@zlink-systems/framework 0.25.0 → 0.27.0

package/dist/runtime/foundation/runtime-state-projections.d.ts

@@ -1,4 +1,6 @@
-import { ZLinkFrameworkRuntimeState } from '../../contracts';
+import { ZLinkFrameworkRuntimeState, ZLinkTopologyState } from '../../contracts';
+export declare function runtimeObservationIsTerminal(state: ZLinkFrameworkRuntimeState): boolean;
+export declare function topologyObservationIsTerminal(state: ZLinkTopologyState): boolean;
 export type MaintenanceAdmissionState = 'preparing' | 'serving' | 'retiring' | 'draining' | 'stopped' | 'error';
 export type DiscoveryAvailability = 'preparing' | 'serving' | 'retiring' | 'stopped' | 'error' | 'disconnected';
 /** Derives public readiness from the public runtime state authority. */

package/dist/runtime/foundation/runtime-state-projections.js

@@ -1,11 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.runtimeObservationIsTerminal = runtimeObservationIsTerminal;
+exports.topologyObservationIsTerminal = topologyObservationIsTerminal;
 exports.runtimeStateIsReady = runtimeStateIsReady;
 exports.runtimeAcceptsWork = runtimeAcceptsWork;
 exports.maintenanceAdmissionState = maintenanceAdmissionState;
 exports.discoveryAvailabilityForRuntimeState = discoveryAvailabilityForRuntimeState;
 exports.topologyRuntimeIsReady = topologyRuntimeIsReady;
 const contracts_1 = require("../../contracts");
+function runtimeObservationIsTerminal(state) {
+    return state === contracts_1.ZLinkFrameworkRuntimeState.Stopped;
+}
+function topologyObservationIsTerminal(state) {
+    return state === contracts_1.ZLinkTopologyState.Stopped || state === contracts_1.ZLinkTopologyState.Failed;
+}
 /** Derives public readiness from the public runtime state authority. */
 function runtimeStateIsReady(state) {
     return state === contracts_1.ZLinkFrameworkRuntimeState.Serving;

package/dist/runtime/foundation/service-authority-payload-codec.d.ts

@@ -47,6 +47,7 @@ export declare function replaceServiceAuthorityRelocationState(payload: Uint8Arr
 export declare function encodeServiceUserSpotAuthorityPayload(value: ServiceUserSpotAuthorityPayload): Buffer;
 export declare function encodeServiceInstanceAuthorityPayload(value: ServiceInstanceAuthorityPayload): Buffer;
 export declare function decodeServiceReadySpotAuthority(payload: Uint8Array): ServiceReadySpotAuthority | undefined;
+export declare function decodeServiceClosingSpotAuthority(payload: Uint8Array): ServiceReadySpotAuthority | undefined;
 export declare function decodeServiceInstanceAuthorityPayload(payload: Uint8Array): ServiceDecodedInstanceAuthority | undefined;
 export declare function rewriteServiceAuthorityOwner(payload: Uint8Array, owner: ZLinkLocationOwnerToken): Buffer | undefined;
 export declare function rewriteServiceAuthorityRoute(payload: Uint8Array, owner: ZLinkLocationOwnerToken, target: {

