@zlink-systems/framework 0.30.0 → 0.30.2

package/dist/runtime/foundation/service-stateful-runtime.js

@@ -1,13 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceStatefulRuntime = void 0;
+exports.sessionOwnerFenceMatches = sessionOwnerFenceMatches;
 exports.statefulMailboxData = statefulMailboxData;
+const abort_1 = require("../abort");
+const channel_envelope_1 = require("../channels/channel-envelope");
+const runtime_message_1 = require("../backend/runtime-message");
+const dispatch_error_details_1 = require("../diagnostics/dispatch-error-details");
+const service_wire_codec_generated_1 = require("../protocol/service_wire_codec.generated");
+const routing_id_1 = require("../routing-id");
 const stream_wire_1 = require("@zlink-systems/stream-wire");
 const node_async_hooks_1 = require("node:async_hooks");
 const contracts_1 = require("../../contracts");
 const service_authority_payload_codec_1 = require("./service-authority-payload-codec");
 const ZLinkDispatchOptions_1 = require("../../contracts/Dispatch/ZLinkDispatchOptions");
-const abort_1 = require("../abort");
+const durable_service_request_1 = require("./durable-service-request");
 const admission_1 = require("../admission");
 const runtime_values_1 = require("../backend/runtime-values");
 const message_flow_1 = require("../diagnostics/message-flow");
@@ -25,12 +32,21 @@ const service_stateful_wire_codec_1 = require("./service-stateful-wire-codec");
 const service_wire_binary_primitives_1 = require("./service-wire-binary-primitives");
 const service_wire_constants_generated_1 = require("./service-wire-constants.generated");
 const service_wire_m6a_codec_1 = require("./service-wire-m6a-codec");
-const STATEFUL_OPERATION_RETRY_TICK_MS = 20;
 const MAX_NODE_TIMER_DELAY_MS = 2_147_483_647;
 const SPOT_MOVING = 34;
 const USER_SPOT_OPERATION_CAPACITY = 65_536;
 const USER_SPOT_OPERATION_REPLAY_RETENTION_MS = 5 * 60_000;
 const ACTOR_ROUTE_NOT_FOUND = 1;
+/**
+ * The receiving Session owner compares the identity carried by command 42,
+ * 51 or 54 with its current values exactly (§4).
+ */
+function sessionOwnerFenceMatches(local, fence) {
+    return ((0, routing_id_1.routingIdsEqual)(fence.sessionOwnerNodeRid, local.nodeRid) &&
+        fence.sessionOwnerNodeGeneration === local.nodeGeneration &&
+        fence.sessionOwnerId === local.ownerId &&
+        fence.sessionOwnerLeaseGeneration === local.leaseGeneration);
+}
 /**
  * Owns M6B routing, identity fences and terminal operations. Application turns
  * remain in the common mailbox, where a claimed Spot or Actor owner is serial.
@@ -78,9 +94,11 @@ class ServiceStatefulRuntime {
     asyncInstanceAuthority;
     instanceApplicationLifecycle;
     userSpotOperationHandler;
+    requestSourceAcceptance;
     messageFollowHandler;
     mailboxDropHandler;
     dispatchErrors;
+    sessionOwnerDescriptors;
     dispatchErrorMeshName;
     admittedUserSpotOperations = new Map();
     pendingInstanceActivations = new Map();
@@ -92,11 +110,48 @@ class ServiceStatefulRuntime {
         this.operations = new service_stateful_registry_1.ServiceTerminalOperationRegistry(new operation_registry_1.OperationRegistry(undefined, onPendingOperationsChanged));
         this.registry = new service_stateful_registry_1.ServiceStatefulRegistry(nodeRid, nodeGeneration);
         this.registry.createEntrySpot(nodeRid);
-        raw.setServiceIngress((record) => this.ingress(record));
+        raw.setServiceIngress((record) => this.ingress(record), acceptsStatefulIngress);
     }
     setMailboxDropHandler(handler) {
         this.mailboxDropHandler = handler;
     }
+    setSessionOwnerDescriptors(source) {
+        this.sessionOwnerDescriptors = source;
+    }
+    /** §4: this host's Session owner identity, taken from its own descriptor. */
+    localSessionOwner() {
+        const token = this.sessionOwnerDescriptors?.local();
+        return token === undefined
+            ? undefined
+            : {
+                nodeRid: this.nodeRid,
+                nodeGeneration: this.nodeGeneration,
+                ownerId: token.ownerId,
+                leaseGeneration: token.leaseGeneration
+            };
+    }
+    /**
+     * §4: the identity of the Session owner that requested a bind. It is this
+     * host's own descriptor, or the admitted peer descriptor of that exact
+     * lifecycle that passed the owner lease check. Without one the bind is
+     * rejected instead of storing a guessed identity.
+     */
+    async sessionOwnerOf(nodeRid, nodeGeneration) {
+        const token = (0, routing_id_1.routingIdsEqual)(nodeRid, this.nodeRid)
+            ? nodeGeneration === this.nodeGeneration
+                ? this.sessionOwnerDescriptors?.local()
+                : undefined
+            : await this.sessionOwnerDescriptors?.peer(nodeRid, nodeGeneration);
+        if (token === undefined) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `Session owner '${nodeRid}' has no live MeshNode descriptor for its lifecycle.`);
+        }
+        return {
+            nodeRid,
+            nodeGeneration,
+            ownerId: token.ownerId,
+            leaseGeneration: token.leaseGeneration
+        };
+    }
     setDispatchErrorReporter(reporter, meshName) {
         this.dispatchErrors = reporter;
         this.dispatchErrorMeshName = meshName;
@@ -139,7 +194,7 @@ class ServiceStatefulRuntime {
         const current = this.registry.binding(actor.ref);
         if (current?.bindingGeneration === bindingGeneration &&
             current.sessionOwnerNodeRid === sessionNodeRid &&
-            current.sessionRid === sessionRid) {
+            (0, routing_id_1.routingIdsEqual)(current.sessionRid, sessionRid)) {
             return;
         }
         this.registry.installSessionBinding({
@@ -526,6 +581,56 @@ class ServiceStatefulRuntime {
     setMessageFollowHandler(handler) {
         this.messageFollowHandler = handler;
     }
+    setRequestSourceAcceptance(acceptance) {
+        this.requestSourceAcceptance = acceptance;
+    }
+    /**
+     * Location runtime §9.3: the first accepting owner reads the sender's owner values once. A
+     * sender without a live descriptor ends the request Unavailable (Session·Actor binding §4). The
+     * polled descriptors answer without a promise; only a Store read returns one.
