@zlink-systems/framework 0.10.0

package/dist/runtime/host/service-relocation-host-runtime.js

@@ -0,0 +1,4113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceRelocationDataLostError = exports.ZLinkHostServiceRelocationRuntime = exports.ZLinkRelocationStateIncompatibleError = void 0;
+exports.decodeQueuedHandoffPacket = decodeQueuedHandoffPacket;
+exports.createServiceRelocationId = createServiceRelocationId;
+exports.relocationFailedFailureCode = relocationFailedFailureCode;
+exports.encodeHandoffQueuedMessages = encodeHandoffQueuedMessages;
+const node_crypto_1 = require("node:crypto");
+const runtime_values_1 = require("../backend/runtime-values");
+const contracts_1 = require("../../contracts");
+const Options_1 = require("../../contracts/Locations/Options");
+const framework_errors_internal_1 = require("../framework-errors-internal");
+const service_runtime_contracts_1 = require("../foundation/service-runtime-contracts");
+const routing_id_1 = require("../routing-id");
+const service_wire_m6a_codec_1 = require("../foundation/service-wire-m6a-codec");
+const service_relocation_runtime_1 = require("../foundation/service-relocation-runtime");
+const relocation_direct_transfer_1 = require("./relocation-direct-transfer");
+const relocation_state_adapter_1 = require("./relocation-state-adapter");
+const service_relocation_coordinator_1 = require("../foundation/service-relocation-coordinator");
+const service_maintenance_runtime_1 = require("../foundation/service-maintenance-runtime");
+const service_relocation_object_owner_1 = require("../foundation/service-relocation-object-owner");
+const service_relocation_aggregate_committer_1 = require("../foundation/service-relocation-aggregate-committer");
+const spot_provider_1 = require("../spots/spot-provider");
+const actor_runtime_state_1 = require("../actors/actor-runtime-state");
+const actor_handoff_1 = require("../actors/actor-handoff");
+const spot_remote_codec_1 = require("../spots/spot-remote-codec");
+const actor_authority_publication_1 = require("../actors/actor-authority-publication");
+const service_authority_payload_codec_1 = require("../foundation/service-authority-payload-codec");
+const actor_transfer_runtime_1 = require("./actor-transfer-runtime");
+const authority_key_codec_1 = require("../locations/authority-key-codec");
+const service_relocation_control_1 = require("./service-relocation-control");
+const service_stateful_wire_codec_1 = require("../foundation/service-stateful-wire-codec");
+const service_wire_constants_generated_1 = require("../foundation/service-wire-constants.generated");
+const bounded_replay_map_1 = require("./bounded-replay-map");
+const relocation_integrity_fault_gate_1 = require("./relocation-integrity-fault-gate");
+const actor_remote_wire_1 = require("../actors/actor-remote-wire");
+const actor_join_recovery_codec_1 = require("../foundation/actor-join-recovery-codec");
+class ZLinkRelocationStateIncompatibleError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ZLinkRelocationStateIncompatibleError';
+    }
+}
+exports.ZLinkRelocationStateIncompatibleError = ZLinkRelocationStateIncompatibleError;
+const RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES = 64 * 1024 * 1024;
+const RELOCATION_TARGET_TOMBSTONE_LIMIT = 1024;
+const RELOCATION_OPERATION_RETENTION_MS = 5 * 60_000;
+const SERVICE_CONTROL_TERMINAL_CAPACITY = 4096;
+/** Production host bridge from Retire inventory to remote RouteMesh owners. */
+class ZLinkHostServiceRelocationRuntime {
+    options;
+    targetStages = new Map();
+    terminalTargets = new bounded_replay_map_1.BoundedReplayMap(RELOCATION_TARGET_TOMBSTONE_LIMIT);
+    relocationAuthorityKeys = new Map();
+    targetPrepareOperations = new Map();
+    pendingReplyRelays = new Map();
+    pendingSessionRelocations = new Map();
+    terminalSessionRelocations = new bounded_replay_map_1.BoundedReplayMap(SERVICE_CONTROL_TERMINAL_CAPACITY);
+    /**
+     * A command 44 submit has no response path. Keep a bounded record of a
+     * rejected one-way attempt without turning the committed relocation into a
+     * retry loop.
+     */
+    failedSessionRouteSubmits = new bounded_replay_map_1.BoundedReplayMap(SERVICE_CONTROL_TERMINAL_CAPACITY);
+    sourceRelocationIds = new Set();
+    targetAssemblies = new Map();
+    /**
+     * Terminal restore failures (assembly/checksum/factory/restore error): the
+     * target already sent relocationFailed (command 53) once. An exact-identity
+     * Prepare resend replays the stored response rather than retrying the
+     * restore; a different exact identity reusing the same RelocationId+attempt
+     * key supersedes the stale entry (spec 28 §3, §9).
+     */
+    targetReadyFailures = new Map();
+    /**
+     * Successful restores retained across a Ready delivery retry: an
+     * exact-identity Prepare resend re-submits Ready against this retained
+     * staging instead of redoing the restore (spec 28).
+     */
+    targetReadyResponses = new Map();
+    sourceCutoverWindows = new Map();
+    peerPayloadBudgets = new Map();
+    nodePayloadBudget;
+    sourceActorJoinProfiles = new Map();
+    terminalActorJoinSourceLeaves = new bounded_replay_map_1.BoundedReplayMap(SERVICE_CONTROL_TERMINAL_CAPACITY);
+    codec = new service_relocation_runtime_1.ServiceRelocationAuthorityPayloadCodec();
+    /**
+     * Set once dispose() starts tearing assemblies down. A payload() rejection
+     * observed after this point is the shutdown itself, not a chunk-assembly or
+     * checksum integrity failure — it must not be reported as DataLost(35).
+     */
+    disposed = false;
+    constructor(options) {
+        this.options = options;
+    }
+    async relocateActorJoin(input) {
+        const sourceRef = input.state.nativeActorRef;
+        if (sourceRef === undefined) {
+            throw new Error(`Actor '${input.state.actorId}' has no source authority identity.`);
+        }
+        const descriptors = await this.options.liveDescriptors(input.meshName, input.signal);
+        const target = descriptors.find(value => (0, routing_id_1.routingIdsEqual)(value.rid, input.target.targetNodeRid));
+        if (target === undefined) {
+            throw new Error(`Actor '${input.state.actorId}' Join target '${String(input.target.targetNodeRid)}' is not live.`);
+        }
+        if (input.target.targetNodeGeneration !== undefined
+            && target.lifecycleGeneration !== input.target.targetNodeGeneration) {
+            throw new Error(`Actor '${input.state.actorId}' Join target generation changed after admission.`);
+        }
+        this.reserveExactRelocationId(input.relocationId);
+        let resolveReady;
+        const ready = new Promise((resolve) => {
+            resolveReady = resolve;
+        });
+        this.sourceActorJoinProfiles.set(input.relocationId, {
+            actor: input.actor,
+            state: input.state,
+            sourceActorRef: sourceRef,
+            sourceSpotId: input.state.spotId,
+            targetSpotId: input.target.spotId,
+            targetNodeRid: input.target.targetNodeRid,
+            relocationContentType: this.actorRegistration(input.state.meshName ?? input.meshName, input.state.actorType ?? '').relocation.kind === 'snapshot'
+                ? 'application/vnd.zlink.actor-relocation.snapshot'
+                : 'application/vnd.zlink.actor-relocation.recreate',
+            completionOperationId: input.completionOperationId,
+            canonicalRecovery: input.canonicalRecovery,
+            ready,
+            resolveReady
+        });
+        const membershipEpoch = input.state.spotMembershipEpoch > 0n
+            ? input.state.spotMembershipEpoch
+            : 1n;
+        const spotGeneration = input.target.targetSpotGeneration ?? target.lifecycleGeneration;
+        try {
+            await this.relocateStandaloneActor(input.meshName, input.state, target, target.applicationVersion, input.signal, {
+                spotId: input.target.spotId,
+                spotKind: input.target.spotKind === contracts_1.ZLinkSpotKind.Entry
+                    ? contracts_1.ZLinkSpotKind.Entry
+                    : contracts_1.ZLinkSpotKind.User,
+                spotObjectGeneration: spotGeneration
+            }, input.relocationId, true, input.advertisedReceiveChunkLimitBytes);
+            resolveReady();
+        }
+        catch (error) {
+            this.sourceActorJoinProfiles.delete(input.relocationId);
+            throw error;
+        }
+        return {
+            actorRef: {
+                actorId: sourceRef.actorId,
+                generation: sourceRef.generation,
+                nodeRid: target.rid
+            },
+            membershipEpoch,
+            spotGeneration
+        };
+    }
+    async dispose() {
+        this.disposed = true;
+        const errors = [];
+        for (const stage of this.targetStages.values()) {
+            if (stage.fallback !== undefined)
+                clearTimeout(stage.fallback);
+            try {
+                if (stage.finalize !== undefined) {
+                    await stage.finalize;
+                }
+                else if (stage.phase === 'ready') {
+                    await this.abortTargetStage(stage);
+                }
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        this.targetStages.clear();
+        this.terminalTargets.clear();
+        for (const pending of this.targetAssemblies.values()) {
+            pending.assembly.fail('Relocation runtime stopped.');
+        }
+        this.targetAssemblies.clear();
+        this.targetReadyFailures.clear();
+        this.targetReadyResponses.clear();
+        for (const window of this.sourceCutoverWindows.values()) {
+            if (window.windowTimer !== undefined)
+                clearTimeout(window.windowTimer);
+            if (window.retryTimer !== undefined)
+                clearTimeout(window.retryTimer);
+            if (window.followTimer !== undefined)
+                clearTimeout(window.followTimer);
+        }
+        this.sourceCutoverWindows.clear();
+        const stopped = new Error('Relocation runtime stopped.');
+        stopped.name = 'AbortError';
+        this.targetPrepareOperations.clear();
+        for (const pending of this.pendingReplyRelays.values()) {
+            if (pending.timer !== undefined)
+                clearTimeout(pending.timer);
+            pending.reject(stopped);
+        }
+        this.pendingReplyRelays.clear();
+        for (const pending of this.pendingSessionRelocations.values()) {
+            if (pending.retryTimer !== undefined)
+                clearTimeout(pending.retryTimer);
+            if (pending.deadlineTimer !== undefined)
+                clearTimeout(pending.deadlineTimer);
+            pending.reject(stopped);
+        }
+        this.pendingSessionRelocations.clear();
+        this.terminalSessionRelocations.clear();
+        this.failedSessionRouteSubmits.clear();
+        this.sourceActorJoinProfiles.clear();
+        this.terminalActorJoinSourceLeaves.clear();
+        this.options.boundSessionRelocation?.clear?.();
+        this.relocationAuthorityKeys.clear();
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1)
+            throw new AggregateError(errors, 'Relocation runtime stop failed.');
+    }
+    completeActorJoinSourceCleanup(actorId) {
+        for (const [relocationId, profile] of this.sourceActorJoinProfiles) {
+            if (profile.state.actorId !== actorId)
+                continue;
+            this.sourceActorJoinProfiles.delete(relocationId);
+            this.terminalActorJoinSourceLeaves.remember(relocationId, actorId);
+            void profile.ready.then(async () => {
+                await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
+                await this.options.actorManager()?.completeRelocationSource(actorId, profile.sourceActorRef);
+            }).catch(error => {
+                console.error('[zlink.runtime.relocation.source_cleanup_failed]', error);
+            });
+        }
+    }
+    async relocateMesh(meshName, targetApplicationVersion, signal, stopStartingSignal) {
+        const spotManager = this.options.spotManager();
+        const actorManager = this.options.actorManager();
+        // A stateless host has no relocation work. The corresponding managers are
+        // not created for that registration, and the no-op path must still allow
+        // the host relocation lifecycle to complete.
+        if (spotManager === undefined || actorManager === undefined)
+            return;
+        const groupedActorIds = new Set();
+        const work = [];
+        for (const activation of spotManager.relocationActivations(meshName)) {
+            const kind = this.spotKind(meshName, activation);
+            if (kind === undefined)
+                continue;
+            const states = actorManager.snapshotStates().filter(state => state.actor !== undefined && String(state.spotId) === String(activation.spotId));
+            for (const state of states)
+                groupedActorIds.add(state.actorId);
+            if (kind === 'user_spot'
+                && activation.executionMode === contracts_1.ZLinkUserSpotExecutionMode.PerActor) {
+                let shellRelocation;
+                const relocateShell = (relocationSignal) => {
+                    shellRelocation ??= this.relocatePerActorSpotShell(meshName, activation, undefined, targetApplicationVersion, relocationSignal);
+                    return shellRelocation;
+                };
+                work.push({
+                    id: `spot:${String(activation.spotId)}`,
+                    relocate: relocateShell
+                });
+                for (const state of states) {
+                    work.push({
+                        id: `actor:${state.actorId}`,
+                        relocate: async (relocationSignal) => {
+                            await relocateShell(relocationSignal);
+                            await this.relocateStandaloneActor(meshName, state, undefined, targetApplicationVersion, relocationSignal, {
+                                spotId: activation.spotId,
+                                spotKind: contracts_1.ZLinkSpotKind.User,
+                                spotObjectGeneration: (await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(activation.spotId)), relocationSignal)).objectGeneration
+                            });
+                        }
+                    });
+                }
+                continue;
+            }
+            work.push({
+                id: `spot:${String(activation.spotId)}`,
+                relocate: relocationSignal => this.relocateSpotAggregate(meshName, activation, kind, states, undefined, targetApplicationVersion, relocationSignal)
+            });
+        }
+        for (const state of actorManager.snapshotStates()) {
+            if (state.actor === undefined || groupedActorIds.has(state.actorId))
+                continue;
+            if ((state.meshName ?? meshName) !== meshName)
+                continue;
+            work.push({
+                id: `actor:${state.actorId}`,
+                relocate: relocationSignal => this.relocateStandaloneActor(meshName, state, undefined, targetApplicationVersion, relocationSignal)
+            });
+        }
+        if (work.length === 0)
+            return;
+        const maintenance = new service_maintenance_runtime_1.ServiceMaintenanceRuntime({
+            preflight: async () => true,
+            publishState: () => undefined,
+            forceStop: () => undefined
+        });
+        for (const unit of work) {
+            maintenance.enqueue({
+                id: unit.id,
+                ready: () => true,
+                relocate: unit.relocate
+            });
+        }
+        const operationSignal = signal ?? new AbortController().signal;
+        const deadlineMs = signal === undefined ? 30_000 : 24 * 60 * 60 * 1000;
+        const result = await raceAbort(maintenance.start('retire', deadlineMs, stopStartingSignal, operationSignal), operationSignal);
+        if (result.state !== 'completed') {
+            throw result.terminalError ?? new Error(`Host relocation ended in '${result.state}'.`);
+        }
+    }
+    async tryHandleControl(meshName, record, signal) {
+        if (record.parts.length === 0)
+            return false;
+        const payload = record.parts[0].data();
+        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelay)) {
+            await this.handleReplyRelay(meshName, (0, service_stateful_wire_codec_1.decodeMaintenanceReplyRelay)(record.parts.map(part => part.data())), record.sourceNodeRid, signal);
+            return true;
+        }
+        const sideband = record.parts.length === 1
+            ? undefined
+            : decodePrepareSideband(record.parts.slice(1).map(part => part.data()));
+        if (record.parts.length > 1 && sideband === undefined)
+            return false;
+        if (record.kind === service_runtime_contracts_1.ReceiveKind.NodeSend) {
+            const sourceLeave = (0, actor_remote_wire_1.decodeRemoteActorSourceLeaveTerminal)(payload);
+            if (sourceLeave !== undefined) {
+                return this.acceptActorJoinSourceLeave(sourceLeave);
+            }
+        }
+        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationSealed)) {
+            this.acceptSessionRelocationResponse((0, service_stateful_wire_codec_1.decodeSessionRelocationSealed)(payload), record.sourceNodeRid);
+            return true;
+        }
+        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationSeal)) {
+            const request = (0, service_stateful_wire_codec_1.decodeSessionRelocationSeal)(payload);
+            const response = await this.handleSessionRelocationSeal(meshName, request, record.sourceNodeRid, signal);
+            await this.sendSessionRelocationResponse(meshName, record.sourceNodeRid, (0, service_stateful_wire_codec_1.encodeSessionRelocationSealed)(response));
+            return true;
+        }
+        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationRoute)) {
+            const request = (0, service_stateful_wire_codec_1.decodeSessionRelocationRoute)(payload);
+            await this.handleSessionRelocationRoute(meshName, request, record.sourceNodeRid, signal);
+            return true;
+        }
+        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelayAck)) {
+            await this.acceptReplyRelayAck(meshName, (0, service_stateful_wire_codec_1.decodeMaintenanceReplyRelayAck)(payload), record.sourceNodeRid, signal);
+            return true;
+        }
+        let request = (0, service_relocation_control_1.decodeServiceRelocationControlRequest)(payload);
+        if (request === undefined)
+            return false;
+        if (sideband !== undefined) {
+            if (request.kind !== 'prepare')
+                return false;
+            request = { ...request, nodeInternalBoundSessions: sideband };
+        }
+        // Ready(30) and Failed(53) are replies to Prepare(40), never independent
+        // inbound controls. The source consumes them on Core's request reply leg.
+        if (request.kind === 'ready' || request.kind === 'failed')
+            return false;
+        if (request.kind === 'state') {
+            this.acceptRelocationStateChunk(request, record.sourceNodeRid);
+            return true;
+        }
+        if (request.kind === 'prepare') {
+            if (record.sourceNodeRid === null) {
+                throw new Error('Relocation prepare has no authenticated source node.');
+            }
+            if (record.kind !== service_runtime_contracts_1.ReceiveKind.NodeRequest) {
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Relocation prepare requires a Core request leg.');
+            }
+            const operationKey = relocationStagingId(request);
+            const fingerprint = stringifyWire(request);
+            // A restore that failed outright is terminal: the source observes the
+            // same explicit relocationFailed on every identical Prepare resend
+            // rather than a silent stall. A different exact identity reusing the
+            // same RelocationId+attempt key supersedes the stale failure — the
+            // newer attempt wins (spec 28 §3).
+            const readyFailure = this.targetReadyFailures.get(operationKey);
+            if (readyFailure !== undefined) {
+                if (readyFailure.fingerprint === fingerprint) {
+                    this.replyPrepare(record, readyFailure.response);
+                    return true;
+                }
+                this.targetReadyFailures.delete(operationKey);
+            }
+            // Spec 28: an exact-identity Restore resend against staging that
+            // already restored successfully reuses that staging — it re-submits
+            // READY rather than restarting the restore.
+            const readyPending = this.targetReadyResponses.get(operationKey);
+            if (readyPending !== undefined) {
+                if (readyPending.fingerprint !== fingerprint) {
+                    throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
+                }
+                this.submitTargetReady(meshName, operationKey, record, readyPending.response);
+                return true;
+            }
+            let operation = this.targetPrepareOperations.get(operationKey);
+            if (operation !== undefined && operation.fingerprint !== fingerprint) {
+                throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
+            }
+            if (operation === undefined) {
+                // The prepare turn must not block the ordered dispatch lane: the
+                // payload chunks that complete this operation arrive as later records
+                // on the same connection. Register the assembly synchronously, then
+                // finish the restore and the Ready reply asynchronously.
+                this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
+                const promise = this.handlePrepareControl(meshName, operationKey, request, record.sourceNodeRid, signal);
+                operation = { fingerprint, promise };
+                this.targetPrepareOperations.set(operationKey, operation);
+                void promise.finally(() => {
+                    if (this.targetPrepareOperations.get(operationKey) === operation) {
+                        this.targetPrepareOperations.delete(operationKey);
+                    }
+                }).catch(() => undefined);
+            }
+            void this.deliverTargetReady(meshName, operationKey, request, record, operation.promise);
+            return true;
+        }
+        await this.handleOneWayControl(meshName, request, record.sourceNodeRid, signal);
+        return true;
+    }
+    /** Sends the Ready reply once the async restore finished; failures replay on resend. */
+    async deliverTargetReady(meshName, operationKey, request, ingress, operation) {
+        let response;
+        try {
+            response = await operation;
+        }
+        catch (error) {
+            // The restore itself failed (chunk assembly/checksum, factory,
+            // restore or staging): this is terminal. Send relocationFailed
+            // (command 53) once and remember it so an identical Prepare resend
+            // replays the same response instead of retrying the restore.
+            const failed = relocationFailed(request, relocationFailedFailureCode(error, request.object.kind));
+            this.targetReadyFailures.set(operationKey, {
+                fingerprint: stringifyWire(request),
+                response: failed
+            });
+            // The stored failure replay is bounded by the same Restore validity
+            // window as everything else in this attempt — it is not kept forever
+            // (spec 28 §9).
+            const failureExpiry = setTimeout(() => {
+                this.targetReadyFailures.delete(operationKey);
+            }, RELOCATION_OPERATION_RETENTION_MS);
+            failureExpiry.unref();
+            console.error('[zlink.runtime.relocation.restore_failed]', operationKey, error);
+            const submitted = this.replyPrepare(ingress, failed);
+            if (submitted !== runtime_values_1.SubmitResult.Ok) {
+                console.error('[zlink.runtime.relocation.failure_reply_failed]', operationKey, error);
+            }
+            return;
+        }
+        // Spec 28: staging that finished restoring successfully is retained
+        // across a Ready delivery retry — an identical Prepare resend re-submits
+        // Ready against this staging instead of the restore being redone or the
+        // attempt being failed outright.
+        this.targetReadyResponses.set(operationKey, {
+            fingerprint: stringifyWire(request),
+            response
+        });
+        // A Ready that never delivers within the Restore validity window is
+        // bounded, too: the retained staging, its reservation and hidden objects
+        // are cleaned up exactly once instead of being held indefinitely (spec
+        // 28 §9, finding F3). A successful submit removes the map entry first,
+        // so this fire is then a harmless no-op.
+        const readyExpiry = setTimeout(() => {
+            this.expireTargetReadyResponse(operationKey);
+        }, RELOCATION_OPERATION_RETENTION_MS);
+        readyExpiry.unref();
+        this.submitTargetReady(meshName, operationKey, ingress, response);
+    }
+    /** Cleans up a Ready reply that never delivered within the Restore validity window. */
+    expireTargetReadyResponse(operationKey) {
+        if (!this.targetReadyResponses.delete(operationKey))
+            return;
+        const stage = this.targetStages.get(operationKey);
+        if (stage === undefined)
+            return;
+        this.targetStages.delete(operationKey);
+        void this.abortTargetStage(stage).catch(error => {
+            console.error('[zlink.runtime.relocation.ready_expired_abort_failed]', operationKey, error);
+        });
+    }
+    /**
+     * Submits one Ready reply. A failed submit is left for the next identical
+     * Prepare resend to retry against the retained staging (spec 28) — it is
+     * not rolled back here and does not arm the cutover fallback.
