Complete refactor to new grpc control plane and only http proxy for carts (#4)

Co-authored-by: matst80 <mats.tornberg@gmail.com> Reviewed-on: https://git.tornberg.me/mats/go-cart-actor/pulls/4 Co-authored-by: Mats Törnberg <mats@tornberg.me> Co-committed-by: Mats Törnberg <mats@tornberg.me>
2025-10-14 22:31:12 +02:00
parent f735540c3d
commit f5014fe906
88 changed files with 9836 additions and 5646 deletions
--- a/pkg/actor/disk_storage.go
+++ b/pkg/actor/disk_storage.go
@@ -0,0 +1,137 @@
+package actor
+
+import (
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/gogo/protobuf/proto"
+)
+
+type QueueEvent struct {
+	TimeStamp time.Time
+	Message   proto.Message
+}
+
+type DiskStorage[V any] struct {
+	*StateStorage
+	path  string
+	done  chan struct{}
+	queue *sync.Map // map[uint64][]QueueEvent
+}
+
+type LogStorage[V any] interface {
+	LoadEvents(id uint64, grain Grain[V]) error
+	AppendEvent(id uint64, msg ...proto.Message) error
+}
+
+func NewDiskStorage[V any](path string, registry MutationRegistry) *DiskStorage[V] {
+	return &DiskStorage[V]{
+		StateStorage: NewState(registry),
+		path:         path,
+		done:         make(chan struct{}),
+	}
+}
+
+func (s *DiskStorage[V]) SaveLoop(duration time.Duration) {
+	s.queue = &sync.Map{}
+	ticker := time.NewTicker(duration)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-s.done:
+			s.save()
+			return
+		case <-ticker.C:
+			s.save()
+		}
+	}
+}
+
+func (s *DiskStorage[V]) save() {
+	carts := 0
+	lines := 0
+	s.queue.Range(func(key, value any) bool {
+		id := key.(uint64)
+		path := s.logPath(id)
+		fh, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+		if err != nil {
+			log.Printf("failed to open event log file: %v", err)
+			return true
+		}
+		defer fh.Close()
+
+		if qe, ok := value.([]QueueEvent); ok {
+			for _, msg := range qe {
+				if err := s.Append(fh, msg.Message, msg.TimeStamp); err != nil {
+					log.Printf("failed to append event to log file: %v", err)
+				}
+				lines++
+			}
+		}
+		carts++
+		s.queue.Delete(id)
+		return true
+	})
+	if lines > 0 {
+		log.Printf("Appended %d carts and %d lines to disk", carts, lines)
+	}
+}
+
+func (s *DiskStorage[V]) logPath(id uint64) string {
+	return filepath.Join(s.path, fmt.Sprintf("%d.events.log", id))
+}
+
+func (s *DiskStorage[V]) LoadEvents(id uint64, grain Grain[V]) error {
+	path := s.logPath(id)
+	if _, err := os.Stat(path); errors.Is(err, os.ErrNotExist) {
+		// No log -> nothing to replay
+		return nil
+	}
+
+	fh, err := os.Open(path)
+	if err != nil {
+		return fmt.Errorf("open replay file: %w", err)
+	}
+	defer fh.Close()
+	return s.Load(fh, func(msg proto.Message) {
+		s.registry.Apply(grain, msg)
+	})
+}
+
+func (s *DiskStorage[V]) Close() {
+	s.save()
+	close(s.done)
+}
+
+func (s *DiskStorage[V]) AppendEvent(id uint64, msg ...proto.Message) error {
+	if s.queue != nil {
+		queue := make([]QueueEvent, 0)
+		data, found := s.queue.Load(id)
+		if found {
+			queue = data.([]QueueEvent)
+		}
+		for _, m := range msg {
+			queue = append(queue, QueueEvent{Message: m, TimeStamp: time.Now()})
+		}
+		s.queue.Store(id, queue)
+		return nil
+	} else {
+		path := s.logPath(id)
+		fh, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+		if err != nil {
+			log.Printf("failed to open event log file: %v", err)
+			return err
+		}
+		defer fh.Close()
+		for _, m := range msg {
+			err = s.Append(fh, m, time.Now())
+		}
+		return err
+	}
+
+}
--- a/pkg/actor/grain.go
+++ b/pkg/actor/grain.go
@@ -0,0 +1,13 @@
+package actor
+
+import (
+	"time"
+)
+
+type Grain[V any] interface {
+	GetId() uint64
+
+	GetLastAccess() time.Time
+	GetLastChange() time.Time
+	GetCurrentState() (*V, error)
+}
--- a/pkg/actor/grain_pool.go
+++ b/pkg/actor/grain_pool.go
@@ -0,0 +1,41 @@
+package actor
+
+import (
+	"net/http"
+
+	"github.com/gogo/protobuf/proto"
+)
+
+type MutationResult[V any] struct {
+	Result    V             `json:"result"`
+	Mutations []ApplyResult `json:"mutations,omitempty"`
+}
+
+type GrainPool[V any] interface {
+	Apply(id uint64, mutation ...proto.Message) (*MutationResult[V], error)
+	Get(id uint64) (V, error)
+	OwnerHost(id uint64) (Host, bool)
+	Hostname() string
+	TakeOwnership(id uint64)
+	HandleOwnershipChange(host string, ids []uint64) error
+	HandleRemoteExpiry(host string, ids []uint64) error
+	Negotiate(otherHosts []string)
+	GetLocalIds() []uint64
+	RemoveHost(host string)
+	IsHealthy() bool
+	IsKnown(string) bool
+	Close()
+}
+
+// Host abstracts a remote node capable of proxying cart requests.
+type Host interface {
+	AnnounceExpiry(ids []uint64)
+	Negotiate(otherHosts []string) ([]string, error)
+	Name() string
+	Proxy(id uint64, w http.ResponseWriter, r *http.Request) (bool, error)
+	GetActorIds() []uint64
+	Close() error
+	Ping() bool
+	IsHealthy() bool
+	AnnounceOwnership(ownerHost string, ids []uint64)
+}
--- a/pkg/actor/grpc_server.go
+++ b/pkg/actor/grpc_server.go
@@ -0,0 +1,119 @@
+package actor
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net"
+	"time"
+
+	messages "git.tornberg.me/go-cart-actor/pkg/messages"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/reflection"
+)
+
+// ControlServer implements the ControlPlane gRPC services.
+// It delegates to a grain pool and cluster operations to a synced pool.
+type ControlServer[V any] struct {
+	messages.UnimplementedControlPlaneServer
+
+	pool GrainPool[V]
+}
+
+func (s *ControlServer[V]) AnnounceOwnership(ctx context.Context, req *messages.OwnershipAnnounce) (*messages.OwnerChangeAck, error) {
+	err := s.pool.HandleOwnershipChange(req.Host, req.Ids)
+	if err != nil {
+		return &messages.OwnerChangeAck{
+			Accepted: false,
+			Message:  "owner change failed",
+		}, err
+	}
+
+	log.Printf("Ack count: %d", len(req.Ids))
+	return &messages.OwnerChangeAck{
+		Accepted: true,
+		Message:  "ownership announced",
+	}, nil
+}
+
+func (s *ControlServer[V]) AnnounceExpiry(ctx context.Context, req *messages.ExpiryAnnounce) (*messages.OwnerChangeAck, error) {
+	err := s.pool.HandleRemoteExpiry(req.Host, req.Ids)
+	return &messages.OwnerChangeAck{
+		Accepted: err == nil,
+		Message:  "expiry acknowledged",
+	}, nil
+}
+
+// ControlPlane: Ping
+func (s *ControlServer[V]) Ping(ctx context.Context, _ *messages.Empty) (*messages.PingReply, error) {
+	// log.Printf("got ping")
+	return &messages.PingReply{
+		Host:     s.pool.Hostname(),
+		UnixTime: time.Now().Unix(),
+	}, nil
+}
+
+// ControlPlane: Negotiate (merge host views)
+func (s *ControlServer[V]) Negotiate(ctx context.Context, req *messages.NegotiateRequest) (*messages.NegotiateReply, error) {
+
+	s.pool.Negotiate(req.KnownHosts)
+	return &messages.NegotiateReply{Hosts: req.GetKnownHosts()}, nil
+}
+
+// ControlPlane: GetCartIds (locally owned carts only)
+func (s *ControlServer[V]) GetLocalActorIds(ctx context.Context, _ *messages.Empty) (*messages.ActorIdsReply, error) {
+	return &messages.ActorIdsReply{Ids: s.pool.GetLocalIds()}, nil
+}
+
+// ControlPlane: Closing (peer shutdown notification)
+func (s *ControlServer[V]) Closing(ctx context.Context, req *messages.ClosingNotice) (*messages.OwnerChangeAck, error) {
+	if req.GetHost() != "" {
+		s.pool.RemoveHost(req.GetHost())
+	}
+	return &messages.OwnerChangeAck{
+		Accepted: true,
+		Message:  "removed host",
+	}, nil
+}
+
+type ServerConfig struct {
+	Addr    string
+	Options []grpc.ServerOption
+}
+
+func NewServerConfig(addr string, options ...grpc.ServerOption) ServerConfig {
+	return ServerConfig{
+		Addr:    addr,
+		Options: options,
+	}
+}
+
+func DefaultServerConfig() ServerConfig {
+	return NewServerConfig(":1337")
+}
+
+// StartGRPCServer configures and starts the unified gRPC server on the given address.
+// It registers both the CartActor and ControlPlane services.
+func NewControlServer[V any](config ServerConfig, pool GrainPool[V]) (*grpc.Server, error) {
+	lis, err := net.Listen("tcp", config.Addr)
+	if err != nil {
+		return nil, fmt.Errorf("failed to listen: %w", err)
+	}
+
+	grpcServer := grpc.NewServer(config.Options...)
+	server := &ControlServer[V]{
+		pool: pool,
+	}
+
+	messages.RegisterControlPlaneServer(grpcServer, server)
+	reflection.Register(grpcServer)
+
+	log.Printf("gRPC server listening as %s on %s", pool.Hostname(), config.Addr)
+	go func() {
+		if err := grpcServer.Serve(lis); err != nil {
+			log.Fatalf("failed to serve gRPC: %v", err)
+		}
+	}()
+
+	return grpcServer, nil
+}
--- a/pkg/actor/mutation_registry.go
+++ b/pkg/actor/mutation_registry.go
@@ -0,0 +1,226 @@
+package actor
+
+import (
+	"fmt"
+	"log"
+	"reflect"
+	"sync"
+
+	"github.com/gogo/protobuf/proto"
+)
+
+type ApplyResult struct {
+	Type     string        `json:"type"`
+	Mutation proto.Message `json:"mutation"`
+	Error    error         `json:"error,omitempty"`
+}
+
+type MutationRegistry interface {
+	Apply(grain any, msg ...proto.Message) ([]ApplyResult, error)
+	RegisterMutations(handlers ...MutationHandler)
+	Create(typeName string) (proto.Message, bool)
+	GetTypeName(msg proto.Message) (string, bool)
+	//GetStorageEvent(msg proto.Message) StorageEvent
+	//FromStorageEvent(event StorageEvent) (proto.Message, error)
+}
+
+type ProtoMutationRegistry struct {
+	mutationRegistryMu sync.RWMutex
+	mutationRegistry   map[reflect.Type]MutationHandler
+}
+
+var (
+	ErrMutationNotRegistered = &MutationError{
+		Message:    "mutation not registered",
+		Code:       255,
+		StatusCode: 500,
+	}
+)
+
+type MutationError struct {
+	Message    string `json:"message"`
+	Code       uint32 `json:"code"`
+	StatusCode uint32 `json:"status_code"`
+}
+
+func (m MutationError) Error() string {
+	return m.Message
+}
+
+// MutationOption configures additional behavior for a registered mutation.
