@zlink-systems/framework 0.30.0 → 0.30.2

package/src/runtime/locations/location-store-repository.ts

@@ -1,3 +1,5 @@
+import type { ZLinkRuntimeMetrics } from '../diagnostics/runtime-metrics';
+import { routingIdsEqual, toBackendRoutingId } from '../routing-id';
 import {
   ServiceRelocationAuthorityPayloadCodec,
   serviceRelocationAuthorityApplicationPayload
@@ -22,6 +24,7 @@ import {
   type ZLinkStoreKey,
   type ZLinkStoreReadResult,
   type ZLinkStoreScanCursor,
+  type ZLinkStoreValue,
   type ZLinkStoreVersion,
   type ZLinkStoreWriteRequest,
   ZLinkFrameworkException,
@@ -43,6 +46,7 @@ import {
 import { ZLinkLocationWriteStatus as WriteStatus } from '../../contracts/Locations';
 import {
   ZLINK_PROVIDER_MAX_PAGE_SIZE,
+  ZLINK_PROVIDER_MAX_WRITE_KEYS,
   ZLINK_PROVIDER_MAX_VALUE_BYTES
 } from '../../contracts/Locations/Stores';
 import { SHA256_DIGEST_BYTES } from '../foundation/actor-join-recovery-codec';
@@ -130,6 +134,15 @@ interface AuthorityRecord {
   readonly visibleStoreVersion?: string;
 }
 
+/** An Actor membership of an ended User Spot incarnation (location runtime §6.1). */
+interface EndedSpotMember {
+  readonly key: ZLinkStoreKey;
+  readonly version: ZLinkStoreVersion;
+  readonly ownerId: string;
+  readonly leaseGeneration: bigint;
+  readonly allocation: StoredAuthoritySnapshot['allocation'];
+}
+
 interface CapacityRecord {
   readonly active: CapacityUsage;
   readonly pending: CapacityUsage;
@@ -207,28 +220,48 @@ const MAX_OWNER_CLEANUP_BATCH_ROWS = 2_047;
  */
 export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   private readonly provider: ZLinkLocationStore;
+  private readonly confirmedCapacities = new Map<string, CapacityRecord | undefined>();
   private readonly aggregateInventory: ZLinkAggregateInventoryStore;
 
   constructor(
     provider: ZLinkLocationStore,
-    private readonly nowProvider: () => Date = () => new Date()
+    private readonly nowProvider: () => Date = () => new Date(),
+    private readonly metrics?: ZLinkRuntimeMetrics
   ) {
     super(nowProvider);
     // Classify only failures of the opaque SPI, before interpreting its records.
+    const confirm = (key: ZLinkStoreKey, bytes?: Uint8Array) => {
+      if (this.confirmedCapacities.has(key.value)) {
+        this.confirmedCapacities.set(
+          key.value,
+          bytes === undefined ? emptyCapacityRecord() : decodeJson<CapacityRecord>(bytes)
+        );
+      }
+    };
     this.provider = {
       async read(key, signal) {
+        let result: ZLinkStoreReadResult;
         try {
-          return await provider.read(key, signal);
+          result = await provider.read(key, signal);
         } catch (error) {
           throw locationStoreProviderFailure(error, signal);
         }
+        confirm(key, result.kind === 'found' ? result.value.bytes : undefined);
+        return result;
       },
       async write(request, signal) {
+        let result;
         try {
-          return await provider.write(request, signal);
+          result = await provider.write(request, signal);
         } catch (error) {
           throw locationStoreProviderFailure(error, signal);
         }
+        if (result.kind === 'applied') {
+          for (const mutation of request.mutations) {
+            if (mutation.kind === 'put') confirm(mutation.key, mutation.bytes);
+          }
+        }
+        return result;
       },
       async scan(request, signal) {
         try {
@@ -241,9 +274,38 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     this.aggregateInventory = new ZLinkAggregateInventoryStore(this.provider);
   }
 
+  private async observeStore<T>(operation: string, request: () => Promise<T>): Promise<T> {
+    try {
+      return await request();
+    } catch (error) {
+      if (
+        error instanceof ZLinkFrameworkException &&
+        error.kind === ZLinkFrameworkErrorKind.Unavailable
+      ) {
+        this.metrics?.recordLocationStoreError(operation);
+      }
+      throw error;
+    }
+  }
+
+  confirmedCapacity(
+    key: ZLinkMeshNodeDescriptorKey,
+    limits: ZLinkMeshNodeDescriptor['populationCapacity']
+  ): ZLinkMeshNodeDescriptor['populationCapacity'] | undefined {
+    const record = this.confirmedCapacities.get(capacityKey(key.meshName, String(key.rid)).value);
+    return record === undefined ? undefined : projectCapacity(limits, record);
+  }
+
   override async readAuthority(
     key: ZLinkAuthorityKey,
     signal?: AbortSignal
+  ): Promise<ZLinkAuthorityReadResult> {
+    return this.observeStore('read', () => this.readAuthorityRequest(key, signal));
+  }
+
+  private async readAuthorityRequest(
+    key: ZLinkAuthorityKey,
+    signal?: AbortSignal
   ): Promise<ZLinkAuthorityReadResult> {
     const result = await this.provider.read(authorityKey(key.value), signal);
     if (result.kind === 'missing') {
@@ -262,6 +324,17 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     cursor: ZLinkAuthorityScanCursor | undefined,
     limit: number,
     signal?: AbortSignal
+  ): Promise<ZLinkAuthorityScanResult> {
+    return this.observeStore('read', () =>
+      this.listAuthoritiesRequest(prefix, cursor, limit, signal)
+    );
+  }
+
+  private async listAuthoritiesRequest(
+    prefix: string,
+    cursor: ZLinkAuthorityScanCursor | undefined,
+    limit: number,
+    signal?: AbortSignal
   ): Promise<ZLinkAuthorityScanResult> {
     if (!Number.isInteger(limit) || limit < 1 || limit > ZLINK_PROVIDER_MAX_PAGE_SIZE) {
       throw new RangeError(`Authority scan limit must be in 1..${ZLINK_PROVIDER_MAX_PAGE_SIZE}.`);
@@ -303,6 +376,17 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     expectedStoreVersion: ZLinkAuthorityStoreVersion,
     mutation: ZLinkAuthorityMutation,
     signal?: AbortSignal
+  ): Promise<ZLinkAuthorityCompareExchangeResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.compareExchangeAuthorityRequest(key, expectedStoreVersion, mutation, signal)
+    );
+  }
+
+  private async compareExchangeAuthorityRequest(
+    key: ZLinkAuthorityKey,
+    expectedStoreVersion: ZLinkAuthorityStoreVersion,
+    mutation: ZLinkAuthorityMutation,
+    signal?: AbortSignal
   ): Promise<ZLinkAuthorityCompareExchangeResult> {
     if (mutation.kind !== 'delete') {
       validatePayloadSize(mutation.payload, 'Authority payload');
@@ -551,6 +635,15 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async prepareAggregate(
     request: ZLinkAggregatePrepareRequest,