+     */
+    acceptRequestSource(ingress, signal) {
+        if (ingress.requestSource !== undefined)
+            return undefined;
+        const acceptance = this.requestSourceAcceptance;
+        if (acceptance === undefined)
+            return undefined;
+        const generation = ingress.sourceNodeGeneration ?? this.tryPeerGeneration(ingress.sourceRoutingId);
+        const sourceRouteHex = ingress.sourceRoute === undefined || ingress.sourceRoute.length === 0
+            ? undefined
+            : Buffer.from(ingress.sourceRoute).toString('hex');
+        const sourceRid = sourceRouteHex === undefined
+            ? ingress.sourceRoutingId
+            : (0, routing_id_1.decodeRoutingId)(ingress.sourceRoutingId, sourceRouteHex);
+        const source = generation === undefined
+            ? undefined
+            : acceptance(sourceRid, generation, sourceRouteHex ?? (0, routing_id_1.encodeRoutingIdStorageHex)(sourceRid), signal);
+        if (source instanceof Promise) {
+            return source.then((read) => this.recordRequestSource(ingress, read), (error) => {
+                if (error instanceof contracts_1.ZLinkFrameworkException &&
+                    error.kind === contracts_1.ZLinkFrameworkErrorKind.Unavailable &&
+                    this.dispatchErrors?.captureEnabled() === true) {
+                    this.dispatchErrors.report({
+                        surface: ZLinkDispatchOptions_1.ZLinkDispatchErrorSurface.Node,
+                        messageKind: ZLinkDispatchOptions_1.ZLinkDispatchMessageKind.Request,
+                        reason: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.StaleTarget,
+                        action: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorAction.ReplyError,
+                        meshName: this.dispatchErrorMeshName,
+                        sourceRid: ingress.sourceRoutingId,
+                        error
+                    });
+                }
+                throw error;
+            });
+        }
+        this.recordRequestSource(ingress, source);
+        return undefined;
+    }
+    recordRequestSource(ingress, source) {
+        if (source === undefined)
+            throw requestSourceUnavailable(ingress.sourceRoutingId);
+        ingress.requestSource = source;
+    }
     sealSpotMessageFollowIngress(source) {
         this.requireOpen();
         if (source.targetNodeRid !== this.nodeRid ||
@@ -575,6 +680,10 @@ class ServiceStatefulRuntime {
         const state = this.exactSpotMessageFollow(seal);
         if (state === undefined || state.target !== undefined)
             return false;
+        if (target === null) {
+            this.failExpiredSpotMessageFollow(state);
+            return true;
+        }
         if (!Number.isSafeInteger(durationMs) || durationMs < 0) {
             throw new RangeError('Message Follow duration must be a non-negative safe integer.');
         }
@@ -679,7 +788,7 @@ class ServiceStatefulRuntime {
         });
         return this.submitOneWay(target.targetNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)]);
     }
-    requestToSpot(sourceSpotId, requested, payload, timeoutMs) {
+    requestToSpot(sourceSpotId, requested, payload, timeoutMs, onAdmitted) {
         const pending = this.operations.register(timeoutMs);
         const target = this.acceptSpotAuthority(requested);
         if (target === undefined) {
@@ -690,11 +799,11 @@ class ServiceStatefulRuntime {
             high: this.nodeGeneration,
             low: this.nextMessageFollowOperation++
         });
-        this.submitRequest(pending, target.targetNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'spotRequest');
+        this.submitRequest(pending, target.targetNodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'spotRequest', undefined, onAdmitted);
         return pending;
     }
-    async sendToActor(target, _targetNodeGeneration, _authorityOwnerGeneration, payload, sourceActor, boundSession) {
-        const route = this.tryActorFence(target);
+    async sendToActor(target, payload, sourceActor, boundSession, routeFence) {
+        const route = routeFence ?? this.tryActorFence(target);
         if (route === undefined)
             return runtime_values_1.SubmitResult.NotFound;
         const header = (0, service_stateful_wire_codec_1.encodeActorHeader)('actorSend', route, undefined, sourceActor, boundSession === undefined
@@ -705,9 +814,10 @@ class ServiceStatefulRuntime {
             }, { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ });
         return this.submitOneWay(target.nodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)]);
     }
-    requestToActor(target, _targetNodeGeneration, _authorityOwnerGeneration, payload, timeoutMs, sourceActor, boundSession) {
-        const pending = this.operations.register(timeoutMs);
-        const route = this.tryActorFence(target);
+    requestToActor(target, payload, timeoutMs, sourceActor, boundSession, onAdmitted, routeFence) {
+        const operationLow = this.nextMessageFollowOperation++;
+        const pending = this.operations.register(timeoutMs, 'registry', operationLow);
+        const route = routeFence ?? this.tryActorFence(target);
         if (route === undefined) {
             this.operations.reply(pending.id, (0, framework_errors_internal_1.internalFrameworkWireReply)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale));
             return pending;
@@ -717,10 +827,18 @@ class ServiceStatefulRuntime {
             : {
                 ...boundSession,
                 sequence: this.nextSessionSequence++
-            }, { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ });
-        this.submitRequest(pending, target.nodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'actorRequest');
+            }, { high: this.nodeGeneration, low: operationLow });
+        this.submitRequest(pending, target.nodeRid, [header, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)], timeoutMs, 'actorRequest', undefined, onAdmitted);
         return pending;
     }
+    acceptRelocatedActorTerminal(operation, replyRouteId, result) {
+        if (operation.high !== this.nodeGeneration ||
+            this.operations.context(replyRouteId) !== operation.low)
+            return undefined;
+        return this.operations.reply(replyRouteId, result, service_stateful_registry_1.RELOCATION_REPLY_RETENTION_MS)
+            ? 'terminalReceived'
+            : 'alreadyTerminal';
+    }
     async sendToInstanceSpot(route, payload, sourceSpotId, metadataFrame, instanceIntent = false) {
         return this.submitOneWay(route.targetNodeRid, instanceOperationParts([
             (0, service_stateful_wire_codec_1.encodeInstanceSpotHeader)(route, this.nodeGeneration, this.nodeRid, sourceSpotId, 'send', { high: 0n, low: 0n }, undefined, metadataFrame !== undefined, instanceIntent),
@@ -737,12 +855,12 @@ class ServiceStatefulRuntime {
             payloadFrame
         ], metadataFrame));
     }
-    requestToInstanceSpot(route, payload, timeoutMs, sourceSpotId, metadataFrame, instanceIntent = false) {
+    requestToInstanceSpot(route, payload, timeoutMs, sourceSpotId, metadataFrame, instanceIntent = false, onAdmitted) {
         const pending = this.operations.register(timeoutMs);
         this.submitRequest(pending, route.targetNodeRid, instanceOperationParts([
             (0, service_stateful_wire_codec_1.encodeInstanceSpotHeader)(route, this.nodeGeneration, this.nodeRid, sourceSpotId, 'request', { high: operation_identity_1.ZLINK_NATIVE_CORRELATION_OPERATION_NAMESPACE, low: pending.id }, pending.id, metadataFrame !== undefined, instanceIntent),
             (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload)
-        ], metadataFrame), timeoutMs, 'instanceSpotRequest');
+        ], metadataFrame), timeoutMs, 'instanceSpotRequest', undefined, onAdmitted);
         return pending;
     }
     requestToMissingInstanceSpot(target, payload, timeoutMs, sourceSpotId, metadataFrame) {
@@ -750,13 +868,13 @@ class ServiceStatefulRuntime {
         const payloadFrame = (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload);
         return this.requestToMissingInstanceSpotFrame(target, payloadFrame, deadlineUnixMs, sourceSpotId, metadataFrame);
     }
-    requestToMissingInstanceSpotFrame(target, payloadFrame, deadlineUnixMs, sourceSpotId, metadataFrame) {
+    requestToMissingInstanceSpotFrame(target, payloadFrame, deadlineUnixMs, sourceSpotId, metadataFrame, onAdmitted) {
         const timeoutMs = remainingDeadlineMs(deadlineUnixMs);
         const pending = this.operations.register(timeoutMs);
         this.submitRequest(pending, target.targetNodeRid, instanceOperationParts([
             (0, service_stateful_wire_codec_1.encodeInstanceSpotActivationHeader)(target, this.nodeGeneration, this.nodeRid, sourceSpotId, 'request', { high: operation_identity_1.ZLINK_NATIVE_CORRELATION_OPERATION_NAMESPACE, low: pending.id }, deadlineUnixMs, pending.id, metadataFrame !== undefined),
             payloadFrame
-        ], metadataFrame), timeoutMs, 'instanceSpotRequest');
+        ], metadataFrame), timeoutMs, 'instanceSpotRequest', undefined, onAdmitted);
         return pending;
     }
     lookupRemoteActor(targetNodeRid, actorId, timeoutMs) {
@@ -845,26 +963,40 @@ class ServiceStatefulRuntime {
         });
         return pending;
     }
-    bindSession(sessionRid, actor, timeoutMs, deliver, onBindingReplaced, actorAuthority) {