package/dist/runtime/foundation/service-authority-payload-codec.js

@@ -4,10 +4,19 @@ exports.replaceServiceAuthorityRelocationState = replaceServiceAuthorityRelocati
 exports.encodeServiceUserSpotAuthorityPayload = encodeServiceUserSpotAuthorityPayload;
 exports.encodeServiceInstanceAuthorityPayload = encodeServiceInstanceAuthorityPayload;
 exports.decodeServiceReadySpotAuthority = decodeServiceReadySpotAuthority;
+exports.decodeServiceClosingSpotAuthority = decodeServiceClosingSpotAuthority;
 exports.decodeServiceInstanceAuthorityPayload = decodeServiceInstanceAuthorityPayload;
 exports.rewriteServiceAuthorityOwner = rewriteServiceAuthorityOwner;
 exports.rewriteServiceAuthorityRoute = rewriteServiceAuthorityRoute;
+const stream_wire_1 = require("@zlink-systems/stream-wire");
+const contracts_1 = require("../../contracts");
+const actor_join_recovery_codec_1 = require("./actor-join-recovery-codec");
 const service_relocation_runtime_1 = require("./service-relocation-runtime");
+const service_wire_binary_primitives_1 = require("./service-wire-binary-primitives");
+const SPOT_AUTHORITY_OBJECT_KIND = 2;
+const USER_SPOT_WIRE_KIND = (0, contracts_1.zlinkSpotKindToWire)(contracts_1.ZLinkSpotKind.User);
+const INSTANCE_SPOT_WIRE_KIND = (0, contracts_1.zlinkSpotKindToWire)(contracts_1.ZLinkSpotKind.Instance);
+const AUTHORITY_TEXT16_MAX_BYTES = 0xffff;
 const AUTHORITY_MAGIC = Buffer.from([0x5a, 0x4c, 0x41, 0x55]);
 const AUTHORITY_FORMAT_VERSION = 1;
 const AUTHORITY_FLAGS = 0;
@@ -84,6 +93,13 @@ function decodeServiceReadySpotAuthority(payload) {
     const decoded = decodeSpotAuthority(payload);
     return decoded?.state === 'ready' && decoded.operationKind === 0 ? decoded : undefined;
 }
+function decodeServiceClosingSpotAuthority(payload) {
+    const decoded = decodeSpotAuthority(payload);
+    return decoded?.operationKind === 3 &&
+        (decoded.kind === 'user_spot' || decoded.state === 'closing')
+        ? decoded
+        : undefined;
+}
 function decodeServiceInstanceAuthorityPayload(payload) {
     const decoded = decodeSpotAuthority(payload);
     if (decoded?.kind !== 'instance_spot' ||
@@ -163,7 +179,7 @@ function decodeSpotAuthority(payload) {
         const operationKind = body.u8();
         const objectKind = body.u8();
         const object = body.takeReader(body.u16());
-        if (objectKind !== 2)
+        if (objectKind !== SPOT_AUTHORITY_OBJECT_KIND)
             return undefined;
         const spotKind = object.u8();
         const spot = object.takeReader(object.u16());
@@ -173,13 +189,13 @@ function decodeSpotAuthority(payload) {
         let state;
         let stableType;
         let spotId;
-        if (spotKind === 2) {
+        if (spotKind === USER_SPOT_WIRE_KIND) {
