@zlink-systems/framework 0.31.0 → 0.32.0

package/dist/runtime/foundation/raw-service-mesh-runtime.js

@@ -8,6 +8,7 @@ const internal_observation_1 = require("../internal-observation");
 const node_os_1 = require("node:os");
 const application_ingress_record_owner_1 = require("../application-jobs/application-ingress-record-owner");
 const submission_result_1 = require("../messaging/submission-result");
+const payload_slab_1 = require("../../contracts/Common/payload-slab");
 const runtime_values_1 = require("../backend/runtime-values");
 const service_wire_codec_generated_1 = require("../protocol/service_wire_codec.generated");
 const service_wire_binary_primitives_1 = require("./service-wire-binary-primitives");
@@ -774,28 +775,13 @@ class RawServiceMeshRuntime {
     replyGenericProtocolError(received) {
         if (received.requestSeq === undefined || received.parts.length === 0)
             return false;
-        try {
-            const header = (0, service_wire_m6a_codec_1.decodeHeader)(received.parts[0]);
-            const correlation = header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.nodeRequest
-                ? (0, service_wire_m6a_codec_1.decodeNodeRequestHeader)(received.parts[0])
-                : header.command === service_wire_m6a_codec_1.M6aServiceWireCommand.channelRequest
-                    ? (0, service_wire_m6a_codec_1.decodeChannelRequestHeader)(received.parts[0]).correlation
-                    : undefined;
-            if (correlation === undefined)
-                return false;
-            const reply = [
-                (0, service_wire_m6a_codec_1.encodeReplyHeader)(correlation, runtime_values_1.RequestResult.ProtocolError, service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestProtocolError)
-            ];
-            if (received.reply === undefined)
-                return false;
-            received.reply(reply);
-            return true;
-        }
-        catch (error) {
-            if (error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError)
-                return false;
-            throw error;
-        }
+        const correlation = (0, service_wire_constants_generated_1.recoverRequestCorrelation)(received.parts[0]);
+        if (correlation === undefined || received.reply === undefined)
+            return false;
+        received.reply([
+            (0, service_wire_m6a_codec_1.encodeReplyHeader)(correlation, runtime_values_1.RequestResult.ProtocolError, service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestProtocolError)
+        ]);
+        return true;
     }
     processReceived(received, nowMs, applicationJobOwner) {
         const peer = this.topology.admittedPeer(received.sourceRid);
@@ -1081,12 +1067,29 @@ class RawServiceMeshRuntime {
             ];
             this.startControlSend(probe.nodeRoutingId, service_wire_m6a_codec_1.M6aServiceWireCommand.livenessProbe, () => this.submitControl(probe.nodeRoutingId, parts));
         }
+        const failures = [];
         for (const nodeRoutingId of result.timedOutNodes) {
             const peer = this.topology.peer(nodeRoutingId);
             if (peer === undefined)
                 continue;
-            this.removePeer(peer, () => this.requireStarted().disconnectRid(nodeRoutingId));
+            try {
+                this.removePeer(peer, () => {
+                    try {
+                        this.requireStarted().disconnectRid(nodeRoutingId);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                });
+            }
+            catch (error) {
+                failures.push(error);
+            }
         }
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1)
+            throw new AggregateError(failures, 'Liveness peer cleanup failed.');
         return result;
     }
     /**
@@ -1168,7 +1171,7 @@ class RawServiceMeshRuntime {
         const header = channelName === undefined
             ? (0, service_wire_m6a_codec_1.encodeNodeRequestHeader)(correlation)
             : (0, service_wire_m6a_codec_1.encodeChannelRequestHeader)(correlation, channelName);
-        const encodedPayload = this.applicationFrame(payload);
+        let encodedPayload = this.applicationFrame(payload);
         let selectedTargetNodeRoutingId = targetNodeRoutingId;
         if (selectedTargetNodeRoutingId !== this.descriptor.nodeRoutingId &&
             !this.isPeerRouteReady(selectedTargetNodeRoutingId)) {
@@ -1195,6 +1198,7 @@ class RawServiceMeshRuntime {
             }
         }
         if (selectedTargetNodeRoutingId === this.descriptor.nodeRoutingId) {
+            encodedPayload = (0, payload_slab_1.copyPayloadBytes)(encodedPayload);
             // The local admission path aborts its capacity wait on the terminal
             // Promise, so a local request always keeps the Promise entry.
             const pending = requestOperation === undefined
@@ -1317,7 +1321,7 @@ class RawServiceMeshRuntime {
         return Buffer.isBuffer(payload) ? payload : (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload);
     }
     applicationPayload(payload) {
-        return Buffer.isBuffer(payload) ? (0, service_wire_m6a_codec_1.decodeApplicationPayloadView)(payload) : payload;
+        return Buffer.isBuffer(payload) ? (0, service_wire_m6a_codec_1.decodeApplicationPayload)(payload) : payload;
     }
     admitPeer(descriptor, connectionId, nowMs, expected, command = service_wire_m6a_codec_1.M6aServiceWireCommand.hello, descriptorBytes) {
         const previous = this.topology.admittedPeer(descriptor.nodeRoutingId);

