@zlink-systems/framework 0.25.0 → 0.27.0

package/src/runtime/host/service-relocation-host-runtime.ts

@@ -1,47 +1,88 @@
+import { UINT64_MAX, ZlinkStreamContentType } from '@zlink-systems/stream-wire';
 import { randomBytes } from 'node:crypto';
-import { SubmitResult } from '../backend/runtime-values';
-import type {
-  RoutingId,
-  Type,
-  ZLinkActor,
-  ZLinkActorRelocationAdapter,
-  ZLinkMeshNodeDescriptor,
-  ZLinkSpot,
-  ZLinkSpotRelocationAdapter,
-  ZLinkInstanceSpot
-} from '../../contracts';
-import type {
-  ZLinkAuthorityKey,
-  ZLinkAuthorityScanCursor,
-  ZLinkAuthoritySnapshot,
-  ZLinkCapacityVector,
-  ZLinkLocationOwnerToken
-} from '../locations/internal-location-contracts';
 import {
+  type RoutingId,
+  type Type,
+  type ZLinkActor,
+  type ZLinkActorRelocationAdapter,
+  type ZLinkInstanceSpot,
+  type ZLinkMeshNodeDescriptor,
+  type ZLinkSpot,
+  type ZLinkSpotRelocationAdapter,
   ZLinkFrameworkErrorKind,
   ZLinkFrameworkException,
   ZLinkFrameworkRuntimeState,
   ZLinkObjectRole,
+  ZLinkSpotKind,
   ZLinkSpotRelocationCoordinationMode,
   ZLinkSpotRelocationReadyOutcome,
-  ZLinkSpotKind,
   ZLinkUserSpotExecutionMode
 } from '../../contracts';
+
+import type { ZLinkProviderResolver } from '../../contracts/Common/ZLinkProviderResolver';
 import { zlinkRuntimeDefaultLocationOptions } from '../../contracts/Locations/Options';
+import { ZLINK_PROVIDER_MAX_PAGE_SIZE } from '../../contracts/Locations/Stores';
+import type { ZLinkActivationAdmission } from '../activation-admission';
+import type { DefaultZLinkActorManager } from '../actors';
 import {
-  ZLinkFrameworkInternalErrorKind,
-  createInternalFrameworkException
-} from '../framework-errors-internal';
-import type { ZLinkDomainLocationStore as ZLinkLocationStore } from '../locations/domain-store-contract';
-import type { ZLinkTrackedInstanceAuthority } from '../locations/spot-location-claims';
-import type { ZLinkProviderResolver } from '../../contracts/Common/ZLinkProviderResolver';
-import type { ZLinkRuntimeEventPublisher, ZLinkRuntimeMetrics } from '../diagnostics';
-import type { ZLinkFrameworkRegistration } from '../configuration';
+  decodeRelocatingActorAuthorityIdentity,
+  rewriteActorAuthorityRoute
+} from '../actors/actor-authority-publication';
+import {
+  replayActorHandoffBacklog,
+  type ZLinkActorHandoffPacket,
+  type ZLinkActorHandoffResult
+} from '../actors/actor-handoff';
+import type { ZLinkActorJoinRelocation } from '../actors/actor-join-relocation';
+import {
+  ZLINK_REMOTE_ACTOR_SOURCE_LEAVE_TERMINAL,
+  decodeRemoteActorSourceLeaveTerminal
+} from '../actors/actor-remote-wire';
+import {
+  toFrameworkActorRef,
+  type ZLinkActorRuntimeState,
+  type ZLinkRemoteBoundSessionTarget
+} from '../actors/actor-runtime-state';
 import type { ZLinkBackendMeshNode, ZLinkMeshCompletionTable } from '../backend';
-import { ReceiveKind, type ReceiveRecord } from '../foundation/service-runtime-contracts';
-import { decodeRoutingId, encodeRoutingIdStorageHex, routingIdsEqual } from '../routing-id';
-import { ServiceWireProtocolError } from '../foundation/service-wire-m6a-codec';
-import type { ServiceSpotMessageFollowSeal } from '../foundation/service-stateful-runtime';
+import { RequestResult, SubmitResult } from '../backend/runtime-values';
+import type { ZLinkFrameworkRegistration } from '../configuration';
+import {
+  type ZLinkRuntimeEventPublisher,
+  type ZLinkRuntimeMetrics,
+  isRelocationDebugEnabled,
+  relocationDebug
+} from '../diagnostics';
+
+import { METRIC_NAMES, MILLISECONDS_PER_SECOND } from '../diagnostics/runtime-metrics';
+import { isStructuralGuardEnabled, trackDiagnosticCompletion } from '../execution/state-lane';
+import {
+  RECREATE_RELOCATION_CONTENT_TYPE,
+  SNAPSHOT_RELOCATION_CONTENT_TYPE,
+  decodeCanonicalActorJoinRecoverySavedWork,
+  encodeCanonicalActorJoinRecoverySavedWork,
+  type CanonicalActorJoinRecovery
+} from '../foundation/actor-join-recovery-codec';
+import { OPERATION_IDENTITY_BYTES } from '../foundation/operation-identity';
+import { rewriteServiceAuthorityRoute } from '../foundation/service-authority-payload-codec';
+import { ServiceMaintenanceRuntime } from '../foundation/service-maintenance-runtime';
+import {
+  ServiceRelocationAggregateCommitter,
+  type ServicePreparedRelocationAggregate,
+  type ServiceRelocationAggregatePlan
+} from '../foundation/service-relocation-aggregate-committer';
+import {
+  ServiceRelocationAuthorityError,
+  ServiceRelocationPostCommitError
+} from '../foundation/service-relocation-coordinator';
+import {
+  ServiceRelocationObjectCaptureOwner,
+  ServiceRelocationObjectRestoreOwner,
+  type ServiceCapturedObjectRelocation,
+  type ServiceObjectRelocationStaging,
+  type ServiceRelocationCaptureUnit,
+  type ServiceRelocationHiddenObject,
+  type ServiceRelocationTargetObjectPort
+} from '../foundation/service-relocation-object-owner';
 import {
   ServiceRelocationAuthorityPayloadCodec,
   crc32c,
@@ -60,114 +101,108 @@ import {
   type ServiceRelocationTimer
 } from '../foundation/service-relocation-runtime';
 import {
-  ZLinkRelocationInFlightBudget,
-  ZLinkRelocationPayloadAssembly,
-  effectiveActorJoinChunkLimitBytes,
-  effectiveRelocationBudgetBytes,
-  planRelocationChunks,
-  relocationChunkAt
-} from './relocation-direct-transfer';
-import {
-  captureRelocationAdapterState,
-  restoreRelocationAdapterState,
-  type ZLinkRelocationStateAdapterLike
-} from './relocation-state-adapter';
-import { ServiceRelocationPostCommitError } from '../foundation/service-relocation-coordinator';
-import { ServiceMaintenanceRuntime } from '../foundation/service-maintenance-runtime';
-import {
-  ServiceRelocationObjectCaptureOwner,
-  ServiceRelocationObjectRestoreOwner,
-  type ServiceCapturedObjectRelocation,
-  type ServiceObjectRelocationStaging,
-  type ServiceRelocationCaptureUnit,
-  type ServiceRelocationHiddenObject,
-  type ServiceRelocationTargetObjectPort
-} from '../foundation/service-relocation-object-owner';
-import {
-  ServiceRelocationAggregateCommitter,
-  type ServicePreparedRelocationAggregate,
-  type ServiceRelocationAggregatePlan
-} from '../foundation/service-relocation-aggregate-committer';
-import { createProviderInstance } from '../spots/spot-provider';
-import type { DefaultZLinkSpotManager, ZLinkSpotNodeRuntimeManager } from '../spots';
-import type { ZLinkSpotActivation } from '../spots/spot-activation-state';
-import type { DefaultZLinkActorManager } from '../actors';
-import type { ZLinkDeferredJoinAcceptedRoot } from '../actors/deferred-join-accepted-journal';
-import {
-  toFrameworkActorRef,
-  type ZLinkActorRuntimeState,
-  type ZLinkRemoteBoundSessionTarget
-} from '../actors/actor-runtime-state';
-import {
-  replayActorHandoffBacklog,
-  type ZLinkActorHandoffPacket,
-  type ZLinkActorHandoffResult
-} from '../actors/actor-handoff';
-import { decodeHandoffBacklog } from '../spots/spot-remote-codec';
-import {
-  decodeRelocatingActorAuthorityIdentity,
-  rewriteActorAuthorityRoute
-} from '../actors/actor-authority-publication';
-import { rewriteServiceAuthorityRoute } from '../foundation/service-authority-payload-codec';
-import { committedActorOwnerFence, type ZLinkActorTransferRuntime } from './actor-transfer-runtime';
-import { decodeAuthorityKey, encodeAuthorityKey } from '../locations/authority-key-codec';
-import {
-  decodeServiceRelocationControlRequest,
-  decodeServiceRelocationControlResponse,
-  encodeServiceRelocationControlRequest,
-  encodeServiceRelocationControlResponse,
-  type ZLinkServiceRelocationControlRequest,
-  type ZLinkServiceRelocationControlResponse
-} from './service-relocation-control';
+  MeshPeerRuntimeState,
+  ReceiveKind,
+  type ReceiveRecord
+} from '../foundation/service-runtime-contracts';
+import type { ServiceSpotMessageFollowSeal } from '../foundation/service-stateful-runtime';
 import {
+  M6bServiceWireCommand,
   decodeMaintenanceReplyRelay,
   decodeMaintenanceReplyRelayAck,
+  decodeServiceWireFrozenRecord,
   decodeSessionRelocationRoute,
   decodeSessionRelocationSeal,
   decodeSessionRelocationSealed,
   encodeMaintenanceReplyRelay,
   encodeMaintenanceReplyRelayAck,
+  encodeServiceWireFrozenActorApplicationRecord,
   encodeSessionRelocationRoute,
   encodeSessionRelocationSeal,
   encodeSessionRelocationSealed,
   serviceSessionRelocationIdentityKey,
-  decodeServiceWireFrozenRecord,
-  encodeServiceWireFrozenActorApplicationRecord,
-  M6bServiceWireCommand,
-  type ServiceMaintenanceReplyRelay,
-  type ServiceMaintenanceReplyRelayAck,
   type ServiceMaintenanceRelocationControl,
   type ServiceMaintenanceRelocationCutover,
   type ServiceMaintenanceRelocationData,
   type ServiceMaintenanceRelocationFailed,
-  type ServiceMaintenanceRelocationReady,
   type ServiceMaintenanceRelocationPrepare,
+  type ServiceMaintenanceRelocationReady,
   type ServiceMaintenanceRelocationState,
+  type ServiceMaintenanceReplyRelay,
+  type ServiceMaintenanceReplyRelayAck,
   type ServiceSessionRelocationRoute,
   type ServiceSessionRelocationSeal,
   type ServiceSessionRelocationSealed,
   type ServiceWireOperationId,
-  type ServiceWireRequestSourceFence,
-  type ServiceWireRelocationTarget,
   type ServiceWireRelocationCoordinatorFence,
-  type ServiceWireRelocationObject
+  type ServiceWireRelocationObject,
+  type ServiceWireRelocationTarget,
+  type ServiceWireRequestSourceFence
 } from '../foundation/service-stateful-wire-codec';
 import { ServiceWireFrameworkErrorCode } from '../foundation/service-wire-constants.generated';
+import { ServiceWireProtocolError } from '../foundation/service-wire-m6a-codec';
+import {
+  ZLinkFrameworkInternalErrorKind,
+  createInternalFrameworkException,
+  frameworkRelocationFailureCode,
+  internalFrameworkErrorKindFromWireFailureCode
+} from '../framework-errors-internal';
+import { decodeAuthorityKey, encodeAuthorityKey } from '../locations/authority-key-codec';
+import { isIndeterminateLocationStoreFailure } from '../locations/location-store-failure';
+import type { ZLinkDomainLocationStore as ZLinkLocationStore } from '../locations/domain-store-contract';
+import type {
+  ZLinkAuthorityKey,
+  ZLinkAuthorityScanCursor,
+  ZLinkAuthoritySnapshot,
+  ZLinkCapacityVector,
+  ZLinkLocationOwnerToken
+} from '../locations/internal-location-contracts';
+import type { ZLinkTrackedInstanceAuthority } from '../locations/spot-location-claims';
+import { decodeRoutingId, encodeRoutingIdStorageHex, routingIdsEqual } from '../routing-id';
+import type { DefaultZLinkSpotManager, ZLinkSpotNodeRuntimeManager } from '../spots';
+import type { ZLinkSpotActivation } from '../spots/spot-activation-state';
+import { createProviderInstance } from '../spots/spot-provider';
+import { decodeHandoffBacklog } from '../spots/spot-remote-codec';
+import { committedActorOwnerFence, type ZLinkActorTransferRuntime } from './actor-transfer-runtime';
 import { BoundedReplayMap } from './bounded-replay-map';
-import type { ZLinkActorJoinRelocation } from '../actors/actor-join-relocation';
+import {
+  ZLinkRelocationInFlightBudget,
+  ZLinkRelocationPayloadAssembly,
+  effectiveActorJoinChunkLimitBytes,
+  effectiveRelocationBudgetBytes,
+  planRelocationChunks,
+  relocationChunkAt
+} from './relocation-direct-transfer';
 import {
   ZLINK_INTERNAL_RELOCATION_INTEGRITY_FAULT_GATE,
   type ZLinkInternalRelocationIntegrityFaultGate
 } from './relocation-integrity-fault-gate';
 import {
-  decodeRemoteActorSourceLeaveTerminal,
-  ZLINK_REMOTE_ACTOR_SOURCE_LEAVE_TERMINAL
-} from '../actors/actor-remote-wire';
+  captureRelocationAdapterState,
+  restoreRelocationAdapterState,
+  type ZLinkRelocationStateAdapterLike
+} from './relocation-state-adapter';
 import {
-  decodeCanonicalActorJoinRecoverySavedWork,
-  encodeCanonicalActorJoinRecoverySavedWork,
-  type CanonicalActorJoinRecovery
-} from '../foundation/actor-join-recovery-codec';
+  decodeServiceRelocationControlRequest,
+  decodeServiceRelocationControlResponse,
+  encodeServiceRelocationControlRequest,
+  encodeServiceRelocationControlResponse,
+  type ZLinkServiceRelocationControlRequest,
+  type ZLinkServiceRelocationControlResponse
+} from './service-relocation-control';
+const RELOCATION_ATTEMPT_TIMEOUT_MS = 250;
+
+const RELOCATION_AUTHORITY_RETRY_DELAY_MS = 25;
+
+const RELOCATION_MAX_SEND_ATTEMPTS = 120;
+
+const RELOCATION_AUTHORITY_POLL_INTERVAL_MS = 10;
+
+const RELOCATION_RESEND_DELAY_MS = 250;
+
+const RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+
+const RELOCATION_OPERATION_TIMEOUT_MS = 30_000;
 
 export class ZLinkRelocationStateIncompatibleError extends Error {
   constructor(message: string) {
@@ -186,6 +221,7 @@ interface ZLinkHostRelocationOptions {
   readonly providerResolver?: ZLinkProviderResolver;
   readonly locationStore: () => ZLinkLocationStore | undefined;
   readonly currentOwner: () => ZLinkLocationOwnerToken | undefined;
+  readonly targetAdmissionSealed?: () => boolean;
   readonly liveDescriptors: (
     meshName: string,
     signal?: AbortSignal
@@ -210,6 +246,7 @@ interface ZLinkHostRelocationOptions {
   readonly reconcileStatefulAuthorityRoutes?: (signal?: AbortSignal) => Promise<void>;
   readonly runtimeEventPublisher?: ZLinkRuntimeEventPublisher;
   readonly metrics?: ZLinkRuntimeMetrics;
+  readonly activationAdmission?: ZLinkActivationAdmission;
 }
 
 interface RelocationTargetRequirement {
@@ -241,6 +278,8 @@ interface LocalStage {
   readonly boundaryRelay: ServiceMaintenanceRelocationData[];
   fallback?: ReturnType<typeof setTimeout>;
   finalize?: Promise<void>;
+  /** The Restore's activation admission (MeshNode §5.1); held until target commit or abort. */
+  readonly releaseActivation: () => void;
 }
 
 interface TargetPayloadAssembly {
@@ -253,11 +292,11 @@ interface TargetPayloadAssembly {
 interface SourceCutoverWindow {
   readonly meshName: string;
   readonly targetNodeRid: RoutingId;
-  /** Boundary batch frames plus the cutover frame, retained for retransmission. */
+  /** Boundary batch frames plus the cutover frame, retained until authority settlement. */
   frames?: readonly Buffer[];
+  /** A failed submit or a lost target connection requires the whole batch again. */
+  resendPending: boolean;
   readonly cutoverSubmittedAtMs: number;
-  windowTimer?: ReturnType<typeof setTimeout>;
-  retryTimer?: ReturnType<typeof setTimeout>;
   followTimer?: ReturnType<typeof setTimeout>;
   windowClosed: boolean;
   followExpired: boolean;
@@ -272,7 +311,6 @@ interface TargetRelocationOffer {
   readonly prepareFingerprint: string;
   readonly authenticatedSourceNodeRid: string;
   readonly envelope: ServiceRelocationEnvelope;
-  readonly restoreDeadlineAtMs: number;
   readonly reservation: TargetRelocationReservation;
 }
 
