@zlink-systems/framework 0.30.0 → 0.30.2

package/src/runtime/foundation/service-stateful-runtime.ts

@@ -1,3 +1,12 @@
+import { awaitWithAbort, isAbortError } from '../abort';
+import { decodeChannelHeader } from '../channels/channel-envelope';
+import { ZLinkBufferMessage } from '../backend/runtime-message';
+import {
+  dispatchErrorDetails,
+  dispatchReasonFromError
+} from '../diagnostics/dispatch-error-details';
+import { encodeBoundSessionCloseCommand } from '../protocol/service_wire_codec.generated';
+import { decodeRoutingId, encodeRoutingIdStorageHex, routingIdsEqual } from '../routing-id';
 import { ZlinkStreamContentType } from '@zlink-systems/stream-wire';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { ZLinkFrameworkErrorKind, ZLinkFrameworkException } from '../../contracts';
@@ -10,11 +19,11 @@ import {
   ZLinkDispatchMessageKind,
   ZLinkRuntimeMessageFlowOutcome as ZLinkMessageFlowOutcome
 } from '../../contracts/Dispatch/ZLinkDispatchOptions';
-import { awaitWithAbort } from '../abort';
+import { requestDurableService } from './durable-service-request';
 import { shouldCompactBackingArray } from '../admission';
 import { RequestResult, SubmitResult, isZLinkBackendResultError } from '../backend/runtime-values';
 import type { ZLinkDispatchErrorReporter } from '../channels/dispatch-error-reporter';
-import { flowIfEnabled } from '../diagnostics/message-flow';
+import { flowIfEnabled, traceSessionBindingControlDrop } from '../diagnostics/message-flow';
 import { captureZLinkExecutionTurn } from '../execution';
 import {
   ZLinkFrameworkInternalErrorKind,
@@ -58,6 +67,7 @@ import {
   ServiceStaleGenerationError,
   ServiceStatefulRegistry,
   ServiceTerminalOperationRegistry,
+  RELOCATION_REPLY_RETENTION_MS,
   type ServiceActorRef,
   type ServiceActorState,
   type ServiceSessionBinding,
@@ -104,15 +114,19 @@ import {
   SERVICE_WIRE_COMMAND_OFFSET,
   SERVICE_WIRE_FLAGS_OFFSET
 } from './service-wire-binary-primitives';
-import { SERVICE_WIRE_MAGIC, SERVICE_WIRE_MAJOR } from './service-wire-constants.generated';
+import {
+  SERVICE_WIRE_MAGIC,
+  SERVICE_WIRE_MAJOR,
+  SERVICE_FRAMEWORK_MULTIPART_CONTENT_TYPE
+} from './service-wire-constants.generated';
 import {
   ServiceWireProtocolError,
   decodeApplicationPayload,
   decodeApplicationPayloadView,
+  decodeMultipartApplicationParts,
   encodeApplicationPayload,
   type ServiceApplicationPayload
 } from './service-wire-m6a-codec';
-const STATEFUL_OPERATION_RETRY_TICK_MS = 20;
 
 const MAX_NODE_TIMER_DELAY_MS = 2_147_483_647;
 
@@ -206,6 +220,58 @@ export interface ServiceCanonicalActorJoinCandidate {
   readonly local: { readonly phase: 'admission'; readonly transferId: string };
 }
 
+/**
+ * Session–Actor binding §4: the owner ID and owner lease generation of a
+ * Session owner identity are the host's `(OwnerId, LeaseGeneration)` published
+ * in its MeshNode descriptor.
+ */
+export interface ServiceSessionOwnerToken {
+  readonly ownerId: string;
+  readonly leaseGeneration: bigint;
+}
+
+/** The descriptor source of the Session owner identity (§4). */
+export interface ServiceSessionOwnerDescriptors {
+  /** This host's published token, or undefined while it has no live descriptor. */
+  local(): ServiceSessionOwnerToken | undefined;
+  /**
+   * The token of the admitted peer descriptor with this exact RID and
+   * lifecycle generation that passed the Location runtime §4.1 owner lease
+   * check, or undefined when no such descriptor exists.
+   */
+  peer(nodeRid: string, nodeGeneration: bigint): Promise<ServiceSessionOwnerToken | undefined>;
+}
+
+/** The four values of one Session owner identity (§4). */
+export interface ServiceSessionOwnerIdentity {
+  readonly nodeRid: string;
+  readonly nodeGeneration: bigint;
+  readonly ownerId: string;
+  readonly leaseGeneration: bigint;
+}
+
+/**
+ * The receiving Session owner compares the identity carried by command 42,
+ * 51 or 54 with its current values exactly (§4).
+ */
+export function sessionOwnerFenceMatches(
+  local: ServiceSessionOwnerIdentity,
+  fence: Pick<
+    ServiceRetiredBoundSessionRouteFence,
+    | 'sessionOwnerNodeRid'
+    | 'sessionOwnerNodeGeneration'
+    | 'sessionOwnerId'
+    | 'sessionOwnerLeaseGeneration'
+  >
+): boolean {
+  return (
+    routingIdsEqual(fence.sessionOwnerNodeRid, local.nodeRid) &&
+    fence.sessionOwnerNodeGeneration === local.nodeGeneration &&
+    fence.sessionOwnerId === local.ownerId &&
+    fence.sessionOwnerLeaseGeneration === local.leaseGeneration
+  );
+}
+
 export interface ServiceSessionDelivery {
   readonly binding: ServiceSessionBinding;
   /**
@@ -213,6 +279,7 @@ export interface ServiceSessionDelivery {
    * been validated. The stream adapter owns multipart decoding at that point.
    */
   readonly deliver: (sessionRid: string, payloadFrame: Uint8Array) => Promise<boolean>;
+  readonly close?: () => Promise<void>;
   /** Enqueues the replacement lifecycle callback on the owning STREAM session. */
   readonly onBindingReplaced?: (
     actorId: string,
@@ -247,6 +314,7 @@ export interface ServiceInstanceApplicationLifecycle {
   isIdleEvicting?(target: ServiceInstanceApplicationIdentity): boolean;
   beginIdleEviction?(target: ServiceInstanceApplicationIdentity): boolean;
   materialize(target: ServiceInstanceApplicationIdentity, objectGeneration: bigint): Promise<void>;
+  publish?(target: ServiceInstanceApplicationTarget): void;
   discard(target: ServiceInstanceActivationTarget): Promise<void>;
   beginTerminal(target: ServiceInstanceApplicationTarget): void;
   completeTerminal(target: ServiceInstanceApplicationTarget): Promise<boolean>;
@@ -382,7 +450,7 @@ export class ServiceStatefulRuntime {
 
   readonly registry: ServiceStatefulRegistry;
 
-  private readonly operations: ServiceTerminalOperationRegistry<ServiceStatefulResult>;
+  private readonly operations: ServiceTerminalOperationRegistry<ServiceStatefulResult, bigint>;
   private readonly sessionDeliveries = new Map<string, ServiceSessionDelivery>();
   /**
    * A local Actor owner can replace its own session binding before the
@@ -415,6 +483,7 @@ export class ServiceStatefulRuntime {
   private asyncInstanceAuthority?: ServiceAsyncInstanceActivationAuthority;
   private instanceApplicationLifecycle?: ServiceInstanceApplicationLifecycle;
   private userSpotOperationHandler?: ServiceUserSpotOperationHandler;
+  private requestSourceAcceptance?: import('../backend/contracts').ZLinkBackendRequestSourceAcceptance;
   private messageFollowHandler?: (
     record: import('./service-stateful-wire-codec').ServiceMessageFollowRecord
   ) => void;
@@ -423,6 +492,7 @@ export class ServiceStatefulRuntime {
     readonly owner: string;
   }) => void;
   private dispatchErrors?: ZLinkDispatchErrorReporter;
+  private sessionOwnerDescriptors?: ServiceSessionOwnerDescriptors;
   private dispatchErrorMeshName?: string;
   private readonly admittedUserSpotOperations = new Map<
     string,
@@ -454,7 +524,7 @@ export class ServiceStatefulRuntime {
     );
     this.registry = new ServiceStatefulRegistry(nodeRid, nodeGeneration);
     this.registry.createEntrySpot(nodeRid);
-    raw.setServiceIngress((record) => this.ingress(record));
+    raw.setServiceIngress((record) => this.ingress(record), acceptsStatefulIngress);
   }
 
   setMailboxDropHandler(
@@ -466,6 +536,52 @@ export class ServiceStatefulRuntime {
     this.mailboxDropHandler = handler;
   }
 