     signal?: AbortSignal
+  ): Promise<ZLinkAggregatePrepareResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.prepareAggregateRequest(request, signal)
+    );
+  }
+
+  private async prepareAggregateRequest(
+    request: ZLinkAggregatePrepareRequest,
+    signal?: AbortSignal
   ): Promise<ZLinkAggregatePrepareResult> {
     validateProviderAggregateRequest(request);
     const fence = aggregateFence(request.aggregateId, request.aggregateGeneration);
@@ -838,7 +931,7 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
               aggregateRecord.requestFingerprint === fingerprint &&
               (aggregateRecord.state === 'staging' || aggregateRecord.state === 'prepared')
             ) {
-              return await this.prepareAggregate(request, signal);
+              return await this.prepareAggregateRequest(request, signal);
             }
           }
           await this.clearAggregateMarkers(fence, installed, signal);
@@ -915,6 +1008,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async commitAggregate(
     fence: ZLinkAggregateFence,
     signal?: AbortSignal
+  ): Promise<ZLinkAggregateCommitResult> {
+    return this.observeStore('compare_exchange', () => this.commitAggregateRequest(fence, signal));
+  }
+
+  private async commitAggregateRequest(
+    fence: ZLinkAggregateFence,
+    signal?: AbortSignal
   ): Promise<ZLinkAggregateCommitResult> {
     validateAggregateFence(fence);
     return await this.commitAggregateCore(fence, signal);
@@ -1146,6 +1246,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async abortAggregate(
     fence: ZLinkAggregateFence,
     signal?: AbortSignal
+  ): Promise<ZLinkAggregateAbortResult> {
+    return this.observeStore('compare_exchange', () => this.abortAggregateRequest(fence, signal));
+  }
+
+  private async abortAggregateRequest(
+    fence: ZLinkAggregateFence,
+    signal?: AbortSignal
   ): Promise<ZLinkAggregateAbortResult> {
     validateAggregateFence(fence);
     const rowKey = aggregateKey(fence);
@@ -1206,6 +1313,17 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     expectedStoreVersion: string,
     signal?: AbortSignal,
     request?: ZLinkEndedOwnerReleaseIntent
+  ): Promise<boolean> {
+    return this.observeStore('release', () =>
+      this.releaseEndedReservationRequest(key, expectedStoreVersion, signal, request)
+    );
+  }
+
+  private async releaseEndedReservationRequest(
+    key: ZLinkAuthorityKey,
+    expectedStoreVersion: string,
+    signal?: AbortSignal,
+    request?: ZLinkEndedOwnerReleaseIntent
   ): Promise<boolean> {
     return (
       (await this.tryReleaseEndedReservation(key, expectedStoreVersion, signal, request)) ===
@@ -1245,9 +1363,8 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
       this.provider.read(descriptorKey, signal),
       this.provider.read(capacityRowKey, signal)
     ]);
-    if (lease.kind === 'found' && lease.value.expiresAt === undefined)
-      throw new Error('Location Store owner lease record is invalid.');
     const ownerLive = sameLiveOwner(lease, snapshot);
+    let members: EndedSpotMember[] = [];
     if (snapshot.allocation.state === 'active') {
       if (ownerLive) return 'notReclaimable';
       let unavailable = record.aggregate !== undefined || hasRelocationAuthority(snapshot.payload);
@@ -1259,46 +1376,12 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
           spot.stableType !== request.intent.stableType ||
           spot.spotId !== request.key.globalId ||
           spot.activationRecovery !== undefined;
-        if (spot?.kind === 'user_spot') {
-          // The snapshot starts only after the old owner's lease was found invalid.
-          for (const prefix of [`${PREFIX}actor:`, `${AUTHORITY_PREIMAGE_PREFIX}actor\0`]) {
-            membershipSnapshot: for (;;) {
-              let snapshotHasMember = false;
-              let cursor: ZLinkStoreScanCursor | undefined;
-              do {
-                const page = await this.provider.scan(
-                  { prefix, cursor, limit: ZLINK_PROVIDER_MAX_PAGE_SIZE },
-                  signal
-                );
-                if (page.kind === 'expired') continue membershipSnapshot;
-                for (const item of page.value.items) {
-                  if (prefix === `${PREFIX}actor:`) {
-                    const actor = normalizeActor(
-                      decodeJson<DescriptorRecord<ZLinkActorLocation>>(item.value.bytes).descriptor
-                    );
-                    snapshotHasMember ||=
-                      actor.spotKind === ZLinkSpotKind.User &&
-                      String(actor.spotId) === spot.spotId &&
-                      actor.spotGeneration === snapshot.objectGeneration;
-                  } else {
-                    const authority = decodeAuthorityRecord(item.value.bytes).snapshot;
-                    if (authority.allocation.objectKind !== 'actor') continue;
-                    const actor = decodeActorAuthorityPayload(
-                      serviceRelocationAuthorityApplicationPayload(authority.payload)
-                    );
-                    snapshotHasMember ||=
-                      actor?.currentSpotKind === ZLinkSpotKind.User &&
-                      actor.currentSpotId === spot.spotId &&
-                      actor.currentSpotGeneration === snapshot.objectGeneration;
-                  }
-                }
-                cursor = page.value.nextCursor;
-              } while (cursor !== undefined);
-              unavailable ||= snapshotHasMember;
-              break;
-            }
-          }
-        }
+        if (
+          spot?.kind === 'user_spot' &&
+          !unavailable &&
+          request?.actorRelocationPolicy === 'disabled'
+        )
+          members = await this.readEndedSpotMembers(spot.spotId, snapshot.objectGeneration, signal);
       }
       if (unavailable || request?.actorRelocationPolicy !== 'disabled')
         throw new ZLinkFrameworkException(
@@ -1318,60 +1401,171 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
       (record.aggregate !== undefined || hasRelocationAuthority(snapshot.payload))
     )
       return 'notReclaimable';
+    // Location runtime §6.1: the authority and every ended-owner member are released in
+    // one conditional batch. Each member is fenced by its row version and the observed
+    // (invalid) state of its own owner lease; member capacity is returned like the Spot's.