+type MutationOption func(*mutationOptions)
+
+// mutationOptions holds flags adjustable per registration.
+type mutationOptions struct {
+	updateTotals bool
+}
+
+// WithTotals ensures CartGrain.UpdateTotals() is called after a successful handler.
+func WithTotals() MutationOption {
+	return func(o *mutationOptions) {
+		o.updateTotals = true
+	}
+}
+
+type MutationHandler interface {
+	Handle(state any, msg proto.Message) error
+	Name() string
+	Type() reflect.Type
+	Create() proto.Message
+}
+
+// RegisteredMutation stores metadata + the execution closure.
+type RegisteredMutation[V any, T proto.Message] struct {
+	name    string
+	handler func(*V, T) error
+	create  func() T
+	msgType reflect.Type
+}
+
+func NewMutation[V any, T proto.Message](handler func(*V, T) error, create func() T) *RegisteredMutation[V, T] {
+	// Derive the name and message type from a concrete instance produced by create().
+	// This avoids relying on reflect.TypeFor (which can yield unexpected results in some toolchains)
+	// and ensures we always peel off the pointer layer for proto messages.
+	instance := create()
+	rt := reflect.TypeOf(instance)
+	if rt.Kind() == reflect.Ptr {
+		rt = rt.Elem()
+	}
+	return &RegisteredMutation[V, T]{
+		name:    rt.Name(),
+		handler: handler,
+		create:  create,
+		msgType: rt,
+	}
+}
+
+func (m *RegisteredMutation[V, T]) Handle(state any, msg proto.Message) error {
+	return m.handler(state.(*V), msg.(T))
+}
+
+func (m *RegisteredMutation[V, T]) Name() string {
+	return m.name
+}
+
+func (m *RegisteredMutation[V, T]) Create() proto.Message {
+	return m.create()
+}
+
+func (m *RegisteredMutation[V, T]) Type() reflect.Type {
+	return m.msgType
+}
+
+func NewMutationRegistry() MutationRegistry {
+	return &ProtoMutationRegistry{
+		mutationRegistry:   make(map[reflect.Type]MutationHandler),
+		mutationRegistryMu: sync.RWMutex{},
+	}
+}
+
+func (r *ProtoMutationRegistry) RegisterMutations(handlers ...MutationHandler) {
+	r.mutationRegistryMu.Lock()
+	defer r.mutationRegistryMu.Unlock()
+
+	for _, handler := range handlers {
+		r.mutationRegistry[handler.Type()] = handler
+	}
+}
+
+func (r *ProtoMutationRegistry) GetTypeName(msg proto.Message) (string, bool) {
+	r.mutationRegistryMu.RLock()
+	defer r.mutationRegistryMu.RUnlock()
+
+	rt := indirectType(reflect.TypeOf(msg))
+	if handler, ok := r.mutationRegistry[rt]; ok {
+		return handler.Name(), true
+	}
+	return "", false
+}
+
+func (r *ProtoMutationRegistry) getHandler(typeName string) MutationHandler {
+	r.mutationRegistryMu.Lock()
+	defer r.mutationRegistryMu.Unlock()
+
+	for _, handler := range r.mutationRegistry {
+		if handler.Name() == typeName {
+			return handler
+		}
+	}
+
+	return nil
+}
+
+func (r *ProtoMutationRegistry) Create(typeName string) (proto.Message, bool) {
+
+	handler := r.getHandler(typeName)
+	if handler == nil {
+		log.Printf("missing handler for %s", typeName)
+		return nil, false
+	}
+
+	return handler.Create(), true
+}
+
+// ApplyRegistered attempts to apply a registered mutation.
+// Returns updated grain if successful.
+//
+// If the mutation is not registered, returns (nil, ErrMutationNotRegistered).
+func (r *ProtoMutationRegistry) Apply(grain any, msg ...proto.Message) ([]ApplyResult, error) {
+	results := make([]ApplyResult, 0, len(msg))
+
+	if grain == nil {
+		return results, fmt.Errorf("nil grain")
+	}
+	if msg == nil {
+		return results, fmt.Errorf("nil mutation message")
+	}
+
+	for _, m := range msg {
+		rt := indirectType(reflect.TypeOf(m))
+		r.mutationRegistryMu.RLock()
+		entry, ok := r.mutationRegistry[rt]
+		r.mutationRegistryMu.RUnlock()
+		if !ok {
+			results = append(results, ApplyResult{Error: ErrMutationNotRegistered, Type: rt.Name(), Mutation: m})
+			continue
+		}
+		err := entry.Handle(grain, m)
+		results = append(results, ApplyResult{Error: err, Type: rt.Name(), Mutation: m})
+	}
+
+	// if entry.updateTotals {
+	// 	grain.UpdateTotals()
+	// }
+
+	return results, nil
+}
+
+// RegisteredMutations returns metadata for all registered mutations (snapshot).
+func (r *ProtoMutationRegistry) RegisteredMutations() []string {
+	r.mutationRegistryMu.RLock()
+	defer r.mutationRegistryMu.RUnlock()
+	out := make([]string, 0, len(r.mutationRegistry))
+	for _, entry := range r.mutationRegistry {
+		out = append(out, entry.Name())
+	}
+	return out
+}
+
+// RegisteredMutationTypes returns the reflect.Type list of all registered messages.
+// Useful for coverage tests ensuring expected set matches actual set.
+func (r *ProtoMutationRegistry) RegisteredMutationTypes() []reflect.Type {
+	r.mutationRegistryMu.RLock()
+	defer r.mutationRegistryMu.RUnlock()
+	out := make([]reflect.Type, 0, len(r.mutationRegistry))
+	for _, entry := range r.mutationRegistry {
+		out = append(out, entry.Type())
+	}
+	return out
+}
+
+func indirectType(t reflect.Type) reflect.Type {
+	for t.Kind() == reflect.Ptr {
+		t = t.Elem()
+	}
+	return t
+}
--- a/pkg/actor/mutation_registry_test.go
+++ b/pkg/actor/mutation_registry_test.go
@@ -0,0 +1,134 @@
+package actor
+
+import (
+	"errors"
+	"reflect"
+	"slices"
+	"testing"
+
+	"git.tornberg.me/go-cart-actor/pkg/messages"
+)
+
+type cartState struct {
+	calls     int
+	lastAdded *messages.AddItem
+}
+
+func TestRegisteredMutationBasics(t *testing.T) {
+	reg := NewMutationRegistry().(*ProtoMutationRegistry)
+
+	addItemMutation := NewMutation(
+		func(state *cartState, msg *messages.AddItem) error {
+			state.calls++
+			// copy to avoid external mutation side-effects (not strictly necessary for the test)
+			cp := *msg
+			state.lastAdded = &cp
+			return nil
+		},
+		func() *messages.AddItem { return &messages.AddItem{} },
+	)
+
+	// Sanity check on mutation metadata
+	if addItemMutation.Name() != "AddItem" {
+		t.Fatalf("expected mutation Name() == AddItem, got %s", addItemMutation.Name())
+	}
+	if got, want := addItemMutation.Type(), reflect.TypeOf(messages.AddItem{}); got != want {
+		t.Fatalf("expected Type() == %v, got %v", want, got)
+	}
+
+	reg.RegisterMutations(addItemMutation)
+
+	// RegisteredMutations: membership (order not guaranteed)
+	names := reg.RegisteredMutations()
+	if !slices.Contains(names, "AddItem") {
+		t.Fatalf("RegisteredMutations missing AddItem, got %v", names)
+	}
+
+	// RegisteredMutationTypes: membership (order not guaranteed)
+	types := reg.RegisteredMutationTypes()
+	if !slices.Contains(types, reflect.TypeOf(messages.AddItem{})) {
+		t.Fatalf("RegisteredMutationTypes missing AddItem type, got %v", types)
+	}
+
+	// GetTypeName should resolve for a pointer instance
+	name, ok := reg.GetTypeName(&messages.AddItem{})
+	if !ok || name != "AddItem" {
+		t.Fatalf("GetTypeName returned (%q,%v), expected (AddItem,true)", name, ok)
+	}
+
+	// GetTypeName should fail for unregistered type
+	if name, ok := reg.GetTypeName(&messages.Noop{}); ok || name != "" {
+		t.Fatalf("expected GetTypeName to fail for unregistered message, got (%q,%v)", name, ok)
+	}
+
+	// Create by name
+	msg, ok := reg.Create("AddItem")
+	if !ok {
+		t.Fatalf("Create failed for registered mutation")
+	}
+	if _, isAddItem := msg.(*messages.AddItem); !isAddItem {
+		t.Fatalf("Create returned wrong concrete type: %T", msg)
+	}
+
+	// Create unknown
+	if m2, ok := reg.Create("Unknown"); ok || m2 != nil {
+		t.Fatalf("Create should fail for unknown mutation, got (%T,%v)", m2, ok)
+	}
+
+	// Apply happy path
+	state := &cartState{}
+	add := &messages.AddItem{ItemId: 42, Quantity: 3, Sku: "ABC"}
+	if _, err := reg.Apply(state, add); err != nil {
+		t.Fatalf("Apply returned error: %v", err)
+	}
+	if state.calls != 1 {
+		t.Fatalf("handler not invoked expected calls=1 got=%d", state.calls)
+	}
+	if state.lastAdded == nil || state.lastAdded.ItemId != 42 || state.lastAdded.Quantity != 3 {
+		t.Fatalf("state not updated correctly: %+v", state.lastAdded)
+	}
+
+	// Apply nil grain
+	if _, err := reg.Apply(nil, add); err == nil {
+		t.Fatalf("expected error for nil grain")
+	}
+
+	// Apply nil message
+	if _, err := reg.Apply(state, nil); err == nil {
+		t.Fatalf("expected error for nil mutation message")
+	}
+
+	// Apply unregistered message
+	if _, err := reg.Apply(state, &messages.Noop{}); !errors.Is(err, ErrMutationNotRegistered) {
+		t.Fatalf("expected ErrMutationNotRegistered, got %v", err)
+	}
+}
+
+// func TestConcurrentSafeRegistrationLookup(t *testing.T) {
+// 	// This test is light-weight; it ensures locks don't deadlock under simple concurrent access.