+  setSessionOwnerDescriptors(source: ServiceSessionOwnerDescriptors): void {
+    this.sessionOwnerDescriptors = source;
+  }
+
+  /** §4: this host's Session owner identity, taken from its own descriptor. */
+  private localSessionOwner(): ServiceSessionOwnerIdentity | undefined {
+    const token = this.sessionOwnerDescriptors?.local();
+    return token === undefined
+      ? undefined
+      : {
+          nodeRid: this.nodeRid,
+          nodeGeneration: this.nodeGeneration,
+          ownerId: token.ownerId,
+          leaseGeneration: token.leaseGeneration
+        };
+  }
+
+  /**
+   * §4: the identity of the Session owner that requested a bind. It is this
+   * host's own descriptor, or the admitted peer descriptor of that exact
+   * lifecycle that passed the owner lease check. Without one the bind is
+   * rejected instead of storing a guessed identity.
+   */
+  private async sessionOwnerOf(
+    nodeRid: string,
+    nodeGeneration: bigint
+  ): Promise<ServiceSessionOwnerIdentity> {
+    const token = routingIdsEqual(nodeRid, this.nodeRid)
+      ? nodeGeneration === this.nodeGeneration
+        ? this.sessionOwnerDescriptors?.local()
+        : undefined
+      : await this.sessionOwnerDescriptors?.peer(nodeRid, nodeGeneration);
+    if (token === undefined) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.RouteNotConnected,
+        `Session owner '${nodeRid}' has no live MeshNode descriptor for its lifecycle.`
+      );
+    }
+    return {
+      nodeRid,
+      nodeGeneration,
+      ownerId: token.ownerId,
+      leaseGeneration: token.leaseGeneration
+    };
+  }
+
   setDispatchErrorReporter(reporter: ZLinkDispatchErrorReporter, meshName: string): void {
     this.dispatchErrors = reporter;
     this.dispatchErrorMeshName = meshName;
@@ -567,7 +683,7 @@ export class ServiceStatefulRuntime {
     if (
       current?.bindingGeneration === bindingGeneration &&
       current.sessionOwnerNodeRid === sessionNodeRid &&
-      current.sessionRid === sessionRid
+      routingIdsEqual(current.sessionRid, sessionRid)
     ) {
       return;
     }
@@ -1131,6 +1247,78 @@ export class ServiceStatefulRuntime {
     this.messageFollowHandler = handler;
   }
 
+  setRequestSourceAcceptance(
+    acceptance: import('../backend/contracts').ZLinkBackendRequestSourceAcceptance
+  ): void {
+    this.requestSourceAcceptance = acceptance;
+  }
+
+  /**
+   * Location runtime §9.3: the first accepting owner reads the sender's owner values once. A
+   * sender without a live descriptor ends the request Unavailable (Session·Actor binding §4). The
+   * polled descriptors answer without a promise; only a Store read returns one.
+   */
+  private acceptRequestSource(
+    ingress: RawServiceIngressRecord,
+    signal?: AbortSignal
+  ): Promise<void> | undefined {
+    if (ingress.requestSource !== undefined) return undefined;
+    const acceptance = this.requestSourceAcceptance;
+    if (acceptance === undefined) return undefined;
+    const generation =
+      ingress.sourceNodeGeneration ?? this.tryPeerGeneration(ingress.sourceRoutingId);
+    const sourceRouteHex =
+      ingress.sourceRoute === undefined || ingress.sourceRoute.length === 0
+        ? undefined
+        : Buffer.from(ingress.sourceRoute).toString('hex');
+    const sourceRid =
+      sourceRouteHex === undefined
+        ? ingress.sourceRoutingId
+        : decodeRoutingId(ingress.sourceRoutingId, sourceRouteHex);
+    const source =
+      generation === undefined
+        ? undefined
+        : acceptance(
+            sourceRid,
+            generation,
+            sourceRouteHex ?? encodeRoutingIdStorageHex(sourceRid),
+            signal
+          );
+    if (source instanceof Promise) {
+      return source.then(
+        (read) => this.recordRequestSource(ingress, read),
+        (error: unknown) => {
+          if (
+            error instanceof ZLinkFrameworkException &&
+            error.kind === ZLinkFrameworkErrorKind.Unavailable &&
+            this.dispatchErrors?.captureEnabled() === true
+          ) {
+            this.dispatchErrors.report({
+              surface: ZLinkDispatchErrorSurface.Node,
+              messageKind: ZLinkDispatchMessageKind.Request,
+              reason: ZLinkDispatchErrorReason.StaleTarget,
+              action: ZLinkDispatchErrorAction.ReplyError,
+              meshName: this.dispatchErrorMeshName,
+              sourceRid: ingress.sourceRoutingId,
+              error
+            });
+          }
+          throw error;
+        }
+      );
+    }
+    this.recordRequestSource(ingress, source);
+    return undefined;
+  }
+
+  private recordRequestSource(
+    ingress: RawServiceIngressRecord,
+    source: import('../locations/request-source-resolver').ZLinkRequestSourceFence | undefined
+  ): void {
+    if (source === undefined) throw requestSourceUnavailable(ingress.sourceRoutingId);
+    ingress.requestSource = source;
+  }
+
   sealSpotMessageFollowIngress(
     source: ServiceDirectSpotRouteFence
   ): ServiceSpotMessageFollowSeal | undefined {
@@ -1180,11 +1368,15 @@ export class ServiceStatefulRuntime {
 
   async commitSpotMessageFollowIngress(
     seal: ServiceSpotMessageFollowSeal,
-    target: ServiceDirectSpotRouteFence,
+    target: ServiceDirectSpotRouteFence | null,
     durationMs: number
   ): Promise<boolean> {
     const state = this.exactSpotMessageFollow(seal);
     if (state === undefined || state.target !== undefined) return false;
+    if (target === null) {
+      this.failExpiredSpotMessageFollow(state);
+      return true;
+    }
     if (!Number.isSafeInteger(durationMs) || durationMs < 0) {
       throw new RangeError('Message Follow duration must be a non-negative safe integer.');
     }
@@ -1326,7 +1518,8 @@ export class ServiceStatefulRuntime {
     sourceSpotId: string,
     requested: ServiceDirectSpotRouteFence,
     payload: ServiceApplicationPayload,
-    timeoutMs: number
+    timeoutMs: number,
+    onAdmitted?: () => void
   ): ServiceStatefulPendingOperation {
     const pending = this.operations.register(timeoutMs);
     const target = this.acceptSpotAuthority(requested);
@@ -1346,20 +1539,21 @@ export class ServiceStatefulRuntime {
       target.targetNodeRid,
       [header, encodeApplicationPayload(payload)],
       timeoutMs,
-      'spotRequest'
+      'spotRequest',
+      undefined,
+      onAdmitted
     );
     return pending;
   }
 
   async sendToActor(
     target: ServiceActorRef,
-    _targetNodeGeneration: bigint,
-    _authorityOwnerGeneration: bigint,
     payload: ServiceApplicationPayload,
     sourceActor?: ServiceActorRef,
-    boundSession?: { readonly sessionRid: string; readonly bindingGeneration: bigint }
+    boundSession?: { readonly sessionRid: string; readonly bindingGeneration: bigint },
+    routeFence?: ServiceActorRouteFence
   ): Promise<number> {
-    const route = this.tryActorFence(target);
+    const route = routeFence ?? this.tryActorFence(target);
     if (route === undefined) return SubmitResult.NotFound;
     const header = encodeActorHeader(
       'actorSend',
@@ -1379,15 +1573,16 @@ export class ServiceStatefulRuntime {
 
   requestToActor(
     target: ServiceActorRef,
-    _targetNodeGeneration: bigint,
-    _authorityOwnerGeneration: bigint,
     payload: ServiceApplicationPayload,
     timeoutMs: number,
     sourceActor?: ServiceActorRef,
-    boundSession?: { readonly sessionRid: string; readonly bindingGeneration: bigint }
+    boundSession?: { readonly sessionRid: string; readonly bindingGeneration: bigint },
+    onAdmitted?: () => void,
+    routeFence?: ServiceActorRouteFence
   ): ServiceStatefulPendingOperation {
-    const pending = this.operations.register(timeoutMs);
-    const route = this.tryActorFence(target);
+    const operationLow = this.nextMessageFollowOperation++;
+    const pending = this.operations.register(timeoutMs, 'registry', operationLow);
+    const route = routeFence ?? this.tryActorFence(target);
     if (route === undefined) {
       this.operations.reply(
         pending.id,
@@ -1406,18 +1601,35 @@ export class ServiceStatefulRuntime {
             ...boundSession,
             sequence: this.nextSessionSequence++
           },
-      { high: this.nodeGeneration, low: this.nextMessageFollowOperation++ }
+      { high: this.nodeGeneration, low: operationLow }
     );
     this.submitRequest(
       pending,
       target.nodeRid,
       [header, encodeApplicationPayload(payload)],
       timeoutMs,
-      'actorRequest'
+      'actorRequest',
+      undefined,
+      onAdmitted
     );
     return pending;
   }
 