+    const conditions: ZLinkStoreCondition[] = [
+      { kind: 'version', key: rowKey, expected: current.value.version },
+      conditionFor(descriptorKey, descriptor)
+    ];
     const mutations: ZLinkStoreWriteRequest['mutations'][number][] = [
       { kind: 'delete', key: rowKey }
     ];
-    if (capacity.kind === 'found') {
-      const stored = decodeJson<CapacityRecord>(capacity.value.bytes);
-      try {
+    const owners = new Map<string, ZLinkStoreReadResult>([[snapshot.ownerId, lease]]);
+    for (const member of members) {
+      let memberLease = owners.get(member.ownerId);
+      if (memberLease === undefined) {
+        memberLease = await this.provider.read(ownerKey(member.ownerId), signal);
+        owners.set(member.ownerId, memberLease);
+      }
+      if (
+        memberLease.kind === 'found' &&
+        matchesLiveOwnerLease(memberLease, member.ownerId, member.leaseGeneration)
+      )
+        throw new ZLinkFrameworkException(
+          ZLinkFrameworkErrorKind.Unavailable,
+          'User Spot still has a member with a live owner lease.'
+        );
+      conditions.push({ kind: 'version', key: member.key, expected: member.version });
+      mutations.push({ kind: 'delete', key: member.key });
+    }
+    for (const [ownerId, read] of owners) conditions.push(conditionFor(ownerKey(ownerId), read));
+    const capacities = new Map<string, { read: ZLinkStoreReadResult; next?: CapacityRecord }>([
+      [capacityRowKey.value, { read: capacity }]
+    ]);
+    const releases: { allocation: StoredAuthoritySnapshot['allocation'] }[] = [
+      { allocation: snapshot.allocation },
+      ...members.map((member) => ({ allocation: member.allocation }))
+    ];
+    try {
+      for (const { allocation } of releases) {
+        const key = capacityKey(allocation.descriptor.meshName, String(allocation.descriptor.rid));
+        let entry = capacities.get(key.value);
+        if (entry === undefined) {
+          entry = { read: await this.provider.read(key, signal) };
+          capacities.set(key.value, entry);
+        }
+        if (entry.read.kind !== 'found') continue;
+        const stored = entry.next ?? decodeJson<CapacityRecord>(entry.read.value.bytes);
+        entry.next = {
+          active:
+            allocation.state === 'active'
+              ? subtractCapacity(stored.active, allocation.capacity)
+              : stored.active,
+          pending:
+            allocation.state === 'reserved'
+              ? subtractCapacity(stored.pending, allocation.capacity)
+              : stored.pending
+        };
+      }
+    } catch (error) {
+      if (
+        !(error instanceof ZLinkFrameworkException) ||
+        error.kind !== ZLinkFrameworkErrorKind.DataLost
+      )
+        throw error;
+      for (const authority of [{ key: rowKey, version: current.value.version }, ...members]) {
+        const observed = await this.provider.read(authority.key, signal);
+        if (observed.kind === 'missing' || observed.value.version.value !== authority.version.value)
+          return 'conflict';
+      }
+      throw error;
+    }
+    for (const [key, entry] of capacities) {
+      conditions.push(conditionFor(storeKey(key), entry.read));
+      if (entry.next !== undefined)
         mutations.push({
           kind: 'put',
-          key: capacityRowKey,
-          bytes: encodeJson({
-            active:
-              snapshot.allocation.state === 'active'
-                ? subtractCapacity(stored.active, snapshot.allocation.capacity)
-                : stored.active,
-            pending:
-              snapshot.allocation.state === 'reserved'
-                ? subtractCapacity(stored.pending, snapshot.allocation.capacity)
-                : stored.pending
-          } satisfies CapacityRecord)
+          key: storeKey(key),
+          bytes: encodeJson(entry.next satisfies CapacityRecord)
         });
-      } catch (error) {
-        if (
-          !(error instanceof ZLinkFrameworkException) ||
-          error.kind !== ZLinkFrameworkErrorKind.DataLost
-        )
-          throw error;
-        const observed = await this.provider.read(rowKey, signal);
-        if (
-          observed.kind === 'missing' ||
-          observed.value.version.value !== current.value.version.value
-        )
-          return 'conflict';
-        throw error;
-      }
     }
-    const result = await this.provider.write(
-      {
-        conditions: [
-          { kind: 'version', key: rowKey, expected: current.value.version },
-          conditionFor(leaseKey, lease),
-          conditionFor(descriptorKey, descriptor),
-          conditionFor(capacityRowKey, capacity)
-        ],
-        mutations
-      },
-      signal
-    );
+    // Every mutated key is also a condition key, so the condition count is the batch's
+    // unique key count. A release beyond the provider bound changes nothing.
+    if (conditions.length > ZLINK_PROVIDER_MAX_WRITE_KEYS)
+      throw new ZLinkFrameworkException(
+        ZLinkFrameworkErrorKind.Unavailable,
+        'User Spot member release exceeds one Location Store batch.'
+      );
+    const result = await this.provider.write({ conditions, mutations }, signal);
     return result.kind === 'applied' ? 'reclaimed' : 'conflict';
   }
 
+  /**
+   * Reads every Actor membership of one User Spot incarnation from complete snapshot scans
+   * (location runtime §6.1), from Actor authorities alone. An expired snapshot
+   * discards the earlier pages and restarts; a Store failure propagates. A member authority
+   * that is relocating, part of an aggregate or not yet activated keeps the Spot.
+   */
+  private async readEndedSpotMembers(
+    spotId: string,
+    spotGeneration: bigint,
+    signal?: AbortSignal
+  ): Promise<EndedSpotMember[]> {
+    membershipSnapshot: for (;;) {
+      const members: EndedSpotMember[] = [];
+      let cursor: ZLinkStoreScanCursor | undefined;
+      do {
+        const page = await this.provider.scan(
+          {
+            prefix: `${AUTHORITY_PREIMAGE_PREFIX}actor\0`,
+            cursor,
+            limit: ZLINK_PROVIDER_MAX_PAGE_SIZE
+          },
+          signal
+        );
+        if (page.kind === 'expired') continue membershipSnapshot;
+        for (const item of page.value.items) {
+          const record = decodeAuthorityRecord(item.value.bytes);
+          const authority = record.snapshot;
+          if (authority.allocation.objectKind !== 'actor') continue;
+          const actor = decodeActorAuthorityPayload(
+            serviceRelocationAuthorityApplicationPayload(authority.payload)
+          );
+          if (
+            actor?.currentSpotKind !== ZLinkSpotKind.User ||
+            actor.currentSpotId !== spotId ||
+            actor.currentSpotGeneration !== spotGeneration
+          )
+            continue;
+          if (
+            authority.allocation.state !== 'active' ||
+            record.aggregate !== undefined ||
+            hasRelocationAuthority(authority.payload) ||
+            decodeActorAuthorityPayload(authority.payload)?.state !== 'ready'
+          )
+            throw new ZLinkFrameworkException(
+              ZLinkFrameworkErrorKind.Unavailable,
+              'User Spot still has a relocating or unactivated member.'
