@zlink-systems/framework 0.26.0 → 0.27.0

package/dist/runtime/host/service-relocation-host-runtime.js

@@ -5,36 +5,50 @@ exports.decodeQueuedHandoffPacket = decodeQueuedHandoffPacket;
 exports.createServiceRelocationId = createServiceRelocationId;
 exports.relocationFailedFailureCode = relocationFailedFailureCode;
 exports.encodeHandoffQueuedMessages = encodeHandoffQueuedMessages;
+const stream_wire_1 = require("@zlink-systems/stream-wire");
 const node_crypto_1 = require("node:crypto");
-const runtime_values_1 = require("../backend/runtime-values");
 const contracts_1 = require("../../contracts");
 const Options_1 = require("../../contracts/Locations/Options");
-const framework_errors_internal_1 = require("../framework-errors-internal");
-const service_runtime_contracts_1 = require("../foundation/service-runtime-contracts");
-const routing_id_1 = require("../routing-id");
-const service_wire_m6a_codec_1 = require("../foundation/service-wire-m6a-codec");
-const service_relocation_runtime_1 = require("../foundation/service-relocation-runtime");
-const relocation_direct_transfer_1 = require("./relocation-direct-transfer");
-const relocation_state_adapter_1 = require("./relocation-state-adapter");
-const service_relocation_coordinator_1 = require("../foundation/service-relocation-coordinator");
+const Stores_1 = require("../../contracts/Locations/Stores");
+const actor_authority_publication_1 = require("../actors/actor-authority-publication");
+const actor_handoff_1 = require("../actors/actor-handoff");
+const actor_remote_wire_1 = require("../actors/actor-remote-wire");
+const actor_runtime_state_1 = require("../actors/actor-runtime-state");
+const runtime_values_1 = require("../backend/runtime-values");
+const diagnostics_1 = require("../diagnostics");
+const runtime_metrics_1 = require("../diagnostics/runtime-metrics");
+const state_lane_1 = require("../execution/state-lane");
+const actor_join_recovery_codec_1 = require("../foundation/actor-join-recovery-codec");
+const operation_identity_1 = require("../foundation/operation-identity");
+const service_authority_payload_codec_1 = require("../foundation/service-authority-payload-codec");
 const service_maintenance_runtime_1 = require("../foundation/service-maintenance-runtime");
-const service_relocation_object_owner_1 = require("../foundation/service-relocation-object-owner");
 const service_relocation_aggregate_committer_1 = require("../foundation/service-relocation-aggregate-committer");
+const service_relocation_coordinator_1 = require("../foundation/service-relocation-coordinator");
+const service_relocation_object_owner_1 = require("../foundation/service-relocation-object-owner");
+const service_relocation_runtime_1 = require("../foundation/service-relocation-runtime");
+const service_runtime_contracts_1 = require("../foundation/service-runtime-contracts");
+const service_stateful_wire_codec_1 = require("../foundation/service-stateful-wire-codec");
+const service_wire_constants_generated_1 = require("../foundation/service-wire-constants.generated");
+const service_wire_m6a_codec_1 = require("../foundation/service-wire-m6a-codec");
+const framework_errors_internal_1 = require("../framework-errors-internal");
+const authority_key_codec_1 = require("../locations/authority-key-codec");
+const location_store_failure_1 = require("../locations/location-store-failure");
+const routing_id_1 = require("../routing-id");
 const spot_provider_1 = require("../spots/spot-provider");
-const actor_runtime_state_1 = require("../actors/actor-runtime-state");
-const actor_handoff_1 = require("../actors/actor-handoff");
 const spot_remote_codec_1 = require("../spots/spot-remote-codec");
-const actor_authority_publication_1 = require("../actors/actor-authority-publication");
-const service_authority_payload_codec_1 = require("../foundation/service-authority-payload-codec");
 const actor_transfer_runtime_1 = require("./actor-transfer-runtime");
-const authority_key_codec_1 = require("../locations/authority-key-codec");
-const service_relocation_control_1 = require("./service-relocation-control");
-const service_stateful_wire_codec_1 = require("../foundation/service-stateful-wire-codec");
-const service_wire_constants_generated_1 = require("../foundation/service-wire-constants.generated");
 const bounded_replay_map_1 = require("./bounded-replay-map");
+const relocation_direct_transfer_1 = require("./relocation-direct-transfer");
 const relocation_integrity_fault_gate_1 = require("./relocation-integrity-fault-gate");
-const actor_remote_wire_1 = require("../actors/actor-remote-wire");
-const actor_join_recovery_codec_1 = require("../foundation/actor-join-recovery-codec");
+const relocation_state_adapter_1 = require("./relocation-state-adapter");
+const service_relocation_control_1 = require("./service-relocation-control");
+const RELOCATION_ATTEMPT_TIMEOUT_MS = 250;
+const RELOCATION_AUTHORITY_RETRY_DELAY_MS = 25;
+const RELOCATION_MAX_SEND_ATTEMPTS = 120;
+const RELOCATION_AUTHORITY_POLL_INTERVAL_MS = 10;
+const RELOCATION_RESEND_DELAY_MS = 250;
+const RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+const RELOCATION_OPERATION_TIMEOUT_MS = 30_000;
 class ZLinkRelocationStateIncompatibleError extends Error {
     constructor(message) {
         super(message);
@@ -68,8 +82,7 @@ class ZLinkHostServiceRelocationRuntime {
      * Terminal restore failures (assembly/checksum/factory/restore error): the
      * target already sent relocationFailed (command 53) once. An exact-identity
      * Prepare resend replays the stored response rather than retrying the
-     * restore; a different exact identity reusing the same RelocationId+attempt
-     * key supersedes the stale entry (spec 28 §3, §9).
+     * restore. A different exact identity never changes this entry (spec 28 §4.3).