+  acceptRelocatedActorTerminal(
+    operation: { readonly high: bigint; readonly low: bigint },
+    replyRouteId: bigint,
+    result: ServiceStatefulResult
+  ): 'terminalReceived' | 'alreadyTerminal' | undefined {
+    if (
+      operation.high !== this.nodeGeneration ||
+      this.operations.context(replyRouteId) !== operation.low
+    )
+      return undefined;
+    return this.operations.reply(replyRouteId, result, RELOCATION_REPLY_RETENTION_MS)
+      ? 'terminalReceived'
+      : 'alreadyTerminal';
+  }
+
   async sendToInstanceSpot(
     route: ServiceInstanceRouteFence,
     payload: ServiceApplicationPayload,
@@ -1499,7 +1711,8 @@ export class ServiceStatefulRuntime {
     timeoutMs: number,
     sourceSpotId?: string,
     metadataFrame?: Uint8Array,
-    instanceIntent = false
+    instanceIntent = false,
+    onAdmitted?: () => void
   ): ServiceStatefulPendingOperation {
     const pending = this.operations.register(timeoutMs);
     this.submitRequest(
@@ -1523,7 +1736,9 @@ export class ServiceStatefulRuntime {
         metadataFrame
       ),
       timeoutMs,
-      'instanceSpotRequest'
+      'instanceSpotRequest',
+      undefined,
+      onAdmitted
     );
     return pending;
   }
@@ -1551,7 +1766,8 @@ export class ServiceStatefulRuntime {
     payloadFrame: Buffer,
     deadlineUnixMs: bigint,
     sourceSpotId?: string,
-    metadataFrame?: Uint8Array
+    metadataFrame?: Uint8Array,
+    onAdmitted?: () => void
   ): ServiceStatefulPendingOperation {
     const timeoutMs = remainingDeadlineMs(deadlineUnixMs);
     const pending = this.operations.register(timeoutMs);
@@ -1576,7 +1792,9 @@ export class ServiceStatefulRuntime {
         metadataFrame
       ),
       timeoutMs,
-      'instanceSpotRequest'
+      'instanceSpotRequest',
+      undefined,
+      onAdmitted
     );
     return pending;
   }
@@ -1747,27 +1965,51 @@ export class ServiceStatefulRuntime {
     timeoutMs: number,
     deliver: ServiceSessionDelivery['deliver'],
     onBindingReplaced?: ServiceSessionDelivery['onBindingReplaced'],
-    actorAuthority?: StreamSessionActorAuthorityFence
+    actorAuthority?: StreamSessionActorAuthorityFence,
+    close?: () => Promise<void>
   ): ServiceStatefulPendingOperation {
     const deadlineMs = performance.now() + timeoutMs;
     const pending = this.operations.register(timeoutMs, 'sender');
-    const generation = this.nextSessionSequence++;
+    const sessionOwner = this.localSessionOwner();
+    if (sessionOwner === undefined) {
+      this.operations.reply(
+        pending.id,
+        failure(
+          createInternalFrameworkException(
+            ZLinkFrameworkInternalErrorKind.RouteNotConnected,
+            `Session owner '${this.nodeRid}' has no live MeshNode descriptor.`
+          )
+        )
+      );
+      return pending;
+    }
+    const deliveryKey = actorKey(actor);
+    const previousDelivery = this.sessionDeliveries.get(deliveryKey);
+    const previousBinding = previousDelivery?.binding;
+    const generation =
+      previousBinding !== undefined &&
+      sameActorRef(previousBinding.actor, actor) &&
+      previousBinding.sessionRid === sessionRid &&
+      previousBinding.sessionOwnerNodeRid === sessionOwner.nodeRid &&
+      previousBinding.sessionOwnerNodeGeneration === sessionOwner.nodeGeneration
+        ? previousBinding.bindingGeneration
+        : this.nextSessionSequence++;
     const localBinding: ServiceSessionBinding = {
       actor,
       sessionRid,
-      sessionOwnerNodeRid: this.nodeRid,
-      sessionOwnerNodeGeneration: this.nodeGeneration,
-      sessionOwnerId: this.nodeRid,
-      sessionOwnerLeaseGeneration: this.nodeGeneration,
+      sessionOwnerNodeRid: sessionOwner.nodeRid,
+      sessionOwnerNodeGeneration: sessionOwner.nodeGeneration,
+      sessionOwnerId: sessionOwner.ownerId,
+      sessionOwnerLeaseGeneration: sessionOwner.leaseGeneration,
       bindingGeneration: generation,
       membershipEpoch: this.registry.actor(actor.actorId)?.membershipEpoch ?? 1n
     };
     const delivery: ServiceSessionDelivery = {
       binding: localBinding,
       deliver,
+      ...(close === undefined ? {} : { close }),
       ...(onBindingReplaced === undefined ? {} : { onBindingReplaced })
     };
-    const deliveryKey = actorKey(actor);
     if (actor.nodeRid === this.nodeRid) {
       let installedDelivery: ServiceSessionDelivery | undefined;
       try {
@@ -1791,18 +2033,7 @@ export class ServiceStatefulRuntime {
           });
           return pending;
         }
-        const previousDelivery = this.sessionDeliveries.get(deliveryKey);
-        const binding = this.registry.bindSession(
-          actor,
-          sessionRid,
-          this.nodeRid,
-          this.nodeGeneration,
-          this.nodeRid,
-          this.nodeGeneration
-        );
-        if (previousDelivery !== undefined && previous !== undefined) {
-          this.retiredSessionDeliveries.set(sessionDeliveryKey(previous), previousDelivery);
-        }
+        const binding = this.registry.installSessionBinding(localBinding);
         installedDelivery = { ...delivery, binding };
         this.sessionDeliveries.set(deliveryKey, installedDelivery);
         this.operations.reply(pending.id, {
@@ -1810,7 +2041,10 @@ export class ServiceStatefulRuntime {
           failureCode: 0,
           kindData: undefined
         });
-        if (previous !== undefined) {
+        if (previous !== undefined && previous !== binding) {
+          if (previousDelivery !== undefined) {
+            this.retiredSessionDeliveries.set(sessionDeliveryKey(previous), previousDelivery);
+          }
           this.sendBoundSessionReplacement(
             previous,
             actorAuthorityFromRoute(
@@ -1835,7 +2069,6 @@ export class ServiceStatefulRuntime {
       }
       return pending;
     }
-    const previousDelivery = this.sessionDeliveries.get(deliveryKey);
     let bindingActorFence: ServiceActorRouteFence;
     let header: Buffer;
     try {
@@ -1883,7 +2116,10 @@ export class ServiceStatefulRuntime {
             // Publish the exact Location authority used by command 38 in the
             // same Session-owner completion turn as the binding route. Actor
             // lookup only carries a peer-lifecycle fallback for owner lease.
-            this.rememberActorRoute(bindingActorFence);
+            this.rememberActorRoute({
+              ...bindingActorFence,
+              authorityOwnerGeneration: result.streamBinding.authorityOwnerGeneration
+            });
             this.sessionDeliveries.set(deliveryKey, committed);
           }
         }
@@ -1892,6 +2128,59 @@ export class ServiceStatefulRuntime {
     };
   }
 
+  closeBoundSession(
+    actor: ServiceActorRef,
+    expectedBindingGeneration: bigint,
+    timeoutMs: number
+  ): ServiceStatefulPendingOperation {
+    const pending = this.operations.register(timeoutMs);
+    const binding = this.registry.binding(actor);
+    if (binding === undefined) {
+      this.operations.reply(
+        pending.id,
+        internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.ActorSessionNotBound)
+      );
+      return pending;
+    }
+    const header = Buffer.from(
+      encodeBoundSessionCloseCommand(
+        {
+          command: 'boundSessionClose',
+          flags: 0,
+          correlation: pending.id,
+          actor: { actorId: actor.actorId, objectGeneration: actor.generation },
+          session: {
+            sessionOwnerNodeRid: Buffer.from(
+              encodeRoutingIdStorageHex(binding.sessionOwnerNodeRid),
+              'hex'
+            ),
+            sessionOwnerNodeGeneration: binding.sessionOwnerNodeGeneration!,
+            sessionOwnerId: binding.sessionOwnerId!,
+            sessionOwnerLeaseGeneration: binding.sessionOwnerLeaseGeneration!,
+            sessionRid: Buffer.from(encodeRoutingIdStorageHex(binding.sessionRid), 'hex'),
+            retiredBindingGeneration: expectedBindingGeneration
+          }
+        },
+        {}
+      )[0]!
+    );
+    const reply = routingIdsEqual(binding.sessionOwnerNodeRid, this.nodeRid)
+      ? this.requestLocalInfrastructure(header, pending.id, timeoutMs)
+      : this.raw.requestService(binding.sessionOwnerNodeRid, [header], timeoutMs);
+    void reply.then(
+      (parts) =>
+        this.completeRemoteReply(
+          pending,
+          binding.sessionOwnerNodeRid,
+          'boundSessionClose',
+          undefined,
+          parts
+        ),
+      (error) => this.operations.fail(pending.id, error)
+    );
+    return pending;
+  }
+
   unbindSession(
     sessionRid: string,
     actor: ServiceActorRef,
@@ -1902,7 +2191,7 @@ export class ServiceStatefulRuntime {
     const delivery = this.sessionDeliveries.get(actorKey(actor));
     if (
       delivery === undefined ||
-      delivery.binding.sessionRid !== sessionRid ||
+      !routingIdsEqual(delivery.binding.sessionRid, sessionRid) ||
       delivery.binding.bindingGeneration !== expectedBindingGeneration
     ) {
       this.operations.reply(
@@ -1932,7 +2221,7 @@ export class ServiceStatefulRuntime {
   sessionBindings(sessionRid: string): readonly ServiceStreamSessionBinding[] {
     return [...this.sessionDeliveries.values()]
       .map((value) => value.binding)
-      .filter((binding) => binding.sessionRid === sessionRid)
+      .filter((binding) => routingIdsEqual(binding.sessionRid, sessionRid))
       .map((binding) => {
         const owner = requireSessionOwnerIdentity(binding);
         return {
@@ -1954,20 +2243,13 @@ export class ServiceStatefulRuntime {
     payload: ServiceApplicationPayload
   ): Promise<number> {
     const delivery = this.sessionDeliveries.get(actorKey(actor));
-    if (delivery === undefined || delivery.binding.sessionRid !== sessionRid) {
+    if (delivery === undefined || !routingIdsEqual(delivery.binding.sessionRid, sessionRid)) {
       return SubmitResult.NotFound;
     }
-    return this.sendToActor(
-      actor,
-      this.peerGeneration(actor.nodeRid),
-      actor.generation,
-      payload,
-      undefined,
-      {
-        sessionRid,
-        bindingGeneration: delivery.binding.bindingGeneration
-      }
-    );
+    return this.sendToActor(actor, payload, undefined, {
+      sessionRid,
+      bindingGeneration: delivery.binding.bindingGeneration
+    });
   }
 