+     */
+    submitTargetReady(meshName, operationKey, ingress, response) {
+        const submitted = this.replyPrepare(ingress, response);
+        if (submitted !== runtime_values_1.SubmitResult.Ok) {
+            console.warn('[zlink.runtime.relocation.ready_submit_pending_resend]', operationKey);
+            return;
+        }
+        this.targetReadyResponses.delete(operationKey);
+        this.armTargetCutoverFallback(meshName, operationKey);
+    }
+    replyPrepare(ingress, response) {
+        try {
+            return ingress.reply((0, service_relocation_control_1.encodeServiceRelocationControlResponse)(response));
+        }
+        catch {
+            return runtime_values_1.SubmitResult.NotConnected;
+        }
+    }
+    /** Copies one exact-identity payload chunk into its registered assembly. */
+    acceptRelocationStateChunk(request, sourceNodeRid) {
+        const operationKey = relocationStagingId(request);
+        const pending = this.targetAssemblies.get(operationKey);
+        if (pending === undefined
+            || sourceNodeRid === null
+            || String(sourceNodeRid) !== pending.authenticatedSourceNodeRid
+            || request.senderRole !== 'source'
+            || !sameCoordinator(request.coordinator, pending.prepare.coordinator)
+            || stringifyWire(request.object) !== stringifyWire(pending.prepare.object)) {
+            // Spec 28 §4.3 — a chunk with a different exact identity is never
+            // attached to an in-progress assembly; it is discarded.
+            console.warn('[zlink.runtime.relocation.stale_state_chunk]', operationKey);
+            return;
+        }
+        let chunkData = request.chunkData;
+        if (this.relocationIntegrityFaultGate()?.consumeChecksumMismatch() === true) {
+            // Preserve the exact command identity and manifest while changing only
+            // one delivered payload byte.
+            chunkData = Buffer.from(chunkData);
+            if (chunkData.byteLength > 0)
+                chunkData[0] ^= 0x01;
+        }
+        pending.assembly.accept(request.chunkOrdinal, chunkData);
+    }
+    registerTargetAssembly(operationKey, request, authenticatedSourceNodeRid) {
+        const existing = this.targetAssemblies.get(operationKey);
+        if (existing !== undefined) {
+            if (existing.fingerprint !== stringifyWire(request)) {
+                // Same exact identity with a different declared length or checksum is
+                // an explicit conflict failure; the existing assembly is neither
+                // reused nor overwritten (spec 28 §4.3).
+                throw existing.assembly.fail(`Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`);
+            }
+            return existing;
+        }
+        const pending = {
+            prepare: request,
+            fingerprint: stringifyWire(request),
+            authenticatedSourceNodeRid,
+            assembly: new relocation_direct_transfer_1.ZLinkRelocationPayloadAssembly(Number(request.payloadTotalLength), request.payloadChunkCount, request.payloadChecksumCrc32c)
+        };
+        this.targetAssemblies.set(operationKey, pending);
+        if (this.relocationIntegrityFaultGate()?.consumeIdentityConflict() === true) {
+            // Route a same-identity, different-manifest delivery through the normal
+            // conflict branch so existing staging is neither reused nor overwritten.
+            return this.registerTargetAssembly(operationKey, {
+                ...request,
+                payloadChecksumCrc32c: request.payloadChecksumCrc32c ^ 1
+            }, authenticatedSourceNodeRid);
+        }
+        return pending;
+    }
+    relocationIntegrityFaultGate() {
+        try {
+            return this.options.providerResolver?.get?.(relocation_integrity_fault_gate_1.ZLINK_INTERNAL_RELOCATION_INTEGRITY_FAULT_GATE);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    requestSessionRelocationSeal(meshName, targetNodeRid, request, signal) {
+        return this.requestSessionRelocationSealControl(meshName, targetNodeRid, request, signal);
+    }
+    async sendSessionRelocationRoute(meshName, targetNodeRid, request, signal) {
+        //  A relocation whose session owner IS this node publishes the route
+        //  to itself; RouteMesh has no self connection (NotConnected), so the
+        //  control dispatches through the same inbound handler locally.
+        const localRid = this.requireMeshNode(meshName).status().routingId;
+        if (String(localRid) === String(targetNodeRid)) {
+            await this.handleSessionRelocationRoute(meshName, request, localRid, signal);
+            return;
+        }
+        //  Spec 20 §5.1 / config-10 ST-E1C: command 44 is a one-way control with
+        //  no response or application ACK. Submit exactly once; a rejected
+        //  submit is retained only as bounded per-attempt state. The receiving
+        //  Session owns seal-timeout cleanup, after which reconnect plus explicit
+        //  bind is the only recovery path -- never a second command 44 send.
+        const bytes = (0, service_stateful_wire_codec_1.encodeSessionRelocationRoute)(request);
+        signal?.throwIfAborted();
+        const submitted = await this.sendInfrastructureControl(meshName, targetNodeRid, bytes);
+        if (submitted !== runtime_values_1.SubmitResult.Ok) {
+            this.failedSessionRouteSubmits.remember(sessionRelocationRouteSubmitKey(request, targetNodeRid), submitted);
+        }
+    }
+    requestSessionRelocationSealControl(meshName, targetNodeRid, request, signal) {
+        const key = sessionRelocationPendingKey(request);
+        const bytes = (0, service_stateful_wire_codec_1.encodeSessionRelocationSeal)(request);
+        const requestFingerprint = bytes.toString('base64');
+        const expectedTarget = String(targetNodeRid);
+        const terminal = this.terminalSessionRelocations.get(key);
+        if (terminal !== undefined) {
+            if (terminal.targetNodeRid !== expectedTarget
+                || terminal.requestFingerprint !== requestFingerprint) {
+                return Promise.reject(new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation control '${key}' repeated with different bytes or target.`));
+            }
+            this.terminalSessionRelocations.touch(key);
+        }
+        const existing = this.pendingSessionRelocations.get(key);
+        if (existing !== undefined) {
+            if (existing.targetNodeRid !== expectedTarget
+                || existing.requestFingerprint !== requestFingerprint) {
+                return Promise.reject(new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation control '${key}' repeated with different bytes or target.`));
+            }
+            return existing.promise;
+        }
+        let resolvePromise;
+        let rejectPromise;
+        const promise = new Promise((resolve, reject) => {
+            resolvePromise = resolve;
+            rejectPromise = reject;
+        });
+        let abortListener;
+        let settled = false;
+        const finish = (action) => {
+            if (settled)
+                return;
+            settled = true;
+            const current = this.pendingSessionRelocations.get(key);
+            if (current === pending) {
+                if (current.retryTimer !== undefined)
+                    clearTimeout(current.retryTimer);
+                if (current.deadlineTimer !== undefined)
+                    clearTimeout(current.deadlineTimer);
+                this.pendingSessionRelocations.delete(key);
+            }
+            if (abortListener !== undefined) {
+                signal?.removeEventListener('abort', abortListener);
+            }
+            action();
+        };
+        let pending;
+        // Spec 48:205/20:408 — the seal control keeps the operation's deadline
+        // and cancellation contract; an unbounded identical-bytes resend loop
+        // turned a lost ACK into a permanent relocation stall (observed ~30s
+        // admission interruption until teardown). Resends stay within the
+        // relocation seal window, then the join terminates DeadlineExceeded
+        // (spec 32:88).
+        // Spec 06 — the configured SessionRelocationSealTimeout is an additional
+        // finite upper bound; the caller's earlier absolute deadline still wins.
+        const registration = Object.hasOwn(this.options, 'registration')
+            ? this.options.registration
+            : undefined;
+        const sealTimeoutMs = registration?.locations.options
+            .sessionRelocationSealTimeoutMs
+            ?? Options_1.zlinkRuntimeDefaultLocationOptions.sessionRelocationSealTimeoutMs;
+        const resendDeadline = performance.now() + sealTimeoutMs;
+        const send = async () => {
+            if (signal?.aborted === true) {
+                finish(() => rejectPromise(signal.reason));
+                return;
+            }
+            //  A seal whose session owner IS this node has no RouteMesh self
+            //  connection (NotConnected); dispatch through the inbound handler
+            //  locally instead of the wire.
+            const localRid = this.requireMeshNode(meshName).status().routingId;
+            if (String(localRid) === expectedTarget) {
+                try {
+                    const response = await this.handleSessionRelocationSeal(meshName, request, localRid, signal);
+                    pending.resolve(response);
+                }
+                catch (error) {
+                    pending.reject(error);
+                }
+                return;
+            }
+            if (performance.now() >= resendDeadline) {
+                pending.reject((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Session relocation seal '${key}' was not acknowledged within the relocation seal timeout.`, true));
+                return;
+            }
+            try {
+                const submitted = await this.sendInfrastructureControl(meshName, targetNodeRid, bytes);
+                if (submitted !== runtime_values_1.SubmitResult.Ok) {
+                    pending.reject((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RelocationTargetUnavailable, `Session relocation seal '${key}' was not accepted by RouteMesh.`, true));
+                    return;
+                }
+                if (this.pendingSessionRelocations.get(key) === pending) {
+                    pending.retryTimer = setTimeout(() => void send(), 250);
+                }
+            }
+            catch (error) {
+                pending.reject((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RelocationTargetUnavailable, `Session relocation seal '${key}' could not reach its RouteMesh owner.`, true, error));
+            }
+        };
+        pending = {
+            targetNodeRid: expectedTarget,
+            request,
+            requestFingerprint,
+            promise,
+            resolve: response => finish(() => {
+                this.terminalSessionRelocations.remember(key, {
+                    targetNodeRid: expectedTarget,
+                    request,
+                    requestFingerprint,
+                    responseFingerprint: sessionRelocationResponseFingerprint(response)
+                });
+                resolvePromise(response);
+            }),
+            reject: error => finish(() => rejectPromise(error))
+        };
+        this.pendingSessionRelocations.set(key, pending);
+        pending.deadlineTimer = setTimeout(() => pending.reject((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Session relocation seal '${key}' was not acknowledged within the relocation seal timeout.`, true)), Math.max(0, resendDeadline - performance.now()));
+        pending.deadlineTimer.unref();
+        abortListener = () => pending.reject(signal?.reason ?? (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Session relocation seal '${key}' was cancelled.`, true));
+        if (signal?.aborted === true) {
+            abortListener();
+            return promise;
+        }
+        signal?.addEventListener('abort', abortListener, { once: true });
+        void send();
+        return promise;
+    }
+    acceptSessionRelocationResponse(response, sourceNodeRid) {
+        const key = sessionRelocationResponseKey(response);
+        const pending = this.pendingSessionRelocations.get(key);
+        if (pending === undefined) {
+            const terminal = this.terminalSessionRelocations.get(key);
+            if (terminal === undefined)
+                return;
+            if (sourceNodeRid === null || String(sourceNodeRid) !== terminal.targetNodeRid) {
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation ACK '${key}' source node changed.`);
+            }
+            validateSessionRelocationResponse(terminal.request, response);
+            if (sessionRelocationResponseFingerprint(response) !== terminal.responseFingerprint) {
+                throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation ACK '${key}' repeated with different bytes.`);
+            }
+            this.terminalSessionRelocations.touch(key);
+            return;
+        }
+        if (sourceNodeRid === null || String(sourceNodeRid) !== pending.targetNodeRid) {
+            pending.reject(new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation ACK '${key}' source node changed.`));
+            return;
+        }
+        try {
+            validateSessionRelocationResponse(pending.request, response);
+            pending.resolve(response);
+        }
+        catch (error) {
+            pending.reject(error);
+        }
+    }
+    //  A relocation control dispatched locally names THIS node as its
+    //  source; the peers() view never contains the local node, so its
+    //  lifecycle generation comes from the node status instead.
+    sourceLifecycleGeneration(meshName, sourceNodeRid) {
+        if (sourceNodeRid === null)
+            return undefined;
+        const node = this.requireMeshNode(meshName);
+        const status = node.status();
+        if (String(status.routingId) === String(sourceNodeRid)) {
+            return status.lifecycleGeneration;
+        }
+        return node.peers().find(peer => peer.routingId !== null
+            && String(peer.routingId) === String(sourceNodeRid))?.lifecycleGeneration;
+    }
+    async handleSessionRelocationSeal(meshName, request, sourceNodeRid, signal) {
+        if (sourceNodeRid === null
+            || String(sourceNodeRid) !== request.coordinator.nodeRid
+            || String(sourceNodeRid) !== request.actor.actor.nodeRid) {
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation seal source does not match its coordinator and Actor fence.');
+        }
+        this.validateSessionOwnerFence(meshName, request.session);
+        const sealSourceGeneration = this.sourceLifecycleGeneration(meshName, sourceNodeRid);
+        if (sealSourceGeneration !== request.actor.targetNodeGeneration
+            || sealSourceGeneration !== request.coordinator.nodeGeneration) {
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation seal source lifecycle generation is stale.');
+        }
+        const handler = this.options.boundSessionRelocation?.receiveSeal;
+        if (handler === undefined) {
+            throw new Error('Session relocation seal ingress is not configured.');
+        }
+        return await handler(request, signal);
+    }
+    async handleSessionRelocationRoute(meshName, request, sourceNodeRid, _signal) {
+        this.validateSessionOwnerFence(meshName, request.session);
+        const expectedSource = request.route.action === 'commit'
+            ? request.route.targetNodeRid
+            : request.coordinator.nodeRid;
+        if (sourceNodeRid === null || String(sourceNodeRid) !== expectedSource) {
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation route source does not match its action fence.');
+        }
+        const routeSourceGeneration = this.sourceLifecycleGeneration(meshName, sourceNodeRid);
+        const expectedSourceGeneration = request.route.action === 'commit'
+            ? request.route.targetNodeGeneration
+            : request.coordinator.nodeGeneration;
+        if (routeSourceGeneration !== expectedSourceGeneration) {
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation route source lifecycle generation is stale.');
+        }
+        const handler = this.options.boundSessionRelocation?.receiveRoute;
+        if (handler === undefined) {
+            throw new Error('Session relocation route ingress is not configured.');
+        }
+        await handler(request);
+    }
+    validateSessionOwnerFence(meshName, session) {
+        const status = this.requireMeshNode(meshName).status();
+        const owner = this.options.currentOwner();
+        if (String(status.routingId) !== session.sessionOwnerNodeRid
+            || status.lifecycleGeneration !== session.sessionOwnerNodeGeneration
+            || owner?.ownerId !== session.sessionOwnerId
+            || owner.leaseGeneration !== session.sessionOwnerLeaseGeneration) {
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation command does not match the local Session owner fence.');
+        }
+    }
+    async sendSessionRelocationResponse(meshName, targetNodeRid, bytes) {
+        if (targetNodeRid === null) {
+            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation command has no authenticated source.');
+        }
+        const submitted = await this.sendInfrastructureControl(meshName, targetNodeRid, bytes);
+        if (submitted !== runtime_values_1.SubmitResult.Ok) {
+            throw new Error('Session relocation ACK was not accepted by RouteMesh.');
+        }
+    }
+    async relocateSpotAggregate(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal) {
+        const store = this.requireLocationStore();
+        const spotKey = (0, authority_key_codec_1.encodeAuthorityKey)(kind, String(activation.spotId));
+        const spotAuthority = await requireAuthority(store, spotKey, signal);
+        const actorAuthorities = new Map();
+        for (const state of actorStates) {
+            actorAuthorities.set(state.actorId, await requireAuthority(store, (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId), signal));
+        }
+        const sessions = [];
+        let spotCapture;
+        let spotMessageFollowSeal;
+        let spotSealCommitted = false;
+        let readinessBoundaryConsumed = false;
+        let interruptionStartedAt;
+        const spotRegistration = this.spotRegistration(meshName, kind, spotAuthority.allocation.stableType);
+        target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, relocationTargetRequirements([
+            {
+                objectKind: kind,
+                stableType: spotAuthority.allocation.stableType,
+                policy: spotRegistration.relocation.kind,
+                count: 1
+            },
+            ...actorStates.map(state => {
+                const actorAuthority = actorAuthorities.get(state.actorId);
+                return {
+                    objectKind: 'actor',
+                    stableType: actorAuthority.allocation.stableType,
+                    policy: this.actorRegistration(state.meshName ?? meshName, actorAuthority.allocation.stableType).relocation.kind,
+                    count: 1
+                };
+            })
+        ]), signal);
+        const aggregateId = this.reserveRelocationId();
+        const spotUnit = {
+            authorityKey: spotKey.value,
+            objectKind: kind,
+            stableType: spotAuthority.allocation.stableType,
+            objectGeneration: spotAuthority.objectGeneration,
+            authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
+            seal: async (captureSignal) => {
+                interruptionStartedAt = performance.now();
+                spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
+                // captureRelocation seals synchronously before its first await. Invoke
+                // it in the same event-loop turn as the wire ingress seal so no
+                // accepted direct message can enter between the two boundaries.
+                const spotCaptureOperation = activation.captureRelocation(captureSignal);
+                const preparedSessions = Promise.all(actorStates.map(async (state) => ({
+                    state,
+                    actor: state.actor,
+                    prepared: await this.options.actorTransfer.prepareMaintenanceSession(state.actor, state, captureSignal, false, relocationWireId(aggregateId))
+                })));
+                const preparedSessionsOutcome = preparedSessions.then(value => ({ value }), error => ({ error }));
+                spotCapture = await spotCaptureOperation;
+                const preparation = await preparedSessionsOutcome;
+                if ('error' in preparation)
+                    throw preparation.error;
+                sessions.push(...preparation.value);
+                return {
+                    boundSessionState: Buffer.alloc(0),
+                    queuedMessages: [],
+                    timers: spotCapture.timers.map(toServiceTimer)
+                };
+            },
+            captureApplicationState: captureSignal => this.captureApplication(spotRegistration.relocation, activation.spot, captureSignal),
+            commitSeal: async () => {
+                if (!spotSealCommitted) {
+                    if (spotCapture === undefined || !await activation.commitRelocation(spotCapture)) {
+                        throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+                    }
+                    spotSealCommitted = true;
+                }
+                if (spotMessageFollowSeal !== undefined) {
+                    await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
+                }
+                for (const session of sessions) {
+                    const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', session.state.actorId));
+                    const targetActorRef = {
+                        actorId: session.state.actorId,
+                        objectGeneration: actorAuthorities.get(session.state.actorId).objectGeneration,
+                        meshName,
+                        nodeRid: target.rid
+                    };
+                    await session.prepared.commit({
+                        routerChannelId: meshName,
+                        targetNodeRid: target.rid,
+                        spotId: activation.spotId,
+                        spotKind: kind === 'user_spot'
+                            ? contracts_1.ZLinkSpotKind.User
+                            : contracts_1.ZLinkSpotKind.Instance,
+                        authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+                    }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(session.state.actorId, targetActorRef, committedAuthority));
+                    activation.commitActorDeparture(session.state.actorId);
+                    await this.requireActorManager().completeRelocationSource(session.state.actorId);
+                }
+                await this.requireSpotManager().completeRelocationSource(activation);
+            },
+            abortSeal: async () => {
+                const failures = [];
+                if (spotCapture !== undefined) {
+                    try {
+                        activation.abortRelocation(spotCapture);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                }
+                if (spotMessageFollowSeal !== undefined) {
+                    try {
+                        const node = this.requireMeshNode(meshName);
+                        const abort = node.abortSpotMessageFollowIngress;
+                        if (abort === undefined || !abort.call(node, spotMessageFollowSeal)) {
+                            throw new Error('Spot Message Follow abort fence became stale.');
+                        }
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                }
+                for (const session of [...sessions].reverse()) {
+                    try {
+                        await session.prepared.rollback();
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                }
+                if (failures.length !== 0) {
+                    throw new AggregateError(failures, 'Spot relocation source rollback was incomplete.');
+                }
+            }
+        };
+        const actorUnits = actorStates.map(state => this.actorCaptureUnit(state, actorAuthorities.get(state.actorId), sessions, false, undefined, undefined, undefined, undefined, false));
+        const memberships = actorStates.map(state => ({
+            actorKey: (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId).value,
+            spotKey: spotKey.value,
+            spotObjectGeneration: spotAuthority.objectGeneration,
+            membershipEpoch: state.spotMembershipEpoch > 0n ? state.spotMembershipEpoch : 1n
+        }));
+        let outcome = 'completed';
+        try {
+            const waitForRelocationBoundary = activation.waitForRelocationBoundary;
+            readinessBoundaryConsumed = waitForRelocationBoundary === undefined
+                ? false
+                : await waitForRelocationBoundary.call(activation, signal);
+            // A full in-flight payload budget delays this unit before its seal, so
+            // the Spot and its Actors keep processing messages while waiting.
+            await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
+            const captureOwner = new service_relocation_object_owner_1.ServiceRelocationObjectCaptureOwner();
+            const captured = kind === 'user_spot'
+                ? await captureOwner.captureUserSpotAggregate(aggregateId, 1n, spotUnit, actorUnits, memberships, signal)
+                : await captureOwner.captureInstanceSpotAggregate(aggregateId, 1n, spotUnit, actorUnits, memberships, signal);
+            await this.runCoordinator(meshName, target, spotAuthority, captured, new Map([[spotKey.value, spotAuthority], ...actorStates.map(state => [
+                    (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId).value,
+                    actorAuthorities.get(state.actorId)
+                ])]), signal, sessions);
+        }
+        catch (error) {
+            outcome = 'failed';
+            if (readinessBoundaryConsumed
+                && !(error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError)) {
+                await activation.completeConsumedRelocationBoundary(contracts_1.ZLinkSpotRelocationReadyOutcome.Continued).catch(() => undefined);
+            }
+            throw error;
+        }
+        finally {
+            this.sourceRelocationIds.delete(aggregateId);
+            if (interruptionStartedAt !== undefined) {
+                this.recordRelocationInterruption(meshName, kind, kind === 'user_spot' ? 'spot_wide' : undefined, interruptionStartedAt, outcome);
+            }
+        }
+    }
+    async relocateStandaloneActor(meshName, state, target, targetApplicationVersion, signal, targetMembership, aggregateIdOverride, retainSourceForActorJoin = false, 
+    /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
+    advertisedReceiveChunkLimitBytes) {
+        relocationDebug('standalone_actor.begin', { actorId: state.actorId });
+        const authority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId), signal);
+        target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, [{
+                objectKind: 'actor',
+                stableType: authority.allocation.stableType,
+                policy: this.actorRegistration(state.meshName ?? meshName, authority.allocation.stableType).relocation.kind,
+                count: 1
+            }], signal);
+        const sessions = [];
+        const membershipSpotId = targetMembership?.spotId
+            ?? (target.entrySpotId ?? String(target.rid));
+        const aggregateId = aggregateIdOverride ?? this.reserveRelocationId();
+        const unit = this.actorCaptureUnit(state, authority, sessions, true, target, meshName, {
+            spotId: membershipSpotId,
+            spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry
+        }, relocationWireId(aggregateId), retainSourceForActorJoin);
+        const membership = {
+            actorKey: (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId).value,
+            spotKey: (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(membershipSpotId)).value,
+            spotObjectGeneration: targetMembership?.spotObjectGeneration ?? target.lifecycleGeneration,
+            membershipEpoch: state.spotMembershipEpoch > 0n ? state.spotMembershipEpoch : 1n
+        };
+        let interruptionStartedAt;
+        const measuredUnit = {
+            ...unit,
+            seal: async (captureSignal) => {
+                interruptionStartedAt = performance.now();
+                return unit.seal(captureSignal);
+            }
+        };
+        let outcome = 'completed';
+        try {
+            relocationDebug('standalone_actor.wait_budget', { actorId: state.actorId, targetRid: String(target.rid) });
+            await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
+            relocationDebug('standalone_actor.capture_begin', { actorId: state.actorId });
+            const captured = await new service_relocation_object_owner_1.ServiceRelocationObjectCaptureOwner().captureStandaloneActor(aggregateId, 1n, measuredUnit, membership, signal);
+            relocationDebug('standalone_actor.capture_complete', { actorId: state.actorId });
+            await this.runCoordinator(meshName, target, authority, captured, new Map([[measuredUnit.authorityKey, authority]]), signal, sessions, advertisedReceiveChunkLimitBytes);
+        }
+        catch (error) {
+            outcome = 'failed';
+            throw error;
+        }
+        finally {
+            this.sourceRelocationIds.delete(aggregateId);
+            if (interruptionStartedAt !== undefined) {
+                this.recordRelocationInterruption(meshName, 'actor', undefined, interruptionStartedAt, outcome);
+            }
+        }
+    }
+    async relocatePerActorSpotShell(meshName, activation, target, targetApplicationVersion, signal) {
+        const spotKey = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(activation.spotId));
+        const spotAuthority = await requireAuthority(this.requireLocationStore(), spotKey, signal);
+        const spotRegistration = this.spotRegistration(meshName, 'user_spot', spotAuthority.allocation.stableType);
+        target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, [{
+                objectKind: 'user_spot',
+                stableType: spotAuthority.allocation.stableType,
+                policy: spotRegistration.relocation.kind,
+                count: 1
+            }], signal);
+        let spotCapture;
+        let spotMessageFollowSeal;
+        let sealCommitted = false;
+        let interruptionStartedAt;
+        const spotUnit = {
+            authorityKey: spotKey.value,
+            objectKind: 'user_spot',
+            stableType: spotAuthority.allocation.stableType,
+            objectGeneration: spotAuthority.objectGeneration,
+            authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
+            seal: async (captureSignal) => {
+                interruptionStartedAt = performance.now();
+                spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
+                spotCapture = await activation.captureRelocation(captureSignal);
+                return {
+                    boundSessionState: Buffer.alloc(0),
+                    queuedMessages: [],
+                    timers: spotCapture.timers.map(toServiceTimer)
+                };
+            },
+            // PerActor User Spots are stateless shells. Application state and the
+            // Spot relocation adapter are intentionally not part of this unit.