      */
     targetReadyFailures = new Map();
     /**
@@ -109,8 +122,13 @@ class ZLinkHostServiceRelocationRuntime {
         }
         this.reserveExactRelocationId(input.relocationId);
         let resolveReady;
-        const ready = new Promise((resolve) => {
-            resolveReady = resolve;
+        const ready = new Promise((resolve, reject) => {
+            resolveReady = (failure) => {
+                if (failure === undefined)
+                    resolve();
+                else
+                    reject(failure.cause);
+            };
         });
         this.sourceActorJoinProfiles.set(input.relocationId, {
             actor: input.actor,
@@ -121,8 +139,8 @@ class ZLinkHostServiceRelocationRuntime {
             targetNodeRid: input.target.targetNodeRid,
             relocationContentType: this.actorRegistration(input.state.meshName ?? input.meshName, input.state.actorType ?? '')
                 .relocation.kind === 'snapshot'
-                ? 'application/vnd.zlink.actor-relocation.snapshot'
-                : 'application/vnd.zlink.actor-relocation.recreate',
+                ? actor_join_recovery_codec_1.SNAPSHOT_RELOCATION_CONTENT_TYPE
+                : actor_join_recovery_codec_1.RECREATE_RELOCATION_CONTENT_TYPE,
             completionOperationId: input.completionOperationId,
             canonicalRecovery: input.canonicalRecovery,
             ready,
@@ -141,8 +159,14 @@ class ZLinkHostServiceRelocationRuntime {
             resolveReady();
         }
         catch (error) {
-            this.sourceActorJoinProfiles.delete(input.relocationId);
-            throw error;
+            if (error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) {
+                resolveReady(error);
+                this.completeActorJoinSourceCleanup(input.state.actorId);
+            }
+            else {
+                this.sourceActorJoinProfiles.delete(input.relocationId);
+                throw error;
+            }
         }
         return {
             actorRef: {
@@ -157,20 +181,11 @@ class ZLinkHostServiceRelocationRuntime {
     async dispose() {
         this.disposed = true;
         const errors = [];
-        for (const stage of this.targetStages.values()) {
-            if (stage.fallback !== undefined)
-                clearTimeout(stage.fallback);
-            try {
-                if (stage.finalize !== undefined) {
-                    await stage.finalize;
-                }
-                else if (stage.phase === 'ready') {
-                    await this.abortTargetStage(stage);
-                }
-            }
-            catch (error) {
-                errors.push(error);
-            }
+        try {
+            await this.drainTargetAttempts();
+        }
+        catch (error) {
+            errors.push(error);
         }
         this.targetStages.clear();
         this.terminalTargets.clear();
@@ -213,22 +228,67 @@ class ZLinkHostServiceRelocationRuntime {
         if (errors.length > 1)
             throw new AggregateError(errors, 'Relocation runtime stop failed.');
     }
+    /** Host shutdown waits for the existing attempt terminal before releasing its lease. */
+    async drainTargetAttempts() {
+        const results = await Promise.allSettled([...this.targetStages.entries()].map(([stagingId, stage]) => {
+            if (stage.fallback !== undefined)
+                clearTimeout(stage.fallback);
+            return stage.lane.finally(() => {
+                if (stage.phase === 'failed')
+                    return stage.finalize;
+                if (this.targetStageSealed(stage)) {
+                    const terminal = this.discardTargetStage(stagingId, stage);
+                    stage.finalize = terminal;
+                    return terminal;
+                }
+                return this.beginTargetFinalize(stage.offer.reservation.prepared.plan.targetDescriptor.meshName, stagingId, stage);
+            });
+        }));
+        const errors = results.flatMap((result) => result.status === 'rejected' ? [result.reason] : []);
+        if (errors.length === 1)
+            throw errors[0];
+        if (errors.length > 1)
+            throw new AggregateError(errors, 'Relocation target drain failed.');
+    }
+    /** Spec 28 §4.4: the target owner alone orders shutdown seal and verified cutover. */
+    targetStageSealed(stage) {
+        return (!stage.cutoverReceived && (this.disposed || this.options.targetAdmissionSealed?.() === true));
+    }
     completeActorJoinSourceCleanup(actorId) {
         for (const [relocationId, profile] of this.sourceActorJoinProfiles) {
             if (profile.state.actorId !== actorId)
                 continue;
             this.sourceActorJoinProfiles.delete(relocationId);
             this.terminalActorJoinSourceLeaves.remember(relocationId, actorId);
-            void profile.ready
-                .then(async () => {
-                await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
-                await this.options
-                    .actorManager()
-                    ?.completeRelocationSource(actorId, profile.sourceActorRef);
-            })
-                .catch((error) => {
-                console.error('[zlink.runtime.relocation.source_cleanup_failed]', error);
-            });
+            void this.finalizeActorJoinSource(profile);
+        }
+    }
+    async finalizeActorJoinSource(profile) {
+        const failures = [];
+        try {
+            await profile.ready;
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        try {
+            await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        try {
+            await this.options
+                .actorManager()
+                ?.completeRelocationSource(profile.state.actorId, profile.sourceActorRef);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        if (failures.length > 0) {
+            console.error('[zlink.runtime.relocation.source_cleanup_failed]', failures.length === 1
+                ? failures[0]
+                : new AggregateError(failures, 'Actor source retirement failed.'));
         }
     }
     async relocateMesh(meshName, targetApplicationVersion, signal, stopStartingSignal) {
@@ -305,13 +365,18 @@ class ZLinkHostServiceRelocationRuntime {
                 ready: () => true,
                 relocate: (relocationSignal) => {
                     const run = unit.relocate(relocationSignal);
+                    if ((0, state_lane_1.isStructuralGuardEnabled)()) {
+                        (0, state_lane_1.trackDiagnosticCompletion)(run, `relocation ${unit.id}`);
+                    }
                     started.push(run);
                     return run;
                 }
             });
         }
         const operationSignal = signal ?? new AbortController().signal;
-        const deadlineMs = signal === undefined ? 30_000 : 24 * 60 * 60 * 1000;
+        const deadlineMs = signal === undefined
+            ? RELOCATION_OPERATION_TIMEOUT_MS
+            : RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS;
         let failure;
         try {
             const result = await raceAbort(maintenance.start('retire', deadlineMs, stopStartingSignal, operationSignal), operationSignal);
@@ -400,41 +465,50 @@ class ZLinkHostServiceRelocationRuntime {
             }
             const operationKey = relocationStagingId(request);
             const fingerprint = stringifyWire(request);
+            const readyFailure = this.targetReadyFailures.get(operationKey);
+            const readyPending = this.targetReadyResponses.get(operationKey);
+            let operation = this.targetPrepareOperations.get(operationKey);
+            const acceptedFingerprint = readyFailure?.fingerprint ??
+                readyPending?.fingerprint ??
