChannel(channelName, (peer) => this.isPeerRouteReady(peer.descriptor.nodeRoutingId));
@@ -348,11 +442,12 @@ class RawServiceMeshRuntime {
                 }
             };
     }
-    setServiceIngress(handler) {
+    setServiceIngress(handler, accepts) {
         if (this.serviceIngress !== undefined && this.serviceIngress !== handler) {
             throw new Error('Raw service ingress is already registered.');
         }
         this.serviceIngress = handler;
+        this.serviceIngressAccepts = accepts;
     }
     async reserveLocalIngress(signal) {
         const waitSignal = signal === undefined
@@ -362,11 +457,17 @@ class RawServiceMeshRuntime {
         return application_ingress_record_owner_1.ApplicationIngressRecordOwner.create(this.applicationJobQueue, permit, { close() { } });
     }
     async sendService(targetNodeRoutingId, parts) {
-        return this.send(targetNodeRoutingId, parts);
+        try {
+            await this.requireStarted().send(targetNodeRoutingId, parts);
+            return true;
+        }
+        catch (error) {
+            return this.sendFailure(error);
+        }
     }
-    requestService(targetNodeRoutingId, parts, timeoutMs) {
-        const admission = this.topology.peer(targetNodeRoutingId)?.liveness;
-        return this.requireStarted().request(targetNodeRoutingId, parts, timeoutMs, admission?.recordReceived);
+    requestService(targetNodeRoutingId, parts, timeoutMs, onAdmitted) {
+        const admission = this.topology.admittedPeer(targetNodeRoutingId)?.liveness;
+        return this.requireStarted().request(targetNodeRoutingId, parts, timeoutMs, admission?.recordReceived, onAdmitted);
     }
     replyService(record, parts) {
         if (record.requestSequence === undefined) {
@@ -423,51 +524,59 @@ class RawServiceMeshRuntime {
         const observe = (_source, byteCount) => {
             bytes += byteCount;
         };
-        while (receiveReady && messages < RAW_MESH_RECEIVE_RECORD_BUDGET && !this.closed) {
-            const result = await this.receiveOne(performance.now(), observe);
-            if (result === 'noData') {
-                receiveReady = false;
-                break;
+        const rotation = (this.receiveRotation ??= this.applicationJobQueue.createReceiveRotation(RAW_MESH_RECEIVE_RECORD_BUDGET, 'remote'));
+        if (receiveReady)
+            rotation.reserve();
+        try {
+            while (receiveReady && messages < RAW_MESH_RECEIVE_RECORD_BUDGET && !this.closed) {
+                const received = this.receiveOne(performance.now(), observe, rotation);
+                const result = received instanceof Promise ? await received : received;
+                if (result === 'noData') {
+                    receiveReady = false;
+                    break;
+                }
+                messages += 1;
+                // Core owns the per-peer fair-queue cursor. The Framework limit bounds
+                // the entire round, so changing peers does not renew its byte/count budget.
+                if (bytes >= RAW_MESH_RECEIVE_BYTE_BUDGET ||
+                    performance.now() - startedAtMs >= exports.RAW_MESH_RECEIVE_TIME_BUDGET_MS)
+                    break;
             }
-            messages += 1;
-            // Core owns the per-peer fair-queue cursor. The Framework limit bounds
-            // the entire round, so changing peers does not renew its byte/count budget.
-            if (bytes >= RAW_MESH_RECEIVE_BYTE_BUDGET ||
-                performance.now() - startedAtMs >= exports.RAW_MESH_RECEIVE_TIME_BUDGET_MS)
-                break;
+        }
+        finally {
+            rotation.releaseUnused();
         }
         if (!this.closed) {
-            for (const nodeRoutingId of this.expectedPeers.keys()) {
-                if (this.topology.peer(nodeRoutingId) === undefined)
-                    await this.announcePeer(nodeRoutingId);
-            }
             this.tickLiveness();
         }
         return receiveReady && messages > 0;
     }
-    async receiveOne(nowMs, observe) {
+    receiveOne(nowMs, observe, rotation) {
         const router = this.requireStarted();
         this.observeInfrastructureFailure();
-        if (this.receivePermit === undefined && this.receiveAcquisition === undefined) {
+        let permit = this.receivePermit;
+        this.receivePermit = undefined;
+        permit ??= rotation?.take();
+        if (permit === undefined && this.receiveAcquisition === undefined) {
             let resolveAcquisition;
             let rejectAcquisition;
-            const acquisition = new Promise((resolve, reject) => {
-                resolveAcquisition = resolve;
-                rejectAcquisition = reject;
-            });
-            const permit = this.applicationJobQueue.acquireOrResume((permit) => {
+            permit = this.applicationJobQueue.acquireOrResume((permit) => {
                 this.receiveAcquisition = undefined;
-                if (this.closed)
+                if (this.closed) {
                     permit.releaseAfterInternalProcessing();
+                    permit.releaseStorage?.();
+                }
                 else {
                     this.receivePermit = permit;
                     this.onReceiveReady?.();
                 }
-                resolveAcquisition(permit);
-            }, rejectAcquisition, this.applicationJobStop.signal, 'remote');
-            if (permit !== undefined)
-                this.receivePermit = permit;
-            else {
+                resolveAcquisition?.(permit);
+            }, (error) => rejectAcquisition?.(error), this.applicationJobStop.signal, 'remote');
+            if (permit === undefined) {
+                const acquisition = new Promise((resolve, reject) => {
+                    resolveAcquisition = resolve;
+                    rejectAcquisition = reject;
+                });
                 this.receiveAcquisition = acquisition;
                 acquisition.catch((error) => {
                     this.receiveAcquisition = undefined;