+// 	reg := NewMutationRegistry().(*ProtoMutationRegistry)
+// 	mut := NewMutation[cartState, *messages.Noop](
+// 		func(state *cartState, msg *messages.Noop) error { state.calls++; return nil },
+// 		func() *messages.Noop { return &messages.Noop{} },
+// 	)
+// 	reg.RegisterMutations(mut)
+
+// 	done := make(chan struct{})
+// 	const workers = 25
+// 	for i := 0; i < workers; i++ {
+// 		go func() {
+// 			for j := 0; j < 100; j++ {
+// 				_, _ = reg.Create("Noop")
+// 				_, _ = reg.GetTypeName(&messages.Noop{})
+// 				_ = reg.Apply(&cartState{}, &messages.Noop{})
+// 			}
+// 			done <- struct{}{}
+// 		}()
+// 	}
+
+// 	for i := 0; i < workers; i++ {
+// 		<-done
+// 	}
+// }
+
+// Helpers
--- a/pkg/actor/simple_grain_pool.go
+++ b/pkg/actor/simple_grain_pool.go
@@ -0,0 +1,433 @@
+package actor
+
+import (
+	"fmt"
+	"log"
+	"maps"
+	"sync"
+	"time"
+
+	"github.com/gogo/protobuf/proto"
+)
+
+type SimpleGrainPool[V any] struct {
+	// fields and methods
+	localMu          sync.RWMutex
+	grains           map[uint64]Grain[V]
+	mutationRegistry MutationRegistry
+	spawn            func(id uint64) (Grain[V], error)
+	spawnHost        func(host string) (Host, error)
+	storage          LogStorage[V]
+	ttl              time.Duration
+	poolSize         int
+
+	// Cluster coordination --------------------------------------------------
+	hostname     string
+	remoteMu     sync.RWMutex
+	remoteOwners map[uint64]Host
+	remoteHosts  map[string]Host
+	//discardedHostHandler *DiscardedHostHandler
+
+	// House-keeping ---------------------------------------------------------
+	purgeTicker *time.Ticker
+}
+
+type GrainPoolConfig[V any] struct {
+	Hostname         string
+	Spawn            func(id uint64) (Grain[V], error)
+	SpawnHost        func(host string) (Host, error)
+	TTL              time.Duration
+	PoolSize         int
+	MutationRegistry MutationRegistry
+	Storage          LogStorage[V]
+}
+
+func NewSimpleGrainPool[V any](config GrainPoolConfig[V]) (*SimpleGrainPool[V], error) {
+	p := &SimpleGrainPool[V]{
+		grains:           make(map[uint64]Grain[V]),
+		mutationRegistry: config.MutationRegistry,
+		storage:          config.Storage,
+		spawn:            config.Spawn,
+		spawnHost:        config.SpawnHost,
+		ttl:              config.TTL,
+		poolSize:         config.PoolSize,
+		hostname:         config.Hostname,
+		remoteOwners:     make(map[uint64]Host),
+		remoteHosts:      make(map[string]Host),
+	}
+
+	p.purgeTicker = time.NewTicker(time.Minute)
+	go func() {
+		for range p.purgeTicker.C {
+			p.purge()
+		}
+	}()
+
+	return p, nil
+}
+
+func (p *SimpleGrainPool[V]) purge() {
+	purgeLimit := time.Now().Add(-p.ttl)
+	purgedIds := make([]uint64, 0, len(p.grains))
+	p.localMu.Lock()
+	for id, grain := range p.grains {
+		if grain.GetLastAccess().Before(purgeLimit) {
+			purgedIds = append(purgedIds, id)
+
+			delete(p.grains, id)
+		}
+	}
+	p.localMu.Unlock()
+	p.forAllHosts(func(remote Host) {
+		remote.AnnounceExpiry(purgedIds)
+	})
+
+}
+
+// LocalUsage returns the number of resident grains and configured capacity.
+func (p *SimpleGrainPool[V]) LocalUsage() (int, int) {
+	p.localMu.RLock()
+	defer p.localMu.RUnlock()
+	return len(p.grains), p.poolSize
+}
+
+// LocalCartIDs returns the currently owned cart ids (for control-plane RPCs).
+func (p *SimpleGrainPool[V]) GetLocalIds() []uint64 {
+	p.localMu.RLock()
+	defer p.localMu.RUnlock()
+	ids := make([]uint64, 0, len(p.grains))
+	for _, g := range p.grains {
+		if g == nil {
+			continue
+		}
+		ids = append(ids, uint64(g.GetId()))
+	}
+	return ids
+}
+
+func (p *SimpleGrainPool[V]) HandleRemoteExpiry(host string, ids []uint64) error {
+	p.remoteMu.Lock()
+	defer p.remoteMu.Unlock()
+	for _, id := range ids {
+		delete(p.remoteOwners, id)
+	}
+	return nil
+}
+
+func (p *SimpleGrainPool[V]) HandleOwnershipChange(host string, ids []uint64) error {
+	log.Printf("host %s now owns %d cart ids", host, len(ids))
+	p.remoteMu.RLock()
+	remoteHost, exists := p.remoteHosts[host]
+	p.remoteMu.RUnlock()
+	if !exists {
+		createdHost, err := p.AddRemote(host)
+		if err != nil {
+			return err
+		}
+		remoteHost = createdHost
+	}
+	p.remoteMu.Lock()
+	defer p.remoteMu.Unlock()
+	p.localMu.Lock()
+	defer p.localMu.Unlock()
+	for _, id := range ids {
+		log.Printf("Handling ownership change for cart %d to host %s", id, host)
+		delete(p.grains, id)
+		p.remoteOwners[id] = remoteHost
+	}
+	return nil
+}
+
+// TakeOwnership takes ownership of a grain.
+func (p *SimpleGrainPool[V]) TakeOwnership(id uint64) {
+	p.broadcastOwnership([]uint64{id})
+}
+
+func (p *SimpleGrainPool[V]) AddRemote(host string) (Host, error) {
+	if host == "" {
+		return nil, fmt.Errorf("host is empty")
+	}
+	if host == p.hostname {
+		return nil, fmt.Errorf("same host, this should not happen")
+	}
+	p.remoteMu.RLock()
+	existing, found := p.remoteHosts[host]
+	p.remoteMu.RUnlock()
+	if found {
+		return existing, nil
+	}
+
+	remote, err := p.spawnHost(host)
+	if err != nil {
+		log.Printf("AddRemote %s failed: %v", host, err)
+
+		return nil, err
+	}
+	p.remoteMu.Lock()
+	p.remoteHosts[host] = remote
+	p.remoteMu.Unlock()
+	// connectedRemotes.Set(float64(p.RemoteCount()))
+
+	log.Printf("Connected to remote host %s", host)
+	go p.pingLoop(remote)
+	go p.initializeRemote(remote)
+	go p.SendNegotiation()
+	return remote, nil
+}
+
+func (p *SimpleGrainPool[V]) initializeRemote(remote Host) {
+
+	remotesIds := remote.GetActorIds()
+
+	p.remoteMu.Lock()
+	for _, id := range remotesIds {
+		p.localMu.Lock()
+		delete(p.grains, id)
+		p.localMu.Unlock()
+		if _, exists := p.remoteOwners[id]; !exists {
+			p.remoteOwners[id] = remote
+		}
+	}
+	p.remoteMu.Unlock()
+
+}
+
+func (p *SimpleGrainPool[V]) RemoveHost(host string) {
+	p.remoteMu.Lock()
+	remote, exists := p.remoteHosts[host]
+
+	if exists {
+		go remote.Close()
+		delete(p.remoteHosts, host)
+	}
+	count := 0
+	for id, owner := range p.remoteOwners {
+		if owner.Name() == host {
+			count++
+			delete(p.remoteOwners, id)
+		}
+	}
+	log.Printf("Removing host %s, grains: %d", host, count)
+	p.remoteMu.Unlock()
+
+	if exists {
+		remote.Close()
+	}
+	// connectedRemotes.Set(float64(p.RemoteCount()))
+}
+
+func (p *SimpleGrainPool[V]) RemoteCount() int {
+	p.remoteMu.RLock()
+	defer p.remoteMu.RUnlock()
+	return len(p.remoteHosts)
+}
+
+// RemoteHostNames returns a snapshot of connected remote host identifiers.
+func (p *SimpleGrainPool[V]) RemoteHostNames() []string {
+	p.remoteMu.RLock()
+	defer p.remoteMu.RUnlock()
+	hosts := make([]string, 0, len(p.remoteHosts))
+	for host := range p.remoteHosts {
+		hosts = append(hosts, host)
+	}
+	return hosts
+}
+
+func (p *SimpleGrainPool[V]) IsKnown(host string) bool {
+	if host == p.hostname {
+		return true
+	}
+	p.remoteMu.RLock()
+	defer p.remoteMu.RUnlock()
+	_, ok := p.remoteHosts[host]
+	return ok
+}
+
+func (p *SimpleGrainPool[V]) pingLoop(remote Host) {
+	remote.Ping()
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+	for range ticker.C {
+		if !remote.Ping() {
+			if !remote.IsHealthy() {
+				log.Printf("Remote %s unhealthy, removing", remote.Name())
+				p.Close()
+				p.RemoveHost(remote.Name())
+				return
+			}
+			continue
+		}
+	}
+}
+
+func (p *SimpleGrainPool[V]) IsHealthy() bool {
+	p.remoteMu.RLock()
+	defer p.remoteMu.RUnlock()
+	for _, r := range p.remoteHosts {
+		if !r.IsHealthy() {
+			return false
+		}
+	}
+	return true
+}
+
+func (p *SimpleGrainPool[V]) Negotiate(otherHosts []string) {
+
+	for _, host := range otherHosts {
+		if host != p.hostname {
+			p.remoteMu.RLock()
+			_, ok := p.remoteHosts[host]
+			p.remoteMu.RUnlock()
+			if !ok {
+				go p.AddRemote(host)
+			}
+		}
+	}
+}
+
+func (p *SimpleGrainPool[V]) SendNegotiation() {
+	//negotiationCount.Inc()
+
+	p.remoteMu.RLock()
+	hosts := make([]string, 0, len(p.remoteHosts)+1)
+	hosts = append(hosts, p.hostname)
+	remotes := make([]Host, 0, len(p.remoteHosts))
+	for h, r := range p.remoteHosts {
+		hosts = append(hosts, h)
+		remotes = append(remotes, r)
+	}
+	p.remoteMu.RUnlock()
+
+	p.forAllHosts(func(remote Host) {
+		knownByRemote, err := remote.Negotiate(hosts)
+
+		if err != nil {
+			log.Printf("Negotiate with %s failed: %v", remote.Name(), err)
+			return
+		}
+		for _, h := range knownByRemote {
+			if !p.IsKnown(h) {
+				go p.AddRemote(h)
+			}
+		}
+	})
+}
+
+func (p *SimpleGrainPool[V]) forAllHosts(fn func(Host)) {
+	p.remoteMu.RLock()
+	rh := maps.Clone(p.remoteHosts)
+	p.remoteMu.RUnlock()
+
+	wg := sync.WaitGroup{}
+	for _, host := range rh {
+
+		wg.Go(func() { fn(host) })
+
+	}
+
+	for name, host := range rh {
+		if !host.IsHealthy() {
+			host.Close()
+			p.remoteMu.Lock()
+			delete(p.remoteHosts, name)
+			p.remoteMu.Unlock()
+		}
+
+	}
+}
+
+func (p *SimpleGrainPool[V]) broadcastOwnership(ids []uint64) {
+	if len(ids) == 0 {
+		return
+	}
+
+	p.forAllHosts(func(rh Host) {
+		rh.AnnounceOwnership(p.hostname, ids)
+	})
+	log.Printf("%s taking ownership of %d ids", p.hostname, len(ids))
+	// go p.statsUpdate()
+}
+
+func (p *SimpleGrainPool[V]) getOrClaimGrain(id uint64) (Grain[V], error) {
+	p.localMu.RLock()
+	grain, exists := p.grains[id]
+	p.localMu.RUnlock()
+	if exists && grain != nil {
+		return grain, nil
+	}
+
+	grain, err := p.spawn(id)
+	if err != nil {
+		return nil, err
+	}
+	p.localMu.Lock()
+	p.grains[id] = grain
+	p.localMu.Unlock()
+	go p.broadcastOwnership([]uint64{id})
+	return grain, nil
+}
+
+// // ErrNotOwner is returned when a cart belongs to another host.
+// var ErrNotOwner = fmt.Errorf("not owner")
+
+// Apply applies a mutation to a grain.