@@ -302,7 +340,7 @@ interface SourceActorJoinProfile {
     Parameters<ZLinkActorJoinRelocation['relocateActorJoin']>[0]['canonicalRecovery']
   >;
   readonly ready: Promise<void>;
-  readonly resolveReady: () => void;
+  readonly resolveReady: (failure?: ServiceRelocationPostCommitError) => void;
 }
 
 interface PendingRelocationReplyRelay {
@@ -361,8 +399,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
    * Terminal restore failures (assembly/checksum/factory/restore error): the
    * target already sent relocationFailed (command 53) once. An exact-identity
    * Prepare resend replays the stored response rather than retrying the
-   * restore; a different exact identity reusing the same RelocationId+attempt
-   * key supersedes the stale entry (spec 28 §3, §9).
+   * restore. A different exact identity never changes this entry (spec 28 §4.3).
    */
   private readonly targetReadyFailures = new Map<
     string,
@@ -419,9 +456,12 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       );
     }
     this.reserveExactRelocationId(input.relocationId);
-    let resolveReady!: () => void;
-    const ready = new Promise<void>((resolve) => {
-      resolveReady = resolve;
+    let resolveReady!: (failure?: ServiceRelocationPostCommitError) => void;
+    const ready = new Promise<void>((resolve, reject) => {
+      resolveReady = (failure) => {
+        if (failure === undefined) resolve();
+        else reject(failure.cause);
+      };
     });
     this.sourceActorJoinProfiles.set(input.relocationId, {
       actor: input.actor,
@@ -433,8 +473,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       relocationContentType:
         this.actorRegistration(input.state.meshName ?? input.meshName, input.state.actorType ?? '')
           .relocation.kind === 'snapshot'
-          ? 'application/vnd.zlink.actor-relocation.snapshot'
-          : 'application/vnd.zlink.actor-relocation.recreate',
+          ? SNAPSHOT_RELOCATION_CONTENT_TYPE
+          : RECREATE_RELOCATION_CONTENT_TYPE,
       completionOperationId: input.completionOperationId,
       canonicalRecovery: input.canonicalRecovery,
       ready,
@@ -464,8 +504,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       );
       resolveReady();
     } catch (error) {
-      this.sourceActorJoinProfiles.delete(input.relocationId);
-      throw error;
+      if (error instanceof ServiceRelocationPostCommitError) {
+        resolveReady(error);
+        this.completeActorJoinSourceCleanup(input.state.actorId);
+      } else {
+        this.sourceActorJoinProfiles.delete(input.relocationId);
+        throw error;
+      }
     }
     return {
       actorRef: {
@@ -481,17 +526,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   async dispose(): Promise<void> {
     this.disposed = true;
     const errors: unknown[] = [];
-    for (const stage of this.targetStages.values()) {
-      if (stage.fallback !== undefined) clearTimeout(stage.fallback);
-      try {
-        if (stage.finalize !== undefined) {
-          await stage.finalize;
-        } else if (stage.phase === 'ready') {
-          await this.abortTargetStage(stage);
-        }
-      } catch (error) {
-        errors.push(error);
-      }
+    try {
+      await this.drainTargetAttempts();
+    } catch (error) {
+      errors.push(error);
     }
     this.targetStages.clear();
     this.terminalTargets.clear();
@@ -502,8 +540,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     this.targetReadyFailures.clear();
     this.targetReadyResponses.clear();
     for (const window of this.sourceCutoverWindows.values()) {
-      if (window.windowTimer !== undefined) clearTimeout(window.windowTimer);
-      if (window.retryTimer !== undefined) clearTimeout(window.retryTimer);
       if (window.followTimer !== undefined) clearTimeout(window.followTimer);
     }
     this.sourceCutoverWindows.clear();
@@ -531,24 +567,78 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (errors.length > 1) throw new AggregateError(errors, 'Relocation runtime stop failed.');
   }
 
+  /** Host shutdown waits for the existing attempt terminal before releasing its lease. */
+  async drainTargetAttempts(): Promise<void> {
+    const results = await Promise.allSettled(
+      [...this.targetStages.entries()].map(([stagingId, stage]) => {
+        if (stage.fallback !== undefined) clearTimeout(stage.fallback);
+        return stage.lane.finally(() => {
+          if (stage.phase === 'failed') return stage.finalize;
+          if (this.targetStageSealed(stage)) {
+            const terminal = this.discardTargetStage(stagingId, stage);
+            stage.finalize = terminal;
+            return terminal;
+          }
+          return this.beginTargetFinalize(
+            stage.offer.reservation.prepared.plan.targetDescriptor.meshName,
+            stagingId,
+            stage
+          );
+        });
+      })
+    );
+    const errors = results.flatMap((result) =>
+      result.status === 'rejected' ? [result.reason as unknown] : []
+    );
+    if (errors.length === 1) throw errors[0];
+    if (errors.length > 1) throw new AggregateError(errors, 'Relocation target drain failed.');
+  }
+
+  /** Spec 28 §4.4: the target owner alone orders shutdown seal and verified cutover. */
+  private targetStageSealed(stage: LocalStage): boolean {
+    return (
+      !stage.cutoverReceived && (this.disposed || this.options.targetAdmissionSealed?.() === true)
+    );
+  }
+
   completeActorJoinSourceCleanup(actorId: string): void {
     for (const [relocationId, profile] of this.sourceActorJoinProfiles) {
       if (profile.state.actorId !== actorId) continue;
       this.sourceActorJoinProfiles.delete(relocationId);
       this.terminalActorJoinSourceLeaves.remember(relocationId, actorId);
-      void profile.ready
-        .then(async () => {
-          await this.options.actorTransfer.completeRelocationSourceLeave(
-            profile.actor,
-            profile.sourceSpotId
-          );
-          await this.options
-            .actorManager()
-            ?.completeRelocationSource(actorId, profile.sourceActorRef);
-        })
-        .catch((error) => {
-          console.error('[zlink.runtime.relocation.source_cleanup_failed]', error);
-        });
+      void this.finalizeActorJoinSource(profile);
+    }
+  }
+
+  private async finalizeActorJoinSource(profile: SourceActorJoinProfile): Promise<void> {
+    const failures: unknown[] = [];
+    try {
+      await profile.ready;
+    } catch (error) {
+      failures.push(error);
+    }
+    try {
+      await this.options.actorTransfer.completeRelocationSourceLeave(
+        profile.actor,
+        profile.sourceSpotId
+      );
+    } catch (error) {
+      failures.push(error);
+    }
+    try {
+      await this.options
+        .actorManager()
+        ?.completeRelocationSource(profile.state.actorId, profile.sourceActorRef);
+    } catch (error) {
+      failures.push(error);
+    }
+    if (failures.length > 0) {
+      console.error(
+        '[zlink.runtime.relocation.source_cleanup_failed]',
+        failures.length === 1
+          ? failures[0]
+          : new AggregateError(failures, 'Actor source retirement failed.')
+      );
     }
   }
 
@@ -661,22 +751,59 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       publishState: () => undefined,
       forceStop: () => undefined
     });
+    const started: Array<Promise<void>> = [];
     for (const unit of work) {
       maintenance.enqueue({
         id: unit.id,
         ready: () => true,
-        relocate: unit.relocate
+        relocate: (relocationSignal) => {
+          const run = unit.relocate(relocationSignal);
+          if (isStructuralGuardEnabled()) {
+            trackDiagnosticCompletion(run, `relocation ${unit.id}`);
+          }
+          started.push(run);
+          return run;
+        }
       });
     }
     const operationSignal = signal ?? new AbortController().signal;
-    const deadlineMs = signal === undefined ? 30_000 : 24 * 60 * 60 * 1000;
-    const result = await raceAbort(
-      maintenance.start('retire', deadlineMs, stopStartingSignal, operationSignal),
-      operationSignal
+    const deadlineMs =
+      signal === undefined
+        ? RELOCATION_OPERATION_TIMEOUT_MS
+        : RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS;
+    let failure: unknown;
+    try {
+      const result = await raceAbort(
+        maintenance.start('retire', deadlineMs, stopStartingSignal, operationSignal),
+        operationSignal
+      );
+      if (result.state === 'completed') return;
+      failure = result.terminalError ?? new Error(`Host relocation ended in '${result.state}'.`);
+    } catch (error) {
+      failure = error;
+    }
+    // The host result follows the settled authority of every started unit
+    // (spec 30 §13): a unit completes only after its target commit is
+    // confirmed, so a failure beside a completed unit leaves units on both
+    // sides.
+    const settled = await Promise.allSettled(started);
+    const targetSide = settled.filter(
+      (value) =>
+        value.status === 'fulfilled' || value.reason instanceof ServiceRelocationPostCommitError
+    ).length;
+    const authorityError = settled.find(
+      (value): value is PromiseRejectedResult =>
+        value.status === 'rejected' && value.reason instanceof ServiceRelocationAuthorityError
     );
-    if (result.state !== 'completed') {
-      throw result.terminalError ?? new Error(`Host relocation ended in '${result.state}'.`);
+    if (authorityError !== undefined) throw authorityError.reason;
+    // A unit that never started also stays on the source.
+    if (targetSide > 0 && targetSide < work.length) {
+      throw new ServiceRelocationAuthorityError(
+        'Relocation units settled on both the source and the target.',
+        { cause: failure }
+      );
     }
+    throw failure;
   }
 