+    bindSession(sessionRid, actor, timeoutMs, deliver, onBindingReplaced, actorAuthority, close) {
         const deadlineMs = performance.now() + timeoutMs;
         const pending = this.operations.register(timeoutMs, 'sender');
-        const generation = this.nextSessionSequence++;
+        const sessionOwner = this.localSessionOwner();
+        if (sessionOwner === undefined) {
+            this.operations.reply(pending.id, failure((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `Session owner '${this.nodeRid}' has no live MeshNode descriptor.`)));
+            return pending;
+        }
+        const deliveryKey = actorKey(actor);
+        const previousDelivery = this.sessionDeliveries.get(deliveryKey);
+        const previousBinding = previousDelivery?.binding;
+        const generation = previousBinding !== undefined &&
+            sameActorRef(previousBinding.actor, actor) &&
+            previousBinding.sessionRid === sessionRid &&
+            previousBinding.sessionOwnerNodeRid === sessionOwner.nodeRid &&
+            previousBinding.sessionOwnerNodeGeneration === sessionOwner.nodeGeneration
+            ? previousBinding.bindingGeneration
+            : this.nextSessionSequence++;
         const localBinding = {
             actor,
             sessionRid,
-            sessionOwnerNodeRid: this.nodeRid,
-            sessionOwnerNodeGeneration: this.nodeGeneration,
-            sessionOwnerId: this.nodeRid,
-            sessionOwnerLeaseGeneration: this.nodeGeneration,
+            sessionOwnerNodeRid: sessionOwner.nodeRid,
+            sessionOwnerNodeGeneration: sessionOwner.nodeGeneration,
+            sessionOwnerId: sessionOwner.ownerId,
+            sessionOwnerLeaseGeneration: sessionOwner.leaseGeneration,
             bindingGeneration: generation,
             membershipEpoch: this.registry.actor(actor.actorId)?.membershipEpoch ?? 1n
         };
         const delivery = {
             binding: localBinding,
             deliver,
+            ...(close === undefined ? {} : { close }),
             ...(onBindingReplaced === undefined ? {} : { onBindingReplaced })
         };
-        const deliveryKey = actorKey(actor);
         if (actor.nodeRid === this.nodeRid) {
             let installedDelivery;
             try {
@@ -887,11 +1019,7 @@ class ServiceStatefulRuntime {
                     });
                     return pending;
                 }
-                const previousDelivery = this.sessionDeliveries.get(deliveryKey);
-                const binding = this.registry.bindSession(actor, sessionRid, this.nodeRid, this.nodeGeneration, this.nodeRid, this.nodeGeneration);
-                if (previousDelivery !== undefined && previous !== undefined) {
-                    this.retiredSessionDeliveries.set(sessionDeliveryKey(previous), previousDelivery);
-                }
+                const binding = this.registry.installSessionBinding(localBinding);
                 installedDelivery = { ...delivery, binding };
                 this.sessionDeliveries.set(deliveryKey, installedDelivery);
                 this.operations.reply(pending.id, {
@@ -899,7 +1027,10 @@ class ServiceStatefulRuntime {
                     failureCode: 0,
                     kindData: undefined
                 });
-                if (previous !== undefined) {
+                if (previous !== undefined && previous !== binding) {
+                    if (previousDelivery !== undefined) {
+                        this.retiredSessionDeliveries.set(sessionDeliveryKey(previous), previousDelivery);
+                    }
                     this.sendBoundSessionReplacement(previous, actorAuthorityFromRoute(this.tryActorFence(actor) ?? {
                         actor,
                         targetNodeGeneration: this.nodeGeneration,
@@ -917,7 +1048,6 @@ class ServiceStatefulRuntime {
             }
             return pending;
         }
-        const previousDelivery = this.sessionDeliveries.get(deliveryKey);
         let bindingActorFence;
         let header;
         try {
@@ -955,7 +1085,10 @@ class ServiceStatefulRuntime {
                         // Publish the exact Location authority used by command 38 in the
                         // same Session-owner completion turn as the binding route. Actor
                         // lookup only carries a peer-lifecycle fallback for owner lease.
-                        this.rememberActorRoute(bindingActorFence);
+                        this.rememberActorRoute({
+                            ...bindingActorFence,
+                            authorityOwnerGeneration: result.streamBinding.authorityOwnerGeneration
+                        });
                         this.sessionDeliveries.set(deliveryKey, committed);
                     }
                 }
@@ -963,11 +1096,38 @@ class ServiceStatefulRuntime {
             })
         };
     }
+    closeBoundSession(actor, expectedBindingGeneration, timeoutMs) {
+        const pending = this.operations.register(timeoutMs);
+        const binding = this.registry.binding(actor);
+        if (binding === undefined) {
+            this.operations.reply(pending.id, (0, framework_errors_internal_1.internalFrameworkWireReply)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorSessionNotBound));
+            return pending;
+        }
+        const header = Buffer.from((0, service_wire_codec_generated_1.encodeBoundSessionCloseCommand)({
+            command: 'boundSessionClose',
+            flags: 0,
+            correlation: pending.id,
+            actor: { actorId: actor.actorId, objectGeneration: actor.generation },
+            session: {
+                sessionOwnerNodeRid: Buffer.from((0, routing_id_1.encodeRoutingIdStorageHex)(binding.sessionOwnerNodeRid), 'hex'),
+                sessionOwnerNodeGeneration: binding.sessionOwnerNodeGeneration,
+                sessionOwnerId: binding.sessionOwnerId,
+                sessionOwnerLeaseGeneration: binding.sessionOwnerLeaseGeneration,
+                sessionRid: Buffer.from((0, routing_id_1.encodeRoutingIdStorageHex)(binding.sessionRid), 'hex'),
+                retiredBindingGeneration: expectedBindingGeneration
+            }
+        }, {})[0]);
+        const reply = (0, routing_id_1.routingIdsEqual)(binding.sessionOwnerNodeRid, this.nodeRid)
+            ? this.requestLocalInfrastructure(header, pending.id, timeoutMs)
+            : this.raw.requestService(binding.sessionOwnerNodeRid, [header], timeoutMs);
+        void reply.then((parts) => this.completeRemoteReply(pending, binding.sessionOwnerNodeRid, 'boundSessionClose', undefined, parts), (error) => this.operations.fail(pending.id, error));
+        return pending;
+    }
     unbindSession(sessionRid, actor, expectedBindingGeneration, timeoutMs) {
         const pending = this.operations.register(timeoutMs);
         const delivery = this.sessionDeliveries.get(actorKey(actor));
         if (delivery === undefined ||
-            delivery.binding.sessionRid !== sessionRid ||
+            !(0, routing_id_1.routingIdsEqual)(delivery.binding.sessionRid, sessionRid) ||
             delivery.binding.bindingGeneration !== expectedBindingGeneration) {
             this.operations.reply(pending.id, (0, framework_errors_internal_1.internalFrameworkWireReply)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale));
             return pending;
@@ -993,7 +1153,7 @@ class ServiceStatefulRuntime {
     sessionBindings(sessionRid) {
         return [...this.sessionDeliveries.values()]
             .map((value) => value.binding)
-            .filter((binding) => binding.sessionRid === sessionRid)
+            .filter((binding) => (0, routing_id_1.routingIdsEqual)(binding.sessionRid, sessionRid))
             .map((binding) => {
             const owner = requireSessionOwnerIdentity(binding);
             return {
@@ -1009,10 +1169,10 @@ class ServiceStatefulRuntime {
     }
     async sendSessionToActor(sessionRid, actor, payload) {
         const delivery = this.sessionDeliveries.get(actorKey(actor));
-        if (delivery === undefined || delivery.binding.sessionRid !== sessionRid) {
+        if (delivery === undefined || !(0, routing_id_1.routingIdsEqual)(delivery.binding.sessionRid, sessionRid)) {
             return runtime_values_1.SubmitResult.NotFound;
         }
-        return this.sendToActor(actor, this.peerGeneration(actor.nodeRid), actor.generation, payload, undefined, {
+        return this.sendToActor(actor, payload, undefined, {
             sessionRid,
             bindingGeneration: delivery.binding.bindingGeneration
         });
@@ -1046,6 +1206,10 @@ class ServiceStatefulRuntime {
     get pendingOperationCount() {
         return this.operations.size;
     }
+    /** The next stateful request expiry, as a lower bound. */
+    nextMaintenanceDeadlineMs() {
+        return this.operations.nextDeadlineMs();
+    }
     close() {
         if (this.closed)
             return;
@@ -1071,26 +1235,10 @@ class ServiceStatefulRuntime {
         }
         this.spotMessageFollow.clear();
     }
+    cancelPendingOperations(reason) {
+        this.operations.failAll(reason);
+    }
     async ingress(record) {
-        // These frozen relocation controls overlap the legacy stateful command
-        // number range (30-34). They are bare infrastructure records and must
-        // fall through to RawServiceMeshRuntime's relocation ingress instead of
-        // being decoded as stateful actor/spot work.