+func (p *SimpleGrainPool[V]) Apply(id uint64, mutation ...proto.Message) (*MutationResult[*V], error) {
+	grain, err := p.getOrClaimGrain(id)
+	if err != nil {
+		return nil, err
+	}
+
+	mutations, err := p.mutationRegistry.Apply(grain, mutation...)
+	if err != nil {
+		return nil, err
+	}
+	if p.storage != nil {
+		go func() {
+			if err := p.storage.AppendEvent(id, mutation...); err != nil {
+				log.Printf("failed to store mutation for grain %d: %v", id, err)
+			}
+		}()
+	}
+	result, err := grain.GetCurrentState()
+	if err != nil {
+		return nil, err
+	}
+	return &MutationResult[*V]{
+		Result:    result,
+		Mutations: mutations,
+	}, nil
+}
+
+// Get returns the current state of a grain.
+func (p *SimpleGrainPool[V]) Get(id uint64) (*V, error) {
+	grain, err := p.getOrClaimGrain(id)
+	if err != nil {
+		return nil, err
+	}
+	return grain.GetCurrentState()
+}
+
+// OwnerHost reports the remote owner (if any) for the supplied cart id.
+func (p *SimpleGrainPool[V]) OwnerHost(id uint64) (Host, bool) {
+	p.remoteMu.RLock()
+	defer p.remoteMu.RUnlock()
+	owner, ok := p.remoteOwners[id]
+	return owner, ok
+}
+
+// Hostname returns the local hostname (pod IP).
+func (p *SimpleGrainPool[V]) Hostname() string {
+	return p.hostname
+}
+
+// Close notifies remotes that this host is shutting down.
+func (p *SimpleGrainPool[V]) Close() {
+
+	p.forAllHosts(func(rh Host) {
+		rh.Close()
+	})
+
+	if p.purgeTicker != nil {
+		p.purgeTicker.Stop()
+	}
+}
--- a/pkg/actor/state.go
+++ b/pkg/actor/state.go
@@ -0,0 +1,98 @@
+package actor
+
+import (
+	"bufio"
+	"encoding/json"
+	"errors"
+	"io"
+	"time"
+
+	"github.com/gogo/protobuf/proto"
+)
+
+type StateStorage struct {
+	registry MutationRegistry
+}
+
+type StorageEvent struct {
+	Type      string        `json:"type"`
+	TimeStamp time.Time     `json:"timestamp"`
+	Mutation  proto.Message `json:"mutation"`
+}
+
+type rawEvent struct {
+	Type      string          `json:"type"`
+	TimeStamp time.Time       `json:"timestamp"`
+	Mutation  json.RawMessage `json:"mutation"`
+}
+
+func NewState(registry MutationRegistry) *StateStorage {
+	return &StateStorage{
+		registry: registry,
+	}
+}
+
+var ErrUnknownType = errors.New("unknown type")
+
+func (s *StateStorage) Load(r io.Reader, onMessage func(msg proto.Message)) error {
+	var err error
+	var evt *StorageEvent
+	scanner := bufio.NewScanner(r)
+	for err == nil {
+		evt, err = s.Read(scanner)
+		if err == nil {
+			onMessage(evt.Mutation)
+		}
+	}
+	if err == io.EOF {
+		return nil
+	}
+	return err
+}
+
+func (s *StateStorage) Append(io io.Writer, mutation proto.Message, timeStamp time.Time) error {
+	typeName, ok := s.registry.GetTypeName(mutation)
+	if !ok {
+		return ErrUnknownType
+	}
+	event := &StorageEvent{
+		Type:      typeName,
+		TimeStamp: timeStamp,
+		Mutation:  mutation,
+	}
+	jsonBytes, err := json.Marshal(event)
+	if err != nil {
+		return err
+	}
+	if _, err := io.Write(jsonBytes); err != nil {
+		return err
+	}
+	io.Write([]byte("\n"))
+	return nil
+}
+
+func (s *StateStorage) Read(r *bufio.Scanner) (*StorageEvent, error) {
+	var event rawEvent
+
+	if r.Scan() {
+		b := r.Bytes()
+		err := json.Unmarshal(b, &event)
+		if err != nil {
+			return nil, err
+		}
+		typeName := event.Type
+		mutation, ok := s.registry.Create(typeName)
+		if !ok {
+			return nil, ErrUnknownType
+		}
+		if err := json.Unmarshal(event.Mutation, mutation); err != nil {
+			return nil, err
+		}
+		return &StorageEvent{
+			Type:      typeName,
+			TimeStamp: event.TimeStamp,
+			Mutation:  mutation,
+		}, r.Err()
+	}
+	return nil, io.EOF
+}
--- a/pkg/discovery/discovery.go
+++ b/pkg/discovery/discovery.go
@@ -0,0 +1,73 @@
+package discovery
+
+import (
+	"context"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+	toolsWatch "k8s.io/client-go/tools/watch"
+)
+
+type K8sDiscovery struct {
+	ctx    context.Context
+	client *kubernetes.Clientset
+}
+
+func (k *K8sDiscovery) Discover() ([]string, error) {
+	return k.DiscoverInNamespace("")
+}
+func (k *K8sDiscovery) DiscoverInNamespace(namespace string) ([]string, error) {
+	pods, err := k.client.CoreV1().Pods(namespace).List(k.ctx, metav1.ListOptions{
+		LabelSelector: "actor-pool=cart",
+	})
+	if err != nil {
+		return nil, err
+	}
+	hosts := make([]string, 0, len(pods.Items))
+	for _, pod := range pods.Items {
+		hosts = append(hosts, pod.Status.PodIP)
+	}
+	return hosts, nil
+}
+
+type HostChange struct {
+	Host string
+	Type watch.EventType
+}
+
+func (k *K8sDiscovery) Watch() (<-chan HostChange, error) {
+	timeout := int64(30)
+	watcherFn := func(options metav1.ListOptions) (watch.Interface, error) {
+		return k.client.CoreV1().Pods("").Watch(k.ctx, metav1.ListOptions{
+			LabelSelector:  "actor-pool=cart",
+			TimeoutSeconds: &timeout,
+		})
+	}
+	watcher, err := toolsWatch.NewRetryWatcherWithContext(k.ctx, "1", &cache.ListWatch{WatchFunc: watcherFn})
+	if err != nil {
+		return nil, err
+	}
+	ch := make(chan HostChange)
+	go func() {
+		for event := range watcher.ResultChan() {
+
+			pod := event.Object.(*v1.Pod)
+			// log.Printf("pod change %+v", pod.Status.Phase == v1.PodRunning)
+			ch <- HostChange{
+				Host: pod.Status.PodIP,
+				Type: event.Type,
+			}
+		}
+	}()
+	return ch, nil
+}
+
+func NewK8sDiscovery(client *kubernetes.Clientset) *K8sDiscovery {
+	return &K8sDiscovery{
+		ctx:    context.Background(),
+		client: client,
+	}
+}
--- a/pkg/discovery/discovery_mock.go
+++ b/pkg/discovery/discovery_mock.go
@@ -0,0 +1,102 @@
+package discovery
+
+import (
+	"context"
+	"sync"
+
+	"k8s.io/apimachinery/pkg/watch"
+)
+
+// MockDiscovery is an in-memory Discovery implementation for tests.
+// It allows deterministic injection of host additions/removals without
+// depending on Kubernetes API machinery.
+type MockDiscovery struct {
+	mu      sync.RWMutex
+	hosts   []string
+	events  chan HostChange
+	closed  bool
+	started bool
+}
+
+// NewMockDiscovery creates a mock discovery with an initial host list.
+func NewMockDiscovery(initial []string) *MockDiscovery {
+	cp := make([]string, len(initial))
+	copy(cp, initial)
+	return &MockDiscovery{
+		hosts:  cp,
+		events: make(chan HostChange, 32),
+	}
+}
+
+// Discover returns the current host snapshot.
+func (m *MockDiscovery) Discover() ([]string, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	cp := make([]string, len(m.hosts))
+	copy(cp, m.hosts)
+	return cp, nil
+}
+
+// Watch returns a channel that will receive HostChange events.
+// The channel is buffered; AddHost/RemoveHost push events non-blockingly.
+func (m *MockDiscovery) Watch() (<-chan HostChange, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return nil, context.Canceled
+	}
+	m.started = true
+	return m.events, nil
+}
+
+// AddHost inserts a new host (if absent) and emits an Added event.
+func (m *MockDiscovery) AddHost(host string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	for _, h := range m.hosts {
+		if h == host {
+			return
+		}
+	}
+	m.hosts = append(m.hosts, host)
+	if m.started {
+		m.events <- HostChange{Host: host, Type: watch.Added}
+	}
+}
+
+// RemoveHost removes a host (if present) and emits a Deleted event.
+func (m *MockDiscovery) RemoveHost(host string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	idx := -1
+	for i, h := range m.hosts {
+		if h == host {
+			idx = i
+			break
+		}
+	}
+	if idx == -1 {
+		return
+	}
+	m.hosts = append(m.hosts[:idx], m.hosts[idx+1:]...)
+	if m.started {
+		m.events <- HostChange{Host: host, Type: watch.Deleted}
+	}
+}
+
+// Close closes the event channel (idempotent).
+func (m *MockDiscovery) Close() {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.closed {
+		return
+	}
+	m.closed = true
+	close(m.events)
+}
--- a/pkg/discovery/discovery_test.go
+++ b/pkg/discovery/discovery_test.go
@@ -0,0 +1,51 @@
+package discovery
+
+import (
+	"testing"
+	"time"
+
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func TestDiscovery(t *testing.T) {
+	config, err := clientcmd.BuildConfigFromFlags("", "/home/mats/.kube/config")
+	if err != nil {
+		t.Errorf("Error building config: %v", err)
+	}
+	client, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		t.Errorf("Error creating client: %v", err)
+	}
+	d := NewK8sDiscovery(client)
+	res, err := d.DiscoverInNamespace("")
+	if err != nil {
+		t.Errorf("Error discovering: %v", err)
+	}
+	if len(res) == 0 {
+		t.Errorf("Expected at least one host, got none")
+	}
+}
+
+func TestWatch(t *testing.T) {
+	config, err := clientcmd.BuildConfigFromFlags("", "/home/mats/.kube/config")
+	if err != nil {
+		t.Errorf("Error building config: %v", err)
+	}
+	client, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		t.Errorf("Error creating client: %v", err)
+	}
+	d := NewK8sDiscovery(client)
+	ch, err := d.Watch()
+	if err != nil {
+		t.Errorf("Error watching: %v", err)
+	}
+
+	select {
+	case m := <-ch:
+		t.Logf("Received watch %v", m)
+	case <-time.After(5 * time.Second):
+		t.Errorf("Timeout waiting for watch")
+	}
+}
--- a/pkg/discovery/types.go
+++ b/pkg/discovery/types.go
@@ -0,0 +1,6 @@
+package discovery
+
+type Discovery interface {
+	Discover() ([]string, error)
+	Watch() (<-chan HostChange, error)
+}
--- a/pkg/messages/control_plane.pb.go
+++ b/pkg/messages/control_plane.pb.go
@@ -0,0 +1,582 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.5
+// 	protoc        v5.29.3
+// source: control_plane.proto
+
+package messages
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Empty request placeholder (common pattern).
+type Empty struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Empty) Reset() {
+	*x = Empty{}
+	mi := &file_control_plane_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Empty) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Empty) ProtoMessage() {}
+
+func (x *Empty) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Empty.ProtoReflect.Descriptor instead.