   async sendBoundSession(
@@ -2003,6 +2285,11 @@ export class ServiceStatefulRuntime {
     return this.operations.size;
   }
 
+  /** The next stateful request expiry, as a lower bound. */
+  nextMaintenanceDeadlineMs(): number {
+    return this.operations.nextDeadlineMs();
+  }
+
   close(): void {
     if (this.closed) return;
     this.closed = true;
@@ -2026,32 +2313,13 @@ export class ServiceStatefulRuntime {
     this.spotMessageFollow.clear();
   }
 
+  cancelPendingOperations(reason: unknown): void {
+    this.operations.failAll(reason);
+  }
+
   private async ingress(
     record: RawServiceIngressRecord
   ): Promise<RawServicePumpResult | undefined> {
-    // These frozen relocation controls overlap the legacy stateful command
-    // number range (30-34). They are bare infrastructure records and must
-    // fall through to RawServiceMeshRuntime's relocation ingress instead of
-    // being decoded as stateful actor/spot work.
-    if (
-      record.command === M6bServiceWireCommand.relocationReady ||
-      record.command === M6bServiceWireCommand.relocationData ||
-      record.command === M6bServiceWireCommand.replyRelay ||
-      record.command === M6bServiceWireCommand.relocationCutover
-    ) {
-      return undefined;
-    }
-    if (
-      record.command < M6bServiceWireCommand.spotSend ||
-      (record.command > M6bServiceWireCommand.instanceSpot &&
-        record.command !== M6bServiceWireCommand.userSpotCreate &&
-        record.command !== M6bServiceWireCommand.userSpotClose &&
-        record.command !== M6bServiceWireCommand.actorCreate &&
-        record.command !== M6bServiceWireCommand.messageFollow &&
-        record.command !== M6bServiceWireCommand.boundSessionReplaced)
-    ) {
-      return undefined;
-    }
     let decoded: ServiceStatefulWireRecord;
     let canonicalActorJoin: ActorJoin28 | undefined;
     try {
@@ -2098,7 +2366,8 @@ export class ServiceStatefulRuntime {
         decoded.kind === 'userSpotClose' ||
         decoded.kind === 'actorCreate' ||
         decoded.kind === 'messageFollow' ||
-        decoded.kind === 'boundSessionReplaced';
+        decoded.kind === 'boundSessionReplaced' ||
+        decoded.kind === 'boundSessionClose';
       if (
         record.parts.length < 1 ||
         record.parts.length > (instanceMetadata || statefulMetadata ? 3 : 2) ||
@@ -2143,7 +2412,13 @@ export class ServiceStatefulRuntime {
           decoded.activation === 'missing' &&
           (error instanceof ZLinkFrameworkException || error instanceof ServiceStaleGenerationError)
         ) {
-          this.finishMissingInstanceActivationFailure(record, decoded, error);
+          this.finishMissingInstanceActivationFailure(
+            record,
+            decoded,
+            error,
+            undefined,
+            payloadFrame
+          );
           return 'infrastructure';
         }
         const correlation = statefulCorrelation(decoded);
@@ -2275,7 +2550,7 @@ export class ServiceStatefulRuntime {
             record.boundSession.bindingGeneration
           );
           if (
-            binding.sessionRid !== record.boundSession.sessionRid ||
+            !routingIdsEqual(binding.sessionRid, record.boundSession.sessionRid) ||
             binding.sessionOwnerNodeRid !== ingress.sourceRoutingId
           ) {
             throw new ServiceStaleGenerationError('binding', record.target.actor.actorId);
@@ -2298,12 +2573,13 @@ export class ServiceStatefulRuntime {
               : { sourceBindingGeneration: record.boundSession.bindingGeneration }),
             targetActor: actor.ref,
             messageFollowOrigin: {
-              sourceNodeRid: ingress.sourceRoutingId,
-              originalOperation: {
-                high: this.peerGeneration(ingress.sourceRoutingId),
-                low: record.correlation ?? this.nextMessageFollowOperation++
+              get requestSource() {
+                return ingress.requestSource;
               },
-              originalReplyRouteId: ingress.requestSequence ?? 0n
+              target: record.target,
+              sourceNodeRid: ingress.sourceRoutingId,
+              originalOperation: record.operation,
+              originalReplyRouteId: record.correlation ?? 0n
             },
             ...(record.kind === 'actorRequest'
               ? { reply: this.replyPort(ingress, record.correlation) }
@@ -2341,7 +2617,9 @@ export class ServiceStatefulRuntime {
           canonicalActorJoinPayload
         );
       case 'boundSessionBind':
-        return this.replySessionBind(ingress, record);
+        return await this.replySessionBind(ingress, record);
+      case 'boundSessionClose':
+        return await this.handleBoundSessionClose(ingress, record);
       case 'boundSessionReplaced':
         return this.handleBoundSessionReplaced(ingress, record);
       case 'boundSessionSend':
@@ -2371,6 +2649,7 @@ export class ServiceStatefulRuntime {
         localReply,
         metadataFrame
       ).finally(() => ownedIngress.applicationJobOwner?.close());
+      ingress.onAdmitted?.();
       return 'infrastructure';
     }
     if (
@@ -2384,6 +2663,7 @@ export class ServiceStatefulRuntime {
         payloadFrame,
         metadataFrame
       ).finally(() => ownedIngress.applicationJobOwner?.close());
+      ingress.onAdmitted?.();
       return 'infrastructure';
     }
     const spot = this.requireInstanceActivation(ingress, record);
@@ -2546,7 +2826,7 @@ export class ServiceStatefulRuntime {
         }
       });
     } catch (error) {
-      this.finishMissingInstanceActivationFailure(ingress, record, error, localReply);
+      this.finishMissingInstanceActivationFailure(ingress, record, error, localReply, payloadFrame);
     }
   }
 