             kind = 'user_spot';
             spotId = spot.rid();
             stableType = spot.text8();
             state = spot.u8();
         }
-        else if (spotKind === 3) {
+        else if (spotKind === INSTANCE_SPOT_WIRE_KIND) {
             kind = 'instance_spot';
             state = spot.u8();
             const instance = spot.takeReader(spot.u16());
@@ -271,21 +287,23 @@ function rid(value, name) {
 }
 function text16(value, name) {
     const bytes = Buffer.from(value);
-    if (bytes.byteLength < 1 || bytes.byteLength > 0xffff || bytes.includes(0)) {
-        throw new RangeError(`${name} must contain 1..65535 UTF-8 bytes without NUL.`);
+    if (bytes.byteLength < 1 || bytes.byteLength > AUTHORITY_TEXT16_MAX_BYTES || bytes.includes(0)) {
+        throw new RangeError(`${name} must contain 1..${AUTHORITY_TEXT16_MAX_BYTES} UTF-8 bytes without NUL.`);
     }
     return concat(u16(bytes.byteLength), bytes);
 }
 function sha256(value) {
-    if (value.byteLength !== 32) {
-        throw new RangeError('activationRecovery.sha256 must contain exactly 32 bytes.');
+    if (value.byteLength !== actor_join_recovery_codec_1.SHA256_DIGEST_BYTES) {
+        throw new RangeError(`activationRecovery.sha256 must contain exactly ${actor_join_recovery_codec_1.SHA256_DIGEST_BYTES} bytes.`);
     }
-    return concat(Buffer.of(32), value);
+    return concat(Buffer.of(actor_join_recovery_codec_1.SHA256_DIGEST_BYTES), value);
 }
 function sized8(value, name) {
     const bytes = Buffer.from(value);
-    if (bytes.byteLength < 1 || bytes.byteLength > 255 || bytes.includes(0)) {
-        throw new RangeError(`${name} must contain 1..255 UTF-8 bytes without NUL.`);
+    if (bytes.byteLength < 1 ||
+        bytes.byteLength > service_wire_binary_primitives_1.SERVICE_WIRE_TEXT8_MAX_BYTES ||
+        bytes.includes(0)) {
+        throw new RangeError(`${name} must contain 1..${service_wire_binary_primitives_1.SERVICE_WIRE_TEXT8_MAX_BYTES} UTF-8 bytes without NUL.`);
     }
     return concat(Buffer.of(bytes.byteLength), bytes);
 }
@@ -306,7 +324,7 @@ function boundedU32(value, name) {
     return u32(value);
 }
 function u64(value, name) {
-    if (value <= 0n || value > 0xffffffffffffffffn) {
+    if (value <= 0n || value > stream_wire_1.UINT64_MAX) {
         throw new RangeError(`${name} must be a non-zero u64.`);
     }
     const result = Buffer.alloc(8);
@@ -314,7 +332,7 @@ function u64(value, name) {
     return result;
 }
 function ordinalU64(value, name) {
-    if (value < 0n || value > 0xffffffffffffffffn) {
+    if (value < 0n || value > stream_wire_1.UINT64_MAX) {
         throw new RangeError(`${name} must be a u64.`);
     }
     const result = Buffer.alloc(8);