package/dist/runtime/foundation/service-liveness-registry.d.ts

@@ -25,7 +25,7 @@ export declare class ServiceLivenessConnection {
 export declare class ServiceLivenessRegistry {
     private readonly probeIntervalMs;
     private readonly peerTimeoutMs;
-    private readonly peers;
+    readonly peers: Map<string, ServiceLivenessConnection>;
     private nextProbeId;
     /**
      * The earliest probe or timeout among admitted peers. Received traffic only

package/dist/runtime/foundation/service-mailbox.d.ts

@@ -6,6 +6,7 @@ export interface ServiceMailboxDispatchOwner {
     prepareDispatch(record: ServiceMailboxRecord, signal: AbortSignal): boolean | Promise<boolean>;
 }
 export interface ServiceMailboxRecord {
+    receivedAt?: Date;
     readonly sourcePreparationOwner?: ServiceMailboxDispatchOwner;
     readonly ingress?: RawServiceIngressRecord;
     readonly owner: string;
@@ -42,6 +43,7 @@ export interface ServiceMailboxRelocationSeal {
 /** Level-triggered queues with one active application claim per owner. */
 export declare class ServiceMailbox {
     private readonly onReady?;
+    private readonly receivedAtClock;
     private readonly application;
     private readonly infrastructure;
     private readonly relocationSeals;
@@ -49,7 +51,7 @@ export declare class ServiceMailbox {
     private nextClaimSerial;
     private nextRelocationSerial;
     private closed;
-    constructor(onReady?: ((domain: ServiceMailboxDomain) => void) | undefined);
+    constructor(onReady?: ((domain: ServiceMailboxDomain) => void) | undefined, receivedAtClock?: () => Date);
     releaseClaimedPayload(record: ServiceMailboxRecord): void;
     tryEnqueue(record: ServiceMailboxRecord): boolean;
     tryClaim(domain: ServiceMailboxDomain, messageBudget: number, byteBudget: number): ServiceMailboxClaim | undefined;

package/dist/runtime/foundation/service-mailbox.js

@@ -4,6 +4,7 @@ exports.ServiceMailbox = void 0;
 /** Level-triggered queues with one active application claim per owner. */
 class ServiceMailbox {
     onReady;
+    receivedAtClock;
     application;
     infrastructure;
     relocationSeals = new Map();
@@ -11,8 +12,9 @@ class ServiceMailbox {
     nextClaimSerial = 1n;
     nextRelocationSerial = 1n;
     closed = false;
-    constructor(onReady) {
+    constructor(onReady, receivedAtClock = () => new Date()) {
         this.onReady = onReady;
+        this.receivedAtClock = receivedAtClock;
         // Host ApplicationJobQueue permits own ordinary-record admission. The
         // Framework-owned payload lifetime does not retain Core HWM credit. A
         // second mailbox cap would reject already-admitted work before the shared
@@ -32,6 +34,7 @@ class ServiceMailbox {
         const bytes = retainedBytes(record);
         if (this.closed)
             return false;
+        record.receivedAt ??= this.receivedAtClock();
         if (record.domain === 'application') {
             if (this.relocatedOwners.has(record.owner))
                 return false;

package/dist/runtime/foundation/service-runtime-contracts.d.ts

@@ -214,6 +214,7 @@ export interface ZLinkMessageFollowOrigin {
     readonly target?: import('./service-stateful-wire-codec').ServiceActorRouteFence;
 }
 export interface ReceiveRecord {
+    readonly receivedAt?: Date;
     /** Resolve record prerequisites in owner order, outside an application handler turn. */
     readonly prepareDispatch?: (this: ReceiveRecord, signal: AbortSignal) => boolean | Promise<boolean>;
     readonly statefulMailboxRecord?: import('./service-mailbox').ServiceMailboxRecord;
@@ -234,6 +235,7 @@ export interface ReceiveRecord {
     readonly kindData: ReceiveKindData | null;
     readonly terminalResult: number;
     readonly failureErrno: number;
+    readonly failureMessage?: string;
     readonly parts: Message[];
     /** Returns whether the local operation can still accept a lifecycle reply. */
     readonly isPending?: () => boolean;
@@ -251,7 +253,7 @@ export interface ReceiveRecord {
     reply(parts: MessageLike | readonly MessageLike[], flags?: number): SubmitResult;
     replyActorJoin(joinResult: number, parts: MessageLike | readonly MessageLike[], flags?: number, replyContentType?: string): SubmitResult;
     /** Emits a typed command-20 terminal for a lifecycle request before admission. */
-    replyFailure?(terminalResult: number, failureCode: number): SubmitResult;
+    replyFailure?(terminalResult: number, failureCode: number, tail?: import('./service-stateful-wire-codec').ServiceStatefulReplyTail): SubmitResult;
 }
 export interface ClaimReceiveResult {
     readonly ok: boolean;