   async tryHandleControl(
@@ -764,47 +891,57 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       }
       const operationKey = relocationStagingId(request);
       const fingerprint = stringifyWire(request);
+      const readyFailure = this.targetReadyFailures.get(operationKey);
+      const readyPending = this.targetReadyResponses.get(operationKey);
+      let operation = this.targetPrepareOperations.get(operationKey);
+      const acceptedFingerprint =
+        readyFailure?.fingerprint ??
+        readyPending?.fingerprint ??
+        operation?.fingerprint ??
+        this.targetAssemblies.get(operationKey)?.fingerprint ??
+        this.targetStages.get(operationKey)?.offer.prepareFingerprint ??
+        this.terminalTargets.get(operationKey);
+      if (request.sourceNodeRid !== String(record.sourceNodeRid)) return true;
+      if (acceptedFingerprint !== undefined && acceptedFingerprint !== fingerprint) {
+        if (!samePrepareIdentity(acceptedFingerprint, request)) return true;
+        this.replyPrepare(
+          record,
+          relocationFailed(request, ServiceWireFrameworkErrorCode.relocationDataLost)
+        );
+        return true;
+      }
       // A restore that failed outright is terminal: the source observes the
       // same explicit relocationFailed on every identical Prepare resend
-      // rather than a silent stall. A different exact identity reusing the
-      // same RelocationId+attempt key supersedes the stale failure — the
-      // newer attempt wins (spec 28 §3).
-      const readyFailure = this.targetReadyFailures.get(operationKey);
+      // rather than a silent stall.
       if (readyFailure !== undefined) {
-        if (readyFailure.fingerprint === fingerprint) {
-          this.replyPrepare(record, readyFailure.response);
-          return true;
-        }
-        this.targetReadyFailures.delete(operationKey);
+        this.replyPrepare(record, readyFailure.response);
+        return true;
       }
       // Spec 28: an exact-identity Restore resend against staging that
       // already restored successfully reuses that staging — it re-submits
       // READY rather than restarting the restore.
-      const readyPending = this.targetReadyResponses.get(operationKey);
       if (readyPending !== undefined) {
-        if (readyPending.fingerprint !== fingerprint) {
-          throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-        }
         this.submitTargetReady(meshName, operationKey, record, readyPending.response);
         return true;
       }
-      let operation = this.targetPrepareOperations.get(operationKey);
-      if (operation !== undefined && operation.fingerprint !== fingerprint) {
-        throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-      }
       if (operation === undefined) {
         // The prepare turn must not block the ordered dispatch lane: the
         // payload chunks that complete this operation arrive as later records
         // on the same connection. Register the assembly synchronously, then
         // finish the restore and the Ready reply asynchronously.
-        this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
-        const promise = this.handlePrepareControl(
-          meshName,
-          operationKey,
-          request,
-          record.sourceNodeRid,
-          signal
-        );
+        let promise: Promise<ServiceMaintenanceRelocationReady>;
+        try {
+          this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
+          promise = this.handlePrepareControl(
+            meshName,
+            operationKey,
+            request,
+            record.sourceNodeRid,
+            signal
+          );
+        } catch (error) {
+          promise = Promise.reject(error);
+        }
         operation = { fingerprint, promise };
         this.targetPrepareOperations.set(operationKey, operation);
         void promise
@@ -838,10 +975,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       // restore or staging): this is terminal. Send relocationFailed
       // (command 53) once and remember it so an identical Prepare resend
       // replays the same response instead of retrying the restore.
-      const failed = relocationFailed(
-        request,
-        relocationFailedFailureCode(error, request.object.kind)
-      );
+      const failed = relocationFailed(request, relocationFailedFailureCode(error));
       this.targetReadyFailures.set(operationKey, {
         fingerprint: stringifyWire(request),
         response: failed
@@ -935,7 +1069,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       String(sourceNodeRid) !== pending.authenticatedSourceNodeRid ||
       request.senderRole !== 'source' ||
       !sameCoordinator(request.coordinator, pending.prepare.coordinator) ||
-      stringifyWire(request.object) !== stringifyWire(pending.prepare.object)
+      !sameRelocationObject(request.object, pending.prepare.object)
     ) {
       // Spec 28 §4.3 — a chunk with a different exact identity is never
       // attached to an in-progress assembly; it is discarded.
@@ -959,14 +1093,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   ): TargetPayloadAssembly {
     const existing = this.targetAssemblies.get(operationKey);
     if (existing !== undefined) {
-      if (existing.fingerprint !== stringifyWire(request)) {
-        // Same exact identity with a different declared length or checksum is
-        // an explicit conflict failure; the existing assembly is neither
-        // reused nor overwritten (spec 28 §4.3).
-        throw existing.assembly.fail(
-          `Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`
-        );
-      }
       return existing;
     }
     const pending: TargetPayloadAssembly = {
@@ -981,15 +1107,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     };
     this.targetAssemblies.set(operationKey, pending);
     if (this.relocationIntegrityFaultGate()?.consumeIdentityConflict() === true) {
-      // Route a same-identity, different-manifest delivery through the normal
-      // conflict branch so existing staging is neither reused nor overwritten.
-      return this.registerTargetAssembly(
-        operationKey,
-        {
-          ...request,
-          payloadChecksumCrc32c: request.payloadChecksumCrc32c ^ 1
-        },
-        authenticatedSourceNodeRid
+      throw new ServiceRelocationDataLostError(
+        pending.assembly.fail(
+          `Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`
+        ).message
       );
     }
     return pending;
@@ -1167,7 +1288,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           return;
         }
         if (this.pendingSessionRelocations.get(key) === pending) {
-          pending.retryTimer = setTimeout(() => void send(), 250);
+          pending.retryTimer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
         }
       } catch (error) {
         pending.reject(
@@ -1385,6 +1506,28 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     target: ZLinkMeshNodeDescriptor | undefined,
     targetApplicationVersion: bigint | undefined,
     signal?: AbortSignal
+  ): Promise<void> {
+    await activation.serial.executeControlLifecycleOperation(() =>
+      this.relocateSpotAggregateCore(
+        meshName,
+        activation,
+        kind,
+        actorStates,
+        target,
+        targetApplicationVersion,
+        signal
+      )
+    );
+  }
+
+  private async relocateSpotAggregateCore(
+    meshName: string,
+    activation: ZLinkSpotActivation,
+    kind: 'user_spot' | 'instance_spot',
+    actorStates: readonly ZLinkActorRuntimeState[],
+    target: ZLinkMeshNodeDescriptor | undefined,
+    targetApplicationVersion: bigint | undefined,
+    signal?: AbortSignal
   ): Promise<void> {
     const store = this.requireLocationStore();
     const spotKey = encodeAuthorityKey(kind, String(activation.spotId));
@@ -1441,12 +1584,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       objectGeneration: spotAuthority.objectGeneration,
       authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
       seal: async (captureSignal) => {
-        interruptionStartedAt = performance.now();
-        spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
-        // captureRelocation seals synchronously before its first await. Invoke
-        // it in the same event-loop turn as the wire ingress seal so no
-        // accepted direct message can enter between the two boundaries.
-        const spotCaptureOperation = activation.captureRelocation(captureSignal);
+        const { spotCaptureOperation } = await this.afterSpotCloseDecision(
+          meshName,
+          activation.spotId,
+          () => {
+            interruptionStartedAt = performance.now();
+            spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
+            // Both seals run in the same event-loop turn after the Close decision.
+            return { spotCaptureOperation: activation.captureRelocation(captureSignal) };
+          }
+        );
         const preparedSessions = Promise.all(
           actorStates.map(async (state) => ({
             state,
@@ -1477,47 +1624,72 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       captureApplicationState: (captureSignal) =>
         this.captureApplication(spotRegistration.relocation, activation.spot, captureSignal),
       commitSeal: async () => {
-        if (!spotSealCommitted) {
-          if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
-            throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+        const failures: unknown[] = [];
+        try {
+          if (!spotSealCommitted) {
+            if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
+              throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+            }
+            spotSealCommitted = true;
           }
-          spotSealCommitted = true;
-        }
-        if (spotMessageFollowSeal !== undefined) {
-          await this.commitSpotMessageFollow(
-            meshName,
-            spotMessageFollowSeal,
-            spotKey,
-            activation,
-            target
-          );
+          if (spotMessageFollowSeal !== undefined) {
+            await this.commitSpotMessageFollow(
+              meshName,
+              spotMessageFollowSeal,
+              spotKey,
+              activation,
+              target
+            );
+          }
+        } catch (error) {
+          failures.push(error);
         }
         for (const session of sessions) {
-          const committedAuthority = await requireAuthority(
-            this.requireLocationStore(),
-            encodeAuthorityKey('actor', session.state.actorId)
-          );
-          const targetActorRef = {
-            actorId: session.state.actorId,
-            objectGeneration: actorAuthorities.get(session.state.actorId)!.objectGeneration,
-            meshName,
-            nodeRid: target.rid
-          };
-          await session.prepared.commit(
-            {
-              routerChannelId: meshName,
-              targetNodeRid: target.rid,
-              spotId: activation.spotId,
-              spotKind: kind === 'user_spot' ? ZLinkSpotKind.User : ZLinkSpotKind.Instance,
-              authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-            } as never,
-            targetActorRef,
-            committedActorOwnerFence(session.state.actorId, targetActorRef, committedAuthority)
-          );
-          activation.commitActorDeparture(session.state.actorId);
-          await this.requireActorManager().completeRelocationSource(session.state.actorId);
+          try {
+            const committedAuthority = await requireAuthority(
+              this.requireLocationStore(),
+              encodeAuthorityKey('actor', session.state.actorId)
+            );
+            const targetActorRef = {
+              actorId: session.state.actorId,
+              objectGeneration: actorAuthorities.get(session.state.actorId)!.objectGeneration,
+              meshName,
+              nodeRid: target.rid
+            };
+            await session.prepared.commit(
+              {
+                routerChannelId: meshName,
+                targetNodeRid: target.rid,
+                spotId: activation.spotId,
+                spotKind: kind === 'user_spot' ? ZLinkSpotKind.User : ZLinkSpotKind.Instance,
+                authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+              } as never,
+              targetActorRef,
+              committedActorOwnerFence(session.state.actorId, targetActorRef, committedAuthority)
+            );
+          } catch (error) {
+            failures.push(error);
+          }
+          try {
+            activation.commitActorDeparture(session.state.actorId);
+          } catch (error) {
+            failures.push(error);
+          }
+          try {
+            await this.requireActorManager().completeRelocationSource(session.state.actorId);
+          } catch (error) {
+            failures.push(error);
+          }
         }
-        await this.requireSpotManager().completeRelocationSource(activation);
+        try {
+          await this.requireSpotManager().completeRelocationSource(activation);
+        } catch (error) {
+          failures.push(error);
+        }
+        if (failures.length > 0)
+          throw failures.length === 1
+            ? failures[0]
+            : new AggregateError(failures, 'Spot source retirement failed.');
       },
       abortSeal: async () => {
         const failures: unknown[] = [];
@@ -1623,7 +1795,11 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       );
     } catch (error) {
       outcome = 'failed';
-      if (readinessBoundaryConsumed && !(error instanceof ServiceRelocationPostCommitError)) {
+      if (
+        readinessBoundaryConsumed &&
+        !(error instanceof ServiceRelocationPostCommitError) &&
+        !(error instanceof ServiceRelocationAuthorityError)
+      ) {
         await activation
           .completeConsumedRelocationBoundary(ZLinkSpotRelocationReadyOutcome.Continued)
           .catch(() => undefined);
@@ -1659,7 +1835,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes?: number
   ): Promise<void> {
-    relocationDebug('standalone_actor.begin', { actorId: state.actorId });
+    if (isRelocationDebugEnabled()) {
+      relocationDebug('standalone_actor.begin', { actorId: state.actorId });
+    }
     const authority = await requireAuthority(
       this.requireLocationStore(),
       encodeAuthorityKey('actor', state.actorId),
@@ -1716,12 +1894,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     };
     let outcome = 'completed';
     try {
-      relocationDebug('standalone_actor.wait_budget', {
-        actorId: state.actorId,
-        targetRid: String(target.rid)
-      });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('standalone_actor.wait_budget', {
+          actorId: state.actorId,
+          targetRid: String(target.rid)
+        });
+      }
       await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
-      relocationDebug('standalone_actor.capture_begin', { actorId: state.actorId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('standalone_actor.capture_begin', { actorId: state.actorId });
+      }
       const captured = await new ServiceRelocationObjectCaptureOwner().captureStandaloneActor(
         aggregateId,
         1n,
@@ -1729,7 +1911,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         membership,
         signal
       );
-      relocationDebug('standalone_actor.capture_complete', { actorId: state.actorId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('standalone_actor.capture_complete', { actorId: state.actorId });
+      }
       await this.runCoordinator(
         meshName,
         target,
@@ -1763,6 +1947,24 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     target: ZLinkMeshNodeDescriptor | undefined,
     targetApplicationVersion: bigint | undefined,
     signal?: AbortSignal
+  ): Promise<void> {
+    await activation.serial.executeControlLifecycleOperation(() =>
+      this.relocatePerActorSpotShellCore(
+        meshName,
+        activation,
+        target,
+        targetApplicationVersion,
+        signal
+      )
+    );
+  }
+
+  private async relocatePerActorSpotShellCore(
+    meshName: string,
+    activation: ZLinkSpotActivation,
+    target: ZLinkMeshNodeDescriptor | undefined,
+    targetApplicationVersion: bigint | undefined,
+    signal?: AbortSignal
   ): Promise<void> {
     const spotKey = encodeAuthorityKey('user_spot', String(activation.spotId));
     const spotAuthority = await requireAuthority(this.requireLocationStore(), spotKey, signal);
@@ -1796,9 +1998,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       objectGeneration: spotAuthority.objectGeneration,
       authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
       seal: async (captureSignal) => {
-        interruptionStartedAt = performance.now();
-        spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
-        spotCapture = await activation.captureRelocation(captureSignal);
+        const { spotCaptureOperation } = await this.afterSpotCloseDecision(
+          meshName,
+          activation.spotId,
+          () => {
+            interruptionStartedAt = performance.now();
+            spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
+            return { spotCaptureOperation: activation.captureRelocation(captureSignal) };
+          }
+        );
+        spotCapture = await spotCaptureOperation;
         return {
           boundSessionState: Buffer.alloc(0),
           queuedMessages: [],
@@ -1937,36 +2146,54 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           meshName === undefined
         )
           return;
-        const membershipSpotId =
-          targetMembership?.spotId ?? ((target.entrySpotId ?? String(target.rid)) as RoutingId);
-        const committedAuthority = await requireAuthority(
-          this.requireLocationStore(),
-          encodeAuthorityKey('actor', state.actorId)
-        );
-        const targetActorRef = {
-          actorId: state.actorId,
-          objectGeneration: authority.objectGeneration,
-          meshName,
-          nodeRid: target.rid
-        };
-        await ownSession.prepared.commit(
-          {
-            routerChannelId: meshName,
-            targetNodeRid: target.rid,
-            spotId: membershipSpotId,
-            spotKind: targetMembership?.spotKind ?? ZLinkSpotKind.Entry,
-            authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-          } as never,
-          targetActorRef,
-          committedActorOwnerFence(state.actorId, targetActorRef, committedAuthority)
-        );
+        const failures: unknown[] = [];
+        try {
+          const membershipSpotId =
+            targetMembership?.spotId ?? ((target.entrySpotId ?? String(target.rid)) as RoutingId);
+          const committedAuthority = await requireAuthority(
+            this.requireLocationStore(),
+            encodeAuthorityKey('actor', state.actorId)
+          );
+          const targetActorRef = {
+            actorId: state.actorId,
+            objectGeneration: authority.objectGeneration,
+            meshName,
+            nodeRid: target.rid
+          };
+          await ownSession.prepared.commit(
+            {
+              routerChannelId: meshName,
+              targetNodeRid: target.rid,
+              spotId: membershipSpotId,
+              spotKind: targetMembership?.spotKind ?? ZLinkSpotKind.Entry,
+              authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+            } as never,
+            targetActorRef,
+            committedActorOwnerFence(state.actorId, targetActorRef, committedAuthority)
+          );
+        } catch (error) {
+          failures.push(error);
+        }
         if (!retainSourceForActorJoin) {
-          await this.requireActorManager().completeRelocationSource(state.actorId);
+          try {
+            await this.requireActorManager().completeRelocationSource(state.actorId);
+          } catch (error) {
+            failures.push(error);
+          }
         }
+        if (failures.length > 0)
+          throw failures.length === 1
+            ? failures[0]
+            : new AggregateError(failures, 'Actor source retirement failed.');
       },
       abortSeal: async () => {
         if (standalone && ownSession !== undefined) await ownSession.prepared.rollback();
-      }
+      },
+      discardSeal: (reason) =>
+        (standalone
+          ? ownSession
+          : sessions.find((value) => value.state === state)
+        )?.prepared.discard(reason)
     };
   }
 
