@zlink-systems/framework 0.25.0 → 0.27.0

package/dist/runtime/host/service-relocation-host-runtime.js

@@ -5,36 +5,50 @@ exports.decodeQueuedHandoffPacket = decodeQueuedHandoffPacket;
 exports.createServiceRelocationId = createServiceRelocationId;
 exports.relocationFailedFailureCode = relocationFailedFailureCode;
 exports.encodeHandoffQueuedMessages = encodeHandoffQueuedMessages;
+const stream_wire_1 = require("@zlink-systems/stream-wire");
 const node_crypto_1 = require("node:crypto");
-const runtime_values_1 = require("../backend/runtime-values");
 const contracts_1 = require("../../contracts");
 const Options_1 = require("../../contracts/Locations/Options");
-const framework_errors_internal_1 = require("../framework-errors-internal");
-const service_runtime_contracts_1 = require("../foundation/service-runtime-contracts");
-const routing_id_1 = require("../routing-id");
-const service_wire_m6a_codec_1 = require("../foundation/service-wire-m6a-codec");
-const service_relocation_runtime_1 = require("../foundation/service-relocation-runtime");
-const relocation_direct_transfer_1 = require("./relocation-direct-transfer");
-const relocation_state_adapter_1 = require("./relocation-state-adapter");
-const service_relocation_coordinator_1 = require("../foundation/service-relocation-coordinator");
+const Stores_1 = require("../../contracts/Locations/Stores");
+const actor_authority_publication_1 = require("../actors/actor-authority-publication");
+const actor_handoff_1 = require("../actors/actor-handoff");
+const actor_remote_wire_1 = require("../actors/actor-remote-wire");
+const actor_runtime_state_1 = require("../actors/actor-runtime-state");
+const runtime_values_1 = require("../backend/runtime-values");
+const diagnostics_1 = require("../diagnostics");
+const runtime_metrics_1 = require("../diagnostics/runtime-metrics");
+const state_lane_1 = require("../execution/state-lane");
+const actor_join_recovery_codec_1 = require("../foundation/actor-join-recovery-codec");
+const operation_identity_1 = require("../foundation/operation-identity");
+const service_authority_payload_codec_1 = require("../foundation/service-authority-payload-codec");
 const service_maintenance_runtime_1 = require("../foundation/service-maintenance-runtime");
-const service_relocation_object_owner_1 = require("../foundation/service-relocation-object-owner");
 const service_relocation_aggregate_committer_1 = require("../foundation/service-relocation-aggregate-committer");
+const service_relocation_coordinator_1 = require("../foundation/service-relocation-coordinator");
+const service_relocation_object_owner_1 = require("../foundation/service-relocation-object-owner");
+const service_relocation_runtime_1 = require("../foundation/service-relocation-runtime");
+const service_runtime_contracts_1 = require("../foundation/service-runtime-contracts");
+const service_stateful_wire_codec_1 = require("../foundation/service-stateful-wire-codec");
+const service_wire_constants_generated_1 = require("../foundation/service-wire-constants.generated");
+const service_wire_m6a_codec_1 = require("../foundation/service-wire-m6a-codec");
+const framework_errors_internal_1 = require("../framework-errors-internal");
+const authority_key_codec_1 = require("../locations/authority-key-codec");
+const location_store_failure_1 = require("../locations/location-store-failure");
+const routing_id_1 = require("../routing-id");
 const spot_provider_1 = require("../spots/spot-provider");
-const actor_runtime_state_1 = require("../actors/actor-runtime-state");
-const actor_handoff_1 = require("../actors/actor-handoff");
 const spot_remote_codec_1 = require("../spots/spot-remote-codec");
-const actor_authority_publication_1 = require("../actors/actor-authority-publication");
-const service_authority_payload_codec_1 = require("../foundation/service-authority-payload-codec");
 const actor_transfer_runtime_1 = require("./actor-transfer-runtime");
-const authority_key_codec_1 = require("../locations/authority-key-codec");
-const service_relocation_control_1 = require("./service-relocation-control");
-const service_stateful_wire_codec_1 = require("../foundation/service-stateful-wire-codec");
-const service_wire_constants_generated_1 = require("../foundation/service-wire-constants.generated");
 const bounded_replay_map_1 = require("./bounded-replay-map");
+const relocation_direct_transfer_1 = require("./relocation-direct-transfer");
 const relocation_integrity_fault_gate_1 = require("./relocation-integrity-fault-gate");
-const actor_remote_wire_1 = require("../actors/actor-remote-wire");
-const actor_join_recovery_codec_1 = require("../foundation/actor-join-recovery-codec");
+const relocation_state_adapter_1 = require("./relocation-state-adapter");
+const service_relocation_control_1 = require("./service-relocation-control");
+const RELOCATION_ATTEMPT_TIMEOUT_MS = 250;
+const RELOCATION_AUTHORITY_RETRY_DELAY_MS = 25;
+const RELOCATION_MAX_SEND_ATTEMPTS = 120;
+const RELOCATION_AUTHORITY_POLL_INTERVAL_MS = 10;
+const RELOCATION_RESEND_DELAY_MS = 250;
+const RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+const RELOCATION_OPERATION_TIMEOUT_MS = 30_000;
 class ZLinkRelocationStateIncompatibleError extends Error {
     constructor(message) {
         super(message);
@@ -68,8 +82,7 @@ class ZLinkHostServiceRelocationRuntime {
      * Terminal restore failures (assembly/checksum/factory/restore error): the
      * target already sent relocationFailed (command 53) once. An exact-identity
      * Prepare resend replays the stored response rather than retrying the
-     * restore; a different exact identity reusing the same RelocationId+attempt
-     * key supersedes the stale entry (spec 28 §3, §9).
+     * restore. A different exact identity never changes this entry (spec 28 §4.3).
      */
     targetReadyFailures = new Map();
     /**
@@ -109,8 +122,13 @@ class ZLinkHostServiceRelocationRuntime {
         }
         this.reserveExactRelocationId(input.relocationId);
         let resolveReady;
-        const ready = new Promise((resolve) => {
-            resolveReady = resolve;
+        const ready = new Promise((resolve, reject) => {
+            resolveReady = (failure) => {
+                if (failure === undefined)
+                    resolve();
+                else
+                    reject(failure.cause);
+            };
         });
         this.sourceActorJoinProfiles.set(input.relocationId, {
             actor: input.actor,
@@ -121,8 +139,8 @@ class ZLinkHostServiceRelocationRuntime {
             targetNodeRid: input.target.targetNodeRid,
             relocationContentType: this.actorRegistration(input.state.meshName ?? input.meshName, input.state.actorType ?? '')
                 .relocation.kind === 'snapshot'
-                ? 'application/vnd.zlink.actor-relocation.snapshot'
-                : 'application/vnd.zlink.actor-relocation.recreate',
+                ? actor_join_recovery_codec_1.SNAPSHOT_RELOCATION_CONTENT_TYPE
+                : actor_join_recovery_codec_1.RECREATE_RELOCATION_CONTENT_TYPE,
             completionOperationId: input.completionOperationId,
             canonicalRecovery: input.canonicalRecovery,
             ready,
@@ -141,8 +159,14 @@ class ZLinkHostServiceRelocationRuntime {
             resolveReady();
         }
         catch (error) {
-            this.sourceActorJoinProfiles.delete(input.relocationId);
-            throw error;
+            if (error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) {
+                resolveReady(error);
+                this.completeActorJoinSourceCleanup(input.state.actorId);
+            }
+            else {
+                this.sourceActorJoinProfiles.delete(input.relocationId);
+                throw error;
+            }
         }
         return {
             actorRef: {
@@ -157,20 +181,11 @@ class ZLinkHostServiceRelocationRuntime {
     async dispose() {
         this.disposed = true;
         const errors = [];
-        for (const stage of this.targetStages.values()) {
-            if (stage.fallback !== undefined)
-                clearTimeout(stage.fallback);
-            try {
-                if (stage.finalize !== undefined) {
-                    await stage.finalize;
-                }
-                else if (stage.phase === 'ready') {
-                    await this.abortTargetStage(stage);
-                }
-            }
-            catch (error) {
-                errors.push(error);
-            }
+        try {
+            await this.drainTargetAttempts();
+        }
+        catch (error) {
+            errors.push(error);
         }
         this.targetStages.clear();
         this.terminalTargets.clear();
@@ -181,10 +196,6 @@ class ZLinkHostServiceRelocationRuntime {
         this.targetReadyFailures.clear();
         this.targetReadyResponses.clear();
         for (const window of this.sourceCutoverWindows.values()) {
-            if (window.windowTimer !== undefined)
-                clearTimeout(window.windowTimer);
-            if (window.retryTimer !== undefined)
-                clearTimeout(window.retryTimer);
             if (window.followTimer !== undefined)
                 clearTimeout(window.followTimer);
         }
@@ -217,22 +228,67 @@ class ZLinkHostServiceRelocationRuntime {
         if (errors.length > 1)
             throw new AggregateError(errors, 'Relocation runtime stop failed.');
     }
+    /** Host shutdown waits for the existing attempt terminal before releasing its lease. */
+    async drainTargetAttempts() {
+        const results = await Promise.allSettled([...this.targetStages.entries()].map(([stagingId, stage]) => {
+            if (stage.fallback !== undefined)
+                clearTimeout(stage.fallback);
+            return stage.lane.finally(() => {
+                if (stage.phase === 'failed')
+                    return stage.finalize;
+                if (this.targetStageSealed(stage)) {
+                    const terminal = this.discardTargetStage(stagingId, stage);
+                    stage.finalize = terminal;
+                    return terminal;
+                }
+                return this.beginTargetFinalize(stage.offer.reservation.prepared.plan.targetDescriptor.meshName, stagingId, stage);
+            });
+        }));
+        const errors = results.flatMap((result) => result.status === 'rejected' ? [result.reason] : []);
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1)
+            throw new AggregateError(errors, 'Relocation target drain failed.');
+    }
+    /** Spec 28 §4.4: the target owner alone orders shutdown seal and verified cutover. */
+    targetStageSealed(stage) {
+        return (!stage.cutoverReceived && (this.disposed || this.options.targetAdmissionSealed?.() === true));
+    }
     completeActorJoinSourceCleanup(actorId) {
         for (const [relocationId, profile] of this.sourceActorJoinProfiles) {
             if (profile.state.actorId !== actorId)
                 continue;
             this.sourceActorJoinProfiles.delete(relocationId);
             this.terminalActorJoinSourceLeaves.remember(relocationId, actorId);
-            void profile.ready
-                .then(async () => {
-                await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
-                await this.options
-                    .actorManager()
-                    ?.completeRelocationSource(actorId, profile.sourceActorRef);
-            })
-                .catch((error) => {
-                console.error('[zlink.runtime.relocation.source_cleanup_failed]', error);
-            });
+            void this.finalizeActorJoinSource(profile);
+        }
+    }
+    async finalizeActorJoinSource(profile) {
+        const failures = [];
+        try {
+            await profile.ready;
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        try {
+            await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        try {
+            await this.options
+                .actorManager()
+                ?.completeRelocationSource(profile.state.actorId, profile.sourceActorRef);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (failures.length > 0) {
+            console.error('[zlink.runtime.relocation.source_cleanup_failed]', failures.length === 1
+                ? failures[0]
+                : new AggregateError(failures, 'Actor source retirement failed.'));
         }
     }
     async relocateMesh(meshName, targetApplicationVersion, signal, stopStartingSignal) {
@@ -302,19 +358,49 @@ class ZLinkHostServiceRelocationRuntime {
             publishState: () => undefined,
             forceStop: () => undefined
         });
+        const started = [];
         for (const unit of work) {
             maintenance.enqueue({
                 id: unit.id,
                 ready: () => true,
-                relocate: unit.relocate
+                relocate: (relocationSignal) => {
+                    const run = unit.relocate(relocationSignal);
+                    if ((0, state_lane_1.isStructuralGuardEnabled)()) {
+                        (0, state_lane_1.trackDiagnosticCompletion)(run, `relocation ${unit.id}`);
+                    }
+                    started.push(run);
+                    return run;
+                }
             });
         }
         const operationSignal = signal ?? new AbortController().signal;
-        const deadlineMs = signal === undefined ? 30_000 : 24 * 60 * 60 * 1000;
-        const result = await raceAbort(maintenance.start('retire', deadlineMs, stopStartingSignal, operationSignal), operationSignal);
-        if (result.state !== 'completed') {
-            throw result.terminalError ?? new Error(`Host relocation ended in '${result.state}'.`);
+        const deadlineMs = signal === undefined
+            ? RELOCATION_OPERATION_TIMEOUT_MS
+            : RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS;
+        let failure;
+        try {
+            const result = await raceAbort(maintenance.start('retire', deadlineMs, stopStartingSignal, operationSignal), operationSignal);
+            if (result.state === 'completed')
+                return;
+            failure = result.terminalError ?? new Error(`Host relocation ended in '${result.state}'.`);
         }
+        catch (error) {
+            failure = error;
+        }
+        // The host result follows the settled authority of every started unit
+        // (spec 30 §13): a unit completes only after its target commit is
+        // confirmed, so a failure beside a completed unit leaves units on both
+        // sides.
+        const settled = await Promise.allSettled(started);
+        const targetSide = settled.filter((value) => value.status === 'fulfilled' || value.reason instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError).length;
+        const authorityError = settled.find((value) => value.status === 'rejected' && value.reason instanceof service_relocation_coordinator_1.ServiceRelocationAuthorityError);
+        if (authorityError !== undefined)
+            throw authorityError.reason;
+        // A unit that never started also stays on the source.