+            );
+          members.push({
+            key: item.key,
+            version: item.value.version,
+            ownerId: authority.ownerId,
+            leaseGeneration: authority.ownerLeaseGeneration,
+            allocation: authority.allocation
+          });
+        }
+        cursor = page.value.nextCursor;
+      } while (cursor !== undefined);
+      return members;
+    }
+  }
+
   override async reserve(
     request: ZLinkObjectReserveRequest,
     signal?: AbortSignal,
     deadlineUnixMs?: bigint
+  ): Promise<ZLinkObjectReserveResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.reserveRequest(request, signal, deadlineUnixMs)
+    );
+  }
+
+  private async reserveRequest(
+    request: ZLinkObjectReserveRequest,
+    signal?: AbortSignal,
+    deadlineUnixMs?: bigint
   ): Promise<ZLinkObjectReserveResult> {
     const encodedAuthorityKey = encodeAuthorityKey(request.key.kind, request.key.globalId);
     const reservationId = randomUUID();
@@ -1517,6 +1711,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     request: ZLinkObjectCommitRequest,
     signal?: AbortSignal,
     deadlineUnixMs?: bigint
+  ): Promise<ZLinkObjectCommitResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.commitRequest(request, signal, deadlineUnixMs)
+    );
+  }
+
+  private async commitRequest(
+    request: ZLinkObjectCommitRequest,
+    signal?: AbortSignal,
+    deadlineUnixMs?: bigint
   ): Promise<ZLinkObjectCommitResult> {
     const key = encodeAuthorityKey(request.key.kind, request.key.globalId);
     const rowKey = authorityKey(key.value);
@@ -1603,6 +1807,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     request: ZLinkObjectAbortRequest,
     signal?: AbortSignal,
     deadlineUnixMs?: bigint
+  ): Promise<ZLinkObjectAbortResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.abortRequest(request, signal, deadlineUnixMs)
+    );
+  }
+
+  private async abortRequest(
+    request: ZLinkObjectAbortRequest,
+    signal?: AbortSignal,
+    deadlineUnixMs?: bigint
   ): Promise<ZLinkObjectAbortResult> {
     const key = encodeAuthorityKey(request.key.kind, request.key.globalId);
     const rowKey = authorityKey(key.value);
@@ -1627,12 +1841,6 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
         this.provider.read(leaseKey, signal),
         this.provider.read(capacityRowKey, signal)
       ]);
-      if (leaseRead.kind === 'found' && leaseRead.value.expiresAt === undefined) {
-        // A lease is always written with a positive TTL, so a missing expiry
-        // is a corrupt record. Abort deletes authority state, so refuse
-        // rather than read the absence as expiry.
-        throw new Error('Location Store owner lease record is invalid.');
-      }
       if (liveTargetDescriptor(descriptorRead, leaseRead, request.target) === undefined)
         return { kind: 'stale' };
       const capacity =
@@ -1672,6 +1880,15 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async completeCreation(
     request: ZLinkObjectCreationCompleteRequest,
     signal?: AbortSignal
+  ): Promise<ZLinkObjectCreationCompleteResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.completeCreationRequest(request, signal)
+    );
+  }
+
+  private async completeCreationRequest(
+    request: ZLinkObjectCreationCompleteRequest,
+    signal?: AbortSignal
   ): Promise<ZLinkObjectCreationCompleteResult> {
     if (request.key.kind !== 'actor') {
       throw new TypeError('completeCreation is reserved for Actor creation.');
@@ -1840,6 +2057,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async readCreationTerminal(
     operation: ZLinkCreationOperationIdentity,
     signal?: AbortSignal
+  ): Promise<ZLinkCreationTerminalReadResult> {
+    return this.observeStore('read', () => this.readCreationTerminalRequest(operation, signal));
+  }
+
+  private async readCreationTerminalRequest(
+    operation: ZLinkCreationOperationIdentity,
+    signal?: AbortSignal
   ): Promise<ZLinkCreationTerminalReadResult> {
     validateCreationOperation(operation);
     const result = await this.provider.read(creationTerminalKey(operation), signal);
@@ -1855,6 +2079,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     ownerId: string,
     leaseTtlMs: number,
     signal?: AbortSignal
+  ): Promise<ZLinkOwnerLeaseClaimResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.claimOwnerLeaseRequest(ownerId, leaseTtlMs, signal)
+    );
+  }
+
+  private async claimOwnerLeaseRequest(
+    ownerId: string,
+    leaseTtlMs: number,
+    signal?: AbortSignal
   ): Promise<ZLinkOwnerLeaseClaimResult> {
     requireOwnerInput(ownerId, leaseTtlMs);
     for (;;) {
@@ -1906,17 +2140,25 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async readOwnerLease(
     ownerId: string,
     signal?: AbortSignal
+  ): Promise<ZLinkOwnerLeaseReadResult> {
+    return this.observeStore('read', () => this.readOwnerLeaseRequest(ownerId, signal));
+  }
+
+  private async readOwnerLeaseRequest(
+    ownerId: string,
+    signal?: AbortSignal
   ): Promise<ZLinkOwnerLeaseReadResult> {
     const result = await this.provider.read(ownerKey(ownerId), signal);
     if (result.kind === 'missing') return { kind: 'missing' };
+    const leaseExpiresAt = requireOwnerLeaseExpiry(result.value);
     const record = decodeOwnerRecord(result.value.bytes);
-    if (record.ownerId !== ownerId || result.value.expiresAt === undefined) {
+    if (record.ownerId !== ownerId) {
       throw new Error('Location Store owner lease record is invalid.');
     }
     return {
       kind: 'found',
       token: { ownerId, leaseGeneration: BigInt(record.leaseGeneration) },
-      leaseExpiresAt: result.value.expiresAt,
+      leaseExpiresAt,
       storeNow: result.value.storeNow
     };
   }
@@ -1925,6 +2167,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     token: ZLinkLocationOwnerToken,
     leaseTtlMs: number,
     signal?: AbortSignal
+  ): Promise<ZLinkOwnerLeaseRenewResult> {
+    return this.observeStore('lease_renew', () =>
+      this.renewOwnerLeaseRequest(token, leaseTtlMs, signal)
+    );
+  }
+
+  private async renewOwnerLeaseRequest(
+    token: ZLinkLocationOwnerToken,
+    leaseTtlMs: number,
+    signal?: AbortSignal
   ): Promise<ZLinkOwnerLeaseRenewResult> {