package/dist/runtime/foundation/service-discovery-registry.d.ts

@@ -23,6 +23,9 @@ export interface SelectedClientServer {
 }
 /** Dedicated discovery state; fanout publishers never reuse RouteMesh peer rows. */
 export declare class ServiceDiscoveryRegistry {
+    private readonly clientServerChanged;
+    onClientServerChanged(listener: (error?: Error) => void): () => void;
+    dispose(error: Error): void;
     private readonly clientServers;
     private readonly fanoutPublishers;
     private readonly clientServerSelections;
@@ -32,6 +35,7 @@ export declare class ServiceDiscoveryRegistry {
     selectClientServer(channelName: string): ClientServerDescriptor | undefined;
     selectClientServerConnection(channelName: string): SelectedClientServer | undefined;
     private selectClientServerConnectionCore;
+    hasReadyClientServer(channelName: string): boolean;
     clientServerDescriptors(channelName: string): readonly ClientServerDescriptor[];
     admitFanoutPublisher(descriptor: FanoutPublisherDescriptor, connectionId: string): boolean;
     removeFanoutPublisher(channelName: string, publisherRoutingId: string, connectionId: string): boolean;

package/dist/runtime/foundation/service-discovery-registry.js

@@ -1,8 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceDiscoveryRegistry = void 0;
+const RegistrationBuilderPolicy_1 = require("../../contracts/Configuration/RegistrationBuilderPolicy");
+const service_weighted_selection_1 = require("./service-weighted-selection");
 /** Dedicated discovery state; fanout publishers never reuse RouteMesh peer rows. */
 class ServiceDiscoveryRegistry {
+    clientServerChanged = new Set();
+    onClientServerChanged(listener) {
+        this.clientServerChanged.add(listener);
+        return () => {
+            this.clientServerChanged.delete(listener);
+        };
+    }
+    dispose(error) {
+        for (const listener of this.clientServerChanged)
+            listener(error);
+        this.clientServerChanged.clear();
+    }
     clientServers = new Map();
     fanoutPublishers = new Map();
     clientServerSelections = new Map();
@@ -56,6 +70,10 @@ class ServiceDiscoveryRegistry {
         }
         return selection.select();
     }
+    hasReadyClientServer(channelName) {
+        return [...this.clientServers.values()].some(({ descriptor }) => descriptor.channelName === channelName &&
+            (descriptor.state === 'serving' || descriptor.state === 'retiring'));
+    }
     clientServerDescriptors(channelName) {
         return [...this.clientServers.values()]
             .map((value) => value.descriptor)
@@ -94,6 +112,8 @@ class ServiceDiscoveryRegistry {
         if (this.clientServerSelections.has(channelName)) {
             this.clientServerSelections.get(channelName).rebuild();
         }
+        for (const listener of this.clientServerChanged)
+            listener();
     }
     clientServerCandidates(channelName) {
         return [...this.clientServers.values()]
@@ -150,8 +170,8 @@ function validateClientServer(descriptor) {
     requireText(descriptor.securityIdentity, 'securityIdentity');
     requireText(descriptor.advertisedEndpoint, 'advertisedEndpoint');
     validateRevision(descriptor.lifecycleGeneration, descriptor.descriptorRevision);
-    if (!Number.isInteger(descriptor.weight) || descriptor.weight < 0 || descriptor.weight > 10_000) {
-        throw new RangeError('ClientServer weight must be an integer in 0..10000.');
+    if (!(0, RegistrationBuilderPolicy_1.isValidPublicWeight)(descriptor.weight)) {
+        throw new RangeError(`ClientServer weight must be an integer in 0..${RegistrationBuilderPolicy_1.ZLINK_MAX_PUBLIC_WEIGHT}.`);
     }
     if (!Number.isSafeInteger(descriptor.effectiveMaxMessageBytes) ||
         descriptor.effectiveMaxMessageBytes < 1) {
@@ -174,4 +194,3 @@ function requireText(value, field) {
         throw new TypeError(`${field} must be non-empty text without NUL.`);
     }
 }
-const service_weighted_selection_1 = require("./service-weighted-selection");

package/dist/runtime/foundation/service-instance-activation-recovery-codec.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encodeInstanceActivationRecoveryEnvelope = encodeInstanceActivationRecoveryEnvelope;
 exports.decodeInstanceActivationRecoveryEnvelope = decodeInstanceActivationRecoveryEnvelope;
+const service_wire_binary_primitives_1 = require("./service-wire-binary-primitives");
+const stream_wire_1 = require("@zlink-systems/stream-wire");
 const service_relocation_runtime_1 = require("./service-relocation-runtime");
 const service_wire_m6a_codec_1 = require("./service-wire-m6a-codec");
 const service_metadata_codec_1 = require("./service-metadata-codec");
@@ -175,8 +177,10 @@ function requireOperation(value) {
 }
 function textBytes(value, name) {
     const bytes = Buffer.from(value, 'utf8');
-    if (bytes.byteLength < 1 || bytes.byteLength > 255 || bytes.includes(0)) {
-        throw new RangeError(`${name} must contain 1..255 UTF-8 bytes without NUL.`);
+    if (bytes.byteLength < 1 ||
+        bytes.byteLength > service_wire_binary_primitives_1.SERVICE_WIRE_TEXT8_MAX_BYTES ||
+        bytes.includes(0)) {
+        throw new RangeError(`${name} must contain 1..${service_wire_binary_primitives_1.SERVICE_WIRE_TEXT8_MAX_BYTES} UTF-8 bytes without NUL.`);
     }
     return bytes;
 }
@@ -189,12 +193,12 @@ function writeText8(target, offset, value) {
     return offset + 1 + value.byteLength;
 }
 function validatePositiveU64(value, name) {
-    if (value <= 0n || value > 0xffffffffffffffffn) {
+    if (value <= 0n || value > stream_wire_1.UINT64_MAX) {
         throw new RangeError(`${name} is out of range.`);
     }
 }
 function validateU64(value, name) {
-    if (value < 0n || value > 0xffffffffffffffffn) {
+    if (value < 0n || value > stream_wire_1.UINT64_MAX) {
         throw new RangeError(`${name} is out of range.`);
     }
 }