+        if (targetSide > 0 && targetSide < work.length) {
+            throw new service_relocation_coordinator_1.ServiceRelocationAuthorityError('Relocation units settled on both the source and the target.', { cause: failure });
+        }
+        throw failure;
     }
     async tryHandleControl(meshName, record, signal) {
         if (record.parts.length === 0)
@@ -379,41 +465,50 @@ class ZLinkHostServiceRelocationRuntime {
             }
             const operationKey = relocationStagingId(request);
             const fingerprint = stringifyWire(request);
+            const readyFailure = this.targetReadyFailures.get(operationKey);
+            const readyPending = this.targetReadyResponses.get(operationKey);
+            let operation = this.targetPrepareOperations.get(operationKey);
+            const acceptedFingerprint = readyFailure?.fingerprint ??
+                readyPending?.fingerprint ??
+                operation?.fingerprint ??
+                this.targetAssemblies.get(operationKey)?.fingerprint ??
+                this.targetStages.get(operationKey)?.offer.prepareFingerprint ??
+                this.terminalTargets.get(operationKey);
+            if (request.sourceNodeRid !== String(record.sourceNodeRid))
+                return true;
+            if (acceptedFingerprint !== undefined && acceptedFingerprint !== fingerprint) {
+                if (!samePrepareIdentity(acceptedFingerprint, request))
+                    return true;
+                this.replyPrepare(record, relocationFailed(request, service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost));
+                return true;
+            }
             // A restore that failed outright is terminal: the source observes the
             // same explicit relocationFailed on every identical Prepare resend
-            // rather than a silent stall. A different exact identity reusing the
-            // same RelocationId+attempt key supersedes the stale failure — the
-            // newer attempt wins (spec 28 §3).
-            const readyFailure = this.targetReadyFailures.get(operationKey);
+            // rather than a silent stall.
             if (readyFailure !== undefined) {
-                if (readyFailure.fingerprint === fingerprint) {
-                    this.replyPrepare(record, readyFailure.response);
-                    return true;
-                }
-                this.targetReadyFailures.delete(operationKey);
+                this.replyPrepare(record, readyFailure.response);
+                return true;
             }
             // Spec 28: an exact-identity Restore resend against staging that
             // already restored successfully reuses that staging — it re-submits
             // READY rather than restarting the restore.
-            const readyPending = this.targetReadyResponses.get(operationKey);
             if (readyPending !== undefined) {
-                if (readyPending.fingerprint !== fingerprint) {
-                    throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-                }
                 this.submitTargetReady(meshName, operationKey, record, readyPending.response);
                 return true;
             }
-            let operation = this.targetPrepareOperations.get(operationKey);
-            if (operation !== undefined && operation.fingerprint !== fingerprint) {
-                throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-            }
             if (operation === undefined) {
                 // The prepare turn must not block the ordered dispatch lane: the
                 // payload chunks that complete this operation arrive as later records
                 // on the same connection. Register the assembly synchronously, then
                 // finish the restore and the Ready reply asynchronously.
-                this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
-                const promise = this.handlePrepareControl(meshName, operationKey, request, record.sourceNodeRid, signal);
+                let promise;
+                try {
+                    this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
+                    promise = this.handlePrepareControl(meshName, operationKey, request, record.sourceNodeRid, signal);
+                }
+                catch (error) {
+                    promise = Promise.reject(error);
+                }
                 operation = { fingerprint, promise };
                 this.targetPrepareOperations.set(operationKey, operation);
                 void promise
@@ -441,7 +536,7 @@ class ZLinkHostServiceRelocationRuntime {
             // restore or staging): this is terminal. Send relocationFailed
             // (command 53) once and remember it so an identical Prepare resend
             // replays the same response instead of retrying the restore.
-            const failed = relocationFailed(request, relocationFailedFailureCode(error, request.object.kind));
+            const failed = relocationFailed(request, relocationFailedFailureCode(error));
             this.targetReadyFailures.set(operationKey, {
                 fingerprint: stringifyWire(request),
                 response: failed
@@ -522,7 +617,7 @@ class ZLinkHostServiceRelocationRuntime {
             String(sourceNodeRid) !== pending.authenticatedSourceNodeRid ||
             request.senderRole !== 'source' ||
             !sameCoordinator(request.coordinator, pending.prepare.coordinator) ||
-            stringifyWire(request.object) !== stringifyWire(pending.prepare.object)) {
+            !sameRelocationObject(request.object, pending.prepare.object)) {
             // Spec 28 §4.3 — a chunk with a different exact identity is never
             // attached to an in-progress assembly; it is discarded.
             console.warn('[zlink.runtime.relocation.stale_state_chunk]', operationKey);
@@ -541,12 +636,6 @@ class ZLinkHostServiceRelocationRuntime {
     registerTargetAssembly(operationKey, request, authenticatedSourceNodeRid) {
         const existing = this.targetAssemblies.get(operationKey);
         if (existing !== undefined) {
-            if (existing.fingerprint !== stringifyWire(request)) {
-                // Same exact identity with a different declared length or checksum is
-                // an explicit conflict failure; the existing assembly is neither
-                // reused nor overwritten (spec 28 §4.3).
-                throw existing.assembly.fail(`Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`);
-            }
             return existing;
         }
         const pending = {
@@ -557,12 +646,7 @@ class ZLinkHostServiceRelocationRuntime {
         };
         this.targetAssemblies.set(operationKey, pending);
         if (this.relocationIntegrityFaultGate()?.consumeIdentityConflict() === true) {
-            // Route a same-identity, different-manifest delivery through the normal
-            // conflict branch so existing staging is neither reused nor overwritten.
-            return this.registerTargetAssembly(operationKey, {
-                ...request,
-                payloadChecksumCrc32c: request.payloadChecksumCrc32c ^ 1
-            }, authenticatedSourceNodeRid);
+            throw new ServiceRelocationDataLostError(pending.assembly.fail(`Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`).message);
         }
         return pending;
     }
@@ -689,7 +773,7 @@ class ZLinkHostServiceRelocationRuntime {
                     return;
                 }
                 if (this.pendingSessionRelocations.get(key) === pending) {
-                    pending.retryTimer = setTimeout(() => void send(), 250);
+                    pending.retryTimer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
                 }
             }
             catch (error) {
@@ -827,6 +911,9 @@ class ZLinkHostServiceRelocationRuntime {
         }
     }
     async relocateSpotAggregate(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal) {
+        await activation.serial.executeControlLifecycleOperation(() => this.relocateSpotAggregateCore(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal));
+    }
+    async relocateSpotAggregateCore(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal) {
         const store = this.requireLocationStore();
         const spotKey = (0, authority_key_codec_1.encodeAuthorityKey)(kind, String(activation.spotId));
         const spotAuthority = await requireAuthority(store, spotKey, signal);
@@ -866,12 +953,12 @@ class ZLinkHostServiceRelocationRuntime {
             objectGeneration: spotAuthority.objectGeneration,
             authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
             seal: async (captureSignal) => {
-                interruptionStartedAt = performance.now();
-                spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
-                // captureRelocation seals synchronously before its first await. Invoke
-                // it in the same event-loop turn as the wire ingress seal so no
-                // accepted direct message can enter between the two boundaries.
-                const spotCaptureOperation = activation.captureRelocation(captureSignal);
+                const { spotCaptureOperation } = await this.afterSpotCloseDecision(meshName, activation.spotId, () => {
+                    interruptionStartedAt = performance.now();
+                    spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
+                    // Both seals run in the same event-loop turn after the Close decision.
+                    return { spotCaptureOperation: activation.captureRelocation(captureSignal) };
+                });
                 const preparedSessions = Promise.all(actorStates.map(async (state) => ({
                     state,
                     actor: state.actor,
@@ -891,34 +978,64 @@ class ZLinkHostServiceRelocationRuntime {
             },
             captureApplicationState: (captureSignal) => this.captureApplication(spotRegistration.relocation, activation.spot, captureSignal),
             commitSeal: async () => {
-                if (!spotSealCommitted) {
-                    if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
-                        throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+                const failures = [];
+                try {
+                    if (!spotSealCommitted) {
+                        if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
+                            throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+                        }
+                        spotSealCommitted = true;
+                    }
+                    if (spotMessageFollowSeal !== undefined) {
+                        await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
                     }
-                    spotSealCommitted = true;
                 }
-                if (spotMessageFollowSeal !== undefined) {
-                    await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
+                catch (error) {
+                    failures.push(error);
                 }
                 for (const session of sessions) {
-                    const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', session.state.actorId));
-                    const targetActorRef = {
-                        actorId: session.state.actorId,
-                        objectGeneration: actorAuthorities.get(session.state.actorId).objectGeneration,
-                        meshName,
-                        nodeRid: target.rid
-                    };
-                    await session.prepared.commit({
-                        routerChannelId: meshName,
-                        targetNodeRid: target.rid,
-                        spotId: activation.spotId,
-                        spotKind: kind === 'user_spot' ? contracts_1.ZLinkSpotKind.User : contracts_1.ZLinkSpotKind.Instance,
-                        authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-                    }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(session.state.actorId, targetActorRef, committedAuthority));
-                    activation.commitActorDeparture(session.state.actorId);
-                    await this.requireActorManager().completeRelocationSource(session.state.actorId);
+                    try {
+                        const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', session.state.actorId));
+                        const targetActorRef = {
+                            actorId: session.state.actorId,
+                            objectGeneration: actorAuthorities.get(session.state.actorId).objectGeneration,
+                            meshName,
+                            nodeRid: target.rid
+                        };
+                        await session.prepared.commit({
+                            routerChannelId: meshName,
+                            targetNodeRid: target.rid,
+                            spotId: activation.spotId,
+                            spotKind: kind === 'user_spot' ? contracts_1.ZLinkSpotKind.User : contracts_1.ZLinkSpotKind.Instance,
+                            authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+                        }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(session.state.actorId, targetActorRef, committedAuthority));
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                    try {
+                        activation.commitActorDeparture(session.state.actorId);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                    try {
+                        await this.requireActorManager().completeRelocationSource(session.state.actorId);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
                 }
-                await this.requireSpotManager().completeRelocationSource(activation);
+                try {
+                    await this.requireSpotManager().completeRelocationSource(activation);
+                }
+                catch (error) {
+                    failures.push(error);
+                }
+                if (failures.length > 0)
+                    throw failures.length === 1
+                        ? failures[0]
+                        : new AggregateError(failures, 'Spot source retirement failed.');
             },
             abortSeal: async () => {
                 const failures = [];
@@ -986,7 +1103,9 @@ class ZLinkHostServiceRelocationRuntime {
         }
         catch (error) {
             outcome = 'failed';
-            if (readinessBoundaryConsumed && !(error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError)) {
+            if (readinessBoundaryConsumed &&
+                !(error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) &&
+                !(error instanceof service_relocation_coordinator_1.ServiceRelocationAuthorityError)) {
                 await activation
                     .completeConsumedRelocationBoundary(contracts_1.ZLinkSpotRelocationReadyOutcome.Continued)
                     .catch(() => undefined);
@@ -1003,7 +1122,9 @@ class ZLinkHostServiceRelocationRuntime {
     async relocateStandaloneActor(meshName, state, target, targetApplicationVersion, signal, targetMembership, aggregateIdOverride, retainSourceForActorJoin = false, 
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes) {
-        relocationDebug('standalone_actor.begin', { actorId: state.actorId });
+        if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+            (0, diagnostics_1.relocationDebug)('standalone_actor.begin', { actorId: state.actorId });
+        }
         const authority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId), signal);
         target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, [
             {
@@ -1036,14 +1157,20 @@ class ZLinkHostServiceRelocationRuntime {
         };
         let outcome = 'completed';
         try {
-            relocationDebug('standalone_actor.wait_budget', {
-                actorId: state.actorId,
-                targetRid: String(target.rid)
-            });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('standalone_actor.wait_budget', {
+                    actorId: state.actorId,
+                    targetRid: String(target.rid)
+                });
+            }
             await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
-            relocationDebug('standalone_actor.capture_begin', { actorId: state.actorId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('standalone_actor.capture_begin', { actorId: state.actorId });
+            }
             const captured = await new service_relocation_object_owner_1.ServiceRelocationObjectCaptureOwner().captureStandaloneActor(aggregateId, 1n, measuredUnit, membership, signal);
-            relocationDebug('standalone_actor.capture_complete', { actorId: state.actorId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('standalone_actor.capture_complete', { actorId: state.actorId });
+            }
             await this.runCoordinator(meshName, target, authority, captured, new Map([[measuredUnit.authorityKey, authority]]), signal, sessions, advertisedReceiveChunkLimitBytes);
         }
         catch (error) {
@@ -1058,6 +1185,9 @@ class ZLinkHostServiceRelocationRuntime {
         }
     }
     async relocatePerActorSpotShell(meshName, activation, target, targetApplicationVersion, signal) {
+        await activation.serial.executeControlLifecycleOperation(() => this.relocatePerActorSpotShellCore(meshName, activation, target, targetApplicationVersion, signal));
+    }
+    async relocatePerActorSpotShellCore(meshName, activation, target, targetApplicationVersion, signal) {
         const spotKey = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(activation.spotId));
         const spotAuthority = await requireAuthority(this.requireLocationStore(), spotKey, signal);
         const spotRegistration = this.spotRegistration(meshName, 'user_spot', spotAuthority.allocation.stableType);
@@ -1080,9 +1210,12 @@ class ZLinkHostServiceRelocationRuntime {
             objectGeneration: spotAuthority.objectGeneration,
             authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
             seal: async (captureSignal) => {
-                interruptionStartedAt = performance.now();
-                spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
-                spotCapture = await activation.captureRelocation(captureSignal);
+                const { spotCaptureOperation } = await this.afterSpotCloseDecision(meshName, activation.spotId, () => {
+                    interruptionStartedAt = performance.now();
+                    spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
+                    return { spotCaptureOperation: activation.captureRelocation(captureSignal) };
+                });
+                spotCapture = await spotCaptureOperation;
                 return {
                     boundSessionState: Buffer.alloc(0),
                     queuedMessages: [],
@@ -1169,29 +1302,47 @@ class ZLinkHostServiceRelocationRuntime {
                     target === undefined ||
                     meshName === undefined)
                     return;
-                const membershipSpotId = targetMembership?.spotId ?? (target.entrySpotId ?? String(target.rid));
-                const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId));
-                const targetActorRef = {
-                    actorId: state.actorId,
-                    objectGeneration: authority.objectGeneration,
-                    meshName,
-                    nodeRid: target.rid
-                };
-                await ownSession.prepared.commit({
-                    routerChannelId: meshName,
-                    targetNodeRid: target.rid,
-                    spotId: membershipSpotId,
-                    spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry,
-                    authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-                }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(state.actorId, targetActorRef, committedAuthority));
+                const failures = [];
+                try {
+                    const membershipSpotId = targetMembership?.spotId ?? (target.entrySpotId ?? String(target.rid));
+                    const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId));
+                    const targetActorRef = {
+                        actorId: state.actorId,
+                        objectGeneration: authority.objectGeneration,
+                        meshName,
+                        nodeRid: target.rid
+                    };
+                    await ownSession.prepared.commit({
+                        routerChannelId: meshName,
+                        targetNodeRid: target.rid,
+                        spotId: membershipSpotId,
+                        spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry,
+                        authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+                    }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(state.actorId, targetActorRef, committedAuthority));
+                }
+                catch (error) {
+                    failures.push(error);
+                }
                 if (!retainSourceForActorJoin) {
-                    await this.requireActorManager().completeRelocationSource(state.actorId);
+                    try {
+                        await this.requireActorManager().completeRelocationSource(state.actorId);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
                 }
+                if (failures.length > 0)
+                    throw failures.length === 1
+                        ? failures[0]
+                        : new AggregateError(failures, 'Actor source retirement failed.');
             },
             abortSeal: async () => {
                 if (standalone && ownSession !== undefined)
                     await ownSession.prepared.rollback();
-            }
+            },
+            discardSeal: (reason) => (standalone
+                ? ownSession
+                : sessions.find((value) => value.state === state))?.prepared.discard(reason)
         };
     }
     reserveRelocationId() {
@@ -1217,12 +1368,16 @@ class ZLinkHostServiceRelocationRuntime {
     async runCoordinator(meshName, target, primary, captured, _authorities, signal, sessions = [], 
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes) {
-        relocationDebug('coordinator.begin', {
-            aggregateId: captured.envelope.aggregateId,
-            targetRid: String(target.rid)
-        });
+        if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+            (0, diagnostics_1.relocationDebug)('coordinator.begin', {
+                aggregateId: captured.envelope.aggregateId,
+                targetRid: String(target.rid)
+            });
+        }
         const localStatus = this.requireMeshNode(meshName).status();
-        const controlDeadlineAtMs = signal === undefined ? performance.now() + 30_000 : Number.MAX_SAFE_INTEGER;
+        const controlDeadlineAtMs = signal === undefined
+            ? performance.now() + RELOCATION_OPERATION_TIMEOUT_MS
+            : Number.MAX_SAFE_INTEGER;
         const coordinator = {
             ownerId: primary.ownerId,
             leaseGeneration: primary.ownerLeaseGeneration,
@@ -1264,11 +1419,13 @@ class ZLinkHostServiceRelocationRuntime {
         // configured limit unchanged (spec 15 §4.2).