     requireOwnerInput(token.ownerId, leaseTtlMs);
     const key = ownerKey(token.ownerId);
@@ -1957,6 +2209,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async releaseOwnerLease(
     token: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<ZLinkOwnerLeaseReleaseResult> {
+    return this.observeStore('release', () => this.releaseOwnerLeaseRequest(token, signal));
+  }
+
+  private async releaseOwnerLeaseRequest(
+    token: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<ZLinkOwnerLeaseReleaseResult> {
     const key = ownerKey(token.ownerId);
     const current = await this.provider.read(key, signal);
@@ -1978,6 +2237,19 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     intent: ZLinkLocationWriteIntent,
     signal?: AbortSignal
   ): Promise<ZLinkLocationWriteResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.updateMeshNodeRequest(descriptor, intent, signal)
+    );
+  }
+
+  private async updateMeshNodeRequest(
+    descriptor: ZLinkMeshNodeDescriptor,
+    intent: ZLinkLocationWriteIntent,
+    signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteResult> {
+    const capacityRowKey = capacityKey(descriptor.meshName, String(descriptor.rid));
+    if (!this.confirmedCapacities.has(capacityRowKey.value))
+      this.confirmedCapacities.set(capacityRowKey.value, undefined);
     return this.updateDescriptor(
       meshKey(descriptor.meshName, descriptor.rid),
       descriptor,
@@ -1993,6 +2265,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     key: ZLinkMeshNodeDescriptorKey,
     owner: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteStatus> {
+    return this.observeStore('release', () => this.removeMeshNodeRequest(key, owner, signal));
+  }
+
+  private async removeMeshNodeRequest(
+    key: ZLinkMeshNodeDescriptorKey,
+    owner: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteStatus> {
     const rowKey = meshKey(key.meshName, key.rid);
     const current = await this.provider.read(rowKey, signal);
@@ -2013,6 +2293,8 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
       },
       signal
     );
+    if (result.kind === 'applied')
+      this.confirmedCapacities.delete(capacityKey(key.meshName, String(key.rid)).value);
     return result.kind === 'applied' ? WriteStatus.Stored : WriteStatus.IgnoredStale;
   }
 
@@ -2020,6 +2302,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     meshName: string,
     page: ZLinkPageRequest = {},
     signal?: AbortSignal
+  ): Promise<ZLinkLocationPage<ZLinkMeshNodeDescriptor>> {
+    return this.observeStore('read', () => this.listMeshNodesRequest(meshName, page, signal));
+  }
+
+  private async listMeshNodesRequest(
+    meshName: string,
+    page: ZLinkPageRequest = {},
+    signal?: AbortSignal
   ): Promise<ZLinkLocationPage<ZLinkMeshNodeDescriptor>> {
     const result = await this.provider.scan(
       {
@@ -2050,30 +2340,7 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
             : decodeJson<CapacityRecord>(capacityRead.value.bytes);
         return {
           ...descriptor,
-          populationCapacity: {
-            actors: {
-              ...descriptor.populationCapacity.actors,
-              active: capacity.active.actors,
-              reserved: capacity.pending.actors
-            },
-            spots: {
-              ...descriptor.populationCapacity.spots,
-              active: capacity.active.spots,
-              reserved: capacity.pending.spots
-            },
-            spotTypes: descriptor.populationCapacity.spotTypes.map((value) => {
-              const key = capacityTypeKey({
-                objectKind: value.objectKind,
-                stableType: value.stableType,
-                count: 0
-              });
-              return {
-                ...value,
-                active: capacity.active.spotTypes[key] ?? 0,
-                reserved: capacity.pending.spotTypes[key] ?? 0
-              };
-            })
-          }
+          populationCapacity: projectCapacity(descriptor.populationCapacity, capacity)
         };
       })
     );
@@ -2087,6 +2354,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     descriptor: ZLinkClientServerServerDescriptor,
     intent: ZLinkLocationWriteIntent,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.updateClientServerRequest(descriptor, intent, signal)
+    );
+  }
+
+  private async updateClientServerRequest(
+    descriptor: ZLinkClientServerServerDescriptor,
+    intent: ZLinkLocationWriteIntent,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteResult> {
     validateClientServerDescriptor(descriptor);
     const normalized = reviveClientServerDescriptor(descriptor);
@@ -2105,6 +2382,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     key: ZLinkClientServerServerDescriptorKey,
     owner: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteStatus> {
+    return this.observeStore('release', () => this.removeClientServerRequest(key, owner, signal));
+  }
+
+  private async removeClientServerRequest(
+    key: ZLinkClientServerServerDescriptorKey,
+    owner: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteStatus> {
     return this.removeDescriptor(
       clientServerKey(key.channelName, key.serverRid),
@@ -2118,6 +2403,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     channelName: string,
     page: ZLinkPageRequest = {},
     signal?: AbortSignal
+  ): Promise<ZLinkLocationPage<ZLinkClientServerServerDescriptor>> {
+    return this.observeStore('read', () =>
+      this.listClientServersRequest(channelName, page, signal)
+    );
+  }
+
+  private async listClientServersRequest(
+    channelName: string,
+    page: ZLinkPageRequest = {},
+    signal?: AbortSignal
   ): Promise<ZLinkLocationPage<ZLinkClientServerServerDescriptor>> {
     return this.listDescriptors(
       clientServerPrefix(channelName),
@@ -2131,6 +2426,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     descriptor: ZLinkFanoutPublisherDescriptor,
     intent: ZLinkLocationWriteIntent,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.updateFanoutPublisherRequest(descriptor, intent, signal)
+    );
+  }
+
+  private async updateFanoutPublisherRequest(
+    descriptor: ZLinkFanoutPublisherDescriptor,
