separate server run bindings from deployment targets

platform/service/control.go

@@ -29,6 +29,9 @@ func (svc *CoreService) RegisterRunHello(hello domain.RunControlHello) (domain.R
 		return domain.RunControlHelloResult{}, err
 	}
 	if hasComponentAuthIdentity(hello) {
+		if err := svc.validateDedicatedRunHello(hello); err != nil {
+			return domain.RunControlHelloResult{}, err
+		}
 		auth, err := svc.AuthenticateComponent(domain.ComponentAuthenticationRequest{
 			ServerInstanceID: hello.ServerInstanceID,
 			ComponentKind:    hello.ComponentKind,
@@ -122,6 +125,32 @@ func (svc *CoreService) RegisterRunHello(hello domain.RunControlHello) (domain.R
 	}), nil
 }
 
+func (svc *CoreService) validateDedicatedRunHello(hello domain.RunControlHello) error {
+	if hello.ComponentKind != domain.DistributionComponentRun {
+		return validationError("component-authenticated run hello must use the run component")
+	}
+	instance, err := svc.store.ServerInstances().Get(hello.ServerInstanceID)
+	if err != nil {
+		return err
+	}
+	if strings.TrimSpace(instance.DeploymentTargetID) == "" {
+		return nil // legacy Run registrations keep their historical endpoint contract.
+	}
+	if hello.PluginID != instance.PluginID || hello.RunEndpointID != instance.RunEndpointID {
+		return validationError("run endpoint identity does not match the server binding")
+	}
+	instances, err := svc.store.ServerInstances().List(domain.ServerInstanceFilter{RunEndpointID: hello.RunEndpointID})
+	if err != nil {
+		return err
+	}
+	for _, candidate := range instances {
+		if candidate.ID != instance.ID && candidate.State != domain.ServerInstanceStateDeleted {
+			return validationError("run endpoint is already bound to another server")
+		}
+	}
+	return nil
+}
+
 func hasComponentAuthIdentity(hello domain.RunControlHello) bool {
 	return hello.ServerInstanceID != "" || hello.PluginID != "" || hello.ComponentKind != "" || hello.ComponentKey != "" || hello.KeyGeneration != 0
 }
@@ -214,6 +243,15 @@ func (svc *CoreService) revokeRunControlSessionForInstance(instance domain.Serve
 	if strings.TrimSpace(instance.RunEndpointID) == "" {
 		return nil
 	}
+	instances, err := svc.store.ServerInstances().List(domain.ServerInstanceFilter{RunEndpointID: instance.RunEndpointID})
+	if err != nil {
+		return err
+	}
+	for _, candidate := range instances {
+		if candidate.ID != instance.ID && candidate.State != domain.ServerInstanceStateDeleted {
+			return nil
+		}
+	}
 	svc.controlMu.Lock()
 	defer svc.controlMu.Unlock()