package/dist/runtime/foundation/service-liveness-registry.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceLivenessRegistry = exports.DEFAULT_SERVICE_PEER_TIMEOUT_MS = exports.DEFAULT_SERVICE_PROBE_INTERVAL_MS = void 0;
+const stream_wire_1 = require("@zlink-systems/stream-wire");
 exports.DEFAULT_SERVICE_PROBE_INTERVAL_MS = 5_000;
 exports.DEFAULT_SERVICE_PEER_TIMEOUT_MS = 15_000;
 /** Uses monotonic milliseconds and never treats application traffic as a probe ACK. */
@@ -101,7 +102,7 @@ class ServiceLivenessRegistry {
     }
     allocateProbeId() {
         const result = this.nextProbeId++;
-        if (this.nextProbeId > 0xffffffffffffffffn)
+        if (this.nextProbeId > stream_wire_1.UINT64_MAX)
             this.nextProbeId = 1n;
         return result;
     }

package/dist/runtime/foundation/service-maintenance-runtime.d.ts

@@ -42,4 +42,3 @@ export declare class ServiceMaintenanceRuntime {
     private publishCore;
     private notify;
 }
-export declare function classifyRelocationRecovery(publishedReference: boolean, payloadPresent: boolean, checksumMatches: boolean, inventoryMatches: boolean): 'resume' | 'orphan' | 'relocationDataLost';

package/dist/runtime/foundation/service-maintenance-runtime.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceMaintenanceRuntime = void 0;
-exports.classifyRelocationRecovery = classifyRelocationRecovery;
 const node_async_hooks_1 = require("node:async_hooks");
 const state_lane_1 = require("../execution/state-lane");
 const detachedStateLaneResource = new node_async_hooks_1.AsyncResource('zlink:service-maintenance-runtime');
@@ -110,13 +109,28 @@ class ServiceMaintenanceRuntime {
     }
     async runUnits(signal, stopStartingSignal) {
         const pending = new Set();
+        // A unit failure is recorded before its promise leaves `pending`, so no
+        // failure is lost. Every started unit runs to its own terminal before the
+        // first failure is reported: the host result follows the settled
+        // authority of each unit (spec 30 §13).
+        const failures = [];
+        const reportFailure = async () => {
+            if (failures.length === 0)
+                return;
+            await Promise.allSettled(pending);
+            throw failures[0];
+        };
         for (;;) {
+            await reportFailure();
             const queued = await this.lane.run(() => this.units.length > 0);
-            if (!queued && pending.size === 0)
+            if (!queued && pending.size === 0) {
+                await reportFailure();
                 return;
+            }
             signal.throwIfAborted();
             if (stopStartingSignal?.aborted === true) {
                 await Promise.allSettled(pending);
+                await reportFailure();
                 stopStartingSignal.throwIfAborted();
             }
             let admitted = false;
@@ -142,7 +156,12 @@ class ServiceMaintenanceRuntime {
                     continue;
                 admitted = true;
                 let running;
-                running = startOutsideStateLane(() => unit.relocate(signal).finally(async () => {
+                running = startOutsideStateLane(() => unit
+                    .relocate(signal)
+                    .catch((error) => {
+                    failures.push(error);
+                })
+                    .finally(async () => {
                     const publication = await this.lane.run(() => {
                         this.activeOutbound--;
                         pending.delete(running);
@@ -154,6 +173,7 @@ class ServiceMaintenanceRuntime {
                 this.notify(claim.publication);
             }
             if (pending.size === 0) {
+                await reportFailure();
                 if (!admitted)
                     throw new Error('No relocation unit is ready to start.');
             }
@@ -189,8 +209,3 @@ exports.ServiceMaintenanceRuntime = ServiceMaintenanceRuntime;
 function startOutsideStateLane(work) {
     return detachedStateLaneResource.runInAsyncScope(work);
 }
-function classifyRelocationRecovery(publishedReference, payloadPresent, checksumMatches, inventoryMatches) {
-    if (!publishedReference)
-        return payloadPresent ? 'orphan' : 'resume';
-    return payloadPresent && checksumMatches && inventoryMatches ? 'resume' : 'relocationDataLost';
-}