@@ -2004,13 +2231,17 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes?: number
   ): Promise<void> {
-    relocationDebug('coordinator.begin', {
-      aggregateId: captured.envelope.aggregateId,
-      targetRid: String(target.rid)
-    });
+    if (isRelocationDebugEnabled()) {
+      relocationDebug('coordinator.begin', {
+        aggregateId: captured.envelope.aggregateId,
+        targetRid: String(target.rid)
+      });
+    }
     const localStatus = this.requireMeshNode(meshName).status();
     const controlDeadlineAtMs =
-      signal === undefined ? performance.now() + 30_000 : Number.MAX_SAFE_INTEGER;
+      signal === undefined
+        ? performance.now() + RELOCATION_OPERATION_TIMEOUT_MS
+        : Number.MAX_SAFE_INTEGER;
     const coordinator = {
       ownerId: primary.ownerId,
       leaseGeneration: primary.ownerLeaseGeneration,
@@ -2067,12 +2298,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       advertisedReceiveChunkLimitBytes
     );
     const plan = planRelocationChunks(encoded, chunkLimitBytes);
-    const convergenceDeadlineAtMs =
-      signal === undefined
-        ? performance.now() + RELOCATION_OPERATION_RETENTION_MS
-        : controlDeadlineAtMs;
+    // The Restore absolute deadline is this unit's relocation deadline: the
+    // caller's signal, or the control deadline without one. From it the
+    // source settles the authority with its Preserve fence (Location runtime
+    // §10). The target keeps no deadline of its own.
+    const restoreDeadlineReached = () =>
+      signal?.aborted === true || performance.now() >= controlDeadlineAtMs;
     let readyReceived = false;
-    let sourceCommitted = false;
+    let settlement: 'target' | 'source' | 'lost' | undefined;
     try {
       const prepare = {
         kind: 'prepare',
@@ -2102,17 +2335,25 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         encodePrepareSideband(captured.envelope)
       );
       try {
-        relocationDebug('coordinator.state_transfer_begin', {
-          aggregateId: captured.envelope.aggregateId
-        });
+        if (isRelocationDebugEnabled()) {
+          relocationDebug('coordinator.state_transfer_begin', {
+            aggregateId: captured.envelope.aggregateId
+          });
+        }
         await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, signal);
       } catch (chunkError) {
         readyOperation.catch(() => undefined);
         throw chunkError;
       }
-      relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+      }
       const ready = await readyOperation;
-      relocationDebug('coordinator.ready_received', { aggregateId: captured.envelope.aggregateId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('coordinator.ready_received', {
+          aggregateId: captured.envelope.aggregateId
+        });
+      }
       validateControlResponse(prepare, ready);
       // Ready arms the target's cutover-wait fallback. From this point
       // forward the source can no longer reopen dispatch without risking two
@@ -2169,9 +2410,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           Buffer.concat(boundaryBatch.map((value) => value.canonicalBytes))
         )
       });
-      // The one-way cutover submit reaches a terminal result exactly once;
-      // success and failure both end source dispatch permanently. The batch
-      // copy stays for the retransmission window (spec 28 §4.4).
+      // The cutover submit result is not the authority result. The memory
+      // copy of the boundary batch and cutover stays until the authority
+      // settlement below (spec 28 §4.4).
       let submitFailure: unknown;
       try {
         for (const record of boundaryBatch) {
@@ -2182,7 +2423,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         submitFailure = error;
         console.warn('[zlink.runtime.relocation.cutover_submit_failed]', relayAuthorityId, error);
       }
-      this.beginSourceCutoverWindow(
+      const window = this.beginSourceCutoverWindow(
         meshName,
         target.rid,
         relayAuthorityId,
@@ -2190,53 +2431,59 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         submitFailure !== undefined,
         limits
       );
-
-      await this.waitForTargetAuthorities(
-        captured.envelope,
-        targetFence,
-        convergenceDeadlineAtMs,
-        signal
-      );
-      relocationDebug('coordinator.target_authorities_observed', {
-        aggregateId: captured.envelope.aggregateId
-      });
-      for (const session of sessions) session.prepared.setReplayResults([]);
-      await captured.commitSource();
-      sourceCommitted = true;
-      await this.options.reconcileStatefulAuthorityRoutes?.(signal);
-    } catch (error) {
-      if (!readyReceived) throw error;
       try {
-        await this.waitForTargetAuthorities(
+        settlement = await this.settleSourceAuthority(
           captured.envelope,
+          primary,
           targetFence,
-          convergenceDeadlineAtMs
-        );
-        if (!sourceCommitted) {
-          for (const session of sessions) session.prepared.setReplayResults([]);
-          await captured.commitSource();
-          sourceCommitted = true;
-        }
-        await this.options.reconcileStatefulAuthorityRoutes?.();
-        const authority = await requireAuthority(
-          this.requireLocationStore(),
-          { value: primaryKey(captured.envelope) } as ZLinkAuthorityKey,
-          undefined
+          restoreDeadlineReached,
+          window
         );
-        throw new ServiceRelocationPostCommitError(
-          authority,
-          { id: `${captured.envelope.aggregateId}:${captured.envelope.aggregateGeneration}` },
-          error
+      } finally {
+        this.closeSourceCutoverWindow(relayAuthorityId, window);
+      }
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('coordinator.authority_settled', {
+          aggregateId: captured.envelope.aggregateId,
+          settlement
+        });
+      }
+      if (settlement === 'source') {
+        // Preserve won: the captured queue, timers and held records return to
+        // the source queue in their accepted order, and dispatch reopens.
+        await captured.abortSource();
+        throw new Error(
+          `Relocation '${relayAuthorityId}' ended by the source Preserve fence; the source kept the authority.`
         );
-      } catch (convergenceError) {
-        if (convergenceError instanceof ServiceRelocationPostCommitError) {
-          throw convergenceError;
-        }
-        throw new AggregateError(
-          [error, convergenceError],
-          'Relocation became irreversible after Ready and target convergence failed.'
+      }
+      if (settlement === 'lost') {
+        // Expired owner: dispatch and Store changes stop for good and every
+        // pending request without a terminal gets one Unavailable.
+        const unavailable = createInternalFrameworkException(
+          ZLinkFrameworkInternalErrorKind.RouteNotConnected,
+          `Relocation '${relayAuthorityId}' source owner lease ended before its authority settled.`,
+          true
         );
+        await captured.discardSource(unavailable);
+        throw new ServiceRelocationAuthorityError(unavailable.message, { cause: unavailable });
       }
+      for (const session of sessions) session.prepared.setReplayResults([]);
+      await captured.commitSource();
+      await this.options.reconcileStatefulAuthorityRoutes?.(signal);
+    } catch (error) {
+      if (settlement !== 'target') throw error;
+      // Target commit is confirmed; later source cleanup failures cannot move
+      // the authority back (spec 28 §10).
+      const authority = await requireAuthority(
+        this.requireLocationStore(),
+        { value: primaryKey(captured.envelope) } as ZLinkAuthorityKey,
+        undefined
+      );
+      throw new ServiceRelocationPostCommitError(
+        authority,
+        { id: `${captured.envelope.aggregateId}:${captured.envelope.aggregateGeneration}` },
+        error
+      );
     } finally {
       if (!readyReceived) {
         // Only an explicit failure before the Ready reply becomes accepted
@@ -2339,12 +2586,11 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   }
 
   /**
-   * Starts the source retransmission window after the cutover submit
-   * terminal. The boundary batch and cutover copies live in framework memory
-   * (not charged to the in-flight budget) and are cleaned exactly once when
-   * the window ends. While the window is open a failed submit retries the
-   * whole batch on the (re-established) connection. S4 — the Message Follow
-   * route removal point — closes the unit for SafeToShutdown.
+   * Starts the source cutover window after the cutover submit terminal. The
+   * boundary batch and cutover copies live in framework memory (not charged
+   * to the in-flight budget) until the authority settlement closes the
+   * window. S4 — the Message Follow route removal point — closes the unit for
+   * SafeToShutdown.
    */
   private beginSourceCutoverWindow(
     meshName: string,
@@ -2353,65 +2599,184 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     frames: readonly Buffer[],
     initialSubmitFailed: boolean,
     limits: ReturnType<ZLinkHostServiceRelocationRuntime['relocationLimits']>
-  ): void {
+  ): SourceCutoverWindow {
     const submittedAt = performance.now();
     const window: SourceCutoverWindow = {
       meshName,
       targetNodeRid,
       frames,
+      resendPending: initialSubmitFailed,
       cutoverSubmittedAtMs: submittedAt,
       windowClosed: false,
       followExpired: false
     };
     this.sourceCutoverWindows.set(relocationKey, window);
-    const settle = () => {
-      if (window.windowClosed && window.followExpired) {
-        this.sourceCutoverWindows.delete(relocationKey);
+    window.followTimer = setTimeout(() => {
+      window.followExpired = true;
+      // S1→S4 route convergence: the span the source must keep its Message
+      // Follow route (spec 30 §7.1).
+      this.options.metrics?.duration(
+        METRIC_NAMES.RelocationRouteConvergence,
+        Math.max(0, performance.now() - submittedAt) / MILLISECONDS_PER_SECOND,
+        { mesh_name: meshName }
+      );
+      this.releaseSourceCutoverWindow(relocationKey, window);
+    }, limits.messageFollowDurationMs);
+    window.followTimer.unref();
+    return window;
+  }
+
+  /** The authority settlement ended: the retained batch copy is released. */
+  private closeSourceCutoverWindow(relocationKey: string, window: SourceCutoverWindow): void {
+    window.windowClosed = true;
+    window.frames = undefined;
+    this.releaseSourceCutoverWindow(relocationKey, window);
+  }
+
+  private releaseSourceCutoverWindow(relocationKey: string, window: SourceCutoverWindow): void {
+    if (
+      window.windowClosed &&
+      window.followExpired &&
+      this.sourceCutoverWindows.get(relocationKey) === window
+    ) {
+      this.sourceCutoverWindows.delete(relocationKey);
+    }
+  }
+
+  /**
+   * Sends the whole boundary batch and cutover again after a failed submit
+   * or an observed loss of the target connection (spec 28 §4.4). The target
+   * replaces its partial span with the whole batch.
+   */
+  private async resendSourceCutover(window: SourceCutoverWindow): Promise<void> {
+    const frames = window.frames;
+    if (frames === undefined) return;
+    const peers = this.requireMeshNode(window.meshName).peers();
+    const peer = peers.find(
+      (value) =>
+        value.routingId !== null && String(value.routingId) === String(window.targetNodeRid)
+    );
+    if (peer !== undefined && peer.state !== MeshPeerRuntimeState.Serving) {
+      window.resendPending = true;
+      return;
+    }
+    if (!window.resendPending) return;
+    try {
+      for (const frame of frames) {
+        await this.submitControlFrame(
+          window.meshName,
+          window.targetNodeRid,
+          frame,
+          'cutover retransmission'
+        );
+      }
+      window.resendPending = false;
+    } catch {
+      // The next settlement round retries the whole batch.
+    }
+  }
+
+  /**
+   * The one source authority settlement after Ready (Location runtime
+   * §6.1·§10, spec 28 §4.4). It reads the Store until the target commit or
+   * the Restore deadline. From the Restore deadline it runs the source
+   * Preserve fence: a CAS on the StoreVersion expected by target NewOwner
+   * excludes a late target commit. `target`: the
+   * target committed. `source`: Preserve fenced the target out while the
+   * source owner lease was valid. `lost`: the source owner lease ended first
+   * or another authority owns the object. An uncertain Store or lease result
+   * keeps the work retained and repeats the same decision.
+   */
+  private async settleSourceAuthority(
+    envelope: ServiceRelocationEnvelope,
+    primary: ZLinkAuthoritySnapshot,
+    target: ServiceWireRelocationTarget,
+    restoreDeadlineReached: () => boolean,
+    window: SourceCutoverWindow
+  ): Promise<'target' | 'source' | 'lost'> {
+    const owner = { ownerId: primary.ownerId, leaseGeneration: primary.ownerLeaseGeneration };
+    const store = this.requireLocationStore();
+    for (;;) {
+      if (this.disposed) throw new Error('Relocation runtime stopped.');
+      await this.resendSourceCutover(window);
+      const observed = await this.readSourceSettlement(envelope, primary, target).catch(
+        (error: unknown) => {
+          if (!isIndeterminateLocationStoreFailure(error)) throw error;
+          return undefined;
+        }
+      );
+      if (observed?.kind === 'target') return 'target';
+      if (observed?.kind === 'other') return 'lost';
+      if (restoreDeadlineReached() && observed?.kind === 'source') {
+        // An unreadable lease is an uncertain result, not an expiry.
+        if (
+          await this.exactSourceLeaseExpired(owner).catch((error: unknown) => {
+            if (!isIndeterminateLocationStoreFailure(error)) throw error;
+            return false;
+          })
+        )
+          return 'lost';
+        const publication = this.codec.read(observed.current.payload);
+        const preserved = await store
+          .compareExchangeAuthority(
+            { value: primaryKey(envelope) } as ZLinkAuthorityKey,
+            observed.current.storeVersion,
+            {
+              kind: 'put',
+              generationTransition: 'preserve',
+              payload:
+                publication === undefined
+                  ? observed.current.payload
+                  : this.codec.clear(observed.current.payload, publication.reference)
+            }
+          )
+          .catch((error: unknown) => {
+            if (!isIndeterminateLocationStoreFailure(error)) throw error;
+            return undefined;
+          });
+        if (preserved?.kind === 'stored') return 'source';
       }
-    };
-    window.windowTimer = setTimeout(() => {
-      window.windowClosed = true;
-      window.frames = undefined;
-      if (window.retryTimer !== undefined) clearTimeout(window.retryTimer);
-      settle();
-    }, limits.relocationCutoverWaitTimeoutMs);
-    window.windowTimer.unref();
-    window.followTimer = setTimeout(() => {
-      window.followExpired = true;
-      // S1→S4 route convergence: the span the source must keep its Message
-      // Follow route (spec 30 §7.1).
-      this.options.metrics?.duration(
-        'zlink.relocation.route_convergence',
-        Math.max(0, performance.now() - submittedAt) / 1000,
-        { mesh_name: meshName }
+      // The caller awaits this settlement, so the retry timer keeps the loop alive.
+      await new Promise<void>((resolve) =>
+        setTimeout(resolve, RELOCATION_AUTHORITY_POLL_INTERVAL_MS)
       );
-      settle();
-    }, limits.messageFollowDurationMs);
-    window.followTimer.unref();
-    if (initialSubmitFailed) this.scheduleCutoverRetransmit(window);
+    }
   }
 
-  private scheduleCutoverRetransmit(window: SourceCutoverWindow): void {
-    if (window.windowClosed || window.frames === undefined) return;
-    window.retryTimer = setTimeout(() => {
-      void (async () => {
-        const frames = window.frames;
-        if (window.windowClosed || frames === undefined) return;
-        try {
-          for (const frame of frames) {
-            await this.submitControlFrame(
-              window.meshName,
-              window.targetNodeRid,
-              frame,
-              'cutover retransmission'
-            );
-          }
-        } catch {
-          this.scheduleCutoverRetransmit(window);
-        }
-      })();
-    }, 250);
-    window.retryTimer.unref();
+  private async readSourceSettlement(
+    envelope: ServiceRelocationEnvelope,
+    primary: ZLinkAuthoritySnapshot,
+    target: ServiceWireRelocationTarget
+  ): Promise<
+    | { readonly kind: 'target' }
+    | { readonly kind: 'source'; readonly current: ZLinkAuthoritySnapshot }
+    | { readonly kind: 'other' }
+  > {
+    const primaryAuthorityKey = primaryKey(envelope);
+    let committed = 0;
+    let primaryCurrent: ZLinkAuthoritySnapshot | undefined;
+    for (const participant of envelope.participants) {
+      const current = await this.requireLocationStore().readAuthority({
+        value: participant.key
+      } as ZLinkAuthorityKey);
+      if (current.kind !== 'snapshot') return { kind: 'other' };
+      if (
+        current.objectGeneration === participant.objectGeneration &&
+        current.ownerId === target.ownerId &&
+        current.ownerLeaseGeneration === target.ownerLeaseGeneration &&
+        current.authorityOwnerGeneration > participant.authorityOwnerGeneration &&
+        String(current.allocation.descriptor.rid) === target.nodeRid &&
+        current.allocation.descriptorLifecycleGeneration === target.nodeGeneration
+      ) {
+        committed += 1;
+      }
+      if (participant.key === primaryAuthorityKey) primaryCurrent = current;
+    }
+    if (committed === envelope.participants.length) return { kind: 'target' };
+    if (primaryCurrent !== undefined && isSourceOwner(primaryCurrent, primary)) {
+      return { kind: 'source', current: primaryCurrent };
+    }
+    return { kind: 'other' };
   }
 
   /**
@@ -2455,14 +2820,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     meshName: string,
     stagingId: string,
     request: ServiceMaintenanceRelocationPrepare,
-    sourceNodeRid: RoutingId | null,
+    sourceNodeRid: RoutingId,
     signal?: AbortSignal
   ): Promise<ServiceMaintenanceRelocationReady> {
-    if (sourceNodeRid === null || String(sourceNodeRid) !== request.sourceNodeRid) {
-      throw new Error(
-        'Relocation prepare source node fence does not match the authenticated peer.'
-      );
-    }
     const targetStatus = this.requireMeshNode(meshName).status();
     const targetOwner = this.options.currentOwner();
     const targetDescriptor = this.options.localDescriptor?.(meshName);
@@ -2480,24 +2840,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const fingerprint = stringifyWire(request);
     const existing = this.targetStages.get(stagingId);
     if (existing !== undefined) {
-      if (
-        existing.offer.authenticatedSourceNodeRid !== String(sourceNodeRid) ||
-        existing.offer.prepareFingerprint !== fingerprint
-      ) {
-        throw new Error('Relocation prepare retry source node changed.');
-      }
       return relocationReady(request);
     }
     const terminal = this.terminalTargets.get(stagingId);
     if (terminal !== undefined) {
-      if (terminal !== fingerprint) {
-        throw new Error(`Relocation '${stagingId}' repeated Prepare with different bytes.`);
-      }
       this.terminalTargets.touch(stagingId);
       return relocationReady(request);
     }
     const pendingAssembly = this.targetAssemblies.get(stagingId);
-    if (pendingAssembly === undefined || pendingAssembly.fingerprint !== fingerprint) {
+    if (pendingAssembly === undefined) {
       throw new Error(`Relocation '${stagingId}' has no matching payload assembly.`);
     }
     // The directly transferred payload replaces the shared durable root: the
@@ -2525,6 +2876,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       request.nodeInternalBoundSessions
     );
     validatePrepareEnvelope(request, inventoryEnvelope);
+    const releaseActivation =
+      (await this.options.activationAdmission?.acquire(meshName, signal)) ?? (() => undefined);
     let materialized:
       (Pick<LocalStage, 'owner' | 'staging'> & { readonly target: LocalTargetPort }) | undefined;
     let reservation: TargetRelocationReservation | undefined;
@@ -2539,7 +2892,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         meshName,
         request,
         inventoryEnvelope,
-        materialized.target,
         signal
       );
       const offer: TargetRelocationOffer = {
@@ -2547,7 +2899,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         prepareFingerprint: fingerprint,
         authenticatedSourceNodeRid: String(sourceNodeRid),
         envelope: inventoryEnvelope,
-        restoreDeadlineAtMs: performance.now() + RELOCATION_OPERATION_RETENTION_MS,
         reservation
       };
       const stage: LocalStage = {
@@ -2556,10 +2907,12 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         phase: 'ready',
         lane: Promise.resolve(),
         cutoverReceived: false,
-        boundaryRelay: []
+        boundaryRelay: [],
+        releaseActivation
       };
       this.targetStages.set(stagingId, stage);
     } catch (error) {
+      releaseActivation();
       if (reservation !== undefined) {
         await this.abortTargetReservation(reservation, signal).catch(() => undefined);
       }
@@ -2571,11 +2924,23 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     return relocationReady(request);
   }
 