         const chunkLimitBytes = (0, relocation_direct_transfer_1.effectiveActorJoinChunkLimitBytes)(limits.relocationPayloadChunkLimitBytes, advertisedReceiveChunkLimitBytes);
         const plan = (0, relocation_direct_transfer_1.planRelocationChunks)(encoded, chunkLimitBytes);
-        const convergenceDeadlineAtMs = signal === undefined
-            ? performance.now() + RELOCATION_OPERATION_RETENTION_MS
-            : controlDeadlineAtMs;
+        // The Restore absolute deadline is this unit's relocation deadline: the
+        // caller's signal, or the control deadline without one. From it the
+        // source settles the authority with its Preserve fence (Location runtime
+        // §10). The target keeps no deadline of its own.
+        const restoreDeadlineReached = () => signal?.aborted === true || performance.now() >= controlDeadlineAtMs;
         let readyReceived = false;
-        let sourceCommitted = false;
+        let settlement;
         try {
             const prepare = {
                 kind: 'prepare',
@@ -1291,18 +1448,26 @@ class ZLinkHostServiceRelocationRuntime {
             // the target assembled, verified, and restored the payload.
             const readyOperation = this.sendControl(meshName, target.rid, prepare, signal, controlDeadlineAtMs, encodePrepareSideband(captured.envelope));
             try {
-                relocationDebug('coordinator.state_transfer_begin', {
-                    aggregateId: captured.envelope.aggregateId
-                });
+                if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                    (0, diagnostics_1.relocationDebug)('coordinator.state_transfer_begin', {
+                        aggregateId: captured.envelope.aggregateId
+                    });
+                }
                 await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, signal);
             }
             catch (chunkError) {
                 readyOperation.catch(() => undefined);
                 throw chunkError;
             }
-            relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+            }
             const ready = await readyOperation;
-            relocationDebug('coordinator.ready_received', { aggregateId: captured.envelope.aggregateId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('coordinator.ready_received', {
+                    aggregateId: captured.envelope.aggregateId
+                });
+            }
             validateControlResponse(prepare, ready);
             // Ready arms the target's cutover-wait fallback. From this point
             // forward the source can no longer reopen dispatch without risking two
@@ -1343,9 +1508,9 @@ class ZLinkHostServiceRelocationRuntime {
                 boundaryRecordCount: BigInt(boundaryBatch.length),
                 boundaryChecksumCrc32c: (0, service_relocation_runtime_1.crc32c)(Buffer.concat(boundaryBatch.map((value) => value.canonicalBytes)))
             });
-            // The one-way cutover submit reaches a terminal result exactly once;
-            // success and failure both end source dispatch permanently. The batch
-            // copy stays for the retransmission window (spec 28 §4.4).
+            // The cutover submit result is not the authority result. The memory
+            // copy of the boundary batch and cutover stays until the authority
+            // settlement below (spec 28 §4.4).
             let submitFailure;
             try {
                 for (const record of boundaryBatch) {
@@ -1357,38 +1522,44 @@ class ZLinkHostServiceRelocationRuntime {
                 submitFailure = error;
                 console.warn('[zlink.runtime.relocation.cutover_submit_failed]', relayAuthorityId, error);
             }
-            this.beginSourceCutoverWindow(meshName, target.rid, relayAuthorityId, [...boundaryBatch.map((value) => value.frame), cutoverFrame], submitFailure !== undefined, limits);
-            await this.waitForTargetAuthorities(captured.envelope, targetFence, convergenceDeadlineAtMs, signal);
-            relocationDebug('coordinator.target_authorities_observed', {
-                aggregateId: captured.envelope.aggregateId
-            });
+            const window = this.beginSourceCutoverWindow(meshName, target.rid, relayAuthorityId, [...boundaryBatch.map((value) => value.frame), cutoverFrame], submitFailure !== undefined, limits);
+            try {
+                settlement = await this.settleSourceAuthority(captured.envelope, primary, targetFence, restoreDeadlineReached, window);
+            }
+            finally {
+                this.closeSourceCutoverWindow(relayAuthorityId, window);
+            }
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('coordinator.authority_settled', {
+                    aggregateId: captured.envelope.aggregateId,
+                    settlement
+                });
+            }
+            if (settlement === 'source') {
+                // Preserve won: the captured queue, timers and held records return to
+                // the source queue in their accepted order, and dispatch reopens.
+                await captured.abortSource();
+                throw new Error(`Relocation '${relayAuthorityId}' ended by the source Preserve fence; the source kept the authority.`);
+            }
+            if (settlement === 'lost') {
+                // Expired owner: dispatch and Store changes stop for good and every
+                // pending request without a terminal gets one Unavailable.
+                const unavailable = (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `Relocation '${relayAuthorityId}' source owner lease ended before its authority settled.`, true);
+                await captured.discardSource(unavailable);
+                throw new service_relocation_coordinator_1.ServiceRelocationAuthorityError(unavailable.message, { cause: unavailable });
+            }
             for (const session of sessions)
                 session.prepared.setReplayResults([]);
             await captured.commitSource();
-            sourceCommitted = true;
             await this.options.reconcileStatefulAuthorityRoutes?.(signal);
         }
         catch (error) {
-            if (!readyReceived)
+            if (settlement !== 'target')
                 throw error;
-            try {
-                await this.waitForTargetAuthorities(captured.envelope, targetFence, convergenceDeadlineAtMs);
-                if (!sourceCommitted) {
-                    for (const session of sessions)
-                        session.prepared.setReplayResults([]);
-                    await captured.commitSource();
-                    sourceCommitted = true;
-                }
-                await this.options.reconcileStatefulAuthorityRoutes?.();
-                const authority = await requireAuthority(this.requireLocationStore(), { value: primaryKey(captured.envelope) }, undefined);
-                throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, { id: `${captured.envelope.aggregateId}:${captured.envelope.aggregateGeneration}` }, error);
-            }
-            catch (convergenceError) {
-                if (convergenceError instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) {
-                    throw convergenceError;
-                }
-                throw new AggregateError([error, convergenceError], 'Relocation became irreversible after Ready and target convergence failed.');
-            }
+            // Target commit is confirmed; later source cleanup failures cannot move
+            // the authority back (spec 28 §10).
+            const authority = await requireAuthority(this.requireLocationStore(), { value: primaryKey(captured.envelope) }, undefined);
+            throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, { id: `${captured.envelope.aggregateId}:${captured.envelope.aggregateGeneration}` }, error);
         }
         finally {
             if (!readyReceived) {
@@ -1461,12 +1632,11 @@ class ZLinkHostServiceRelocationRuntime {
         return budget;
     }
     /**
-     * Starts the source retransmission window after the cutover submit
-     * terminal. The boundary batch and cutover copies live in framework memory
-     * (not charged to the in-flight budget) and are cleaned exactly once when
-     * the window ends. While the window is open a failed submit retries the
-     * whole batch on the (re-established) connection. S4 — the Message Follow
-     * route removal point — closes the unit for SafeToShutdown.
+     * Starts the source cutover window after the cutover submit terminal. The
+     * boundary batch and cutover copies live in framework memory (not charged
+     * to the in-flight budget) until the authority settlement closes the
+     * window. S4 — the Message Follow route removal point — closes the unit for
+     * SafeToShutdown.
      */
     beginSourceCutoverWindow(meshName, targetNodeRid, relocationKey, frames, initialSubmitFailed, limits) {
         const submittedAt = performance.now();
@@ -1474,54 +1644,145 @@ class ZLinkHostServiceRelocationRuntime {
             meshName,
             targetNodeRid,
             frames,
+            resendPending: initialSubmitFailed,
             cutoverSubmittedAtMs: submittedAt,
             windowClosed: false,
             followExpired: false
         };
         this.sourceCutoverWindows.set(relocationKey, window);
-        const settle = () => {
-            if (window.windowClosed && window.followExpired) {
-                this.sourceCutoverWindows.delete(relocationKey);
-            }
-        };
-        window.windowTimer = setTimeout(() => {
-            window.windowClosed = true;
-            window.frames = undefined;
-            if (window.retryTimer !== undefined)
-                clearTimeout(window.retryTimer);
-            settle();
-        }, limits.relocationCutoverWaitTimeoutMs);
-        window.windowTimer.unref();
         window.followTimer = setTimeout(() => {
             window.followExpired = true;
             // S1→S4 route convergence: the span the source must keep its Message
             // Follow route (spec 30 §7.1).
-            this.options.metrics?.duration('zlink.relocation.route_convergence', Math.max(0, performance.now() - submittedAt) / 1000, { mesh_name: meshName });
-            settle();
+            this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationRouteConvergence, Math.max(0, performance.now() - submittedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND, { mesh_name: meshName });
+            this.releaseSourceCutoverWindow(relocationKey, window);
         }, limits.messageFollowDurationMs);
         window.followTimer.unref();
-        if (initialSubmitFailed)
-            this.scheduleCutoverRetransmit(window);
+        return window;
+    }
+    /** The authority settlement ended: the retained batch copy is released. */
+    closeSourceCutoverWindow(relocationKey, window) {
+        window.windowClosed = true;
+        window.frames = undefined;
+        this.releaseSourceCutoverWindow(relocationKey, window);
     }
-    scheduleCutoverRetransmit(window) {
-        if (window.windowClosed || window.frames === undefined)
+    releaseSourceCutoverWindow(relocationKey, window) {
+        if (window.windowClosed &&
+            window.followExpired &&
+            this.sourceCutoverWindows.get(relocationKey) === window) {
+            this.sourceCutoverWindows.delete(relocationKey);
+        }
+    }
+    /**
+     * Sends the whole boundary batch and cutover again after a failed submit
+     * or an observed loss of the target connection (spec 28 §4.4). The target
+     * replaces its partial span with the whole batch.