+                operation?.fingerprint ??
+                this.targetAssemblies.get(operationKey)?.fingerprint ??
+                this.targetStages.get(operationKey)?.offer.prepareFingerprint ??
+                this.terminalTargets.get(operationKey);
+            if (request.sourceNodeRid !== String(record.sourceNodeRid))
+                return true;
+            if (acceptedFingerprint !== undefined && acceptedFingerprint !== fingerprint) {
+                if (!samePrepareIdentity(acceptedFingerprint, request))
+                    return true;
+                this.replyPrepare(record, relocationFailed(request, service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost));
+                return true;
+            }
             // A restore that failed outright is terminal: the source observes the
             // same explicit relocationFailed on every identical Prepare resend
-            // rather than a silent stall. A different exact identity reusing the
-            // same RelocationId+attempt key supersedes the stale failure — the
-            // newer attempt wins (spec 28 §3).
-            const readyFailure = this.targetReadyFailures.get(operationKey);
+            // rather than a silent stall.
             if (readyFailure !== undefined) {
-                if (readyFailure.fingerprint === fingerprint) {
-                    this.replyPrepare(record, readyFailure.response);
-                    return true;
-                }
-                this.targetReadyFailures.delete(operationKey);
+                this.replyPrepare(record, readyFailure.response);
+                return true;
             }
             // Spec 28: an exact-identity Restore resend against staging that
             // already restored successfully reuses that staging — it re-submits
             // READY rather than restarting the restore.
-            const readyPending = this.targetReadyResponses.get(operationKey);
             if (readyPending !== undefined) {
-                if (readyPending.fingerprint !== fingerprint) {
-                    throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-                }
                 this.submitTargetReady(meshName, operationKey, record, readyPending.response);
                 return true;
             }
-            let operation = this.targetPrepareOperations.get(operationKey);
-            if (operation !== undefined && operation.fingerprint !== fingerprint) {
-                throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-            }
             if (operation === undefined) {
                 // The prepare turn must not block the ordered dispatch lane: the
                 // payload chunks that complete this operation arrive as later records
                 // on the same connection. Register the assembly synchronously, then
                 // finish the restore and the Ready reply asynchronously.
-                this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
-                const promise = this.handlePrepareControl(meshName, operationKey, request, record.sourceNodeRid, signal);
+                let promise;
+                try {
+                    this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
+                    promise = this.handlePrepareControl(meshName, operationKey, request, record.sourceNodeRid, signal);
+                }
+                catch (error) {
+                    promise = Promise.reject(error);
+                }
                 operation = { fingerprint, promise };
                 this.targetPrepareOperations.set(operationKey, operation);
                 void promise
@@ -462,7 +536,7 @@ class ZLinkHostServiceRelocationRuntime {
             // restore or staging): this is terminal. Send relocationFailed
             // (command 53) once and remember it so an identical Prepare resend
             // replays the same response instead of retrying the restore.
-            const failed = relocationFailed(request, relocationFailedFailureCode(error, request.object.kind));
+            const failed = relocationFailed(request, relocationFailedFailureCode(error));
             this.targetReadyFailures.set(operationKey, {
                 fingerprint: stringifyWire(request),
                 response: failed
@@ -543,7 +617,7 @@ class ZLinkHostServiceRelocationRuntime {
             String(sourceNodeRid) !== pending.authenticatedSourceNodeRid ||
             request.senderRole !== 'source' ||
             !sameCoordinator(request.coordinator, pending.prepare.coordinator) ||
-            stringifyWire(request.object) !== stringifyWire(pending.prepare.object)) {
+            !sameRelocationObject(request.object, pending.prepare.object)) {
             // Spec 28 §4.3 — a chunk with a different exact identity is never
             // attached to an in-progress assembly; it is discarded.
             console.warn('[zlink.runtime.relocation.stale_state_chunk]', operationKey);
@@ -562,12 +636,6 @@ class ZLinkHostServiceRelocationRuntime {
     registerTargetAssembly(operationKey, request, authenticatedSourceNodeRid) {
         const existing = this.targetAssemblies.get(operationKey);
         if (existing !== undefined) {
-            if (existing.fingerprint !== stringifyWire(request)) {
-                // Same exact identity with a different declared length or checksum is
-                // an explicit conflict failure; the existing assembly is neither
-                // reused nor overwritten (spec 28 §4.3).
-                throw existing.assembly.fail(`Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`);
-            }
             return existing;
         }
         const pending = {
@@ -578,12 +646,7 @@ class ZLinkHostServiceRelocationRuntime {
         };
         this.targetAssemblies.set(operationKey, pending);
         if (this.relocationIntegrityFaultGate()?.consumeIdentityConflict() === true) {
-            // Route a same-identity, different-manifest delivery through the normal
-            // conflict branch so existing staging is neither reused nor overwritten.