-        if (record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationReady ||
-            record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationData ||
-            record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelay ||
-            record.command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationCutover) {
-            return undefined;
-        }
-        if (record.command < service_stateful_wire_codec_1.M6bServiceWireCommand.spotSend ||
-            (record.command > service_stateful_wire_codec_1.M6bServiceWireCommand.instanceSpot &&
-                record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.userSpotCreate &&
-                record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.userSpotClose &&
-                record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.actorCreate &&
-                record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.messageFollow &&
-                record.command !== service_stateful_wire_codec_1.M6bServiceWireCommand.boundSessionReplaced)) {
-            return undefined;
-        }
         let decoded;
         let canonicalActorJoin;
         try {
@@ -1130,7 +1278,8 @@ class ServiceStatefulRuntime {
                 decoded.kind === 'userSpotClose' ||
                 decoded.kind === 'actorCreate' ||
                 decoded.kind === 'messageFollow' ||
-                decoded.kind === 'boundSessionReplaced';
+                decoded.kind === 'boundSessionReplaced' ||
+                decoded.kind === 'boundSessionClose';
             if (record.parts.length < 1 ||
                 record.parts.length > (instanceMetadata || statefulMetadata ? 3 : 2) ||
                 (hasPayload &&
@@ -1162,7 +1311,7 @@ class ServiceStatefulRuntime {
                 if (decoded.kind === 'instanceSpot' &&
                     decoded.activation === 'missing' &&
                     (error instanceof contracts_1.ZLinkFrameworkException || error instanceof service_stateful_registry_1.ServiceStaleGenerationError)) {
-                    this.finishMissingInstanceActivationFailure(record, decoded, error);
+                    this.finishMissingInstanceActivationFailure(record, decoded, error, undefined, payloadFrame);
                     return 'infrastructure';
                 }
                 const correlation = statefulCorrelation(decoded);
@@ -1266,7 +1415,7 @@ class ServiceStatefulRuntime {
                     : this.validateActorFence(record.target);
                 if (record.boundSession !== undefined) {
                     const binding = this.registry.validateBoundSession(record.target.actor, record.boundSession.bindingGeneration);
-                    if (binding.sessionRid !== record.boundSession.sessionRid ||
+                    if (!(0, routing_id_1.routingIdsEqual)(binding.sessionRid, record.boundSession.sessionRid) ||
                         binding.sessionOwnerNodeRid !== ingress.sourceRoutingId) {
                         throw new service_stateful_registry_1.ServiceStaleGenerationError('binding', record.target.actor.actorId);
                     }
@@ -1283,12 +1432,13 @@ class ServiceStatefulRuntime {
                         : { sourceBindingGeneration: record.boundSession.bindingGeneration }),
                     targetActor: actor.ref,
                     messageFollowOrigin: {
-                        sourceNodeRid: ingress.sourceRoutingId,
-                        originalOperation: {
-                            high: this.peerGeneration(ingress.sourceRoutingId),
-                            low: record.correlation ?? this.nextMessageFollowOperation++
+                        get requestSource() {
+                            return ingress.requestSource;
                         },
-                        originalReplyRouteId: ingress.requestSequence ?? 0n
+                        target: record.target,
+                        sourceNodeRid: ingress.sourceRoutingId,
+                        originalOperation: record.operation,
+                        originalReplyRouteId: record.correlation ?? 0n
                     },
                     ...(record.kind === 'actorRequest'
                         ? { reply: this.replyPort(ingress, record.correlation) }
@@ -1312,7 +1462,9 @@ class ServiceStatefulRuntime {
                 this.validateSpotFence(record.target);
                 return this.enqueueActorJoin(ingress, record, payloadFrame, canonicalActorJoin, canonicalActorJoinPayload);
             case 'boundSessionBind':
-                return this.replySessionBind(ingress, record);
+                return await this.replySessionBind(ingress, record);
+            case 'boundSessionClose':
+                return await this.handleBoundSessionClose(ingress, record);
             case 'boundSessionReplaced':
                 return this.handleBoundSessionReplaced(ingress, record);
             case 'boundSessionSend':
@@ -1329,12 +1481,14 @@ class ServiceStatefulRuntime {
         if (record.activation === 'missing' && this.asyncInstanceAuthority !== undefined) {
             const ownedIngress = shareIngressOwnership(ingress);
             void this.continueMissingInstanceActivation(ownedIngress, record, payloadFrame, localReply, metadataFrame).finally(() => ownedIngress.applicationJobOwner?.close());
+            ingress.onAdmitted?.();
             return 'infrastructure';
         }
         if (record.activation === 'ready' &&
             this.needsInstanceApplicationMaterialization(ingress, record)) {
             const ownedIngress = shareIngressOwnership(ingress);
             void this.continueReadyInstanceMaterialization(ownedIngress, record, payloadFrame, metadataFrame).finally(() => ownedIngress.applicationJobOwner?.close());
+            ingress.onAdmitted?.();
             return 'infrastructure';
         }
         const spot = this.requireInstanceActivation(ingress, record);
@@ -1447,7 +1601,7 @@ class ServiceStatefulRuntime {
             });
         }
         catch (error) {
-            this.finishMissingInstanceActivationFailure(ingress, record, error, localReply);
+            this.finishMissingInstanceActivationFailure(ingress, record, error, localReply, payloadFrame);
         }
     }
     async continueReadyInstanceMaterialization(ingress, record, payloadFrame, metadataFrame) {
@@ -1470,6 +1624,7 @@ class ServiceStatefulRuntime {
             const refreshedRecord = latestRoute !== undefined && sameInstanceApplicationOwner(latestRoute, record.route)
                 ? { ...record, route: latestRoute }
                 : record;
+            this.publishCommittedInstanceRoute(intent.instanceType, refreshedRecord.route);
             const spot = this.requireInstanceActivation(ingress, refreshedRecord);
             const admitted = this.enqueueActivatedInstanceSpot(ingress, record, payloadFrame, spot, undefined, this.instanceApplicationTerminalCompletion(this.instanceApplicationTarget(refreshedRecord)), metadataFrame, undefined, this.instanceApplicationTarget(refreshedRecord));
             if (admitted !== 'application') {
@@ -1591,7 +1746,7 @@ class ServiceStatefulRuntime {
         for (const waiter of waiters)
             waiter();
     }
-    finishMissingInstanceActivationFailure(ingress, record, error, localReply) {
+    finishMissingInstanceActivationFailure(ingress, record, error, localReply, payloadFrame) {
         if (record.operationKind === 'request') {
             if (record.deadlineUnixMs <= BigInt(Date.now()))
                 return;
@@ -1605,17 +1760,46 @@ class ServiceStatefulRuntime {
             return;
         }
         const reporter = this.dispatchErrors;
+        const tracePoint = (0, message_flow_1.flowIfEnabled)(reporter?.flow, ZLinkDispatchOptions_1.ZLinkRuntimeMessageFlowOutcome.Dropped);
+        if (tracePoint === undefined && reporter?.captureEnabled() !== true)
+            return;
+        const reason = (0, abort_1.isAbortError)(error)
+            ? ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.Shutdown
+            : (0, dispatch_error_details_1.dispatchReasonFromError)(error);
+        // Decode the retained first message only after diagnostics accepts the terminal.
+        // Detached local and remote activation share this owner and its explicit flow.
+        const payload = payloadFrame === undefined ? undefined : (0, service_wire_m6a_codec_1.decodeApplicationPayloadView)(payloadFrame);
+        const header = payload?.contentType === service_wire_constants_generated_1.SERVICE_FRAMEWORK_MULTIPART_CONTENT_TYPE
+            ? (0, channel_envelope_1.decodeChannelHeader)((0, service_wire_m6a_codec_1.decodeMultipartApplicationParts)(payloadFrame, runtime_message_1.ZLinkBufferMessage.fromOwned), reporter?.flow.flowCreationEnabled())
+            : undefined;
+        const context = {
+            surface: ZLinkDispatchOptions_1.ZLinkDispatchErrorSurface.InstanceSpot,
+            messageKind: ZLinkDispatchOptions_1.ZLinkDispatchMessageKind.Send,
+            meshName: this.dispatchErrorMeshName,
+            sourceRid: record.sourceNodeRid,
+            spotId: record.target.targetSpotId,
+            instanceSpotType: record.target.stableType,
+            activationState: 'activating',
+            packetName: header?.messageName ?? payload?.packetName,
+            flowId: header?.flowId,
+            flowOrigin: header?.flowOrigin
+        };
+        tracePoint?.trace({
+            ...context,
+            outcome: ZLinkDispatchOptions_1.ZLinkRuntimeMessageFlowOutcome.Dropped,
+            errorReason: reason === ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.Shutdown
+                ? reason
+                : error instanceof contracts_1.ZLinkFrameworkException &&
+                    error.kind === contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded
+                    ? 'activation_timeout'
+                    : 'activation_rejected',
+            ...(0, dispatch_error_details_1.dispatchErrorDetails)(error)
+        });
         if (reporter?.captureEnabled() === true) {
             reporter.report({
-                surface: ZLinkDispatchOptions_1.ZLinkDispatchErrorSurface.InstanceSpot,
-                messageKind: ZLinkDispatchOptions_1.ZLinkDispatchMessageKind.Send,
-                reason: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.StaleTarget,
+                ...context,
+                reason,
                 action: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorAction.Drop,
-                meshName: this.dispatchErrorMeshName,
-                sourceRid: record.sourceNodeRid,
-                spotId: record.target.targetSpotId,
-                instanceSpotType: record.target.stableType,
-                activationState: 'activating',
                 error
             });
         }
@@ -1754,11 +1938,17 @@ class ServiceStatefulRuntime {
     activateMissingInstanceAsync(record, payloadFrame, metadataFrame, admit) {
         const key = record.target.targetSpotId;
         const pending = this.pendingInstanceActivations.get(key);
+        const metric = pending === undefined
+            ? this.dispatchErrors?.metrics?.startInstanceSpotActivation(record.target.targetMeshName, record.target.stableType)
+            : undefined;
         const ready = pending ??