package/dist/runtime/foundation/service-stateful-registry.d.ts

@@ -119,6 +119,8 @@ export declare class ServiceStatefulRegistry {
     installSessionBinding(binding: ServiceSessionBinding): ServiceSessionBinding;
     binding(actor: ServiceActorRef): ServiceSessionBinding | undefined;
     private bindingCore;
+    /** The Actor owner admits each relayed Session sequence once per binding. */
+    acceptBoundSessionSequence(actor: ServiceActorRef, expectedBindingGeneration: bigint, sequence: bigint): boolean;
     unbindSession(actor: ServiceActorRef, expectedBindingGeneration: bigint, expectedSessionRid?: string, expectedSessionOwnerNodeRid?: string): boolean;
     validateBoundSession(actor: ServiceActorRef, expectedBindingGeneration: bigint): ServiceSessionBinding;
     reserve(objectKind: ServiceObjectReservation['objectKind'], key: string, stableType: string, attempt: bigint): ServiceReservationResult;

package/dist/runtime/foundation/service-stateful-registry.js

@@ -246,7 +246,7 @@ class ServiceStatefulRegistry {
         });
         requireText(binding.sessionOwnerNodeRid, 'sessionOwnerNodeRid');
         requirePositive(binding.bindingGeneration, 'bindingGeneration');
-        const current = this.bindings.get(actorKey(binding.actor));
+        const current = this.bindings.get(actorKey(binding.actor))?.binding;
         if (current !== undefined &&
             current.sessionOwnerNodeRid === binding.sessionOwnerNodeRid &&
             current.sessionOwnerNodeGeneration === binding.sessionOwnerNodeGeneration &&
@@ -257,21 +257,34 @@ class ServiceStatefulRegistry {
             throw new ServiceStaleGenerationError('binding', binding.actor.actorId);
         }
         const accepted = Object.freeze({ ...binding });
-        this.bindings.set(actorKey(binding.actor), accepted);
+        this.bindings.set(actorKey(binding.actor), { binding: accepted, lastAcceptedSequence: 0n });
         return accepted;
     }
     binding(actor) {
         return this.bindingCore(actor);
     }
     bindingCore(actor) {
-        const binding = this.bindings.get(actorKey(actor));
+        const binding = this.bindings.get(actorKey(actor))?.binding;
         return binding?.actor.generation === actor.generation ? binding : undefined;
     }
+    /** The Actor owner admits each relayed Session sequence once per binding. */
+    acceptBoundSessionSequence(actor, expectedBindingGeneration, sequence) {
+        const entry = this.bindings.get(actorKey(actor));
+        if (entry === undefined ||
+            entry.binding.actor.generation !== actor.generation ||
+            entry.binding.bindingGeneration !== expectedBindingGeneration ||
+            sequence <= entry.lastAcceptedSequence) {
+            return false;
+        }
+        entry.lastAcceptedSequence = sequence;
+        return true;
+    }
     unbindSession(actor, expectedBindingGeneration, expectedSessionRid, expectedSessionOwnerNodeRid) {
         const key = actorKey(actor);
-        const binding = this.bindings.get(key);
-        if (binding === undefined)
+        const entry = this.bindings.get(key);
+        if (entry === undefined)
             return false;
+        const binding = entry.binding;
         if (binding.bindingGeneration !== expectedBindingGeneration ||
             (expectedSessionRid !== undefined &&
                 !(0, routing_id_1.routingIdsEqual)(binding.sessionRid, expectedSessionRid)) ||
@@ -387,14 +400,17 @@ class ServiceStatefulRegistry {
     }
     updateBindingMembership(actor) {
         const key = actorKey(actor.ref);
-        const binding = this.bindings.get(key);
-        if (binding === undefined)
+        const entry = this.bindings.get(key);
+        if (entry === undefined)
             return;
-        this.bindings.set(key, Object.freeze({
-            ...binding,
-            actor: actor.ref,
-            membershipEpoch: actor.membershipEpoch
-        }));
+        this.bindings.set(key, {
+            binding: Object.freeze({
+                ...entry.binding,
+                actor: actor.ref,
+                membershipEpoch: actor.membershipEpoch
+            }),
+            lastAcceptedSequence: entry.lastAcceptedSequence
+        });
     }
 }
 exports.ServiceStatefulRegistry = ServiceStatefulRegistry;