-            return this.registerTargetAssembly(operationKey, {
-                ...request,
-                payloadChecksumCrc32c: request.payloadChecksumCrc32c ^ 1
-            }, authenticatedSourceNodeRid);
+            throw new ServiceRelocationDataLostError(pending.assembly.fail(`Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`).message);
         }
         return pending;
     }
@@ -710,7 +773,7 @@ class ZLinkHostServiceRelocationRuntime {
                     return;
                 }
                 if (this.pendingSessionRelocations.get(key) === pending) {
-                    pending.retryTimer = setTimeout(() => void send(), 250);
+                    pending.retryTimer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
                 }
             }
             catch (error) {
@@ -848,7 +911,7 @@ class ZLinkHostServiceRelocationRuntime {
         }
     }
     async relocateSpotAggregate(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal) {
-        await activation.serial.executeLifecycleOperation(() => this.relocateSpotAggregateCore(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal));
+        await activation.serial.executeControlLifecycleOperation(() => this.relocateSpotAggregateCore(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal));
     }
     async relocateSpotAggregateCore(meshName, activation, kind, actorStates, target, targetApplicationVersion, signal) {
         const store = this.requireLocationStore();
@@ -915,34 +978,64 @@ class ZLinkHostServiceRelocationRuntime {
             },
             captureApplicationState: (captureSignal) => this.captureApplication(spotRegistration.relocation, activation.spot, captureSignal),
             commitSeal: async () => {
-                if (!spotSealCommitted) {
-                    if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
-                        throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+                const failures = [];
+                try {
+                    if (!spotSealCommitted) {
+                        if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
+                            throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+                        }
+                        spotSealCommitted = true;
+                    }
+                    if (spotMessageFollowSeal !== undefined) {
+                        await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
                     }
-                    spotSealCommitted = true;
                 }
-                if (spotMessageFollowSeal !== undefined) {
-                    await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
+                catch (error) {
+                    failures.push(error);
                 }
                 for (const session of sessions) {
-                    const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', session.state.actorId));
-                    const targetActorRef = {
-                        actorId: session.state.actorId,
-                        objectGeneration: actorAuthorities.get(session.state.actorId).objectGeneration,
-                        meshName,
-                        nodeRid: target.rid
-                    };
-                    await session.prepared.commit({
-                        routerChannelId: meshName,
-                        targetNodeRid: target.rid,
-                        spotId: activation.spotId,
-                        spotKind: kind === 'user_spot' ? contracts_1.ZLinkSpotKind.User : contracts_1.ZLinkSpotKind.Instance,
-                        authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-                    }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(session.state.actorId, targetActorRef, committedAuthority));
-                    activation.commitActorDeparture(session.state.actorId);
-                    await this.requireActorManager().completeRelocationSource(session.state.actorId);
+                    try {
+                        const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', session.state.actorId));
+                        const targetActorRef = {
+                            actorId: session.state.actorId,
+                            objectGeneration: actorAuthorities.get(session.state.actorId).objectGeneration,
+                            meshName,
+                            nodeRid: target.rid
+                        };
+                        await session.prepared.commit({
+                            routerChannelId: meshName,
+                            targetNodeRid: target.rid,
+                            spotId: activation.spotId,
+                            spotKind: kind === 'user_spot' ? contracts_1.ZLinkSpotKind.User : contracts_1.ZLinkSpotKind.Instance,
+                            authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+                        }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(session.state.actorId, targetActorRef, committedAuthority));
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                    try {
+                        activation.commitActorDeparture(session.state.actorId);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
+                    try {
+                        await this.requireActorManager().completeRelocationSource(session.state.actorId);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
                 }
-                await this.requireSpotManager().completeRelocationSource(activation);
+                try {
+                    await this.requireSpotManager().completeRelocationSource(activation);
+                }
+                catch (error) {
+                    failures.push(error);
+                }
+                if (failures.length > 0)
+                    throw failures.length === 1
+                        ? failures[0]
+                        : new AggregateError(failures, 'Spot source retirement failed.');
             },
             abortSeal: async () => {
                 const failures = [];
@@ -1029,7 +1122,9 @@ class ZLinkHostServiceRelocationRuntime {
     async relocateStandaloneActor(meshName, state, target, targetApplicationVersion, signal, targetMembership, aggregateIdOverride, retainSourceForActorJoin = false, 
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes) {
-        relocationDebug('standalone_actor.begin', { actorId: state.actorId });
+        if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+            (0, diagnostics_1.relocationDebug)('standalone_actor.begin', { actorId: state.actorId });
+        }
         const authority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId), signal);
         target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, [
             {
@@ -1062,14 +1157,20 @@ class ZLinkHostServiceRelocationRuntime {
         };
         let outcome = 'completed';
         try {
-            relocationDebug('standalone_actor.wait_budget', {
-                actorId: state.actorId,
-                targetRid: String(target.rid)
-            });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('standalone_actor.wait_budget', {
+                    actorId: state.actorId,
+                    targetRid: String(target.rid)
+                });
+            }
             await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
-            relocationDebug('standalone_actor.capture_begin', { actorId: state.actorId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('standalone_actor.capture_begin', { actorId: state.actorId });
+            }
             const captured = await new service_relocation_object_owner_1.ServiceRelocationObjectCaptureOwner().captureStandaloneActor(aggregateId, 1n, measuredUnit, membership, signal);
-            relocationDebug('standalone_actor.capture_complete', { actorId: state.actorId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('standalone_actor.capture_complete', { actorId: state.actorId });
+            }
             await this.runCoordinator(meshName, target, authority, captured, new Map([[measuredUnit.authorityKey, authority]]), signal, sessions, advertisedReceiveChunkLimitBytes);
         }
         catch (error) {
@@ -1084,7 +1185,7 @@ class ZLinkHostServiceRelocationRuntime {
         }
     }
     async relocatePerActorSpotShell(meshName, activation, target, targetApplicationVersion, signal) {
-        await activation.serial.executeLifecycleOperation(() => this.relocatePerActorSpotShellCore(meshName, activation, target, targetApplicationVersion, signal));
+        await activation.serial.executeControlLifecycleOperation(() => this.relocatePerActorSpotShellCore(meshName, activation, target, targetApplicationVersion, signal));
     }
     async relocatePerActorSpotShellCore(meshName, activation, target, targetApplicationVersion, signal) {
         const spotKey = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(activation.spotId));
@@ -1201,24 +1302,39 @@ class ZLinkHostServiceRelocationRuntime {
                     target === undefined ||
                     meshName === undefined)
                     return;
-                const membershipSpotId = targetMembership?.spotId ?? (target.entrySpotId ?? String(target.rid));
-                const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId));
-                const targetActorRef = {
-                    actorId: state.actorId,
-                    objectGeneration: authority.objectGeneration,
-                    meshName,
-                    nodeRid: target.rid
-                };
-                await ownSession.prepared.commit({
-                    routerChannelId: meshName,