+func (*Empty) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{0}
+}
+
+// Ping reply includes responding host and its current unix time (seconds).
+type PingReply struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	UnixTime      int64                  `protobuf:"varint,2,opt,name=unix_time,json=unixTime,proto3" json:"unix_time,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PingReply) Reset() {
+	*x = PingReply{}
+	mi := &file_control_plane_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PingReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PingReply) ProtoMessage() {}
+
+func (x *PingReply) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PingReply.ProtoReflect.Descriptor instead.
+func (*PingReply) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *PingReply) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *PingReply) GetUnixTime() int64 {
+	if x != nil {
+		return x.UnixTime
+	}
+	return 0
+}
+
+// NegotiateRequest carries the caller's full view of known hosts (including self).
+type NegotiateRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	KnownHosts    []string               `protobuf:"bytes,1,rep,name=known_hosts,json=knownHosts,proto3" json:"known_hosts,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NegotiateRequest) Reset() {
+	*x = NegotiateRequest{}
+	mi := &file_control_plane_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NegotiateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NegotiateRequest) ProtoMessage() {}
+
+func (x *NegotiateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NegotiateRequest.ProtoReflect.Descriptor instead.
+func (*NegotiateRequest) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *NegotiateRequest) GetKnownHosts() []string {
+	if x != nil {
+		return x.KnownHosts
+	}
+	return nil
+}
+
+// NegotiateReply returns the callee's healthy hosts (including itself).
+type NegotiateReply struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Hosts         []string               `protobuf:"bytes,1,rep,name=hosts,proto3" json:"hosts,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NegotiateReply) Reset() {
+	*x = NegotiateReply{}
+	mi := &file_control_plane_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NegotiateReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NegotiateReply) ProtoMessage() {}
+
+func (x *NegotiateReply) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NegotiateReply.ProtoReflect.Descriptor instead.
+func (*NegotiateReply) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *NegotiateReply) GetHosts() []string {
+	if x != nil {
+		return x.Hosts
+	}
+	return nil
+}
+
+// CartIdsReply returns the list of cart IDs (string form) currently owned locally.
+type ActorIdsReply struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Ids           []uint64               `protobuf:"varint,1,rep,packed,name=ids,proto3" json:"ids,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ActorIdsReply) Reset() {
+	*x = ActorIdsReply{}
+	mi := &file_control_plane_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ActorIdsReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActorIdsReply) ProtoMessage() {}
+
+func (x *ActorIdsReply) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActorIdsReply.ProtoReflect.Descriptor instead.
+func (*ActorIdsReply) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ActorIdsReply) GetIds() []uint64 {
+	if x != nil {
+		return x.Ids
+	}
+	return nil
+}
+
+// OwnerChangeAck retained as response type for Closing RPC (ConfirmOwner removed).
+type OwnerChangeAck struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Accepted      bool                   `protobuf:"varint,1,opt,name=accepted,proto3" json:"accepted,omitempty"`
+	Message       string                 `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OwnerChangeAck) Reset() {
+	*x = OwnerChangeAck{}
+	mi := &file_control_plane_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OwnerChangeAck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OwnerChangeAck) ProtoMessage() {}
+
+func (x *OwnerChangeAck) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OwnerChangeAck.ProtoReflect.Descriptor instead.
+func (*OwnerChangeAck) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *OwnerChangeAck) GetAccepted() bool {
+	if x != nil {
+		return x.Accepted
+	}
+	return false
+}
+
+func (x *OwnerChangeAck) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+// ClosingNotice notifies peers this host is terminating (so they can drop / re-resolve).
+type ClosingNotice struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ClosingNotice) Reset() {
+	*x = ClosingNotice{}
+	mi := &file_control_plane_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ClosingNotice) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClosingNotice) ProtoMessage() {}
+
+func (x *ClosingNotice) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClosingNotice.ProtoReflect.Descriptor instead.
+func (*ClosingNotice) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ClosingNotice) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+// OwnershipAnnounce broadcasts first-touch ownership claims for cart IDs.
+// First claim wins; receivers SHOULD NOT overwrite an existing different owner.
+type OwnershipAnnounce struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`       // announcing host
+	Ids           []uint64               `protobuf:"varint,2,rep,packed,name=ids,proto3" json:"ids,omitempty"` // newly claimed cart ids
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OwnershipAnnounce) Reset() {
+	*x = OwnershipAnnounce{}
+	mi := &file_control_plane_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OwnershipAnnounce) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OwnershipAnnounce) ProtoMessage() {}
+
+func (x *OwnershipAnnounce) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OwnershipAnnounce.ProtoReflect.Descriptor instead.
+func (*OwnershipAnnounce) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *OwnershipAnnounce) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *OwnershipAnnounce) GetIds() []uint64 {
+	if x != nil {
+		return x.Ids
+	}
+	return nil
+}
+
+// ExpiryAnnounce broadcasts that a host evicted the provided cart IDs.
+type ExpiryAnnounce struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Ids           []uint64               `protobuf:"varint,2,rep,packed,name=ids,proto3" json:"ids,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExpiryAnnounce) Reset() {
+	*x = ExpiryAnnounce{}
+	mi := &file_control_plane_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExpiryAnnounce) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExpiryAnnounce) ProtoMessage() {}
+
+func (x *ExpiryAnnounce) ProtoReflect() protoreflect.Message {
+	mi := &file_control_plane_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExpiryAnnounce.ProtoReflect.Descriptor instead.
+func (*ExpiryAnnounce) Descriptor() ([]byte, []int) {
+	return file_control_plane_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *ExpiryAnnounce) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *ExpiryAnnounce) GetIds() []uint64 {
+	if x != nil {
+		return x.Ids
+	}
+	return nil
+}
+
+var File_control_plane_proto protoreflect.FileDescriptor
+
+var file_control_plane_proto_rawDesc = string([]byte{
+	0x0a, 0x13, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x22,
+	0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x3c, 0x0a, 0x09, 0x50, 0x69, 0x6e, 0x67,
+	0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x6e, 0x69,
+	0x78, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x75, 0x6e,
+	0x69, 0x78, 0x54, 0x69, 0x6d, 0x65, 0x22, 0x33, 0x0a, 0x10, 0x4e, 0x65, 0x67, 0x6f, 0x74, 0x69,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x6b, 0x6e,
+	0x6f, 0x77, 0x6e, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0a, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x48, 0x6f, 0x73, 0x74, 0x73, 0x22, 0x26, 0x0a, 0x0e, 0x4e,
+	0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x14, 0x0a,
+	0x05, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x68, 0x6f,
+	0x73, 0x74, 0x73, 0x22, 0x21, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x6f, 0x72, 0x49, 0x64, 0x73, 0x52,
+	0x65, 0x70, 0x6c, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x04, 0x52, 0x03, 0x69, 0x64, 0x73, 0x22, 0x46, 0x0a, 0x0e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x43,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x41, 0x63, 0x6b, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x63, 0x63, 0x65,
+	0x70, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x61, 0x63, 0x63, 0x65,
+	0x70, 0x74, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x23,
+	0x0a, 0x0d, 0x43, 0x6c, 0x6f, 0x73, 0x69, 0x6e, 0x67, 0x4e, 0x6f, 0x74, 0x69, 0x63, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68,
+	0x6f, 0x73, 0x74, 0x22, 0x39, 0x0a, 0x11, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x68, 0x69, 0x70,
+	0x41, 0x6e, 0x6e, 0x6f, 0x75, 0x6e, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03,
+	0x69, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x04, 0x52, 0x03, 0x69, 0x64, 0x73, 0x22, 0x36,
+	0x0a, 0x0e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x41, 0x6e, 0x6e, 0x6f, 0x75, 0x6e, 0x63, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x68, 0x6f, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x04, 0x52, 0x03, 0x69, 0x64, 0x73, 0x32, 0x8d, 0x03, 0x0a, 0x0c, 0x43, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e, 0x65, 0x12, 0x2c, 0x0a, 0x04, 0x50, 0x69, 0x6e, 0x67, 0x12,
+	0x0f, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
+	0x1a, 0x13, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x50, 0x69, 0x6e, 0x67,
+	0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x41, 0x0a, 0x09, 0x4e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61,
+	0x74, 0x65, 0x12, 0x1a, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x4e, 0x65,
+	0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18,
+	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x4e, 0x65, 0x67, 0x6f, 0x74, 0x69,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x3c, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4c,
+	0x6f, 0x63, 0x61, 0x6c, 0x41, 0x63, 0x74, 0x6f, 0x72, 0x49, 0x64, 0x73, 0x12, 0x0f, 0x2e, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x17, 0x2e,
+	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x41, 0x63, 0x74, 0x6f, 0x72, 0x49, 0x64,
+	0x73, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x4a, 0x0a, 0x11, 0x41, 0x6e, 0x6e, 0x6f, 0x75, 0x6e,
+	0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x68, 0x69, 0x70, 0x12, 0x1b, 0x2e, 0x6d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x73, 0x68, 0x69, 0x70,
+	0x41, 0x6e, 0x6e, 0x6f, 0x75, 0x6e, 0x63, 0x65, 0x1a, 0x18, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x73, 0x2e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x41,
+	0x63, 0x6b, 0x12, 0x44, 0x0a, 0x0e, 0x41, 0x6e, 0x6e, 0x6f, 0x75, 0x6e, 0x63, 0x65, 0x45, 0x78,
+	0x70, 0x69, 0x72, 0x79, 0x12, 0x18, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e,
+	0x45, 0x78, 0x70, 0x69, 0x72, 0x79, 0x41, 0x6e, 0x6e, 0x6f, 0x75, 0x6e, 0x63, 0x65, 0x1a, 0x18,
+	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x43,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x41, 0x63, 0x6b, 0x12, 0x3c, 0x0a, 0x07, 0x43, 0x6c, 0x6f, 0x73,
+	0x69, 0x6e, 0x67, 0x12, 0x17, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x43,
+	0x6c, 0x6f, 0x73, 0x69, 0x6e, 0x67, 0x4e, 0x6f, 0x74, 0x69, 0x63, 0x65, 0x1a, 0x18, 0x2e, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x43, 0x68, 0x61,
+	0x6e, 0x67, 0x65, 0x41, 0x63, 0x6b, 0x42, 0x2e, 0x5a, 0x2c, 0x67, 0x69, 0x74, 0x2e, 0x74, 0x6f,
+	0x72, 0x6e, 0x62, 0x65, 0x72, 0x67, 0x2e, 0x6d, 0x65, 0x2f, 0x67, 0x6f, 0x2d, 0x63, 0x61, 0x72,
+	0x74, 0x2d, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x3b, 0x6d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
+
+var (
+	file_control_plane_proto_rawDescOnce sync.Once
+	file_control_plane_proto_rawDescData []byte
+)
+
+func file_control_plane_proto_rawDescGZIP() []byte {
+	file_control_plane_proto_rawDescOnce.Do(func() {
+		file_control_plane_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_control_plane_proto_rawDesc), len(file_control_plane_proto_rawDesc)))
+	})
+	return file_control_plane_proto_rawDescData
+}
+
+var file_control_plane_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_control_plane_proto_goTypes = []any{
+	(*Empty)(nil),             // 0: messages.Empty
+	(*PingReply)(nil),         // 1: messages.PingReply
+	(*NegotiateRequest)(nil),  // 2: messages.NegotiateRequest
+	(*NegotiateReply)(nil),    // 3: messages.NegotiateReply
+	(*ActorIdsReply)(nil),     // 4: messages.ActorIdsReply
+	(*OwnerChangeAck)(nil),    // 5: messages.OwnerChangeAck
+	(*ClosingNotice)(nil),     // 6: messages.ClosingNotice
+	(*OwnershipAnnounce)(nil), // 7: messages.OwnershipAnnounce
+	(*ExpiryAnnounce)(nil),    // 8: messages.ExpiryAnnounce
+}
+var file_control_plane_proto_depIdxs = []int32{
+	0, // 0: messages.ControlPlane.Ping:input_type -> messages.Empty
+	2, // 1: messages.ControlPlane.Negotiate:input_type -> messages.NegotiateRequest
+	0, // 2: messages.ControlPlane.GetLocalActorIds:input_type -> messages.Empty
+	7, // 3: messages.ControlPlane.AnnounceOwnership:input_type -> messages.OwnershipAnnounce
+	8, // 4: messages.ControlPlane.AnnounceExpiry:input_type -> messages.ExpiryAnnounce
+	6, // 5: messages.ControlPlane.Closing:input_type -> messages.ClosingNotice
+	1, // 6: messages.ControlPlane.Ping:output_type -> messages.PingReply
+	3, // 7: messages.ControlPlane.Negotiate:output_type -> messages.NegotiateReply
+	4, // 8: messages.ControlPlane.GetLocalActorIds:output_type -> messages.ActorIdsReply
+	5, // 9: messages.ControlPlane.AnnounceOwnership:output_type -> messages.OwnerChangeAck
+	5, // 10: messages.ControlPlane.AnnounceExpiry:output_type -> messages.OwnerChangeAck
+	5, // 11: messages.ControlPlane.Closing:output_type -> messages.OwnerChangeAck
+	6, // [6:12] is the sub-list for method output_type
+	0, // [0:6] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_control_plane_proto_init() }
+func file_control_plane_proto_init() {
+	if File_control_plane_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_control_plane_proto_rawDesc), len(file_control_plane_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_control_plane_proto_goTypes,
+		DependencyIndexes: file_control_plane_proto_depIdxs,
+		MessageInfos:      file_control_plane_proto_msgTypes,
+	}.Build()
+	File_control_plane_proto = out.File
+	file_control_plane_proto_goTypes = nil
+	file_control_plane_proto_depIdxs = nil
+}
--- a/pkg/messages/control_plane_grpc.pb.go
+++ b/pkg/messages/control_plane_grpc.pb.go
@@ -0,0 +1,327 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.29.3
+// source: control_plane.proto
+
+package messages
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ControlPlane_Ping_FullMethodName              = "/messages.ControlPlane/Ping"
+	ControlPlane_Negotiate_FullMethodName         = "/messages.ControlPlane/Negotiate"
+	ControlPlane_GetLocalActorIds_FullMethodName  = "/messages.ControlPlane/GetLocalActorIds"
+	ControlPlane_AnnounceOwnership_FullMethodName = "/messages.ControlPlane/AnnounceOwnership"
+	ControlPlane_AnnounceExpiry_FullMethodName    = "/messages.ControlPlane/AnnounceExpiry"
+	ControlPlane_Closing_FullMethodName           = "/messages.ControlPlane/Closing"
+)
+
+// ControlPlaneClient is the client API for ControlPlane service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ControlPlane defines cluster coordination and ownership operations.