package/dist/runtime/foundation/service-stateful-runtime.d.ts

@@ -3,12 +3,13 @@ import type { RequestRuntime } from './request-runtime';
 import { inspectRuntime } from '../internal-observation';
 import type { ZLinkAuthoritySnapshot } from '../locations/internal-location-contracts';
 import type { ZLinkDispatchErrorReporter } from '../channels/dispatch-error-reporter';
-import type { RawServiceMeshRuntime } from './raw-service-mesh-runtime';
+import { type ActorJoin28 } from '../protocol/service_wire_pilot_codec.generated';
+import type { RawServiceIngressRecord, RawServiceMeshRuntime, RawServicePumpResult } from './raw-service-mesh-runtime';
 import type { ServiceInstanceActivationRecoveryEnvelope } from './service-instance-activation-recovery-codec';
 import type { ServiceMailboxRecord } from './service-mailbox';
 import { type ReceiveKindData, type ServiceStreamSessionBinding, type StreamSessionActorAuthorityFence } from './service-runtime-contracts';
-import { ServiceStatefulRegistry, type ServiceActorRef, type ServiceActorState, type ServiceSessionBinding, type ServiceSpotRef, type ServiceSpotState } from './service-stateful-registry';
-import { type ServiceActorCreateRecord, type ServiceActorRouteFence, type ServiceDirectSpotRouteFence, type ServiceInstanceActivationTarget, type ServiceInstanceColdActivationTarget, type ServiceInstanceRouteFence, type ServiceRetiredBoundSessionRouteFence, type ServiceStatefulReplyTail, type ServiceStatefulWireRecord, type ServiceUserSpotCloseRecord, type ServiceUserSpotCreateRecord } from './service-stateful-wire-codec';
+import { ServiceStatefulRegistry, ServiceTerminalOperationRegistry, type ServiceActorRef, type ServiceActorState, type ServiceSessionBinding, type ServiceSpotRef, type ServiceSpotState } from './service-stateful-registry';
+import { type ServiceActorCreateRecord, type ServiceActorRouteFence, type ServiceDirectSpotRouteFence, type ServiceInstanceActivationTarget, type ServiceInstanceColdActivationTarget, type ServiceInstanceRouteFence, type ServiceRetiredBoundSessionRouteFence, type ServiceSpotRouteFence, type ServiceStatefulReplyTail, type ServiceStatefulWireRecord, type ServiceUserSpotCloseRecord, type ServiceUserSpotCreateRecord } from './service-stateful-wire-codec';
 import { type ServiceApplicationPayload } from './service-wire-m6a-codec';
 export interface ServiceSpotMessageFollowSeal {
     readonly key: string;
@@ -17,6 +18,7 @@ export interface ServiceSpotMessageFollowSeal {
 export interface ServiceStatefulResult {
     readonly terminalResult: number;
     readonly failureCode: number;
+    readonly failureMessage?: string;
     readonly payload?: ServiceApplicationPayload;
     readonly kindData?: ReceiveKindData;
     readonly applicationMetadata?: Buffer;
@@ -248,7 +250,7 @@ export declare class ServiceStatefulRuntime {
     }>;
     private static readonly detachedIngressScope;
     readonly registry: ServiceStatefulRegistry;
-    private readonly operations;
+    readonly operations: ServiceTerminalOperationRegistry<ServiceStatefulResult, bigint>;
     private readonly sessionDeliveries;
     /**
      * A local Actor owner can replace its own session binding before the
@@ -284,7 +286,12 @@ export declare class ServiceStatefulRuntime {
     private dispatchErrors?;
     private sessionOwnerDescriptors?;
     private dispatchErrorMeshName?;
-    private readonly admittedUserSpotOperations;
+    readonly admittedUserSpotOperations: Map<string, {
+        readonly request: string;
+        readonly replayExpiresAtMs: number;
+        readonly result: Promise<ServiceUserSpotOperationResult>;
+        settled: boolean;
+    }>;
     private readonly pendingInstanceActivations;
     private closed;
     constructor(raw: RawServiceMeshRuntime, nodeRid: string, nodeGeneration: bigint, onPendingOperationsChanged?: () => void, requests?: RequestRuntime | undefined);
@@ -397,31 +404,56 @@ export declare class ServiceStatefulRuntime {
     close(): void;
     cancelPendingOperations(reason: unknown): void;
     private ingress;
-    private handleIngress;
+    handleIngress(ingress: RawServiceIngressRecord, record: ServiceStatefulWireRecord, payloadFrame: Buffer | undefined, metadataFrame?: Buffer, canonicalActorJoin?: ActorJoin28, canonicalActorJoinPayload?: ServiceApplicationPayload): Promise<RawServicePumpResult>;
     private enqueueInstanceSpot;
     private needsInstanceApplicationMaterialization;
-    private enqueueActivatedInstanceSpot;
-    private continueMissingInstanceActivation;
+    enqueueActivatedInstanceSpot(ingress: RawServiceIngressRecord, record: Extract<ServiceStatefulWireRecord, {
+        readonly kind: 'instanceSpot';
+    }>, payloadFrame: Buffer, spot: Pick<ServiceSpotState, 'ref'>, localReply?: NonNullable<ServiceStatefulMailboxData['reply']>, onTerminalCompletion?: NonNullable<ServiceStatefulMailboxData['onTerminalCompletion']>, metadataFrame?: Buffer, onHandlerTurnStarted?: () => void, applicationTargetOverride?: ServiceInstanceApplicationTarget): RawServicePumpResult;