+    intent: ZLinkLocationWriteIntent,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteResult> {
     validateFanoutPublisherDescriptor(descriptor);
     const normalized = reviveFanoutDescriptor(descriptor);
@@ -2149,6 +2454,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     key: ZLinkFanoutPublisherDescriptorKey,
     owner: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteStatus> {
+    return this.observeStore('release', () =>
+      this.removeFanoutPublisherRequest(key, owner, signal)
+    );
+  }
+
+  private async removeFanoutPublisherRequest(
+    key: ZLinkFanoutPublisherDescriptorKey,
+    owner: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteStatus> {
     return this.removeDescriptor(
       fanoutKey(key.channelName, key.publisherRid),
@@ -2162,6 +2477,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     channelName: string,
     page: ZLinkPageRequest = {},
     signal?: AbortSignal
+  ): Promise<ZLinkLocationPage<ZLinkFanoutPublisherDescriptor>> {
+    return this.observeStore('read', () =>
+      this.listFanoutPublishersRequest(channelName, page, signal)
+    );
+  }
+
+  private async listFanoutPublishersRequest(
+    channelName: string,
+    page: ZLinkPageRequest = {},
+    signal?: AbortSignal
   ): Promise<ZLinkLocationPage<ZLinkFanoutPublisherDescriptor>> {
     return this.listDescriptors(fanoutPrefix(channelName), page, reviveFanoutDescriptor, signal);
   }
@@ -2170,6 +2495,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     location: ZLinkSpotLocation,
     intent: ZLinkLocationWriteIntent,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.updateSpotRequest(location, intent, signal)
+    );
+  }
+
+  private async updateSpotRequest(
+    location: ZLinkSpotLocation,
+    intent: ZLinkLocationWriteIntent,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteResult> {
     return this.updateOwnedLocation(
       spotKey(location.meshName, String(location.spotId)),
@@ -2183,6 +2518,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     key: ZLinkSpotLocationKey,
     owner: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteStatus> {
+    return this.observeStore('release', () => this.removeSpotRequest(key, owner, signal));
+  }
+
+  private async removeSpotRequest(
+    key: ZLinkSpotLocationKey,
+    owner: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteStatus> {
     return this.removeOwnedLocation(spotKey(key.meshName, String(key.spotId)), owner, signal);
   }
@@ -2190,6 +2533,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async resolveSpot(
     key: ZLinkSpotLocationKey,
     signal?: AbortSignal
+  ): Promise<ZLinkSpotLocation | undefined> {
+    return this.observeStore('read', () => this.resolveSpotRequest(key, signal));
+  }
+
+  private async resolveSpotRequest(
+    key: ZLinkSpotLocationKey,
+    signal?: AbortSignal
   ): Promise<ZLinkSpotLocation | undefined> {
     const value = await this.readOwnedLocation<ZLinkSpotLocation>(
       spotKey(key.meshName, String(key.spotId)),
@@ -2202,6 +2552,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     filter: ZLinkSpotLocationFilter,
     page: ZLinkPageRequest = {},
     signal?: AbortSignal
+  ): Promise<ZLinkLocationPage<ZLinkSpotLocation>> {
+    return this.observeStore('read', () => this.listSpotsRequest(filter, page, signal));
+  }
+
+  private async listSpotsRequest(
+    filter: ZLinkSpotLocationFilter,
+    page: ZLinkPageRequest = {},
+    signal?: AbortSignal
   ): Promise<ZLinkLocationPage<ZLinkSpotLocation>> {
     return this.listOwnedLocations(
       `${PREFIX}spot:`,
@@ -2216,6 +2574,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     location: ZLinkActorLocation,
     intent: ZLinkLocationWriteIntent,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.updateActorRequest(location, intent, signal)
+    );
+  }
+
+  private async updateActorRequest(
+    location: ZLinkActorLocation,
+    intent: ZLinkLocationWriteIntent,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteResult> {
     return this.updateOwnedLocation(
       actorKey(location.meshName, location.actorId),
@@ -2230,6 +2598,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     key: ZLinkActorLocationKey,
     owner: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteStatus> {
+    return this.observeStore('release', () => this.removeActorRequest(key, owner, signal));
+  }
+
+  private async removeActorRequest(
+    key: ZLinkActorLocationKey,
+    owner: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteStatus> {
     return this.removeOwnedLocation(actorKey(key.meshName, key.actorId), owner, signal);
   }
@@ -2237,6 +2613,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async resolveActor(
     key: ZLinkActorLocationKey,
     signal?: AbortSignal
+  ): Promise<ZLinkActorLocation | undefined> {
+    return this.observeStore('read', () => this.resolveActorRequest(key, signal));
+  }
+
+  private async resolveActorRequest(
+    key: ZLinkActorLocationKey,
+    signal?: AbortSignal
   ): Promise<ZLinkActorLocation | undefined> {
     const value = await this.readOwnedLocation<ZLinkActorLocation>(
       actorKey(key.meshName, key.actorId),
@@ -2249,6 +2632,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     filter: ZLinkActorLocationFilter,
     page: ZLinkPageRequest = {},
     signal?: AbortSignal
+  ): Promise<ZLinkLocationPage<ZLinkActorLocation>> {
+    return this.observeStore('read', () => this.listActorsRequest(filter, page, signal));
+  }
+
+  private async listActorsRequest(
+    filter: ZLinkActorLocationFilter,
+    page: ZLinkPageRequest = {},
+    signal?: AbortSignal
   ): Promise<ZLinkLocationPage<ZLinkActorLocation>> {
     return this.listOwnedLocations(
       `${PREFIX}actor:`,
@@ -2263,6 +2654,16 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     location: ZLinkRouteLocation,
     intent: ZLinkLocationWriteIntent,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteResult> {
+    return this.observeStore('compare_exchange', () =>
+      this.updateRouteRequest(location, intent, signal)
+    );
+  }
+
+  private async updateRouteRequest(
+    location: ZLinkRouteLocation,
+    intent: ZLinkLocationWriteIntent,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteResult> {
     const rowKey = routeKey(String(location.routeKind), location.routeKey);