+type ControlPlaneClient interface {
+	// Ping for liveness; lightweight health signal.
+	Ping(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*PingReply, error)
+	// Negotiate merges host views; used during discovery & convergence.
+	Negotiate(ctx context.Context, in *NegotiateRequest, opts ...grpc.CallOption) (*NegotiateReply, error)
+	// GetCartIds lists currently owned cart IDs on this node.
+	GetLocalActorIds(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ActorIdsReply, error)
+	// Ownership announcement: first-touch claim broadcast (idempotent; best-effort).
+	AnnounceOwnership(ctx context.Context, in *OwnershipAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error)
+	// Expiry announcement: drop remote ownership hints when local TTL expires.
+	AnnounceExpiry(ctx context.Context, in *ExpiryAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error)
+	// Closing announces graceful shutdown so peers can proactively adjust.
+	Closing(ctx context.Context, in *ClosingNotice, opts ...grpc.CallOption) (*OwnerChangeAck, error)
+}
+
+type controlPlaneClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewControlPlaneClient(cc grpc.ClientConnInterface) ControlPlaneClient {
+	return &controlPlaneClient{cc}
+}
+
+func (c *controlPlaneClient) Ping(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*PingReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PingReply)
+	err := c.cc.Invoke(ctx, ControlPlane_Ping_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) Negotiate(ctx context.Context, in *NegotiateRequest, opts ...grpc.CallOption) (*NegotiateReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(NegotiateReply)
+	err := c.cc.Invoke(ctx, ControlPlane_Negotiate_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) GetLocalActorIds(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ActorIdsReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ActorIdsReply)
+	err := c.cc.Invoke(ctx, ControlPlane_GetLocalActorIds_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) AnnounceOwnership(ctx context.Context, in *OwnershipAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(OwnerChangeAck)
+	err := c.cc.Invoke(ctx, ControlPlane_AnnounceOwnership_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) AnnounceExpiry(ctx context.Context, in *ExpiryAnnounce, opts ...grpc.CallOption) (*OwnerChangeAck, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(OwnerChangeAck)
+	err := c.cc.Invoke(ctx, ControlPlane_AnnounceExpiry_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *controlPlaneClient) Closing(ctx context.Context, in *ClosingNotice, opts ...grpc.CallOption) (*OwnerChangeAck, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(OwnerChangeAck)
+	err := c.cc.Invoke(ctx, ControlPlane_Closing_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ControlPlaneServer is the server API for ControlPlane service.
+// All implementations must embed UnimplementedControlPlaneServer
+// for forward compatibility.
+//
+// ControlPlane defines cluster coordination and ownership operations.
+type ControlPlaneServer interface {
+	// Ping for liveness; lightweight health signal.
+	Ping(context.Context, *Empty) (*PingReply, error)
+	// Negotiate merges host views; used during discovery & convergence.
+	Negotiate(context.Context, *NegotiateRequest) (*NegotiateReply, error)
+	// GetCartIds lists currently owned cart IDs on this node.
+	GetLocalActorIds(context.Context, *Empty) (*ActorIdsReply, error)
+	// Ownership announcement: first-touch claim broadcast (idempotent; best-effort).
+	AnnounceOwnership(context.Context, *OwnershipAnnounce) (*OwnerChangeAck, error)
+	// Expiry announcement: drop remote ownership hints when local TTL expires.
+	AnnounceExpiry(context.Context, *ExpiryAnnounce) (*OwnerChangeAck, error)
+	// Closing announces graceful shutdown so peers can proactively adjust.
+	Closing(context.Context, *ClosingNotice) (*OwnerChangeAck, error)
+	mustEmbedUnimplementedControlPlaneServer()
+}
+
+// UnimplementedControlPlaneServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedControlPlaneServer struct{}
+
+func (UnimplementedControlPlaneServer) Ping(context.Context, *Empty) (*PingReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Ping not implemented")
+}
+func (UnimplementedControlPlaneServer) Negotiate(context.Context, *NegotiateRequest) (*NegotiateReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Negotiate not implemented")
+}
+func (UnimplementedControlPlaneServer) GetLocalActorIds(context.Context, *Empty) (*ActorIdsReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetLocalActorIds not implemented")
+}
+func (UnimplementedControlPlaneServer) AnnounceOwnership(context.Context, *OwnershipAnnounce) (*OwnerChangeAck, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AnnounceOwnership not implemented")
+}
+func (UnimplementedControlPlaneServer) AnnounceExpiry(context.Context, *ExpiryAnnounce) (*OwnerChangeAck, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method AnnounceExpiry not implemented")
+}
+func (UnimplementedControlPlaneServer) Closing(context.Context, *ClosingNotice) (*OwnerChangeAck, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Closing not implemented")
+}
+func (UnimplementedControlPlaneServer) mustEmbedUnimplementedControlPlaneServer() {}
+func (UnimplementedControlPlaneServer) testEmbeddedByValue()                      {}
+
+// UnsafeControlPlaneServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ControlPlaneServer will
+// result in compilation errors.
+type UnsafeControlPlaneServer interface {
+	mustEmbedUnimplementedControlPlaneServer()
+}
+
+func RegisterControlPlaneServer(s grpc.ServiceRegistrar, srv ControlPlaneServer) {
+	// If the following call pancis, it indicates UnimplementedControlPlaneServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ControlPlane_ServiceDesc, srv)
+}
+
+func _ControlPlane_Ping_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).Ping(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_Ping_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).Ping(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_Negotiate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(NegotiateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).Negotiate(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_Negotiate_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).Negotiate(ctx, req.(*NegotiateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_GetLocalActorIds_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).GetLocalActorIds(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_GetLocalActorIds_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).GetLocalActorIds(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_AnnounceOwnership_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(OwnershipAnnounce)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).AnnounceOwnership(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_AnnounceOwnership_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).AnnounceOwnership(ctx, req.(*OwnershipAnnounce))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_AnnounceExpiry_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExpiryAnnounce)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).AnnounceExpiry(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_AnnounceExpiry_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).AnnounceExpiry(ctx, req.(*ExpiryAnnounce))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ControlPlane_Closing_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ClosingNotice)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ControlPlaneServer).Closing(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ControlPlane_Closing_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ControlPlaneServer).Closing(ctx, req.(*ClosingNotice))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ControlPlane_ServiceDesc is the grpc.ServiceDesc for ControlPlane service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ControlPlane_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "messages.ControlPlane",
+	HandlerType: (*ControlPlaneServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Ping",
+			Handler:    _ControlPlane_Ping_Handler,
+		},
+		{
+			MethodName: "Negotiate",
+			Handler:    _ControlPlane_Negotiate_Handler,
+		},
+		{
+			MethodName: "GetLocalActorIds",
+			Handler:    _ControlPlane_GetLocalActorIds_Handler,
+		},
+		{
+			MethodName: "AnnounceOwnership",
+			Handler:    _ControlPlane_AnnounceOwnership_Handler,
+		},
+		{
+			MethodName: "AnnounceExpiry",
+			Handler:    _ControlPlane_AnnounceExpiry_Handler,
+		},
+		{
+			MethodName: "Closing",
+			Handler:    _ControlPlane_Closing_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "control_plane.proto",
+}
--- a/pkg/messages/messages.pb.go
+++ b/pkg/messages/messages.pb.go
--- a/pkg/proxy/remotehost.go
+++ b/pkg/proxy/remotehost.go
@@ -0,0 +1,187 @@
+package proxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"time"
+
+	messages "git.tornberg.me/go-cart-actor/pkg/messages"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// RemoteHost mirrors the lightweight controller used for remote node
+// interaction.