@@ -2581,6 +2861,7 @@ export class ServiceStatefulRuntime {
         latestRoute !== undefined && sameInstanceApplicationOwner(latestRoute, record.route)
           ? { ...record, route: latestRoute }
           : record;
+      this.publishCommittedInstanceRoute(intent.instanceType, refreshedRecord.route);
       const spot = this.requireInstanceActivation(ingress, refreshedRecord);
       const admitted = this.enqueueActivatedInstanceSpot(
         ingress,
@@ -2737,7 +3018,8 @@ export class ServiceStatefulRuntime {
       { readonly kind: 'instanceSpot'; readonly activation: 'missing' }
     >,
     error: unknown,
-    localReply?: NonNullable<ServiceStatefulMailboxData['reply']>
+    localReply?: NonNullable<ServiceStatefulMailboxData['reply']>,
+    payloadFrame?: Buffer
   ): void {
     if (record.operationKind === 'request') {
       if (record.deadlineUnixMs <= BigInt(Date.now())) return;
@@ -2750,17 +3032,51 @@ export class ServiceStatefulRuntime {
       return;
     }
     const reporter = this.dispatchErrors;
+    const tracePoint = flowIfEnabled(reporter?.flow, ZLinkMessageFlowOutcome.Dropped);
+    if (tracePoint === undefined && reporter?.captureEnabled() !== true) return;
+    const reason = isAbortError(error)
+      ? ZLinkDispatchErrorReason.Shutdown
+      : dispatchReasonFromError(error);
+    // Decode the retained first message only after diagnostics accepts the terminal.
+    // Detached local and remote activation share this owner and its explicit flow.
+    const payload =
+      payloadFrame === undefined ? undefined : decodeApplicationPayloadView(payloadFrame);
+    const header =
+      payload?.contentType === SERVICE_FRAMEWORK_MULTIPART_CONTENT_TYPE
+        ? decodeChannelHeader(
+            decodeMultipartApplicationParts(payloadFrame!, ZLinkBufferMessage.fromOwned),
+            reporter?.flow.flowCreationEnabled()
+          )
+        : undefined;
+    const context = {
+      surface: ZLinkDispatchErrorSurface.InstanceSpot,
+      messageKind: ZLinkDispatchMessageKind.Send,
+      meshName: this.dispatchErrorMeshName,
+      sourceRid: record.sourceNodeRid,
+      spotId: record.target.targetSpotId,
+      instanceSpotType: record.target.stableType,
+      activationState: 'activating' as const,
+      packetName: header?.messageName ?? payload?.packetName,
+      flowId: header?.flowId,
+      flowOrigin: header?.flowOrigin
+    };
+    tracePoint?.trace({
+      ...context,
+      outcome: ZLinkMessageFlowOutcome.Dropped,
+      errorReason:
+        reason === ZLinkDispatchErrorReason.Shutdown
+          ? reason
+          : error instanceof ZLinkFrameworkException &&
+              error.kind === ZLinkFrameworkErrorKind.DeadlineExceeded
+            ? 'activation_timeout'
+            : 'activation_rejected',
+      ...dispatchErrorDetails(error)
+    });
     if (reporter?.captureEnabled() === true) {
       reporter.report({
-        surface: ZLinkDispatchErrorSurface.InstanceSpot,
-        messageKind: ZLinkDispatchMessageKind.Send,
-        reason: ZLinkDispatchErrorReason.StaleTarget,
+        ...context,
+        reason,
         action: ZLinkDispatchErrorAction.Drop,
-        meshName: this.dispatchErrorMeshName,
-        sourceRid: record.sourceNodeRid,
-        spotId: record.target.targetSpotId,
-        instanceSpotType: record.target.stableType,
-        activationState: 'activating',
         error
       });
     }
@@ -2979,12 +3295,25 @@ export class ServiceStatefulRuntime {
   ): Promise<unknown> {
     const key = record.target.targetSpotId;
     const pending = this.pendingInstanceActivations.get(key);
+    const metric =
+      pending === undefined
+        ? this.dispatchErrors?.metrics?.startInstanceSpotActivation(
+            record.target.targetMeshName,
+            record.target.stableType
+          )
+        : undefined;
     const ready =
       pending ??
-      this.runMissingInstanceActivation(record, payloadFrame, metadataFrame).then((activation) => ({
-        ...activation,
-        stableType: record.target.stableType
-      }));
+      this.runMissingInstanceActivation(record, payloadFrame, metadataFrame).then(
+        (activation) => {
+          metric?.complete('ready');
+          return { ...activation, stableType: record.target.stableType };
+        },
+        (error) => {
+          metric?.complete(instanceActivationOutcome(error));
+          throw error;
+        }
+      );
     const operation = ready.then(async (value) => {
       if (pending !== undefined) {
         await this.asyncInstanceAuthority?.read(
@@ -3033,12 +3362,38 @@ export class ServiceStatefulRuntime {
   ): Promise<{
     readonly spot: Pick<ServiceSpotState, 'ref'>;
     readonly route: ServiceInstanceRouteFence;
+  }> {
+    const deadline = operationDeadline(record.deadlineUnixMs);
+    try {
+      deadline.signal.throwIfAborted();
+      return await awaitWithAbort(
+        this.runMissingInstanceActivationCore(record, payloadFrame, metadataFrame, deadline.signal),
+        deadline.signal
+      );
+    } catch (error) {
+      if (isAbortError(error) && deadline.signal.aborted) throw deadline.signal.reason;
+      throw error;
+    } finally {
+      deadline.close();
+    }
+  }
+
+  private async runMissingInstanceActivationCore(
+    record: Extract<
+      ServiceStatefulWireRecord,
+      { readonly kind: 'instanceSpot'; readonly activation: 'missing' }
+    >,
+    payloadFrame: Buffer,
+    metadataFrame: Buffer | undefined,
+    signal: AbortSignal
+  ): Promise<{
+    readonly spot: Pick<ServiceSpotState, 'ref'>;
+    readonly route: ServiceInstanceRouteFence;
   }> {
     const target = record.target;
     if (
       target.targetNodeRid !== this.nodeRid ||
-      target.targetNodeGeneration !== this.nodeGeneration ||
-      record.deadlineUnixMs < BigInt(Date.now())
+      target.targetNodeGeneration !== this.nodeGeneration
     ) {
       throw new ServiceStaleGenerationError('spot', target.targetSpotId);
     }
@@ -3150,21 +3505,22 @@ export class ServiceStatefulRuntime {
         throw new ServiceStaleGenerationError('spot', target.targetSpotId);
       }
     }
-    const deadline = operationDeadline(record.deadlineUnixMs);
-    let reserved: ServiceInstanceAuthorityReserve;
-    try {
-      reserved = await authority.reserve(activationRequest, deadline.signal);
-    } finally {
-      deadline.close();
-    }
-    if (this.closed || record.deadlineUnixMs < BigInt(Date.now())) {
+    const reserved = await authority.reserve(activationRequest, signal);
+    if (this.closed || signal.aborted) {
+      const error = new ZLinkFrameworkException(
+        this.closed
+          ? ZLinkFrameworkErrorKind.ShuttingDown
+          : ZLinkFrameworkErrorKind.DeadlineExceeded,
+        this.closed ? 'Runtime stopped during Instance activation.' : 'Operation deadline exceeded.'
+      );
       await authority.abort(target, reserved.reservation);
-      throw new ServiceStaleGenerationError('spot', target.targetSpotId);
+      throw error;
     }
 
     let activation: { readonly spot: ServiceSpotState; readonly created: boolean };
     try {
       await this.instanceApplicationLifecycle?.materialize(target, reserved.reservation.attempt);
+      signal.throwIfAborted();
       activation = this.activateInstanceSpot(
         target.targetSpotId,
         target.stableType,
@@ -3232,8 +3588,6 @@ export class ServiceStatefulRuntime {
       if (activation.created) this.registry.closeSpot(activation.spot.ref);
       throw new ServiceStaleGenerationError('spot', target.targetSpotId);
     }
-    this.publishCommittedInstanceRoute(target.stableType, route);
-
     const confirmed = await authority.read(target);
     if (confirmed.kind !== 'ready' || !sameInstanceRoute(confirmed.route, route)) {
       if (confirmed.kind === 'ready' && confirmed.route.targetNodeRid !== this.nodeRid) {
@@ -3248,6 +3602,7 @@ export class ServiceStatefulRuntime {
     ) {
       throw new ServiceStaleGenerationError('spot', target.targetSpotId);
     }
+    this.publishCommittedInstanceRoute(target.stableType, confirmed.route);
     return { spot: current, route: confirmed.route };
   }
 
@@ -3265,6 +3620,9 @@ export class ServiceStatefulRuntime {
           : instanceRouteAsDirectRoute(expectedCurrentRoute);
     this.rememberSpotRoute(directRoute, expectedDirectRoute);
     this.registerInstanceIntent(stableType, route, expectedCurrentRoute);
+    const target = this.instanceSpotApplicationTarget(route.targetSpotId);
+    if (target !== undefined)
+      this.instanceApplicationLifecycle?.publish?.({ targetSpotId: route.targetSpotId, ...target });
   }
 
   private replaceCommittedInstanceRoute(
@@ -3417,55 +3775,52 @@ export class ServiceStatefulRuntime {
     return 'infrastructure';
   }
 