@@ -476,12 +585,11 @@ class RawServiceMeshRuntime {
                 });
             }
         }
-        const permit = this.receivePermit;
-        this.receivePermit = undefined;
         if (permit === undefined)
             return 'noData';
         if (this.closed) {
             permit.releaseAfterInternalProcessing();
+            permit.releaseStorage?.();
             return 'noData';
         }
         let received;
@@ -490,23 +598,44 @@ class RawServiceMeshRuntime {
         }
         catch (error) {
             permit.releaseAfterInternalProcessing();
+            permit.releaseStorage?.();
             throw error;
         }
         if (received === undefined) {
             permit.releaseAfterInternalProcessing();
+            permit.releaseStorage?.();
             return 'noData';
         }
         const applicationJobOwner = application_ingress_record_owner_1.ApplicationIngressRecordOwner.create(this.applicationJobQueue, permit, received);
+        let result;
+        try {
+            result = this.processReceived(received, nowMs, applicationJobOwner);
+        }
+        catch (error) {
+            applicationJobOwner.close();
+            throw error;
+        }
+        return result instanceof Promise
+            ? result.then((value) => this.finishReceive(received, applicationJobOwner, observe, value), (error) => {
+                applicationJobOwner.close();
+                throw error;
+            })
+            : this.finishReceive(received, applicationJobOwner, observe, result);
+    }
+    finishReceive(received, owner, observe, result) {
         try {
-            const result = await this.processReceived(received, nowMs, applicationJobOwner);
-            if (result === 'protocolError') {
+            if (result === 'protocolError')
                 this.reportProtocolError(received);
+            if (observe !== undefined) {
+                let bytes = 0;
+                for (const part of received.parts)
+                    bytes += part.byteLength;
+                observe(received.sourceRid, bytes);
             }
-            observe?.(received.sourceRid, received.parts.reduce((sum, part) => sum + part.byteLength, 0));
             return result;
         }
         finally {
-            applicationJobOwner.close();
+            owner.close();
         }
     }
     reportProtocolError(received) {
@@ -545,61 +674,19 @@ class RawServiceMeshRuntime {
             throw error;
         }
     }
-    async processReceived(received, nowMs, applicationJobOwner) {
-        if (received.parts.length === 0 ||
-            (received.parts.length === 1 && received.parts[0].byteLength === 0)) {
-            if (this.peerAdmissionSealed?.() === true)
-                return 'dropped';
-            return (await this.sendControl(received.sourceRid, [
-                (0, service_wire_m6a_codec_1.encodeRouteMeshAdmission)(service_wire_m6a_codec_1.M6aServiceWireCommand.hello, this.topology.localDescriptor())
-            ]))
-                ? 'infrastructure'
-                : 'dropped';
-        }
+    processReceived(received, nowMs, applicationJobOwner) {
+        const peer = this.topology.admittedPeer(received.sourceRid);
+        const currentSource = peer?.liveness !== undefined && peer.liveness.connectionId === received.routeGeneration;
+        if (received.parts.length === 0)
+            return currentSource ? 'protocolError' : 'dropped';
         try {
             const header = (0, service_wire_m6a_codec_1.decodeHeader)(received.parts[0]);
             if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.hello && this.peerAdmissionSealed?.() === true) {
                 return 'dropped';
             }
             if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.hello ||
-                header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.admit ||
-                header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.update) {
-                if (received.parts.length !== 1)
-                    return 'protocolError';
-                const descriptor = (0, service_wire_m6a_codec_1.decodeRouteMeshAdmission)(received.parts[0], header.command, received.sourceRid);
-                const expected = this.expectedPeers.get(received.sourceRid);
-                if (expected !== undefined &&
-                    (expected.meshName !== descriptor.meshName ||
-                        expected.nodeRoutingId !== descriptor.nodeRoutingId)) {
-                    await this.sendControl(received.sourceRid, [
-                        (0, service_wire_m6a_codec_1.encodeReject)((0, service_wire_codec_generated_1.enumWireRejectReason)('identityMismatch'))
-                    ]);
-                    return 'infrastructure';
-                }
-                const result = this.admitPeer(descriptor, received.routeGeneration, nowMs, expected);
-                if (result !== 'admitted' && result !== 'notRequired') {
-                    const detail = result === 'invalidDescriptor'
-                        ? describeInvalidAdmissionDescriptor(descriptor, expected, this.topology.peer(descriptor.nodeRoutingId)?.descriptor)
-                        : undefined;
-                    console.warn(`RouteMesh admission rejected peer '${received.sourceRid}' as ${result}` +
-                        (detail === undefined ? '.' : ` (${detail}).`));
-                    await this.sendControl(received.sourceRid, [(0, service_wire_m6a_codec_1.encodeReject)(admissionReason(result))]);
-                    return 'infrastructure';
-                }
-                if (result === 'admitted')
-                    this.selectBilateralConnection(descriptor);
-                if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.hello) {
-                    // Hello supplies only the sender's descriptor. Even NotRequired
-                    // peers must receive ours before the intent owner closes transport;
-                    // submitting a response does not guarantee delivery before close.