-                    targetNodeRid: target.rid,
-                    spotId: membershipSpotId,
-                    spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry,
-                    authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-                }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(state.actorId, targetActorRef, committedAuthority));
+                const failures = [];
+                try {
+                    const membershipSpotId = targetMembership?.spotId ?? (target.entrySpotId ?? String(target.rid));
+                    const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId));
+                    const targetActorRef = {
+                        actorId: state.actorId,
+                        objectGeneration: authority.objectGeneration,
+                        meshName,
+                        nodeRid: target.rid
+                    };
+                    await ownSession.prepared.commit({
+                        routerChannelId: meshName,
+                        targetNodeRid: target.rid,
+                        spotId: membershipSpotId,
+                        spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry,
+                        authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+                    }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(state.actorId, targetActorRef, committedAuthority));
+                }
+                catch (error) {
+                    failures.push(error);
+                }
                 if (!retainSourceForActorJoin) {
-                    await this.requireActorManager().completeRelocationSource(state.actorId);
+                    try {
+                        await this.requireActorManager().completeRelocationSource(state.actorId);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                    }
                 }
+                if (failures.length > 0)
+                    throw failures.length === 1
+                        ? failures[0]
+                        : new AggregateError(failures, 'Actor source retirement failed.');
             },
             abortSeal: async () => {
                 if (standalone && ownSession !== undefined)
@@ -1252,12 +1368,16 @@ class ZLinkHostServiceRelocationRuntime {
     async runCoordinator(meshName, target, primary, captured, _authorities, signal, sessions = [], 
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes) {
-        relocationDebug('coordinator.begin', {
-            aggregateId: captured.envelope.aggregateId,
-            targetRid: String(target.rid)
-        });
+        if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+            (0, diagnostics_1.relocationDebug)('coordinator.begin', {
+                aggregateId: captured.envelope.aggregateId,
+                targetRid: String(target.rid)
+            });
+        }
         const localStatus = this.requireMeshNode(meshName).status();
-        const controlDeadlineAtMs = signal === undefined ? performance.now() + 30_000 : Number.MAX_SAFE_INTEGER;
+        const controlDeadlineAtMs = signal === undefined
+            ? performance.now() + RELOCATION_OPERATION_TIMEOUT_MS
+            : Number.MAX_SAFE_INTEGER;
         const coordinator = {
             ownerId: primary.ownerId,
             leaseGeneration: primary.ownerLeaseGeneration,
@@ -1306,7 +1426,6 @@ class ZLinkHostServiceRelocationRuntime {
         const restoreDeadlineReached = () => signal?.aborted === true || performance.now() >= controlDeadlineAtMs;
         let readyReceived = false;
         let settlement;
-        let sourceCommitted = false;
         try {
             const prepare = {
                 kind: 'prepare',
@@ -1329,18 +1448,26 @@ class ZLinkHostServiceRelocationRuntime {
             // the target assembled, verified, and restored the payload.
             const readyOperation = this.sendControl(meshName, target.rid, prepare, signal, controlDeadlineAtMs, encodePrepareSideband(captured.envelope));
             try {
-                relocationDebug('coordinator.state_transfer_begin', {
-                    aggregateId: captured.envelope.aggregateId
-                });
+                if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                    (0, diagnostics_1.relocationDebug)('coordinator.state_transfer_begin', {
+                        aggregateId: captured.envelope.aggregateId
+                    });
+                }
                 await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, signal);
             }
             catch (chunkError) {
                 readyOperation.catch(() => undefined);
                 throw chunkError;
             }
-            relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+            }
             const ready = await readyOperation;
-            relocationDebug('coordinator.ready_received', { aggregateId: captured.envelope.aggregateId });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('coordinator.ready_received', {
+                    aggregateId: captured.envelope.aggregateId
+                });
+            }
             validateControlResponse(prepare, ready);
             // Ready arms the target's cutover-wait fallback. From this point
             // forward the source can no longer reopen dispatch without risking two
@@ -1402,10 +1529,12 @@ class ZLinkHostServiceRelocationRuntime {
             finally {
                 this.closeSourceCutoverWindow(relayAuthorityId, window);
             }
-            relocationDebug('coordinator.authority_settled', {
-                aggregateId: captured.envelope.aggregateId,
-                settlement
-            });
+            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                (0, diagnostics_1.relocationDebug)('coordinator.authority_settled', {
+                    aggregateId: captured.envelope.aggregateId,
+                    settlement
+                });
+            }
             if (settlement === 'source') {
                 // Preserve won: the captured queue, timers and held records return to
                 // the source queue in their accepted order, and dispatch reopens.
@@ -1422,20 +1551,13 @@ class ZLinkHostServiceRelocationRuntime {
             for (const session of sessions)
                 session.prepared.setReplayResults([]);
             await captured.commitSource();
-            sourceCommitted = true;
             await this.options.reconcileStatefulAuthorityRoutes?.(signal);
         }
         catch (error) {
             if (settlement !== 'target')
                 throw error;
             // Target commit is confirmed; later source cleanup failures cannot move
-            // the authority back (spec 28 §9).
-            if (!sourceCommitted) {
-                for (const session of sessions)
-                    session.prepared.setReplayResults([]);
-                await captured.commitSource().catch(() => undefined);
-            }
-            await this.options.reconcileStatefulAuthorityRoutes?.().catch(() => undefined);
+            // the authority back (spec 28 §10).
             const authority = await requireAuthority(this.requireLocationStore(), { value: primaryKey(captured.envelope) }, undefined);
             throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, { id: `${captured.envelope.aggregateId}:${captured.envelope.aggregateGeneration}` }, error);
         }
@@ -1532,7 +1654,7 @@ class ZLinkHostServiceRelocationRuntime {
             window.followExpired = true;
             // S1→S4 route convergence: the span the source must keep its Message
             // Follow route (spec 30 §7.1).
-            this.options.metrics?.duration('zlink.relocation.route_convergence', Math.max(0, performance.now() - submittedAt) / 1000, { mesh_name: meshName });
+            this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationRouteConvergence, Math.max(0, performance.now() - submittedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND, { mesh_name: meshName });
             this.releaseSourceCutoverWindow(relocationKey, window);
         }, limits.messageFollowDurationMs);
         window.followTimer.unref();
@@ -1562,8 +1684,7 @@ class ZLinkHostServiceRelocationRuntime {
             return;
         const peers = this.requireMeshNode(window.meshName).peers();
         const peer = peers.find((value) => value.routingId !== null && String(value.routingId) === String(window.targetNodeRid));
-        // Backend peer state 3 is Ready.
-        if (peer !== undefined && peer.state !== 3) {
+        if (peer !== undefined && peer.state !== service_runtime_contracts_1.MeshPeerRuntimeState.Serving) {
             window.resendPending = true;
             return;
         }
@@ -1597,14 +1718,22 @@ class ZLinkHostServiceRelocationRuntime {
             if (this.disposed)
                 throw new Error('Relocation runtime stopped.');
             await this.resendSourceCutover(window);
-            const observed = await this.readSourceSettlement(envelope, primary, target).catch(() => undefined);
+            const observed = await this.readSourceSettlement(envelope, primary, target).catch((error) => {
+                if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error))
+                    throw error;
+                return undefined;
+            });
             if (observed?.kind === 'target')
                 return 'target';
             if (observed?.kind === 'other')
                 return 'lost';
             if (restoreDeadlineReached() && observed?.kind === 'source') {
                 // An unreadable lease is an uncertain result, not an expiry.