     const normalized = normalizeRoute(location);
@@ -2324,6 +2725,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     key: ZLinkRouteLocationKey,
     owner: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<ZLinkLocationWriteResult> {
+    return this.observeStore('release', () => this.removeRouteRequest(key, owner, signal));
+  }
+
+  private async removeRouteRequest(
+    key: ZLinkRouteLocationKey,
+    owner: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<ZLinkLocationWriteResult> {
     const rowKey = routeKey(String(key.routeKind), key.routeKey);
     const current = await this.provider.read(rowKey, signal);
@@ -2358,6 +2767,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async resolveRoute(
     key: ZLinkRouteLocationKey,
     signal?: AbortSignal
+  ): Promise<ZLinkRouteLocation | undefined> {
+    return this.observeStore('read', () => this.resolveRouteRequest(key, signal));
+  }
+
+  private async resolveRouteRequest(
+    key: ZLinkRouteLocationKey,
+    signal?: AbortSignal
   ): Promise<ZLinkRouteLocation | undefined> {
     const value = await this.readOwnedLocation<ZLinkRouteLocation>(
       routeKey(String(key.routeKind), key.routeKey),
@@ -2370,6 +2786,14 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
     filter: ZLinkRouteLocationFilter,
     page: ZLinkPageRequest = {},
     signal?: AbortSignal
+  ): Promise<ZLinkLocationPage<ZLinkRouteLocation>> {
+    return this.observeStore('read', () => this.listRoutesRequest(filter, page, signal));
+  }
+
+  private async listRoutesRequest(
+    filter: ZLinkRouteLocationFilter,
+    page: ZLinkPageRequest = {},
+    signal?: AbortSignal
   ): Promise<ZLinkLocationPage<ZLinkRouteLocation>> {
     return this.listOwnedLocations(
       `${PREFIX}route:`,
@@ -2383,6 +2807,13 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
   override async removeAllByOwner(
     owner: ZLinkLocationOwnerToken,
     signal?: AbortSignal
+  ): Promise<bigint> {
+    return this.observeStore('release', () => this.removeAllByOwnerRequest(owner, signal));
+  }
+
+  private async removeAllByOwnerRequest(
+    owner: ZLinkLocationOwnerToken,
+    signal?: AbortSignal
   ): Promise<bigint> {
     const leaseKey = ownerKey(owner.ownerId);
     const lease = await this.provider.read(leaseKey, signal);
@@ -2484,7 +2915,7 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
       const encodedAuthority = authorityContractValueFromPreimage(candidate.key.value);
       const identity = decodeAuthorityKey({ value: encodedAuthority } as ZLinkAuthorityKey);
       if (record.snapshot.allocation.state === 'active') {
-        const result = await this.compareExchangeAuthority(
+        const result = await this.compareExchangeAuthorityRequest(
           { value: encodedAuthority } as ZLinkAuthorityKey,
           current.value.version as unknown as ZLinkAuthorityStoreVersion,
           { kind: 'delete' },
@@ -2495,7 +2926,7 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
       }
       const reservationId = record.snapshot.pendingCreation?.reservationId;
       if (reservationId === undefined) continue;
-      const aborted = await this.abort(
+      const aborted = await this.abortRequest(
         {
           key: identity,
           reservationId,
@@ -2682,13 +3113,27 @@ export class ZLinkLocationStoreRepository extends ZLinkInMemoryLocationStore {
         currentRow.kind === 'found'
           ? { kind: 'version', key: rowKey, expected: currentRow.value.version }
           : { kind: 'missing', key: rowKey };
-      const result = await this.provider.write(
-        {
-          conditions: [leaseValueCondition(leaseKey, { ownerId, leaseGeneration }), rowCondition],
-          mutations: [{ kind: 'put', key: rowKey, bytes: encodedDescriptor }]
-        },
-        signal
-      );
+      let result: Awaited<ReturnType<ZLinkLocationStore['write']>>;
+      try {
+        result = await this.provider.write(
+          {
+            conditions: [leaseValueCondition(leaseKey, { ownerId, leaseGeneration }), rowCondition],
+            mutations: [{ kind: 'put', key: rowKey, bytes: encodedDescriptor }]
+          },
+          signal
+        );
+      } catch (failure) {
+        // Location runtime §10: the Store may have applied a write whose result
+        // was lost. Re-read the same key; the same bytes confirm the write.
+        const confirmed = await this.provider.read(rowKey, signal).catch(() => undefined);
+        if (
+          confirmed?.kind === 'found' &&
+          Buffer.from(confirmed.value.bytes).equals(Buffer.from(encodedDescriptor))
+        ) {
+          return { status: WriteStatus.Stored, generation, updatedAt: confirmed.value.storeNow };
+        }
+        throw failure;
+      }
       if (result.kind === 'applied') {
         return { status: WriteStatus.Stored, generation, updatedAt: result.storeNow };
       }
@@ -3737,6 +4182,12 @@ function reviveCanonical(value: unknown, key = ''): unknown {
   return value;
 }
 
+function requireOwnerLeaseExpiry(value: ZLinkStoreValue): Date {
+  if (value.expiresAt === undefined)
+    throw new Error('Location Store owner lease record is invalid.');
+  return value.expiresAt;
+}
+
 function decodeOwnerRecord(bytes: Uint8Array): OwnerRecord {
   const record = decodeJson<OwnerRecord>(bytes);
   requireRecordVersion(record, 'owner lease');
@@ -4196,21 +4647,22 @@ function liveTargetDescriptor(
     readonly owner: ZLinkLocationOwnerToken;
   }
 ): ZLinkMeshNodeDescriptor | undefined {
-  if (descriptorRead.kind === 'missing' || leaseRead.kind === 'missing') return undefined;
+  if (leaseRead.kind === 'missing') return undefined;
+  const leaseExpiresAt = requireOwnerLeaseExpiry(leaseRead.value);
+  if (descriptorRead.kind === 'missing') return undefined;
   const descriptor = reviveMeshDescriptor(
     decodeCanonicalDescriptorRecord<ZLinkMeshNodeDescriptor>(descriptorRead.value.bytes).descriptor
   );
   const lease = decodeOwnerRecord(leaseRead.value.bytes);
   return descriptor.meshName === target.meshName &&
-    String(descriptor.rid) === String(target.nodeRid) &&
+    routingIdsEqual(descriptor.rid, toBackendRoutingId(target.nodeRid)) &&
     descriptor.lifecycleGeneration === target.nodeLifecycleGeneration &&