-                    await this.sendControl(received.sourceRid, [
-                        (0, service_wire_m6a_codec_1.encodeRouteMeshAdmission)(service_wire_m6a_codec_1.M6aServiceWireCommand.admit, this.topology.localDescriptor())
-                    ]);
-                }
-                else if (result === 'notRequired') {
-                    this.retireNotRequiredExpectedPeer(received.sourceRid, descriptor.advertisedEndpoint);
-                }
-                return 'infrastructure';
+                header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.admit) {
+                return this.processAdmission(received, header, nowMs).catch((error) => this.receiveProtocolFailure(error));
             }
             if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.reject) {
                 if (received.parts.length !== 1)
@@ -607,47 +694,123 @@ class RawServiceMeshRuntime {
                 (0, service_wire_m6a_codec_1.decodeReject)(received.parts[0]);
                 return 'infrastructure';
             }
-            const peer = this.topology.peer(received.sourceRid);
-            if (peer === undefined)
-                return 'protocolError';
-            if (peer.liveness !== undefined && peer.liveness.connectionId === received.routeGeneration)
-                this.liveness.recordReceived(peer.liveness, nowMs);
+            if (!currentSource)
+                return 'dropped';
+            this.liveness.recordReceived(peer.liveness, nowMs);
+            if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.update) {
+                return this.processAdmission(received, header, nowMs).catch((error) => this.receiveProtocolFailure(error));
+            }
             if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.livenessProbe ||
                 header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.livenessAck) {
-                if (received.parts.length !== 1)
-                    return 'protocolError';
-                const record = livenessCodec.decodeLivenessRecord(received.parts[0]);
-                if (record.command === service_wire_m6a_codec_1.M6aServiceWireCommand.livenessProbe) {
-                    const ack = this.liveness.acknowledgeProbe(received.sourceRid, received.routeGeneration, record.probeId);
-                    if (ack === undefined)
-                        return 'protocolError';
-                    const sent = await this.sendControl(received.sourceRid, [
-                        livenessCodec.encodeLivenessRecord({
-                            command: service_wire_m6a_codec_1.M6aServiceWireCommand.livenessAck,
-                            probeId: record.probeId
-                        })
-                    ]);
-                    if (!sent)
-                        return 'dropped';
-                }
-                else {
-                    this.liveness.acknowledge(received.sourceRid, received.routeGeneration, record.probeId, nowMs);
-                }
-                return 'infrastructure';
+                return this.processLiveness(received, nowMs).catch((error) => this.receiveProtocolFailure(error));
             }
-            const stateful = await this.serviceIngress?.({
-                command: header.command,
-                flags: header.flags,
-                sourceRoutingId: received.sourceRid,
-                sourceNodeGeneration: peer.descriptor.lifecycleGeneration,
-                sourceRoute: received.sourceRoute,
-                ...(received.reply === undefined ? {} : { reply: received.reply }),
-                ...(received.requestSeq === undefined ? {} : { requestSequence: received.requestSeq }),
-                parts: received.parts,
-                applicationJobOwner
-            });
+            const stateful = this.serviceIngress !== undefined && this.serviceIngressAccepts?.(header.command) !== false
+                ? this.serviceIngress({
+                    command: header.command,
+                    flags: header.flags,
+                    sourceRoutingId: received.sourceRid,
+                    sourceNodeGeneration: peer.descriptor.lifecycleGeneration,
+                    sourceRoute: received.sourceRoute,
+                    ...(received.reply === undefined ? {} : { reply: received.reply }),
+                    ...(received.requestSeq === undefined
+                        ? {}
+                        : { requestSequence: received.requestSeq }),
+                    parts: received.parts,
+                    applicationJobOwner
+                })
+                : undefined;
+            if (stateful instanceof Promise)
+                return stateful.then((result) => result ?? this.processApplicationReceived(received, header, applicationJobOwner), (error) => this.receiveProtocolFailure(error));
             if (stateful !== undefined)
                 return stateful;
+            return this.processApplicationReceived(received, header, applicationJobOwner);
+        }
+        catch (error) {
+            if (!currentSource && error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError)
+                return 'dropped';
+            return this.receiveProtocolFailure(error);
+        }
+    }
+    receiveProtocolFailure(error) {
+        if (error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError)
+            return 'protocolError';
+        throw error;
+    }