-                if (await this.exactSourceLeaseExpired(owner).catch(() => false))
+                if (await this.exactSourceLeaseExpired(owner).catch((error) => {
+                    if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error))
+                        throw error;
+                    return false;
+                }))
                     return 'lost';
                 const publication = this.codec.read(observed.current.payload);
                 const preserved = await store
@@ -1615,12 +1744,16 @@ class ZLinkHostServiceRelocationRuntime {
                         ? observed.current.payload
                         : this.codec.clear(observed.current.payload, publication.reference)
                 })
-                    .catch(() => undefined);
+                    .catch((error) => {
+                    if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error))
+                        throw error;
+                    return undefined;
+                });
                 if (preserved?.kind === 'stored')
                     return 'source';
             }
             // The caller awaits this settlement, so the retry timer keeps the loop alive.
-            await new Promise((resolve) => setTimeout(resolve, 10));
+            await new Promise((resolve) => setTimeout(resolve, RELOCATION_AUTHORITY_POLL_INTERVAL_MS));
         }
     }
     async readSourceSettlement(envelope, primary, target) {
@@ -1680,9 +1813,6 @@ class ZLinkHostServiceRelocationRuntime {
     }
     /** Restores the hidden object and its saved-work prefix before Ready. */
     async handlePrepareControl(meshName, stagingId, request, sourceNodeRid, signal) {
-        if (sourceNodeRid === null || String(sourceNodeRid) !== request.sourceNodeRid) {
-            throw new Error('Relocation prepare source node fence does not match the authenticated peer.');
-        }
         const targetStatus = this.requireMeshNode(meshName).status();
         const targetOwner = this.options.currentOwner();
         const targetDescriptor = this.options.localDescriptor?.(meshName);
@@ -1698,22 +1828,15 @@ class ZLinkHostServiceRelocationRuntime {
         const fingerprint = stringifyWire(request);
         const existing = this.targetStages.get(stagingId);
         if (existing !== undefined) {
-            if (existing.offer.authenticatedSourceNodeRid !== String(sourceNodeRid) ||
-                existing.offer.prepareFingerprint !== fingerprint) {
-                throw new Error('Relocation prepare retry source node changed.');
-            }
             return relocationReady(request);
         }
         const terminal = this.terminalTargets.get(stagingId);
         if (terminal !== undefined) {
-            if (terminal !== fingerprint) {
-                throw new Error(`Relocation '${stagingId}' repeated Prepare with different bytes.`);
-            }
             this.terminalTargets.touch(stagingId);
             return relocationReady(request);
         }
         const pendingAssembly = this.targetAssemblies.get(stagingId);
-        if (pendingAssembly === undefined || pendingAssembly.fingerprint !== fingerprint) {
+        if (pendingAssembly === undefined) {
             throw new Error(`Relocation '${stagingId}' has no matching payload assembly.`);
         }
         // The directly transferred payload replaces the shared durable root: the
@@ -1795,7 +1918,7 @@ class ZLinkHostServiceRelocationRuntime {
             if (stage.finalize !== undefined)
                 return;
             console.warn('[zlink.runtime.relocation.cutover_timeout]', stagingId);
-            this.options.metrics?.count('zlink.relocation.cutover_timeout', 1, {
+            this.options.metrics?.count(runtime_metrics_1.METRIC_NAMES.RelocationCutoverTimeout, 1, {
                 mesh_name: meshName
             });
             void this.beginTargetFinalize(meshName, stagingId, stage).catch((error) => console.error('[zlink.runtime.relocation.location_update_failed]', error));
@@ -1809,7 +1932,7 @@ class ZLinkHostServiceRelocationRuntime {
         const stagingId = relocationStagingId(request);
         const stage = this.targetStages.get(stagingId);
         if (stage === undefined) {
-            if (this.terminalTargets.get(stagingId) !== undefined) {
+            if (this.disposed || this.terminalTargets.get(stagingId) !== undefined) {
                 if (request.kind === 'cutover') {
                     console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
                 }
@@ -1818,21 +1941,26 @@ class ZLinkHostServiceRelocationRuntime {
             throw new Error(`Relocation staging '${stagingId}' is missing.`);
         }
         validateTargetOneWayControl(stage, request, sourceNodeRid);
-        // A verified cutover closes the boundary batch. A later record or cutover
-        // is a duplicate retransmission and never changes the staged batch.
-        if (stage.cutoverReceived || (stage.phase !== 'ready' && stage.phase !== 'finalizing')) {
-            if (request.kind === 'cutover') {
-                console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+        stage.lane = stage.lane.then(() => {
+            // A verified cutover closes the boundary batch. A later record or cutover
+            // is a duplicate retransmission and never changes the staged batch.
+            if (stage.cutoverReceived || (stage.phase !== 'ready' && stage.phase !== 'finalizing')) {
+                if (request.kind === 'cutover') {
+                    console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+                }
+                return;
             }
+            if (request.kind === 'data') {
+                return this.stageBoundaryRelay(stage, request);
+            }
+            if (this.targetStageSealed(stage))
+                return;
+            this.reconcileBoundaryRelay(stage, request, stagingId);
+            stage.cutoverReceived = true;
+        });
+        await stage.lane;
+        if (request.kind === 'data')
             return;
-        }
-        if (request.kind === 'data') {
-            stage.lane = stage.lane.then(() => this.stageBoundaryRelay(stage, request));
-            await stage.lane;
-            return;
-        }
-        this.reconcileBoundaryRelay(stage, request, stagingId);
-        stage.cutoverReceived = true;
         // A settlement started by the cutover wait Warning is still reading the
         // Store; it submits the CAS on its next round now that cutover verified.
         if (stage.finalize !== undefined)
@@ -1894,10 +2022,10 @@ class ZLinkHostServiceRelocationRuntime {
         try {
             authority = await this.commitTargetReservation(stage, stage.offer.reservation, signal);
             if (authority === undefined) {
-                // Source Preserve, a definitive conflict or the target lease ended
-                // this staging before any target commit (Location runtime §10).