+     */
+    async resendSourceCutover(window) {
+        const frames = window.frames;
+        if (frames === undefined)
             return;
-        window.retryTimer = setTimeout(() => {
-            void (async () => {
-                const frames = window.frames;
-                if (window.windowClosed || frames === undefined)
-                    return;
-                try {
-                    for (const frame of frames) {
-                        await this.submitControlFrame(window.meshName, window.targetNodeRid, frame, 'cutover retransmission');
-                    }
-                }
-                catch {
-                    this.scheduleCutoverRetransmit(window);
-                }
-            })();
-        }, 250);
-        window.retryTimer.unref();
+        const peers = this.requireMeshNode(window.meshName).peers();
+        const peer = peers.find((value) => value.routingId !== null && String(value.routingId) === String(window.targetNodeRid));
+        if (peer !== undefined && peer.state !== service_runtime_contracts_1.MeshPeerRuntimeState.Serving) {
+            window.resendPending = true;
+            return;
+        }
+        if (!window.resendPending)
+            return;
+        try {
+            for (const frame of frames) {
+                await this.submitControlFrame(window.meshName, window.targetNodeRid, frame, 'cutover retransmission');
+            }
+            window.resendPending = false;
+        }
+        catch {
+            // The next settlement round retries the whole batch.
+        }
+    }
+    /**
+     * The one source authority settlement after Ready (Location runtime
+     * §6.1·§10, spec 28 §4.4). It reads the Store until the target commit or
+     * the Restore deadline. From the Restore deadline it runs the source
+     * Preserve fence: a CAS on the StoreVersion expected by target NewOwner
+     * excludes a late target commit. `target`: the
+     * target committed. `source`: Preserve fenced the target out while the
+     * source owner lease was valid. `lost`: the source owner lease ended first
+     * or another authority owns the object. An uncertain Store or lease result
+     * keeps the work retained and repeats the same decision.
+     */
+    async settleSourceAuthority(envelope, primary, target, restoreDeadlineReached, window) {
+        const owner = { ownerId: primary.ownerId, leaseGeneration: primary.ownerLeaseGeneration };
+        const store = this.requireLocationStore();
+        for (;;) {
+            if (this.disposed)
+                throw new Error('Relocation runtime stopped.');
+            await this.resendSourceCutover(window);
+            const observed = await this.readSourceSettlement(envelope, primary, target).catch((error) => {
+                if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error))
+                    throw error;
+                return undefined;
+            });
+            if (observed?.kind === 'target')
+                return 'target';
+            if (observed?.kind === 'other')
+                return 'lost';
+            if (restoreDeadlineReached() && observed?.kind === 'source') {
+                // An unreadable lease is an uncertain result, not an expiry.
+                if (await this.exactSourceLeaseExpired(owner).catch((error) => {
+                    if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error))
+                        throw error;
+                    return false;
+                }))
+                    return 'lost';
+                const publication = this.codec.read(observed.current.payload);
+                const preserved = await store
+                    .compareExchangeAuthority({ value: primaryKey(envelope) }, observed.current.storeVersion, {
+                    kind: 'put',
+                    generationTransition: 'preserve',
+                    payload: publication === undefined
+                        ? observed.current.payload
+                        : this.codec.clear(observed.current.payload, publication.reference)
+                })
+                    .catch((error) => {
+                    if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error))
+                        throw error;
+                    return undefined;
+                });
+                if (preserved?.kind === 'stored')
+                    return 'source';
+            }
+            // The caller awaits this settlement, so the retry timer keeps the loop alive.
+            await new Promise((resolve) => setTimeout(resolve, RELOCATION_AUTHORITY_POLL_INTERVAL_MS));
+        }
+    }
+    async readSourceSettlement(envelope, primary, target) {
+        const primaryAuthorityKey = primaryKey(envelope);
+        let committed = 0;
+        let primaryCurrent;
+        for (const participant of envelope.participants) {
+            const current = await this.requireLocationStore().readAuthority({
+                value: participant.key
+            });
+            if (current.kind !== 'snapshot')
+                return { kind: 'other' };
+            if (current.objectGeneration === participant.objectGeneration &&
+                current.ownerId === target.ownerId &&
+                current.ownerLeaseGeneration === target.ownerLeaseGeneration &&
+                current.authorityOwnerGeneration > participant.authorityOwnerGeneration &&
+                String(current.allocation.descriptor.rid) === target.nodeRid &&
+                current.allocation.descriptorLifecycleGeneration === target.nodeGeneration) {
+                committed += 1;
+            }
+            if (participant.key === primaryAuthorityKey)
+                primaryCurrent = current;
+        }
+        if (committed === envelope.participants.length)
+            return { kind: 'target' };
+        if (primaryCurrent !== undefined && isSourceOwner(primaryCurrent, primary)) {
+            return { kind: 'source', current: primaryCurrent };
+        }
+        return { kind: 'other' };
     }
     /**
      * True when every relocation this source started reached its Message
@@ -1552,9 +1813,6 @@ class ZLinkHostServiceRelocationRuntime {
     }
     /** Restores the hidden object and its saved-work prefix before Ready. */
     async handlePrepareControl(meshName, stagingId, request, sourceNodeRid, signal) {
-        if (sourceNodeRid === null || String(sourceNodeRid) !== request.sourceNodeRid) {
-            throw new Error('Relocation prepare source node fence does not match the authenticated peer.');
-        }
         const targetStatus = this.requireMeshNode(meshName).status();
         const targetOwner = this.options.currentOwner();
         const targetDescriptor = this.options.localDescriptor?.(meshName);
@@ -1570,22 +1828,15 @@ class ZLinkHostServiceRelocationRuntime {
         const fingerprint = stringifyWire(request);
         const existing = this.targetStages.get(stagingId);
         if (existing !== undefined) {
-            if (existing.offer.authenticatedSourceNodeRid !== String(sourceNodeRid) ||
-                existing.offer.prepareFingerprint !== fingerprint) {
-                throw new Error('Relocation prepare retry source node changed.');
-            }
             return relocationReady(request);
         }
         const terminal = this.terminalTargets.get(stagingId);
         if (terminal !== undefined) {
-            if (terminal !== fingerprint) {
-                throw new Error(`Relocation '${stagingId}' repeated Prepare with different bytes.`);
-            }
             this.terminalTargets.touch(stagingId);
             return relocationReady(request);
         }
         const pendingAssembly = this.targetAssemblies.get(stagingId);
-        if (pendingAssembly === undefined || pendingAssembly.fingerprint !== fingerprint) {
+        if (pendingAssembly === undefined) {
             throw new Error(`Relocation '${stagingId}' has no matching payload assembly.`);
         }
         // The directly transferred payload replaces the shared durable root: the
@@ -1611,6 +1862,7 @@ class ZLinkHostServiceRelocationRuntime {
         const envelope = (0, service_relocation_runtime_1.decodeServiceRelocationEnvelope)(payload, request.targetAttemptGeneration);
         const inventoryEnvelope = attachPrepareBoundSessions(await this.resolveTargetParticipantInventory(request, envelope, signal), request.nodeInternalBoundSessions);
         validatePrepareEnvelope(request, inventoryEnvelope);
+        const releaseActivation = (await this.options.activationAdmission?.acquire(meshName, signal)) ?? (() => undefined);
         let materialized;
         let reservation;
         try {
@@ -1620,13 +1872,12 @@ class ZLinkHostServiceRelocationRuntime {
             // rejects unrelated authority CAS until commit/abort.
             materialized = await this.materializeTargetEnvelope(meshName, inventoryEnvelope, signal);
             await materialized.owner.restoreSavedWork(materialized.staging, signal);
-            reservation = await this.reserveTargetForPrepare(meshName, request, inventoryEnvelope, materialized.target, signal);
+            reservation = await this.reserveTargetForPrepare(meshName, request, inventoryEnvelope, signal);
             const offer = {
                 prepare: request,
                 prepareFingerprint: fingerprint,
                 authenticatedSourceNodeRid: String(sourceNodeRid),
                 envelope: inventoryEnvelope,
-                restoreDeadlineAtMs: performance.now() + RELOCATION_OPERATION_RETENTION_MS,
                 reservation
             };
             const stage = {
@@ -1635,11 +1886,13 @@ class ZLinkHostServiceRelocationRuntime {
                 phase: 'ready',
                 lane: Promise.resolve(),
                 cutoverReceived: false,
-                boundaryRelay: []
+                boundaryRelay: [],
+                releaseActivation
             };
             this.targetStages.set(stagingId, stage);
         }
         catch (error) {
+            releaseActivation();
             if (reservation !== undefined) {
                 await this.abortTargetReservation(reservation, signal).catch(() => undefined);
             }
@@ -1650,12 +1903,25 @@ class ZLinkHostServiceRelocationRuntime {
         }
         return relocationReady(request);
     }
+    /**
+     * The cutover wait of a Ready stage (spec 28 §4.4) is a Warning only: it
+     * records `cutover_timeout` and never submits the target CAS or opens
+     * dispatch. From then on the target settlement reads the Location Store so
+     * a source Preserve fence or a lost target lease ends the staging; only a
+     * verified cutover lets that settlement submit the CAS.
+     */
     armTargetCutoverFallback(meshName, stagingId) {
         const stage = this.targetStages.get(stagingId);
         if (stage === undefined || stage.fallback !== undefined || stage.finalize !== undefined)
             return;
         stage.fallback = setTimeout(() => {
-            void this.beginTargetFinalize(meshName, stagingId, stage, true).catch((error) => console.error('[zlink.runtime.relocation.location_update_failed]', error));
+            if (stage.finalize !== undefined)
+                return;
+            console.warn('[zlink.runtime.relocation.cutover_timeout]', stagingId);
+            this.options.metrics?.count(runtime_metrics_1.METRIC_NAMES.RelocationCutoverTimeout, 1, {
+                mesh_name: meshName
+            });
+            void this.beginTargetFinalize(meshName, stagingId, stage).catch((error) => console.error('[zlink.runtime.relocation.location_update_failed]', error));
         }, this.relocationLimits().relocationCutoverWaitTimeoutMs);
         stage.fallback.unref();
     }
@@ -1666,7 +1932,7 @@ class ZLinkHostServiceRelocationRuntime {
         const stagingId = relocationStagingId(request);
         const stage = this.targetStages.get(stagingId);
         if (stage === undefined) {
-            if (this.terminalTargets.get(stagingId) !== undefined) {
+            if (this.disposed || this.terminalTargets.get(stagingId) !== undefined) {
                 if (request.kind === 'cutover') {
                     console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
                 }
@@ -1675,20 +1941,33 @@ class ZLinkHostServiceRelocationRuntime {
             throw new Error(`Relocation staging '${stagingId}' is missing.`);
         }
         validateTargetOneWayControl(stage, request, sourceNodeRid);
-        if (request.kind === 'data') {
-            stage.lane = stage.lane.then(() => this.stageBoundaryRelay(stage, request));
-            await stage.lane;
+        stage.lane = stage.lane.then(() => {
+            // A verified cutover closes the boundary batch. A later record or cutover
+            // is a duplicate retransmission and never changes the staged batch.
+            if (stage.cutoverReceived || (stage.phase !== 'ready' && stage.phase !== 'finalizing')) {
+                if (request.kind === 'cutover') {
+                    console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+                }
+                return;
+            }
+            if (request.kind === 'data') {
+                return this.stageBoundaryRelay(stage, request);
+            }
+            if (this.targetStageSealed(stage))
+                return;
+            this.reconcileBoundaryRelay(stage, request, stagingId);
+            stage.cutoverReceived = true;
+        });
+        await stage.lane;
+        if (request.kind === 'data')
             return;
-        }
-        if (stage.cutoverReceived || stage.phase !== 'ready') {
-            console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+        // A settlement started by the cutover wait Warning is still reading the
+        // Store; it submits the CAS on its next round now that cutover verified.
+        if (stage.finalize !== undefined)
             return;
-        }
-        this.reconcileBoundaryRelay(stage, request, stagingId);
-        stage.cutoverReceived = true;
         if (stage.fallback !== undefined)
             clearTimeout(stage.fallback);
-        await this.beginTargetFinalize(meshName, stagingId, stage, false, signal);
+        await this.beginTargetFinalize(meshName, stagingId, stage, signal);
     }
     /** Validates one boundary relay record and buffers it until cutover applies it. */
     async stageBoundaryRelay(stage, request) {
@@ -1707,14 +1986,13 @@ class ZLinkHostServiceRelocationRuntime {
         }
         const expectedCount = Number(request.boundaryRecordCount);
         const staged = stage.boundaryRelay;
-        const checksumOf = (records) => (0, service_relocation_runtime_1.crc32c)(Buffer.concat(records.map((value) => value.frozenRecord.canonicalBytes)));
-        if (staged.length === expectedCount && checksumOf(staged) === request.boundaryChecksumCrc32c) {
-            return;
-        }
-        if (staged.length > expectedCount) {
-            const suffix = staged.slice(staged.length - expectedCount);
-            if (checksumOf(suffix) === request.boundaryChecksumCrc32c) {
-                console.warn('[zlink.runtime.relocation.boundary_batch_replaced]', stagingId);
+        // The batch is the last `boundaryRecordCount` records: the source sends
+        // the whole batch right before this cutover on the ordered connection,
+        // so a retransmission replaces an earlier partial span as a whole.