+    continueMissingInstanceActivation(ingress: RawServiceIngressRecord, record: Extract<ServiceStatefulWireRecord, {
+        readonly kind: 'instanceSpot';
+        readonly activation: 'missing';
+    }>, payloadFrame: Buffer, localReply?: NonNullable<ServiceStatefulMailboxData['reply']>, metadataFrame?: Buffer): Promise<void>;
     private continueReadyInstanceMaterialization;
     /**
      * Spot messaging §4 step 12 with §7 step 1: a Close waits for the first terminal
      * record only of a message whose handler turn started before it; a message queued
      * behind that Close is not counted, so it cannot hold the Close it follows.
      */
-    private activationTerminalCompletion;
-    private instanceApplicationTerminalCompletion;
+    activationTerminalCompletion(target: ServiceInstanceActivationTarget, route: ServiceInstanceRouteFence): {
+        readonly onTerminalCompletion: () => Promise<void>;
+        readonly onHandlerTurnStarted: () => void;
+    };
+    instanceApplicationTerminalCompletion(target: ServiceInstanceApplicationTarget): (() => Promise<void>) | undefined;
     private instanceApplicationTarget;
     private beginInstanceAuthorityOperation;
     private completeInstanceAuthorityOperation;
     private completeInstanceApplicationWaitersIfQuiescent;
-    private finishMissingInstanceActivationFailure;
+    finishMissingInstanceActivationFailure(ingress: RawServiceIngressRecord, record: Extract<ServiceStatefulWireRecord, {
+        readonly kind: 'instanceSpot';
+        readonly activation: 'missing';
+    }>, error: unknown, localReply?: NonNullable<ServiceStatefulMailboxData['reply']>, payloadFrame?: Buffer): void;
     private requireInstanceActivation;
     private requireReadyInstanceApplicationRoute;
-    private validateInstanceIngress;
+    validateInstanceIngress(ingress: RawServiceIngressRecord, record: Extract<ServiceStatefulWireRecord, {
+        readonly kind: 'instanceSpot';
+    }>): void;
     private activateMissingInstance;
     private localReadyInstance;
-    private activateMissingInstanceAsync;
-    private runMissingInstanceActivation;
+    activateMissingInstanceAsync(record: Extract<ServiceStatefulWireRecord, {
+        readonly kind: 'instanceSpot';
+        readonly activation: 'missing';
+    }>, payloadFrame: Buffer, metadataFrame: Buffer | undefined, admit: (activation: {
+        readonly spot: Pick<ServiceSpotState, 'ref'>;
+        readonly route: ServiceInstanceRouteFence;
+    }) => void): Promise<unknown>;
+    runMissingInstanceActivation(record: Extract<ServiceStatefulWireRecord, {
+        readonly kind: 'instanceSpot';
+        readonly activation: 'missing';
+    }>, payloadFrame: Buffer, metadataFrame?: Buffer): Promise<{
+        readonly spot: Pick<ServiceSpotState, 'ref'>;
+        readonly route: ServiceInstanceRouteFence;
+    }>;
     private runMissingInstanceActivationCore;
     private acceptsLocalMissingInstancePlacement;
     private reconcileReadyInstanceProjection;
@@ -447,7 +479,7 @@ export declare class ServiceStatefulRuntime {
     private traceRejectedBoundSessionSend;
     private prepareRequestSource;
     prepareDispatch(record: ServiceMailboxRecord, signal: AbortSignal): boolean | Promise<boolean>;
-    private enqueueApplicationFrame;
+    enqueueApplicationFrame(ingress: RawServiceIngressRecord, owner: string, payloadFrame: Buffer, stateful: ServiceStatefulMailboxData): RawServicePumpResult;
     private enqueueLifecycleFrame;
     private enqueueFrame;
     private enqueueLogicalMulticast;
@@ -465,13 +497,13 @@ export declare class ServiceStatefulRuntime {
     private submitOneWay;
     private submitRequest;
     private submitActorJoin;
-    private submitLocalRequest;
+    submitLocalRequest(ingress: RawServiceIngressRecord, pending: ServiceStatefulPendingOperation, operationKind: 'spotRequest' | 'actorRequest' | 'actorLookup' | 'actorDestroy' | 'actorJoin' | 'streamBind' | 'streamUnbind' | 'instanceSpotRequest', actor?: ServiceActorRef, deadlineUnixMs?: bigint, receiver?: import('./operation-registry').OperationObserver<unknown, unknown>): Promise<void>;
     private completeRemoteReply;
     private resultFromReply;
-    private validateActorFence;
-    private validateActorMessageFence;
+    validateActorFence(fence: ServiceActorRouteFence): ServiceActorState;
+    validateActorMessageFence(fence: ServiceActorRouteFence): ServiceActorState;
     private validateSpotFence;
-    private validateDirectSpotFence;
+    validateDirectSpotFence(fence: ServiceSpotRouteFence): ServiceSpotState;
     private holdOrRelaySpotMessage;
     private restoreSpotMessageFollowRecord;
     private drainSpotMessageFollow;