-                console.warn('[zlink.runtime.relocation.target_staging_discarded]', stagingId);
-                throw new Error(`Relocation '${stagingId}' target staging lost the authority settlement.`);
+                // The seal owner may have ended staging while a Store read was pending.
+                if (stage.phase === 'failed')
+                    return;
+                return this.discardTargetStage(stagingId, stage, signal);
             }
             authorityCommitted = true;
             stage.releaseActivation();
@@ -1930,7 +2058,7 @@ class ZLinkHostServiceRelocationRuntime {
             }
             await stage.owner.openAdmission(stage.staging, signal);
             // S2→S3: owner confirmation to application dispatch opening.
-            this.options.metrics?.duration('zlink.relocation.target_resume', Math.max(0, performance.now() - resumeStartedAt) / 1000, { mesh_name: meshName });
+            this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationTargetResume, Math.max(0, performance.now() - resumeStartedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND, { mesh_name: meshName });
             await this.publishSessionRoutes(stage.staging);
             await this.relayTerminalReplies(meshName, stage, this.targetReplyRelayCoordinator(meshName, stage, authority), signal);
             stage.phase = 'open';
@@ -1939,14 +2067,16 @@ class ZLinkHostServiceRelocationRuntime {
             this.targetAssemblies.delete(stagingId);
         }
         catch (error) {
-            stage.phase = 'failed';
             this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
             this.targetStages.delete(stagingId);
             this.targetAssemblies.delete(stagingId);
             if (!authorityCommitted) {
-                await this.abortTargetStage(stage).catch(() => undefined);
+                // abortTargetStage may already have assigned failed before throwing.
+                if (stage.phase !== 'failed')
+                    await this.abortTargetStage(stage);
                 throw error;
             }
+            stage.phase = 'failed';
             if (authority !== undefined) {
                 throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, stage.staging, error);
             }
@@ -2030,16 +2160,7 @@ class ZLinkHostServiceRelocationRuntime {
         }
         this.sourceActorJoinProfiles.delete(input.transferId);
         this.terminalActorJoinSourceLeaves.remember(input.transferId, input.actorId);
-        void profile.ready
-            .then(async () => {
-            await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
-            await this.options
-                .actorManager()
-                ?.completeRelocationSource(input.actorId, profile.sourceActorRef);
-        })
-            .catch((error) => {
-            console.error('[zlink.runtime.relocation.source_leave_failed]', error);
-        });
+        void this.finalizeActorJoinSource(profile);
         return true;
     }
     async sendControlOneWay(meshName, targetNodeRid, request) {
@@ -2148,13 +2269,13 @@ class ZLinkHostServiceRelocationRuntime {
                         pending.resolve('sourceLeaseExpired');
                         return;
                     }
-                    if (++attempts > 120) {
+                    if (++attempts > RELOCATION_MAX_SEND_ATTEMPTS) {
                         pending.reject(new Error(`Relocation reply relay ACK '${key}' timed out.`));
                         return;
                     }
                     await this.sendInfrastructureControl(meshName, ackTargetNodeRid, (0, service_stateful_wire_codec_1.encodeMaintenanceReplyRelay)(request));
                     if (this.pendingReplyRelays.get(key) === pending) {
-                        pending.timer = setTimeout(() => void send(), 250);
+                        pending.timer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
                     }
                 }
                 catch (error) {
@@ -2249,13 +2370,15 @@ class ZLinkHostServiceRelocationRuntime {
             lease.leaseExpiresAt.getTime() <= lease.storeNow.getTime());
     }
     async publishSessionRoutes(staging) {
-        for (const hidden of staging.hidden.values()) {
-            if (hidden.actor !== undefined) {
-                await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor);
-            }
+        for (const [key, hidden] of staging.hidden) {
+            if (hidden.actor === undefined)
+                continue;
+            // The Session seal travels with the relocation envelope, not the Actor.
+            const carried = staging.envelope.participants.find((value) => value.key === key);
+            await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor, carried === undefined ? undefined : decodeActorSession(carried.boundSessionState));
         }
     }
-    async sendControl(meshName, targetNodeRid, request, signal, deadlineAtMs = performance.now() + 30_000, sideband = []) {
+    async sendControl(meshName, targetNodeRid, request, signal, deadlineAtMs = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS, sideband = []) {
         const key = controlAckKey(request);
         const frames = sideband.length === 0
             ? [(0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request)]
@@ -2267,7 +2390,7 @@ class ZLinkHostServiceRelocationRuntime {
             if (remainingMs <= 0) {
                 throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Relocation control ACK '${key}' timed out.`, true, lastRequestError);
             }
-            const attemptTimeoutMs = Math.max(1, Math.min(250, Math.ceil(remainingMs)));
+            const attemptTimeoutMs = Math.max(1, Math.min(RELOCATION_ATTEMPT_TIMEOUT_MS, Math.ceil(remainingMs)));
             const startedAtMs = performance.now();
             try {
                 const replyFrames = await this.requestInfrastructureControl(meshName, targetNodeRid, frames, attemptTimeoutMs);
@@ -2287,11 +2410,13 @@ class ZLinkHostServiceRelocationRuntime {
                     throw error;
                 }
                 lastRequestError = error;
-                relocationDebug('control.request_retry', {
-                    key,
-                    kind: request.kind,
-                    targetRid: String(targetNodeRid)
-                });
+                if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+                    (0, diagnostics_1.relocationDebug)('control.request_retry', {
+                        key,
+                        kind: request.kind,
+                        targetRid: String(targetNodeRid)
+                    });
+                }
                 const retryDelayMs = Math.min(Math.max(0, attemptTimeoutMs - (performance.now() - startedAtMs)), Math.max(0, deadlineAtMs - performance.now()));
                 if (retryDelayMs > 0) {
                     await waitForRelocationRetry(retryDelayMs, signal);
@@ -2316,7 +2441,7 @@ class ZLinkHostServiceRelocationRuntime {
             peers.some((peer) => peer.routingId !== null &&
                 String(peer.routingId) === String(descriptor.rid) &&
                 peer.lifecycleGeneration === descriptor.lifecycleGeneration &&
-                peer.state === 3) &&
+                peer.state === service_runtime_contracts_1.MeshPeerRuntimeState.Serving) &&
             relocationTargetSupports(descriptor, requirements))
             .sort((left, right) => String(left.rid).localeCompare(String(right.rid)));
         const target = selectWeightedRelocationTarget(candidates);
@@ -2480,6 +2605,18 @@ class ZLinkHostServiceRelocationRuntime {
             throw new AggregateError(failures, 'Relocation target rollback was incomplete.');
         }
     }
+    async discardTargetStage(stagingId, stage, signal) {
+        stage.phase = 'failed';
+        console.warn('[zlink.runtime.relocation.target_staging_discarded]', stagingId);
+        try {
+            await this.abortTargetStage(stage, signal);
+        }
+        finally {
+            this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
+            this.targetStages.delete(stagingId);
+            this.targetAssemblies.delete(stagingId);
+        }
+    }
     async commitTargetReservation(stage, reservation, signal) {
         return await this.commitTargetAggregate(stage, reservation.prepared, signal);
     }
@@ -2497,9 +2634,11 @@ class ZLinkHostServiceRelocationRuntime {
     async commitTargetAggregate(stage, prepared, signal) {
         const target = stage.offer.prepare.target;
         for (;;) {
+            if (stage.phase === 'failed')
+                return undefined;
             signal?.throwIfAborted();
-            if (this.disposed)
-                throw new Error('Relocation runtime stopped.');
+            if (this.targetStageSealed(stage))
+                return undefined;
             let conflict = false;
             if (stage.cutoverReceived) {
                 // The boundary relay span is applied to the temporary queue before
@@ -2511,13 +2650,19 @@ class ZLinkHostServiceRelocationRuntime {
                 // A thrown provider call has an unknown result; the read below decides.