+            captureApplicationState: async () => Buffer.alloc(0),
+            commitSeal: async () => {
+                if (!sealCommitted) {
+                    if (spotCapture === undefined || !await activation.commitRelocation(spotCapture)) {
+                        throw new Error(`PerActor Spot '${String(activation.spotId)}' relocation seal became stale.`);
+                    }
+                    sealCommitted = true;
+                }
+                if (spotMessageFollowSeal !== undefined) {
+                    await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
+                }
+                await this.requireSpotManager().completeRelocationSource(activation);
+            },
+            abortSeal: async () => {
+                if (spotCapture !== undefined)
+                    activation.abortRelocation(spotCapture);
+                if (spotMessageFollowSeal !== undefined) {
+                    const node = this.requireMeshNode(meshName);
+                    const abort = node.abortSpotMessageFollowIngress;
+                    if (abort === undefined || !abort.call(node, spotMessageFollowSeal)) {
+                        throw new Error('Spot Message Follow abort fence became stale.');
+                    }
+                }
+            }
+        };
+        const aggregateId = this.reserveRelocationId();
+        let outcome = 'completed';
+        try {
+            await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
+            const captured = await new service_relocation_object_owner_1.ServiceRelocationObjectCaptureOwner().captureUserSpotAggregate(aggregateId, 1n, spotUnit, [], [], signal);
+            await this.runCoordinator(meshName, target, spotAuthority, captured, new Map([[spotKey.value, spotAuthority]]), signal, []);
+        }
+        catch (error) {
+            outcome = 'failed';
+            throw error;
+        }
+        finally {
+            this.sourceRelocationIds.delete(aggregateId);
+            if (interruptionStartedAt !== undefined) {
+                this.recordRelocationInterruption(meshName, 'user_spot', 'per_actor', interruptionStartedAt, outcome);
+            }
+        }
+    }
+    actorCaptureUnit(state, authority, sessions, standalone = false, target, meshName, targetMembership, sessionRelocation, retainSourceForActorJoin = false) {
+        const registration = this.actorRegistration(state.meshName ?? meshName ?? '', state.actorType ?? authority.allocation.stableType);
+        let ownSession;
+        return {
+            authorityKey: (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId).value,
+            objectKind: 'actor',
+            stableType: authority.allocation.stableType,
+            objectGeneration: authority.objectGeneration,
+            authorityOwnerGeneration: authority.authorityOwnerGeneration,
+            seal: async (signal) => {
+                if (standalone) {
+                    ownSession = {
+                        state,
+                        actor: state.actor,
+                        prepared: await this.options.actorTransfer.prepareMaintenanceSession(state.actor, state, signal, true, sessionRelocation)
+                    };
+                    sessions.push(ownSession);
+                }
+                const prepared = standalone ? ownSession : sessions.find(value => value.state === state);
+                return {
+                    boundSessionState: encodeActorSession(prepared?.prepared.target),
+                    queuedMessages: encodeHandoffQueuedMessages(prepared?.prepared.handoffBacklog ?? []),
+                    timers: []
+                };
+            },
+            // The canonical participant body (discriminator 1) is raw application
+            // state. The sealed bound-session target remains in sealed work and is
+            // transported only by Prepare's NODE-INTERNAL sideband frames.
+            captureApplicationState: signal => this.captureApplication(registration.relocation, state.actor, signal),
+            commitSeal: async () => {
+                if (!standalone || ownSession === undefined || target === undefined || meshName === undefined)
+                    return;
+                const membershipSpotId = targetMembership?.spotId
+                    ?? (target.entrySpotId ?? String(target.rid));
+                const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId));
+                const targetActorRef = {
+                    actorId: state.actorId,
+                    objectGeneration: authority.objectGeneration,
+                    meshName,
+                    nodeRid: target.rid
+                };
+                await ownSession.prepared.commit({
+                    routerChannelId: meshName,
+                    targetNodeRid: target.rid,
+                    spotId: membershipSpotId,
+                    spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry,
+                    authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+                }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(state.actorId, targetActorRef, committedAuthority));
+                if (!retainSourceForActorJoin) {
+                    await this.requireActorManager().completeRelocationSource(state.actorId);
+                }
+            },
+            abortSeal: async () => {
+                if (standalone && ownSession !== undefined)
+                    await ownSession.prepared.rollback();
+            }
+        };
+    }
+    reserveRelocationId() {
+        const id = createServiceRelocationId(candidate => {
+            if (this.sourceRelocationIds.has(candidate))
+                return true;
+            const wire = relocationWireId(candidate);
+            const prefix = `${wire.high}:${wire.low}:`;
+            return [...this.targetStages.keys()].some(key => key.startsWith(prefix));
+        });
+        this.sourceRelocationIds.add(id);
+        return id;
+    }
+    reserveExactRelocationId(id) {
+        const wire = relocationWireId(id);
+        const prefix = `${wire.high}:${wire.low}:`;
+        if (this.sourceRelocationIds.has(id)
+            || [...this.targetStages.keys()].some(key => key.startsWith(prefix))) {
+            throw new Error(`Actor Join relocation '${id}' is already active.`);
+        }
+        this.sourceRelocationIds.add(id);
+    }
+    async runCoordinator(meshName, target, primary, captured, _authorities, signal, sessions = [], 
+    /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
+    advertisedReceiveChunkLimitBytes) {
+        relocationDebug('coordinator.begin', { aggregateId: captured.envelope.aggregateId, targetRid: String(target.rid) });
+        const localStatus = this.requireMeshNode(meshName).status();
+        const controlDeadlineAtMs = signal === undefined
+            ? performance.now() + 30_000
+            : Number.MAX_SAFE_INTEGER;
+        const coordinator = {
+            ownerId: primary.ownerId,
+            leaseGeneration: primary.ownerLeaseGeneration,
+            nodeRid: String(localStatus.routingId),
+            nodeGeneration: localStatus.lifecycleGeneration,
+            expectedAuthorityStoreVersion: primary.storeVersion.value
+        };
+        const targetFence = {
+            nodeRid: String(target.rid),
+            nodeGeneration: target.lifecycleGeneration,
+            ownerId: target.ownerId,
+            ownerLeaseGeneration: target.leaseGeneration
+        };
+        const relocation = relocationWireId(captured.envelope.aggregateId);
+        const object = relocationObject(captured.envelope);
+        // The selected target lifecycle is the attempt fence used by the
+        // reference C++ relocation path. Keep the envelope and every control leg
+        // on that one exact identity; a process replacement is a different
+        // attempt even when it reuses the same routing id.
+        const targetAttemptGeneration = target.lifecycleGeneration;
+        const relayAuthorityId = wireIdText(relocationWireId(captured.envelope.aggregateId));
+        const relayAuthorityKey = primaryKey(captured.envelope);
+        if (this.relocationAuthorityKeys.has(relayAuthorityId)) {
+            throw new Error(`Relocation reply relay authority '${relayAuthorityId}' is already registered.`);
+        }
+        this.relocationAuthorityKeys.set(relayAuthorityId, relayAuthorityKey);
+        // The captured payload stays in source memory: this copy is the only
+        // handoff original until the cutover submit terminal and the
+        // retransmission window end (spec 28 §4.2).
+        const canonicalEnvelope = canonicalizeCapturedHandoffBacklog(captured.envelope, coordinator, targetFence);
+        const actorJoinProfile = this.sourceActorJoinProfiles.get(captured.envelope.aggregateId);
+        const transportEnvelope = actorJoinProfile?.canonicalRecovery === undefined
+            ? canonicalEnvelope
+            : appendCanonicalActorJoinRecovery(canonicalEnvelope, actorJoinProfile, coordinator, primary);
+        const encoded = (0, service_relocation_runtime_1.encodeServiceRelocationEnvelope)(transportEnvelope, target.applicationVersion);
+        const limits = this.relocationLimits();
+        // Actor Join threads the target's admission-time advertised cap in;
+        // other relocation paths have no such negotiation and fall back to the
+        // configured limit unchanged (spec 15 §4.2).
+        const chunkLimitBytes = (0, relocation_direct_transfer_1.effectiveActorJoinChunkLimitBytes)(limits.relocationPayloadChunkLimitBytes, advertisedReceiveChunkLimitBytes);
+        const plan = (0, relocation_direct_transfer_1.planRelocationChunks)(encoded, chunkLimitBytes);
+        const convergenceDeadlineAtMs = signal === undefined
+            ? performance.now() + RELOCATION_OPERATION_RETENTION_MS
+            : controlDeadlineAtMs;
+        let readyReceived = false;
+        let sourceCommitted = false;
+        try {
+            const prepare = {
+                kind: 'prepare',
+                relocation,
+                targetAttemptGeneration,
+                coordinator,
+                target: targetFence,
+                initiatorRole: 'source',
+                object,
+                sourceNodeRid: coordinator.nodeRid,
+                sourceNodeGeneration: coordinator.nodeGeneration,
+                payloadTotalLength: BigInt(plan.totalLength),
+                payloadChunkCount: plan.chunkCount,
+                payloadChecksumCrc32c: plan.checksumCrc32c,
+                applicationVersion: target.applicationVersion
+            };
+            // Start the Restore request first (it also registers the temporary
+            // queue and the assembly on the target), then stream the payload chunks
+            // on the same ordered connection. The Ready reply arrives only after
+            // the target assembled, verified, and restored the payload.
+            const readyOperation = this.sendControl(meshName, target.rid, prepare, signal, controlDeadlineAtMs, encodePrepareSideband(captured.envelope));
+            try {
+                relocationDebug('coordinator.state_transfer_begin', { aggregateId: captured.envelope.aggregateId });
+                await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, signal);
+            }
+            catch (chunkError) {
+                readyOperation.catch(() => undefined);
+                throw chunkError;
+            }
+            relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+            const ready = await readyOperation;
+            relocationDebug('coordinator.ready_received', { aggregateId: captured.envelope.aggregateId });
+            validateControlResponse(prepare, ready);
+            // Ready arms the target's cutover-wait fallback. From this point
+            // forward the source can no longer reopen dispatch without risking two
+            // owners.
+            readyReceived = true;
+            const boundaryBatch = [];
+            for (const session of sessions) {
+                const participant = captured.envelope.participants.find(value => value.objectKind === 'actor'
+                    && (0, authority_key_codec_1.decodeAuthorityKey)({ value: value.key }).globalId
+                        === session.state.actorId);
+                if (participant === undefined) {
+                    throw new Error(`Relocation Actor '${session.state.actorId}' is missing from its envelope.`);
+                }
+                for (const packet of session.prepared.takeRelocationRelay()) {
+                    const frozenRecord = canonicalRelayFrozenRecord(participant, packet, coordinator, targetFence);
+                    const data = {
+                        kind: 'data',
+                        relocation,
+                        targetAttemptGeneration,
+                        coordinator,
+                        senderRole: 'source',
+                        object: relocationObjectForParticipant(participant),
+                        frozenRecord
+                    };
+                    boundaryBatch.push({
+                        frame: (0, service_relocation_control_1.encodeServiceRelocationControlRequest)(data),
+                        canonicalBytes: frozenRecord.canonicalBytes
+                    });
+                }
+            }
+            const cutoverFrame = (0, service_relocation_control_1.encodeServiceRelocationControlRequest)({
+                kind: 'cutover',
+                relocation,
+                targetAttemptGeneration,
+                coordinator,
+                senderRole: 'source',
+                object,
+                boundaryRecordCount: BigInt(boundaryBatch.length),
+                boundaryChecksumCrc32c: (0, service_relocation_runtime_1.crc32c)(Buffer.concat(boundaryBatch.map(value => value.canonicalBytes)))
+            });
+            // The one-way cutover submit reaches a terminal result exactly once;
+            // success and failure both end source dispatch permanently. The batch
+            // copy stays for the retransmission window (spec 28 §4.4).
+            let submitFailure;
+            try {
+                for (const record of boundaryBatch) {
+                    await this.submitControlFrame(meshName, target.rid, record.frame, 'relay');
+                }
+                await this.submitControlFrame(meshName, target.rid, cutoverFrame, 'cutover');
+            }
+            catch (error) {
+                submitFailure = error;
+                console.warn('[zlink.runtime.relocation.cutover_submit_failed]', relayAuthorityId, error);
+            }
+            this.beginSourceCutoverWindow(meshName, target.rid, relayAuthorityId, [...boundaryBatch.map(value => value.frame), cutoverFrame], submitFailure !== undefined, limits);
+            await this.waitForTargetAuthorities(captured.envelope, targetFence, convergenceDeadlineAtMs, signal);
+            relocationDebug('coordinator.target_authorities_observed', { aggregateId: captured.envelope.aggregateId });
+            for (const session of sessions)
+                session.prepared.setReplayResults([]);
+            await captured.commitSource();
+            sourceCommitted = true;
+            await this.options.reconcileStatefulAuthorityRoutes?.(signal);
+        }
+        catch (error) {
+            if (!readyReceived)
+                throw error;
+            try {
+                await this.waitForTargetAuthorities(captured.envelope, targetFence, convergenceDeadlineAtMs);
+                if (!sourceCommitted) {
+                    for (const session of sessions)
+                        session.prepared.setReplayResults([]);
+                    await captured.commitSource();
+                    sourceCommitted = true;
+                }
+                await this.options.reconcileStatefulAuthorityRoutes?.();
+                const authority = await requireAuthority(this.requireLocationStore(), { value: primaryKey(captured.envelope) }, undefined);
+                throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, { id: `${captured.envelope.aggregateId}:${captured.envelope.aggregateGeneration}` }, error);
+            }
+            catch (convergenceError) {
+                if (convergenceError instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) {
+                    throw convergenceError;
+                }
+                throw new AggregateError([error, convergenceError], 'Relocation became irreversible after Ready and target convergence failed.');
+            }
+        }
+        finally {
+            if (!readyReceived) {
+                // Only an explicit failure before the Ready reply becomes accepted
+                // restores the source from the memory payload (spec 28 §9).
+                await captured.abortSource().catch(() => undefined);
+            }
+            if (this.relocationAuthorityKeys.get(relayAuthorityId) === relayAuthorityKey) {
+                this.relocationAuthorityKeys.delete(relayAuthorityId);
+            }
+        }
+    }
+    /** Streams the payload chunks of one stage under the effective in-flight budgets. */
+    async sendRelocationStateChunks(meshName, target, identity, encoded, plan, signal) {
+        for (let ordinal = 0; ordinal < plan.chunkCount; ordinal += 1) {
+            const chunkData = (0, relocation_direct_transfer_1.relocationChunkAt)(encoded, plan, ordinal);
+            const releases = await this.acquireRelocationBudget(String(target.rid), chunkData.byteLength, signal);
+            try {
+                await this.sendControlOneWay(meshName, target.rid, {
+                    kind: 'state',
+                    relocation: identity.relocation,
+                    targetAttemptGeneration: identity.targetAttemptGeneration,
+                    coordinator: identity.coordinator,
+                    senderRole: 'source',
+                    object: identity.object,
+                    chunkOrdinal: ordinal,
+                    chunkData
+                });
+            }
+            finally {
+                for (const release of releases)
+                    release();
+            }
+        }
+    }
+    /**
+     * Phase 1 in-flight accounting: the charge covers the submit window of one
+     * chunk under min(configured, conservative) budgets per peer and per node.
+     */
+    async acquireRelocationBudget(targetRid, bytes, signal) {
+        const releases = [];
+        const nodeBudget = this.requireNodePayloadBudget();
+        const peerBudget = this.requirePeerPayloadBudget(targetRid);
+        releases.push(await nodeBudget.acquire(bytes, signal));
+        try {
+            releases.push(await peerBudget.acquire(bytes, signal));
+        }
+        catch (error) {
+            for (const release of releases)
+                release();
+            throw error;
+        }
+        return releases;
+    }
+    /** Pre-seal admission wait — a full budget delays the next unit before seal. */
+    async waitForRelocationBudgetHeadroom(targetRid, signal) {
+        await this.requireNodePayloadBudget().waitForHeadroom(signal);
+        await this.requirePeerPayloadBudget(targetRid).waitForHeadroom(signal);
+    }
+    requireNodePayloadBudget() {
+        this.nodePayloadBudget ??= new relocation_direct_transfer_1.ZLinkRelocationInFlightBudget((0, relocation_direct_transfer_1.effectiveRelocationBudgetBytes)(this.relocationLimits().relocationNodeInFlightPayloadBudgetBytes));
+        return this.nodePayloadBudget;
+    }
+    requirePeerPayloadBudget(targetRid) {
+        let budget = this.peerPayloadBudgets.get(targetRid);
+        if (budget === undefined) {
+            budget = new relocation_direct_transfer_1.ZLinkRelocationInFlightBudget((0, relocation_direct_transfer_1.effectiveRelocationBudgetBytes)(this.relocationLimits().relocationInFlightPayloadBudgetBytes));
+            this.peerPayloadBudgets.set(targetRid, budget);
+        }
+        return budget;
+    }
+    /**
+     * Starts the source retransmission window after the cutover submit
+     * terminal. The boundary batch and cutover copies live in framework memory
+     * (not charged to the in-flight budget) and are cleaned exactly once when
+     * the window ends. While the window is open a failed submit retries the
+     * whole batch on the (re-established) connection. S4 — the Message Follow
+     * route removal point — closes the unit for SafeToShutdown.
+     */
+    beginSourceCutoverWindow(meshName, targetNodeRid, relocationKey, frames, initialSubmitFailed, limits) {
+        const submittedAt = performance.now();
+        const window = {
+            meshName,
+            targetNodeRid,
+            frames,
+            cutoverSubmittedAtMs: submittedAt,
+            windowClosed: false,
+            followExpired: false
+        };
+        this.sourceCutoverWindows.set(relocationKey, window);
+        const settle = () => {
+            if (window.windowClosed && window.followExpired) {
+                this.sourceCutoverWindows.delete(relocationKey);
+            }
+        };
+        window.windowTimer = setTimeout(() => {
+            window.windowClosed = true;
+            window.frames = undefined;
+            if (window.retryTimer !== undefined)
+                clearTimeout(window.retryTimer);
+            settle();
+        }, limits.relocationCutoverWaitTimeoutMs);
+        window.windowTimer.unref();
+        window.followTimer = setTimeout(() => {
+            window.followExpired = true;
+            // S1→S4 route convergence: the span the source must keep its Message
+            // Follow route (spec 30 §7.1).
+            this.options.metrics?.duration('zlink.relocation.route_convergence', Math.max(0, performance.now() - submittedAt) / 1000, { mesh_name: meshName });
+            settle();
+        }, limits.messageFollowDurationMs);
+        window.followTimer.unref();
+        if (initialSubmitFailed)
+            this.scheduleCutoverRetransmit(window);
+    }
+    scheduleCutoverRetransmit(window) {
+        if (window.windowClosed || window.frames === undefined)
+            return;
+        window.retryTimer = setTimeout(() => {
+            void (async () => {
+                const frames = window.frames;
+                if (window.windowClosed || frames === undefined)
+                    return;
+                try {
+                    for (const frame of frames) {
+                        await this.submitControlFrame(window.meshName, window.targetNodeRid, frame, 'cutover retransmission');
+                    }
+                }
+                catch {
+                    this.scheduleCutoverRetransmit(window);
+                }
+            })();
+        }, 250);
+        window.retryTimer.unref();
+    }
+    /**
+     * True when every relocation this source started reached its Message
+     * Follow route removal point (S4) and its cutover retransmission window
+     * ended — both source-local events (spec 30 §11).
+     */
+    isSafeToShutdown() {
+        return this.sourceCutoverWindows.size === 0;
+    }
+    async releaseParticipantAuthorities(envelope, primaryKey, signal) {
+        for (const participant of envelope.participants) {
+            if (participant.key === primaryKey)
+                continue;
+            const key = { value: participant.key };
+            const current = await requireAuthority(this.requireLocationStore(), key, signal);
+            const publication = this.codec.read(current.payload);
+            if (publication === undefined)
+                continue;
+            const result = await this.requireLocationStore().compareExchangeAuthority(key, current.storeVersion, {
+                kind: 'put',
+                generationTransition: 'preserve',
+                payload: this.codec.clear(current.payload, publication.reference)
+            }, signal);
+            if (result.kind !== 'stored') {
+                throw new Error(`Participant '${participant.key}' recovery pointer release failed.`);
+            }
+        }
+    }
+    /** Restores the hidden object and its saved-work prefix before Ready. */
+    async handlePrepareControl(meshName, stagingId, request, sourceNodeRid, signal) {
+        if (sourceNodeRid === null || String(sourceNodeRid) !== request.sourceNodeRid) {
+            throw new Error('Relocation prepare source node fence does not match the authenticated peer.');
+        }
+        const targetStatus = this.requireMeshNode(meshName).status();
+        const targetOwner = this.options.currentOwner();
+        const targetDescriptor = this.options.localDescriptor?.(meshName);
+        if (targetOwner === undefined
+            || String(targetStatus.routingId) !== request.target.nodeRid
+            || targetStatus.lifecycleGeneration !== request.target.nodeGeneration
+            || targetOwner.ownerId !== request.target.ownerId
+            || targetOwner.leaseGeneration !== request.target.ownerLeaseGeneration
+            || targetDescriptor !== undefined
+                && targetDescriptor.applicationVersion !== request.applicationVersion) {
+            throw new Error('Relocation prepare target fence does not match the target owner.');
+        }
+        const fingerprint = stringifyWire(request);
+        const existing = this.targetStages.get(stagingId);
+        if (existing !== undefined) {
+            if (existing.offer.authenticatedSourceNodeRid !== String(sourceNodeRid)
+                || existing.offer.prepareFingerprint !== fingerprint) {
+                throw new Error('Relocation prepare retry source node changed.');
+            }
+            return relocationReady(request);
+        }
+        const terminal = this.terminalTargets.get(stagingId);
+        if (terminal !== undefined) {
+            if (terminal !== fingerprint) {
+                throw new Error(`Relocation '${stagingId}' repeated Prepare with different bytes.`);
+            }
+            this.terminalTargets.touch(stagingId);
+            return relocationReady(request);
+        }
+        const pendingAssembly = this.targetAssemblies.get(stagingId);
+        if (pendingAssembly === undefined || pendingAssembly.fingerprint !== fingerprint) {
+            throw new Error(`Relocation '${stagingId}' has no matching payload assembly.`);
+        }
+        // The directly transferred payload replaces the shared durable root: the
+        // Restore starts only after every chunk arrived and the assembled bytes
+        // matched the manifest checksum exactly once.