-  private replySessionBind(
+  private async replySessionBind(
     ingress: RawServiceIngressRecord,
     record: Extract<ServiceStatefulWireRecord, { readonly kind: 'boundSessionBind' }>
-  ): RawServicePumpResult {
+  ): Promise<RawServicePumpResult> {
     try {
       if (record.binding.state === 'active') {
+        const sessionOwner = await this.sessionOwnerOf(
+          ingress.sourceRoutingId,
+          ingress.sourceNodeGeneration ?? this.peerGeneration(ingress.sourceRoutingId)
+        );
         const actor = this.validateActorFence(record.actor);
-        const previous = this.registry.binding(actor.ref);
-        const sourceGeneration =
-          ingress.sourceNodeGeneration ?? this.peerGeneration(ingress.sourceRoutingId);
         const binding = sessionBindingFromWire(
           actor.ref,
           record.sessionRid,
-          ingress.sourceRoutingId,
+          sessionOwner.nodeRid,
           record.binding.generation,
           actor.membershipEpoch,
-          sourceGeneration,
-          ingress.sourceRoutingId,
-          sourceGeneration
+          sessionOwner.nodeGeneration,
+          sessionOwner.ownerId,
+          sessionOwner.leaseGeneration
         );
-        if (previous !== undefined && sameSessionIdentity(previous, binding)) {
-          // Registry publication is the last step of the first binding owner
-          // turn, so an observable same-Session binding already has every
-          // Actor route projection installed and can complete idempotently.
-          this.replyWire(ingress, record.correlation, RequestResult.Ok, 0, undefined, {
-            kind: 'streamBind',
-            bindingGeneration: previous.bindingGeneration,
-            authorityOwnerGeneration: actor.authorityOwnerGeneration
-          });
-          return 'infrastructure';
-        }
+        let completedBinding = binding;
         const accepted = this.enqueueActorBindingControl(
           ingress,
           binding,
           record.actor,
           (terminalResult, failureCode) => {
-            let completedBinding = binding;
             let replacedBinding: ServiceSessionBinding | undefined;
             if (terminalResult === RequestResult.Ok) {
               // This callback runs inside the Actor binding control turn,
-              // after the Host has installed its Actor-to-session projection.
+              // before the Host copies the accepted Actor-to-session projection.
               // Publish the authority-owned registry view in that same turn
               // before making the terminal reply observable.
               const turnCurrent = this.registry.binding(actor.ref);
-              if (turnCurrent !== undefined && sameSessionIdentity(turnCurrent, binding)) {
-                completedBinding = turnCurrent;
-              } else {
-                replacedBinding = turnCurrent;
-                this.registry.installSessionBinding(binding);
+              try {
+                completedBinding = this.registry.installSessionBinding(binding);
+                if (turnCurrent !== completedBinding) replacedBinding = turnCurrent;
+              } catch (error) {
+                const result = failure(error);
+                this.replyWire(
+                  ingress,
+                  record.correlation,
+                  result.terminalResult,
+                  result.failureCode
+                );
+                return false;
               }
             }
             this.replyWire(
@@ -3496,7 +3851,8 @@ export class ServiceStatefulRuntime {
               );
             }
             return true;
-          }
+          },
+          () => completedBinding
         );
         if (!accepted) {
           const result = failure(
@@ -3517,6 +3873,36 @@ export class ServiceStatefulRuntime {
     return 'infrastructure';
   }
 
+  private async handleBoundSessionClose(
+    ingress: RawServiceIngressRecord,
+    record: Extract<ServiceStatefulWireRecord, { readonly kind: 'boundSessionClose' }>
+  ): Promise<RawServicePumpResult> {
+    if (ingress.requestSequence === undefined) return 'protocolError';
+    try {
+      const delivery = this.sessionDeliveries.get(actorKey(record.actor));
+      const sessionOwner = this.localSessionOwner();
+      if (
+        sessionOwner === undefined ||
+        !sessionOwnerFenceMatches(sessionOwner, record.session) ||
+        delivery === undefined ||
+        delivery.binding.actor.generation !== record.actor.generation ||
+        !exactRetiredDelivery(delivery.binding, record.session) ||
+        delivery.close === undefined
+      ) {
+        throw createInternalFrameworkException(
+          ZLinkFrameworkInternalErrorKind.RouteNotConnected,
+          'The requested session binding is no longer current.'
+        );
+      }
+      await delivery.close();
+      this.replyWire(ingress, record.correlation, RequestResult.Ok, 0);
+    } catch (error) {
+      const result = failure(error);
+      this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+    }
+    return 'infrastructure';
+  }
+
   /**
    * Handles the replacement notice at the retired session owner.  This path
    * intentionally never calls validateActorFence(): the notice is authorized
@@ -3539,12 +3925,25 @@ export class ServiceStatefulRuntime {
       // session that belongs to the new lifecycle.
       return 'infrastructure';
     }
-    if (
-      record.retiredSession.sessionOwnerNodeRid !== this.nodeRid ||
-      record.retiredSession.sessionOwnerNodeGeneration !== this.nodeGeneration ||
-      record.retiredSession.sessionOwnerId !== this.nodeRid ||
-      record.retiredSession.sessionOwnerLeaseGeneration !== this.nodeGeneration
-    ) {
+    const sessionOwner = this.localSessionOwner();
+    if (sessionOwner === undefined) {
+      traceSessionBindingControlDrop(
+        this.dispatchErrors?.flow,
+        ingress.sourceRoutingId,
+        authority.actor.actorId,
+        'boundSessionReplaced',
+        'location_unavailable'
+      );
+      return 'infrastructure';
+    }
+    if (!sessionOwnerFenceMatches(sessionOwner, record.retiredSession)) {
+      traceSessionBindingControlDrop(
+        this.dispatchErrors?.flow,
+        ingress.sourceRoutingId,
+        authority.actor.actorId,
+        'boundSessionReplaced',
+        'stale_target'
+      );
       return 'infrastructure';
     }
     const actor = authority.actor;
@@ -3571,6 +3970,9 @@ export class ServiceStatefulRuntime {
           : undefined;
     if (delivery === undefined) return 'infrastructure';
     this.appliedReplacementNotices.add(key);
+    if (delivery === current) {
+      this.sessionDeliveries.delete(deliveryKey);
+    }
     delivery.onBindingReplaced?.(actor.actorId, record.retiredSession, actor);
     if (retired !== undefined) {
       this.retiredSessionDeliveries.delete(sessionDeliveryKey(retired.binding));
@@ -3582,14 +3984,20 @@ export class ServiceStatefulRuntime {
     previous: ServiceSessionBinding,
     actorAuthority: ServiceBoundSessionActorAuthority
   ): void {
-    const ownerGeneration =
-      previous.sessionOwnerNodeGeneration ?? this.tryPeerGeneration(previous.sessionOwnerNodeRid);
-    if (ownerGeneration === undefined) return;
+    // Command 51 carries the retired binding's stored identity unchanged; a
+    // binding without one has nothing to notify.
+    if (
+      previous.sessionOwnerNodeGeneration === undefined ||
+      previous.sessionOwnerId === undefined ||
+      previous.sessionOwnerLeaseGeneration === undefined
+    ) {
+      return;
+    }
     const header = encodeBoundSessionReplacedHeader(actorAuthority, {
       sessionOwnerNodeRid: previous.sessionOwnerNodeRid,
-      sessionOwnerNodeGeneration: ownerGeneration,
-      sessionOwnerId: previous.sessionOwnerId ?? previous.sessionOwnerNodeRid,
-      sessionOwnerLeaseGeneration: previous.sessionOwnerLeaseGeneration ?? ownerGeneration,
+      sessionOwnerNodeGeneration: previous.sessionOwnerNodeGeneration,
+      sessionOwnerId: previous.sessionOwnerId,
+      sessionOwnerLeaseGeneration: previous.sessionOwnerLeaseGeneration,
       sessionRid: previous.sessionRid,
       retiredBindingGeneration: previous.bindingGeneration
     });
@@ -3612,11 +4020,9 @@ export class ServiceStatefulRuntime {
       current === undefined ||
       sourceGeneration === undefined ||
       current.bindingGeneration !== record.binding.retiredGeneration ||
-      current.sessionRid !== record.sessionRid ||
+      !routingIdsEqual(current.sessionRid, record.sessionRid) ||
       current.sessionOwnerNodeRid !== ingress.sourceRoutingId ||
-      current.sessionOwnerNodeGeneration !== sourceGeneration ||
-      current.sessionOwnerId !== ingress.sourceRoutingId ||
-      current.sessionOwnerLeaseGeneration !== sourceGeneration
+      current.sessionOwnerNodeGeneration !== sourceGeneration
     ) {
       this.replyWire(ingress, record.correlation, RequestResult.Ok, 0);
       return;
@@ -3781,6 +4187,37 @@ export class ServiceStatefulRuntime {
     });
   }
 