+        if (staged.length >= expectedCount) {
+            const batch = staged.slice(staged.length - expectedCount);
+            if ((0, service_relocation_runtime_1.crc32c)(Buffer.concat(batch.map((value) => value.frozenRecord.canonicalBytes))) ===
+                request.boundaryChecksumCrc32c) {
                 staged.splice(0, staged.length - expectedCount);
                 return;
             }
@@ -1724,18 +2002,14 @@ class ZLinkHostServiceRelocationRuntime {
         throw new Error(`Relocation cutover boundary confirmation mismatch for '${stagingId}' ` +
             `(staged=${staged.length} declared=${expectedCount}).`);
     }
-    beginTargetFinalize(meshName, stagingId, stage, fallback, signal) {
+    beginTargetFinalize(meshName, stagingId, stage, signal) {
         if (stage.finalize !== undefined)
             return stage.finalize;
-        if (fallback) {
-            console.warn('[zlink.runtime.relocation.cutover_timeout]', stagingId);
-            this.options.metrics?.count('zlink.relocation.cutover_timeout', 1, {
-                mesh_name: meshName
-            });
-        }
+        // Records staged before this point finish first. The settlement is not
+        // put on the lane, so a cutover that arrives while it waits for the
+        // authority result is still reconciled.
         const finalize = stage.lane.then(() => this.finalizeTargetStage(meshName, stagingId, stage, signal));
         stage.finalize = finalize;
-        stage.lane = finalize;
         return finalize;
     }
     async finalizeTargetStage(meshName, stagingId, stage, signal) {
@@ -1746,14 +2020,15 @@ class ZLinkHostServiceRelocationRuntime {
         let authority;
         let resumeStartedAt;
         try {
-            // The boundary relay span is applied to the temporary queue before the
-            // owner CAS so the merged order is saved work, pre-boundary relay, then
-            // post-boundary temporary records (spec 28 §4.6).
-            for (const relay of stage.boundaryRelay.splice(0)) {
-                await this.applyRelocationData(stage, relay, signal);
-            }
             authority = await this.commitTargetReservation(stage, stage.offer.reservation, signal);
+            if (authority === undefined) {
+                // The seal owner may have ended staging while a Store read was pending.
+                if (stage.phase === 'failed')
+                    return;
+                return this.discardTargetStage(stagingId, stage, signal);
+            }
             authorityCommitted = true;
+            stage.releaseActivation();
             resumeStartedAt = performance.now();
             stage.phase = 'committed';
             await stage.owner.normalize(stage.staging, authority, signal);
@@ -1768,13 +2043,10 @@ class ZLinkHostServiceRelocationRuntime {
                 }
             }
             await this.finalizeActorJoinProfiles(meshName, stage, signal);
-            // Actor Join completion may advance its accepted-completion journal in
-            // the canonical authority slot. Try to clear that final publication
-            // before admission becomes externally visible so a later Join cannot
-            // reserve against the previous root. A bounded CAS conflict must not
-            // roll back already committed target ownership or strand its staged
-            // object: the next reservation recognizes the retained journal root and
-            // continues its existing cleanup/retry path.
+            // Clear the final relocation publication before admission becomes
+            // externally visible so a later Join cannot reserve against the
+            // previous root. A bounded CAS conflict must not roll back already
+            // committed target ownership or strand its staged object.
             try {
                 await this.clearTargetRelocationPublication(stage, authority, signal);
             }
@@ -1786,7 +2058,7 @@ class ZLinkHostServiceRelocationRuntime {
             }
             await stage.owner.openAdmission(stage.staging, signal);
             // S2→S3: owner confirmation to application dispatch opening.
-            this.options.metrics?.duration('zlink.relocation.target_resume', Math.max(0, performance.now() - resumeStartedAt) / 1000, { mesh_name: meshName });
+            this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationTargetResume, Math.max(0, performance.now() - resumeStartedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND, { mesh_name: meshName });
             await this.publishSessionRoutes(stage.staging);
             await this.relayTerminalReplies(meshName, stage, this.targetReplyRelayCoordinator(meshName, stage, authority), signal);
             stage.phase = 'open';
@@ -1795,14 +2067,16 @@ class ZLinkHostServiceRelocationRuntime {
             this.targetAssemblies.delete(stagingId);
         }
         catch (error) {
-            stage.phase = 'failed';
             this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
             this.targetStages.delete(stagingId);
             this.targetAssemblies.delete(stagingId);
             if (!authorityCommitted) {
-                await this.abortTargetStage(stage).catch(() => undefined);
+                // abortTargetStage may already have assigned failed before throwing.
+                if (stage.phase !== 'failed')
+                    await this.abortTargetStage(stage);
                 throw error;
             }
+            stage.phase = 'failed';
             if (authority !== undefined) {
                 throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, stage.staging, error);
             }
@@ -1886,16 +2160,7 @@ class ZLinkHostServiceRelocationRuntime {
         }
         this.sourceActorJoinProfiles.delete(input.transferId);
         this.terminalActorJoinSourceLeaves.remember(input.transferId, input.actorId);
-        void profile.ready
-            .then(async () => {
-            await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
-            await this.options
-                .actorManager()
-                ?.completeRelocationSource(input.actorId, profile.sourceActorRef);
-        })
-            .catch((error) => {
-            console.error('[zlink.runtime.relocation.source_leave_failed]', error);
-        });
+        void this.finalizeActorJoinSource(profile);
         return true;
     }
     async sendControlOneWay(meshName, targetNodeRid, request) {
@@ -1907,58 +2172,23 @@ class ZLinkHostServiceRelocationRuntime {
             throw new Error(`Relocation ${kind} was not accepted by RouteMesh.`);
         }
     }
-    async waitForTargetAuthorities(envelope, target, deadlineAtMs, signal) {
-        for (;;) {
-            signal?.throwIfAborted();
-            let exact = true;
-            for (const participant of envelope.participants) {
-                const current = await this.requireLocationStore().readAuthority({ value: participant.key }, signal);
-                if (current.kind !== 'snapshot' ||
-                    current.objectGeneration !== participant.objectGeneration ||
-                    current.ownerId !== target.ownerId ||
-                    current.ownerLeaseGeneration !== target.ownerLeaseGeneration ||
-                    current.authorityOwnerGeneration <= participant.authorityOwnerGeneration ||
-                    String(current.allocation.descriptor.rid) !== target.nodeRid ||
-                    current.allocation.descriptorLifecycleGeneration !== target.nodeGeneration) {
-                    exact = false;
-                    break;
-                }
-            }
-            if (exact)
-                return;
-            if (performance.now() >= deadlineAtMs) {
-                throw new Error('Relocation target owner was not confirmed before its original deadline.');
-            }
-            await new Promise((resolve) => setTimeout(resolve, 10));
-        }
-    }
     async clearTargetRelocationPublication(stage, primary, signal) {
         await this.releaseParticipantAuthorities(stage.staging.envelope, stage.staging.primaryAuthorityKey.value, signal);
-        //  The deferred-Join journal advances its completion cursor with its
-        //  own authority CAS while the target finalizes, so the initially
-        //  captured storeVersion can be stale by the time the relocation
-        //  wrapper is cleared. Re-read and retry on conflict instead of turning
-        //  a completed relocation into a post-commit failure (spec 28 —
-        //  retryable store conflicts converge on the same CAS and the same
-        //  relocation identity until the outcome is determined).
-        let current = primary;
-        for (let attempt = 0; attempt < 16; attempt += 1) {
-            const publication = this.codec.read(current.payload);
-            if (publication === undefined)
-                return;
-            const result = await this.requireLocationStore().compareExchangeAuthority(stage.staging.primaryAuthorityKey, current.storeVersion, {
-                kind: 'put',
-                generationTransition: 'preserve',
-                payload: this.codec.clear(current.payload, publication.reference)
-            }, signal);
-            if (result.kind === 'stored')
-                return;
-            const read = await this.requireLocationStore().readAuthority(stage.staging.primaryAuthorityKey, signal);
-            if (read.kind !== 'snapshot')
-                break;
-            current = read;
+        //  The target owner is the only writer of the committed primary
+        //  authority between its commit and this clear, so one CAS against the
+        //  committed snapshot decides. A conflict means another owner changed the
+        //  row; the caller records it and leaves the committed ownership intact.
+        const publication = this.codec.read(primary.payload);
+        if (publication === undefined)
+            return;
+        const result = await this.requireLocationStore().compareExchangeAuthority(stage.staging.primaryAuthorityKey, primary.storeVersion, {
+            kind: 'put',
+            generationTransition: 'preserve',
+            payload: this.codec.clear(primary.payload, publication.reference)
+        }, signal);
+        if (result.kind !== 'stored') {
+            throw new Error('Relocation target authority normalization CAS failed.');
         }
-        throw new Error('Relocation target authority normalization CAS failed.');
     }
     async handleReplyRelay(meshName, relay, sourceNodeRid, signal) {
         if (sourceNodeRid === null) {
@@ -2039,13 +2269,13 @@ class ZLinkHostServiceRelocationRuntime {
                         pending.resolve('sourceLeaseExpired');
                         return;
                     }
-                    if (++attempts > 120) {
+                    if (++attempts > RELOCATION_MAX_SEND_ATTEMPTS) {
                         pending.reject(new Error(`Relocation reply relay ACK '${key}' timed out.`));
                         return;
                     }
                     await this.sendInfrastructureControl(meshName, ackTargetNodeRid, (0, service_stateful_wire_codec_1.encodeMaintenanceReplyRelay)(request));
                     if (this.pendingReplyRelays.get(key) === pending) {
-                        pending.timer = setTimeout(() => void send(), 250);
+                        pending.timer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
                     }
                 }
                 catch (error) {
@@ -2140,13 +2370,15 @@ class ZLinkHostServiceRelocationRuntime {
             lease.leaseExpiresAt.getTime() <= lease.storeNow.getTime());
     }
     async publishSessionRoutes(staging) {
-        for (const hidden of staging.hidden.values()) {
-            if (hidden.actor !== undefined) {
-                await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor);
-            }
+        for (const [key, hidden] of staging.hidden) {
+            if (hidden.actor === undefined)
+                continue;
+            // The Session seal travels with the relocation envelope, not the Actor.
+            const carried = staging.envelope.participants.find((value) => value.key === key);
+            await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor, carried === undefined ? undefined : decodeActorSession(carried.boundSessionState));
         }
     }
-    async sendControl(meshName, targetNodeRid, request, signal, deadlineAtMs = performance.now() + 30_000, sideband = []) {
+    async sendControl(meshName, targetNodeRid, request, signal, deadlineAtMs = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS, sideband = []) {
         const key = controlAckKey(request);
         const frames = sideband.length === 0
             ? [(0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request)]
@@ -2158,7 +2390,7 @@ class ZLinkHostServiceRelocationRuntime {
             if (remainingMs <= 0) {
                 throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Relocation control ACK '${key}' timed out.`, true, lastRequestError);
             }
-            const attemptTimeoutMs = Math.max(1, Math.min(250, Math.ceil(remainingMs)));
+            const attemptTimeoutMs = Math.max(1, Math.min(RELOCATION_ATTEMPT_TIMEOUT_MS, Math.ceil(remainingMs)));
             const startedAtMs = performance.now();
             try {
                 const replyFrames = await this.requestInfrastructureControl(meshName, targetNodeRid, frames, attemptTimeoutMs);
@@ -2178,11 +2410,13 @@ class ZLinkHostServiceRelocationRuntime {
                     throw error;
                 }
                 lastRequestError = error;
-                relocationDebug('control.request_retry', {
-                    key,
-                    kind: request.kind,
-                    targetRid: String(targetNodeRid)
-                });
+                if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                    (0, diagnostics_1.relocationDebug)('control.request_retry', {
+                        key,
+                        kind: request.kind,
+                        targetRid: String(targetNodeRid)
+                    });
+                }
                 const retryDelayMs = Math.min(Math.max(0, attemptTimeoutMs - (performance.now() - startedAtMs)), Math.max(0, deadlineAtMs - performance.now()));
                 if (retryDelayMs > 0) {
                     await waitForRelocationRetry(retryDelayMs, signal);
@@ -2207,7 +2441,7 @@ class ZLinkHostServiceRelocationRuntime {
             peers.some((peer) => peer.routingId !== null &&
                 String(peer.routingId) === String(descriptor.rid) &&
                 peer.lifecycleGeneration === descriptor.lifecycleGeneration &&
-                peer.state === 3) &&
+                peer.state === service_runtime_contracts_1.MeshPeerRuntimeState.Serving) &&
             relocationTargetSupports(descriptor, requirements))
             .sort((left, right) => String(left.rid).localeCompare(String(right.rid)));
         const target = selectWeightedRelocationTarget(candidates);
@@ -2234,39 +2468,9 @@ class ZLinkHostServiceRelocationRuntime {
         }
         return authorities;
     }
-    async reserveTargetForPrepare(meshName, prepare, envelope, targetPort, signal) {
+    async reserveTargetForPrepare(meshName, prepare, envelope, signal) {
         const authorities = await this.readTargetParticipantAuthorities(envelope, signal);
         const publication = relocationPublication(prepare, envelope);
-        // Carries the exact reference + CRC of a deferred-Join publication the
-        // target reservation must keep connected through the CAS (spec 28 —
-        // clearing/replacing it here would strand the journal's own
-        // prepared->committed transition with nothing left for it to find).