package/dist/runtime/foundation/service-stateful-runtime.js

@@ -33,6 +33,7 @@ const service_stateful_registry_1 = require("./service-stateful-registry");
 const service_stateful_wire_codec_1 = require("./service-stateful-wire-codec");
 const service_wire_binary_primitives_1 = require("./service-wire-binary-primitives");
 const service_wire_constants_generated_1 = require("./service-wire-constants.generated");
+const payload_slab_1 = require("../../contracts/Common/payload-slab");
 const service_wire_m6a_codec_1 = require("./service-wire-m6a-codec");
 const MAX_NODE_TIMER_DELAY_MS = 2_147_483_647;
 const SPOT_MOVING = 34;
@@ -1339,7 +1340,7 @@ class ServiceStatefulRuntime {
                 ? record.parts.length >= 2
                     ? record.parts[record.parts.length - 1]
                     : undefined
-                : (0, service_wire_m6a_codec_1.encodeApplicationPayload)(canonicalPayload);
+                : (0, service_wire_m6a_codec_1.encodeOwnedApplicationPayload)(canonicalPayload);
             try {
                 return await this.handleIngress(record, decoded, payloadFrame, metadataFrame, canonicalActorJoin, canonicalPayload);
             }
@@ -1455,6 +1456,48 @@ class ServiceStatefulRuntime {
                         binding.sessionOwnerNodeRid !== ingress.sourceRoutingId) {
                         throw new service_stateful_registry_1.ServiceStaleGenerationError('binding', record.target.actor.actorId);
                     }
+                    if (!this.registry.acceptBoundSessionSequence(record.target.actor, record.boundSession.bindingGeneration, record.boundSession.sequence)) {
+                        const error = new contracts_1.ZLinkFrameworkException(contracts_1.ZLinkFrameworkErrorKind.InvalidOperation, 'Bound Session relay sequence does not increase.');
+                        const reporter = this.dispatchErrors;
+                        if (record.kind === 'actorRequest') {
+                            if (reporter?.captureEnabled() === true) {
+                                reporter.report({
+                                    surface: ZLinkDispatchOptions_1.ZLinkDispatchErrorSurface.StreamSession,
+                                    messageKind: ZLinkDispatchOptions_1.ZLinkDispatchMessageKind.Request,
+                                    reason: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.StaleTarget,
+                                    action: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorAction.ReplyError,
+                                    meshName: this.dispatchErrorMeshName,
+                                    sourceRid: ingress.sourceRoutingId,
+                                    actorId: record.target.actor.actorId,
+                                    correlationId: record.correlation?.toString(),
+                                    error
+                                });
+                            }
+                            const result = failure(error);
+                            this.replyWire(ingress, record.correlation, result.terminalResult, result.failureCode);
+                            return 'infrastructure';
+                        }
+                        const tracePoint = (0, message_flow_1.flowIfEnabled)(reporter?.flow, ZLinkDispatchOptions_1.ZLinkRuntimeMessageFlowOutcome.Dropped);
+                        if (tracePoint !== undefined) {
+                            tracePoint.trace({
+                                outcome: ZLinkDispatchOptions_1.ZLinkRuntimeMessageFlowOutcome.Dropped,
+                                surface: ZLinkDispatchOptions_1.ZLinkDispatchErrorSurface.StreamSession,
+                                messageKind: ZLinkDispatchOptions_1.ZLinkDispatchMessageKind.Send,
+                                packetName: (0, service_wire_m6a_codec_1.decodeApplicationPayloadView)(payloadFrame).packetName,
+                                ...(this.dispatchErrorMeshName === undefined
+                                    ? {}
+                                    : { meshName: this.dispatchErrorMeshName }),
+                                ...(record.correlation === undefined
+                                    ? {}
+                                    : { correlationId: record.correlation.toString() }),
+                                sourceRid: ingress.sourceRoutingId,
+                                actorId: record.target.actor.actorId,
+                                streamSessionId: record.boundSession.sessionRid,
+                                errorReason: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorReason.StaleTarget
+                            });
+                        }