+    async processAdmission(received, header, nowMs) {
+        if (received.parts.length !== 1)
+            return 'protocolError';
+        const descriptor = (0, service_wire_m6a_codec_1.decodeRouteMeshAdmission)(received.parts[0], header.command, received.sourceRid);
+        const expected = this.expectedPeers.get(received.sourceRid);
+        if (expected !== undefined &&
+            (expected.meshName !== descriptor.meshName ||
+                expected.nodeRoutingId !== descriptor.nodeRoutingId)) {
+            await this.sendControl(received.sourceRid, [
+                (0, service_wire_m6a_codec_1.encodeReject)((0, service_wire_codec_generated_1.enumWireRejectReason)('identityMismatch'))
+            ]);
+            return 'infrastructure';
+        }
+        const helloKey = controlSendKey(received.sourceRid, service_wire_m6a_codec_1.M6aServiceWireCommand.hello);
+        const exchange = this.controlSends.get(helloKey);
+        const result = this.admitPeer(descriptor, received.routeGeneration, nowMs, expected, header.command, received.parts[0].subarray(service_wire_binary_primitives_1.SERVICE_WIRE_PREFIX_SIZE));
+        if (result !== 'admitted' && result !== 'notRequired') {
+            const detail = result === 'invalidDescriptor'
+                ? describeInvalidAdmissionDescriptor(descriptor, expected, this.topology.peer(descriptor.nodeRoutingId)?.descriptor)
+                : undefined;
+            console.warn(`RouteMesh admission rejected peer '${received.sourceRid}' as ${result}` +
+                (detail === undefined ? '.' : ` (${detail}).`));
+            await this.sendControl(received.sourceRid, [(0, service_wire_m6a_codec_1.encodeReject)(admissionReason(result))]);
+            return 'infrastructure';
+        }
+        if (result === 'admitted')
+            this.selectBilateralConnection(descriptor);
+        if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.hello) {
+            // Hello supplies only the sender's descriptor. Even NotRequired
+            // peers must receive ours before the intent owner closes transport;
+            // submitting a response does not guarantee delivery before close.
+            const local = exchange?.current?.() === true && exchange.hello !== undefined
+                ? (0, service_wire_m6a_codec_1.decodeRouteMeshAdmission)(exchange.hello, service_wire_m6a_codec_1.M6aServiceWireCommand.hello, this.descriptor.nodeRoutingId)
+                : this.topology.localDescriptor();
+            await this.sendControl(received.sourceRid, [
+                (0, service_wire_m6a_codec_1.encodeRouteMeshAdmission)(service_wire_m6a_codec_1.M6aServiceWireCommand.admit, local)
+            ]);
+        }
+        else if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.admit) {
+            this.controlSends.delete(helloKey);
+            this.refreshAdmissionPending(nowMs);
+            if (result === 'notRequired') {
+                this.retireNotRequiredExpectedPeer(received.sourceRid, descriptor.advertisedEndpoint);
+            }
+            else if (exchange?.hello !== undefined &&
+                (0, service_wire_m6a_codec_1.decodeRouteMeshAdmission)(exchange.hello, service_wire_m6a_codec_1.M6aServiceWireCommand.hello, this.descriptor.nodeRoutingId).descriptorRevision < this.descriptor.descriptorRevision) {
+                await this.publishLocalDescriptor([received.sourceRid]);
+            }
+        }
+        return 'infrastructure';
+    }
+    async processLiveness(received, nowMs) {
+        if (received.parts.length !== 1)
+            return 'protocolError';
+        const record = livenessCodec.decodeLivenessRecord(received.parts[0]);
+        if (record.command === service_wire_m6a_codec_1.M6aServiceWireCommand.livenessProbe) {
+            const ack = this.liveness.acknowledgeProbe(received.sourceRid, received.routeGeneration, record.probeId);
+            if (ack === undefined)
+                return 'protocolError';
+            const sent = await this.sendControl(received.sourceRid, [
+                livenessCodec.encodeLivenessRecord({
+                    command: service_wire_m6a_codec_1.M6aServiceWireCommand.livenessAck,
+                    probeId: record.probeId
+                })
+            ]);
+            if (!sent)
+                return 'dropped';
+        }
+        else {
+            this.liveness.acknowledge(received.sourceRid, received.routeGeneration, record.probeId, nowMs);
+        }
+        return 'infrastructure';
+    }
+    processApplicationReceived(received, header, applicationJobOwner) {
+        try {
             if (header.flags === 0 &&
                 // A bare infrastructure control is normally exactly one frame, but a
                 // relocation Prepare now rides its bound-session journal as
@@ -663,7 +826,7 @@ class RawServiceMeshRuntime {
                 received.parts.length >= 1 &&
                 isBareInfrastructureControl(header.command)) {
                 const accepted = this.mailbox.tryEnqueue({
-                    owner: `node:${this.descriptor.nodeRoutingId}`,
+                    owner: this.nodeMailboxOwner,
                     domain: 'infrastructure',
                     parts: received.parts,
                     sourceRoutingId: received.sourceRid,
@@ -675,62 +838,60 @@ class RawServiceMeshRuntime {
             }
             if (header.flags !== 0 ||