package/dist/runtime/foundation/service-metadata-codec.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encodeServiceMetadataFrame = encodeServiceMetadataFrame;
 exports.validateServiceMetadataFrame = validateServiceMetadataFrame;
-const MAX_METADATA_BYTES = 1024;
+const stream_wire_1 = require("@zlink-systems/stream-wire");
 const FATAL_UTF8 = new TextDecoder('utf-8', { fatal: true });
 function encodeServiceMetadataFrame(entries) {
     if (entries.size > 0xff) {
@@ -19,8 +19,8 @@ function encodeServiceMetadataFrame(entries) {
     return validateServiceMetadataFrame(Buffer.concat(encoded));
 }
 function validateServiceMetadataFrame(frame) {
-    if (frame.byteLength > MAX_METADATA_BYTES) {
-        throw new RangeError('Application metadata frame exceeds 1024 bytes.');
+    if (frame.byteLength > stream_wire_1.ZLINK_STREAM_MAX_METADATA_BYTES) {
+        throw new RangeError(`Application metadata frame exceeds ${stream_wire_1.ZLINK_STREAM_MAX_METADATA_BYTES} bytes.`);
     }
     const bytes = Buffer.from(frame);
     let offset = 0;

package/dist/runtime/foundation/service-relocation-aggregate-committer.d.ts

@@ -20,16 +20,13 @@ export interface ServicePreparedRelocationAggregate {
     readonly fence: ZLinkAggregateFence;
     readonly plan: ServiceRelocationAggregatePlan;
 }
-type AggregateStore = Pick<ZLinkObjectCreationStore, 'prepareAggregate' | 'commitAggregate' | 'abortAggregate'> & Pick<ZLinkAuthorityStore, 'readAuthority'>;
-/** Commits every owner and membership row through one Location Store fence. */
+type AggregateStore = Pick<ZLinkObjectCreationStore, 'prepareAggregate' | 'abortAggregate'> & Pick<ZLinkAuthorityStore, 'readAuthority'>;
+/** Prepares and aborts relocation through one Location Store fence. */
 export declare class ServiceRelocationAggregateCommitter {
     private readonly store;
     constructor(store: AggregateStore);
     prepare(plan: ServiceRelocationAggregatePlan, signal?: AbortSignal): Promise<ServicePreparedRelocationAggregate>;
     private authorityStoreVersionsUnchanged;
-    commit(prepared: ServicePreparedRelocationAggregate, signal?: AbortSignal): Promise<ReadonlyMap<string, ZLinkAuthoritySnapshot>>;
     abort(prepared: ServicePreparedRelocationAggregate, signal?: AbortSignal): Promise<void>;
-    private commitFence;
-    private readCommittedParticipants;
 }
 export {};