+  /**
+   * The cutover wait of a Ready stage (spec 28 §4.4) is a Warning only: it
+   * records `cutover_timeout` and never submits the target CAS or opens
+   * dispatch. From then on the target settlement reads the Location Store so
+   * a source Preserve fence or a lost target lease ends the staging; only a
+   * verified cutover lets that settlement submit the CAS.
+   */
   private armTargetCutoverFallback(meshName: string, stagingId: string): void {
     const stage = this.targetStages.get(stagingId);
     if (stage === undefined || stage.fallback !== undefined || stage.finalize !== undefined) return;
     stage.fallback = setTimeout(() => {
-      void this.beginTargetFinalize(meshName, stagingId, stage, true).catch((error) =>
+      if (stage.finalize !== undefined) return;
+      console.warn('[zlink.runtime.relocation.cutover_timeout]', stagingId);
+      this.options.metrics?.count(METRIC_NAMES.RelocationCutoverTimeout, 1, {
+        mesh_name: meshName
+      });
+      void this.beginTargetFinalize(meshName, stagingId, stage).catch((error) =>
         console.error('[zlink.runtime.relocation.location_update_failed]', error)
       );
     }, this.relocationLimits().relocationCutoverWaitTimeoutMs);
@@ -2594,7 +2959,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const stagingId = relocationStagingId(request);
     const stage = this.targetStages.get(stagingId);
     if (stage === undefined) {
-      if (this.terminalTargets.get(stagingId) !== undefined) {
+      if (this.disposed || this.terminalTargets.get(stagingId) !== undefined) {
         if (request.kind === 'cutover') {
           console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
         }
@@ -2603,19 +2968,29 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       throw new Error(`Relocation staging '${stagingId}' is missing.`);
     }
     validateTargetOneWayControl(stage, request, sourceNodeRid);
-    if (request.kind === 'data') {
-      stage.lane = stage.lane.then(() => this.stageBoundaryRelay(stage, request));
-      await stage.lane;
-      return;
-    }
-    if (stage.cutoverReceived || stage.phase !== 'ready') {
-      console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
-      return;
-    }
-    this.reconcileBoundaryRelay(stage, request, stagingId);
-    stage.cutoverReceived = true;
+    stage.lane = stage.lane.then(() => {
+      // A verified cutover closes the boundary batch. A later record or cutover
+      // is a duplicate retransmission and never changes the staged batch.
+      if (stage.cutoverReceived || (stage.phase !== 'ready' && stage.phase !== 'finalizing')) {
+        if (request.kind === 'cutover') {
+          console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+        }
+        return;
+      }
+      if (request.kind === 'data') {
+        return this.stageBoundaryRelay(stage, request);
+      }
+      if (this.targetStageSealed(stage)) return;
+      this.reconcileBoundaryRelay(stage, request, stagingId);
+      stage.cutoverReceived = true;
+    });
+    await stage.lane;
+    if (request.kind === 'data') return;
+    // A settlement started by the cutover wait Warning is still reading the
+    // Store; it submits the CAS on its next round now that cutover verified.
+    if (stage.finalize !== undefined) return;
     if (stage.fallback !== undefined) clearTimeout(stage.fallback);
-    await this.beginTargetFinalize(meshName, stagingId, stage, false, signal);
+    await this.beginTargetFinalize(meshName, stagingId, stage, signal);
   }
 
   /** Validates one boundary relay record and buffers it until cutover applies it. */
@@ -2643,15 +3018,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     }
     const expectedCount = Number(request.boundaryRecordCount);
     const staged = stage.boundaryRelay;
-    const checksumOf = (records: readonly ServiceMaintenanceRelocationData[]) =>
-      crc32c(Buffer.concat(records.map((value) => value.frozenRecord.canonicalBytes)));
-    if (staged.length === expectedCount && checksumOf(staged) === request.boundaryChecksumCrc32c) {
-      return;
-    }
-    if (staged.length > expectedCount) {
-      const suffix = staged.slice(staged.length - expectedCount);
-      if (checksumOf(suffix) === request.boundaryChecksumCrc32c) {
-        console.warn('[zlink.runtime.relocation.boundary_batch_replaced]', stagingId);
+    // The batch is the last `boundaryRecordCount` records: the source sends
+    // the whole batch right before this cutover on the ordered connection,
+    // so a retransmission replaces an earlier partial span as a whole.
+    if (staged.length >= expectedCount) {
+      const batch = staged.slice(staged.length - expectedCount);
+      if (
+        crc32c(Buffer.concat(batch.map((value) => value.frozenRecord.canonicalBytes))) ===
+        request.boundaryChecksumCrc32c
+      ) {
         staged.splice(0, staged.length - expectedCount);
         return;
       }
@@ -2668,21 +3043,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     meshName: string,
     stagingId: string,
     stage: LocalStage,
-    fallback: boolean,
     signal?: AbortSignal
   ): Promise<void> {
     if (stage.finalize !== undefined) return stage.finalize;
-    if (fallback) {
-      console.warn('[zlink.runtime.relocation.cutover_timeout]', stagingId);
-      this.options.metrics?.count('zlink.relocation.cutover_timeout', 1, {
-        mesh_name: meshName
-      });
-    }
+    // Records staged before this point finish first. The settlement is not
+    // put on the lane, so a cutover that arrives while it waits for the
+    // authority result is still reconciled.
     const finalize = stage.lane.then(() =>
       this.finalizeTargetStage(meshName, stagingId, stage, signal)
     );
     stage.finalize = finalize;
-    stage.lane = finalize;
     return finalize;
   }
 
@@ -2698,14 +3068,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     let authority: ZLinkAuthoritySnapshot | undefined;
     let resumeStartedAt: number | undefined;
     try {
-      // The boundary relay span is applied to the temporary queue before the
-      // owner CAS so the merged order is saved work, pre-boundary relay, then
-      // post-boundary temporary records (spec 28 §4.6).
-      for (const relay of stage.boundaryRelay.splice(0)) {
-        await this.applyRelocationData(stage, relay, signal);
-      }
       authority = await this.commitTargetReservation(stage, stage.offer.reservation, signal);
+      if (authority === undefined) {
+        // The seal owner may have ended staging while a Store read was pending.
+        if ((stage as LocalStage).phase === 'failed') return;
+        return this.discardTargetStage(stagingId, stage, signal);
+      }
       authorityCommitted = true;
+      stage.releaseActivation();
       resumeStartedAt = performance.now();
       stage.phase = 'committed';
       await stage.owner.normalize(stage.staging, authority, signal);
@@ -2720,13 +3090,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         }
       }
       await this.finalizeActorJoinProfiles(meshName, stage, signal);
-      // Actor Join completion may advance its accepted-completion journal in
-      // the canonical authority slot. Try to clear that final publication
-      // before admission becomes externally visible so a later Join cannot
-      // reserve against the previous root. A bounded CAS conflict must not
-      // roll back already committed target ownership or strand its staged
-      // object: the next reservation recognizes the retained journal root and
-      // continues its existing cleanup/retry path.
+      // Clear the final relocation publication before admission becomes
+      // externally visible so a later Join cannot reserve against the
+      // previous root. A bounded CAS conflict must not roll back already
+      // committed target ownership or strand its staged object.
       try {
         await this.clearTargetRelocationPublication(stage, authority, signal);
       } catch (error) {
@@ -2738,8 +3105,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       await stage.owner.openAdmission(stage.staging, signal);
       // S2→S3: owner confirmation to application dispatch opening.
       this.options.metrics?.duration(
-        'zlink.relocation.target_resume',
-        Math.max(0, performance.now() - resumeStartedAt) / 1000,
+        METRIC_NAMES.RelocationTargetResume,
+        Math.max(0, performance.now() - resumeStartedAt) / MILLISECONDS_PER_SECOND,
         { mesh_name: meshName }
       );
       await this.publishSessionRoutes(stage.staging);
@@ -2754,14 +3121,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       this.targetStages.delete(stagingId);
       this.targetAssemblies.delete(stagingId);
     } catch (error) {
-      stage.phase = 'failed';
       this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
       this.targetStages.delete(stagingId);
       this.targetAssemblies.delete(stagingId);
       if (!authorityCommitted) {
-        await this.abortTargetStage(stage).catch(() => undefined);
+        // abortTargetStage may already have assigned failed before throwing.
+        if ((stage as LocalStage).phase !== 'failed') await this.abortTargetStage(stage);
         throw error;
       }
+      stage.phase = 'failed';
       if (authority !== undefined) {
         throw new ServiceRelocationPostCommitError(authority, stage.staging, error);
       }
@@ -2897,19 +3265,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     }
     this.sourceActorJoinProfiles.delete(input.transferId);
     this.terminalActorJoinSourceLeaves.remember(input.transferId, input.actorId);
-    void profile.ready
-      .then(async () => {
-        await this.options.actorTransfer.completeRelocationSourceLeave(
-          profile.actor,
-          profile.sourceSpotId
-        );
-        await this.options
-          .actorManager()
-          ?.completeRelocationSource(input.actorId, profile.sourceActorRef);
-      })
-      .catch((error) => {
-        console.error('[zlink.runtime.relocation.source_leave_failed]', error);
-      });
+    void this.finalizeActorJoinSource(profile);
     return true;
   }
 
@@ -2941,41 +3297,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     }
   }
 
-  private async waitForTargetAuthorities(
-    envelope: ServiceRelocationEnvelope,
-    target: ServiceWireRelocationTarget,
-    deadlineAtMs: number,
-    signal?: AbortSignal
-  ): Promise<void> {
-    for (;;) {
-      signal?.throwIfAborted();
-      let exact = true;
-      for (const participant of envelope.participants) {
-        const current = await this.requireLocationStore().readAuthority(
-          { value: participant.key } as ZLinkAuthorityKey,
-          signal
-        );
-        if (
-          current.kind !== 'snapshot' ||
-          current.objectGeneration !== participant.objectGeneration ||
-          current.ownerId !== target.ownerId ||
-          current.ownerLeaseGeneration !== target.ownerLeaseGeneration ||
-          current.authorityOwnerGeneration <= participant.authorityOwnerGeneration ||
-          String(current.allocation.descriptor.rid) !== target.nodeRid ||
-          current.allocation.descriptorLifecycleGeneration !== target.nodeGeneration
-        ) {
-          exact = false;
-          break;
-        }
-      }
-      if (exact) return;
-      if (performance.now() >= deadlineAtMs) {
-        throw new Error('Relocation target owner was not confirmed before its original deadline.');
-      }
-      await new Promise<void>((resolve) => setTimeout(resolve, 10));
-    }
-  }
-
   private async clearTargetRelocationPublication(
     stage: LocalStage,
     primary: ZLinkAuthoritySnapshot,
@@ -2986,36 +3307,25 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       stage.staging.primaryAuthorityKey.value,
       signal
     );
-    //  The deferred-Join journal advances its completion cursor with its
-    //  own authority CAS while the target finalizes, so the initially
-    //  captured storeVersion can be stale by the time the relocation
-    //  wrapper is cleared. Re-read and retry on conflict instead of turning
-    //  a completed relocation into a post-commit failure (spec 28 —
-    //  retryable store conflicts converge on the same CAS and the same
-    //  relocation identity until the outcome is determined).
-    let current: ZLinkAuthoritySnapshot = primary;
-    for (let attempt = 0; attempt < 16; attempt += 1) {
-      const publication = this.codec.read(current.payload);
-      if (publication === undefined) return;
-      const result = await this.requireLocationStore().compareExchangeAuthority(
-        stage.staging.primaryAuthorityKey,
-        current.storeVersion,
-        {
-          kind: 'put',
-          generationTransition: 'preserve',
-          payload: this.codec.clear(current.payload, publication.reference)
-        },
-        signal
-      );
-      if (result.kind === 'stored') return;
-      const read = await this.requireLocationStore().readAuthority(
-        stage.staging.primaryAuthorityKey,
-        signal
-      );
-      if (read.kind !== 'snapshot') break;
-      current = read;
+    //  The target owner is the only writer of the committed primary
+    //  authority between its commit and this clear, so one CAS against the
+    //  committed snapshot decides. A conflict means another owner changed the
+    //  row; the caller records it and leaves the committed ownership intact.
+    const publication = this.codec.read(primary.payload);
+    if (publication === undefined) return;
+    const result = await this.requireLocationStore().compareExchangeAuthority(
+      stage.staging.primaryAuthorityKey,
+      primary.storeVersion,
+      {
+        kind: 'put',
+        generationTransition: 'preserve',
+        payload: this.codec.clear(primary.payload, publication.reference)
+      },
+      signal
+    );
+    if (result.kind !== 'stored') {
+      throw new Error('Relocation target authority normalization CAS failed.');
     }
-    throw new Error('Relocation target authority normalization CAS failed.');
   }
 
   private async handleReplyRelay(
@@ -3129,7 +3439,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             pending.resolve('sourceLeaseExpired');
             return;
           }
-          if (++attempts > 120) {
+          if (++attempts > RELOCATION_MAX_SEND_ATTEMPTS) {
             pending.reject(new Error(`Relocation reply relay ACK '${key}' timed out.`));
             return;
           }
@@ -3139,7 +3449,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             encodeMaintenanceReplyRelay(request)
           );
           if (this.pendingReplyRelays.get(key) === pending) {
-            pending.timer = setTimeout(() => void send(), 250);
+            pending.timer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
           }
         } catch (error) {
           pending.reject(error);
@@ -3269,7 +3579,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   }
 
   private async exactSourceLeaseExpired(
-    source: ServiceWireRequestSourceFence,
+    source: Pick<ServiceWireRequestSourceFence, 'ownerId' | 'leaseGeneration'>,
     signal?: AbortSignal
   ): Promise<boolean> {
     const lease = await this.requireLocationStore().readOwnerLease(source.ownerId, signal);
@@ -3284,10 +3594,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   private async publishSessionRoutes(
     staging: ServiceObjectRelocationStaging<LocalHidden>
   ): Promise<void> {
-    for (const hidden of staging.hidden.values()) {
-      if (hidden.actor !== undefined) {
-        await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor);
-      }
+    for (const [key, hidden] of staging.hidden) {
+      if (hidden.actor === undefined) continue;
+      // The Session seal travels with the relocation envelope, not the Actor.
+      const carried = staging.envelope.participants.find((value) => value.key === key);
+      await this.options.actorTransfer.publishRoutedActorOwnership(
+        hidden.actor,
+        carried === undefined ? undefined : decodeActorSession(carried.boundSessionState)
+      );
     }
   }
 