+        let payload;
+        try {
+            payload = await pendingAssembly.assembly.payload();
+        }
+        catch (error) {
+            // A rejection observed after dispose() started is the runtime shutting
+            // down, not a chunk-assembly or checksum integrity failure — it must
+            // not be reported as DataLost(35). There is no dedicated ShuttingDown
+            // wire code in the vocabulary yet, so it falls through unwrapped to
+            // the generic InternalFailure code (spec 15 §4).
+            if (this.disposed)
+                throw error;
+            const message = error !== null && typeof error === 'object' && 'message' in error
+                ? error.message ?? error
+                : error;
+            throw new ServiceRelocationDataLostError(String(message));
+        }
+        const envelope = (0, service_relocation_runtime_1.decodeServiceRelocationEnvelope)(payload, request.targetAttemptGeneration);
+        const inventoryEnvelope = attachPrepareBoundSessions(await this.resolveTargetParticipantInventory(request, envelope, signal), request.nodeInternalBoundSessions);
+        validatePrepareEnvelope(request, inventoryEnvelope);
+        let materialized;
+        let reservation;
+        try {
+            // Deferred Join completion publishes into the source authority's
+            // canonical relocation slot. Do that while the row is still CAS-able;
+            // the aggregate marker installed by reserveTargetForPrepare deliberately
+            // rejects unrelated authority CAS until commit/abort.
+            materialized = await this.materializeTargetEnvelope(meshName, inventoryEnvelope, signal);
+            await materialized.owner.restoreSavedWork(materialized.staging, signal);
+            reservation = await this.reserveTargetForPrepare(meshName, request, inventoryEnvelope, materialized.target, signal);
+            const offer = {
+                prepare: request,
+                prepareFingerprint: fingerprint,
+                authenticatedSourceNodeRid: String(sourceNodeRid),
+                envelope: inventoryEnvelope,
+                restoreDeadlineAtMs: performance.now() + RELOCATION_OPERATION_RETENTION_MS,
+                reservation
+            };
+            const stage = {
+                offer,
+                ...materialized,
+                phase: 'ready',
+                lane: Promise.resolve(),
+                cutoverReceived: false,
+                boundaryRelay: []
+            };
+            this.targetStages.set(stagingId, stage);
+        }
+        catch (error) {
+            if (reservation !== undefined) {
+                await this.abortTargetReservation(reservation, signal).catch(() => undefined);
+            }
+            if (materialized !== undefined) {
+                await materialized.owner.abort(materialized.staging).catch(() => undefined);
+            }
+            throw error;
+        }
+        return relocationReady(request);
+    }
+    armTargetCutoverFallback(meshName, stagingId) {
+        const stage = this.targetStages.get(stagingId);
+        if (stage === undefined || stage.fallback !== undefined || stage.finalize !== undefined)
+            return;
+        stage.fallback = setTimeout(() => {
+            void this.beginTargetFinalize(meshName, stagingId, stage, true)
+                .catch(error => console.error('[zlink.runtime.relocation.location_update_failed]', error));
+        }, this.relocationLimits().relocationCutoverWaitTimeoutMs);
+        stage.fallback.unref();
+    }
+    async handleOneWayControl(meshName, request, sourceNodeRid, signal) {
+        if (request.senderRole !== 'source' || sourceNodeRid === null) {
+            throw new Error('Relocation one-way control has no exact source peer.');
+        }
+        const stagingId = relocationStagingId(request);
+        const stage = this.targetStages.get(stagingId);
+        if (stage === undefined) {
+            if (this.terminalTargets.get(stagingId) !== undefined) {
+                if (request.kind === 'cutover') {
+                    console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+                }
+                return;
+            }
+            throw new Error(`Relocation staging '${stagingId}' is missing.`);
+        }
+        validateTargetOneWayControl(stage, request, sourceNodeRid);
+        if (request.kind === 'data') {
+            stage.lane = stage.lane.then(() => this.stageBoundaryRelay(stage, request));
+            await stage.lane;
+            return;
+        }
+        if (stage.cutoverReceived || stage.phase !== 'ready') {
+            console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+            return;
+        }
+        this.reconcileBoundaryRelay(stage, request, stagingId);
+        stage.cutoverReceived = true;
+        if (stage.fallback !== undefined)
+            clearTimeout(stage.fallback);
+        await this.beginTargetFinalize(meshName, stagingId, stage, false, signal);
+    }
+    /** Validates one boundary relay record and buffers it until cutover applies it. */
+    async stageBoundaryRelay(stage, request) {
+        this.validateRelocationData(stage, request);
+        stage.boundaryRelay.push(request);
+    }
+    /**
+     * Compares the cutover confirmation values against the staged boundary
+     * relay. A retransmitted batch replaces a partially received span as a
+     * whole (the retransmission always resends the entire batch, so the exact
+     * span is the staged suffix of `boundaryRecordCount` records).
+     */
+    reconcileBoundaryRelay(stage, request, stagingId) {
+        if (request.boundaryRecordCount > BigInt(Number.MAX_SAFE_INTEGER)) {
+            throw new Error('Relocation cutover boundary record count is out of range.');
+        }
+        const expectedCount = Number(request.boundaryRecordCount);
+        const staged = stage.boundaryRelay;
+        const checksumOf = (records) => (0, service_relocation_runtime_1.crc32c)(Buffer.concat(records.map(value => value.frozenRecord.canonicalBytes)));
+        if (staged.length === expectedCount
+            && checksumOf(staged) === request.boundaryChecksumCrc32c) {
+            return;
+        }
+        if (staged.length > expectedCount) {
+            const suffix = staged.slice(staged.length - expectedCount);
+            if (checksumOf(suffix) === request.boundaryChecksumCrc32c) {
+                console.warn('[zlink.runtime.relocation.boundary_batch_replaced]', stagingId);
+                staged.splice(0, staged.length - expectedCount);
+                return;
+            }
+        }
+        // Spec 28 §4.4 — on an ordered connection this comparison always holds on
+        // the normal path; a mismatch signals an implementation defect.
+        throw new Error(`Relocation cutover boundary confirmation mismatch for '${stagingId}' `
+            + `(staged=${staged.length} declared=${expectedCount}).`);
+    }
+    beginTargetFinalize(meshName, stagingId, stage, fallback, signal) {
+        if (stage.finalize !== undefined)
+            return stage.finalize;
+        if (fallback) {
+            console.warn('[zlink.runtime.relocation.cutover_timeout]', stagingId);
+            this.options.metrics?.count('zlink.relocation.cutover_timeout', 1, {
+                mesh_name: meshName
+            });
+        }
+        const finalize = stage.lane.then(() => this.finalizeTargetStage(meshName, stagingId, stage, signal));
+        stage.finalize = finalize;
+        stage.lane = finalize;
+        return finalize;
+    }
+    async finalizeTargetStage(meshName, stagingId, stage, signal) {
+        if (stage.phase !== 'ready')
+            return;
+        stage.phase = 'finalizing';
+        let authorityCommitted = false;
+        let authority;
+        let resumeStartedAt;
+        try {
+            // The boundary relay span is applied to the temporary queue before the
+            // owner CAS so the merged order is saved work, pre-boundary relay, then
+            // post-boundary temporary records (spec 28 §4.6).
+            for (const relay of stage.boundaryRelay.splice(0)) {
+                await this.applyRelocationData(stage, relay, signal);
+            }
+            authority = await this.commitTargetReservation(stage, stage.offer.reservation, signal);
+            authorityCommitted = true;
+            resumeStartedAt = performance.now();
+            stage.phase = 'committed';
+            await stage.owner.normalize(stage.staging, authority, signal);
+            await stage.owner.publish(stage.staging, authority, signal);
+            // The target may have visited this Actor before and still retain that
+            // tenure in its private Actor-client resolver. The target-only CAS is
+            // now authoritative, so expire the old projection before OnJoinedActor
+            // can issue an Actor request and deadlock behind source leave.
+            for (const hidden of stage.staging.hidden.values()) {
+                if (hidden.actor !== undefined) {
+                    this.options.invalidateActorRoute?.(hidden.actor.context.actorId);
+                }
+            }
+            await this.finalizeActorJoinProfiles(meshName, stage, signal);
+            // Actor Join completion may advance its accepted-completion journal in
+            // the canonical authority slot. Try to clear that final publication
+            // before admission becomes externally visible so a later Join cannot
+            // reserve against the previous root. A bounded CAS conflict must not
+            // roll back already committed target ownership or strand its staged
+            // object: the next reservation recognizes the retained journal root and
+            // continues its existing cleanup/retry path.
+            try {
+                await this.clearTargetRelocationPublication(stage, authority, signal);
+            }
+            catch (error) {
+                console.warn('[zlink.runtime.relocation.publication_clear_failed]', stagingId, error);
+                this.options.metrics?.count('zlink.relocation.publication_clear_failed', 1, {
+                    mesh_name: meshName
+                });
+            }
+            await stage.owner.openAdmission(stage.staging, signal);
+            // S2→S3: owner confirmation to application dispatch opening.
+            this.options.metrics?.duration('zlink.relocation.target_resume', Math.max(0, performance.now() - resumeStartedAt) / 1000, { mesh_name: meshName });
+            await this.publishSessionRoutes(stage.staging);
+            await this.relayTerminalReplies(meshName, stage, this.targetReplyRelayCoordinator(meshName, stage, authority), signal);
+            stage.phase = 'open';
+            this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
+            this.targetStages.delete(stagingId);
+            this.targetAssemblies.delete(stagingId);
+        }
+        catch (error) {
+            stage.phase = 'failed';
+            this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
+            this.targetStages.delete(stagingId);
+            this.targetAssemblies.delete(stagingId);
+            if (!authorityCommitted) {
+                await this.abortTargetStage(stage).catch(() => undefined);
+                throw error;
+            }
+            if (authority !== undefined) {
+                throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, stage.staging, error);
+            }
+            throw error;
+        }
+    }
+    validateRelocationData(stage, request) {
+        const frozen = request.frozenRecord;
+        const target = frozen.target;
+        const payload = frozen.applicationPayload;
+        const preparedTarget = stage.offer.prepare.target;
+        if (request.object.kind !== 'actor'
+            || target?.kind !== 'actor'
+            || payload === undefined
+            || payload.packetName !== '__zlink.actor.handoff.accepted'
+            || target.actorId !== request.object.actorId
+            || target.generation !== request.object.objectGeneration
+            || target.targetNodeRid !== preparedTarget.nodeRid
+            || target.targetNodeGeneration !== preparedTarget.nodeGeneration
+            || target.authorityOwnerGeneration
+                !== request.object.expectedAuthorityOwnerGeneration + 1n
+            || target.ownerLeaseGeneration !== preparedTarget.ownerLeaseGeneration) {
+            throw new Error('Relocation data does not target the exact temporary Actor queue.');
+        }
+        const key = (0, authority_key_codec_1.encodeAuthorityKey)('actor', request.object.actorId).value;
+        const participant = stage.staging.envelope.participants.find(value => value.key === key);
+        if (participant === undefined
+            || participant.objectGeneration !== request.object.objectGeneration
+            || participant.authorityOwnerGeneration
+                !== request.object.expectedAuthorityOwnerGeneration) {
+            throw new Error('Relocation data Actor is not part of the prepared unit.');
+        }
+    }
+    async applyRelocationData(stage, request, signal) {
+        const payload = request.frozenRecord.applicationPayload;
+        await stage.owner.replayRelayedMessage(stage.staging, (0, authority_key_codec_1.encodeAuthorityKey)('actor', request.object.actorId).value, { sequence: 0n, payload: Buffer.from(payload.bytes) }, signal);
+    }
+    async finalizeActorJoinProfiles(meshName, stage, signal) {
+        const manager = this.options.spotManager();
+        if (manager === undefined)
+            return;
+        for (const hidden of stage.staging.hidden.values()) {
+            if (hidden.actor === undefined)
+                continue;
+            const state = this.options.actorManager()?.getState(hidden.actor.context.actorId);
+            const nativeRef = state?.nativeActorRef;
+            if (nativeRef === undefined) {
+                throw new Error(`Actor '${hidden.actor.context.actorId}' relocation target has no native identity.`);
+            }
+            await manager.finalizeActorJoinRelocation(meshName, actorJoinAdmissionIdentity(stage.staging.envelope), hidden.actor, (0, actor_runtime_state_1.toFrameworkActorRef)(nativeRef, meshName), sourceNodeRid => this.submitActorJoinSourceLeave(meshName, sourceNodeRid, stage.staging.envelope.aggregateId, hidden.actor.context.actorId), signal);
+        }
+    }
+    async submitActorJoinSourceLeave(meshName, sourceNodeRid, relocationId, actorId) {
+        try {
+            const submitted = await this.requireMeshNode(meshName).sendToNode(sourceNodeRid, Buffer.from(JSON.stringify({
+                packetName: actor_remote_wire_1.ZLINK_REMOTE_ACTOR_SOURCE_LEAVE_TERMINAL,
+                transferId: relocationId,
+                actorId,
+                succeeded: true
+            })));
+            if (submitted !== runtime_values_1.SubmitResult.Ok) {
+                console.warn('[zlink.runtime.relocation.source_leave_submit_failed]', actorId, submitted);
+            }
+        }
+        catch (error) {
+            console.warn('[zlink.runtime.relocation.source_leave_submit_failed]', actorId, error);
+        }
+    }
+    acceptActorJoinSourceLeave(input) {
+        const profile = this.sourceActorJoinProfiles.get(input.transferId);
+        if (profile === undefined) {
+            const terminalActorId = this.terminalActorJoinSourceLeaves.get(input.transferId);
+            if (terminalActorId === undefined)
+                return false;
+            if (terminalActorId !== input.actorId || !input.succeeded) {
+                throw new Error(`Actor Join relocation '${input.transferId}' source leave identity changed.`);
+            }
+            this.terminalActorJoinSourceLeaves.touch(input.transferId);
+            return true;
+        }
+        if (profile.state.actorId !== input.actorId || !input.succeeded) {
+            throw new Error(`Actor Join relocation '${input.transferId}' source leave identity changed.`);
+        }
+        this.sourceActorJoinProfiles.delete(input.transferId);
+        this.terminalActorJoinSourceLeaves.remember(input.transferId, input.actorId);
+        void profile.ready.then(async () => {
+            await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
+            await this.options.actorManager()?.completeRelocationSource(input.actorId, profile.sourceActorRef);
+        }).catch(error => {
+            console.error('[zlink.runtime.relocation.source_leave_failed]', error);
+        });
+        return true;
+    }
+    async sendControlOneWay(meshName, targetNodeRid, request) {
+        await this.submitControlFrame(meshName, targetNodeRid, (0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request), request.kind);
+    }
+    async submitControlFrame(meshName, targetNodeRid, frame, kind) {
+        const submitted = await this.sendInfrastructureControl(meshName, targetNodeRid, frame);
+        if (submitted !== runtime_values_1.SubmitResult.Ok) {
+            throw new Error(`Relocation ${kind} was not accepted by RouteMesh.`);
+        }
+    }
+    async waitForTargetAuthorities(envelope, target, deadlineAtMs, signal) {
+        for (;;) {
+            signal?.throwIfAborted();
+            let exact = true;
+            for (const participant of envelope.participants) {
+                const current = await this.requireLocationStore().readAuthority({ value: participant.key }, signal);
+                if (current.kind !== 'snapshot'
+                    || current.objectGeneration !== participant.objectGeneration
+                    || current.ownerId !== target.ownerId
+                    || current.ownerLeaseGeneration !== target.ownerLeaseGeneration
+                    || current.authorityOwnerGeneration <= participant.authorityOwnerGeneration
+                    || String(current.allocation.descriptor.rid) !== target.nodeRid
+                    || current.allocation.descriptorLifecycleGeneration !== target.nodeGeneration) {
+                    exact = false;
+                    break;
+                }
+            }
+            if (exact)
+                return;
+            if (performance.now() >= deadlineAtMs) {
+                throw new Error('Relocation target owner was not confirmed before its original deadline.');
+            }
+            await new Promise(resolve => setTimeout(resolve, 10));
+        }
+    }
+    async clearTargetRelocationPublication(stage, primary, signal) {
+        await this.releaseParticipantAuthorities(stage.staging.envelope, stage.staging.primaryAuthorityKey.value, signal);
+        //  The deferred-Join journal advances its completion cursor with its
+        //  own authority CAS while the target finalizes, so the initially
+        //  captured storeVersion can be stale by the time the relocation
+        //  wrapper is cleared. Re-read and retry on conflict instead of turning
+        //  a completed relocation into a post-commit failure (spec 28 —
+        //  retryable store conflicts converge on the same CAS and the same
+        //  relocation identity until the outcome is determined).