-        const retainedDeferredJoinRoots = new Map();
-        for (const participant of envelope.participants) {
-            const staged = targetPort.deferredJoinRoot(participant.key);
-            if (staged !== undefined) {
-                retainedDeferredJoinRoots.set(participant.key, {
-                    reference: staged.reference.value,
-                    checksumCrc32c: staged.checksumCrc32c
-                });
-                continue;
-            }
-            const current = this.codec.read(authorities.get(participant.key).payload);
-            if (participant.objectKind === 'actor' &&
-                current?.canonical === true &&
-                (await this.options.actorTransfer.isDeferredJoinAcceptedRootPublication(current.reference, current.checksumCrc32c, {
-                    authorityKey: participant.key,
-                    objectKind: 'actor',
-                    objectGeneration: participant.objectGeneration,
-                    aggregateId: current.aggregateId,
-                    aggregateGeneration: current.aggregateGeneration
-                }, signal))) {
-                retainedDeferredJoinRoots.set(participant.key, {
-                    reference: current.reference,
-                    checksumCrc32c: current.checksumCrc32c
-                });
-            }
-        }
         const participants = envelope.participants.map((participant) => {
             const expected = authorities.get(participant.key);
             const membership = actorMembershipTarget(envelope, participant.key);
@@ -2278,19 +2482,11 @@ class ZLinkHostServiceRelocationRuntime {
                 entrySpotId === undefined) {
                 throw new Error(`Relocation target RouteMesh '${meshName}' has no Entry Spot.`);
             }
-            const retainedDeferredJoinRoot = retainedDeferredJoinRoots.get(participant.key);
-            const participantPublication = retainedDeferredJoinRoot === undefined
-                ? publication
-                : {
-                    ...publication,
-                    reference: retainedDeferredJoinRoot.reference,
-                    checksumCrc32c: retainedDeferredJoinRoot.checksumCrc32c
-                };
             return {
                 key: { value: participant.key },
                 expected,
                 ownerTransition: 'newOwner',
-                authorityPayload: this.authorityPayloadForPublication(expected.payload, participantPublication, {
+                authorityPayload: this.authorityPayloadForPublication(expected.payload, publication, {
                     owner: {
                         ownerId: prepare.target.ownerId,
                         leaseGeneration: prepare.target.ownerLeaseGeneration
@@ -2313,7 +2509,7 @@ class ZLinkHostServiceRelocationRuntime {
                             ...membership,
                             actorSpotKind: contracts_1.ZLinkSpotKind.User
                         })
-                }, retainedDeferredJoinRoot !== undefined),
+                }),
                 membershipMutation: encodeMembershipMutation(envelope.memberships, participant.key)
             };
         });
@@ -2332,19 +2528,13 @@ class ZLinkHostServiceRelocationRuntime {
             prepared: await new service_relocation_aggregate_committer_1.ServiceRelocationAggregateCommitter(this.requireLocationStore()).prepare(plan, signal)
         };
     }
-    authorityPayloadForPublication(payload, publication, target, replacesDeferredJoinRoot = false) {
+    authorityPayloadForPublication(payload, publication, target) {
         const existing = this.codec.read(payload);
         const canonicalIdentity = (0, service_relocation_runtime_1.serviceRelocationAuthoritySlotIdentity)(payload);
-        const replacesCanonicalJournal = replacesDeferredJoinRoot && existing?.canonical === true;
         if (canonicalIdentity !== undefined &&
             (existing === undefined ||
-                (existing.canonical === true &&
-                    (existing.aggregateId === publication.aggregateId || replacesCanonicalJournal)))) {
-            const published = existing === undefined
-                ? this.codec.publish(payload, publication)
-                : replacesCanonicalJournal && existing.aggregateId !== publication.aggregateId
-                    ? this.codec.publish(this.codec.clear(payload, existing.reference), publication)
-                    : payload;
+                (existing.canonical === true && existing.aggregateId === publication.aggregateId))) {
+            const published = existing === undefined ? this.codec.publish(payload, publication) : payload;
             if (target === undefined)
                 return published;
             return (0, service_relocation_runtime_1.projectServiceRelocationAuthorityTargetReady)((0, service_relocation_runtime_1.replaceServiceRelocationAuthorityApplicationPayload)(published, rewriteAuthorityApplicationRoute(published, target)), {
@@ -2394,6 +2584,7 @@ class ZLinkHostServiceRelocationRuntime {
     async abortTargetStage(stage, signal) {
         if (stage.fallback !== undefined)
             clearTimeout(stage.fallback);
+        stage.releaseActivation();
         const failures = [];
         try {
             await this.abortTargetReservation(stage.offer.reservation, signal);
@@ -2414,24 +2605,64 @@ class ZLinkHostServiceRelocationRuntime {
             throw new AggregateError(failures, 'Relocation target rollback was incomplete.');
         }
     }
+    async discardTargetStage(stagingId, stage, signal) {
+        stage.phase = 'failed';
+        console.warn('[zlink.runtime.relocation.target_staging_discarded]', stagingId);
+        try {
+            await this.abortTargetStage(stage, signal);
+        }
+        finally {
+            this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
+            this.targetStages.delete(stagingId);
+            this.targetAssemblies.delete(stagingId);
+        }
+    }
     async commitTargetReservation(stage, reservation, signal) {
         return await this.commitTargetAggregate(stage, reservation.prepared, signal);
     }
+    /**
+     * The one target authority settlement (Location runtime §10, spec 28
+     * §4.4-§4.5). Only a verified cutover lets the target submit its NewOwner
+     * CAS; a transient or indeterminate result resubmits the same RelocationId
+     * and expected StoreVersion while the target owner lease is valid (no
+     * separate timeout, no fixed count). Before a verified cutover the target
+     * only reads. It returns the committed authority, or undefined when a
+     * definitive Conflict excludes this commit after reconciliation, a source
+     * Preserve fence moved the source row, or the target lease ended; the
+     * caller then discards the staging.
+     */
     async commitTargetAggregate(stage, prepared, signal) {
-        let firstError;
+        const target = stage.offer.prepare.target;
         for (;;) {
+            if (stage.phase === 'failed')
+                return undefined;
             signal?.throwIfAborted();
-            let result;
-            try {
-                result = await this.requireLocationStore().commitAggregate(prepared.fence, signal);
-            }
-            catch (error) {
-                firstError ??= error;
-            }
-            if (result?.kind === 'stale' || result?.kind === 'generationExhausted') {
-                throw new Error(`location_update_failed: relocation aggregate commit returned ${result.kind}.`, { cause: firstError });
+            if (this.targetStageSealed(stage))
+                return undefined;
+            let conflict = false;
+            if (stage.cutoverReceived) {
+                // The boundary relay span is applied to the temporary queue before
+                // the owner CAS so the merged order is saved work, pre-boundary relay,
+                // then post-boundary temporary records (spec 28 §4.6).
+                for (const relay of stage.boundaryRelay.splice(0)) {
+                    await this.applyRelocationData(stage, relay, signal);
+                }
+                // A thrown provider call has an unknown result; the read below decides.
+                const result = await this.requireLocationStore()
+                    .commitAggregate(prepared.fence, signal)
+                    .catch((error) => {
+                    if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error, signal))
+                        throw error;
+                    return undefined;
+                });
+                if (result?.kind === 'generationExhausted') {
+                    throw new Error('location_update_failed: relocation aggregate commit exhausted.');
+                }
+                conflict = result?.kind === 'stale';
             }
             const observed = await this.readAggregateForCommitRetry(prepared, signal);
+            if (stage.phase === 'failed')
+                return undefined;
             if (observed.kind === 'committed') {
                 const primary = observed.authorities.get(stage.staging.primaryAuthorityKey.value);
                 if (primary === undefined) {
@@ -2439,12 +2670,17 @@ class ZLinkHostServiceRelocationRuntime {
                 }
                 return primary;
             }
-            if (observed.kind === 'stale') {
-                throw new Error('location_update_failed: relocation aggregate source authority became stale.', {
-                    cause: firstError
-                });
+            if (observed.kind === 'stale' || (conflict && observed.kind === 'source'))
+                return undefined;
+            // An unreadable lease is an uncertain result, not an expiry.
+            if (await this.exactSourceLeaseExpired({ ownerId: target.ownerId, leaseGeneration: target.ownerLeaseGeneration }, signal).catch((error) => {
+                if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error, signal))
+                    throw error;
+                return false;
+            })) {
+                return undefined;
             }
-            await waitForLocationRetry(stage.offer.restoreDeadlineAtMs, signal, firstError);
+            await waitForRelocationRetry(RELOCATION_AUTHORITY_RETRY_DELAY_MS, signal);
         }
     }
     async readAggregateForCommitRetry(prepared, signal) {
@@ -2473,7 +2709,9 @@ class ZLinkHostServiceRelocationRuntime {
                 }
             }
         }
-        catch {
+        catch (error) {
+            if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error, signal))
+                throw error;
             return { kind: 'unknown' };
         }
         if (committed === prepared.plan.participants.length) {
@@ -2505,7 +2743,7 @@ class ZLinkHostServiceRelocationRuntime {
         if (request.object.kind === 'userSpot' || request.object.kind === 'instanceSpot') {
             let cursor;
             for (;;) {
-                const page = await store.listAuthorities('', cursor, 1000, signal);
+                const page = await store.listAuthorities('', cursor, Stores_1.ZLINK_PROVIDER_MAX_PAGE_SIZE, signal);
                 if (page.kind === 'scanExpired') {
                     throw new Error('Location Store authority scan expired during relocation.');
                 }
@@ -2612,7 +2850,7 @@ class ZLinkHostServiceRelocationRuntime {
         const adapter = await this.createRelocationAdapter(policy.adapterType);
         const captured = await (0, relocation_state_adapter_1.captureRelocationAdapterState)(adapter, value, signal ?? new AbortController().signal);
         if (captured.byteLength > RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES) {
-            throw new ZLinkRelocationStateIncompatibleError('Relocation application state exceeds the 64 MiB participant limit.');
+            throw new ZLinkRelocationStateIncompatibleError(`Relocation application state exceeds the ${RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES / (1024 * 1024)} MiB participant limit.`);
         }
         return captured;
     }
@@ -2620,13 +2858,13 @@ class ZLinkHostServiceRelocationRuntime {
         return (await (0, spot_provider_1.createProviderInstance)(adapterType, this.options.providerResolver));
     }
     recordRelocationInterruption(meshName, unitKind, executionMode, startedAt, outcome) {
-        const seconds = Math.max(0, performance.now() - startedAt) / 1000;
+        const seconds = Math.max(0, performance.now() - startedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND;
         const attributes = {
             unit_kind: unitKind,
             ...(executionMode === undefined ? {} : { execution_mode: executionMode })
         };
-        this.options.metrics?.duration('zlink.relocation.interruption', seconds, attributes);
-        this.options.metrics?.count('zlink.relocation.completed', 1, {
+        this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationInterruption, seconds, attributes);
+        this.options.metrics?.count(runtime_metrics_1.METRIC_NAMES.RelocationCompleted, 1, {
             mesh_name: meshName,
             object_kind: unitKind,
             policy: unitKind === 'user_spot' && executionMode === 'per_actor' ? 'recreate' : 'configured',
@@ -2708,6 +2946,17 @@ class ZLinkHostServiceRelocationRuntime {
             throw new Error('Host relocation requires the Spot manager.');
         return value;
     }
+    afterSpotCloseDecision(meshName, spotId, seal) {
+        const manager = this.requireSpotManager();
+        const sealAfterDecision = () => {
+            if (manager.isSpotClosing(meshName, spotId)) {
+                throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${String(spotId)}' is closing.`, true);
+            }
+            return seal();
+        };
+        const decision = manager.pendingSpotCloseDecision(meshName, spotId);
+        return decision === undefined ? sealAfterDecision() : decision.then(sealAfterDecision);
+    }
     requireActorManager() {
         const value = this.options.actorManager();
         if (value === undefined)
@@ -2793,16 +3042,10 @@ function actorJoinTargetMembership(manager, relocationId, participants) {
         }
     ];
 }
-function relocationDebug(marker, detail) {
-    if (process.env.ZLINK_DEBUG_FRAMEWORK_RELOCATION !== '1')
-        return;
-    console.error('[zlink.runtime.relocation]', marker, detail);
-}
 class LocalTargetPort {
     options;
     meshName;
     envelope;
-    deferredJoinRoots = new Map();
     constructor(options, meshName, envelope) {
         this.options = options;
         this.meshName = meshName;
@@ -2819,7 +3062,7 @@ class LocalTargetPort {
             }).globalId;
             const localDescriptor = this.options.localDescriptor?.(this.meshName);
             const nativeEntrySpot = localDescriptor?.entrySpotId === spotIdentity;
-            const actor = await this.requireActorManager().prepareRelocationActor(identity, participant.stableType, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, (nativeEntrySpot ? localDescriptor.rid : spotIdentity), nativeEntrySpot ? localDescriptor.lifecycleGeneration : membership.spotObjectGeneration, membership.membershipEpoch, signal);
+            const actor = await this.requireActorManager().prepareRelocationActor(identity, participant.stableType, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, nativeEntrySpot ? undefined : spotIdentity, membership.spotObjectGeneration, membership.membershipEpoch, signal);
             return {
                 authorityKey: participant.key,
                 participant,
@@ -2905,8 +3148,14 @@ class LocalTargetPort {
             const applicationSignaled = hidden.participant.objectKind === 'user_spot' &&
                 registration.options?.relocationCoordinationMode ===
                     contracts_1.ZLinkSpotRelocationCoordinationMode.ApplicationSignaled;
+            // createHidden could only predict the owner generation; the native Spot
+            // takes the committed authority, as the Actor branch does above.