@@ -3296,7 +3610,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     targetNodeRid: RoutingId,
     request: ZLinkServiceRelocationControlRequest,
     signal?: AbortSignal,
-    deadlineAtMs = performance.now() + 30_000,
+    deadlineAtMs: number = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS,
     sideband: readonly Uint8Array[] = []
   ): Promise<ReturnType<typeof decodeServiceRelocationControlResponse>> {
     const key = controlAckKey(request);
@@ -3316,7 +3630,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           lastRequestError
         );
       }
-      const attemptTimeoutMs = Math.max(1, Math.min(250, Math.ceil(remainingMs)));
+      const attemptTimeoutMs = Math.max(
+        1,
+        Math.min(RELOCATION_ATTEMPT_TIMEOUT_MS, Math.ceil(remainingMs))
+      );
       const startedAtMs = performance.now();
       try {
         const replyFrames = await this.requestInfrastructureControl(
@@ -3342,11 +3659,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           throw error;
         }
         lastRequestError = error;
-        relocationDebug('control.request_retry', {
-          key,
-          kind: request.kind,
-          targetRid: String(targetNodeRid)
-        });
+        if (isRelocationDebugEnabled()) {
+          relocationDebug('control.request_retry', {
+            key,
+            kind: request.kind,
+            targetRid: String(targetNodeRid)
+          });
+        }
         const retryDelayMs = Math.min(
           Math.max(0, attemptTimeoutMs - (performance.now() - startedAtMs)),
           Math.max(0, deadlineAtMs - performance.now())
@@ -3386,7 +3705,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
               peer.routingId !== null &&
               String(peer.routingId) === String(descriptor.rid) &&
               peer.lifecycleGeneration === descriptor.lifecycleGeneration &&
-              peer.state === 3
+              peer.state === MeshPeerRuntimeState.Serving
           ) &&
           relocationTargetSupports(descriptor, requirements)
       )
@@ -3436,51 +3755,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     meshName: string,
     prepare: ServiceMaintenanceRelocationPrepare,
     envelope: ServiceRelocationEnvelope,
-    targetPort: LocalTargetPort,
     signal?: AbortSignal
   ): Promise<TargetRelocationReservation> {
     const authorities = await this.readTargetParticipantAuthorities(envelope, signal);
     const publication = relocationPublication(prepare, envelope);
-    // Carries the exact reference + CRC of a deferred-Join publication the
-    // target reservation must keep connected through the CAS (spec 28 —
-    // clearing/replacing it here would strand the journal's own
-    // prepared->committed transition with nothing left for it to find).
-    const retainedDeferredJoinRoots = new Map<
-      string,
-      { readonly reference: string; readonly checksumCrc32c: number }
-    >();
-    for (const participant of envelope.participants) {
-      const staged = targetPort.deferredJoinRoot(participant.key);
-      if (staged !== undefined) {
-        retainedDeferredJoinRoots.set(participant.key, {
-          reference: staged.reference.value,
-          checksumCrc32c: staged.checksumCrc32c
-        });
-        continue;
-      }
-      const current = this.codec.read(authorities.get(participant.key)!.payload);
-      if (
-        participant.objectKind === 'actor' &&
-        current?.canonical === true &&
-        (await this.options.actorTransfer.isDeferredJoinAcceptedRootPublication(
-          current.reference,
-          current.checksumCrc32c,
-          {
-            authorityKey: participant.key,
-            objectKind: 'actor',
-            objectGeneration: participant.objectGeneration,
-            aggregateId: current.aggregateId,
-            aggregateGeneration: current.aggregateGeneration
-          },
-          signal
-        ))
-      ) {
-        retainedDeferredJoinRoots.set(participant.key, {
-          reference: current.reference,
-          checksumCrc32c: current.checksumCrc32c
-        });
-      }
-    }
     const participants = envelope.participants.map((participant) => {
       const expected = authorities.get(participant.key)!;
       const membership = actorMembershipTarget(envelope, participant.key);
@@ -3495,48 +3773,34 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       ) {
         throw new Error(`Relocation target RouteMesh '${meshName}' has no Entry Spot.`);
       }
-      const retainedDeferredJoinRoot = retainedDeferredJoinRoots.get(participant.key);
-      const participantPublication =
-        retainedDeferredJoinRoot === undefined
-          ? publication
-          : {
-              ...publication,
-              reference: retainedDeferredJoinRoot.reference,
-              checksumCrc32c: retainedDeferredJoinRoot.checksumCrc32c
-            };
       return {
         key: { value: participant.key } as ZLinkAuthorityKey,
         expected,
         ownerTransition: 'newOwner' as const,
-        authorityPayload: this.authorityPayloadForPublication(
-          expected.payload,
-          participantPublication,
-          {
-            owner: {
-              ownerId: prepare.target.ownerId,
-              leaseGeneration: prepare.target.ownerLeaseGeneration
-            },
-            meshName,
-            nodeRid: prepare.target.nodeRid,
-            nodeGeneration: prepare.target.nodeGeneration,
-            objectGeneration: expected.objectGeneration,
-            targetAttemptGeneration: prepare.targetAttemptGeneration,
-            coordinatorExpectedStoreVersion: expected.storeVersion.value,
-            ...(membership === undefined
-              ? expected.allocation.objectKind === 'actor'
-                ? {
-                    actorSpotId: entrySpotId!,
-                    actorSpotGeneration: prepare.target.nodeGeneration,
-                    actorSpotKind: ZLinkSpotKind.Entry as const
-                  }
-                : {}
-              : {
-                  ...membership,
-                  actorSpotKind: ZLinkSpotKind.User as const
-                })
+        authorityPayload: this.authorityPayloadForPublication(expected.payload, publication, {
+          owner: {
+            ownerId: prepare.target.ownerId,
+            leaseGeneration: prepare.target.ownerLeaseGeneration
           },
-          retainedDeferredJoinRoot !== undefined
-        ),
+          meshName,
+          nodeRid: prepare.target.nodeRid,
+          nodeGeneration: prepare.target.nodeGeneration,
+          objectGeneration: expected.objectGeneration,
+          targetAttemptGeneration: prepare.targetAttemptGeneration,
+          coordinatorExpectedStoreVersion: expected.storeVersion.value,
+          ...(membership === undefined
+            ? expected.allocation.objectKind === 'actor'
+              ? {
+                  actorSpotId: entrySpotId!,
+                  actorSpotGeneration: prepare.target.nodeGeneration,
+                  actorSpotKind: ZLinkSpotKind.Entry as const
+                }
+              : {}
+            : {
+                ...membership,
+                actorSpotKind: ZLinkSpotKind.User as const
+              })
+        }),
         membershipMutation: encodeMembershipMutation(envelope.memberships, participant.key)
       };
     });
@@ -3576,24 +3840,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       readonly actorSpotId?: string;
       readonly actorSpotGeneration?: bigint;
       readonly actorSpotKind?: ZLinkSpotKind.Entry | ZLinkSpotKind.User;
-    },
-    replacesDeferredJoinRoot = false
+    }
   ): Uint8Array {
     const existing = this.codec.read(payload);
     const canonicalIdentity = serviceRelocationAuthoritySlotIdentity(payload);
-    const replacesCanonicalJournal = replacesDeferredJoinRoot && existing?.canonical === true;
     if (
       canonicalIdentity !== undefined &&
       (existing === undefined ||
-        (existing.canonical === true &&
-          (existing.aggregateId === publication.aggregateId || replacesCanonicalJournal)))
+        (existing.canonical === true && existing.aggregateId === publication.aggregateId))
     ) {
-      const published =
-        existing === undefined
-          ? this.codec.publish(payload, publication)
-          : replacesCanonicalJournal && existing.aggregateId !== publication.aggregateId
-            ? this.codec.publish(this.codec.clear(payload, existing.reference), publication)
-            : payload;
+      const published = existing === undefined ? this.codec.publish(payload, publication) : payload;
       if (target === undefined) return published;
       return projectServiceRelocationAuthorityTargetReady(
         replaceServiceRelocationAuthorityApplicationPayload(
@@ -3665,6 +3921,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
 
   private async abortTargetStage(stage: LocalStage, signal?: AbortSignal): Promise<void> {
     if (stage.fallback !== undefined) clearTimeout(stage.fallback);
+    stage.releaseActivation();
     const failures: unknown[] = [];
     try {
       await this.abortTargetReservation(stage.offer.reservation, signal);
@@ -3683,35 +3940,73 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     }
   }
 
+  private async discardTargetStage(
+    stagingId: string,
+    stage: LocalStage,
+    signal?: AbortSignal
+  ): Promise<void> {
+    stage.phase = 'failed';
+    console.warn('[zlink.runtime.relocation.target_staging_discarded]', stagingId);
+    try {
+      await this.abortTargetStage(stage, signal);
+    } finally {
+      this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
+      this.targetStages.delete(stagingId);
+      this.targetAssemblies.delete(stagingId);
+    }
+  }
+
   private async commitTargetReservation(
     stage: LocalStage,
     reservation: TargetRelocationReservation,
     signal?: AbortSignal
-  ): Promise<ZLinkAuthoritySnapshot> {
+  ): Promise<ZLinkAuthoritySnapshot | undefined> {
     return await this.commitTargetAggregate(stage, reservation.prepared, signal);
   }
 
+  /**
+   * The one target authority settlement (Location runtime §10, spec 28
+   * §4.4-§4.5). Only a verified cutover lets the target submit its NewOwner
+   * CAS; a transient or indeterminate result resubmits the same RelocationId
+   * and expected StoreVersion while the target owner lease is valid (no
+   * separate timeout, no fixed count). Before a verified cutover the target
+   * only reads. It returns the committed authority, or undefined when a
+   * definitive Conflict excludes this commit after reconciliation, a source
+   * Preserve fence moved the source row, or the target lease ended; the
+   * caller then discards the staging.
+   */
   private async commitTargetAggregate(
     stage: LocalStage,
     prepared: ServicePreparedRelocationAggregate,
     signal?: AbortSignal
-  ): Promise<ZLinkAuthoritySnapshot> {
-    let firstError: unknown;
+  ): Promise<ZLinkAuthoritySnapshot | undefined> {
+    const target = stage.offer.prepare.target;
     for (;;) {
+      if (stage.phase === 'failed') return undefined;
       signal?.throwIfAborted();
-      let result: Awaited<ReturnType<ZLinkLocationStore['commitAggregate']>> | undefined;
-      try {
-        result = await this.requireLocationStore().commitAggregate(prepared.fence, signal);
-      } catch (error) {
-        firstError ??= error;
-      }
-      if (result?.kind === 'stale' || result?.kind === 'generationExhausted') {
-        throw new Error(
-          `location_update_failed: relocation aggregate commit returned ${result.kind}.`,
-          { cause: firstError }
-        );
+      if (this.targetStageSealed(stage)) return undefined;
+      let conflict = false;
+      if (stage.cutoverReceived) {
+        // The boundary relay span is applied to the temporary queue before
+        // the owner CAS so the merged order is saved work, pre-boundary relay,
+        // then post-boundary temporary records (spec 28 §4.6).
+        for (const relay of stage.boundaryRelay.splice(0)) {
+          await this.applyRelocationData(stage, relay, signal);
+        }
+        // A thrown provider call has an unknown result; the read below decides.
+        const result = await this.requireLocationStore()
+          .commitAggregate(prepared.fence, signal)
+          .catch((error: unknown) => {
+            if (!isIndeterminateLocationStoreFailure(error, signal)) throw error;
+            return undefined;
+          });
+        if (result?.kind === 'generationExhausted') {
+          throw new Error('location_update_failed: relocation aggregate commit exhausted.');
+        }
+        conflict = result?.kind === 'stale';
       }
       const observed = await this.readAggregateForCommitRetry(prepared, signal);
+      if ((stage as LocalStage).phase === 'failed') return undefined;
       if (observed.kind === 'committed') {
         const primary = observed.authorities.get(stage.staging.primaryAuthorityKey.value);
         if (primary === undefined) {
@@ -3719,15 +4014,20 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         }
         return primary;
       }
-      if (observed.kind === 'stale') {
-        throw new Error(
-          'location_update_failed: relocation aggregate source authority became stale.',
-          {
-            cause: firstError
-          }
-        );
+      if (observed.kind === 'stale' || (conflict && observed.kind === 'source')) return undefined;
+      // An unreadable lease is an uncertain result, not an expiry.
+      if (
+        await this.exactSourceLeaseExpired(
+          { ownerId: target.ownerId, leaseGeneration: target.ownerLeaseGeneration },
+          signal
+        ).catch((error: unknown) => {
+          if (!isIndeterminateLocationStoreFailure(error, signal)) throw error;
+          return false;
+        })
+      ) {
+        return undefined;
       }
-      await waitForLocationRetry(stage.offer.restoreDeadlineAtMs, signal, firstError);
+      await waitForRelocationRetry(RELOCATION_AUTHORITY_RETRY_DELAY_MS, signal);
     }
   }
 
@@ -3769,7 +4069,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           return { kind: 'stale' };
         }
       }
-    } catch {
+    } catch (error) {
+      if (!isIndeterminateLocationStoreFailure(error, signal)) throw error;
       return { kind: 'unknown' };
     }
     if (committed === prepared.plan.participants.length) {
@@ -3821,7 +4122,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (request.object.kind === 'userSpot' || request.object.kind === 'instanceSpot') {
       let cursor: ZLinkAuthorityScanCursor | undefined;
       for (;;) {
-        const page = await store.listAuthorities('', cursor, 1000, signal);
+        const page = await store.listAuthorities('', cursor, ZLINK_PROVIDER_MAX_PAGE_SIZE, signal);
         if (page.kind === 'scanExpired') {
           throw new Error('Location Store authority scan expired during relocation.');
         }
@@ -3966,7 +4267,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     );
     if (captured.byteLength > RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES) {
       throw new ZLinkRelocationStateIncompatibleError(
-        'Relocation application state exceeds the 64 MiB participant limit.'
+        `Relocation application state exceeds the ${RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES / (1024 * 1024)} MiB participant limit.`
       );
     }
     return captured;
@@ -3987,13 +4288,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     startedAt: number,
     outcome: string
   ): void {
-    const seconds = Math.max(0, performance.now() - startedAt) / 1000;
+    const seconds = Math.max(0, performance.now() - startedAt) / MILLISECONDS_PER_SECOND;
     const attributes = {
       unit_kind: unitKind,
       ...(executionMode === undefined ? {} : { execution_mode: executionMode })
     };
-    this.options.metrics?.duration('zlink.relocation.interruption', seconds, attributes);
-    this.options.metrics?.count('zlink.relocation.completed', 1, {
+    this.options.metrics?.duration(METRIC_NAMES.RelocationInterruption, seconds, attributes);
+    this.options.metrics?.count(METRIC_NAMES.RelocationCompleted, 1, {
       mesh_name: meshName,
       object_kind: unitKind,
       policy: unitKind === 'user_spot' && executionMode === 'per_actor' ? 'recreate' : 'configured',
@@ -4095,6 +4396,26 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     return value;
   }
 
+  private afterSpotCloseDecision<T>(
+    meshName: string,
+    spotId: RoutingId,
+    seal: () => T
+  ): T | Promise<T> {
+    const manager = this.requireSpotManager();
+    const sealAfterDecision = (): T => {
+      if (manager.isSpotClosing(meshName, spotId)) {
+        throw createInternalFrameworkException(
+          ZLinkFrameworkInternalErrorKind.SpotMoving,
+          `Spot '${String(spotId)}' is closing.`,
+          true
+        );
+      }
+      return seal();
+    };
+    const decision = manager.pendingSpotCloseDecision(meshName, spotId);
+    return decision === undefined ? sealAfterDecision() : decision.then(sealAfterDecision);
+  }
+
   private requireActorManager(): DefaultZLinkActorManager {
     const value = this.options.actorManager();
     if (value === undefined) throw new Error('Host relocation requires the Actor manager.');
@@ -4231,14 +4552,7 @@ function actorJoinTargetMembership(
   ];
 }
 