package/dist/runtime/foundation/service-relocation-aggregate-committer.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceRelocationAggregateCommitter = void 0;
 const service_relocation_runtime_1 = require("./service-relocation-runtime");
 const MAX_PREPARE_CONFLICT_ATTEMPTS = 8;
-/** Commits every owner and membership row through one Location Store fence. */
+/** Prepares and aborts relocation through one Location Store fence. */
 class ServiceRelocationAggregateCommitter {
     store;
     constructor(store) {
@@ -52,59 +52,12 @@ class ServiceRelocationAggregateCommitter {
         }
         return true;
     }
-    async commit(prepared, signal) {
-        try {
-            await this.commitFence(prepared.fence, signal);
-        }
-        catch (firstError) {
-            // A lost commit response is reconciled by repeating the exact durable fence.
-            try {
-                await this.commitFence(prepared.fence, signal);
-            }
-            catch {
-                throw firstError;
-            }
-        }
-        return await this.readCommittedParticipants(prepared.plan, signal);
-    }
     async abort(prepared, signal) {
         const result = await this.store.abortAggregate(prepared.fence, signal);
         if (result.kind !== 'aborted' && result.kind !== 'alreadyAborted') {
             throw new Error(`Location Store rejected relocation aggregate abort: ${result.kind}.`);
         }
     }
-    async commitFence(fence, signal) {
-        const result = await this.store.commitAggregate(fence, signal);
-        if (result.kind !== 'committed' && result.kind !== 'alreadyCommitted') {
-            throw new Error(`Location Store rejected relocation aggregate commit: ${result.kind}.`);
-        }
-    }
-    async readCommittedParticipants(plan, signal) {
-        const committed = new Map();
-        for (const participant of plan.participants) {
-            const current = await this.store.readAuthority(participant.key, signal);
-            if (current.kind !== 'snapshot' ||
-                current.objectGeneration !== participant.expected.objectGeneration ||
-                current.storeVersion.value === participant.expected.storeVersion.value ||
-                !Buffer.from(current.payload).equals(Buffer.from(participant.authorityPayload))) {
-                throw new Error('Committed relocation aggregate does not match its exact participant plan.');
-            }
-            if (participant.ownerTransition === 'newOwner') {
-                if (current.ownerId !== plan.targetOwner.ownerId ||
-                    current.ownerLeaseGeneration !== plan.targetOwner.leaseGeneration ||
-                    current.authorityOwnerGeneration <= participant.expected.authorityOwnerGeneration) {
-                    throw new Error('Committed relocation participant has a different owner fence.');
-                }
-            }
-            else if (current.ownerId !== participant.expected.ownerId ||
-                current.ownerLeaseGeneration !== participant.expected.ownerLeaseGeneration ||
-                current.authorityOwnerGeneration !== participant.expected.authorityOwnerGeneration) {
-                throw new Error('Preserved relocation participant changed its owner fence.');
-            }
-            committed.set(participant.key.value, current);
-        }
-        return committed;
-    }
 }
 exports.ServiceRelocationAggregateCommitter = ServiceRelocationAggregateCommitter;
 function validateAndEncodeParticipants(plan) {

package/dist/runtime/foundation/service-relocation-coordinator.d.ts

@@ -17,3 +17,12 @@ export declare class ServiceRelocationPostCommitError extends Error {
     readonly cause: unknown;
     constructor(authority: ZLinkAuthoritySnapshot, staging: ServiceRelocationStaging, cause: unknown);
 }
+/**
+ * A relocation whose settled authority leaves the host in `Error` with
+ * `Blocked/RelocationFailed` (spec 30 §13): the source owner lease ended
+ * before its Preserve fence succeeded, or units settled on both the source
+ * and the target.
+ */
+export declare class ServiceRelocationAuthorityError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}

package/dist/runtime/foundation/service-relocation-coordinator.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceRelocationPostCommitError = void 0;
+exports.ServiceRelocationAuthorityError = exports.ServiceRelocationPostCommitError = void 0;
 class ServiceRelocationPostCommitError extends Error {
     authority;
     staging;
@@ -14,3 +14,16 @@ class ServiceRelocationPostCommitError extends Error {
     }
 }
 exports.ServiceRelocationPostCommitError = ServiceRelocationPostCommitError;
+/**
+ * A relocation whose settled authority leaves the host in `Error` with
+ * `Blocked/RelocationFailed` (spec 30 §13): the source owner lease ended
+ * before its Preserve fence succeeded, or units settled on both the source
+ * and the target.
+ */
+class ServiceRelocationAuthorityError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ServiceRelocationAuthorityError';
+    }
+}
+exports.ServiceRelocationAuthorityError = ServiceRelocationAuthorityError;