+type RemoteHost struct {
+	host          string
+	httpBase      string
+	conn          *grpc.ClientConn
+	transport     *http.Transport
+	client        *http.Client
+	controlClient messages.ControlPlaneClient
+	missedPings   int
+}
+
+func NewRemoteHost(host string) (*RemoteHost, error) {
+
+	target := fmt.Sprintf("%s:1337", host)
+
+	conn, err := grpc.NewClient(target, grpc.WithTransportCredentials(insecure.NewCredentials()))
+
+	if err != nil {
+		log.Printf("AddRemote: dial %s failed: %v", target, err)
+		return nil, err
+	}
+
+	controlClient := messages.NewControlPlaneClient(conn)
+
+	transport := &http.Transport{
+		MaxIdleConns:        100,
+		MaxIdleConnsPerHost: 100,
+		DisableKeepAlives:   false,
+		IdleConnTimeout:     120 * time.Second,
+	}
+	client := &http.Client{Transport: transport, Timeout: 10 * time.Second}
+
+	return &RemoteHost{
+		host:          host,
+		httpBase:      fmt.Sprintf("http://%s:8080/cart", host),
+		conn:          conn,
+		transport:     transport,
+		client:        client,
+		controlClient: controlClient,
+		missedPings:   0,
+	}, nil
+}
+
+func (h *RemoteHost) Name() string {
+	return h.host
+}
+
+func (h *RemoteHost) Close() error {
+	if h.conn != nil {
+		h.conn.Close()
+	}
+	return nil
+}
+
+func (h *RemoteHost) Ping() bool {
+	var err error = errors.ErrUnsupported
+	for err != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		_, err = h.controlClient.Ping(ctx, &messages.Empty{})
+		cancel()
+		if err != nil {
+			h.missedPings++
+			log.Printf("Ping %s failed (%d) %v", h.host, h.missedPings, err)
+		}
+		if !h.IsHealthy() {
+			return false
+		}
+		time.Sleep(time.Millisecond * 200)
+	}
+
+	h.missedPings = 0
+	return true
+}
+
+func (h *RemoteHost) Negotiate(knownHosts []string) ([]string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	resp, err := h.controlClient.Negotiate(ctx, &messages.NegotiateRequest{
+		KnownHosts: knownHosts,
+	})
+	if err != nil {
+		h.missedPings++
+		log.Printf("Negotiate %s failed: %v", h.host, err)
+		return nil, err
+	}
+	h.missedPings = 0
+	return resp.Hosts, nil
+}
+
+func (h *RemoteHost) GetActorIds() []uint64 {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	reply, err := h.controlClient.GetLocalActorIds(ctx, &messages.Empty{})
+	if err != nil {
+		log.Printf("Init remote %s: GetCartIds error: %v", h.host, err)
+		h.missedPings++
+		return []uint64{}
+	}
+	return reply.GetIds()
+}
+
+func (h *RemoteHost) AnnounceOwnership(ownerHost string, uids []uint64) {
+	_, err := h.controlClient.AnnounceOwnership(context.Background(), &messages.OwnershipAnnounce{
+		Host: ownerHost,
+		Ids:  uids,
+	})
+	if err != nil {
+		log.Printf("ownership announce to %s failed: %v", h.host, err)
+		h.missedPings++
+		return
+	}
+	h.missedPings = 0
+}
+
+func (h *RemoteHost) AnnounceExpiry(uids []uint64) {
+	_, err := h.controlClient.AnnounceExpiry(context.Background(), &messages.ExpiryAnnounce{
+		Host: h.host,
+		Ids:  uids,
+	})
+	if err != nil {
+		log.Printf("expiry announce to %s failed: %v", h.host, err)
+		h.missedPings++
+		return
+	}
+	h.missedPings = 0
+}
+
+func (h *RemoteHost) Proxy(id uint64, w http.ResponseWriter, r *http.Request) (bool, error) {
+	target := fmt.Sprintf("%s%s", h.httpBase, r.URL.RequestURI())
+
+	req, err := http.NewRequestWithContext(r.Context(), r.Method, target, r.Body)
+	if err != nil {
+		http.Error(w, "proxy build error", http.StatusBadGateway)
+		return false, err
+	}
+	//r.Body = io.NopCloser(bytes.NewReader(bodyCopy))
+	req.Header.Set("X-Forwarded-Host", r.Host)
+
+	for k, v := range r.Header {
+		for _, vv := range v {
+			req.Header.Add(k, vv)
+		}
+	}
+	res, err := h.client.Do(req)
+	if err != nil {
+		http.Error(w, "proxy request error", http.StatusBadGateway)
+		return false, err
+	}
+	defer res.Body.Close()
+	for k, v := range res.Header {
+		for _, vv := range v {
+			w.Header().Add(k, vv)
+		}
+	}
+	w.Header().Set("X-Cart-Owner-Routed", "true")
+	if res.StatusCode >= 200 && res.StatusCode <= 299 {
+		w.WriteHeader(res.StatusCode)
+		_, copyErr := io.Copy(w, res.Body)
+		if copyErr != nil {
+			return true, copyErr
+		}
+		return true, nil
+	}
+	return false, fmt.Errorf("proxy response status %d", res.StatusCode)
+}
+
+func (r *RemoteHost) IsHealthy() bool {
+	return r.missedPings < 3
+}
--- a/pkg/voucher/parser.go
+++ b/pkg/voucher/parser.go
@@ -0,0 +1,347 @@
+package voucher
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"unicode"
+)
+
+/*
+Package voucher - rule parser
+
+A lightweight parser for voucher rule expressions.
+
+Supported rule kinds (case-insensitive keywords):
+
+  sku=SKU1|SKU2|SKU3
+    - At least one of the listed SKUs must be present in the cart.
+
+  category=CatA|CatB|CatC
+    - At least one of the listed categories must be present.
+
+  min_total>=12345
+    - Cart total (Inc VAT) must be at least this value (int64).
+
+  min_item_price>=5000
+    - At least one individual item (Inc VAT single unit price) must be at least this value (int64).
+
+Rule list grammar (simplified):
+  rules := rule (sep rule)*
+  rule  := (sku|category) '=' valueList
+         | (min_total|min_item_price) comparator number
+  valueList := value ('|' value)*
+  comparator := '>='   (only comparator currently supported for numeric rules)
+  sep := ';' | ',' | newline
+
+Whitespace is ignored around tokens.
+
+Example:
+  sku=ABC123|XYZ999; category=Shoes|Bags
+  min_total>=10000
+  min_item_price>=2500, category=Accessories
+
+Parsing returns a RuleSet which can later be evaluated against a generic context.
+The evaluation context uses simple Item abstractions to avoid tight coupling with
+the cart implementation (which currently lives under cmd/cart and cannot be
+imported due to being in package main).
+
+This is intentionally conservative and extensible:
+  * Adding new rule kinds: extend RuleKind constants, add parse + evaluate logic.
+  * Supporting new operators: extend numeric rule parsing & evaluation.
+*/
+
+var (
+	// ErrEmptyExpression is returned when the input string has only whitespace.
+	ErrEmptyExpression = errors.New("voucher: empty rule expression")
+	// ErrInvalidRule indicates a syntactic or semantic issue with a single rule fragment.
+	ErrInvalidRule = errors.New("voucher: invalid rule")
+)
+
+// RuleKind enumerates supported rule kinds.
+type RuleKind string
+
+const (
+	RuleSku          RuleKind = "sku"
+	RuleCategory     RuleKind = "category"
+	RuleMinTotal     RuleKind = "min_total"
+	RuleMinItemPrice RuleKind = "min_item_price"
+)
+
+// ruleCondition represents a single, parsed rule.
+type ruleCondition struct {
+	Kind       RuleKind
+	StringVals []string // For sku / category multi-value list
+	MinValue   *int64   // For numeric threshold rules
+	// Operator reserved for future (e.g., >, >=, ==). Currently always ">=" for numeric kinds.
+	Operator string
+}
+
+// RuleSet groups multiple rule conditions (logical AND).
+// All conditions must pass for Applies() to return true.
+type RuleSet struct {
+	Conditions []ruleCondition
+	Source     string // original, trimmed source string
+}
+
+// Item is a minimal abstraction for evaluation (decoupled from cart domain structs).
+type Item struct {
+	Sku       string
+	Category  string
+	UnitPrice int64 // Inc VAT (single unit)
+}
+
+// EvalContext bundles cart-like data necessary for evaluation.
+type EvalContext struct {
+	Items        []Item
+	CartTotalInc int64
+}
+
+// Applies returns true if all rule conditions pass for the context.
+func (rs *RuleSet) Applies(ctx EvalContext) bool {
+	for _, c := range rs.Conditions {
+		switch c.Kind {
+		case RuleSku:
+			if !anyItem(ctx.Items, func(it Item) bool {
+				return containsFold(c.StringVals, it.Sku)
+			}) {
+				return false
+			}
+		case RuleCategory:
+			if !anyItem(ctx.Items, func(it Item) bool {
+				return containsFold(c.StringVals, it.Category)
+			}) {
+				return false
+			}
+		case RuleMinTotal:
+			if c.MinValue == nil || ctx.CartTotalInc < *c.MinValue {
+				return false
+			}
+		case RuleMinItemPrice:
+			if c.MinValue == nil {
+				return false
+			}
+			if !anyItem(ctx.Items, func(it Item) bool {
+				return it.UnitPrice >= *c.MinValue
+			}) {
+				return false
+			}
+		default:
+			// Unknown kinds fail closed to avoid granting unintended discounts.
+			return false
+		}
+	}
+	return true
+}
+
+// anyItem returns true if predicate matches any item.
+func anyItem(items []Item, pred func(Item) bool) bool {
+	for _, it := range items {
+		if pred(it) {
+			return true
+		}
+	}
+	return false
+}
+
+// ParseRules parses a rule expression into a RuleSet.
+func ParseRules(input string) (*RuleSet, error) {
+	trimmed := strings.TrimSpace(input)
+	if trimmed == "" {
+		return nil, ErrEmptyExpression
+	}
+
+	fragments := splitRuleFragments(trimmed)
+	if len(fragments) == 0 {
+		return nil, ErrInvalidRule
+	}
+
+	var conditions []ruleCondition
+	for _, frag := range fragments {
+		if frag == "" {
+			continue
+		}
+		c, err := parseFragment(frag)
+		if err != nil {
+			return nil, fmt.Errorf("%w: %s (%v)", ErrInvalidRule, frag, err)
+		}
+		conditions = append(conditions, c)
+	}
+
+	if len(conditions) == 0 {
+		return nil, ErrInvalidRule
+	}
+
+	return &RuleSet{
+		Conditions: conditions,
+		Source:     trimmed,
+	}, nil
+}
+
+// splitRuleFragments splits on ; , or newline, while respecting basic structure.
+func splitRuleFragments(s string) []string {
+	// Normalize line endings
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+
+	// We allow separators: newline, semicolon, comma.
+	seps := func(r rune) bool {
+		return r == ';' || r == '\n' || r == ','
+	}
+	raw := strings.FieldsFunc(s, seps)
+	out := make([]string, 0, len(raw))
+	for _, f := range raw {
+		t := strings.TrimSpace(f)
+		if t != "" {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
+// parseFragment parses an individual rule fragment.
+func parseFragment(frag string) (ruleCondition, error) {
+	lower := strings.ToLower(frag)
+
+	// Numeric rules have form: <kind> >= number
+	if strings.HasPrefix(lower, string(RuleMinTotal)) ||
+		strings.HasPrefix(lower, string(RuleMinItemPrice)) {
+
+		return parseNumericRule(frag)
+	}
+
+	// Key=Value list rules (sku / category).