-function relocationDebug(marker: string, detail: Record<string, unknown>): void {
-  if (process.env.ZLINK_DEBUG_FRAMEWORK_RELOCATION !== '1') return;
-  console.error('[zlink.runtime.relocation]', marker, detail);
-}
-
 class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden> {
-  private readonly deferredJoinRoots = new Map<string, ZLinkDeferredJoinAcceptedRoot>();
-
   constructor(
     private readonly options: ZLinkHostRelocationOptions,
     private readonly meshName: string,
@@ -4266,8 +4580,8 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
         participant.stableType,
         participant.objectGeneration,
         participant.authorityOwnerGeneration + 1n,
-        (nativeEntrySpot ? localDescriptor.rid : spotIdentity) as RoutingId,
-        nativeEntrySpot ? localDescriptor.lifecycleGeneration : membership.spotObjectGeneration,
+        nativeEntrySpot ? undefined : (spotIdentity as RoutingId),
+        membership.spotObjectGeneration,
         membership.membershipEpoch,
         signal
       );
@@ -4407,11 +4721,22 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
         hidden.participant.objectKind === 'user_spot' &&
         registration.options?.relocationCoordinationMode ===
           ZLinkSpotRelocationCoordinationMode.ApplicationSignaled;
+      // createHidden could only predict the owner generation; the native Spot
+      // takes the committed authority, as the Actor branch does above.
+      const node = this.options.meshNode(this.meshName);
+      node?.restoreSpotAuthority?.(
+        String(hidden.activation.spotId),
+        // createHidden stages an activation only for a Spot participant.
+        hidden.participant.objectKind as 'user_spot' | 'instance_spot',
+        hidden.participant.stableType,
+        authority.objectGeneration,
+        authority.authorityOwnerGeneration
+      );
       await this.requireSpotManager().publishRelocationSpot(
         hidden.activation,
         applicationSignaled ? () => hidden.activation!.notifyRelocatedBoundary() : undefined
       );
-      this.options.meshNode(this.meshName)?.rememberSpotRoute?.({
+      node?.rememberSpotRoute?.({
         spot: {
           spotId: String(hidden.activation.spotId),
           generation: authority.objectGeneration
@@ -4442,14 +4767,13 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
   }
 
   async restoreBoundSession(hidden: LocalHidden, payload: Uint8Array): Promise<void> {
-    if (hidden.actor === undefined || payload.byteLength === 0) return;
-    const target = decodeActorSession(payload);
-    const state = this.requireActorManager().getState(hidden.actor.context.actorId)!;
-    state.setRemoteBoundSessionTarget(target);
-    state.setBoundSessionTransferTarget(target);
-    if (target.bindingGeneration !== undefined) {
-      state.setBoundSessionBindingGeneration(target.bindingGeneration);
-    }
+    const carried = decodeActorSession(payload);
+    if (hidden.actor === undefined || carried === undefined) return;
+    // The relocation delivers the binding it carried; the target installs it
+    // through the one install rule (Session–Actor binding §6, §8).
+    this.requireActorManager()
+      .getState(hidden.actor.context.actorId)!
+      .installBoundSessionBinding(carried);
   }
 
   async replayQueuedMessage(
@@ -4464,14 +4788,7 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
       if (recovery.request.actorId !== hidden.actor.context.actorId) {
         throw new Error('Canonical Actor Join recovery names a different staged Actor.');
       }
-      const deferred = await this.requireSpotManager().restoreCanonicalActorJoinRecovery(
-        recovery,
-        undefined,
-        inventoryDigest(this.envelope.participants, this.envelope.memberships)
-      );
-      if (deferred !== undefined) {
-        this.deferredJoinRoots.set(hidden.authorityKey, deferred);
-      }
+      await this.requireSpotManager().restoreCanonicalActorJoinRecovery(recovery);
       return;
     }
     const packet = decodeQueuedHandoffPacket(message);
@@ -4480,10 +4797,6 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
     hidden.replayPackets.push(packet);
   }
 
-  deferredJoinRoot(authorityKey: string): ZLinkDeferredJoinAcceptedRoot | undefined {
-    return this.deferredJoinRoots.get(authorityKey);
-  }
-
   async openAdmission(hidden: LocalHidden): Promise<void> {
     if (hidden.actor === undefined) return;
     this.requireActorManager().publishRelocationActor(hidden.actor.context.actorId);
@@ -4916,9 +5229,11 @@ export function createServiceRelocationId(
   entropy: (size: number) => Uint8Array = randomBytes
 ): string {
   for (;;) {
-    const bytes = entropy(16);
-    if (bytes.byteLength !== 16) {
-      throw new Error('Relocation identity entropy must return exactly 16 bytes.');
+    const bytes = entropy(OPERATION_IDENTITY_BYTES);
+    if (bytes.byteLength !== OPERATION_IDENTITY_BYTES) {
+      throw new Error(
+        `Relocation identity entropy must return exactly ${OPERATION_IDENTITY_BYTES} bytes.`
+      );
     }
     let nonZero = false;
     for (const byte of bytes) {
@@ -4959,19 +5274,64 @@ function sameCoordinator(
 ): boolean {
   return (
     left.ownerId === right.ownerId &&
-    left.leaseGeneration === right.leaseGeneration &&
+    BigInt(left.leaseGeneration) === right.leaseGeneration &&
     left.nodeRid === right.nodeRid &&
-    left.nodeGeneration === right.nodeGeneration &&
+    BigInt(left.nodeGeneration) === right.nodeGeneration &&
     left.expectedAuthorityStoreVersion === right.expectedAuthorityStoreVersion
   );
 }
 
+function sameRelocationTarget(
+  left: ServiceWireRelocationTarget,
+  right: ServiceWireRelocationTarget
+): boolean {
+  return (
+    left.nodeRid === right.nodeRid &&
+    BigInt(left.nodeGeneration) === right.nodeGeneration &&
+    left.ownerId === right.ownerId &&
+    BigInt(left.ownerLeaseGeneration) === right.ownerLeaseGeneration
+  );
+}
+
+function sameRelocationObject(
+  left: ServiceWireRelocationObject,
+  right: ServiceWireRelocationObject
+): boolean {
+  if (left.kind !== right.kind || BigInt(left.objectGeneration) !== right.objectGeneration) {
+    return false;
+  }
+  if (left.kind === 'actor' && right.kind === 'actor') {
+    return (
+      left.actorId === right.actorId &&
+      BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration
+    );
+  }
+  if (left.kind === 'userSpot' && right.kind === 'userSpot') {
+    return (
+      left.spotId === right.spotId &&
+      BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration
+    );
+  }
+  return (
+    left.kind === 'instanceSpot' &&
+    right.kind === 'instanceSpot' &&
+    left.spotId === right.spotId &&
+    left.stableType === right.stableType
+  );
+}
+
 function isExactSourceAuthority(
   current: ZLinkAuthoritySnapshot,
   expected: ZLinkAuthoritySnapshot
 ): boolean {
   return (
-    current.storeVersion.value === expected.storeVersion.value &&
+    current.storeVersion.value === expected.storeVersion.value && isSourceOwner(current, expected)
+  );
+}
+
+/** The same source tenure owns the row, at any StoreVersion. */
+function isSourceOwner(current: ZLinkAuthoritySnapshot, expected: ZLinkAuthoritySnapshot): boolean {
+  return (
     current.objectGeneration === expected.objectGeneration &&
     current.authorityOwnerGeneration === expected.authorityOwnerGeneration &&
     current.ownerId === expected.ownerId &&
@@ -5002,36 +5362,6 @@ function isExactCommittedTarget(
   );
 }
 
-async function waitForLocationRetry(
-  deadlineAtMs: number,
-  signal: AbortSignal | undefined,
-  cause: unknown
-): Promise<void> {
-  signal?.throwIfAborted();
-  if (performance.now() >= deadlineAtMs) {
-    throw new Error(
-      'location_update_failed: relocation Restore validity expired before exact target owner confirmation.',
-      { cause }
-    );
-  }
-  await new Promise<void>((resolve, reject) => {
-    let timer: ReturnType<typeof setTimeout> | undefined;
-    const aborted = () => {
-      if (timer !== undefined) clearTimeout(timer);
-      reject(signal?.reason);
-    };
-    signal?.addEventListener('abort', aborted, { once: true });
-    timer = setTimeout(
-      () => {
-        signal?.removeEventListener('abort', aborted);
-        resolve();
-      },
-      Math.min(25, Math.max(1, deadlineAtMs - performance.now()))
-    );
-    timer.unref();
-  });
-}
-
 async function waitForRelocationRetry(delayMs: number, signal?: AbortSignal): Promise<void> {
   signal?.throwIfAborted();
   await new Promise<void>((resolve, reject) => {
@@ -5045,7 +5375,6 @@ async function waitForRelocationRetry(delayMs: number, signal?: AbortSignal): Pr
       signal?.removeEventListener('abort', aborted);
       resolve();
     }, delayMs);
-    timer.unref();
   });
 }
 
@@ -5087,14 +5416,16 @@ function maintenanceReplyRelay(
     replyRouteId: BigInt(completion.source.replyRouteId),
     participantId,
     sequence: BigInt(completion.index + 1),
-    terminalResult: completion.result.ok ? 0 : 105,
-    failureCode: completion.result.ok ? 0 : 17,
+    terminalResult: completion.result.ok ? RequestResult.Ok : RequestResult.InternalError,
+    failureCode: completion.result.ok
+      ? ServiceWireFrameworkErrorCode.none
+      : ServiceWireFrameworkErrorCode.requestFailed,
     ...(value === undefined
       ? {}
       : {
           payload: {
-            packetName: 'zlink.relocation.reply',
-            contentType: 'application/json',
+            packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
+            contentType: ZlinkStreamContentType.Json,
             bytes: Buffer.from(JSON.stringify(value), 'utf8')
           }
         })
@@ -5108,16 +5439,16 @@ function handoffResultFromRelay(relay: ServiceMaintenanceReplyRelay): ZLinkActor
   let value: unknown;
   if (relay.payload !== undefined) {
     if (
-      relay.terminalResult !== 0 ||
-      relay.payload.packetName !== 'zlink.relocation.reply' ||
-      relay.payload.contentType !== 'application/json'
+      relay.terminalResult !== RequestResult.Ok ||
+      relay.payload.packetName !== SERVICE_RELOCATION_REPLY_PACKET_NAME ||
+      relay.payload.contentType !== ZlinkStreamContentType.Json
     ) {
       throw new TypeError('Relocation terminal payload boundary is invalid.');
     }
     value = JSON.parse(Buffer.from(relay.payload.bytes).toString('utf8')) as unknown;
   }
   const index = Number(relay.sequence - 1n);
-  return relay.terminalResult === 0
+  return relay.terminalResult === RequestResult.Ok
     ? { index, ok: true, ...(value === undefined ? {} : { response: value }) }
     : { index, ok: false, error: `Actor handoff failed with framework code ${relay.failureCode}.` };
 }
@@ -5133,76 +5464,15 @@ function wireIdText(value: { readonly high: bigint; readonly low: bigint }): str
  */
 export class ServiceRelocationDataLostError extends Error {}
 
-/**
- * Maps a target-side relocation Prepare failure to the closest wire
- * framework-error code the generated schema
- * ({@link ServiceWireFrameworkErrorCode}) defines — mirrors the java
- * reference mapping (commit 97fc074058) and the dotnet/cpp ports. The wire
- * vocabulary predates the framework's typed error kinds and has no
- * one-to-one code for every kind, so several kinds share the nearest fit
- * (documented per case below); unresolvable vocabulary gaps belong at the
- * schema level, not invented here. {@link ServiceRelocationDataLostError}
- * is this runtime's dedicated tag for a verified checksum/assembly/digest
- * integrity failure — the case that keeps relocationDataLost(35). An
- * unclassified error carries no evidence of integrity loss and takes the
- * generic opaque requestFailed(17). `objectKind` (the Prepare's
- * ObjectFence.kind, spec 28 §4.2) picks between an Actor- and
- * Spot-specific code where the schema splits by object kind.
- */
-export function relocationFailedFailureCode(
-  error: unknown,
-  objectKind: ServiceWireRelocationObject['kind']
-): number {
+/** Classifies relocation failure with the error model §2.1 mapping. */
+export function relocationFailedFailureCode(error: unknown): number {
   if (error instanceof ServiceRelocationDataLostError) {
-    return ServiceWireFrameworkErrorCode.relocationDataLost;
+    return frameworkRelocationFailureCode(ZLinkFrameworkErrorKind.DataLost);
   }
   if (!(error instanceof ZLinkFrameworkException)) {
-    return ServiceWireFrameworkErrorCode.requestFailed;
-  }
-  switch (error.kind) {
-    case ZLinkFrameworkErrorKind.DataLost:
-      return ServiceWireFrameworkErrorCode.relocationDataLost;
-    case ZLinkFrameworkErrorKind.Rejected:
-      return ServiceWireFrameworkErrorCode.requestRejected;
-    case ZLinkFrameworkErrorKind.ProtocolError:
-      return ServiceWireFrameworkErrorCode.requestProtocolError;
-    //  No dedicated "deadline exceeded" wire code exists; a worker timeout
-    //  is the closest timeout-shaped signal.
-    case ZLinkFrameworkErrorKind.DeadlineExceeded:
-      return ServiceWireFrameworkErrorCode.workerTimedOut;
-    //  A stale generation/fence is the concrete cause of InvalidOperation
-    //  along this path (spec 15 failure table); pick the
-    //  object-kind-specific stale code.
-    case ZLinkFrameworkErrorKind.InvalidOperation:
-      return objectKind === 'actor'
-        ? ServiceWireFrameworkErrorCode.actorLocationStale
-        : ServiceWireFrameworkErrorCode.spotGenerationStale;
-    //  No dedicated generic "unavailable" wire code exists; a disconnected
-    //  route is the closest "cannot reach/use the target" signal.
-    case ZLinkFrameworkErrorKind.Unavailable:
-      return ServiceWireFrameworkErrorCode.routeNotConnected;
-    case ZLinkFrameworkErrorKind.NotFound:
-      return ServiceWireFrameworkErrorCode.requestTargetNotFound;
-    //  The only "already exists" wire code is Actor-specific; not expected
-    //  along this target-failure path, mapped for completeness.
-    case ZLinkFrameworkErrorKind.AlreadyExists:
-      return ServiceWireFrameworkErrorCode.actorAlreadyExists;
-    case ZLinkFrameworkErrorKind.TypeMismatch:
-      return objectKind === 'actor'
-        ? ServiceWireFrameworkErrorCode.actorTypeMismatch
-        : ServiceWireFrameworkErrorCode.spotTypeMismatch;
-    //  No dedicated "not configured" wire code exists; a missing configured
-    //  handler is the closest analog.
-    case ZLinkFrameworkErrorKind.NotConfigured:
-      return ServiceWireFrameworkErrorCode.handlerNotFound;
-    //  No dedicated generic "internal failure" or "shutting down" wire code
-    //  exists; the generic opaque request-failure code is the closest fit
-    //  for both (ShuttingDown included — re-judged 2026-08-19, C-10).
-    case ZLinkFrameworkErrorKind.ShuttingDown:
-    case ZLinkFrameworkErrorKind.InternalFailure:
-    default:
-      return ServiceWireFrameworkErrorCode.requestFailed;
+    return frameworkRelocationFailureCode(ZLinkFrameworkErrorKind.InternalFailure);
   }
+  return frameworkRelocationFailureCode(error);
 }
 
 function relocationStagingId(value: {
@@ -5315,7 +5585,7 @@ function validatePrepareEnvelope(
   if (
     !sameWireId(request.relocation, relocationWireId(envelope.aggregateId)) ||
     request.applicationVersion !== envelope.applicationVersion ||
-    stringifyWire(request.object) !== stringifyWire(relocationObject(envelope))
+    !sameRelocationObject(request.object, relocationObject(envelope))
   ) {
     throw new Error('Relocation Prepare does not match its immutable root identity.');
   }
@@ -5332,17 +5602,10 @@ function validateTargetOneWayControl(
     !sameWireId(request.relocation, prepare.relocation) ||
     request.targetAttemptGeneration !== prepare.targetAttemptGeneration ||
     !sameCoordinator(request.coordinator, prepare.coordinator) ||
-    stringifyWire(request.object) !==
-      stringifyWire(request.kind === 'data' ? request.object : prepare.object)
+    (request.kind === 'cutover' && !sameRelocationObject(request.object, prepare.object))
   ) {
     throw new Error('Relocation one-way control changed its exact Prepare fence.');
   }
-  if (
-    request.kind === 'cutover' &&
-    stringifyWire(request.object) !== stringifyWire(prepare.object)
-  ) {
-    throw new Error('Relocation Cutover changed its prepared object.');
-  }
 }
 
 function relocationPublication(
@@ -5447,7 +5710,7 @@ function canonicalQueuedFrozenRecord(
     ...(packet.returnResponse ? { replyRouteId: BigInt(packet.source!.replyRouteId) } : {}),
     payload: {
       packetName: '__zlink.actor.handoff.accepted',
-      contentType: 'application/json',
+      contentType: ZlinkStreamContentType.Json,
       bytes: message.payload
     }
   });
@@ -5471,6 +5734,20 @@ function stringifyWire(value: unknown): string {
   return JSON.stringify(value, (_key, item) => (typeof item === 'bigint' ? item.toString() : item));
 }
 