                 received.parts.length !== 2 ||
-                ![
-                    service_wire_m6a_codec_1.M6aServiceWireCommand.nodeSend,
-                    service_wire_m6a_codec_1.M6aServiceWireCommand.nodeRequest,
-                    service_wire_m6a_codec_1.M6aServiceWireCommand.channelSend,
-                    service_wire_m6a_codec_1.M6aServiceWireCommand.channelRequest
-                ].includes(header.command)) {
+                !isApplicationEnvelopeCommand(header.command)) {
                 return 'protocolError';
             }
             let owner;
             let correlation;
             if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.nodeSend) {
-                owner = `node:${this.descriptor.nodeRoutingId}`;
+                owner = this.nodeMailboxOwner;
             }
             else if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.nodeRequest) {
-                owner = `node:${this.descriptor.nodeRoutingId}`;
-                correlation = (0, service_wire_m6a_codec_1.decodeNodeRequestHeader)(received.parts[0]);
+                owner = this.nodeMailboxOwner;
+                correlation = (0, service_wire_m6a_codec_1.decodeNodeRequestHeader)(received.parts[0], header);
             }
             else if (header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.channelSend) {
-                owner = `channel:${(0, service_wire_m6a_codec_1.decodeChannelSendHeader)(received.parts[0])}`;
+                owner = `channel:${(0, service_wire_m6a_codec_1.decodeChannelSendHeader)(received.parts[0], header)}`;
             }
             else {
-                const channel = (0, service_wire_m6a_codec_1.decodeChannelRequestHeader)(received.parts[0]);
+                const channel = (0, service_wire_m6a_codec_1.decodeChannelRequestHeader)(received.parts[0], header);
                 owner = `channel:${channel.channelName}`;
                 correlation = channel.correlation;
             }
-            const applicationJob = await applicationJobOwner.acquire('application');
-            const accepted = this.mailbox.tryEnqueue({
-                owner,
-                domain: 'application',
-                parts: received.parts,
+            const job = applicationJobOwner.acquire('application');
+            return job instanceof Promise
+                ? job.then((permit) => this.enqueueOrdinaryRecord(received, owner, correlation, permit))
+                : this.enqueueOrdinaryRecord(received, owner, correlation, job);
+        }
+        catch (error) {
+            return this.receiveProtocolFailure(error);
+        }
+    }
+    enqueueOrdinaryRecord(received, owner, correlation, applicationJob) {
+        const accepted = this.mailbox.tryEnqueue({
+            owner,
+            domain: 'application',
+            parts: received.parts,
+            sourceRoutingId: received.sourceRid,
+            sourceRoute: received.sourceRoute,
+            reply: received.reply,
+            requestSequence: received.requestSeq,
+            correlation,
+            applicationJob
+        });
+        if (accepted)
+            return 'application';
+        applicationJob.close();
+        if (correlation !== undefined && received.requestSeq !== undefined) {
+            this.replyService({
                 sourceRoutingId: received.sourceRid,
                 sourceRoute: received.sourceRoute,
-                ...(received.reply === undefined ? {} : { reply: received.reply }),
                 requestSequence: received.requestSeq,
-                ...(correlation === undefined ? {} : { correlation }),
-                applicationJob
-            });
-            if (accepted)
-                return 'application';
-            applicationJob.close();
-            if (correlation !== undefined && received.requestSeq !== undefined) {
-                this.replyService({
-                    sourceRoutingId: received.sourceRid,
-                    sourceRoute: received.sourceRoute,
-                    requestSequence: received.requestSeq,
-                    ...(received.reply === undefined ? {} : { reply: received.reply })
-                }, [(0, service_wire_m6a_codec_1.encodeReplyHeader)(correlation, runtime_values_1.RequestResult.NotConnected, 0)]);
-                return 'infrastructure';
-            }
-            return 'dropped';
-        }
-        catch (error) {
-            if (error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError)
-                return 'protocolError';
-            throw error;
+                ...(received.reply === undefined ? {} : { reply: received.reply })
+            }, [(0, service_wire_m6a_codec_1.encodeReplyHeader)(correlation, runtime_values_1.RequestResult.NotConnected, 0)]);
+            return 'infrastructure';
         }
+        return 'dropped';
     }
     expireOperations(nowMs, turnDeadlineMs) {
         return this.operations.expire(nowMs, turnDeadlineMs);
@@ -738,9 +899,38 @@ class RawServiceMeshRuntime {
     get pendingOperationCount() {
         return this.operations.size;
     }
+    cancelPendingOperations(reason) {
+        this.operations.failAll(reason);
+    }
+    /**
+     * The next management deadline of this node (spec 08 §4.2): request expiry,
+     * liveness probe or timeout, or an owned HELLO exchange still awaiting
+     * ADMIT, which keeps the existing announce cadence.