+        let current = primary;
+        for (let attempt = 0; attempt < 16; attempt += 1) {
+            const publication = this.codec.read(current.payload);
+            if (publication === undefined)
+                return;
+            const result = await this.requireLocationStore().compareExchangeAuthority(stage.staging.primaryAuthorityKey, current.storeVersion, {
+                kind: 'put',
+                generationTransition: 'preserve',
+                payload: this.codec.clear(current.payload, publication.reference)
+            }, signal);
+            if (result.kind === 'stored')
+                return;
+            const read = await this.requireLocationStore().readAuthority(stage.staging.primaryAuthorityKey, signal);
+            if (read.kind !== 'snapshot')
+                break;
+            current = read;
+        }
+        throw new Error('Relocation target authority normalization CAS failed.');
+    }
+    async handleReplyRelay(meshName, relay, sourceNodeRid, signal) {
+        if (sourceNodeRid === null) {
+            throw new Error('Relocation reply relay has no authenticated target node.');
+        }
+        await this.requireAdmittedPeer(meshName, String(sourceNodeRid), relay.coordinator, signal);
+        const relocationId = wireIdText(relay.relocation);
+        const authorityKey = this.relocationAuthorityKeys.get(relocationId);
+        if (authorityKey === undefined) {
+            throw new Error('Relocation reply relay has no registered durable authority.');
+        }
+        const authority = await requireAuthority(this.requireLocationStore(), { value: authorityKey }, signal);
+        if (authority.storeVersion.value !== relay.coordinator.expectedAuthorityStoreVersion
+            || authority.ownerId !== relay.coordinator.ownerId
+            || authority.ownerLeaseGeneration !== relay.coordinator.leaseGeneration
+            || String(authority.allocation.descriptor.rid) !== relay.coordinator.nodeRid
+            || authority.allocation.descriptorLifecycleGeneration
+                !== relay.coordinator.nodeGeneration) {
+            throw new Error('Relocation reply relay coordinator authority fence is stale.');
+        }
+        const accepted = this.options.actorTransfer.relayCanonicalMaintenanceTerminal(wireIdText(relay.operation), relay.replyRouteId.toString(), handoffResultFromRelay(relay), sourceNodeRid);
+        if (accepted.status !== 'terminalReceived' && accepted.status !== 'alreadyTerminal'
+            || accepted.source === undefined) {
+            throw new Error('Canonical relocation reply relay collided with another source route.');
+        }
+        const requestSource = handoffSourceFence(accepted.source);
+        const localStatus = this.requireMeshNode(meshName).status();
+        const localOwner = this.options.currentOwner();
+        if (localOwner === undefined
+            || requestSource.ownerId !== localOwner.ownerId
+            || requestSource.leaseGeneration !== localOwner.leaseGeneration
+            || !(0, routing_id_1.routingIdsEqual)(requestSource.nodeRid, localStatus.routingId)
+            || requestSource.nodeGeneration !== localStatus.lifecycleGeneration) {
+            throw new Error('Relocation reply relay request-source fence changed after capture.');
+        }
+        const ack = {
+            relocation: relay.relocation,
+            coordinator: relay.coordinator,
+            operation: relay.operation,
+            replyRouteId: relay.replyRouteId,
+            requestSource,
+            status: accepted.status
+        };
+        if (await this.sendInfrastructureControl(meshName, sourceNodeRid, (0, service_stateful_wire_codec_1.encodeMaintenanceReplyRelayAck)(ack)) !== runtime_values_1.SubmitResult.Ok) {
+            throw new Error('Relocation reply relay ACK send was rejected.');
+        }
+    }
+    async sendReplyRelay(meshName, ackTargetNodeRid, request, expectedRequestSource, signal) {
+        const targetRid = String(ackTargetNodeRid);
+        const identityKey = replyRelayIdentityKey(request);
+        const key = replyRelayPendingKey(targetRid, request);
+        if (this.pendingReplyRelays.has(key)) {
+            throw new Error(`Relocation reply relay ACK '${key}' is already pending.`);
+        }
+        return await new Promise((resolve, reject) => {
+            let attempts = 0;
+            const finish = (action) => {
+                const pending = this.pendingReplyRelays.get(key);
+                if (pending?.timer !== undefined)
+                    clearTimeout(pending.timer);
+                this.pendingReplyRelays.delete(key);
+                action();
+            };
+            const pending = {
+                ackTargetNodeRid: targetRid,
+                identityKey,
+                request,
+                expectedRequestSource,
+                resolve: delivery => finish(() => resolve(delivery)),
+                reject: error => finish(() => reject(error))
+            };
+            const send = async () => {
+                try {
+                    if (signal?.aborted === true) {
+                        pending.reject(signal.reason);
+                        return;
+                    }
+                    if (await this.exactSourceLeaseExpired(expectedRequestSource, signal)) {
+                        pending.resolve('sourceLeaseExpired');
+                        return;
+                    }
+                    if (++attempts > 120) {
+                        pending.reject(new Error(`Relocation reply relay ACK '${key}' timed out.`));
+                        return;
+                    }
+                    await this.sendInfrastructureControl(meshName, ackTargetNodeRid, (0, service_stateful_wire_codec_1.encodeMaintenanceReplyRelay)(request));
+                    if (this.pendingReplyRelays.get(key) === pending) {
+                        pending.timer = setTimeout(() => void send(), 250);
+                    }
+                }
+                catch (error) {
+                    pending.reject(error);
+                }
+            };
+            this.pendingReplyRelays.set(key, pending);
+            void send();
+        });
+    }
+    async acceptReplyRelayAck(meshName, ack, sourceNodeRid, signal) {
+        const identityKey = replyRelayIdentityKey(ack);
+        const exactKey = sourceNodeRid === null
+            ? undefined
+            : replyRelayPendingKey(String(sourceNodeRid), ack);
+        const pending = exactKey === undefined ? undefined : this.pendingReplyRelays.get(exactKey);
+        if (pending === undefined) {
+            const collision = [...this.pendingReplyRelays.values()].find(value => value.identityKey === identityKey);
+            collision?.reject(new Error('Relocation reply relay ACK target source collided.'));
+            return;
+        }
+        try {
+            await this.requireAdmittedPeer(meshName, pending.ackTargetNodeRid, pending.expectedRequestSource, signal);
+            if (!sameWireId(ack.relocation, pending.request.relocation)
+                || !sameWireId(ack.operation, pending.request.operation)
+                || ack.replyRouteId !== pending.request.replyRouteId
+                || !sameCoordinator(ack.coordinator, pending.request.coordinator)
+                || !sameRequestSource(ack.requestSource, pending.expectedRequestSource)) {
+                throw new Error('Relocation reply relay ACK does not match its durable source fence.');
+            }
+            pending.resolve(ack.status);
+        }
+        catch (error) {
+            pending.reject(error);
+        }
+    }
+    async requireAdmittedPeer(meshName, authenticatedRid, expected, signal) {
+        const descriptor = (await this.options.liveDescriptors(meshName, signal)).find(value => String(value.rid) === authenticatedRid && value.state === 1);
+        if (descriptor === undefined
+            || expected !== undefined && (descriptor.ownerId !== expected.ownerId
+                || descriptor.leaseGeneration !== expected.leaseGeneration
+                || String(descriptor.rid) !== expected.nodeRid
+                || descriptor.lifecycleGeneration !== expected.nodeGeneration)) {
+            throw new Error('Relocation reply relay peer is not the exact admitted source fence.');
+        }
+    }
+    targetReplyRelayCoordinator(meshName, stage, authority) {
+        const status = this.requireMeshNode(meshName).status();
+        const owner = this.options.currentOwner();
+        const target = stage.offer.prepare.target;
+        if (owner === undefined
+            || owner.ownerId !== target.ownerId
+            || owner.leaseGeneration !== target.ownerLeaseGeneration
+            || String(status.routingId) !== target.nodeRid
+            || status.lifecycleGeneration !== target.nodeGeneration) {
+            throw new Error('Relocation reply relay target coordinator fence is stale.');
+        }
+        return {
+            ownerId: owner.ownerId,
+            leaseGeneration: owner.leaseGeneration,
+            nodeRid: String(status.routingId),
+            nodeGeneration: status.lifecycleGeneration,
+            expectedAuthorityStoreVersion: authority.storeVersion.value
+        };
+    }
+    async relayTerminalReplies(meshName, stage, coordinator, signal) {
+        for (const [participantIndex, participant] of stage.staging.envelope.participants.entries()) {
+            const hidden = stage.staging.hidden.get(participant.key);
+            if (hidden?.actor === undefined)
+                continue;
+            for (const [resultIndex, packet] of hidden.replayPackets.entries()) {
+                if (!packet.returnResponse || packet.source === undefined)
+                    continue;
+                const result = hidden.replayResults.at(resultIndex);
+                if (result === undefined || result.index !== packet.index) {
+                    throw new Error('Relocation request result changed after target dispatch.');
+                }
+                const completion = {
+                    index: packet.index,
+                    operationId: packet.messageFollowContext.operationId,
+                    source: packet.source,
+                    result
+                };
+                await this.sendReplyRelay(meshName, packet.source.nodeRid, maintenanceReplyRelay(stage, coordinator, BigInt(participantIndex + 1), completion), handoffSourceFence(packet.source), signal);
+            }
+        }
+    }
+    async exactSourceLeaseExpired(source, signal) {
+        const lease = await this.requireLocationStore().readOwnerLease(source.ownerId, signal);
+        return lease.kind === 'missing'
+            || lease.token.ownerId !== source.ownerId
+            || lease.token.leaseGeneration !== source.leaseGeneration
+            || lease.leaseExpiresAt.getTime() <= lease.storeNow.getTime();
+    }
+    async publishSessionRoutes(staging) {
+        for (const hidden of staging.hidden.values()) {
+            if (hidden.actor !== undefined) {
+                await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor);
+            }
+        }
+    }
+    async sendControl(meshName, targetNodeRid, request, signal, deadlineAtMs = performance.now() + 30_000, sideband = []) {
+        const key = controlAckKey(request);
+        const frames = sideband.length === 0
+            ? [(0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request)]
+            : [(0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request), ...sideband];
+        let lastRequestError;
+        for (;;) {
+            signal?.throwIfAborted();
+            const remainingMs = deadlineAtMs - performance.now();
+            if (remainingMs <= 0) {
+                throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Relocation control ACK '${key}' timed out.`, true, lastRequestError);
+            }
+            const attemptTimeoutMs = Math.max(1, Math.min(250, Math.ceil(remainingMs)));
+            const startedAtMs = performance.now();
+            try {
+                const replyFrames = await this.requestInfrastructureControl(meshName, targetNodeRid, frames, attemptTimeoutMs);
+                if (replyFrames.length !== 1) {
+                    throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`Relocation control '${key}' reply must contain exactly one frame.`);
+                }
+                const response = (0, service_relocation_control_1.decodeServiceRelocationControlResponse)(Buffer.from(replyFrames[0]));
+                if (response.kind === 'failed') {
+                    validateControlFailureResponse(request, response);
+                    throw relocationFailureException(response);
+                }
+                validateControlResponse(request, response);
+                return response;
+            }
+            catch (error) {
+                if (error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError
+                    || error instanceof contracts_1.ZLinkFrameworkException) {
+                    throw error;
+                }
+                lastRequestError = error;
+                relocationDebug('control.request_retry', {
+                    key,
+                    kind: request.kind,
+                    targetRid: String(targetNodeRid)
+                });
+                const retryDelayMs = Math.min(Math.max(0, attemptTimeoutMs - (performance.now() - startedAtMs)), Math.max(0, deadlineAtMs - performance.now()));
+                if (retryDelayMs > 0) {
+                    await waitForRelocationRetry(retryDelayMs, signal);
+                }
+            }
+        }
+    }
+    async selectTarget(meshName, localRid, targetApplicationVersion, requirements = [], signal) {
+        const descriptors = await this.options.liveDescriptors(meshName, signal);
+        const local = this.options.localDescriptor?.(meshName)
+            ?? descriptors.find(descriptor => String(descriptor.rid) === localRid);
+        const requiredVersion = targetApplicationVersion ?? local?.applicationVersion;
+        const peers = this.requireMeshNode(meshName).peers();
+        const candidates = descriptors
+            .filter(descriptor => String(descriptor.rid) !== localRid
+            && descriptor.state === contracts_1.ZLinkFrameworkRuntimeState.Serving
+            && descriptor.objectRole === contracts_1.ZLinkObjectRole.Server
+            && descriptor.placementWeight > 0
+            && (requiredVersion === undefined
+                || descriptor.applicationVersion === requiredVersion)
+            && (local?.maintenanceWave === undefined
+                || descriptor.maintenanceWave !== local.maintenanceWave)
+            && peers.some(peer => peer.routingId !== null
+                && String(peer.routingId) === String(descriptor.rid)
+                && peer.lifecycleGeneration === descriptor.lifecycleGeneration
+                && peer.state === 3)
+            && relocationTargetSupports(descriptor, requirements))
+            .sort((left, right) => String(left.rid).localeCompare(String(right.rid)));
+        const target = selectWeightedRelocationTarget(candidates);
+        if (target === undefined) {
+            // Spec 15 §"Failed.Kind": no compatible target node is Unavailable, the
+            // same classification the session-seal control path uses for a target
+            // it cannot reach.
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RelocationTargetUnavailable, `RouteMesh '${meshName}' has no relocation target.`, true);
+        }
+        return target;
+    }
+    async readTargetParticipantAuthorities(envelope, signal) {
+        const authorities = new Map();
+        for (const participant of envelope.participants) {
+            const current = await requireAuthority(this.requireLocationStore(), { value: participant.key }, signal);
+            if (current.objectGeneration !== participant.objectGeneration
+                || current.authorityOwnerGeneration !== participant.authorityOwnerGeneration
+                || current.allocation.objectKind !== participant.objectKind
+                || current.allocation.stableType !== participant.stableType
+                || current.allocation.state !== 'active') {
+                throw new Error(`Relocation participant '${participant.key}' authority changed before reservation.`);
+            }
+            authorities.set(participant.key, current);
+        }
+        return authorities;
+    }
+    async reserveTargetForPrepare(meshName, prepare, envelope, targetPort, signal) {
+        const authorities = await this.readTargetParticipantAuthorities(envelope, signal);
+        const publication = relocationPublication(prepare, envelope);
+        // Carries the exact reference + CRC of a deferred-Join publication the
+        // target reservation must keep connected through the CAS (spec 28 —
+        // clearing/replacing it here would strand the journal's own
+        // prepared->committed transition with nothing left for it to find).
+        const retainedDeferredJoinRoots = new Map();
+        for (const participant of envelope.participants) {
+            const staged = targetPort.deferredJoinRoot(participant.key);
+            if (staged !== undefined) {
+                retainedDeferredJoinRoots.set(participant.key, {
+                    reference: staged.reference.value,
+                    checksumCrc32c: staged.checksumCrc32c
+                });
+                continue;
+            }
+            const current = this.codec.read(authorities.get(participant.key).payload);
+            if (participant.objectKind === 'actor'
+                && current?.canonical === true
+                && await this.options.actorTransfer.isDeferredJoinAcceptedRootPublication(current.reference, current.checksumCrc32c, {
+                    authorityKey: participant.key,
+                    objectKind: 'actor',
+                    objectGeneration: participant.objectGeneration,
+                    aggregateId: current.aggregateId,
+                    aggregateGeneration: current.aggregateGeneration
+                }, signal)) {
+                retainedDeferredJoinRoots.set(participant.key, {
+                    reference: current.reference,
+                    checksumCrc32c: current.checksumCrc32c
+                });
+            }
+        }
+        const participants = envelope.participants.map(participant => {
+            const expected = authorities.get(participant.key);
+            const membership = actorMembershipTarget(envelope, participant.key);
+            const entrySpotId = expected.allocation.objectKind === 'actor'
+                && membership === undefined
+                ? this.options.spotManager()?.entrySpotIdForMesh(meshName)
+                : undefined;
+            if (expected.allocation.objectKind === 'actor'
+                && membership === undefined
+                && entrySpotId === undefined) {
+                throw new Error(`Relocation target RouteMesh '${meshName}' has no Entry Spot.`);
+            }
+            const retainedDeferredJoinRoot = retainedDeferredJoinRoots.get(participant.key);
+            const participantPublication = retainedDeferredJoinRoot === undefined
+                ? publication
+                : {
+                    ...publication,
+                    reference: retainedDeferredJoinRoot.reference,
+                    checksumCrc32c: retainedDeferredJoinRoot.checksumCrc32c
+                };
+            return {
+                key: { value: participant.key },
+                expected,
+                ownerTransition: 'newOwner',
+                authorityPayload: this.authorityPayloadForPublication(expected.payload, participantPublication, {
+                    owner: {
+                        ownerId: prepare.target.ownerId,
+                        leaseGeneration: prepare.target.ownerLeaseGeneration
+                    },
+                    meshName,
+                    nodeRid: prepare.target.nodeRid,
+                    nodeGeneration: prepare.target.nodeGeneration,
+                    objectGeneration: expected.objectGeneration,
+                    targetAttemptGeneration: prepare.targetAttemptGeneration,
+                    coordinatorExpectedStoreVersion: expected.storeVersion.value,
+                    ...(membership === undefined
+                        ? expected.allocation.objectKind === 'actor'
+                            ? {
+                                actorSpotId: entrySpotId,
+                                actorSpotGeneration: prepare.target.nodeGeneration,
+                                actorSpotKind: contracts_1.ZLinkSpotKind.Entry
+                            }
+                            : {}
+                        : {
+                            ...membership,
+                            actorSpotKind: contracts_1.ZLinkSpotKind.User
+                        })
+                }, retainedDeferredJoinRoot !== undefined),
+                membershipMutation: encodeMembershipMutation(envelope.memberships, participant.key)
+            };
+        });
+        const plan = {
+            envelope,
+            participants,
+            targetDescriptor: { meshName, rid: prepare.target.nodeRid },
+            targetDescriptorLifecycleGeneration: prepare.target.nodeGeneration,
+            capacity: participants.reduce((sum, participant) => addCapacity(sum, participant.expected.allocation.capacity), { actors: 0, spots: 0 }),
+            targetOwner: {
+                ownerId: prepare.target.ownerId,
+                leaseGeneration: prepare.target.ownerLeaseGeneration
+            }
+        };
+        return {
+            prepared: await new service_relocation_aggregate_committer_1.ServiceRelocationAggregateCommitter(this.requireLocationStore())
+                .prepare(plan, signal)
+        };
+    }
+    authorityPayloadForPublication(payload, publication, target, replacesDeferredJoinRoot = false) {
+        const existing = this.codec.read(payload);
+        const canonicalIdentity = (0, service_relocation_runtime_1.serviceRelocationAuthoritySlotIdentity)(payload);
+        const replacesCanonicalJournal = replacesDeferredJoinRoot
+            && existing?.canonical === true;
+        if (canonicalIdentity !== undefined
+            && (existing === undefined
+                || existing.canonical === true
+                    && (existing.aggregateId === publication.aggregateId
+                        || replacesCanonicalJournal))) {
+            const published = existing === undefined
+                ? this.codec.publish(payload, publication)
+                : replacesCanonicalJournal
+                    && existing.aggregateId !== publication.aggregateId
+                    ? this.codec.publish(this.codec.clear(payload, existing.reference), publication)
+                    : payload;
+            if (target === undefined)
+                return published;
+            return (0, service_relocation_runtime_1.projectServiceRelocationAuthorityTargetReady)((0, service_relocation_runtime_1.replaceServiceRelocationAuthorityApplicationPayload)(published, rewriteAuthorityApplicationRoute(published, target)), {
+                targetAttemptGeneration: target.targetAttemptGeneration,
+                nodeRid: target.nodeRid,
+                nodeGeneration: target.nodeGeneration,
+                ownerId: target.owner.ownerId,
+                ownerLeaseGeneration: target.owner.leaseGeneration,
+                coordinatorExpectedStoreVersion: target.coordinatorExpectedStoreVersion
+            });
+        }
+        if (existing === undefined) {
+            const published = this.codec.publish(payload, publication);
+            if (target === undefined) {
+                return published;
+            }
+            if ((0, service_relocation_runtime_1.serviceRelocationAuthoritySlotIdentity)(published) !== undefined) {
+                return (0, service_relocation_runtime_1.projectServiceRelocationAuthorityTargetReady)((0, service_relocation_runtime_1.replaceServiceRelocationAuthorityApplicationPayload)(published, rewriteAuthorityApplicationRoute(published, target)), {
+                    targetAttemptGeneration: target.targetAttemptGeneration,
+                    nodeRid: target.nodeRid,
+                    nodeGeneration: target.nodeGeneration,
+                    ownerId: target.owner.ownerId,
+                    ownerLeaseGeneration: target.owner.leaseGeneration,
+                    coordinatorExpectedStoreVersion: target.coordinatorExpectedStoreVersion
+                });
+            }
+            return this.codec.publish(rewriteAuthorityApplicationRoute(payload, target), publication);
+        }
+        if (existing.reference !== publication.reference
+            || existing.checksumCrc32c !== publication.checksumCrc32c
+            || existing.aggregateId !== publication.aggregateId
+            || existing.aggregateGeneration !== publication.aggregateGeneration
+            || existing.inventoryDigest !== publication.inventoryDigest
+            || existing.targetOwnerId !== publication.targetOwnerId
+            || existing.targetOwnerLeaseGeneration
+                !== publication.targetOwnerLeaseGeneration) {
+            throw new Error('Relocation authority contains another published root '
+                + `(current=${existing.aggregateId}/${existing.aggregateGeneration}`
+                + `/${existing.reference}/canonical=${existing.canonical === true}, `
+                + `requested=${publication.aggregateId}/${publication.aggregateGeneration}`
+                + `/${publication.reference}).`);
+        }
+        return payload;
+    }
+    async abortTargetReservation(reservation, signal) {
+        await new service_relocation_aggregate_committer_1.ServiceRelocationAggregateCommitter(this.requireLocationStore())
+            .abort(reservation.prepared, signal);
+    }
+    async abortTargetStage(stage, signal) {
+        if (stage.fallback !== undefined)
+            clearTimeout(stage.fallback);
+        const failures = [];
+        try {
+            await this.abortTargetReservation(stage.offer.reservation, signal);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        try {
+            await stage.owner.abort(stage.staging);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        stage.phase = 'failed';
+        if (failures.length === 1)
+            throw failures[0];
+        if (failures.length > 1) {
+            throw new AggregateError(failures, 'Relocation target rollback was incomplete.');
+        }
+    }
+    async commitTargetReservation(stage, reservation, signal) {
+        return await this.commitTargetAggregate(stage, reservation.prepared, signal);
+    }
+    async commitTargetAggregate(stage, prepared, signal) {
+        let firstError;
+        for (;;) {
+            signal?.throwIfAborted();
+            let result;
+            try {
+                result = await this.requireLocationStore().commitAggregate(prepared.fence, signal);
+            }
+            catch (error) {
+                firstError ??= error;
+            }
+            if (result?.kind === 'stale' || result?.kind === 'generationExhausted') {
+                throw new Error(`location_update_failed: relocation aggregate commit returned ${result.kind}.`, { cause: firstError });
+            }
+            const observed = await this.readAggregateForCommitRetry(prepared, signal);
+            if (observed.kind === 'committed') {
+                const primary = observed.authorities.get(stage.staging.primaryAuthorityKey.value);
+                if (primary === undefined) {
+                    throw new Error('Committed relocation aggregate omitted its primary authority.');
+                }
+                return primary;
+            }
+            if (observed.kind === 'stale') {
+                throw new Error('location_update_failed: relocation aggregate source authority became stale.', {
+                    cause: firstError
+                });
+            }
+            await waitForLocationRetry(stage.offer.restoreDeadlineAtMs, signal, firstError);
+        }
+    }
+    async readAggregateForCommitRetry(prepared, signal) {
+        const authorities = new Map();
+        let source = 0;
+        let committed = 0;
+        try {
+            for (const participant of prepared.plan.participants) {
+                const current = await this.requireLocationStore().readAuthority(participant.key, signal);
+                if (current.kind !== 'snapshot')
+                    return { kind: 'stale' };
+                if (isExactCommittedTarget(current, participant.expected, {
+                    nodeRid: String(prepared.plan.targetDescriptor.rid),
+                    nodeGeneration: prepared.plan.targetDescriptorLifecycleGeneration,
+                    ownerId: prepared.plan.targetOwner.ownerId,
+                    ownerLeaseGeneration: prepared.plan.targetOwner.leaseGeneration
+                }, participant.authorityPayload)) {
+                    committed += 1;
+                    authorities.set(participant.key.value, current);
+                }
+                else if (isExactSourceAuthority(current, participant.expected)) {
+                    source += 1;
+                }
+                else {
+                    return { kind: 'stale' };
+                }
+            }
+        }
+        catch {
+            return { kind: 'unknown' };
+        }
+        if (committed === prepared.plan.participants.length) {
+            return { kind: 'committed', authorities };
+        }
+        return source === prepared.plan.participants.length
+            ? { kind: 'source' }
+            : { kind: 'stale' };
+    }
+    async materializeTargetEnvelope(meshName, envelope, signal) {
+        const target = new LocalTargetPort(this.options, meshName, envelope);
+        const owner = new service_relocation_object_owner_1.ServiceRelocationObjectRestoreOwner(target, value => ({ value }));
+        const staging = await owner.prepare(envelope, signal);
+        if (staging.id !== `${envelope.aggregateId}:${envelope.aggregateGeneration}`) {
+            throw new Error('Relocation materialization returned a different staging identity.');
+        }
+        return { owner, staging, target };
+    }
+    /** Maps schema ordinals to the authoritative Location Store inventory. */
+    async resolveTargetParticipantInventory(request, envelope, signal) {
+        if (!envelope.participants.some(value => value.rootSpotId !== undefined)) {
+            return envelope;
+        }
+        const store = this.requireLocationStore();
+        const manager = this.options.spotManager();
+        const primaryKey = request.object.kind === 'actor'
+            ? (0, authority_key_codec_1.encodeAuthorityKey)('actor', request.object.actorId)
+            : (0, authority_key_codec_1.encodeAuthorityKey)(request.object.kind === 'userSpot' ? 'user_spot' : 'instance_spot', request.object.spotId);
+        const primary = await requireAuthority(store, primaryKey, signal);
+        const entries = [
+            { key: primaryKey, snapshot: primary }
+        ];
+        if (request.object.kind === 'userSpot' || request.object.kind === 'instanceSpot') {
+            let cursor;
+            for (;;) {
+                const page = await store.listAuthorities('', cursor, 1000, signal);
+                if (page.kind === 'scanExpired') {
+                    throw new Error('Location Store authority scan expired during relocation.');
+                }
+                for (const candidate of page.items) {
+                    if (candidate.key.value === primaryKey.value
+                        || (0, authority_key_codec_1.decodeAuthorityKey)(candidate.key).kind !== 'actor')
+                        continue;
+                    const actor = (0, actor_authority_publication_1.decodeRelocatingActorAuthorityIdentity)(candidate.snapshot.payload, candidate.snapshot.objectGeneration);
+                    if (actor?.spotId === request.object.spotId) {
+                        entries.push(candidate);
+                    }
+                }
+                if (page.nextCursor === undefined)
+                    break;
+                cursor = page.nextCursor;
+            }
+        }
+        entries.sort((left, right) => Buffer.compare(Buffer.from(left.key.value, 'utf8'), Buffer.from(right.key.value, 'utf8')));
+        if (new Set(entries.map(entry => entry.key.value)).size !== entries.length) {
+            throw new Error('Location Store relocation inventory has duplicate authority keys.');
+        }
+        const root = envelope.participants.find(value => value.rootSpotId !== undefined);
+        const expectedRootId = request.object.kind === 'actor'
+            ? request.object.actorId
+            : request.object.spotId;
+        if (root === undefined
+            || root.rootSpotId !== expectedRootId
+            || root.rootObjectKind !== primary.allocation.objectKind
+            || root.rootSpotGeneration !== primary.objectGeneration
+            || root.rootObjectKind !== 'instance_spot'
+                && root.rootOwnerGeneration !== primary.authorityOwnerGeneration) {
+            throw new Error('Relocation root object projection does not match Location Store.');
+        }
+        const transferred = new Map(envelope.participants.map(participant => [participant.participantId, participant]));
+        if (transferred.size !== envelope.participants.length || transferred.size !== entries.length) {
+            throw new Error('Relocation payload participant inventory does not match Location Store.');
+        }
+        const participants = entries.map(({ key, snapshot }, index) => {
+            const participantId = BigInt(index + 1);
+            const transferredParticipant = transferred.get(participantId);
+            if (transferredParticipant === undefined) {
+                throw new Error('Relocation payload participant identity does not match Location Store.');
+            }
+            return {
+                ...transferredParticipant,
+                key: key.value,
+                objectKind: snapshot.allocation.objectKind,
+                stableType: snapshot.allocation.stableType,
+                objectGeneration: snapshot.objectGeneration,
+                authorityOwnerGeneration: snapshot.authorityOwnerGeneration
+            };
+        });
+        // Actor-root saved work is admitted against the destination membership.
+        // The canonical root intentionally omits a membership vector; meanwhile
+        // Location Store still names the source Spot until target cutover. Rebuild
+        // the Actor lane from the already accepted ActorJoin admission, preserving
+        // the target queue boundary for decoded saved-work.