-            this.runMissingInstanceActivation(record, payloadFrame, metadataFrame).then((activation) => ({
-                ...activation,
-                stableType: record.target.stableType
-            }));
+            this.runMissingInstanceActivation(record, payloadFrame, metadataFrame).then((activation) => {
+                metric?.complete('ready');
+                return { ...activation, stableType: record.target.stableType };
+            }, (error) => {
+                metric?.complete(instanceActivationOutcome(error));
+                throw error;
+            });
         const operation = ready.then(async (value) => {
             if (pending !== undefined) {
                 await this.asyncInstanceAuthority?.read(record.target, undefined, {
@@ -1786,10 +1976,24 @@ class ServiceStatefulRuntime {
         return operation;
     }
     async runMissingInstanceActivation(record, payloadFrame, metadataFrame) {
+        const deadline = operationDeadline(record.deadlineUnixMs);
+        try {
+            deadline.signal.throwIfAborted();
+            return await (0, abort_1.awaitWithAbort)(this.runMissingInstanceActivationCore(record, payloadFrame, metadataFrame, deadline.signal), deadline.signal);
+        }
+        catch (error) {
+            if ((0, abort_1.isAbortError)(error) && deadline.signal.aborted)
+                throw deadline.signal.reason;
+            throw error;
+        }
+        finally {
+            deadline.close();
+        }
+    }
+    async runMissingInstanceActivationCore(record, payloadFrame, metadataFrame, signal) {
         const target = record.target;
         if (target.targetNodeRid !== this.nodeRid ||
-            target.targetNodeGeneration !== this.nodeGeneration ||
-            record.deadlineUnixMs < BigInt(Date.now())) {
+            target.targetNodeGeneration !== this.nodeGeneration) {
             throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
         }
         const authority = this.asyncInstanceAuthority;
@@ -1883,21 +2087,18 @@ class ServiceStatefulRuntime {
                 throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
             }
         }
-        const deadline = operationDeadline(record.deadlineUnixMs);
-        let reserved;
-        try {
-            reserved = await authority.reserve(activationRequest, deadline.signal);
-        }
-        finally {
-            deadline.close();
-        }
-        if (this.closed || record.deadlineUnixMs < BigInt(Date.now())) {
+        const reserved = await authority.reserve(activationRequest, signal);
+        if (this.closed || signal.aborted) {
+            const error = new contracts_1.ZLinkFrameworkException(this.closed
+                ? contracts_1.ZLinkFrameworkErrorKind.ShuttingDown
+                : contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded, this.closed ? 'Runtime stopped during Instance activation.' : 'Operation deadline exceeded.');
             await authority.abort(target, reserved.reservation);
-            throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
+            throw error;
         }
         let activation;
         try {
             await this.instanceApplicationLifecycle?.materialize(target, reserved.reservation.attempt);
+            signal.throwIfAborted();
             activation = this.activateInstanceSpot(target.targetSpotId, target.stableType, reserved.reservation.attempt, reserved.reservation.authorityOwnerGeneration);
         }
         catch (error) {
@@ -1943,7 +2144,6 @@ class ServiceStatefulRuntime {
                 this.registry.closeSpot(activation.spot.ref);
             throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
         }
-        this.publishCommittedInstanceRoute(target.stableType, route);
         const confirmed = await authority.read(target);
         if (confirmed.kind !== 'ready' || !sameInstanceRoute(confirmed.route, route)) {
             if (confirmed.kind === 'ready' && confirmed.route.targetNodeRid !== this.nodeRid) {
@@ -1956,6 +2156,7 @@ class ServiceStatefulRuntime {
             !routeMatchesLocal(confirmed.route, current, this.nodeRid, this.nodeGeneration)) {
             throw new service_stateful_registry_1.ServiceStaleGenerationError('spot', target.targetSpotId);
         }
+        this.publishCommittedInstanceRoute(target.stableType, confirmed.route);
         return { spot: current, route: confirmed.route };
     }
     publishCommittedInstanceRoute(stableType, route, expectedCurrentRoute) {
@@ -1967,6 +2168,9 @@ class ServiceStatefulRuntime {
                 : instanceRouteAsDirectRoute(expectedCurrentRoute);
         this.rememberSpotRoute(directRoute, expectedDirectRoute);
         this.registerInstanceIntent(stableType, route, expectedCurrentRoute);
+        const target = this.instanceSpotApplicationTarget(route.targetSpotId);
+        if (target !== undefined)
+            this.instanceApplicationLifecycle?.publish?.({ targetSpotId: route.targetSpotId, ...target });
     }
     replaceCommittedInstanceRoute(stableType, previous, next) {
         const current = this.instanceIntents.get(previous.targetSpotId);
@@ -2075,39 +2279,30 @@ class ServiceStatefulRuntime {
         }
         return 'infrastructure';
     }
-    replySessionBind(ingress, record) {
+    async replySessionBind(ingress, record) {
         try {
             if (record.binding.state === 'active') {
+                const sessionOwner = await this.sessionOwnerOf(ingress.sourceRoutingId, ingress.sourceNodeGeneration ?? this.peerGeneration(ingress.sourceRoutingId));
                 const actor = this.validateActorFence(record.actor);
-                const previous = this.registry.binding(actor.ref);
-                const sourceGeneration = ingress.sourceNodeGeneration ?? this.peerGeneration(ingress.sourceRoutingId);
-                const binding = (0, service_stateful_wire_codec_1.sessionBindingFromWire)(actor.ref, record.sessionRid, ingress.sourceRoutingId, record.binding.generation, actor.membershipEpoch, sourceGeneration, ingress.sourceRoutingId, sourceGeneration);
-                if (previous !== undefined && sameSessionIdentity(previous, binding)) {
-                    // Registry publication is the last step of the first binding owner
-                    // turn, so an observable same-Session binding already has every
-                    // Actor route projection installed and can complete idempotently.
-                    this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Ok, 0, undefined, {
-                        kind: 'streamBind',
-                        bindingGeneration: previous.bindingGeneration,
-                        authorityOwnerGeneration: actor.authorityOwnerGeneration
-                    });
-                    return 'infrastructure';
-                }
+                const binding = (0, service_stateful_wire_codec_1.sessionBindingFromWire)(actor.ref, record.sessionRid, sessionOwner.nodeRid, record.binding.generation, actor.membershipEpoch, sessionOwner.nodeGeneration, sessionOwner.ownerId, sessionOwner.leaseGeneration);
+                let completedBinding = binding;
                 const accepted = this.enqueueActorBindingControl(ingress, binding, record.actor, (terminalResult, failureCode) => {
-                    let completedBinding = binding;
                     let replacedBinding;
                     if (terminalResult === runtime_values_1.RequestResult.Ok) {
                         // This callback runs inside the Actor binding control turn,
-                        // after the Host has installed its Actor-to-session projection.
+                        // before the Host copies the accepted Actor-to-session projection.
                         // Publish the authority-owned registry view in that same turn
                         // before making the terminal reply observable.