+     */
+    nextMaintenanceDeadlineMs(nowMs) {
+        this.refreshAdmissionPending(nowMs);
+        return Math.min(this.operations.nextDeadlineMs(), this.liveness.nextDeadlineMs());
+    }
+    refreshAdmissionPending(nowMs) {
+        let pending = false;
+        if (!this.closed && this.controlSends.size !== 0) {
+            for (const nodeRoutingId of this.selectedRoutes.keys()) {
+                const exchange = this.controlSends.get(controlSendKey(nodeRoutingId, service_wire_m6a_codec_1.M6aServiceWireCommand.hello));
+                if (exchange?.current?.() === true) {
+                    pending = true;
+                    break;
+                }
+            }
+        }
+        this.liveness.setAdmissionPending(pending, nowMs);
+    }
     tickLiveness(nowMs = performance.now()) {
+        const admissionDue = this.liveness.tickAdmission(nowMs);
         const result = this.liveness.tick(nowMs);
         this.requireStarted();
+        if (admissionDue)
+            for (const nodeRoutingId of this.selectedRoutes.keys())
+                void this.announcePeer(nodeRoutingId);
         for (const probe of result.probes) {
             const parts = [
                 livenessCodec.encodeLivenessRecord({
@@ -777,10 +967,8 @@ class RawServiceMeshRuntime {
         for (const [nodeRoutingId, generation] of this.selectedRoutes) {
             if (observed.get(nodeRoutingId) === generation)
                 continue;
+            this.controlSends.delete(controlSendKey(nodeRoutingId, service_wire_m6a_codec_1.M6aServiceWireCommand.hello));
             changes++;
-            const expected = this.expectedPeers.get(nodeRoutingId);
-            if (expected !== undefined)
-                delete expected.helloSubmittedGeneration;
             const peer = this.topology.peer(nodeRoutingId);
             if (peer?.liveness?.connectionId === generation) {
                 this.removePeer(peer);
@@ -795,9 +983,12 @@ class RawServiceMeshRuntime {
             selected.push(nodeRoutingId);
         }
         this.selectedRoutes = observed;
+        for (const nodeRoutingId of selected)
+            this.notifyPeerRouteChanged(nodeRoutingId);
         // A new selected route admits only through a new handshake.
         for (const nodeRoutingId of selected)
             await this.announcePeer(nodeRoutingId);
+        this.refreshAdmissionPending(performance.now());
         return changes;
     }
     close() {
@@ -806,9 +997,11 @@ class RawServiceMeshRuntime {
         this.closed = true;
         this.applicationJobStop.abort(new Error('Raw service runtime application job admission stopped.'));
         this.receivePermit?.releaseAfterInternalProcessing();
+        this.receivePermit?.releaseStorage?.();
         this.receivePermit = undefined;
         for (const send of this.controlSends.values())
             delete send.next;
+        this.controlSends.clear();
         this.mailbox.close();
         this.operations.close('Raw service runtime closed.');
         this.serviceIngress = undefined;
@@ -822,13 +1015,12 @@ class RawServiceMeshRuntime {
         this.router = undefined;
         this.host = undefined;
     }
-    requestToTarget(targetNodeRoutingId, payload, timeoutMs, channelName) {
+    requestToTarget(targetNodeRoutingId, payload, timeoutMs, channelName, onAdmitted, observer, operationKind) {
         const correlation = this.nextCorrelation++;
         const header = channelName === undefined
             ? (0, service_wire_m6a_codec_1.encodeNodeRequestHeader)(correlation)
             : (0, service_wire_m6a_codec_1.encodeChannelRequestHeader)(correlation, channelName);
         const encodedPayload = this.applicationFrame(payload);
-        const pending = this.operations.register(timeoutMs);
         let selectedTargetNodeRoutingId = targetNodeRoutingId;
         if (selectedTargetNodeRoutingId !== this.descriptor.nodeRoutingId &&
             !this.isPeerRouteReady(selectedTargetNodeRoutingId)) {
@@ -855,6 +1047,9 @@ class RawServiceMeshRuntime {
             }
         }
         if (selectedTargetNodeRoutingId === this.descriptor.nodeRoutingId) {
+            // The local admission path aborts its capacity wait on the terminal
+            // Promise, so a local request always keeps the Promise entry.
+            const pending = this.operations.register(timeoutMs);
             const parts = [header, encodedPayload];
             const capacityStop = new AbortController();
             void pending.promise.finally(() => capacityStop.abort()).catch(() => undefined);
@@ -888,6 +1083,9 @@ class RawServiceMeshRuntime {
                             failureCode: 0
                         });
                     }
+                    else {
+                        onAdmitted?.();
+                    }
                 }
                 finally {
                     applicationJobOwner.close();
@@ -895,12 +1093,13 @@ class RawServiceMeshRuntime {
             })().catch((error) => this.operations.fail(pending.id, error));
             return pending;
         }
-        const selectedPeer = this.topology.peer(selectedTargetNodeRoutingId);
+        const pending = this.registerRequest(timeoutMs, observer, operationKind);
+        const selectedPeer = this.topology.admittedPeer(selectedTargetNodeRoutingId);
         if (selectedPeer === undefined) {
             // Logical target selection is the requester's decision: an RID that is
             // not an admitted peer is not a target. Whether an admitted target's
             // route can carry the request is Core's REQUEST result.