+                        return 'application';
+                    }
                 }
                 return this.enqueueApplicationFrame(ingress, `actor:${actor.ref.actorId}\0${actor.ref.generation}`, payloadFrame, {
                     receiveKind: record.kind === 'actorSend' ? service_runtime_contracts_1.ReceiveKind.ActorSend : service_runtime_contracts_1.ReceiveKind.ActorRequest,
@@ -2273,7 +2316,7 @@ class ServiceStatefulRuntime {
                     }
                 })
         };
-        const applicationFrame = payloadFrame ?? (0, service_wire_m6a_codec_1.encodeApplicationPayload)(emptyPayload());
+        const applicationFrame = payloadFrame ?? (0, service_wire_m6a_codec_1.encodeOwnedApplicationPayload)(emptyPayload());
         return this.enqueueLifecycleFrame(ingress, `spot:${record.target.spot.spotId}`, applicationFrame, {
             receiveKind: service_runtime_contracts_1.ReceiveKind.SpotControl,
             operationKind: service_runtime_contracts_1.OperationKind.ActorJoin,
@@ -2694,7 +2737,7 @@ class ServiceStatefulRuntime {
     async enqueueLogicalMulticast(channelName, topic, sourceSpotId, payload, sourceNodeRid = this.nodeRid) {
         const applicationJobOwner = await this.raw.reserveLocalIngress();
         try {
-            await this.enqueueLogicalMulticastFrame(channelName, topic, sourceSpotId, (0, service_wire_m6a_codec_1.encodeApplicationPayload)(payload), sourceNodeRid, applicationJobOwner);
+            await this.enqueueLogicalMulticastFrame(channelName, topic, sourceSpotId, (0, service_wire_m6a_codec_1.encodeOwnedApplicationPayload)(payload), sourceNodeRid, applicationJobOwner);
         }
         finally {
             applicationJobOwner.close();
@@ -3046,6 +3089,7 @@ class ServiceStatefulRuntime {
     async submitOneWay(targetNodeRid, parts) {
         this.requireOpen();
         if (targetNodeRid === this.nodeRid) {
+            parts = copyRetainedServiceFrames(parts);
             const applicationJobOwner = await this.raw.reserveLocalIngress();
             if ((0, execution_1.captureZLinkExecutionTurn)() !== undefined) {
                 //  The sender is inside a Spot serial turn. Running ingress inline
@@ -3107,6 +3151,7 @@ class ServiceStatefulRuntime {
     }
     submitRequest(pending, targetNodeRid, parts, timeoutMs, operationKind, actor, onAdmitted, receiver) {
         if (targetNodeRid === this.nodeRid) {
+            parts = copyRetainedServiceFrames(parts);
             const deadlineUnixMs = BigInt(Date.now() + Math.max(0, timeoutMs));
             const capacityStop = new AbortController();
             void pending.promise.then(() => capacityStop.abort(), () => capacityStop.abort());
@@ -3231,7 +3276,7 @@ class ServiceStatefulRuntime {
             ? ingress.parts.length < 2
                 ? undefined
                 : ingress.parts[1]
-            : (0, service_wire_m6a_codec_1.encodeApplicationPayload)({
+            : (0, service_wire_m6a_codec_1.encodeOwnedApplicationPayload)({
                 packetName: canonicalActorJoin.payload.packetName,
                 contentType: canonicalActorJoin.payload.contentType,
                 payload: Buffer.from(canonicalActorJoin.payload.payload)
@@ -3323,7 +3368,7 @@ class ServiceStatefulRuntime {
                 currentMembershipEpoch: (previous?.membershipEpoch ?? 0n) + 1n,
                 resultCode: 0
             };
-            this.enqueueLifecycleFrame(ingress, `spot:${decoded.target.spot.spotId}`, payloadFrame ?? (0, service_wire_m6a_codec_1.encodeApplicationPayload)(emptyPayload()), {
+            this.enqueueLifecycleFrame(ingress, `spot:${decoded.target.spot.spotId}`, payloadFrame ?? (0, service_wire_m6a_codec_1.encodeOwnedApplicationPayload)(emptyPayload()), {
                 receiveKind: service_runtime_contracts_1.ReceiveKind.SpotControl,
                 operationKind: service_runtime_contracts_1.OperationKind.ActorJoin,
                 correlation: decoded.correlation,
@@ -3481,6 +3526,7 @@ class ServiceStatefulRuntime {
         return {
             terminalResult,
             failureCode,
+            ...(tail?.kind === 'streamBindRejected' ? { failureMessage: tail.rejectionMessage } : {}),
             ...(payload === undefined ? {} : { payload }),
             ...(tail?.kind === 'streamBind'
                 ? {
@@ -4219,6 +4265,9 @@ function emptyPayload() {
         payload: Buffer.alloc(0)
     };
 }
+function copyRetainedServiceFrames(parts) {
+    return parts.map((part) => (0, payload_slab_1.copyPayloadBytes)(part));
+}
 /**
  * The generated command-28 decoder is the canonical wire authority.  Keep
  * the stateful mailbox's internal record shape as an adapter only; it must