                         const turnCurrent = this.registry.binding(actor.ref);
-                        if (turnCurrent !== undefined && sameSessionIdentity(turnCurrent, binding)) {
-                            completedBinding = turnCurrent;
+                        try {
+                            completedBinding = this.registry.installSessionBinding(binding);
+                            if (turnCurrent !== completedBinding)
+                                replacedBinding = turnCurrent;
                         }
-                        else {
-                            replacedBinding = turnCurrent;
-                            this.registry.installSessionBinding(binding);
+                        catch (error) {
+                            const result = failure(error);
+                            this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+                            return false;
                         }
                     }
                     this.replyWire(ingress, record.correlation, terminalResult, failureCode, undefined, terminalResult === runtime_values_1.RequestResult.Ok
@@ -2126,7 +2321,7 @@ class ServiceStatefulRuntime {
                         }));
                     }
                     return true;
-                });
+                }, () => completedBinding);
                 if (!accepted) {
                     const result = failure((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Actor '${actor.ref.actorId}' no longer accepts session bindings.`));
                     this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
@@ -2142,6 +2337,29 @@ class ServiceStatefulRuntime {
         }
         return 'infrastructure';
     }
+    async handleBoundSessionClose(ingress, record) {
+        if (ingress.requestSequence === undefined)
+            return 'protocolError';
+        try {
+            const delivery = this.sessionDeliveries.get(actorKey(record.actor));
+            const sessionOwner = this.localSessionOwner();
+            if (sessionOwner === undefined ||
+                !sessionOwnerFenceMatches(sessionOwner, record.session) ||
+                delivery === undefined ||
+                delivery.binding.actor.generation !== record.actor.generation ||
+                !exactRetiredDelivery(delivery.binding, record.session) ||
+                delivery.close === undefined) {
+                throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, 'The requested session binding is no longer current.');
+            }
+            await delivery.close();
+            this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Ok, 0);
+        }
+        catch (error) {
+            const result = failure(error);
+            this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+        }
+        return 'infrastructure';
+    }
     /**
      * Handles the replacement notice at the retired session owner.  This path
      * intentionally never calls validateActorFence(): the notice is authorized
@@ -2161,10 +2379,13 @@ class ServiceStatefulRuntime {
             // session that belongs to the new lifecycle.
             return 'infrastructure';
         }
-        if (record.retiredSession.sessionOwnerNodeRid !== this.nodeRid ||
-            record.retiredSession.sessionOwnerNodeGeneration !== this.nodeGeneration ||
-            record.retiredSession.sessionOwnerId !== this.nodeRid ||
-            record.retiredSession.sessionOwnerLeaseGeneration !== this.nodeGeneration) {
+        const sessionOwner = this.localSessionOwner();
+        if (sessionOwner === undefined) {
+            (0, message_flow_1.traceSessionBindingControlDrop)(this.dispatchErrors?.flow, ingress.sourceRoutingId, authority.actor.actorId, 'boundSessionReplaced', 'location_unavailable');
+            return 'infrastructure';
+        }
+        if (!sessionOwnerFenceMatches(sessionOwner, record.retiredSession)) {
+            (0, message_flow_1.traceSessionBindingControlDrop)(this.dispatchErrors?.flow, ingress.sourceRoutingId, authority.actor.actorId, 'boundSessionReplaced', 'stale_target');
             return 'infrastructure';
         }
         const actor = authority.actor;
@@ -2190,6 +2411,9 @@ class ServiceStatefulRuntime {
         if (delivery === undefined)
             return 'infrastructure';
         this.appliedReplacementNotices.add(key);
+        if (delivery === current) {
+            this.sessionDeliveries.delete(deliveryKey);
+        }
         delivery.onBindingReplaced?.(actor.actorId, record.retiredSession, actor);
         if (retired !== undefined) {
             this.retiredSessionDeliveries.delete(sessionDeliveryKey(retired.binding));
@@ -2197,14 +2421,18 @@ class ServiceStatefulRuntime {
         return 'infrastructure';
     }
     sendBoundSessionReplacement(previous, actorAuthority) {
-        const ownerGeneration = previous.sessionOwnerNodeGeneration ?? this.tryPeerGeneration(previous.sessionOwnerNodeRid);
-        if (ownerGeneration === undefined)
+        // Command 51 carries the retired binding's stored identity unchanged; a
+        // binding without one has nothing to notify.
+        if (previous.sessionOwnerNodeGeneration === undefined ||
+            previous.sessionOwnerId === undefined ||
+            previous.sessionOwnerLeaseGeneration === undefined) {
             return;
+        }
         const header = (0, service_stateful_wire_codec_1.encodeBoundSessionReplacedHeader)(actorAuthority, {
             sessionOwnerNodeRid: previous.sessionOwnerNodeRid,
-            sessionOwnerNodeGeneration: ownerGeneration,
-            sessionOwnerId: previous.sessionOwnerId ?? previous.sessionOwnerNodeRid,
-            sessionOwnerLeaseGeneration: previous.sessionOwnerLeaseGeneration ?? ownerGeneration,
+            sessionOwnerNodeGeneration: previous.sessionOwnerNodeGeneration,
+            sessionOwnerId: previous.sessionOwnerId,
+            sessionOwnerLeaseGeneration: previous.sessionOwnerLeaseGeneration,
             sessionRid: previous.sessionRid,
             retiredBindingGeneration: previous.bindingGeneration
         });
@@ -2222,11 +2450,9 @@ class ServiceStatefulRuntime {
         if (current === undefined ||
             sourceGeneration === undefined ||
             current.bindingGeneration !== record.binding.retiredGeneration ||
-            current.sessionRid !== record.sessionRid ||
+            !(0, routing_id_1.routingIdsEqual)(current.sessionRid, record.sessionRid) ||
             current.sessionOwnerNodeRid !== ingress.sourceRoutingId ||
-            current.sessionOwnerNodeGeneration !== sourceGeneration ||
-            current.sessionOwnerId !== ingress.sourceRoutingId ||
-            current.sessionOwnerLeaseGeneration !== sourceGeneration) {
+            current.sessionOwnerNodeGeneration !== sourceGeneration) {
             this.replyWire(ingress, record.correlation, runtime_values_1.RequestResult.Ok, 0);
             return;
         }
@@ -2358,6 +2584,31 @@ class ServiceStatefulRuntime {
             errorReason: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.StaleTarget
         });
     }
+    prepareRequestSource(ingress, stateful, signal) {
+        const reject = (error) => {
+            if (signal.aborted)
+                return false;
+            if (!(error instanceof contracts_1.ZLinkFrameworkException))
+                throw error;
+            const result = failure(error);
+            stateful.reply?.(result.terminalResult, result.failureCode);
+            return false;
+        };
+        if (signal.aborted)
+            return false;
+        try {
+            const pending = this.acceptRequestSource(ingress, signal);
+            return pending === undefined
+                ? true
+                : (0, abort_1.awaitWithAbort)(pending, signal).then(() => true, reject);
+        }
+        catch (error) {
+            return reject(error);
+        }
+    }
+    prepareDispatch(record, signal) {
+        return this.prepareRequestSource(record.ingress, record.stateful, signal);
+    }
     enqueueApplicationFrame(ingress, owner, payloadFrame, stateful) {
         return this.enqueueFrame('application', ingress, owner, payloadFrame, stateful);
     }
@@ -2371,6 +2622,10 @@ class ServiceStatefulRuntime {
             domain,
             parts: [ingress.parts[0], payloadFrame],
             sourceRoutingId: ingress.sourceRoutingId,
+            ingress,
+            get requestSource() {
+                return ingress.requestSource;
+            },
             sourceRoute: ingress.sourceRoute,
             ...(ingress.reply === undefined ? {} : { reply: ingress.reply }),
             ...(ingress.requestSequence === undefined
@@ -2378,10 +2633,20 @@ class ServiceStatefulRuntime {
                 : { requestSequence: ingress.requestSequence }),
             ...(stateful.correlation === undefined ? {} : { correlation: stateful.correlation }),
             stateful,
+            sourcePreparationOwner: domain === 'application' &&
+                this.requestSourceAcceptance !== undefined &&
+                (stateful.receiveKind === service_runtime_contracts_1.ReceiveKind.SpotSend ||
+                    stateful.receiveKind === service_runtime_contracts_1.ReceiveKind.SpotRequest ||
+                    stateful.receiveKind === service_runtime_contracts_1.ReceiveKind.ActorSend ||
+                    stateful.receiveKind === service_runtime_contracts_1.ReceiveKind.ActorRequest)
+                ? this
+                : undefined,
             applicationJob
         });
-        if (accepted)
+        if (accepted) {
+            ingress.onAdmitted?.();
             return domain;
+        }
         applicationJob.close();
         if (stateful.reply !== undefined) {
             const result = failure((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Mailbox owner '${owner}' no longer accepts work on this runtime.`));
@@ -2481,9 +2746,9 @@ class ServiceStatefulRuntime {
             }
         });
     }
-    enqueueActorBindingControl(ingress, binding, actorAuthority, reply) {
+    enqueueActorBindingControl(ingress, binding, actorAuthority, reply, acceptedBinding) {
         const actor = binding.actor;
-        const sessionOwner = requireSessionOwnerIdentity(binding);
+        requireSessionOwnerIdentity(binding);
         const header = Buffer.from([
             service_wire_constants_generated_1.SERVICE_WIRE_MAGIC[0],
             service_wire_constants_generated_1.SERVICE_WIRE_MAGIC[1],
@@ -2508,12 +2773,27 @@ class ServiceStatefulRuntime {
                     actorNodeGeneration: actorAuthority.targetNodeGeneration,
                     authorityOwnerGeneration: actorAuthority.authorityOwnerGeneration,
                     ownerLeaseGeneration: actorAuthority.ownerLeaseGeneration,
-                    bindingGeneration: binding.bindingGeneration,
-                    sessionNodeRid: binding.sessionOwnerNodeRid,
-                    sessionRid: binding.sessionRid,
-                    sessionOwnerNodeGeneration: sessionOwner.nodeGeneration,
-                    sessionOwnerId: sessionOwner.ownerId,
-                    sessionOwnerLeaseGeneration: sessionOwner.leaseGeneration
+                    // The Host reads only Session identity fields before `reply` installs the
+                    // binding; installation keeps that identity. Generation and owner fields
+                    // are read after `reply`, so they always come from the accepted binding.