+            const node = this.options.meshNode(this.meshName);
+            node?.restoreSpotAuthority?.(String(hidden.activation.spotId), 
+            // createHidden stages an activation only for a Spot participant.
+            hidden.participant.objectKind, hidden.participant.stableType, authority.objectGeneration, authority.authorityOwnerGeneration);
             await this.requireSpotManager().publishRelocationSpot(hidden.activation, applicationSignaled ? () => hidden.activation.notifyRelocatedBoundary() : undefined);
-            this.options.meshNode(this.meshName)?.rememberSpotRoute?.({
+            node?.rememberSpotRoute?.({
                 spot: {
                     spotId: String(hidden.activation.spotId),
                     generation: authority.objectGeneration
@@ -2936,15 +3185,14 @@ class LocalTargetPort {
         hidden.initialized = true;
     }
     async restoreBoundSession(hidden, payload) {
-        if (hidden.actor === undefined || payload.byteLength === 0)
+        const carried = decodeActorSession(payload);
+        if (hidden.actor === undefined || carried === undefined)
             return;
-        const target = decodeActorSession(payload);
-        const state = this.requireActorManager().getState(hidden.actor.context.actorId);
-        state.setRemoteBoundSessionTarget(target);
-        state.setBoundSessionTransferTarget(target);
-        if (target.bindingGeneration !== undefined) {
-            state.setBoundSessionBindingGeneration(target.bindingGeneration);
-        }
+        // The relocation delivers the binding it carried; the target installs it
+        // through the one install rule (Session–Actor binding §6, §8).
+        this.requireActorManager()
+            .getState(hidden.actor.context.actorId)
+            .installBoundSessionBinding(carried);
     }
     async replayQueuedMessage(hidden, message) {
         if (hidden.actor === undefined) {
@@ -2955,10 +3203,7 @@ class LocalTargetPort {
             if (recovery.request.actorId !== hidden.actor.context.actorId) {
                 throw new Error('Canonical Actor Join recovery names a different staged Actor.');
             }
-            const deferred = await this.requireSpotManager().restoreCanonicalActorJoinRecovery(recovery, undefined, (0, service_relocation_runtime_1.inventoryDigest)(this.envelope.participants, this.envelope.memberships));
-            if (deferred !== undefined) {
-                this.deferredJoinRoots.set(hidden.authorityKey, deferred);
-            }
+            await this.requireSpotManager().restoreCanonicalActorJoinRecovery(recovery);
             return;
         }
         const packet = decodeQueuedHandoffPacket(message);
@@ -2967,9 +3212,6 @@ class LocalTargetPort {
             throw new Error('Relocated Actor state is not staged.');
         hidden.replayPackets.push(packet);
     }
-    deferredJoinRoot(authorityKey) {
-        return this.deferredJoinRoots.get(authorityKey);
-    }
     async openAdmission(hidden) {
         if (hidden.actor === undefined)
             return;
@@ -3283,9 +3525,9 @@ function relocationWireId(value) {
 }
 function createServiceRelocationId(isInUse, entropy = node_crypto_1.randomBytes) {
     for (;;) {
-        const bytes = entropy(16);
-        if (bytes.byteLength !== 16) {
-            throw new Error('Relocation identity entropy must return exactly 16 bytes.');
+        const bytes = entropy(operation_identity_1.OPERATION_IDENTITY_BYTES);
+        if (bytes.byteLength !== operation_identity_1.OPERATION_IDENTITY_BYTES) {
+            throw new Error(`Relocation identity entropy must return exactly ${operation_identity_1.OPERATION_IDENTITY_BYTES} bytes.`);
         }
         let nonZero = false;
         for (const byte of bytes) {
@@ -3318,14 +3560,40 @@ function sameWireId(left, right) {
 }
 function sameCoordinator(left, right) {
     return (left.ownerId === right.ownerId &&
-        left.leaseGeneration === right.leaseGeneration &&
+        BigInt(left.leaseGeneration) === right.leaseGeneration &&
         left.nodeRid === right.nodeRid &&
-        left.nodeGeneration === right.nodeGeneration &&
+        BigInt(left.nodeGeneration) === right.nodeGeneration &&
         left.expectedAuthorityStoreVersion === right.expectedAuthorityStoreVersion);
 }
+function sameRelocationTarget(left, right) {
+    return (left.nodeRid === right.nodeRid &&
+        BigInt(left.nodeGeneration) === right.nodeGeneration &&
+        left.ownerId === right.ownerId &&
+        BigInt(left.ownerLeaseGeneration) === right.ownerLeaseGeneration);
+}
+function sameRelocationObject(left, right) {
+    if (left.kind !== right.kind || BigInt(left.objectGeneration) !== right.objectGeneration) {
+        return false;
+    }
+    if (left.kind === 'actor' && right.kind === 'actor') {
+        return (left.actorId === right.actorId &&
+            BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration);
+    }
+    if (left.kind === 'userSpot' && right.kind === 'userSpot') {
+        return (left.spotId === right.spotId &&
+            BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration);
+    }
+    return (left.kind === 'instanceSpot' &&
+        right.kind === 'instanceSpot' &&
+        left.spotId === right.spotId &&
+        left.stableType === right.stableType);
+}
 function isExactSourceAuthority(current, expected) {
-    return (current.storeVersion.value === expected.storeVersion.value &&
-        current.objectGeneration === expected.objectGeneration &&
+    return (current.storeVersion.value === expected.storeVersion.value && isSourceOwner(current, expected));
+}
+/** The same source tenure owns the row, at any StoreVersion. */
+function isSourceOwner(current, expected) {
+    return (current.objectGeneration === expected.objectGeneration &&
         current.authorityOwnerGeneration === expected.authorityOwnerGeneration &&
         current.ownerId === expected.ownerId &&
         current.ownerLeaseGeneration === expected.ownerLeaseGeneration &&
@@ -3345,26 +3613,6 @@ function isExactCommittedTarget(current, expected, target, payload) {
         current.allocation.descriptorLifecycleGeneration === target.nodeGeneration &&
         Buffer.from(current.payload).equals(Buffer.from(payload)));
 }
-async function waitForLocationRetry(deadlineAtMs, signal, cause) {
-    signal?.throwIfAborted();
-    if (performance.now() >= deadlineAtMs) {
-        throw new Error('location_update_failed: relocation Restore validity expired before exact target owner confirmation.', { cause });
-    }
-    await new Promise((resolve, reject) => {
-        let timer;
-        const aborted = () => {
-            if (timer !== undefined)
-                clearTimeout(timer);
-            reject(signal?.reason);
-        };
-        signal?.addEventListener('abort', aborted, { once: true });
-        timer = setTimeout(() => {
-            signal?.removeEventListener('abort', aborted);
-            resolve();
-        }, Math.min(25, Math.max(1, deadlineAtMs - performance.now())));
-        timer.unref();
-    });
-}
 async function waitForRelocationRetry(delayMs, signal) {
     signal?.throwIfAborted();
     await new Promise((resolve, reject) => {
@@ -3379,7 +3627,6 @@ async function waitForRelocationRetry(delayMs, signal) {
             signal?.removeEventListener('abort', aborted);
             resolve();
         }, delayMs);
-        timer.unref();
     });
 }
 function sameRequestSource(left, right) {
@@ -3406,14 +3653,16 @@ function maintenanceReplyRelay(stage, coordinator, participantId, completion) {
         replyRouteId: BigInt(completion.source.replyRouteId),
         participantId,
         sequence: BigInt(completion.index + 1),
-        terminalResult: completion.result.ok ? 0 : 105,
-        failureCode: completion.result.ok ? 0 : 17,
+        terminalResult: completion.result.ok ? runtime_values_1.RequestResult.Ok : runtime_values_1.RequestResult.InternalError,
+        failureCode: completion.result.ok
+            ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.none
+            : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed,
         ...(value === undefined
             ? {}
             : {
                 payload: {
-                    packetName: 'zlink.relocation.reply',
-                    contentType: 'application/json',
+                    packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
+                    contentType: stream_wire_1.ZlinkStreamContentType.Json,
                     bytes: Buffer.from(JSON.stringify(value), 'utf8')
                 }
             })
@@ -3425,15 +3674,15 @@ function handoffResultFromRelay(relay) {
     }
     let value;
     if (relay.payload !== undefined) {
-        if (relay.terminalResult !== 0 ||
-            relay.payload.packetName !== 'zlink.relocation.reply' ||
-            relay.payload.contentType !== 'application/json') {
+        if (relay.terminalResult !== runtime_values_1.RequestResult.Ok ||
+            relay.payload.packetName !== SERVICE_RELOCATION_REPLY_PACKET_NAME ||
+            relay.payload.contentType !== stream_wire_1.ZlinkStreamContentType.Json) {
             throw new TypeError('Relocation terminal payload boundary is invalid.');
         }
         value = JSON.parse(Buffer.from(relay.payload.bytes).toString('utf8'));
     }
     const index = Number(relay.sequence - 1n);
-    return relay.terminalResult === 0
+    return relay.terminalResult === runtime_values_1.RequestResult.Ok
         ? { index, ok: true, ...(value === undefined ? {} : { response: value }) }
         : { index, ok: false, error: `Actor handoff failed with framework code ${relay.failureCode}.` };
 }
@@ -3448,73 +3697,15 @@ function wireIdText(value) {
 class ServiceRelocationDataLostError extends Error {
 }
 exports.ServiceRelocationDataLostError = ServiceRelocationDataLostError;
-/**
- * Maps a target-side relocation Prepare failure to the closest wire
- * framework-error code the generated schema
- * ({@link ServiceWireFrameworkErrorCode}) defines — mirrors the java
- * reference mapping (commit 97fc074058) and the dotnet/cpp ports. The wire
- * vocabulary predates the framework's typed error kinds and has no
- * one-to-one code for every kind, so several kinds share the nearest fit
- * (documented per case below); unresolvable vocabulary gaps belong at the
- * schema level, not invented here. {@link ServiceRelocationDataLostError}
- * is this runtime's dedicated tag for a verified checksum/assembly/digest
- * integrity failure — the case that keeps relocationDataLost(35). An
- * unclassified error carries no evidence of integrity loss and takes the
- * generic opaque requestFailed(17). `objectKind` (the Prepare's
- * ObjectFence.kind, spec 28 §4.2) picks between an Actor- and
- * Spot-specific code where the schema splits by object kind.
- */
-function relocationFailedFailureCode(error, objectKind) {
+/** Classifies relocation failure with the error model §2.1 mapping. */
+function relocationFailedFailureCode(error) {
     if (error instanceof ServiceRelocationDataLostError) {
-        return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost;
+        return (0, framework_errors_internal_1.frameworkRelocationFailureCode)(contracts_1.ZLinkFrameworkErrorKind.DataLost);
     }
     if (!(error instanceof contracts_1.ZLinkFrameworkException)) {
-        return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed;
-    }
-    switch (error.kind) {
-        case contracts_1.ZLinkFrameworkErrorKind.DataLost:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost;
-        case contracts_1.ZLinkFrameworkErrorKind.Rejected:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestRejected;
-        case contracts_1.ZLinkFrameworkErrorKind.ProtocolError:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestProtocolError;
-        //  No dedicated "deadline exceeded" wire code exists; a worker timeout
-        //  is the closest timeout-shaped signal.
-        case contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.workerTimedOut;
-        //  A stale generation/fence is the concrete cause of InvalidOperation
-        //  along this path (spec 15 failure table); pick the
-        //  object-kind-specific stale code.
-        case contracts_1.ZLinkFrameworkErrorKind.InvalidOperation:
-            return objectKind === 'actor'
-                ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorLocationStale
-                : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.spotGenerationStale;
-        //  No dedicated generic "unavailable" wire code exists; a disconnected
-        //  route is the closest "cannot reach/use the target" signal.
-        case contracts_1.ZLinkFrameworkErrorKind.Unavailable:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.routeNotConnected;
-        case contracts_1.ZLinkFrameworkErrorKind.NotFound:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestTargetNotFound;
-        //  The only "already exists" wire code is Actor-specific; not expected
-        //  along this target-failure path, mapped for completeness.
-        case contracts_1.ZLinkFrameworkErrorKind.AlreadyExists:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorAlreadyExists;
-        case contracts_1.ZLinkFrameworkErrorKind.TypeMismatch:
-            return objectKind === 'actor'
-                ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorTypeMismatch
-                : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.spotTypeMismatch;
-        //  No dedicated "not configured" wire code exists; a missing configured
-        //  handler is the closest analog.
-        case contracts_1.ZLinkFrameworkErrorKind.NotConfigured:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.handlerNotFound;
-        //  No dedicated generic "internal failure" or "shutting down" wire code
-        //  exists; the generic opaque request-failure code is the closest fit
-        //  for both (ShuttingDown included — re-judged 2026-08-19, C-10).