     descriptor.ownerId === target.owner.ownerId &&
     descriptor.leaseGeneration === target.owner.leaseGeneration &&
     descriptor.objectRole === ZLinkObjectRole.Server &&
     lease.ownerId === target.owner.ownerId &&
     BigInt(lease.leaseGeneration) === target.owner.leaseGeneration &&
-    leaseRead.value.expiresAt !== undefined &&
-    leaseRead.value.expiresAt.getTime() > leaseRead.value.storeNow.getTime()
+    leaseExpiresAt.getTime() > leaseRead.value.storeNow.getTime()
     ? descriptor
     : undefined;
 }
@@ -4337,7 +4789,7 @@ function sameCreationTarget(
 ): boolean {
   return (
     snapshot.allocation.descriptor.meshName === target.meshName &&
-    String(snapshot.allocation.descriptor.rid) === String(target.nodeRid) &&
+    routingIdsEqual(snapshot.allocation.descriptor.rid, target.nodeRid) &&
     snapshot.allocation.descriptorLifecycleGeneration === target.nodeLifecycleGeneration &&
     snapshot.ownerId === target.owner.ownerId &&
     snapshot.ownerLeaseGeneration === target.owner.leaseGeneration
@@ -4360,10 +4812,7 @@ function matchesLiveOwnerLease(
   ownerId: string,
   leaseGeneration: bigint
 ): boolean {
-  if (
-    lease.value.expiresAt === undefined ||
-    lease.value.expiresAt.getTime() <= lease.value.storeNow.getTime()
-  ) {
+  if (requireOwnerLeaseExpiry(lease.value).getTime() <= lease.value.storeNow.getTime()) {
     return false;
   }
   const owner = decodeOwnerRecord(lease.value.bytes);
@@ -4381,11 +4830,8 @@ function sameDescriptorPredecessor(
 }
 
 function liveOwnerLeaseGeneration(lease: ZLinkStoreReadResult): bigint | undefined {
-  if (
-    lease.kind === 'missing' ||
-    lease.value.expiresAt === undefined ||
-    lease.value.expiresAt.getTime() <= lease.value.storeNow.getTime()
-  ) {
+  if (lease.kind === 'missing') return undefined;
+  if (requireOwnerLeaseExpiry(lease.value).getTime() <= lease.value.storeNow.getTime()) {
     return undefined;
   }
   return BigInt(decodeOwnerRecord(lease.value.bytes).leaseGeneration);
@@ -4415,10 +4861,6 @@ function canTakeOverStoredLocation(
   );
 }
 
-function persistMeshDescriptor(descriptor: ZLinkMeshNodeDescriptor): ZLinkMeshNodeDescriptor {
-  return descriptor;
-}
-
 function reviveMeshDescriptor(descriptor: ZLinkMeshNodeDescriptor): ZLinkMeshNodeDescriptor {
   const value = descriptor as unknown as Record<string, unknown>;
   if ('routingIdHex' in value) {
@@ -4550,7 +4992,7 @@ function matchesSpot(value: ZLinkSpotLocation, filter: ZLinkSpotLocationFilter):
   return (
     (filter.meshName === undefined || value.meshName === filter.meshName) &&
     (filter.spotType === undefined || value.spotType === filter.spotType) &&
-    (filter.nodeRid === undefined || String(value.ownerNodeRid) === String(filter.nodeRid)) &&
+    (filter.nodeRid === undefined || routingIdsEqual(value.ownerNodeRid, filter.nodeRid)) &&
     (filter.spotKind === undefined || value.spotKind === filter.spotKind)
   );
 }
@@ -4558,7 +5000,7 @@ function matchesSpot(value: ZLinkSpotLocation, filter: ZLinkSpotLocationFilter):
 function matchesActor(value: ZLinkActorLocation, filter: ZLinkActorLocationFilter): boolean {
   return (
     (filter.actorType === undefined || value.actorType === filter.actorType) &&
-    (filter.nodeRid === undefined || String(value.ownerNodeRid) === String(filter.nodeRid)) &&
+    (filter.nodeRid === undefined || routingIdsEqual(value.ownerNodeRid, filter.nodeRid)) &&
     (filter.spotId === undefined || String(value.spotId) === String(filter.spotId)) &&
     (filter.locationKind === undefined || value.spotKind === filter.locationKind)
   );
@@ -4568,7 +5010,7 @@ function matchesRoute(value: ZLinkRouteLocation, filter: ZLinkRouteLocationFilte
   return (
     (filter.routeKind === undefined || value.routeKind === filter.routeKind) &&
     (filter.ownerNodeRid === undefined ||
-      String(value.ownerNodeRid) === String(filter.ownerNodeRid)) &&
+      routingIdsEqual(value.ownerNodeRid, filter.ownerNodeRid)) &&
     (filter.ownerId === undefined || value.ownerId === filter.ownerId)
   );
 }
@@ -4589,13 +5031,14 @@ function descriptorOwnerLeaseGeneration(value: OwnedStoreRecord): bigint | undef
   return undefined;
 }
 
+// Location runtime §10: a write whose result was lost is confirmed by reading
+// the same key. The stored row already is this write when it differs only in
+// the time the Store stamped, as for every other descriptor kind.
 function sameMeshDescriptor(
   left: ZLinkMeshNodeDescriptor,
   right: ZLinkMeshNodeDescriptor
 ): boolean {
-  return Buffer.from(encodeJson(persistMeshDescriptor(left))).equals(
-    Buffer.from(encodeJson(persistMeshDescriptor(right)))
-  );
+  return descriptorFingerprint(left, ['updatedAt']) === descriptorFingerprint(right, ['updatedAt']);
 }
 
 function sameClientServerDescriptor(
@@ -4740,7 +5183,10 @@ function requireOwnerInput(ownerId: string, leaseTtlMs: number): void {
 function throwIfOperationExpired(signal?: AbortSignal, deadlineUnixMs?: bigint): void {
   signal?.throwIfAborted();
   if (deadlineUnixMs !== undefined && Date.now() >= Number(deadlineUnixMs)) {
-    throw new DOMException('Operation deadline exceeded.', 'TimeoutError');
+    throw new ZLinkFrameworkException(
+      ZLinkFrameworkErrorKind.DeadlineExceeded,
+      'Operation deadline exceeded.'
+    );
   }
 }
 
@@ -4759,3 +5205,33 @@ function locationStoreProviderFailure(error: unknown, signal?: AbortSignal): unk
     error
   );
 }
+
+function projectCapacity(
+  limits: ZLinkMeshNodeDescriptor['populationCapacity'],
+  capacity: CapacityRecord
+): ZLinkMeshNodeDescriptor['populationCapacity'] {
+  return {
+    actors: {
+      ...limits.actors,
+      active: capacity.active.actors,
+      reserved: capacity.pending.actors
+    },
+    spots: {
+      ...limits.spots,
+      active: capacity.active.spots,
+      reserved: capacity.pending.spots
+    },
+    spotTypes: limits.spotTypes.map((value) => {
+      const key = capacityTypeKey({
+        objectKind: value.objectKind,
+        stableType: value.stableType,
+        count: 0
+      });
+      return {
+        ...value,
+        active: capacity.active.spotTypes[key] ?? 0,
+        reserved: capacity.pending.spotTypes[key] ?? 0
+      };
+    })
+  };
+}