+function samePrepareIdentity(
+  acceptedFingerprint: string,
+  incoming: ServiceMaintenanceRelocationPrepare
+): boolean {
+  const accepted = JSON.parse(acceptedFingerprint) as ServiceMaintenanceRelocationPrepare;
+  return (
+    accepted.sourceNodeRid === incoming.sourceNodeRid &&
+    BigInt(accepted.sourceNodeGeneration) === incoming.sourceNodeGeneration &&
+    sameCoordinator(accepted.coordinator, incoming.coordinator) &&
+    sameRelocationTarget(accepted.target, incoming.target) &&
+    sameRelocationObject(accepted.object, incoming.object)
+  );
+}
+
 function validateControlResponse(
   request: ZLinkServiceRelocationControlRequest,
   response: ZLinkServiceRelocationControlResponse
@@ -5481,8 +5758,8 @@ function validateControlResponse(
     !sameWireId(response.relocation, request.relocation) ||
     response.targetAttemptGeneration !== request.targetAttemptGeneration ||
     !sameCoordinator(response.coordinator, request.coordinator) ||
-    stringifyWire(response.target) !== stringifyWire(request.target) ||
-    stringifyWire(response.object) !== stringifyWire(request.object) ||
+    !sameRelocationTarget(response.target, request.target) ||
+    !sameRelocationObject(response.object, request.object) ||
     response.senderRole !== 'target'
   ) {
     throw new Error('Relocation control response does not match the request fence.');
@@ -5505,82 +5782,19 @@ function validateControlFailureResponse(
     !sameWireId(response.relocation, request.relocation) ||
     response.targetAttemptGeneration !== request.targetAttemptGeneration ||
     !sameCoordinator(response.coordinator, request.coordinator) ||
-    stringifyWire(response.target) !== stringifyWire(request.target) ||
-    stringifyWire(response.object) !== stringifyWire(request.object) ||
+    !sameRelocationTarget(response.target, request.target) ||
+    !sameRelocationObject(response.object, request.object) ||
     response.senderRole !== 'target'
   ) {
     throw new Error('Relocation control response does not match the request fence.');
   }
 }
 
-/**
- * Maps a relocationFailed(53) wire failureCode (the generated
- * ServiceWireFrameworkErrorCode vocabulary) to its internal error kind, so a
- * source-side reject carries the same classification the target chose
- * instead of a generic Error. Direct 1:1 correspondence with the generated
- * names; an unrecognised or absent code falls back to RequestFailed
- * (InternalFailure) — the closest existing kind (spec 15 §"Failed.Kind").
- */
-function relocationFailureCodeKind(failureCode: number): ZLinkFrameworkInternalErrorKind {
-  switch (failureCode) {
-    case 1:
-      return ZLinkFrameworkInternalErrorKind.ActorRouteNotFound;
-    case 2:
-      return ZLinkFrameworkInternalErrorKind.ActorCreateFailed;
-    case 3:
-      return ZLinkFrameworkInternalErrorKind.ActorAlreadyExists;
-    case 4:
-      return ZLinkFrameworkInternalErrorKind.ActorTypeMismatch;
-    case 5:
-      return ZLinkFrameworkInternalErrorKind.SpotCreateFailed;
-    case 6:
-      return ZLinkFrameworkInternalErrorKind.SpotRouteNotFound;
-    case 7:
-      return ZLinkFrameworkInternalErrorKind.SpotTypeMismatch;
-    case 8:
-      return ZLinkFrameworkInternalErrorKind.ActorSessionNotBound;
-    case 9:
-      return ZLinkFrameworkInternalErrorKind.HandlerNotFound;
-    case 10:
-      return ZLinkFrameworkInternalErrorKind.RouteHandlerNotFound;
-    case 11:
-      return ZLinkFrameworkInternalErrorKind.ActorDispatchHandlerNotFound;
-    case 12:
-      return ZLinkFrameworkInternalErrorKind.PayloadDecodeFailed;
-    case 13:
-      return ZLinkFrameworkInternalErrorKind.RouteNotConnected;
-    case 14:
-      return ZLinkFrameworkInternalErrorKind.RequestTargetNotFound;
-    case 15:
-      return ZLinkFrameworkInternalErrorKind.RequestRejected;
-    case 16:
-      return ZLinkFrameworkInternalErrorKind.RequestProtocolError;
-    case 18:
-      return ZLinkFrameworkInternalErrorKind.WorkerQueueFull;
-    case 19:
-      return ZLinkFrameworkInternalErrorKind.WorkerTimedOut;
-    case 20:
-      return ZLinkFrameworkInternalErrorKind.WorkerFailed;
-    case 21:
-      return ZLinkFrameworkInternalErrorKind.ActorLocationStale;
-    case 22:
-      return ZLinkFrameworkInternalErrorKind.ActorCreateRejected;
-    case 33:
-      return ZLinkFrameworkInternalErrorKind.SpotGenerationStale;
-    case 34:
-      return ZLinkFrameworkInternalErrorKind.SpotMoving;
-    case 35:
-      return ZLinkFrameworkInternalErrorKind.RelocationDataLost;
-    case 17:
-    default:
-      return ZLinkFrameworkInternalErrorKind.RequestFailed;
-  }
-}
-
 /** Builds the typed exception a Prepare waiter rejects with on an explicit Failed(53). */
 function relocationFailureException(response: ServiceMaintenanceRelocationFailed) {
   return createInternalFrameworkException(
-    relocationFailureCodeKind(response.failureCode),
+    internalFrameworkErrorKindFromWireFailureCode(response.failureCode) ??
+      ZLinkFrameworkInternalErrorKind.RequestFailed,
     `Relocation '${response.relocation.high}:${response.relocation.low}:` +
       `${response.targetAttemptGeneration}' failed with wire failureCode ${response.failureCode}.`,
     true
@@ -5760,7 +5974,7 @@ function queuedMessageU64(value: unknown, field: string): bigint {
     throw new TypeError(`Relocation Actor Message Follow ${field} is invalid.`);
   }
   const result = BigInt(value);
-  if (result > 0xffff_ffff_ffff_ffffn) {
+  if (result > UINT64_MAX) {
     throw new TypeError(`Relocation Actor Message Follow ${field} is outside u64.`);
   }
   return result;
@@ -5784,6 +5998,15 @@ function toServiceTimer(
   };
 }
 
+const PREPARE_SIDEBAND_MAGIC = 'ZLNI';
+const PREPARE_SIDEBAND_VERSION = 1;
+const PREPARE_SIDEBAND_HEADER_BYTES = 11;
+const PREPARE_SIDEBAND_VERSION_OFFSET = 4;
+const PREPARE_SIDEBAND_KEY_LENGTH_OFFSET = 5;
+const PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET = 7;
+const ACTOR_SESSION_JOURNAL_VERSION = 1;
+const SERVICE_RELOCATION_REPLY_PACKET_NAME = 'zlink.relocation.reply';
+
 /**
  * NODE-INTERNAL Prepare sideband. Frame zero remains the exact canonical
  * command-40 schema record; each following ZLNI frame carries one sealed
@@ -5799,11 +6022,11 @@ function encodePrepareSideband(envelope: ServiceRelocationEnvelope): readonly Bu
       if (key.byteLength === 0 || key.byteLength > 0xffff || payload.byteLength > 0xffff_ffff) {
         throw new TypeError('Bound-session relocation sideband is out of bounds.');
       }
-      const header = Buffer.allocUnsafe(11);
-      header.write('ZLNI', 0, 'ascii');
-      header[4] = 1;
-      header.writeUInt16BE(key.byteLength, 5);
-      header.writeUInt32BE(payload.byteLength, 7);
+      const header = Buffer.allocUnsafe(PREPARE_SIDEBAND_HEADER_BYTES);
+      header.write(PREPARE_SIDEBAND_MAGIC, 0, 'ascii');
+      header[PREPARE_SIDEBAND_VERSION_OFFSET] = PREPARE_SIDEBAND_VERSION;
+      header.writeUInt16BE(key.byteLength, PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+      header.writeUInt32BE(payload.byteLength, PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
       return Buffer.concat([header, key, payload]);
     });
 }
@@ -5819,19 +6042,29 @@ function decodePrepareSideband(frames: readonly Uint8Array[]):
   for (const frame of frames) {
     const bytes = Buffer.from(frame);
     if (
-      bytes.byteLength < 11 ||
-      bytes.subarray(0, 4).toString('ascii') !== 'ZLNI' ||
-      bytes[4] !== 1
+      bytes.byteLength < PREPARE_SIDEBAND_HEADER_BYTES ||
+      bytes.subarray(0, PREPARE_SIDEBAND_VERSION_OFFSET).toString('ascii') !==
+        PREPARE_SIDEBAND_MAGIC ||
+      bytes[PREPARE_SIDEBAND_VERSION_OFFSET] !== PREPARE_SIDEBAND_VERSION
     ) {
       return undefined;
     }
-    const keyLength = bytes.readUInt16BE(5);
-    const payloadLength = bytes.readUInt32BE(7);
-    if (11 + keyLength + payloadLength !== bytes.byteLength || keyLength === 0) return undefined;
-    const participantKey = bytes.subarray(11, 11 + keyLength).toString('utf8');
+    const keyLength = bytes.readUInt16BE(PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+    const payloadLength = bytes.readUInt32BE(PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
+    if (
+      PREPARE_SIDEBAND_HEADER_BYTES + keyLength + payloadLength !== bytes.byteLength ||
+      keyLength === 0
+    )
+      return undefined;
+    const participantKey = bytes
+      .subarray(PREPARE_SIDEBAND_HEADER_BYTES, PREPARE_SIDEBAND_HEADER_BYTES + keyLength)
+      .toString('utf8');
     if (keys.has(participantKey)) return undefined;
     keys.add(participantKey);
-    result.push({ participantKey, payload: Buffer.from(bytes.subarray(11 + keyLength)) });
+    result.push({
+      participantKey,
+      payload: Buffer.from(bytes.subarray(PREPARE_SIDEBAND_HEADER_BYTES + keyLength))
+    });
   }
   return result;
 }
@@ -5862,13 +6095,16 @@ function encodeActorSession(target: ZLinkRemoteBoundSessionTarget | undefined):
   if (target === undefined) return Buffer.alloc(0);
   return Buffer.from(
     JSON.stringify({
-      version: 1,
+      version: ACTOR_SESSION_JOURNAL_VERSION,
       routerChannelId: target.routerChannelId,
       targetNodeRid: String(target.targetNodeRid),
       spotId: String(target.spotId),
       sessionNodeRid:
         target.sessionNodeRid === undefined ? undefined : String(target.sessionNodeRid),
       sessionRid: target.sessionRid === undefined ? undefined : String(target.sessionRid),
+      sessionOwnerNodeGeneration: target.sessionOwnerNodeGeneration?.toString(),
+      sessionOwnerId: target.sessionOwnerId,
+      sessionOwnerLeaseGeneration: target.sessionOwnerLeaseGeneration?.toString(),
       bindingGeneration: target.bindingGeneration?.toString(),
       previousAuthorityOwnerGeneration: target.previousAuthorityOwnerGeneration?.toString(),
       previousOwnerLeaseGeneration: target.previousOwnerLeaseGeneration?.toString(),
@@ -5901,12 +6137,13 @@ function encodeActorSession(target: ZLinkRemoteBoundSessionTarget | undefined):
   );
 }
 
-function decodeActorSession(payload: Uint8Array): ZLinkRemoteBoundSessionTarget {
+function decodeActorSession(payload: Uint8Array): ZLinkRemoteBoundSessionTarget | undefined {
+  if (payload.byteLength === 0) return undefined;
   const value = JSON.parse(Buffer.from(payload).toString('utf8')) as Record<string, unknown>;
   const optionalBigInt = (field: string) =>
     typeof value[field] === 'string' ? BigInt(value[field] as string) : undefined;
   if (
-    value.version !== 1 ||
+    value.version !== ACTOR_SESSION_JOURNAL_VERSION ||
     typeof value.routerChannelId !== 'string' ||
     typeof value.targetNodeRid !== 'string' ||
     typeof value.spotId !== 'string'
@@ -5922,6 +6159,13 @@ function decodeActorSession(payload: Uint8Array): ZLinkRemoteBoundSessionTarget
       ? { sessionNodeRid: value.sessionNodeRid as RoutingId }
       : {}),
     ...(typeof value.sessionRid === 'string' ? { sessionRid: value.sessionRid as RoutingId } : {}),
+    ...(optionalBigInt('sessionOwnerNodeGeneration') === undefined
+      ? {}
+      : { sessionOwnerNodeGeneration: optionalBigInt('sessionOwnerNodeGeneration') }),
+    ...(typeof value.sessionOwnerId === 'string' ? { sessionOwnerId: value.sessionOwnerId } : {}),
+    ...(optionalBigInt('sessionOwnerLeaseGeneration') === undefined
+      ? {}
+      : { sessionOwnerLeaseGeneration: optionalBigInt('sessionOwnerLeaseGeneration') }),
     ...(optionalBigInt('bindingGeneration') === undefined
       ? {}
       : { bindingGeneration: optionalBigInt('bindingGeneration') }),
@@ -6034,3 +6278,16 @@ function addCapacity(left: ZLinkCapacityVector, right: ZLinkCapacityVector): ZLi
         })
   };
 }
+
+if (isStructuralGuardEnabled()) {
+  const relocateActorJoin = ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin;
+  ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin = function (
+    this: ZLinkHostServiceRelocationRuntime,
+    input: Parameters<ZLinkActorJoinRelocation['relocateActorJoin']>[0]
+  ): ReturnType<ZLinkActorJoinRelocation['relocateActorJoin']> {
+    return trackDiagnosticCompletion(
+      relocateActorJoin.call(this, input),
+      `relocation join actor:${input.state.actorId}`
+    );
+  };
+}