+  private prepareRequestSource(
+    ingress: RawServiceIngressRecord,
+    stateful: ServiceStatefulMailboxData,
+    signal: AbortSignal
+  ): boolean | Promise<boolean> {
+    const reject = (error: unknown): false => {
+      if (signal.aborted) return false;
+      if (!(error instanceof ZLinkFrameworkException)) throw error;
+      const result = failure(error);
+      stateful.reply?.(result.terminalResult, result.failureCode);
+      return false;
+    };
+    if (signal.aborted) return false;
+    try {
+      const pending = this.acceptRequestSource(ingress, signal);
+      return pending === undefined
+        ? true
+        : awaitWithAbort(pending, signal).then(() => true, reject);
+    } catch (error) {
+      return reject(error);
+    }
+  }
+
+  prepareDispatch(record: ServiceMailboxRecord, signal: AbortSignal): boolean | Promise<boolean> {
+    return this.prepareRequestSource(
+      record.ingress!,
+      record.stateful as ServiceStatefulMailboxData,
+      signal
+    );
+  }
+
   private enqueueApplicationFrame(
     ingress: RawServiceIngressRecord,
     owner: string,
@@ -3812,6 +4249,10 @@ export class ServiceStatefulRuntime {
       domain,
       parts: [ingress.parts[0]!, payloadFrame],
       sourceRoutingId: ingress.sourceRoutingId,
+      ingress,
+      get requestSource() {
+        return ingress.requestSource;
+      },
       sourceRoute: ingress.sourceRoute,
       ...(ingress.reply === undefined ? {} : { reply: ingress.reply }),
       ...(ingress.requestSequence === undefined
@@ -3819,9 +4260,21 @@ export class ServiceStatefulRuntime {
         : { requestSequence: ingress.requestSequence }),
       ...(stateful.correlation === undefined ? {} : { correlation: stateful.correlation }),
       stateful,
+      sourcePreparationOwner:
+        domain === 'application' &&
+        this.requestSourceAcceptance !== undefined &&
+        (stateful.receiveKind === ReceiveKind.SpotSend ||
+          stateful.receiveKind === ReceiveKind.SpotRequest ||
+          stateful.receiveKind === ReceiveKind.ActorSend ||
+          stateful.receiveKind === ReceiveKind.ActorRequest)
+          ? this
+          : undefined,
       applicationJob
     });
-    if (accepted) return domain;
+    if (accepted) {
+      ingress.onAdmitted?.();
+      return domain;
+    }
     applicationJob.close();
     if (stateful.reply !== undefined) {
       const result = failure(
@@ -3957,10 +4410,11 @@ export class ServiceStatefulRuntime {
     ingress: RawServiceIngressRecord,
     binding: ServiceSessionBinding,
     actorAuthority: ServiceBoundSessionActorAuthority,
-    reply: NonNullable<ServiceStatefulMailboxData['reply']>
+    reply: NonNullable<ServiceStatefulMailboxData['reply']>,
+    acceptedBinding: () => ServiceSessionBinding
   ): boolean {
     const actor = binding.actor;
-    const sessionOwner = requireSessionOwnerIdentity(binding);
+    requireSessionOwnerIdentity(binding);
     const header = Buffer.from([
       SERVICE_WIRE_MAGIC[0],
       SERVICE_WIRE_MAGIC[1],
@@ -3985,12 +4439,27 @@ export class ServiceStatefulRuntime {
           actorNodeGeneration: actorAuthority.targetNodeGeneration,
           authorityOwnerGeneration: actorAuthority.authorityOwnerGeneration,
           ownerLeaseGeneration: actorAuthority.ownerLeaseGeneration,
-          bindingGeneration: binding.bindingGeneration,
-          sessionNodeRid: binding.sessionOwnerNodeRid as never,
-          sessionRid: binding.sessionRid as never,
-          sessionOwnerNodeGeneration: sessionOwner.nodeGeneration,
-          sessionOwnerId: sessionOwner.ownerId,
-          sessionOwnerLeaseGeneration: sessionOwner.leaseGeneration
+          // The Host reads only Session identity fields before `reply` installs the
+          // binding; installation keeps that identity. Generation and owner fields
+          // are read after `reply`, so they always come from the accepted binding.
+          get bindingGeneration() {
+            return acceptedBinding().bindingGeneration;
+          },
+          get sessionNodeRid() {
+            return acceptedBinding().sessionOwnerNodeRid as never;
+          },
+          get sessionRid() {
+            return acceptedBinding().sessionRid as never;
+          },
+          get sessionOwnerNodeGeneration() {
+            return acceptedBinding().sessionOwnerNodeGeneration!;
+          },
+          get sessionOwnerId() {
+            return acceptedBinding().sessionOwnerId!;
+          },
+          get sessionOwnerLeaseGeneration() {
+            return acceptedBinding().sessionOwnerLeaseGeneration!;
+          }
         },
         reply
       } satisfies ServiceStatefulMailboxData,
@@ -4212,64 +4681,15 @@ export class ServiceStatefulRuntime {
     operationKind: 'userSpotCreate' | 'userSpotClose' | 'actorCreate' | 'streamBind' | 'actorJoin',
     deadlineMs: number
   ): Promise<readonly Buffer[]> {
-    const stop = new AbortController();
-    const unobserve = this.raw.observePeerConnectionIntentRemoved((nodeRoutingId) => {
-      if (nodeRoutingId === targetNodeRid) {
-        stop.abort(
-          createInternalFrameworkException(
-            ZLinkFrameworkInternalErrorKind.RouteNotConnected,
-            `${operationKind} target node lifecycle ended.`,
-            true
-          )
-        );
-      }
-    });
-    let wasAdmitted = false;
-    try {
-      // Only durable lifecycle operations replay these frozen frames. Received
-      // envelopes leave this loop before decoding, including failure terminals.
-      for (;;) {
-        this.requireOpen();
-        stop.signal.throwIfAborted();
-        const remainingMs = Math.ceil(deadlineMs - performance.now());
-        if (remainingMs <= 0) throw durableOperationExhausted(operationKind, wasAdmitted);
-        try {
-          return await awaitWithAbort(
-            targetNodeRid === this.nodeRid
-              ? this.requestLocalInfrastructure(parts[0]!, correlation, remainingMs)
-              : this.raw.requestService(targetNodeRid, parts, remainingMs),
-            stop.signal
-          );
-        } catch (error) {
-          stop.signal.throwIfAborted();
-          if (!durableRequestCanReplay(error)) throw error;
-          if (durableRequestWasAdmitted(error)) wasAdmitted = true;
-          const retryDelayMs = Math.min(
-            STATEFUL_OPERATION_RETRY_TICK_MS,
-            deadlineMs - performance.now()
-          );
-          if (retryDelayMs <= 0) {
-            throw durableOperationExhausted(operationKind, wasAdmitted, error);
-          }
-          let timer: ReturnType<typeof setTimeout> | undefined;
-          try {
-            await awaitWithAbort(
-              new Promise<void>((resolve) => {
-                timer = setTimeout(resolve, retryDelayMs);
-              }),
-              stop.signal
-            );
-          } finally {
-            if (timer !== undefined) clearTimeout(timer);
-          }
-        }
-      }
-    } catch (error) {
-      stop.signal.throwIfAborted();
-      throw error;
-    } finally {
-      unobserve();
+    this.requireOpen();
+    if (targetNodeRid === this.nodeRid) {
+      return this.requestLocalInfrastructure(
+        parts[0]!,
+        correlation,
+        Math.ceil(deadlineMs - performance.now())
+      );
     }
+    return requestDurableService(this.raw, targetNodeRid, parts, deadlineMs, operationKind);
   }
 
   private requestLocalInfrastructure(
@@ -4393,7 +4813,8 @@ export class ServiceStatefulRuntime {
       | 'streamBind'
       | 'streamUnbind'
       | 'instanceSpotRequest',
-    actor?: ServiceActorRef
+    actor?: ServiceActorRef,
+    onAdmitted?: () => void
   ): void {
     if (targetNodeRid === this.nodeRid) {
       const deadlineUnixMs = BigInt(Date.now() + Math.max(0, timeoutMs));
@@ -4411,6 +4832,7 @@ export class ServiceStatefulRuntime {
             flags: parts[0]![SERVICE_WIRE_FLAGS_OFFSET]!,
             sourceRoutingId: this.nodeRid,
             requestSequence: pending.id,
+            onAdmitted,
             parts,
             applicationJobOwner
           };
@@ -4429,7 +4851,7 @@ export class ServiceStatefulRuntime {
       })().catch((error) => this.operations.reply(pending.id, failure(error)));
       return;
     }
-    void this.raw.requestService(targetNodeRid, parts, timeoutMs).then(
+    void this.raw.requestService(targetNodeRid, parts, timeoutMs, onAdmitted).then(
       (reply) => this.completeRemoteReply(pending, targetNodeRid, operationKind, actor, reply),
       (error) => this.operations.fail(pending.id, error)
     );
@@ -4611,6 +5033,15 @@ export class ServiceStatefulRuntime {
           operationKind: OperationKind.ActorRequest,
           correlation: decoded.correlation,
           targetActor: current.ref,
+          messageFollowOrigin: {
+            get requestSource() {
+              return ingress.requestSource;
+            },
+            target: decoded.target,
+            sourceNodeRid: ingress.sourceRoutingId,
+            originalOperation: decoded.operation,
+            originalReplyRouteId: decoded.correlation ?? 0n
+          },
           ...(decoded.sourceActor === undefined
             ? {}
             : { sourceActor: { ...decoded.sourceActor, nodeRid: ingress.sourceRoutingId } }),
@@ -4706,13 +5137,17 @@ export class ServiceStatefulRuntime {
       try {
         const current = this.validateActorFence(decoded.actor);
         if (decoded.binding.state === 'active') {
+          const sessionOwner = await this.sessionOwnerOf(this.nodeRid, this.nodeGeneration);
           this.registry.installSessionBinding(
             sessionBindingFromWire(
               current.ref,
               decoded.sessionRid,
-              this.nodeRid,
+              sessionOwner.nodeRid,
               decoded.binding.generation,
-              current.membershipEpoch
+              current.membershipEpoch,
+              sessionOwner.nodeGeneration,
+              sessionOwner.ownerId,
+              sessionOwner.leaseGeneration
             )
           );
         } else {
@@ -4761,6 +5196,7 @@ export class ServiceStatefulRuntime {
       | 'actorJoin'
       | 'streamBind'
       | 'streamUnbind'
+      | 'boundSessionClose'
       | 'instanceSpotRequest',
     actor: ServiceActorRef | undefined,
     reply: readonly Buffer[]
@@ -5387,6 +5823,25 @@ function isEntrySpotFence(fence: ServiceSpotRouteFence): boolean {
   );
 }
 