+	if i := strings.Index(frag, "="); i > 0 {
+		key := strings.TrimSpace(frag[:i])
+		valPart := strings.TrimSpace(frag[i+1:])
+		if key == "" || valPart == "" {
+			return ruleCondition{}, errors.New("empty key/value")
+		}
+		kind := RuleKind(strings.ToLower(key))
+		switch kind {
+		case RuleSku, RuleCategory:
+			values := splitAndClean(valPart, "|")
+			if len(values) == 0 {
+				return ruleCondition{}, errors.New("empty value list")
+			}
+			return ruleCondition{
+				Kind:       kind,
+				StringVals: values,
+			}, nil
+		default:
+			return ruleCondition{}, fmt.Errorf("unsupported key '%s'", key)
+		}
+	}
+
+	return ruleCondition{}, fmt.Errorf("unrecognized fragment '%s'", frag)
+}
+
+func parseNumericRule(frag string) (ruleCondition, error) {
+	// Support only '>=' for now.
+	var kind RuleKind
+	var rest string
+
+	fragTrim := strings.TrimSpace(frag)
+
+	switch {
+	case strings.HasPrefix(strings.ToLower(fragTrim), string(RuleMinTotal)):
+		kind = RuleMinTotal
+		rest = strings.TrimSpace(fragTrim[len(RuleMinTotal):])
+	case strings.HasPrefix(strings.ToLower(fragTrim), string(RuleMinItemPrice)):
+		kind = RuleMinItemPrice
+		rest = strings.TrimSpace(fragTrim[len(RuleMinItemPrice):])
+	default:
+		return ruleCondition{}, fmt.Errorf("unknown numeric rule '%s'", frag)
+	}
+
+	// Expect operator and number (>= <number>)
+	rest = stripLeadingSpace(rest)
+	if !strings.HasPrefix(rest, ">=") {
+		return ruleCondition{}, fmt.Errorf("expected '>=' in '%s'", frag)
+	}
+	numStr := strings.TrimSpace(rest[2:])
+	if numStr == "" {
+		return ruleCondition{}, fmt.Errorf("missing numeric value in '%s'", frag)
+	}
+
+	value, err := strconv.ParseInt(numStr, 10, 64)
+	if err != nil {
+		return ruleCondition{}, fmt.Errorf("invalid number '%s': %v", numStr, err)
+	}
+	if value < 0 {
+		return ruleCondition{}, fmt.Errorf("negative threshold %d", value)
+	}
+
+	return ruleCondition{
+		Kind:     kind,
+		MinValue: &value,
+		Operator: ">=",
+	}, nil
+}
+
+func stripLeadingSpace(s string) string {
+	for len(s) > 0 && unicode.IsSpace(rune(s[0])) {
+		s = s[1:]
+	}
+	return s
+}
+
+func splitAndClean(s string, sep string) []string {
+	raw := strings.Split(s, sep)
+	out := make([]string, 0, len(raw))
+	for _, r := range raw {
+		t := strings.TrimSpace(r)
+		if t != "" {
+			out = append(out, t)
+		}
+	}
+	return out
+}
+
+func containsFold(list []string, candidate string) bool {
+	for _, v := range list {
+		if strings.EqualFold(v, candidate) {
+			return true
+		}
+	}
+	return false
+}
+
+// Describe returns a human-friendly summary of the parsed rule set.
+func (rs *RuleSet) Describe() string {
+	if rs == nil {
+		return "<nil>"
+	}
+	var parts []string
+	for _, c := range rs.Conditions {
+		switch c.Kind {
+		case RuleSku, RuleCategory:
+			parts = append(parts, fmt.Sprintf("%s in (%s)", c.Kind, strings.Join(c.StringVals, "|")))
+		case RuleMinTotal, RuleMinItemPrice:
+			if c.MinValue != nil {
+				parts = append(parts, fmt.Sprintf("%s %s %d", c.Kind, c.OperatorOr(">="), *c.MinValue))
+			}
+		default:
+			parts = append(parts, fmt.Sprintf("unknown(%s)", c.Kind))
+		}
+	}
+	return strings.Join(parts, " AND ")
+}
+
+func (c ruleCondition) OperatorOr(def string) string {
+	if c.Operator == "" {
+		return def
+	}
+	return c.Operator
+}
+
+// --- Convenience helpers for incremental adoption ---
+
+// MustParseRules panics on parse error (useful in tests or static initialization).
+func MustParseRules(expr string) *RuleSet {
+	rs, err := ParseRules(expr)
+	if err != nil {
+		panic(err)
+	}
+	return rs
+}
--- a/pkg/voucher/parser_test.go
+++ b/pkg/voucher/parser_test.go
@@ -0,0 +1,179 @@
+package voucher
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestParseRules_SimpleSku(t *testing.T) {
+	rs, err := ParseRules("sku=ABC123|XYZ999|def456")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(rs.Conditions) != 1 {
+		t.Fatalf("expected 1 condition got %d", len(rs.Conditions))
+	}
+	c := rs.Conditions[0]
+	if c.Kind != RuleSku {
+		t.Fatalf("expected kind sku got %s", c.Kind)
+	}
+	if len(c.StringVals) != 3 {
+		t.Fatalf("expected 3 sku values got %d", len(c.StringVals))
+	}
+	want := []string{"ABC123", "XYZ999", "def456"}
+	for i, v := range want {
+		if c.StringVals[i] != v {
+			t.Fatalf("expected sku[%d]=%s got %s", i, v, c.StringVals[i])
+		}
+	}
+}
+
+func TestParseRules_CategoryAndSkuMixedSeparators(t *testing.T) {
+	rs, err := ParseRules("  category=Shoes|Bags ; sku= A | B , min_total>=1000\nmin_item_price>=500")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(rs.Conditions) != 4 {
+		t.Fatalf("expected 4 conditions got %d", len(rs.Conditions))
+	}
+
+	kinds := []RuleKind{RuleCategory, RuleSku, RuleMinTotal, RuleMinItemPrice}
+	for i, k := range kinds {
+		if rs.Conditions[i].Kind != k {
+			t.Fatalf("expected condition[%d] kind %s got %s", i, k, rs.Conditions[i].Kind)
+		}
+	}
+
+	// Validate numeric thresholds
+	if rs.Conditions[2].MinValue == nil || *rs.Conditions[2].MinValue != 1000 {
+		t.Fatalf("expected min_total>=1000 got %+v", rs.Conditions[2])
+	}
+	if rs.Conditions[3].MinValue == nil || *rs.Conditions[3].MinValue != 500 {
+		t.Fatalf("expected min_item_price>=500 got %+v", rs.Conditions[3])
+	}
+}
+
+func TestParseRules_Empty(t *testing.T) {
+	_, err := ParseRules("   \n  ")
+	if !errors.Is(err, ErrEmptyExpression) {
+		t.Fatalf("expected ErrEmptyExpression got %v", err)
+	}
+}
+
+func TestParseRules_Invalid(t *testing.T) {
+	_, err := ParseRules("unknown=foo")
+	if err == nil {
+		t.Fatal("expected error for unknown key")
+	}
+	_, err = ParseRules("min_total>100") // wrong operator
+	if err == nil {
+		t.Fatal("expected error for wrong operator")
+	}
+	_, err = ParseRules("min_total>=") // missing value
+	if err == nil {
+		t.Fatal("expected error for missing numeric value")
+	}
+}
+
+func TestRuleSet_Applies(t *testing.T) {
+	rs := MustParseRules("sku=ABC123|XYZ999; category=Shoes|min_total>=10000; min_item_price>=3000")
+
+	ctx := EvalContext{
+		Items: []Item{
+			{Sku: "ABC123", Category: "Shoes", UnitPrice: 2500},
+			{Sku: "FFF000", Category: "Accessories", UnitPrice: 3200},
+		},
+		CartTotalInc: 12000,
+	}
+
+	if !rs.Applies(ctx) {
+		t.Fatalf("expected rules to apply")
+	}
+
+	// Fail due to missing sku/category
+	ctx2 := EvalContext{
+		Items: []Item{
+			{Sku: "NOPE", Category: "Different", UnitPrice: 4000},
+		},
+		CartTotalInc: 20000,
+	}
+	if rs.Applies(ctx2) {
+		t.Fatalf("expected rules NOT to apply (sku/category mismatch)")
+	}
+
+	// Fail due to min_total
+	ctx3 := EvalContext{
+		Items: []Item{
+			{Sku: "ABC123", Category: "Shoes", UnitPrice: 2500},
+			{Sku: "FFF000", Category: "Accessories", UnitPrice: 3200},
+		},
+		CartTotalInc: 9000,
+	}
+	if rs.Applies(ctx3) {
+		t.Fatalf("expected rules NOT to apply (min_total not reached)")
+	}
+
+	// Fail due to min_item_price (no item >=3000)
+	ctx4 := EvalContext{
+		Items: []Item{
+			{Sku: "ABC123", Category: "Shoes", UnitPrice: 2500},
+			{Sku: "FFF000", Category: "Accessories", UnitPrice: 2800},
+		},
+		CartTotalInc: 15000,
+	}
+	if rs.Applies(ctx4) {
+		t.Fatalf("expected rules NOT to apply (min_item_price not satisfied)")
+	}
+}
+
+func TestRuleSet_Applies_CaseInsensitive(t *testing.T) {
+	rs := MustParseRules("SKU=abc123|xyz999; CATEGORY=Shoes")
+	ctx := EvalContext{
+		Items: []Item{
+			{Sku: "AbC123", Category: "shoes", UnitPrice: 1000},
+		},
+		CartTotalInc: 1000,
+	}
+	if !rs.Applies(ctx) {
+		t.Fatalf("expected rules to apply (case-insensitive match)")
+	}
+}
+
+func TestDescribe(t *testing.T) {
+	rs := MustParseRules("sku=A|B|min_total>=500")
+	desc := rs.Describe()
+	// Loose assertions to avoid over-specification
+	if desc == "" {
+		t.Fatalf("expected non-empty description")
+	}
+	if !(contains(desc, "sku") && contains(desc, "min_total")) {
+		t.Fatalf("description missing expected parts: %s", desc)
+	}
+}
+
+func contains(haystack, needle string) bool {
+	return len(haystack) >= len(needle) && indexOf(haystack, needle) >= 0
+}
+
+// Simple substring search (avoid importing strings to show intent explicitly here)
+func indexOf(s, sub string) int {
+outer:
+	for i := 0; i+len(sub) <= len(s); i++ {
+		for j := 0; j < len(sub); j++ {
+			if s[i+j] != sub[j] {
+				continue outer
+			}
+		}
+		return i
+	}
+	return -1
+}
+
+func TestMustParseRules_Panics(t *testing.T) {
+	defer func() {
+		if r := recover(); r == nil {
+			t.Fatalf("expected panic for invalid expression")
+		}
+	}()
+	MustParseRules("~~ totally invalid ~~")
+}
--- a/pkg/voucher/service.go
+++ b/pkg/voucher/service.go
@@ -0,0 +1,39 @@
+package voucher
+
+import (
+	"errors"
+
+	"git.tornberg.me/go-cart-actor/pkg/messages"
+)
+
+type Rule struct {
+	Type  string `json:"type"`
+	Value int64  `json:"value"`
+}
+
+type Voucher struct {
+	Code     string `json:"code"`
+	Value    int64  `json:"discount"`
+	TaxValue int64  `json:"taxValue"`
+	TaxRate  int    `json:"taxRate"`
+	rules    []Rule `json:"rules"`
+}
+
+type Service struct {
+	// Add fields here
+
+}
+
+var ErrInvalidCode = errors.New("invalid vouchercode")
+
+func (s *Service) GetVoucher(code string) (*messages.AddVoucher, error) {
+	if code == "" {
+		return nil, ErrInvalidCode
+	}
+	value := int64(250_00)
+	return &messages.AddVoucher{
+		Code:         code,
+		Value:        value,
+		VoucherRules: make([]*messages.VoucherRule, 0),
+	}, nil
+}