+                    get bindingGeneration() {
+                        return acceptedBinding().bindingGeneration;
+                    },
+                    get sessionNodeRid() {
+                        return acceptedBinding().sessionOwnerNodeRid;
+                    },
+                    get sessionRid() {
+                        return acceptedBinding().sessionRid;
+                    },
+                    get sessionOwnerNodeGeneration() {
+                        return acceptedBinding().sessionOwnerNodeGeneration;
+                    },
+                    get sessionOwnerId() {
+                        return acceptedBinding().sessionOwnerId;
+                    },
+                    get sessionOwnerLeaseGeneration() {
+                        return acceptedBinding().sessionOwnerLeaseGeneration;
+                    }
                 },
                 reply
             },
@@ -2682,57 +2962,11 @@ class ServiceStatefulRuntime {
         }
     }
     async requestDurableOperation(targetNodeRid, parts, correlation, operationKind, deadlineMs) {
-        const stop = new AbortController();
-        const unobserve = this.raw.observePeerConnectionIntentRemoved((nodeRoutingId) => {
-            if (nodeRoutingId === targetNodeRid) {
-                stop.abort((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `${operationKind} target node lifecycle ended.`, true));
-            }
-        });
-        let wasAdmitted = false;
-        try {
-            // Only durable lifecycle operations replay these frozen frames. Received
-            // envelopes leave this loop before decoding, including failure terminals.
-            for (;;) {
-                this.requireOpen();
-                stop.signal.throwIfAborted();
-                const remainingMs = Math.ceil(deadlineMs - performance.now());
-                if (remainingMs <= 0)
-                    throw durableOperationExhausted(operationKind, wasAdmitted);
-                try {
-                    return await (0, abort_1.awaitWithAbort)(targetNodeRid === this.nodeRid
-                        ? this.requestLocalInfrastructure(parts[0], correlation, remainingMs)
-                        : this.raw.requestService(targetNodeRid, parts, remainingMs), stop.signal);
-                }
-                catch (error) {
-                    stop.signal.throwIfAborted();
-                    if (!durableRequestCanReplay(error))
-                        throw error;
-                    if (durableRequestWasAdmitted(error))
-                        wasAdmitted = true;
-                    const retryDelayMs = Math.min(STATEFUL_OPERATION_RETRY_TICK_MS, deadlineMs - performance.now());
-                    if (retryDelayMs <= 0) {
-                        throw durableOperationExhausted(operationKind, wasAdmitted, error);
-                    }
-                    let timer;
-                    try {
-                        await (0, abort_1.awaitWithAbort)(new Promise((resolve) => {
-                            timer = setTimeout(resolve, retryDelayMs);
-                        }), stop.signal);
-                    }
-                    finally {
-                        if (timer !== undefined)
-                            clearTimeout(timer);
-                    }
-                }
-            }
-        }
-        catch (error) {
-            stop.signal.throwIfAborted();
-            throw error;
-        }
-        finally {
-            unobserve();
+        this.requireOpen();
+        if (targetNodeRid === this.nodeRid) {
+            return this.requestLocalInfrastructure(parts[0], correlation, Math.ceil(deadlineMs - performance.now()));
         }
+        return (0, durable_service_request_1.requestDurableService)(this.raw, targetNodeRid, parts, deadlineMs, operationKind);
     }
     requestLocalInfrastructure(header, requestSequence, timeoutMs) {
         return new Promise((resolve, reject) => {
@@ -2838,7 +3072,7 @@ class ServiceStatefulRuntime {
             ? runtime_values_1.SubmitResult.Ok
             : runtime_values_1.SubmitResult.NotConnected;
     }
-    submitRequest(pending, targetNodeRid, parts, timeoutMs, operationKind, actor) {
+    submitRequest(pending, targetNodeRid, parts, timeoutMs, operationKind, actor, onAdmitted) {
         if (targetNodeRid === this.nodeRid) {
             const deadlineUnixMs = BigInt(Date.now() + Math.max(0, timeoutMs));
             const capacityStop = new AbortController();
@@ -2853,6 +3087,7 @@ class ServiceStatefulRuntime {
                         flags: parts[0][service_wire_binary_primitives_1.SERVICE_WIRE_FLAGS_OFFSET],
                         sourceRoutingId: this.nodeRid,
                         requestSequence: pending.id,
+                        onAdmitted,
                         parts,
                         applicationJobOwner
                     };
@@ -2867,7 +3102,7 @@ class ServiceStatefulRuntime {
             })().catch((error) => this.operations.reply(pending.id, failure(error)));
             return;
         }
-        void this.raw.requestService(targetNodeRid, parts, timeoutMs).then((reply) => this.completeRemoteReply(pending, targetNodeRid, operationKind, actor, reply), (error) => this.operations.fail(pending.id, error));
+        void this.raw.requestService(targetNodeRid, parts, timeoutMs, onAdmitted).then((reply) => this.completeRemoteReply(pending, targetNodeRid, operationKind, actor, reply), (error) => this.operations.fail(pending.id, error));
     }
     submitActorJoin(pending, actor, targetNodeRid, target, payload, deadlineMs, canonical) {
         const actorRoute = canonical === undefined
@@ -2981,6 +3216,15 @@ class ServiceStatefulRuntime {
                 operationKind: service_runtime_contracts_1.OperationKind.ActorRequest,
                 correlation: decoded.correlation,
                 targetActor: current.ref,
+                messageFollowOrigin: {
+                    get requestSource() {
+                        return ingress.requestSource;
+                    },
+                    target: decoded.target,
+                    sourceNodeRid: ingress.sourceRoutingId,
+                    originalOperation: decoded.operation,
+                    originalReplyRouteId: decoded.correlation ?? 0n
+                },
                 ...(decoded.sourceActor === undefined
                     ? {}
                     : { sourceActor: { ...decoded.sourceActor, nodeRid: ingress.sourceRoutingId } }),
@@ -3068,7 +3312,8 @@ class ServiceStatefulRuntime {
             try {
                 const current = this.validateActorFence(decoded.actor);
                 if (decoded.binding.state === 'active') {
-                    this.registry.installSessionBinding((0, service_stateful_wire_codec_1.sessionBindingFromWire)(current.ref, decoded.sessionRid, this.nodeRid, decoded.binding.generation, current.membershipEpoch));
+                    const sessionOwner = await this.sessionOwnerOf(this.nodeRid, this.nodeGeneration);
+                    this.registry.installSessionBinding((0, service_stateful_wire_codec_1.sessionBindingFromWire)(current.ref, decoded.sessionRid, sessionOwner.nodeRid, decoded.binding.generation, current.membershipEpoch, sessionOwner.nodeGeneration, sessionOwner.ownerId, sessionOwner.leaseGeneration));
                 }
                 else {
                     this.registry.unbindSession(current.ref, decoded.binding.retiredGeneration, decoded.sessionRid, this.nodeRid);
@@ -3583,6 +3828,25 @@ function isEntrySpotFence(fence) {
         fence.authorityOwnerGeneration === fence.targetNodeGeneration &&
         fence.ownerLeaseGeneration === fence.targetNodeGeneration);
 }
+function instanceActivationOutcome(error) {
+    if ((0, abort_1.isAbortError)(error))
+        return 'shutdown';
+    if (error instanceof contracts_1.ZLinkFrameworkException) {
+        switch (error.kind) {
+            case contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded:
+                return 'timed_out';
+            case contracts_1.ZLinkFrameworkErrorKind.ShuttingDown:
+                return 'shutdown';
+            case contracts_1.ZLinkFrameworkErrorKind.AlreadyExists:
+                return 'conflict';
+            case contracts_1.ZLinkFrameworkErrorKind.InvalidOperation:
+                return 'fenced';
+            case contracts_1.ZLinkFrameworkErrorKind.Unavailable:
+                return 'store_failure';
+        }
+    }
+    return 'rejected';
+}
 function operationDeadline(deadlineUnixMs) {
     const controller = new AbortController();
     const delay = Number(deadlineUnixMs - BigInt(Date.now()));
@@ -3598,26 +3862,6 @@ function operationDeadline(deadlineUnixMs) {
 function operationReplayExpired(replayExpiresAtMs) {
     return performance.now() > replayExpiresAtMs;
 }
-function durableRequestWasAdmitted(error) {
-    // Request NotConnected includes Core handover of an admitted request. The
-    // submit/request phase, rather than the result number, owns this distinction.