package/dist/runtime/foundation/service-stateful-wire-codec.d.ts

@@ -515,6 +515,9 @@ export type ServiceStatefulReplyTail = {
     readonly kind: 'streamBind';
     readonly bindingGeneration: bigint;
     readonly authorityOwnerGeneration: bigint;
+} | {
+    readonly kind: 'streamBindRejected';
+    readonly rejectionMessage: string;
 } | {
     readonly kind: 'userSpotCreate';
     readonly createResult: 'existing' | 'created' | 'rejected';

package/dist/runtime/foundation/service-stateful-wire-codec.js

@@ -40,6 +40,7 @@ const service_wire_codec_generated_1 = require("../protocol/service_wire_codec.g
 const stream_wire_1 = require("@zlink-systems/stream-wire");
 const InternalDefaults_1 = require("../../contracts/Configuration/InternalDefaults");
 const framework_errors_internal_1 = require("../framework-errors-internal");
+const runtime_values_1 = require("../backend/runtime-values");
 const service_wire_codec_generated_2 = require("../protocol/service_wire_codec.generated");
 const service_wire_pilot_codec_generated_1 = require("../protocol/service_wire_pilot_codec.generated");
 const routing_id_2 = require("../routing-id");
@@ -1226,6 +1227,12 @@ function decodeStatefulReply(frame, expectedCorrelation, operationKind, hasPaylo
             };
         }
     }
+    else if (operationKind === 'streamBind' && terminalResult === runtime_values_1.RequestResult.Rejected) {
+        tail = {
+            kind: 'streamBindRejected',
+            rejectionMessage: reader.text16('rejectionMessage')
+        };
+    }
     reader.end();
     return {
         correlation,
@@ -1275,6 +1282,8 @@ function encodeReplyTail(tail) {
         }
         case 'streamBind':
             return concat(u64(tail.bindingGeneration), u64(tail.authorityOwnerGeneration));
+        case 'streamBindRejected':
+            return concat(text16(tail.rejectionMessage, 'rejectionMessage'));
         case 'userSpotCreate':
             return concat(Buffer.of(['existing', 'created', 'rejected'].indexOf(tail.createResult) + 1), rid(tail.spotId, 'spotId'), u64(tail.objectGeneration));
         case 'userSpotClose':
@@ -1385,6 +1394,12 @@ function rid(value, name) {
 function text8(value, name) {
     return sized8(value, name);
 }
+function text16(value, name) {
+    const bytes = (0, service_wire_binary_primitives_1.encodeCanonicalServiceWireText)(value, name, 0xffff, outOfRange);
+    if (bytes.byteLength === 0)
+        fail(`${name} must not be empty.`);
+    return concat(u16(bytes.byteLength), bytes);
+}
 function optionalRid(value) {
     return value === undefined ? Buffer.of(0) : rid(value, 'sourceSpotId');
 }

package/dist/runtime/foundation/service-wire-constants.generated.d.ts

@@ -110,3 +110,4 @@ export declare const ServiceWireExactTerminalByFailureCode: {
     readonly 35: 105;
 };
 export declare const isValidServiceWireTerminalFailure: (terminal: number, failureCode: number) => boolean;
+export declare function recoverRequestCorrelation(bytes: Uint8Array): bigint | undefined;

package/dist/runtime/foundation/service-wire-constants.generated.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isValidServiceWireTerminalFailure = exports.ServiceWireExactTerminalByFailureCode = exports.ServiceWireBoundaryTerminalResults = exports.ServiceWireFrameworkErrorCode = exports.ServiceWireFlag = exports.ServiceWireCommand = exports.SERVICE_FRAMEWORK_MULTIPART_CONTENT_TYPE = exports.SERVICE_FRAMEWORK_MULTIPART_PACKET_NAME = exports.SERVICE_WIRE_REQUIRED_CAPABILITY = exports.SERVICE_WIRE_METADATA_BYTES = exports.SERVICE_WIRE_MAJOR = exports.SERVICE_WIRE_MAGIC = void 0;
+exports.recoverRequestCorrelation = recoverRequestCorrelation;
 // Generated from service-wire-v1.schema.json. Do not edit.
 exports.SERVICE_WIRE_MAGIC = [90, 77];
 exports.SERVICE_WIRE_MAJOR = 1;
@@ -132,3 +133,14 @@ const isValidServiceWireTerminalFailure = (terminal, failureCode) => {
     return exports.ServiceWireExactTerminalByFailureCode[failureCode] === terminal;
 };
 exports.isValidServiceWireTerminalFailure = isValidServiceWireTerminalFailure;
+function recoverRequestCorrelation(bytes) {
+    if (bytes.length < 13
+        || bytes[0] !== 90 || bytes[1] !== 77
+        || bytes[2] !== 1
+        || ![17, 19, 22, 25, 26, 27, 28, 38, 47, 48, 49, 54].includes(bytes[3]))
+        return undefined;
+    let correlation = 0n;
+    for (let index = 5; index < 13; ++index)
+        correlation = (correlation << 8n) | BigInt(bytes[index]);
+    return correlation === 0n ? undefined : correlation;
+}

package/dist/runtime/foundation/service-wire-m6a-codec.d.ts

@@ -78,6 +78,8 @@ export declare function decodeChannelRequestHeader(frame: Uint8Array, header?: S
 export declare function encodeReplyHeader(correlation: bigint, terminalResult?: number, failureCode?: number, tail?: Uint8Array): Buffer;
 export declare function decodeReplyHeader(frame: Uint8Array): ServiceReplyHeader;
 export declare function encodeApplicationPayload(payload: ServiceApplicationPayload): Buffer;
+/** Encodes a retained internal application frame with its own backing store. */
+export declare function encodeOwnedApplicationPayload(payload: ServiceApplicationPayload): Buffer;
 /**
  * Encodes the framework multipart payload directly into its M6A application
  * frame. The caller supplies borrowed message views; this function performs