-            this.operations.complete(pending.id, {
+            this.completeRequest(pending, {
                 terminalResult: runtime_values_1.RequestResult.NotFound,
                 failureCode: REQUEST_TARGET_NOT_FOUND_FAILURE_CODE
             });
@@ -909,10 +1108,10 @@ class RawServiceMeshRuntime {
         const parts = [header, encodedPayload];
         let request;
         try {
-            request = this.requireStarted().request(selectedTargetNodeRoutingId, parts, timeoutMs, selectedPeer.liveness?.recordReceived);
+            request = this.requireStarted().request(selectedTargetNodeRoutingId, parts, timeoutMs, selectedPeer.liveness?.recordReceived, onAdmitted);
         }
         catch (error) {
-            this.operations.fail(pending.id, error);
+            this.failRequest(pending, error);
             return pending;
         }
         void request.then((replyParts) => {
@@ -958,24 +1157,22 @@ class RawServiceMeshRuntime {
     applicationPayload(payload) {
         return Buffer.isBuffer(payload) ? (0, service_wire_m6a_codec_1.decodeApplicationPayloadView)(payload) : payload;
     }
-    admitPeer(descriptor, connectionId, nowMs, expected) {
+    admitPeer(descriptor, connectionId, nowMs, expected, command = service_wire_m6a_codec_1.M6aServiceWireCommand.hello, descriptorBytes) {
         const previous = this.topology.peer(descriptor.nodeRoutingId);
-        if (previous !== undefined &&
-            previous.descriptor.lifecycleGeneration === descriptor.lifecycleGeneration &&
-            (descriptor.descriptorRevision < previous.descriptor.descriptorRevision ||
-                (descriptor.descriptorRevision === previous.descriptor.descriptorRevision &&
-                    !(0, service_topology_registry_1.sameServiceNodeDescriptor)(previous.descriptor, descriptor)))) {
-            throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`RouteMesh peer '${descriptor.nodeRoutingId}' descriptor revision is stale or conflicting.`);
-        }
-        const topologyConnectionId = typeof connectionId === 'bigint' ? `route:${connectionId}` : connectionId;
+        const topologyConnectionId = typeof connectionId === 'bigint' ? routeConnectionId(connectionId) : connectionId;
         const result = this.topology.admit(descriptor, topologyConnectionId, expected, () => {
             const admission = this.liveness.admit(descriptor.nodeRoutingId, connectionId, nowMs);
             this.liveness.recordReceived(admission, nowMs);
             return admission;
-        });
+        }, command, descriptorBytes);
+        if (result === 'staleDescriptor') {
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`RouteMesh peer '${descriptor.nodeRoutingId}' descriptor revision is stale or conflicting.`);
+        }
         if (result === 'notRequired' && previous !== undefined) {
             this.liveness.disconnect(descriptor.nodeRoutingId, previous.liveness?.connectionId ?? previous.connectionId);
         }
+        if (result === 'admitted')
+            this.notifyPeerRouteChanged(descriptor.nodeRoutingId);
         return result;
     }
     retireNotRequiredExpectedPeer(nodeRoutingId, advertisedEndpoint) {
@@ -1020,7 +1217,7 @@ class RawServiceMeshRuntime {
     async sendControl(targetNodeRoutingId, parts) {
         return this.startControlSend(targetNodeRoutingId, (0, service_wire_m6a_codec_1.decodeHeader)(parts[0]).command, () => this.submitControl(targetNodeRoutingId, parts));
     }
-    submitControl(target, parts, accepted) {
+    submitControl(target, parts) {
         let submission;
         try {
             submission = this.requireStarted().submitSend(target, parts);
@@ -1028,19 +1225,17 @@ class RawServiceMeshRuntime {
         catch (error) {
             return this.sendFailure(error);
         }
-        if (submission.result === runtime_values_1.SubmitResult.Ok) {
-            accepted?.();
-            return true;
-        }
-        return submission.admitted.then(() => {
-            accepted?.();
+        if (submission.result === runtime_values_1.SubmitResult.Ok)
             return true;
-        }, (error) => this.sendFailure(error));
+        return submission.admitted.then(() => true, (error) => this.sendFailure(error));
     }
-    startControlSend(target, command, attempt, current) {
-        const key = JSON.stringify([target, command]);
+    startControlSend(target, command, attempt, current, hello) {
+        const key = controlSendKey(target, command);
+        if (command === service_wire_m6a_codec_1.M6aServiceWireCommand.hello)
+            this.liveness.setAdmissionPending(true, performance.now());
         const existing = this.controlSends.get(key);
         if (existing !== undefined &&
+            existing.task !== undefined &&
             (command !== service_wire_m6a_codec_1.M6aServiceWireCommand.hello || existing.current?.() === true)) {
             if (command !== service_wire_m6a_codec_1.M6aServiceWireCommand.hello) {
                 existing.next = attempt;
@@ -1049,35 +1244,45 @@ class RawServiceMeshRuntime {
             return true;
         }
         const first = attempt();
-        if (typeof first === 'boolean')
+        if (typeof first === 'boolean') {
+            if (hello !== undefined)
+                this.controlSends.set(key, { current, hello });
             return first;
+        }
         const owner = this;
-        const state = {
-            current,
-            task: first.then(function drain(accepted) {
-                if (!owner.closed && state.next !== undefined) {
-                    const next = state.next;
-                    delete state.next;
-                    return Promise.resolve(next()).then(drain);