+        const memberships = request.object.kind === 'actor'
+            ? actorJoinTargetMembership(manager, envelope.aggregateId, participants)
+            : entries
+                .filter(entry => entry.snapshot.allocation.objectKind === 'actor')
+                .map(entry => ({
+                actorKey: entry.key.value,
+                spotKey: primaryKey.value,
+                spotObjectGeneration: primary.objectGeneration,
+                membershipEpoch: 1n
+            }));
+        return {
+            ...envelope,
+            participants,
+            memberships
+        };
+    }
+    spotKind(meshName, activation) {
+        const node = this.options.registration.spotNodes.get(meshName);
+        const registrations = activation.domain.kind === 'user'
+            ? node?.spotFactoryRegistrations
+            : node?.instanceSpotFactoryRegistrations;
+        return Object.values(registrations ?? {})
+            .some(value => value.implementation === activation.spotType)
+            ? activation.domain.kind === 'user' ? 'user_spot' : 'instance_spot'
+            : undefined;
+    }
+    spotRegistration(meshName, kind, stableType) {
+        const node = this.options.registration.spotNodes.get(meshName);
+        const value = kind === 'user_spot'
+            ? node?.spotFactoryRegistrations?.[stableType]
+            : node?.instanceSpotFactoryRegistrations?.[stableType];
+        if (value === undefined)
+            throw new Error(`Relocation Spot type '${stableType}' is not registered.`);
+        return value;
+    }
+    actorRegistration(meshName, stableType) {
+        const value = this.options.registration.spotNodes.get(meshName)
+            ?.actorFactoryRegistrations?.[stableType];
+        if (value === undefined)
+            throw new Error(`Relocation Actor type '${stableType}' is not registered.`);
+        return value;
+    }
+    async captureApplication(policy, value, signal) {
+        if (policy.kind === 'disabled') {
+            throw new Error(`Relocation is disabled for '${value.constructor?.name ?? 'object'}'.`);
+        }
+        if (policy.kind === 'recreate')
+            return Buffer.alloc(0);
+        const adapter = await this.createRelocationAdapter(policy.adapterType);
+        const captured = await (0, relocation_state_adapter_1.captureRelocationAdapterState)(adapter, value, signal ?? new AbortController().signal);
+        if (captured.byteLength > RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES) {
+            throw new ZLinkRelocationStateIncompatibleError('Relocation application state exceeds the 64 MiB participant limit.');
+        }
+        return captured;
+    }
+    async createRelocationAdapter(adapterType) {
+        return await (0, spot_provider_1.createProviderInstance)(adapterType, this.options.providerResolver);
+    }
+    recordRelocationInterruption(meshName, unitKind, executionMode, startedAt, outcome) {
+        const seconds = Math.max(0, performance.now() - startedAt) / 1000;
+        const attributes = {
+            unit_kind: unitKind,
+            ...(executionMode === undefined ? {} : { execution_mode: executionMode })
+        };
+        this.options.metrics?.duration('zlink.relocation.interruption', seconds, attributes);
+        this.options.metrics?.count('zlink.relocation.completed', 1, {
+            mesh_name: meshName,
+            object_kind: unitKind,
+            policy: unitKind === 'user_spot' && executionMode === 'per_actor'
+                ? 'recreate'
+                : 'configured',
+            outcome
+        });
+        if (seconds <= 1)
+            return;
+        console.warn(`[zlink.runtime.relocation.changed] ${unitKind} admission interruption ` +
+            `exceeded 1 second (${seconds.toFixed(3)}s).`);
+        void this.options.runtimeEventPublisher?.publish({
+            sourceName: 'zlink.runtime.relocation',
+            timestamp: new Date(),
+            identifier: 'zlink.runtime.relocation.changed',
+            meshName,
+            unitKind,
+            executionMode,
+            interruptionTargetExceeded: true,
+            durationSeconds: seconds
+        });
+    }
+    sealSpotMessageFollow(meshName, authority, activation) {
+        const node = this.requireMeshNode(meshName);
+        const seal = node.sealSpotMessageFollowIngress;
+        const abort = node.abortSpotMessageFollowIngress;
+        const commit = node.commitSpotMessageFollowIngress;
+        if (seal === undefined && abort === undefined && commit === undefined)
+            return undefined;
+        if (seal === undefined || abort === undefined || commit === undefined) {
+            throw new Error('Spot Message Follow backend support is incomplete.');
+        }
+        const status = node.status();
+        const result = seal.call(node, {
+            spot: {
+                spotId: String(activation.spotId),
+                generation: authority.objectGeneration
+            },
+            targetNodeRid: String(status.routingId),
+            targetNodeGeneration: status.lifecycleGeneration,
+            authorityOwnerGeneration: authority.authorityOwnerGeneration,
+            ownerLeaseGeneration: authority.ownerLeaseGeneration,
+            storeVersion: authority.storeVersion.value
+        });
+        if (result === undefined) {
+            throw new Error(`Spot '${String(activation.spotId)}' ingress could not be sealed for relocation.`);
+        }
+        return result;
+    }
+    async commitSpotMessageFollow(meshName, seal, authorityKey, activation, target) {
+        const node = this.requireMeshNode(meshName);
+        const commit = node.commitSpotMessageFollowIngress;
+        if (commit === undefined) {
+            throw new Error('Spot Message Follow backend support is incomplete.');
+        }
+        const committed = await requireAuthority(this.requireLocationStore(), authorityKey);
+        const accepted = await commit.call(node, seal, {
+            spot: {
+                spotId: String(activation.spotId),
+                generation: committed.objectGeneration
+            },
+            targetNodeRid: String(target.rid),
+            targetNodeGeneration: target.lifecycleGeneration,
+            authorityOwnerGeneration: committed.authorityOwnerGeneration,
+            ownerLeaseGeneration: committed.ownerLeaseGeneration,
+            storeVersion: committed.storeVersion.value
+        }, this.relocationLimits().messageFollowDurationMs);
+        if (!accepted) {
+            throw new Error(`Spot '${String(activation.spotId)}' Message Follow route became stale.`);
+        }
+    }
+    requireLocationStore() {
+        const value = this.options.locationStore();
+        if (value === undefined)
+            throw new Error('Host relocation requires a Location Store.');
+        return value;
+    }
+    requireSpotManager() {
+        const value = this.options.spotManager();
+        if (value === undefined)
+            throw new Error('Host relocation requires the Spot manager.');
+        return value;
+    }
+    requireActorManager() {
+        const value = this.options.actorManager();
+        if (value === undefined)
+            throw new Error('Host relocation requires the Actor manager.');
+        return value;
+    }
+    relocationLimits() {
+        const configured = this.options.registration?.locations?.options;
+        return {
+            ...Options_1.zlinkRuntimeDefaultLocationOptions,
+            ...(configured ?? {})
+        };
+    }
+    requireMeshNode(meshName) {
+        const value = this.options.meshNode(meshName);
+        if (value === undefined)
+            throw new Error(`RouteMesh '${meshName}' is not started.`);
+        return value;
+    }
+    async sendInfrastructureControl(meshName, targetNodeRid, record) {
+        const node = this.requireMeshNode(meshName);
+        const send = node.sendInfrastructureControl;
+        if (send === undefined) {
+            // Compatibility backends may expose raw RouteMesh delivery through the
+            // ordinary node-send port. Production Node backends provide the
+            // dedicated service-control API above, so this branch neither changes
+            // their framing nor turns a missing send into an immediate terminal:
+            // command 42 still owns its configured deadline while admission waits.
+            if (Array.isArray(record)) {
+                return await node.sendToNode(targetNodeRid, record.map(frame => Buffer.from(frame)));
+            }
+            return await node.sendToNode(targetNodeRid, Buffer.from(record));
+        }
+        if (Array.isArray(record)) {
+            const sendFrames = node.sendInfrastructureControlFrames;
+            if (sendFrames !== undefined) {
+                return await sendFrames.call(node, targetNodeRid, record);
+            }
+            // Legacy in-memory backends have no multipart ingress. They exercise
+            // the canonical frame only; production Node backends implement the
+            // explicit multipart capability above.
+            return await send.call(node, targetNodeRid, record[0]);
+        }
+        return await send.call(node, targetNodeRid, record);
+    }
+    async requestInfrastructureControl(meshName, targetNodeRid, frames, timeoutMs) {
+        const node = this.requireMeshNode(meshName);
+        const request = node.requestInfrastructureControlFrames;
+        if (request === undefined) {
+            throw new Error('RouteMesh backend cannot submit bare infrastructure requests.');
+        }
+        return await request.call(node, targetNodeRid, frames, { timeoutMs });
+    }
+}
+exports.ZLinkHostServiceRelocationRuntime = ZLinkHostServiceRelocationRuntime;
+function canonicalActorJoinRecovery(participants) {
+    const matches = participants.flatMap(participant => participant.queuedMessages.flatMap(message => {
+        const recovery = (0, actor_join_recovery_codec_1.decodeCanonicalActorJoinRecoverySavedWork)(message.payload);
+        return recovery === undefined ? [] : [recovery];
+    }));
+    if (matches.length > 1) {
+        throw new Error('Actor relocation contains duplicate canonical Join recovery records.');
+    }
+    return matches[0];
+}
+function actorJoinAdmissionIdentity(envelope) {
+    return canonicalActorJoinRecovery(envelope.participants)?.request.handoffId
+        ?? envelope.aggregateId;
+}
+function actorJoinTargetMembership(manager, relocationId, participants) {
+    const recovery = canonicalActorJoinRecovery(participants);
+    const admissionId = recovery?.request.handoffId ?? relocationId;
+    const admission = manager?.formalRemoteActorAdmissions?.get(admissionId);
+    const actor = participants.find(value => value.objectKind === 'actor');
+    if (admission === undefined || actor === undefined) {
+        throw new Error(`Actor relocation '${relocationId}' has no accepted target membership.`);
+    }
+    return [{
+            actorKey: actor.key,
+            spotKey: (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(admission.admission.spotId)).value,
+            spotObjectGeneration: admission.admission.targetSpotGeneration,
+            membershipEpoch: admission.admission.expectedMembershipEpoch
+        }];
+}
+function relocationDebug(marker, detail) {
+    if (process.env.ZLINK_DEBUG_FRAMEWORK_RELOCATION !== '1')
+        return;
+    console.error('[zlink.runtime.relocation]', marker, detail);
+}
+class LocalTargetPort {
+    options;
+    meshName;
+    envelope;
+    deferredJoinRoots = new Map();
+    constructor(options, meshName, envelope) {
+        this.options = options;
+        this.meshName = meshName;
+        this.envelope = envelope;
+    }
+    async createHidden(participant, signal) {
+        const identity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: participant.key }).globalId;
+        if (participant.objectKind === 'actor') {
+            const membership = this.envelope.memberships.find(value => value.actorKey === participant.key);
+            if (membership === undefined)
+                throw new Error(`Actor '${identity}' relocation membership is missing.`);
+            const spotIdentity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: membership.spotKey }).globalId;
+            const localDescriptor = this.options.localDescriptor?.(this.meshName);
+            const nativeEntrySpot = localDescriptor?.entrySpotId === spotIdentity;
+            const actor = await this.requireActorManager().prepareRelocationActor(identity, participant.stableType, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, (nativeEntrySpot ? localDescriptor.rid : spotIdentity), nativeEntrySpot ? localDescriptor.lifecycleGeneration : membership.spotObjectGeneration, membership.membershipEpoch, signal);
+            return {
+                authorityKey: participant.key,
+                participant,
+                actor,
+                initialized: false,
+                restoredTimers: [],
+                replayResults: [],
+                replayPackets: []
+            };
+        }
+        const registration = this.registration(participant.objectKind, participant.stableType);
+        const activation = await this.requireSpotManager().prepareRelocationSpot(this.meshName, participant.objectKind, participant.stableType, registration.implementation, identity, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, signal);
+        return {
+            authorityKey: participant.key,
+            participant,
+            activation,
+            initialized: false,
+            restoredTimers: [],
+            replayResults: [],
+            replayPackets: []
+        };
+    }
+    async restoreApplicationState(hidden, payload, signal) {
+        const registration = this.registration(hidden.participant.objectKind, hidden.participant.stableType);
+        if (registration.relocation.kind === 'recreate') {
+            if (payload.byteLength !== 0)
+                throw new Error('Recreate relocation contains snapshot state.');
+            return;
+        }
+        if (registration.relocation.kind !== 'snapshot') {
+            throw new Error(`Relocation is disabled for '${hidden.participant.stableType}'.`);
+        }
+        const adapter = await (0, spot_provider_1.createProviderInstance)(registration.relocation.adapterType, this.options.providerResolver);
+        const instance = (hidden.actor ?? hidden.activation?.spot);
+        await (0, relocation_state_adapter_1.restoreRelocationAdapterState)(adapter, instance, payload, signal ?? new AbortController().signal);
+    }
+    async restoreMemberships(hidden, memberships) {
+        for (const membership of memberships) {
+            const actor = hidden.get(membership.actorKey)?.actor;
+            const spotIdentity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: membership.spotKey }).globalId;
+            const spot = hidden.get(membership.spotKey)?.activation
+                ?? this.requireSpotManager().resolveRelocationActivation(this.meshName, spotIdentity);
+            if (actor === undefined)
+                throw new Error('Relocation membership Actor staging is missing.');
+            const state = this.requireActorManager().getState(actor.context.actorId);
+            const localDescriptor = this.options.localDescriptor?.(this.meshName);
+            const isEntryMembership = localDescriptor?.entrySpotId === spotIdentity;
+            if (isEntryMembership) {
+                // Entry Spot identity is published as a Location membership key, but
+                // it is not a User Spot activation in the Actor runtime. The native
+                // restore already received the target MeshNode RID as its Entry
+                // membership; clearing the framework Spot state keeps dispatch on the
+                // local Entry Spot path after the target commit.
+                state.clearJoinedSpot();
+            }
+            else {
+                state.setJoinedSpot(spotIdentity, spot?.spot, membership.membershipEpoch);
+            }
+            spot?.commitActorJoin(actor);
+        }
+    }
+    async publish(hidden, authority) {
+        if (hidden.actor !== undefined) {
+            const store = this.requireLocationStore();
+            const current = await requireAuthority(store, { value: hidden.authorityKey });
+            const actorId = hidden.actor.context.actorId;
+            const node = this.options.meshNode(this.meshName);
+            const restore = node?.restoreActorAuthority;
+            if (node === undefined || restore === undefined) {
+                throw new Error(`Relocation Actor '${actorId}' native authority publication is unavailable.`);
+            }
+            const native = node.actorLookup(actorId);
+            restore.call(node, actorId, hidden.participant.stableType, current.objectGeneration, current.authorityOwnerGeneration, String(native.spotId), native.spotGeneration, native.membershipEpoch);
+            this.requireActorManager().adoptCreatedAuthority(actorId, current.authorityOwnerGeneration, current.ownerLeaseGeneration);
+            hidden.targetAuthorityOwnerGeneration = current.authorityOwnerGeneration;
+        }
+        else if (hidden.activation !== undefined) {
+            const registration = this.registration(hidden.participant.objectKind, hidden.participant.stableType);
+            const applicationSignaled = hidden.participant.objectKind === 'user_spot'
+                && registration.options?.relocationCoordinationMode
+                    === contracts_1.ZLinkSpotRelocationCoordinationMode.ApplicationSignaled;
+            await this.requireSpotManager().publishRelocationSpot(hidden.activation, applicationSignaled
+                ? () => hidden.activation.notifyRelocatedBoundary()
+                : undefined);
+            this.options.meshNode(this.meshName)?.rememberSpotRoute?.({
+                spot: {
+                    spotId: String(hidden.activation.spotId),
+                    generation: authority.objectGeneration
+                },
+                targetNodeRid: String(authority.allocation.descriptor.rid),
+                targetNodeGeneration: authority.allocation.descriptorLifecycleGeneration,
+                authorityOwnerGeneration: authority.authorityOwnerGeneration,
+                ownerLeaseGeneration: authority.ownerLeaseGeneration,
+                storeVersion: authority.storeVersion.value
+            });
+            if (hidden.participant.objectKind === 'instance_spot') {
+                this.options.trackInstanceSpot?.({
+                    meshName: this.meshName,
+                    spotId: hidden.activation.spotId,
+                    stableType: hidden.participant.stableType,
+                    nodeRid: authority.allocation.descriptor.rid,
+                    nodeGeneration: authority.allocation.descriptorLifecycleGeneration,
+                    objectGeneration: authority.objectGeneration,
+                    authorityOwnerGeneration: authority.authorityOwnerGeneration,
+                    ownerId: authority.ownerId,
+                    ownerLeaseGeneration: authority.ownerLeaseGeneration,
+                    storeVersion: authority.storeVersion.value,
+                    deactivate: () => this.requireSpotManager().abortRelocationSpot(hidden.activation)
+                });
+            }
+        }
+        hidden.initialized = true;
+    }
+    async restoreBoundSession(hidden, payload) {
+        if (hidden.actor === undefined || payload.byteLength === 0)
+            return;
+        const target = decodeActorSession(payload);
+        const state = this.requireActorManager().getState(hidden.actor.context.actorId);
+        state.setRemoteBoundSessionTarget(target);
+        state.setBoundSessionTransferTarget(target);
+        if (target.bindingGeneration !== undefined) {
+            state.setBoundSessionBindingGeneration(target.bindingGeneration);
+        }
+    }
+    async replayQueuedMessage(hidden, message) {
+        if (hidden.actor === undefined) {
+            throw new Error('Only Actor relocation participants can contain packet backlog.');
+        }
+        const recovery = (0, actor_join_recovery_codec_1.decodeCanonicalActorJoinRecoverySavedWork)(message.payload);
+        if (recovery !== undefined) {
+            if (recovery.request.actorId !== hidden.actor.context.actorId) {
+                throw new Error('Canonical Actor Join recovery names a different staged Actor.');
+            }
+            const deferred = await this.requireSpotManager().restoreCanonicalActorJoinRecovery(recovery, undefined, (0, service_relocation_runtime_1.inventoryDigest)(this.envelope.participants, this.envelope.memberships));
+            if (deferred !== undefined) {
+                this.deferredJoinRoots.set(hidden.authorityKey, deferred);
+            }
+            return;
+        }
+        const packet = decodeQueuedHandoffPacket(message);
+        const state = this.requireActorManager().getState(hidden.actor.context.actorId);
+        if (state === undefined)
+            throw new Error('Relocated Actor state is not staged.');
+        hidden.replayPackets.push(packet);
+    }
+    deferredJoinRoot(authorityKey) {
+        return this.deferredJoinRoots.get(authorityKey);
+    }
+    async openAdmission(hidden) {
+        if (hidden.actor === undefined)
+            return;
+        this.requireActorManager().publishRelocationActor(hidden.actor.context.actorId);
+        if (hidden.replayPackets.length === 0)
+            return;
+        const state = this.requireActorManager().getState(hidden.actor.context.actorId);
+        if (state === undefined)
+            throw new Error('Relocated Actor state is not staged.');
+        const results = await (0, actor_handoff_1.replayActorHandoffBacklog)(hidden.replayPackets, (parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef) => {
+            if (state.spotId === undefined) {
+                const runtime = this.options.spotNodeRuntime();
+                if (runtime === undefined) {
+                    throw new Error('Relocated Entry Spot Actor dispatch is unavailable.');
+                }
+                return runtime.dispatchEntryActorPacket(hidden.actor.context.actorId, parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef);
+            }
+            return this.requireSpotManager().dispatchRoutedActorPacket(state.spotId, hidden.actor.context.actorId, parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef);
+        });
+        hidden.replayResults.push(...results);
+    }
+    async restoreTimer(hidden, timer) {
+        if (hidden.activation === undefined)
+            throw new Error('Actor relocation cannot restore a Spot timer.');
+        hidden.restoredTimers.push(timer);
+        if (hidden.restoredTimers.length !== hidden.participant.timers.length)
+            return;
+        hidden.activation.timers.restoreRelocation(hidden.restoredTimers.map(value => ({
+            name: value.timerId,
+            handlerType: value.handlerType,
+            periodMs: value.intervalMs,
+            overrunPolicy: value.overrunPolicy,
+            maxCatchUpTicks: value.maxCatchUpTicks,
+            stopOnUnhandledException: value.stopOnUnhandledException,
+            startedAtUnixMs: value.startedAtUnixMs,
+            deliveryIndex: value.deliveryIndex,
+            lastScheduledIndex: value.lastScheduledIndex,
+            nextDueAtUnixMs: value.dueAtUnixMs,
+            pendingTicks: value.pendingTicks
+        })));
+    }
+    async normalize(_hidden) { }
+    async abort(hidden) {
+        if (hidden.actor !== undefined) {
+            await this.requireActorManager().abortRelocationActor(hidden.actor.context.actorId);
+        }
+        else if (hidden.activation !== undefined) {
+            await this.requireSpotManager().abortRelocationSpot(hidden.activation);
+        }
+    }
+    registration(kind, stableType) {
+        const node = this.options.registration.spotNodes.get(this.meshName);
+        const value = kind === 'actor'
+            ? node?.actorFactoryRegistrations?.[stableType]
+            : kind === 'user_spot'
+                ? node?.spotFactoryRegistrations?.[stableType]
+                : node?.instanceSpotFactoryRegistrations?.[stableType];
+        if (value === undefined)
+            throw new Error(`Relocation type '${stableType}' is not registered.`);
+        return value;
+    }
+    requireLocationStore() {
+        const store = this.options.locationStore();
+        if (store === undefined)
+            throw new Error('Relocation target Location Store is unavailable.');
+        return store;
+    }
+    requireSpotManager() {
+        const manager = this.options.spotManager();
+        if (manager === undefined)
+            throw new Error('Relocation target Spot manager is unavailable.');
+        return manager;
+    }
+    requireActorManager() {
+        const manager = this.options.actorManager();
+        if (manager === undefined)
+            throw new Error('Relocation target Actor manager is unavailable.');
+        return manager;
+    }
+}
+async function requireAuthority(store, key, signal) {
+    const current = await store.readAuthority(key, signal);
+    if (current.kind !== 'snapshot')
+        throw new Error(`Authority '${key.value}' is missing.`);
+    return current;
+}
+function rewriteAuthorityApplicationRoute(payload, target) {
+    const applicationPayload = (0, service_relocation_runtime_1.serviceRelocationAuthorityApplicationPayload)(payload);
+    const actor = (0, actor_authority_publication_1.decodeRelocatingActorAuthorityIdentity)(applicationPayload, target.objectGeneration);
+    if (actor !== undefined) {
+        return (0, actor_authority_publication_1.rewriteActorAuthorityRoute)(applicationPayload, {
+            actorId: actor.actor.actorId,
+            objectGeneration: actor.actor.objectGeneration,
+            meshName: target.meshName,
+            nodeRid: target.nodeRid
+        }, target.actorSpotId ?? actor.spotId, target.actorSpotGeneration ?? actor.spotGeneration, target.actorSpotKind ?? actor.spotKind, target.nodeGeneration, target.owner);
+    }
+    return (0, service_authority_payload_codec_1.rewriteServiceAuthorityRoute)(applicationPayload, target.owner, target)
+        ?? applicationPayload;
+}
+function actorMembershipTarget(envelope, actorKey) {
+    const membership = envelope.memberships.find(value => value.actorKey === actorKey);
+    if (membership === undefined)
+        return undefined;
+    return {
+        actorSpotId: (0, authority_key_codec_1.decodeAuthorityKey)({ value: membership.spotKey }).globalId,
+        actorSpotGeneration: membership.spotObjectGeneration
+    };
+}
+function primaryKey(envelope) {
+    return envelope.participants.find(value => value.objectKind !== 'actor')?.key
+        ?? envelope.participants[0].key;
+}
+function relocationTargetRequirements(values) {
+    const grouped = new Map();
+    for (const value of values) {
+        const key = `${value.objectKind}\0${value.stableType}\0${value.policy}`;
+        const existing = grouped.get(key);
+        grouped.set(key, existing === undefined
+            ? value
+            : { ...existing, count: existing.count + value.count });
+    }
+    return [...grouped.values()];
+}
+function relocationTargetSupports(descriptor, requirements) {
+    if (descriptor.activationConcurrency.limit !== 0
+        && descriptor.activationConcurrency.active >= descriptor.activationConcurrency.limit) {
+        return false;
+    }
+    const actorCount = requirements
+        .filter(value => value.objectKind === 'actor')
+        .reduce((sum, value) => sum + value.count, 0);
+    const spotCount = requirements
+        .filter(value => value.objectKind !== 'actor')
+        .reduce((sum, value) => sum + value.count, 0);
+    if ((descriptor.populationCapacity.actors.limit !== 0
+        && descriptor.populationCapacity.actors.active
+            + descriptor.populationCapacity.actors.reserved
+            + actorCount > descriptor.populationCapacity.actors.limit) || (descriptor.populationCapacity.spots.limit !== 0
+        && descriptor.populationCapacity.spots.active
+            + descriptor.populationCapacity.spots.reserved
+            + spotCount > descriptor.populationCapacity.spots.limit)) {
+        return false;
+    }
+    for (const requirement of requirements) {
+        if (!descriptor.objectCapabilities.some(capability => capability.objectKind === requirement.objectKind
+            && capability.stableType === requirement.stableType
+            && capability.policy === requirement.policy)) {
+            return false;
+        }
+        if (requirement.objectKind !== 'actor') {
+            const capacity = descriptor.populationCapacity.spotTypes.find(value => value.objectKind === requirement.objectKind
+                && value.stableType === requirement.stableType);
+            if (capacity === undefined
+                || (capacity.limit !== 0
+                    && capacity.active + capacity.reserved + requirement.count > capacity.limit)) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+function selectWeightedRelocationTarget(candidates) {
+    const total = candidates.reduce((sum, value) => sum + value.placementWeight, 0);
+    if (total <= 0)
+        return undefined;
+    let selected = Math.random() * total;
+    for (const candidate of candidates) {
+        selected -= candidate.placementWeight;
+        if (selected < 0)
+            return candidate;
+    }
+    return candidates.at(-1);
+}
+function decodeQueuedHandoffPacket(message) {
+    const payload = Buffer.from(message.payload);
+    const frozen = isCanonicalFrozenRecord(payload)
+        ? (0, service_stateful_wire_codec_1.decodeServiceWireFrozenRecord)(payload)
+        : undefined;
+    const value = JSON.parse(Buffer.from(frozen?.applicationPayload?.bytes ?? payload).toString('utf8'));
+    const index = value.index;
+    if (!Number.isSafeInteger(index) || index < 0) {
+        throw new TypeError('Relocation Actor packet index is invalid.');
+    }
+    const messageFollowOrigin = decodeQueuedMessageFollowOrigin(value.messageFollowOrigin);
+    const decoded = (0, spot_remote_codec_1.decodeHandoffBacklog)([{
+            ...value,
+            index: 0,
+            ...(messageFollowOrigin === undefined ? {} : { messageFollowOrigin })
+        }])[0];
+    return { ...decoded, index: index };
+}
+/**
+ * The JSON relocation envelope remains the Stage 1 container, but Actor
+ * backlog entries are frozen service-wire records before it leaves source
+ * ownership. This makes correlation, reply route and canonical payload
+ * validation part of the captured record rather than an ad-hoc JSON packet.
