# Service generation rebinding (K1391–K1395)

The registry owns a name grant, its optional endpoint binding, and the
identity recorded in each client session. A `PublisherId` consists of a slot
and generation supplied by the trusted process boundary. A session records
the full binding, including that identity. A client may use a session only
while it exactly matches the current binding.

The trusted lifecycle owner calls `rebind_stopped(name, stopped, replacement)`
after the old process has stopped and its endpoint resources are revoked.
The operation requires the current grant to belong to `stopped` and the
replacement identity to differ. It returns the old binding for lifecycle
accounting, clears the endpoint, and changes the grant to `replacement` in
one bounded operation. The new publisher may then publish an endpoint; a
client opens a new session. The old session returns `StaleSession` even if
the new process reuses the same slot or endpoint number.

Wrong old identity, unchanged replacement identity, or unknown name return
`Access` or `NotFound` before any state change. A stale session lookup does
not change the grant, binding, or resource count. This module does not own
kernel process handles or prove that the old process stopped; K1395 must
bind the lifecycle call to observed real guest process identities and show
the client obtaining a new session. There is no `unsafe` operation in the
model. Rebinding is not an untrusted message operation.