-                }
-                if (owner.controlSends.get(key) === state)
-                    owner.controlSends.delete(key);
-                return accepted;
-            })
+        const state = { current, hello };
+        const completeSend = () => {
+            if (owner.controlSends.get(key) !== state)
+                return;
+            if (hello !== undefined && current?.() === true)
+                delete state.task;
+            else
+                owner.controlSends.delete(key);
         };
-        this.controlSends.set(key, state);
-        state.task.then(() => { }, (error) => {
-            if (this.controlSends.get(key) === state)
-                this.controlSends.delete(key);
-            if (this.infrastructureTaskRunner === undefined)
-                this.reportInfrastructureFailure(error);
+        const task = first.then(function drain(accepted) {
+            if (!owner.closed && state.next !== undefined) {
+                const next = state.next;
+                delete state.next;
+                return Promise.resolve(next()).then(drain);
+            }
+            completeSend();
+            return accepted;
         });
-        this.infrastructureTaskRunner?.runDetached('RouteMesh control SEND', async () => {
-            await state.task;
+        state.task = task;
+        this.controlSends.set(key, state);
+        task.then(() => { }, (error) => {
+            completeSend();
+            this.reportInfrastructureFailure(error);
         });
         return true;
     }
     reportInfrastructureFailure(error) {
+        if (this.infrastructureTaskRunner !== undefined) {
+            this.infrastructureTaskRunner.runDetached('RouteMesh infrastructure', async () => {
+                throw error;
+            });
+            return;
+        }
         this.infrastructureFailure = {
             error: this.infrastructureFailure === undefined
                 ? error
@@ -1092,13 +1297,15 @@ class RawServiceMeshRuntime {
             throw failure.error;
     }
     send(targetNodeRoutingId, parts) {
-        return this.requireStarted()
-            .send(targetNodeRoutingId, parts)
-            .then(() => {
-            return true;
-        }, (error) => {
+        try {
+            const submission = this.requireStarted().submitSend(targetNodeRoutingId, parts);
+            if (submission.result === runtime_values_1.SubmitResult.Ok)
+                return true;
+            return submission.admitted.then(() => true, (error) => this.sendFailure(error));
+        }
+        catch (error) {
             return this.sendFailure(error);
-        });
+        }
     }
     sendFailure(error) {
         if ((0, runtime_values_1.isZLinkBackendResultError)(error) && error.operation === 'submit') {
@@ -1110,25 +1317,38 @@ class RawServiceMeshRuntime {
     }
 }
 exports.RawServiceMeshRuntime = RawServiceMeshRuntime;
+function controlSendKey(target, command) {
+    return `${command}:${target}`;
+}
+function routeConnectionId(generation) {
+    return `route:${generation}`;
+}
 /**
  * Relocation and bound-Session controls are service-wire records themselves,
  * not application NodeSend(16) envelopes. Keep this list closed: a bare
  * record outside the frozen control vocabulary remains a protocol error.
  */
+const BARE_INFRASTRUCTURE_CONTROLS = new Set([
+    service_wire_constants_generated_1.ServiceWireCommand.relocationReady,
+    service_wire_constants_generated_1.ServiceWireCommand.relocationData,
+    service_wire_constants_generated_1.ServiceWireCommand.replyRelay,
+    service_wire_constants_generated_1.ServiceWireCommand.relocationCutover,
+    service_wire_constants_generated_1.ServiceWireCommand.relocationPrepare,
+    service_wire_constants_generated_1.ServiceWireCommand.sessionRelocationSeal,
+    service_wire_constants_generated_1.ServiceWireCommand.sessionRelocationSealed,
+    service_wire_constants_generated_1.ServiceWireCommand.sessionRelocationRoute,
+    service_wire_constants_generated_1.ServiceWireCommand.replyRelayAck,
+    service_wire_constants_generated_1.ServiceWireCommand.relocationState,
+    service_wire_constants_generated_1.ServiceWireCommand.relocationFailed
+]);
 function isBareInfrastructureControl(command) {
-    return [
-        service_wire_constants_generated_1.ServiceWireCommand.relocationReady,
-        service_wire_constants_generated_1.ServiceWireCommand.relocationData,
-        service_wire_constants_generated_1.ServiceWireCommand.replyRelay,
-        service_wire_constants_generated_1.ServiceWireCommand.relocationCutover,
-        service_wire_constants_generated_1.ServiceWireCommand.relocationPrepare,
-        service_wire_constants_generated_1.ServiceWireCommand.sessionRelocationSeal,
-        service_wire_constants_generated_1.ServiceWireCommand.sessionRelocationSealed,
-        service_wire_constants_generated_1.ServiceWireCommand.sessionRelocationRoute,
-        service_wire_constants_generated_1.ServiceWireCommand.replyRelayAck,
-        service_wire_constants_generated_1.ServiceWireCommand.relocationState,
-        service_wire_constants_generated_1.ServiceWireCommand.relocationFailed
-    ].includes(command);
+    return BARE_INFRASTRUCTURE_CONTROLS.has(command);
+}
+function isApplicationEnvelopeCommand(command) {
+    return (command === service_wire_m6a_codec_1.M6aServiceWireCommand.nodeSend ||
+        command === service_wire_m6a_codec_1.M6aServiceWireCommand.nodeRequest ||
+        command === service_wire_m6a_codec_1.M6aServiceWireCommand.channelSend ||
+        command === service_wire_m6a_codec_1.M6aServiceWireCommand.channelRequest);
 }
 function protocolCommand(parts) {
     if (parts.length === 0)