package/dist/runtime/foundation/service-relocation-object-owner.d.ts

@@ -16,6 +16,8 @@ export interface ServiceRelocationCaptureUnit {
     captureApplicationState(signal?: AbortSignal): Promise<Uint8Array>;
     commitSeal(): Promise<void> | void;
     abortSeal(): Promise<void> | void;
+    /** Expired-owner terminal: pending requests fail once and dispatch stays closed. */
+    discardSeal?(reason: unknown): Promise<void> | void;
 }
 export declare class ServiceCapturedObjectRelocation {
     readonly envelope: ServiceRelocationEnvelope;
@@ -24,6 +26,12 @@ export declare class ServiceCapturedObjectRelocation {
     constructor(envelope: ServiceRelocationEnvelope, units: readonly ServiceRelocationCaptureUnit[]);
     commitSource(): Promise<void>;
     abortSource(): Promise<void>;
+    /**
+     * The source owner lease ended before the authority settled (spec 28 §4.4):
+     * the source neither resumes nor commits. Retained work is dropped and
+     * every pending request without a terminal fails once with `reason`.
+     */
+    discardSource(reason: unknown): Promise<void>;
 }
 /** Captures the two valid relocation units: User Spot aggregate or one Actor. */
 export declare class ServiceRelocationObjectCaptureOwner {

package/dist/runtime/foundation/service-relocation-object-owner.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceRelocationObjectRestoreOwner = exports.ServiceRelocationObjectCaptureOwner = exports.ServiceCapturedObjectRelocation = void 0;
+const DEFAULT_RELOCATION_CALLBACK_CONCURRENCY = 8;
 class ServiceCapturedObjectRelocation {
     envelope;
     units;
@@ -12,8 +13,8 @@ class ServiceCapturedObjectRelocation {
     async commitSource() {
         if (this.terminal === 'committed')
             return;
-        if (this.terminal === 'aborted') {
-            throw new Error('Relocation source capture was already aborted.');
+        if (this.terminal !== 'open') {
+            throw new Error(`Relocation source capture was already ${this.terminal}.`);
         }
         for (const unit of this.units)
             await unit.commitSeal();
@@ -22,8 +23,8 @@ class ServiceCapturedObjectRelocation {
     async abortSource() {
         if (this.terminal === 'aborted')
             return;
-        if (this.terminal === 'committed') {
-            throw new Error('Committed relocation source capture cannot be aborted.');
+        if (this.terminal !== 'open') {
+            throw new Error(`A ${this.terminal} relocation source capture cannot be aborted.`);
         }
         const failures = [];
         for (const unit of [...this.units].reverse()) {
@@ -39,12 +40,24 @@ class ServiceCapturedObjectRelocation {
             throw new AggregateError(failures, 'Relocation source rollback was incomplete.');
         }
     }
+    /**
+     * The source owner lease ended before the authority settled (spec 28 §4.4):
+     * the source neither resumes nor commits. Retained work is dropped and
+     * every pending request without a terminal fails once with `reason`.
+     */
+    async discardSource(reason) {
+        if (this.terminal !== 'open')
+            return;
+        this.terminal = 'discarded';
+        for (const unit of this.units)
+            await unit.discardSeal?.(reason);
+    }
 }
 exports.ServiceCapturedObjectRelocation = ServiceCapturedObjectRelocation;
 /** Captures the two valid relocation units: User Spot aggregate or one Actor. */
 class ServiceRelocationObjectCaptureOwner {
     maxConcurrentCallbacks;
-    constructor(maxConcurrentCallbacks = 8) {
+    constructor(maxConcurrentCallbacks = DEFAULT_RELOCATION_CALLBACK_CONCURRENCY) {
         this.maxConcurrentCallbacks = maxConcurrentCallbacks;
         requireCallbackConcurrency(maxConcurrentCallbacks);
     }
@@ -115,7 +128,7 @@ class ServiceRelocationObjectRestoreOwner {
     target;
     authorityKey;
     maxConcurrentCallbacks;
-    constructor(target, authorityKey, maxConcurrentCallbacks = 8) {
+    constructor(target, authorityKey, maxConcurrentCallbacks = DEFAULT_RELOCATION_CALLBACK_CONCURRENCY) {
         this.target = target;
         this.authorityKey = authorityKey;
         this.maxConcurrentCallbacks = maxConcurrentCallbacks;