-    return (0, runtime_values_1.isZLinkBackendResultError)(error) && error.operation === 'request';
-}
-function durableOperationExhausted(operationKind, wasAdmitted, cause) {
-    return (0, framework_errors_internal_1.createInternalFrameworkException)(wasAdmitted
-        ? framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded
-        : framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `${operationKind} exhausted its end-to-end deadline.`, true, cause);
-}
-function durableRequestCanReplay(error) {
-    if (!(0, runtime_values_1.isZLinkBackendResultError)(error))
-        return false;
-    return error.operation === 'request'
-        ? error.result === runtime_values_1.RequestResult.NotConnected || error.result === runtime_values_1.RequestResult.TimedOut
-        : error.result === runtime_values_1.SubmitResult.NotConnected ||
-            error.result === runtime_values_1.SubmitResult.NotFound ||
-            error.result === runtime_values_1.SubmitResult.NotAdmitted ||
-            error.result === runtime_values_1.SubmitResult.Backpressured;
-}
 function remainingDeadlineMs(deadlineUnixMs) {
     const remainingMs = deadlineUnixMs - BigInt(Date.now());
     if (remainingMs <= 0n) {
@@ -3643,6 +3887,9 @@ function actorLocation(actor) {
         membershipEpoch: actor.membershipEpoch
     };
 }
+function requestSourceUnavailable(nodeRid) {
+    return new contracts_1.ZLinkFrameworkException(contracts_1.ZLinkFrameworkErrorKind.Unavailable, `Request source '${nodeRid}' has no live MeshNode descriptor.`);
+}
 function activationRefused() {
     return new contracts_1.ZLinkFrameworkException(contracts_1.ZLinkFrameworkErrorKind.Unavailable, 'Instance cold activation authority was refused.');
 }
@@ -3660,20 +3907,18 @@ function actorKey(actor) {
 }
 function sameSessionBinding(left, right) {
     return (sameActorRef(left.actor, right.actor) &&
-        left.sessionRid === right.sessionRid &&
+        (0, routing_id_1.routingIdsEqual)(left.sessionRid, right.sessionRid) &&
         sameSessionOwnerIdentity(left, right) &&
         left.bindingGeneration === right.bindingGeneration);
 }
 function sameSessionIdentity(left, right) {
     return (sameActorRef(left.actor, right.actor) &&
-        left.sessionRid === right.sessionRid &&
+        (0, routing_id_1.routingIdsEqual)(left.sessionRid, right.sessionRid) &&
         sameSessionOwnerIdentity(left, right));
 }
 function sameSessionOwnerIdentity(left, right) {
     return (left.sessionOwnerNodeRid === right.sessionOwnerNodeRid &&
-        left.sessionOwnerNodeGeneration === right.sessionOwnerNodeGeneration &&
-        left.sessionOwnerId === right.sessionOwnerId &&
-        left.sessionOwnerLeaseGeneration === right.sessionOwnerLeaseGeneration);
+        left.sessionOwnerNodeGeneration === right.sessionOwnerNodeGeneration);
 }
 function requireSessionOwnerIdentity(binding) {
     if (binding.sessionOwnerNodeGeneration === undefined ||
@@ -3688,15 +3933,15 @@ function requireSessionOwnerIdentity(binding) {
     };
 }
 function sessionDeliveryKey(binding) {
-    return (`${actorKey(binding.actor)}\0${binding.sessionOwnerNodeRid}\0${binding.sessionRid}` +
+    return (`${actorKey(binding.actor)}\0${binding.sessionOwnerNodeRid}\0${(0, routing_id_1.encodeRoutingIdStorageHex)(binding.sessionRid)}` +
         `\0${binding.sessionOwnerNodeGeneration ?? ''}` +
         `\0${binding.sessionOwnerId ?? ''}` +
         `\0${binding.sessionOwnerLeaseGeneration ?? ''}` +
         `\0${binding.bindingGeneration}`);
 }
 function exactRetiredDelivery(binding, retired) {
-    return (binding.sessionRid === retired.sessionRid &&
-        binding.sessionOwnerNodeRid === retired.sessionOwnerNodeRid &&
+    return ((0, routing_id_1.routingIdsEqual)(binding.sessionRid, retired.sessionRid) &&
+        (0, routing_id_1.routingIdsEqual)(binding.sessionOwnerNodeRid, retired.sessionOwnerNodeRid) &&
         binding.sessionOwnerNodeGeneration === retired.sessionOwnerNodeGeneration &&
         binding.sessionOwnerId === retired.sessionOwnerId &&
         binding.sessionOwnerLeaseGeneration === retired.sessionOwnerLeaseGeneration &&
@@ -3710,7 +3955,7 @@ function replacementNoticeKey(record) {
         `\0${record.retiredSession.sessionOwnerNodeGeneration}` +
         `\0${record.retiredSession.sessionOwnerId}` +
         `\0${record.retiredSession.sessionOwnerLeaseGeneration}` +
-        `\0${record.retiredSession.sessionRid}` +
+        `\0${(0, routing_id_1.encodeRoutingIdStorageHex)(record.retiredSession.sessionRid)}` +
         `\0${record.retiredSession.retiredBindingGeneration}`);
 }
 function actorAuthorityFromRoute(route) {
@@ -3944,3 +4189,26 @@ function instanceOperationParts(headerAndPayload, metadataFrame) {
 function statefulMailboxData(record) {
     return record.stateful;
 }
+function acceptsStatefulIngress(command) {
+    // These frozen relocation controls overlap the legacy stateful command
+    // number range (30-34). They are bare infrastructure records and must
+    // fall through to RawServiceMeshRuntime's relocation ingress instead of
+    // being decoded as stateful actor/spot work.
+    if (command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationReady ||
+        command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationData ||
+        command === service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelay ||
+        command === service_stateful_wire_codec_1.M6bServiceWireCommand.relocationCutover) {
+        return false;
+    }
+    if (command < service_stateful_wire_codec_1.M6bServiceWireCommand.spotSend ||
+        (command > service_stateful_wire_codec_1.M6bServiceWireCommand.instanceSpot &&
+            command !== service_stateful_wire_codec_1.M6bServiceWireCommand.userSpotCreate &&
+            command !== service_stateful_wire_codec_1.M6bServiceWireCommand.userSpotClose &&
+            command !== service_stateful_wire_codec_1.M6bServiceWireCommand.actorCreate &&
+            command !== service_stateful_wire_codec_1.M6bServiceWireCommand.messageFollow &&
+            command !== service_stateful_wire_codec_1.M6bServiceWireCommand.boundSessionReplaced &&
+            command !== service_stateful_wire_codec_1.M6bServiceWireCommand.boundSessionClose)) {
+        return false;
+    }
+    return true;
+}