-        case contracts_1.ZLinkFrameworkErrorKind.ShuttingDown:
-        case contracts_1.ZLinkFrameworkErrorKind.InternalFailure:
-        default:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed;
+        return (0, framework_errors_internal_1.frameworkRelocationFailureCode)(contracts_1.ZLinkFrameworkErrorKind.InternalFailure);
     }
+    return (0, framework_errors_internal_1.frameworkRelocationFailureCode)(error);
 }
 function relocationStagingId(value) {
     return `${value.relocation.high}:${value.relocation.low}:${value.targetAttemptGeneration}`;
@@ -3605,7 +3796,7 @@ function relocationFailed(request, failureCode) {
 function validatePrepareEnvelope(request, envelope) {
     if (!sameWireId(request.relocation, relocationWireId(envelope.aggregateId)) ||
         request.applicationVersion !== envelope.applicationVersion ||
-        stringifyWire(request.object) !== stringifyWire(relocationObject(envelope))) {
+        !sameRelocationObject(request.object, relocationObject(envelope))) {
         throw new Error('Relocation Prepare does not match its immutable root identity.');
     }
 }
@@ -3615,14 +3806,9 @@ function validateTargetOneWayControl(stage, request, sourceNodeRid) {
         !sameWireId(request.relocation, prepare.relocation) ||
         request.targetAttemptGeneration !== prepare.targetAttemptGeneration ||
         !sameCoordinator(request.coordinator, prepare.coordinator) ||
-        stringifyWire(request.object) !==
-            stringifyWire(request.kind === 'data' ? request.object : prepare.object)) {
+        (request.kind === 'cutover' && !sameRelocationObject(request.object, prepare.object))) {
         throw new Error('Relocation one-way control changed its exact Prepare fence.');
     }
-    if (request.kind === 'cutover' &&
-        stringifyWire(request.object) !== stringifyWire(prepare.object)) {
-        throw new Error('Relocation Cutover changed its prepared object.');
-    }
 }
 function relocationPublication(prepare, envelope) {
     // The direct transfer has no durable store root; the authority wrapper
@@ -3705,7 +3891,7 @@ function canonicalQueuedFrozenRecord(participant, message, coordinator, target)
         ...(packet.returnResponse ? { replyRouteId: BigInt(packet.source.replyRouteId) } : {}),
         payload: {
             packetName: '__zlink.actor.handoff.accepted',
-            contentType: 'application/json',
+            contentType: stream_wire_1.ZlinkStreamContentType.Json,
             bytes: message.payload
         }
     });
@@ -3726,14 +3912,22 @@ function parseHandoffOperationId(value) {
 function stringifyWire(value) {
     return JSON.stringify(value, (_key, item) => (typeof item === 'bigint' ? item.toString() : item));
 }
+function samePrepareIdentity(acceptedFingerprint, incoming) {
+    const accepted = JSON.parse(acceptedFingerprint);
+    return (accepted.sourceNodeRid === incoming.sourceNodeRid &&
+        BigInt(accepted.sourceNodeGeneration) === incoming.sourceNodeGeneration &&
+        sameCoordinator(accepted.coordinator, incoming.coordinator) &&
+        sameRelocationTarget(accepted.target, incoming.target) &&
+        sameRelocationObject(accepted.object, incoming.object));
+}
 function validateControlResponse(request, response) {
     if (request.kind !== 'prepare' ||
         response.kind !== 'ready' ||
         !sameWireId(response.relocation, request.relocation) ||
         response.targetAttemptGeneration !== request.targetAttemptGeneration ||
         !sameCoordinator(response.coordinator, request.coordinator) ||
-        stringifyWire(response.target) !== stringifyWire(request.target) ||
-        stringifyWire(response.object) !== stringifyWire(request.object) ||
+        !sameRelocationTarget(response.target, request.target) ||
+        !sameRelocationObject(response.object, request.object) ||
         response.senderRole !== 'target') {
         throw new Error('Relocation control response does not match the request fence.');
     }
@@ -3750,78 +3944,16 @@ function validateControlFailureResponse(request, response) {
         !sameWireId(response.relocation, request.relocation) ||
         response.targetAttemptGeneration !== request.targetAttemptGeneration ||
         !sameCoordinator(response.coordinator, request.coordinator) ||
-        stringifyWire(response.target) !== stringifyWire(request.target) ||
-        stringifyWire(response.object) !== stringifyWire(request.object) ||
+        !sameRelocationTarget(response.target, request.target) ||
+        !sameRelocationObject(response.object, request.object) ||
         response.senderRole !== 'target') {
         throw new Error('Relocation control response does not match the request fence.');
     }
 }
-/**
- * Maps a relocationFailed(53) wire failureCode (the generated
- * ServiceWireFrameworkErrorCode vocabulary) to its internal error kind, so a
- * source-side reject carries the same classification the target chose
- * instead of a generic Error. Direct 1:1 correspondence with the generated
- * names; an unrecognised or absent code falls back to RequestFailed
- * (InternalFailure) — the closest existing kind (spec 15 §"Failed.Kind").
- */
-function relocationFailureCodeKind(failureCode) {
-    switch (failureCode) {
-        case 1:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorRouteNotFound;
-        case 2:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorCreateFailed;
-        case 3:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorAlreadyExists;
-        case 4:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorTypeMismatch;
-        case 5:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotCreateFailed;
-        case 6:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotRouteNotFound;
-        case 7:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotTypeMismatch;
-        case 8:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorSessionNotBound;
-        case 9:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.HandlerNotFound;
-        case 10:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteHandlerNotFound;
-        case 11:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorDispatchHandlerNotFound;
-        case 12:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.PayloadDecodeFailed;
-        case 13:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected;
-        case 14:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound;
-        case 15:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestRejected;
-        case 16:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestProtocolError;
-        case 18:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerQueueFull;
-        case 19:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerTimedOut;
-        case 20:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerFailed;
-        case 21:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale;
-        case 22:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorCreateRejected;
-        case 33:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale;
-        case 34:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving;
-        case 35:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RelocationDataLost;
-        case 17:
-        default:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestFailed;
-    }
-}
 /** Builds the typed exception a Prepare waiter rejects with on an explicit Failed(53). */
 function relocationFailureException(response) {
-    return (0, framework_errors_internal_1.createInternalFrameworkException)(relocationFailureCodeKind(response.failureCode), `Relocation '${response.relocation.high}:${response.relocation.low}:` +
+    return (0, framework_errors_internal_1.createInternalFrameworkException)((0, framework_errors_internal_1.internalFrameworkErrorKindFromWireFailureCode)(response.failureCode) ??
+        framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestFailed, `Relocation '${response.relocation.high}:${response.relocation.low}:` +
         `${response.targetAttemptGeneration}' failed with wire failureCode ${response.failureCode}.`, true);
 }
 function controlAckKey(request) {
@@ -3950,7 +4082,7 @@ function queuedMessageU64(value, field) {
         throw new TypeError(`Relocation Actor Message Follow ${field} is invalid.`);
     }
     const result = BigInt(value);
-    if (result > 0xffffffffffffffffn) {
+    if (result > stream_wire_1.UINT64_MAX) {
         throw new TypeError(`Relocation Actor Message Follow ${field} is outside u64.`);
     }
     return result;
@@ -3970,6 +4102,14 @@ function toServiceTimer(value) {
         pendingTicks: value.pendingTicks
     };
 }
+const PREPARE_SIDEBAND_MAGIC = 'ZLNI';
+const PREPARE_SIDEBAND_VERSION = 1;
+const PREPARE_SIDEBAND_HEADER_BYTES = 11;
+const PREPARE_SIDEBAND_VERSION_OFFSET = 4;
+const PREPARE_SIDEBAND_KEY_LENGTH_OFFSET = 5;
+const PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET = 7;
+const ACTOR_SESSION_JOURNAL_VERSION = 1;
+const SERVICE_RELOCATION_REPLY_PACKET_NAME = 'zlink.relocation.reply';
 /**
  * NODE-INTERNAL Prepare sideband. Frame zero remains the exact canonical
  * command-40 schema record; each following ZLNI frame carries one sealed
@@ -3985,11 +4125,11 @@ function encodePrepareSideband(envelope) {
         if (key.byteLength === 0 || key.byteLength > 0xffff || payload.byteLength > 0xffff_ffff) {
             throw new TypeError('Bound-session relocation sideband is out of bounds.');
         }
-        const header = Buffer.allocUnsafe(11);
-        header.write('ZLNI', 0, 'ascii');
-        header[4] = 1;
-        header.writeUInt16BE(key.byteLength, 5);
-        header.writeUInt32BE(payload.byteLength, 7);
+        const header = Buffer.allocUnsafe(PREPARE_SIDEBAND_HEADER_BYTES);
+        header.write(PREPARE_SIDEBAND_MAGIC, 0, 'ascii');
+        header[PREPARE_SIDEBAND_VERSION_OFFSET] = PREPARE_SIDEBAND_VERSION;
+        header.writeUInt16BE(key.byteLength, PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+        header.writeUInt32BE(payload.byteLength, PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
         return Buffer.concat([header, key, payload]);
     });
 }
@@ -3998,20 +4138,27 @@ function decodePrepareSideband(frames) {
     const keys = new Set();
     for (const frame of frames) {
         const bytes = Buffer.from(frame);
-        if (bytes.byteLength < 11 ||
-            bytes.subarray(0, 4).toString('ascii') !== 'ZLNI' ||
-            bytes[4] !== 1) {
+        if (bytes.byteLength < PREPARE_SIDEBAND_HEADER_BYTES ||
+            bytes.subarray(0, PREPARE_SIDEBAND_VERSION_OFFSET).toString('ascii') !==
+                PREPARE_SIDEBAND_MAGIC ||
+            bytes[PREPARE_SIDEBAND_VERSION_OFFSET] !== PREPARE_SIDEBAND_VERSION) {
             return undefined;
         }
-        const keyLength = bytes.readUInt16BE(5);
-        const payloadLength = bytes.readUInt32BE(7);
-        if (11 + keyLength + payloadLength !== bytes.byteLength || keyLength === 0)
+        const keyLength = bytes.readUInt16BE(PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+        const payloadLength = bytes.readUInt32BE(PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
+        if (PREPARE_SIDEBAND_HEADER_BYTES + keyLength + payloadLength !== bytes.byteLength ||
+            keyLength === 0)
             return undefined;
-        const participantKey = bytes.subarray(11, 11 + keyLength).toString('utf8');
+        const participantKey = bytes
+            .subarray(PREPARE_SIDEBAND_HEADER_BYTES, PREPARE_SIDEBAND_HEADER_BYTES + keyLength)
+            .toString('utf8');
         if (keys.has(participantKey))
             return undefined;
         keys.add(participantKey);
-        result.push({ participantKey, payload: Buffer.from(bytes.subarray(11 + keyLength)) });
+        result.push({
+            participantKey,
+            payload: Buffer.from(bytes.subarray(PREPARE_SIDEBAND_HEADER_BYTES + keyLength))
+        });
     }
     return result;
 }
@@ -4037,12 +4184,15 @@ function encodeActorSession(target) {
     if (target === undefined)
         return Buffer.alloc(0);
     return Buffer.from(JSON.stringify({
-        version: 1,
+        version: ACTOR_SESSION_JOURNAL_VERSION,
         routerChannelId: target.routerChannelId,
         targetNodeRid: String(target.targetNodeRid),
         spotId: String(target.spotId),
         sessionNodeRid: target.sessionNodeRid === undefined ? undefined : String(target.sessionNodeRid),
         sessionRid: target.sessionRid === undefined ? undefined : String(target.sessionRid),
+        sessionOwnerNodeGeneration: target.sessionOwnerNodeGeneration?.toString(),
+        sessionOwnerId: target.sessionOwnerId,
+        sessionOwnerLeaseGeneration: target.sessionOwnerLeaseGeneration?.toString(),
         bindingGeneration: target.bindingGeneration?.toString(),
         previousAuthorityOwnerGeneration: target.previousAuthorityOwnerGeneration?.toString(),
         previousOwnerLeaseGeneration: target.previousOwnerLeaseGeneration?.toString(),
@@ -4067,9 +4217,11 @@ function encodeActorSession(target) {
     }), 'utf8');
 }
 function decodeActorSession(payload) {
+    if (payload.byteLength === 0)
+        return undefined;
     const value = JSON.parse(Buffer.from(payload).toString('utf8'));
     const optionalBigInt = (field) => typeof value[field] === 'string' ? BigInt(value[field]) : undefined;
-    if (value.version !== 1 ||
+    if (value.version !== ACTOR_SESSION_JOURNAL_VERSION ||
         typeof value.routerChannelId !== 'string' ||
         typeof value.targetNodeRid !== 'string' ||
         typeof value.spotId !== 'string') {
@@ -4084,6 +4236,13 @@ function decodeActorSession(payload) {
             ? { sessionNodeRid: value.sessionNodeRid }
             : {}),
         ...(typeof value.sessionRid === 'string' ? { sessionRid: value.sessionRid } : {}),
+        ...(optionalBigInt('sessionOwnerNodeGeneration') === undefined
+            ? {}
+            : { sessionOwnerNodeGeneration: optionalBigInt('sessionOwnerNodeGeneration') }),
+        ...(typeof value.sessionOwnerId === 'string' ? { sessionOwnerId: value.sessionOwnerId } : {}),
+        ...(optionalBigInt('sessionOwnerLeaseGeneration') === undefined
+            ? {}
+            : { sessionOwnerLeaseGeneration: optionalBigInt('sessionOwnerLeaseGeneration') }),
         ...(optionalBigInt('bindingGeneration') === undefined
             ? {}
             : { bindingGeneration: optionalBigInt('bindingGeneration') }),
@@ -4182,3 +4341,9 @@ function addCapacity(left, right) {
             })
     };
 }
+if ((0, state_lane_1.isStructuralGuardEnabled)()) {
+    const relocateActorJoin = ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin;
+    ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin = function (input) {
+        return (0, state_lane_1.trackDiagnosticCompletion)(relocateActorJoin.call(this, input), `relocation join actor:${input.state.actorId}`);
+    };
+}