+function instanceActivationOutcome(error: unknown): string {
+  if (isAbortError(error)) return 'shutdown';
+  if (error instanceof ZLinkFrameworkException) {
+    switch (error.kind) {
+      case ZLinkFrameworkErrorKind.DeadlineExceeded:
+        return 'timed_out';
+      case ZLinkFrameworkErrorKind.ShuttingDown:
+        return 'shutdown';
+      case ZLinkFrameworkErrorKind.AlreadyExists:
+        return 'conflict';
+      case ZLinkFrameworkErrorKind.InvalidOperation:
+        return 'fenced';
+      case ZLinkFrameworkErrorKind.Unavailable:
+        return 'store_failure';
+    }
+  }
+  return 'rejected';
+}
+
 function operationDeadline(deadlineUnixMs: bigint): {
   readonly signal: AbortSignal;
   close(): void;
@@ -5414,37 +5869,6 @@ function operationReplayExpired(replayExpiresAtMs: number): boolean {
   return performance.now() > replayExpiresAtMs;
 }
 
-function durableRequestWasAdmitted(error: unknown): boolean {
-  // Request NotConnected includes Core handover of an admitted request. The
-  // submit/request phase, rather than the result number, owns this distinction.
-  return isZLinkBackendResultError(error) && error.operation === 'request';
-}
-
-function durableOperationExhausted(
-  operationKind: 'userSpotCreate' | 'userSpotClose' | 'actorCreate' | 'streamBind' | 'actorJoin',
-  wasAdmitted: boolean,
-  cause?: unknown
-): ZLinkFrameworkException {
-  return createInternalFrameworkException(
-    wasAdmitted
-      ? ZLinkFrameworkInternalErrorKind.DeadlineExceeded
-      : ZLinkFrameworkInternalErrorKind.RouteNotConnected,
-    `${operationKind} exhausted its end-to-end deadline.`,
-    true,
-    cause
-  );
-}
-
-function durableRequestCanReplay(error: unknown): boolean {
-  if (!isZLinkBackendResultError(error)) return false;
-  return error.operation === 'request'
-    ? error.result === RequestResult.NotConnected || error.result === RequestResult.TimedOut
-    : error.result === SubmitResult.NotConnected ||
-        error.result === SubmitResult.NotFound ||
-        error.result === SubmitResult.NotAdmitted ||
-        error.result === SubmitResult.Backpressured;
-}
-
 function remainingDeadlineMs(deadlineUnixMs: bigint): number {
   const remainingMs = deadlineUnixMs - BigInt(Date.now());
   if (remainingMs <= 0n) {
@@ -5482,6 +5906,13 @@ function actorLocation(actor: ServiceActorState): ActorLocation {
   };
 }
 
+function requestSourceUnavailable(nodeRid: string): ZLinkFrameworkException {
+  return new ZLinkFrameworkException(
+    ZLinkFrameworkErrorKind.Unavailable,
+    `Request source '${nodeRid}' has no live MeshNode descriptor.`
+  );
+}
+
 function activationRefused(): ZLinkFrameworkException {
   return new ZLinkFrameworkException(
     ZLinkFrameworkErrorKind.Unavailable,
@@ -5499,14 +5930,14 @@ function failure(error: unknown): ServiceStatefulResult {
   return internalFrameworkWireReply(ZLinkFrameworkInternalErrorKind.RequestFailed);
 }
 
-function actorKey(actor: ServiceActorRef): string {
+function actorKey(actor: Pick<ServiceActorRef, 'actorId' | 'generation'>): string {
   return `${actor.actorId}\0${actor.generation}`;
 }
 
 function sameSessionBinding(left: ServiceSessionBinding, right: ServiceSessionBinding): boolean {
   return (
     sameActorRef(left.actor, right.actor) &&
-    left.sessionRid === right.sessionRid &&
+    routingIdsEqual(left.sessionRid, right.sessionRid) &&
     sameSessionOwnerIdentity(left, right) &&
     left.bindingGeneration === right.bindingGeneration
   );
@@ -5515,7 +5946,7 @@ function sameSessionBinding(left: ServiceSessionBinding, right: ServiceSessionBi
 function sameSessionIdentity(left: ServiceSessionBinding, right: ServiceSessionBinding): boolean {
   return (
     sameActorRef(left.actor, right.actor) &&
-    left.sessionRid === right.sessionRid &&
+    routingIdsEqual(left.sessionRid, right.sessionRid) &&
     sameSessionOwnerIdentity(left, right)
   );
 }
@@ -5538,9 +5969,7 @@ function sameSessionOwnerIdentity(
 ): boolean {
   return (
     left.sessionOwnerNodeRid === right.sessionOwnerNodeRid &&
-    left.sessionOwnerNodeGeneration === right.sessionOwnerNodeGeneration &&
-    left.sessionOwnerId === right.sessionOwnerId &&
-    left.sessionOwnerLeaseGeneration === right.sessionOwnerLeaseGeneration
+    left.sessionOwnerNodeGeneration === right.sessionOwnerNodeGeneration
   );
 }
 
@@ -5578,7 +6007,7 @@ function sessionDeliveryKey(
   >
 ): string {
   return (
-    `${actorKey(binding.actor)}\0${binding.sessionOwnerNodeRid}\0${binding.sessionRid}` +
+    `${actorKey(binding.actor)}\0${binding.sessionOwnerNodeRid}\0${encodeRoutingIdStorageHex(binding.sessionRid)}` +
     `\0${binding.sessionOwnerNodeGeneration ?? ''}` +
     `\0${binding.sessionOwnerId ?? ''}` +
     `\0${binding.sessionOwnerLeaseGeneration ?? ''}` +
@@ -5591,8 +6020,8 @@ function exactRetiredDelivery(
   retired: ServiceRetiredBoundSessionRouteFence
 ): boolean {
   return (
-    binding.sessionRid === retired.sessionRid &&
-    binding.sessionOwnerNodeRid === retired.sessionOwnerNodeRid &&
+    routingIdsEqual(binding.sessionRid, retired.sessionRid) &&
+    routingIdsEqual(binding.sessionOwnerNodeRid, retired.sessionOwnerNodeRid) &&
     binding.sessionOwnerNodeGeneration === retired.sessionOwnerNodeGeneration &&
     binding.sessionOwnerId === retired.sessionOwnerId &&
     binding.sessionOwnerLeaseGeneration === retired.sessionOwnerLeaseGeneration &&
@@ -5611,7 +6040,7 @@ function replacementNoticeKey(
     `\0${record.retiredSession.sessionOwnerNodeGeneration}` +
     `\0${record.retiredSession.sessionOwnerId}` +
     `\0${record.retiredSession.sessionOwnerLeaseGeneration}` +
-    `\0${record.retiredSession.sessionRid}` +
+    `\0${encodeRoutingIdStorageHex(record.retiredSession.sessionRid)}` +
     `\0${record.retiredSession.retiredBindingGeneration}`
   );
 }
@@ -5937,3 +6366,31 @@ export function statefulMailboxData(
 ): ServiceStatefulMailboxData | undefined {
   return record.stateful as ServiceStatefulMailboxData | undefined;
 }
+
+function acceptsStatefulIngress(command: number): boolean {
+  // These frozen relocation controls overlap the legacy stateful command
+  // number range (30-34). They are bare infrastructure records and must
+  // fall through to RawServiceMeshRuntime's relocation ingress instead of
+  // being decoded as stateful actor/spot work.
+  if (
+    command === M6bServiceWireCommand.relocationReady ||
+    command === M6bServiceWireCommand.relocationData ||
+    command === M6bServiceWireCommand.replyRelay ||
+    command === M6bServiceWireCommand.relocationCutover
+  ) {
+    return false;
+  }
+  if (
+    command < M6bServiceWireCommand.spotSend ||
+    (command > M6bServiceWireCommand.instanceSpot &&
+      command !== M6bServiceWireCommand.userSpotCreate &&
+      command !== M6bServiceWireCommand.userSpotClose &&
+      command !== M6bServiceWireCommand.actorCreate &&
+      command !== M6bServiceWireCommand.messageFollow &&
+      command !== M6bServiceWireCommand.boundSessionReplaced &&
+      command !== M6bServiceWireCommand.boundSessionClose)
+  ) {
+    return false;
+  }
+  return true;
+}