+ */
+function canonicalizeCapturedHandoffBacklog(envelope, coordinator, target) {
+    return {
+        ...envelope,
+        participants: envelope.participants.map(participant => participant.objectKind !== 'actor'
+            ? participant
+            : {
+                ...participant,
+                queuedMessages: participant.queuedMessages.map(message => ({
+                    ...message,
+                    payload: canonicalQueuedFrozenRecord(participant, message, coordinator, target).canonicalBytes
+                }))
+            })
+    };
+}
+function appendCanonicalActorJoinRecovery(envelope, profile, coordinator, sourceAuthoritySnapshot) {
+    const recovery = profile.canonicalRecovery;
+    const actorType = profile.state.actorType;
+    const sourceAuthority = (0, actor_authority_publication_1.decodeRelocatingActorAuthorityIdentity)(sourceAuthoritySnapshot.payload, sourceAuthoritySnapshot.objectGeneration);
+    if (actorType === undefined
+        || sourceAuthority === undefined
+        || sourceAuthority.actor.actorId !== profile.state.actorId
+        || sourceAuthority.actor.objectGeneration !== profile.sourceActorRef.generation
+        || !(0, routing_id_1.routingIdsEqual)(sourceAuthority.actor.nodeRid, profile.sourceActorRef.nodeRid)
+        || sourceAuthority.ownerNodeGeneration !== recovery.actorNodeGeneration
+        || sourceAuthoritySnapshot.authorityOwnerGeneration !== profile.state.locationGeneration) {
+        throw new Error(`Actor '${profile.state.actorId}' canonical Join recovery identity is incomplete.`);
+    }
+    const attachment = { attached: false };
+    const participants = envelope.participants.map(participant => {
+        if (participant.objectKind !== 'actor'
+            || (0, authority_key_codec_1.decodeAuthorityKey)({ value: participant.key }).globalId
+                !== profile.state.actorId) {
+            return participant;
+        }
+        if (attachment.attached)
+            throw new Error('Canonical Actor Join recovery has duplicate Actor participants.');
+        attachment.attached = true;
+        const encoded = (0, actor_join_recovery_codec_1.encodeCanonicalActorJoinRecoverySavedWork)({
+            actorId: profile.state.actorId,
+            actorType,
+            handoffId: recovery.handoffId,
+            // The command-28 target admitted this same fenced Store authority. Keep
+            // its CurrentSpotId as the recovery identity instead of projecting the
+            // application Actor state (which may already name an Entry fallback).
+            sourceSpotId: sourceAuthority.spotId,
+            sourceNodeRid: profile.sourceActorRef.nodeRid,
+            actorGeneration: profile.sourceActorRef.generation,
+            actorAuthorityOwnerGeneration: sourceAuthoritySnapshot.authorityOwnerGeneration,
+            actorNodeGeneration: recovery.actorNodeGeneration,
+            expectedOwnerLeaseGeneration: recovery.expectedOwnerLeaseGeneration,
+            relocationId: envelope.aggregateId,
+            relocationContentType: profile.relocationContentType,
+            requestContentType: recovery.requestContentType,
+            request: recovery.request,
+            targetSpotId: String(profile.targetSpotId),
+            targetNodeRid: profile.targetNodeRid,
+            targetNodeGeneration: recovery.targetNodeGeneration,
+            targetSpotGeneration: recovery.targetSpotGeneration,
+            targetAuthorityOwnerGeneration: recovery.targetAuthorityOwnerGeneration,
+            targetSpotAuthorityOwnerGeneration: recovery.targetSpotAuthorityOwnerGeneration,
+            coordinator: {
+                ownerId: coordinator.ownerId,
+                leaseGeneration: coordinator.leaseGeneration,
+                nodeRid: coordinator.nodeRid,
+                nodeGeneration: coordinator.nodeGeneration,
+                expectedAuthorityStoreVersion: coordinator.expectedAuthorityStoreVersion
+            },
+            operationId: recovery.admissionOperationId,
+            ...(recovery.replyContentType === undefined
+                ? {}
+                : { replyContentType: recovery.replyContentType }),
+            reply: recovery.reply
+        });
+        return {
+            ...participant,
+            queuedMessages: [
+                { sequence: 1n, payload: encoded },
+                ...participant.queuedMessages.map(message => ({
+                    ...message,
+                    sequence: message.sequence + 1n
+                }))
+            ]
+        };
+    });
+    if (!attachment.attached)
+        throw new Error('Canonical Actor Join recovery Actor participant is missing.');
+    return { ...envelope, participants };
+}
+function isCanonicalFrozenRecord(payload) {
+    try {
+        (0, service_stateful_wire_codec_1.decodeServiceWireFrozenRecord)(payload);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function relocationWireId(value) {
+    const hex = value.replaceAll('-', '');
+    if (!/^[0-9a-fA-F]{32}$/.test(hex)) {
+        throw new Error(`Relocation aggregate '${value}' is not a canonical 128-bit identity.`);
+    }
+    const result = {
+        high: BigInt(`0x${hex.slice(0, 16)}`),
+        low: BigInt(`0x${hex.slice(16)}`)
+    };
+    if (result.high === 0n && result.low === 0n) {
+        throw new Error('Relocation identity must not be zero.');
+    }
+    return result;
+}
+function createServiceRelocationId(isInUse, entropy = node_crypto_1.randomBytes) {
+    for (;;) {
+        const bytes = entropy(16);
+        if (bytes.byteLength !== 16) {
+            throw new Error('Relocation identity entropy must return exactly 16 bytes.');
+        }
+        let nonZero = false;
+        for (const byte of bytes) {
+            if (byte !== 0) {
+                nonZero = true;
+                break;
+            }
+        }
+        if (!nonZero)
+            continue;
+        const hex = Buffer.from(bytes).toString('hex');
+        const candidate = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-`
+            + `${hex.slice(16, 20)}-${hex.slice(20)}`;
+        if (!isInUse(candidate))
+            return candidate;
+    }
+}
+function operationWireId(value) {
+    const match = /^(\d+):(\d+)$/.exec(value);
+    if (match === null)
+        throw new Error(`Actor handoff operation '${value}' is not canonical.`);
+    const result = { high: BigInt(match[1]), low: BigInt(match[2]) };
+    if (result.high === 0n && result.low === 0n) {
+        throw new Error('Actor handoff operation identity must not be zero.');
+    }
+    return result;
+}
+function sameWireId(left, right) {
+    return left.high === right.high && left.low === right.low;
+}
+function sameCoordinator(left, right) {
+    return left.ownerId === right.ownerId
+        && left.leaseGeneration === right.leaseGeneration
+        && left.nodeRid === right.nodeRid
+        && left.nodeGeneration === right.nodeGeneration
+        && left.expectedAuthorityStoreVersion === right.expectedAuthorityStoreVersion;
+}
+function isExactSourceAuthority(current, expected) {
+    return current.storeVersion.value === expected.storeVersion.value
+        && current.objectGeneration === expected.objectGeneration
+        && current.authorityOwnerGeneration === expected.authorityOwnerGeneration
+        && current.ownerId === expected.ownerId
+        && current.ownerLeaseGeneration === expected.ownerLeaseGeneration
+        && current.allocation.state === expected.allocation.state
+        && current.allocation.objectKind === expected.allocation.objectKind
+        && current.allocation.stableType === expected.allocation.stableType
+        && String(current.allocation.descriptor.rid)
+            === String(expected.allocation.descriptor.rid)
+        && current.allocation.descriptorLifecycleGeneration
+            === expected.allocation.descriptorLifecycleGeneration;
+}
+function isExactCommittedTarget(current, expected, target, payload) {
+    return current.objectGeneration === expected.objectGeneration
+        && current.authorityOwnerGeneration > expected.authorityOwnerGeneration
+        && current.ownerId === target.ownerId
+        && current.ownerLeaseGeneration === target.ownerLeaseGeneration
+        && String(current.allocation.descriptor.rid) === target.nodeRid
+        && current.allocation.descriptorLifecycleGeneration === target.nodeGeneration
+        && Buffer.from(current.payload).equals(Buffer.from(payload));
+}
+async function waitForLocationRetry(deadlineAtMs, signal, cause) {
+    signal?.throwIfAborted();
+    if (performance.now() >= deadlineAtMs) {
+        throw new Error('location_update_failed: relocation Restore validity expired before exact target owner confirmation.', { cause });
+    }
+    await new Promise((resolve, reject) => {
+        let timer;
+        const aborted = () => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            reject(signal?.reason);
+        };
+        signal?.addEventListener('abort', aborted, { once: true });
+        timer = setTimeout(() => {
+            signal?.removeEventListener('abort', aborted);
+            resolve();
+        }, Math.min(25, Math.max(1, deadlineAtMs - performance.now())));
+        timer.unref();
+    });
+}
+async function waitForRelocationRetry(delayMs, signal) {
+    signal?.throwIfAborted();
+    await new Promise((resolve, reject) => {
+        let timer;
+        const aborted = () => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            reject(signal?.reason);
+        };
+        signal?.addEventListener('abort', aborted, { once: true });
+        timer = setTimeout(() => {
+            signal?.removeEventListener('abort', aborted);
+            resolve();
+        }, delayMs);
+        timer.unref();
+    });
+}
+function sameRequestSource(left, right) {
+    return left.ownerId === right.ownerId
+        && left.leaseGeneration === right.leaseGeneration
+        && left.nodeRid === right.nodeRid
+        && left.nodeGeneration === right.nodeGeneration;
+}
+function handoffSourceFence(value) {
+    return {
+        ownerId: value.ownerId,
+        leaseGeneration: BigInt(value.ownerLeaseGeneration),
+        nodeRid: value.nodeRid,
+        nodeGeneration: BigInt(value.nodeGeneration)
+    };
+}
+function maintenanceReplyRelay(stage, coordinator, participantId, completion) {
+    const value = completion.result.ok ? completion.result.response : undefined;
+    return {
+        relocation: relocationWireId(stage.staging.envelope.aggregateId),
+        targetAttemptGeneration: stage.offer.prepare.targetAttemptGeneration,
+        coordinator,
+        operation: operationWireId(completion.operationId),
+        replyRouteId: BigInt(completion.source.replyRouteId),
+        participantId,
+        sequence: BigInt(completion.index + 1),
+        terminalResult: completion.result.ok ? 0 : 105,
+        failureCode: completion.result.ok ? 0 : 17,
+        ...(value === undefined ? {} : { payload: {
+                packetName: 'zlink.relocation.reply',
+                contentType: 'application/json',
+                bytes: Buffer.from(JSON.stringify(value), 'utf8')
+            } })
+    };
+}
+function handoffResultFromRelay(relay) {
+    if (relay.sequence > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new TypeError('Relocation terminal sequence exceeds the Node index range.');
+    }
+    let value;
+    if (relay.payload !== undefined) {
+        if (relay.terminalResult !== 0
+            || relay.payload.packetName !== 'zlink.relocation.reply'
+            || relay.payload.contentType !== 'application/json') {
+            throw new TypeError('Relocation terminal payload boundary is invalid.');
+        }
+        value = JSON.parse(Buffer.from(relay.payload.bytes).toString('utf8'));
+    }
+    const index = Number(relay.sequence - 1n);
+    return relay.terminalResult === 0
+        ? { index, ok: true, ...(value === undefined ? {} : { response: value }) }
+        : { index, ok: false, error: `Actor handoff failed with framework code ${relay.failureCode}.` };
+}
+function wireIdText(value) {
+    return `${value.high}:${value.low}`;
+}
+/**
+ * Tags a target-side restore failure as data loss (chunk assembly or
+ * checksum verification) so relocationFailed reports failureCode 35 rather
+ * than the generic internal-failure code (spec 15 §4).
+ */
+class ServiceRelocationDataLostError extends Error {
+}
+exports.ServiceRelocationDataLostError = ServiceRelocationDataLostError;
+/**
+ * Maps a target-side relocation Prepare failure to the closest wire
+ * framework-error code the generated schema
+ * ({@link ServiceWireFrameworkErrorCode}) defines — mirrors the java
+ * reference mapping (commit 97fc074058) and the dotnet/cpp ports. The wire
+ * vocabulary predates the framework's typed error kinds and has no
+ * one-to-one code for every kind, so several kinds share the nearest fit
+ * (documented per case below); unresolvable vocabulary gaps belong at the
+ * schema level, not invented here. {@link ServiceRelocationDataLostError}
+ * is this runtime's dedicated tag for a verified checksum/assembly/digest
+ * integrity failure — the case that keeps relocationDataLost(35). An
+ * unclassified error carries no evidence of integrity loss and takes the
+ * generic opaque requestFailed(17). `objectKind` (the Prepare's
+ * ObjectFence.kind, spec 28 §4.2) picks between an Actor- and
+ * Spot-specific code where the schema splits by object kind.
+ */
+function relocationFailedFailureCode(error, objectKind) {
+    if (error instanceof ServiceRelocationDataLostError) {
+        return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost;
+    }
+    if (!(error instanceof contracts_1.ZLinkFrameworkException)) {
+        return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed;
+    }
+    switch (error.kind) {
+        case contracts_1.ZLinkFrameworkErrorKind.DataLost:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost;
+        case contracts_1.ZLinkFrameworkErrorKind.Rejected:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestRejected;
+        case contracts_1.ZLinkFrameworkErrorKind.ProtocolError:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestProtocolError;
+        //  No dedicated "capacity exceeded" wire code exists; a full queue is
+        //  the closest capacity-shaped signal.
+        case contracts_1.ZLinkFrameworkErrorKind.CapacityExceeded:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.workerQueueFull;
+        //  No dedicated "deadline exceeded" wire code exists; a worker timeout
+        //  is the closest timeout-shaped signal.
+        case contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.workerTimedOut;
+        //  A stale generation/fence is the concrete cause of InvalidOperation
+        //  along this path (spec 15 failure table); pick the
+        //  object-kind-specific stale code.
+        case contracts_1.ZLinkFrameworkErrorKind.InvalidOperation:
+            return objectKind === 'actor'
+                ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorLocationStale
+                : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.spotGenerationStale;
+        //  No dedicated generic "unavailable" wire code exists; a disconnected
+        //  route is the closest "cannot reach/use the target" signal.
+        case contracts_1.ZLinkFrameworkErrorKind.Unavailable:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.routeNotConnected;
+        case contracts_1.ZLinkFrameworkErrorKind.NotFound:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestTargetNotFound;
+        //  The only "already exists" wire code is Actor-specific; not expected
+        //  along this target-failure path, mapped for completeness.
+        case contracts_1.ZLinkFrameworkErrorKind.AlreadyExists:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorAlreadyExists;
+        case contracts_1.ZLinkFrameworkErrorKind.TypeMismatch:
+            return objectKind === 'actor'
+                ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorTypeMismatch
+                : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.spotTypeMismatch;
+        //  No dedicated "not configured" wire code exists; a missing configured
+        //  handler is the closest analog.
+        case contracts_1.ZLinkFrameworkErrorKind.NotConfigured:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.handlerNotFound;
+        //  No dedicated generic "internal failure" or "shutting down" wire code
+        //  exists; the generic opaque request-failure code is the closest fit
+        //  for both (ShuttingDown included — re-judged 2026-08-19, C-10).
+        case contracts_1.ZLinkFrameworkErrorKind.ShuttingDown:
+        case contracts_1.ZLinkFrameworkErrorKind.InternalFailure:
+        default:
+            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed;
+    }
+}
+function relocationStagingId(value) {
+    return `${value.relocation.high}:${value.relocation.low}:${value.targetAttemptGeneration}`;
+}
+function coordinatorSource(value) {
+    return { ownerId: value.ownerId, leaseGeneration: value.leaseGeneration,
+        nodeRid: value.nodeRid, nodeGeneration: value.nodeGeneration };
+}
+function relocationObject(envelope) {
+    const participant = envelope.participants.find(value => value.objectKind !== 'actor')
+        ?? envelope.participants[0];
+    const identity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: participant.key }).globalId;
+    if (participant.objectKind === 'actor') {
+        return { kind: 'actor', actorId: identity, objectGeneration: participant.objectGeneration,
+            expectedAuthorityOwnerGeneration: participant.authorityOwnerGeneration };
+    }
+    if (participant.objectKind === 'user_spot') {
+        return { kind: 'userSpot', spotId: identity, objectGeneration: participant.objectGeneration,
+            expectedAuthorityOwnerGeneration: participant.authorityOwnerGeneration };
+    }
+    return { kind: 'instanceSpot', stableType: participant.stableType,
+        spotId: identity, objectGeneration: participant.objectGeneration };
+}
+function relocationObjectForParticipant(participant) {
+    const identity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: participant.key }).globalId;
+    if (participant.objectKind === 'actor') {
+        return {
+            kind: 'actor',
+            actorId: identity,
+            objectGeneration: participant.objectGeneration,
+            expectedAuthorityOwnerGeneration: participant.authorityOwnerGeneration
+        };
+    }
+    if (participant.objectKind === 'user_spot') {
+        return {
+            kind: 'userSpot',
+            spotId: identity,
+            objectGeneration: participant.objectGeneration,
+            expectedAuthorityOwnerGeneration: participant.authorityOwnerGeneration
+        };
+    }
+    return {
+        kind: 'instanceSpot',
+        stableType: participant.stableType,
+        spotId: identity,
+        objectGeneration: participant.objectGeneration
+    };
+}
+function relocationReady(request) {
+    return {
+        kind: 'ready',
+        relocation: request.relocation,
+        targetAttemptGeneration: request.targetAttemptGeneration,
+        coordinator: request.coordinator,
+        target: request.target,
+        object: request.object,
+        senderRole: 'target'
+    };
+}
+function relocationFailed(request, failureCode) {
+    return {
+        kind: 'failed',
+        relocation: request.relocation,
+        targetAttemptGeneration: request.targetAttemptGeneration,
+        coordinator: request.coordinator,
+        target: request.target,
+        object: request.object,
+        senderRole: 'target',
+        failureCode
+    };
+}
+function validatePrepareEnvelope(request, envelope) {
+    if (!sameWireId(request.relocation, relocationWireId(envelope.aggregateId))
+        || request.applicationVersion !== envelope.applicationVersion
+        || stringifyWire(request.object) !== stringifyWire(relocationObject(envelope))) {
+        throw new Error('Relocation Prepare does not match its immutable root identity.');
+    }
+}
+function validateTargetOneWayControl(stage, request, sourceNodeRid) {
+    const prepare = stage.offer.prepare;
+    if (String(sourceNodeRid) !== stage.offer.authenticatedSourceNodeRid
+        || !sameWireId(request.relocation, prepare.relocation)
+        || request.targetAttemptGeneration !== prepare.targetAttemptGeneration
+        || !sameCoordinator(request.coordinator, prepare.coordinator)
+        || stringifyWire(request.object) !== stringifyWire(request.kind === 'data' ? request.object : prepare.object)) {
+        throw new Error('Relocation one-way control changed its exact Prepare fence.');
+    }
+    if (request.kind === 'cutover'
+        && stringifyWire(request.object) !== stringifyWire(prepare.object)) {
+        throw new Error('Relocation Cutover changed its prepared object.');
+    }
+}
+function relocationPublication(prepare, envelope) {
+    // The direct transfer has no durable store root; the authority wrapper
+    // keeps a synthetic in-progress marker derived from the exact relocation
+    // identity and the payload manifest checksum.
+    return {
+        reference: `zlink-direct:${envelope.aggregateId}:${prepare.targetAttemptGeneration}`,
+        checksumCrc32c: prepare.payloadChecksumCrc32c,
+        aggregateId: envelope.aggregateId,
+        aggregateGeneration: envelope.aggregateGeneration,
+        targetAttemptGeneration: prepare.targetAttemptGeneration,
+        targetNodeRid: prepare.target.nodeRid,
+        targetNodeGeneration: prepare.target.nodeGeneration,
+        coordinatorOwnerId: prepare.coordinator.ownerId,
+        coordinatorLeaseGeneration: prepare.coordinator.leaseGeneration,
+        coordinatorNodeRid: prepare.coordinator.nodeRid,
+        coordinatorNodeGeneration: prepare.coordinator.nodeGeneration,
+        coordinatorExpectedStoreVersion: prepare.coordinator.expectedAuthorityStoreVersion,
+        inventoryDigest: (0, service_relocation_runtime_1.inventoryDigest)(envelope.participants, envelope.memberships),
+        targetOwnerId: prepare.target.ownerId,
+        targetOwnerLeaseGeneration: prepare.target.ownerLeaseGeneration
+    };
+}
+function canonicalRelayFrozenRecord(participant, packet, coordinator, target) {
+    const message = encodeHandoffQueuedMessages([packet])[0];
+    return canonicalQueuedFrozenRecord(participant, message, coordinator, target);
+}
+function raceAbort(operation, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const aborted = () => reject(signal.reason);
+        signal.addEventListener('abort', aborted, { once: true });
+        operation.then(value => {
+            signal.removeEventListener('abort', aborted);
+            resolve(value);
+        }, error => {
+            signal.removeEventListener('abort', aborted);
+            reject(error);
+        });
+    });
+}
+function canonicalQueuedFrozenRecord(participant, message, coordinator, target) {
+    if (participant.objectKind !== 'actor') {
+        throw new Error('Only Actor object-mailbox participants can contain accepted packets.');
+    }
+    const packet = decodeQueuedHandoffPacket(message);
+    const identity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: participant.key }).globalId;
+    const source = packet.source === undefined
+        ? coordinatorSource(coordinator)
+        : {
+            ownerId: packet.source.ownerId,
+            leaseGeneration: BigInt(packet.source.ownerLeaseGeneration),
+            nodeRid: packet.source.nodeRid,
+            nodeGeneration: BigInt(packet.source.nodeGeneration)
+        };
+    const operationId = parseHandoffOperationId(packet.messageFollowContext.operationId);
+    if (packet.returnResponse && packet.source === undefined) {
+        throw new Error('Captured Actor request has no exact request-source fence.');
+    }
+    if (!packet.returnResponse && packet.source === undefined
+        && packet.remoteBoundSessionTarget !== undefined) {
+        // A durable frozen record is permitted only for a lease-backed source.
+        // Work tied to a Session connection's lifetime drains before Captured,
+        // so freezing it under the coordinator's fence is a protocol error.
+        throw new Error('Captured connection-bound Actor send cannot enter a relocation envelope.');
+    }
+    return (0, service_stateful_wire_codec_1.encodeServiceWireFrozenActorApplicationRecord)({
+        source,
+        target: {
+            actorId: identity,
+            objectGeneration: participant.objectGeneration,
+            nodeRid: target.nodeRid,
+            nodeGeneration: target.nodeGeneration,
+            authorityOwnerGeneration: participant.authorityOwnerGeneration + 1n,
+            ownerLeaseGeneration: target.ownerLeaseGeneration
+        },
+        operationId,
+        ...(packet.returnResponse ? { replyRouteId: BigInt(packet.source.replyRouteId) } : {}),
+        payload: {
+            packetName: '__zlink.actor.handoff.accepted',
+            contentType: 'application/json',
+            bytes: message.payload
+        }
+    });
+}
+function parseHandoffOperationId(value) {
+    if (!/^[0-9a-f]{32}$/.test(value)) {
+        throw new Error('Captured Actor operation ID is invalid.');
+    }
+    const operation = {
+        high: BigInt(`0x${value.slice(0, 16)}`),
+        low: BigInt(`0x${value.slice(16)}`)
+    };
+    if (operation.high === 0n && operation.low === 0n) {
+        throw new Error('Captured Actor operation ID must not be zero.');
+    }
+    return operation;
+}
+function stringifyWire(value) {
+    return JSON.stringify(value, (_key, item) => typeof item === 'bigint' ? item.toString() : item);
+}
+function validateControlResponse(request, response) {
+    if (request.kind !== 'prepare'
+        || response.kind !== 'ready'
+        || !sameWireId(response.relocation, request.relocation)
+        || response.targetAttemptGeneration !== request.targetAttemptGeneration
+        || !sameCoordinator(response.coordinator, request.coordinator)
+        || stringifyWire(response.target) !== stringifyWire(request.target)
+        || stringifyWire(response.object) !== stringifyWire(request.object)
+        || response.senderRole !== 'target') {
+        throw new Error('Relocation control response does not match the request fence.');
+    }
+}
+/**
+ * Same exact-identity fence as {@link validateControlResponse}, for an
+ * explicit Failed(53) reply. A Failed for a different relocation identity
+ * (exact ordinal/coordinator/target/object) must never resolve a different
+ * pending Prepare's ACK.
+ */
+function validateControlFailureResponse(request, response) {
+    if (request.kind !== 'prepare'
+        || response.kind !== 'failed'
+        || !sameWireId(response.relocation, request.relocation)
+        || response.targetAttemptGeneration !== request.targetAttemptGeneration
+        || !sameCoordinator(response.coordinator, request.coordinator)
+        || stringifyWire(response.target) !== stringifyWire(request.target)
+        || stringifyWire(response.object) !== stringifyWire(request.object)
+        || response.senderRole !== 'target') {
+        throw new Error('Relocation control response does not match the request fence.');
+    }
+}
+/**
+ * Maps a relocationFailed(53) wire failureCode (the generated
+ * ServiceWireFrameworkErrorCode vocabulary) to its internal error kind, so a
+ * source-side reject carries the same classification the target chose
+ * instead of a generic Error. Direct 1:1 correspondence with the generated
+ * names; an unrecognised or absent code falls back to RequestFailed
+ * (InternalFailure) — the closest existing kind (spec 15 §"Failed.Kind").
+ */
+function relocationFailureCodeKind(failureCode) {
+    switch (failureCode) {
+        case 1: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorRouteNotFound;
+        case 2: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorCreateFailed;
+        case 3: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorAlreadyExists;
+        case 4: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorTypeMismatch;
+        case 5: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotCreateFailed;
+        case 6: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotRouteNotFound;
+        case 7: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotTypeMismatch;
+        case 8: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorSessionNotBound;
+        case 9: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.HandlerNotFound;
+        case 10: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteHandlerNotFound;
+        case 11: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorDispatchHandlerNotFound;
+        case 12: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.PayloadDecodeFailed;
+        case 13: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected;
+        case 14: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound;
+        case 15: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestRejected;
+        case 16: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestProtocolError;
+        case 18: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerQueueFull;
+        case 19: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerTimedOut;
+        case 20: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerFailed;
+        case 21: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale;
+        case 22: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorCreateRejected;
+        case 33: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale;
+        case 34: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving;
+        case 35: return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RelocationDataLost;
+        case 17:
+        default:
+            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestFailed;
+    }
+}
+/** Builds the typed exception a Prepare waiter rejects with on an explicit Failed(53). */
+function relocationFailureException(response) {
+    return (0, framework_errors_internal_1.createInternalFrameworkException)(relocationFailureCodeKind(response.failureCode), `Relocation '${response.relocation.high}:${response.relocation.low}:`
+        + `${response.targetAttemptGeneration}' failed with wire failureCode ${response.failureCode}.`, true);
+}
+function controlAckKey(request) {
+    if (request.kind !== 'prepare') {
+        throw new Error(`Relocation ${request.kind} is one-way and has no response key.`);
+    }
+    return `relocation:${request.relocation.high}:${request.relocation.low}:`
+        + `${request.targetAttemptGeneration}:ready`;
+}
+function sessionRelocationPendingKey(request) {
+    return sessionRelocationIdentityKey(request);
+}
+function sessionRelocationRouteSubmitKey(request, targetNodeRid) {
+    return `${sessionRelocationIdentityKey(request)}:${String(targetNodeRid)}`;
+}
+function sessionRelocationResponseKey(response) {
+    return sessionRelocationIdentityKey(response);
+}
+function sessionRelocationResponseFingerprint(response) {
+    return (0, service_stateful_wire_codec_1.encodeSessionRelocationSealed)(response).toString('base64');
+}
+function sessionRelocationIdentityKey(value) {
+    return `session-relocation:${(0, service_stateful_wire_codec_1.serviceSessionRelocationIdentityKey)(value)}:sealed`;
+}
+function validateSessionRelocationResponse(request, response) {
+    const sameCoordinator = request.coordinator.ownerId === response.coordinator.ownerId
+        && request.coordinator.leaseGeneration === response.coordinator.leaseGeneration
+        && request.coordinator.nodeRid === response.coordinator.nodeRid
+        && request.coordinator.nodeGeneration === response.coordinator.nodeGeneration
+        && request.coordinator.expectedAuthorityStoreVersion
+            === response.coordinator.expectedAuthorityStoreVersion;
+    const sameSession = request.session.sessionOwnerNodeRid === response.session.sessionOwnerNodeRid
+        && request.session.sessionOwnerNodeGeneration
+            === response.session.sessionOwnerNodeGeneration
+        && request.session.sessionOwnerId === response.session.sessionOwnerId
+        && request.session.sessionOwnerLeaseGeneration
+            === response.session.sessionOwnerLeaseGeneration
+        && request.session.sessionRid === response.session.sessionRid
+        && request.session.bindingGeneration === response.session.bindingGeneration;
+    if (request.relocation.high !== response.relocation.high
+        || request.relocation.low !== response.relocation.low
+        || !sameCoordinator
+        || !sameSession) {
+        throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation ACK changed its exact fence.');
+    }
+    if (request.actor.actor.actorId !== response.actor.actor.actorId
+        || request.actor.actor.generation !== response.actor.actor.generation
+        || request.actor.actor.nodeRid !== response.actor.actor.nodeRid
+        || request.actor.targetNodeGeneration !== response.actor.targetNodeGeneration
+        || request.actor.authorityOwnerGeneration !== response.actor.authorityOwnerGeneration
+        || request.actor.ownerLeaseGeneration !== response.actor.ownerLeaseGeneration) {
+        throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Command 43 ACK does not echo command 42.');
+    }
+}
+function replyRelayIdentityKey(value) {
+    return JSON.stringify([
+        value.operation.high.toString(),
+        value.operation.low.toString(),
+        value.replyRouteId.toString(),
+        value.relocation.high.toString(),
+        value.relocation.low.toString(),
+        value.coordinator.ownerId,
+        value.coordinator.leaseGeneration.toString(),
+        value.coordinator.nodeRid,
+        value.coordinator.nodeGeneration.toString(),
+        value.coordinator.expectedAuthorityStoreVersion
+    ]);
+}
+function replyRelayPendingKey(ackTargetNodeRid, value) {
+    return JSON.stringify([ackTargetNodeRid, replyRelayIdentityKey(value)]);
+}
+function isServiceWireCommand(payload, command) {
+    return payload.byteLength >= 5
+        && payload[0] === 0x5a && payload[1] === 0x4d && payload[2] === 1
+        && payload[3] === command;
+}
+function encodeHandoffQueuedMessages(backlog) {
+    return backlog.map(packet => ({
+        sequence: BigInt(packet.index) + 1n,
+        payload: Buffer.from(JSON.stringify({
+            ...packet,
+            ...(packet.messageFollowOrigin === undefined ? {} : {
+                messageFollowOrigin: {
+                    sourceNodeRid: String(packet.messageFollowOrigin.sourceNodeRid),
+                    sourceNodeRidHex: (0, routing_id_1.encodeRoutingIdStorageHex)(packet.messageFollowOrigin.sourceNodeRid),
+                    originalOperation: {
+                        high: packet.messageFollowOrigin.originalOperation.high.toString(),
+                        low: packet.messageFollowOrigin.originalOperation.low.toString()
+                    },
+                    originalReplyRouteId: packet.messageFollowOrigin.originalReplyRouteId.toString()
+                }
+            })
+        }), 'utf8')
+    }));
+}
+function decodeQueuedMessageFollowOrigin(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'object' || value === null) {
+        throw new TypeError('Relocation Actor Message Follow origin is invalid.');
+    }
+    const origin = value;
+    const operation = origin.originalOperation;
+    if (typeof origin.sourceNodeRid !== 'string'
+        || origin.sourceNodeRid.length === 0
+        || typeof operation !== 'object'
+        || operation === null) {
+        throw new TypeError('Relocation Actor Message Follow origin is invalid.');
+    }
+    const operationRecord = operation;
+    const high = queuedMessageU64(operationRecord.high, 'originalOperation.high');
+    const low = queuedMessageU64(operationRecord.low, 'originalOperation.low');
+    if (high === 0n && low === 0n) {
+        throw new TypeError('Relocation Actor Message Follow operation must not be zero.');
+    }
+    return {
+        sourceNodeRid: (0, routing_id_1.decodeRoutingId)(origin.sourceNodeRid, origin.sourceNodeRidHex),
+        originalOperation: { high, low },
+        originalReplyRouteId: queuedMessageU64(origin.originalReplyRouteId, 'originalReplyRouteId')
+    };
+}
+function queuedMessageU64(value, field) {
+    if (typeof value !== 'string' || !/^(?:0|[1-9][0-9]*)$/.test(value)) {
+        throw new TypeError(`Relocation Actor Message Follow ${field} is invalid.`);
+    }
+    const result = BigInt(value);
+    if (result > 0xffffffffffffffffn) {
+        throw new TypeError(`Relocation Actor Message Follow ${field} is outside u64.`);
+    }
+    return result;
+}
+function toServiceTimer(value) {
+    return {
+        timerId: value.name,
+        handlerType: value.handlerType,
+        startedAtUnixMs: value.startedAtUnixMs,
+        dueAtUnixMs: value.nextDueAtUnixMs,
+        intervalMs: value.periodMs,
+        deliveryIndex: value.deliveryIndex,
+        lastScheduledIndex: value.lastScheduledIndex,
+        overrunPolicy: value.overrunPolicy,
+        maxCatchUpTicks: value.maxCatchUpTicks,
+        stopOnUnhandledException: value.stopOnUnhandledException,
+        pendingTicks: value.pendingTicks
+    };
+}
+/**
+ * NODE-INTERNAL Prepare sideband. Frame zero remains the exact canonical
+ * command-40 schema record; each following ZLNI frame carries one sealed
+ * actor-session journal keyed by its canonical participant authority key.
+ * Sessionless relocation remains a single-frame, wire-identical Prepare.
+ */
+function encodePrepareSideband(envelope) {
+    return envelope.participants
+        .filter(participant => participant.boundSessionState.byteLength !== 0)
+        .map(participant => {
+        const key = Buffer.from(participant.key, 'utf8');
+        const payload = Buffer.from(participant.boundSessionState);
+        if (key.byteLength === 0 || key.byteLength > 0xffff || payload.byteLength > 0xffff_ffff) {
+            throw new TypeError('Bound-session relocation sideband is out of bounds.');
+        }
+        const header = Buffer.allocUnsafe(11);
+        header.write('ZLNI', 0, 'ascii');
+        header[4] = 1;
+        header.writeUInt16BE(key.byteLength, 5);
+        header.writeUInt32BE(payload.byteLength, 7);
+        return Buffer.concat([header, key, payload]);
+    });
+}
+function decodePrepareSideband(frames) {
+    const result = [];
+    const keys = new Set();
+    for (const frame of frames) {
+        const bytes = Buffer.from(frame);
+        if (bytes.byteLength < 11 || bytes.subarray(0, 4).toString('ascii') !== 'ZLNI' || bytes[4] !== 1) {
+            return undefined;
+        }
+        const keyLength = bytes.readUInt16BE(5);
+        const payloadLength = bytes.readUInt32BE(7);
+        if (11 + keyLength + payloadLength !== bytes.byteLength || keyLength === 0)
+            return undefined;
+        const participantKey = bytes.subarray(11, 11 + keyLength).toString('utf8');
+        if (keys.has(participantKey))
+            return undefined;
+        keys.add(participantKey);
+        result.push({ participantKey, payload: Buffer.from(bytes.subarray(11 + keyLength)) });
+    }
+    return result;
+}
+function attachPrepareBoundSessions(envelope, sideband) {
+    if (sideband === undefined || sideband.length === 0)
+        return envelope;
+    const byKey = new Map(sideband.map(value => [value.participantKey, Buffer.from(value.payload)]));
+    const participants = envelope.participants.map(participant => {
+        const payload = byKey.get(participant.key);
+        if (payload === undefined)
+            return participant;
+        if (participant.objectKind !== 'actor') {
+            throw new TypeError('Bound-session relocation sideband names a non-Actor participant.');
+        }
+        byKey.delete(participant.key);
+        return { ...participant, boundSessionState: payload };
+    });
+    if (byKey.size !== 0)
+        throw new TypeError('Bound-session relocation sideband names an unknown participant.');
+    return { ...envelope, participants };
+}
+function encodeActorSession(target) {
+    if (target === undefined)
+        return Buffer.alloc(0);
+    return Buffer.from(JSON.stringify({
+        version: 1,
+        routerChannelId: target.routerChannelId,
+        targetNodeRid: String(target.targetNodeRid),
+        spotId: String(target.spotId),
+        sessionNodeRid: target.sessionNodeRid === undefined ? undefined : String(target.sessionNodeRid),
+        sessionRid: target.sessionRid === undefined ? undefined : String(target.sessionRid),
+        bindingGeneration: target.bindingGeneration?.toString(),
+        previousAuthorityOwnerGeneration: target.previousAuthorityOwnerGeneration?.toString(),
+        previousOwnerLeaseGeneration: target.previousOwnerLeaseGeneration?.toString(),
+        relocationSealId: target.relocationSealId,
+        serviceWireRelocation: target.serviceWireRelocation === undefined
+            ? undefined
+            : {
+                relocationHigh: target.serviceWireRelocation.relocation.high.toString(),
+                relocationLow: target.serviceWireRelocation.relocation.low.toString(),
+                coordinatorOwnerId: target.serviceWireRelocation.coordinator.ownerId,
+                coordinatorLeaseGeneration: target.serviceWireRelocation.coordinator.leaseGeneration.toString(),
+                coordinatorNodeRid: target.serviceWireRelocation.coordinator.nodeRid,
+                coordinatorNodeGeneration: target.serviceWireRelocation.coordinator.nodeGeneration.toString(),
+                expectedAuthorityStoreVersion: target.serviceWireRelocation.coordinator.expectedAuthorityStoreVersion,
+                sessionOwnerNodeRid: target.serviceWireRelocation.session.sessionOwnerNodeRid,
+                sessionOwnerNodeGeneration: target.serviceWireRelocation.session.sessionOwnerNodeGeneration.toString(),
+                sessionOwnerId: target.serviceWireRelocation.session.sessionOwnerId,
+                sessionOwnerLeaseGeneration: target.serviceWireRelocation.session.sessionOwnerLeaseGeneration.toString(),
+                sessionRid: target.serviceWireRelocation.session.sessionRid,
+                bindingGeneration: target.serviceWireRelocation.session.bindingGeneration.toString()
+            }
+    }), 'utf8');
+}
+function decodeActorSession(payload) {
+    const value = JSON.parse(Buffer.from(payload).toString('utf8'));
+    const optionalBigInt = (field) => typeof value[field] === 'string'
+        ? BigInt(value[field])
+        : undefined;
+    if (value.version !== 1 || typeof value.routerChannelId !== 'string'
+        || typeof value.targetNodeRid !== 'string' || typeof value.spotId !== 'string') {
+        throw new TypeError('Actor relocation Session journal is invalid.');
+    }
+    const serviceWire = decodeActorSessionServiceWireFence(value.serviceWireRelocation);
+    return {
+        routerChannelId: value.routerChannelId,
+        targetNodeRid: value.targetNodeRid,
+        spotId: value.spotId,
+        ...(typeof value.sessionNodeRid === 'string' ? { sessionNodeRid: value.sessionNodeRid } : {}),
+        ...(typeof value.sessionRid === 'string' ? { sessionRid: value.sessionRid } : {}),
+        ...(optionalBigInt('bindingGeneration') === undefined ? {} : { bindingGeneration: optionalBigInt('bindingGeneration') }),
+        ...(optionalBigInt('previousAuthorityOwnerGeneration') === undefined ? {} : { previousAuthorityOwnerGeneration: optionalBigInt('previousAuthorityOwnerGeneration') }),
+        ...(optionalBigInt('previousOwnerLeaseGeneration') === undefined ? {} : { previousOwnerLeaseGeneration: optionalBigInt('previousOwnerLeaseGeneration') }),
+        ...(typeof value.relocationSealId === 'string' ? { relocationSealId: value.relocationSealId } : {}),
+        ...(serviceWire === undefined ? {} : { serviceWireRelocation: serviceWire })
+    };
+}
+function decodeActorSessionServiceWireFence(input) {
+    if (input === undefined)
+        return undefined;
+    if (typeof input !== 'object' || input === null) {
+        throw new TypeError('Actor relocation Session service-wire fence is invalid.');
+    }
+    const value = input;
+    const text = (field) => {
+        if (typeof value[field] !== 'string' || value[field].length === 0) {
+            throw new TypeError(`Actor relocation Session service-wire '${field}' is invalid.`);
+        }
+        return value[field];
+    };
+    const positive = (field) => {
+        const parsed = BigInt(text(field));
+        if (parsed <= 0n) {
+            throw new TypeError(`Actor relocation Session service-wire '${field}' is invalid.`);
+        }
+        return parsed;
+    };
+    const ordinal = (field) => {
+        const parsed = BigInt(text(field));
+        if (parsed < 0n) {
+            throw new TypeError(`Actor relocation Session service-wire '${field}' is invalid.`);
+        }
+        return parsed;
+    };
+    const relocation = {
+        high: ordinal('relocationHigh'),
+        low: ordinal('relocationLow')
+    };
+    if (relocation.high === 0n && relocation.low === 0n) {
+        throw new TypeError('Actor relocation Session service-wire identity is zero.');
+    }
+    return {
+        relocation,
+        coordinator: {
+            ownerId: text('coordinatorOwnerId'),
+            leaseGeneration: positive('coordinatorLeaseGeneration'),
+            nodeRid: text('coordinatorNodeRid'),
+            nodeGeneration: positive('coordinatorNodeGeneration'),
+            expectedAuthorityStoreVersion: text('expectedAuthorityStoreVersion')
+        },
+        session: {
+            sessionOwnerNodeRid: text('sessionOwnerNodeRid'),
+            sessionOwnerNodeGeneration: positive('sessionOwnerNodeGeneration'),
+            sessionOwnerId: text('sessionOwnerId'),
+            sessionOwnerLeaseGeneration: positive('sessionOwnerLeaseGeneration'),
+            sessionRid: text('sessionRid'),
+            bindingGeneration: positive('bindingGeneration')
+        }
+    };
+}
+function encodeMembershipMutation(memberships, participantKey) {
+    return Buffer.from(JSON.stringify(memberships.filter(value => value.actorKey === participantKey || value.spotKey === participantKey).map(value => ({
+        ...value,
+        spotObjectGeneration: value.spotObjectGeneration.toString(),
+        membershipEpoch: value.membershipEpoch.toString()
+    }))), 'utf8');
+}
+function addCapacity(left, right) {
+    const spotType = left.spotType ?? right.spotType;
+    if (left.spotType !== undefined && right.spotType !== undefined
+        && (left.spotType.objectKind !== right.spotType.objectKind
+            || left.spotType.stableType !== right.spotType.stableType)) {
+        throw new Error('Relocation aggregate contains more than one Spot stable type.');
+    }
+    return {
+        actors: left.actors + right.actors,
+        spots: left.spots + right.spots,
+        ...(spotType === undefined ? {} : {
+            spotType: {
+                ...spotType,
+                count: (left.spotType?.count ?? 0) + (right.spotType?.count ?? 0)
+            }
+        })
+    };
+}