                 const result = await this.requireLocationStore()
                     .commitAggregate(prepared.fence, signal)
-                    .catch(() => undefined);
+                    .catch((error) => {
+                    if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error, signal))
+                        throw error;
+                    return undefined;
+                });
                 if (result?.kind === 'generationExhausted') {
                     throw new Error('location_update_failed: relocation aggregate commit exhausted.');
                 }
                 conflict = result?.kind === 'stale';
             }
             const observed = await this.readAggregateForCommitRetry(prepared, signal);
+            if (stage.phase === 'failed')
+                return undefined;
             if (observed.kind === 'committed') {
                 const primary = observed.authorities.get(stage.staging.primaryAuthorityKey.value);
                 if (primary === undefined) {
@@ -2528,10 +2673,14 @@ class ZLinkHostServiceRelocationRuntime {
             if (observed.kind === 'stale' || (conflict && observed.kind === 'source'))
                 return undefined;
             // An unreadable lease is an uncertain result, not an expiry.
-            if (await this.exactSourceLeaseExpired({ ownerId: target.ownerId, leaseGeneration: target.ownerLeaseGeneration }, signal).catch(() => false)) {
+            if (await this.exactSourceLeaseExpired({ ownerId: target.ownerId, leaseGeneration: target.ownerLeaseGeneration }, signal).catch((error) => {
+                if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error, signal))
+                    throw error;
+                return false;
+            })) {
                 return undefined;
             }
-            await waitForRelocationRetry(25, signal);
+            await waitForRelocationRetry(RELOCATION_AUTHORITY_RETRY_DELAY_MS, signal);
         }
     }
     async readAggregateForCommitRetry(prepared, signal) {
@@ -2560,7 +2709,9 @@ class ZLinkHostServiceRelocationRuntime {
                 }
             }
         }
-        catch {
+        catch (error) {
+            if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error, signal))
+                throw error;
             return { kind: 'unknown' };
         }
         if (committed === prepared.plan.participants.length) {
@@ -2592,7 +2743,7 @@ class ZLinkHostServiceRelocationRuntime {
         if (request.object.kind === 'userSpot' || request.object.kind === 'instanceSpot') {
             let cursor;
             for (;;) {
-                const page = await store.listAuthorities('', cursor, 1000, signal);
+                const page = await store.listAuthorities('', cursor, Stores_1.ZLINK_PROVIDER_MAX_PAGE_SIZE, signal);
                 if (page.kind === 'scanExpired') {
                     throw new Error('Location Store authority scan expired during relocation.');
                 }
@@ -2699,7 +2850,7 @@ class ZLinkHostServiceRelocationRuntime {
         const adapter = await this.createRelocationAdapter(policy.adapterType);
         const captured = await (0, relocation_state_adapter_1.captureRelocationAdapterState)(adapter, value, signal ?? new AbortController().signal);
         if (captured.byteLength > RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES) {
-            throw new ZLinkRelocationStateIncompatibleError('Relocation application state exceeds the 64 MiB participant limit.');
+            throw new ZLinkRelocationStateIncompatibleError(`Relocation application state exceeds the ${RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES / (1024 * 1024)} MiB participant limit.`);
         }
         return captured;
     }
@@ -2707,13 +2858,13 @@ class ZLinkHostServiceRelocationRuntime {
         return (await (0, spot_provider_1.createProviderInstance)(adapterType, this.options.providerResolver));
     }
     recordRelocationInterruption(meshName, unitKind, executionMode, startedAt, outcome) {
-        const seconds = Math.max(0, performance.now() - startedAt) / 1000;
+        const seconds = Math.max(0, performance.now() - startedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND;
         const attributes = {
             unit_kind: unitKind,
             ...(executionMode === undefined ? {} : { execution_mode: executionMode })
         };
-        this.options.metrics?.duration('zlink.relocation.interruption', seconds, attributes);
-        this.options.metrics?.count('zlink.relocation.completed', 1, {
+        this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationInterruption, seconds, attributes);
+        this.options.metrics?.count(runtime_metrics_1.METRIC_NAMES.RelocationCompleted, 1, {
             mesh_name: meshName,
             object_kind: unitKind,
             policy: unitKind === 'user_spot' && executionMode === 'per_actor' ? 'recreate' : 'configured',
@@ -2891,11 +3042,6 @@ function actorJoinTargetMembership(manager, relocationId, participants) {
         }
     ];
 }
-function relocationDebug(marker, detail) {
-    if (process.env.ZLINK_DEBUG_FRAMEWORK_RELOCATION !== '1')
-        return;
-    console.error('[zlink.runtime.relocation]', marker, detail);
-}
 class LocalTargetPort {
     options;
     meshName;
@@ -2916,7 +3062,7 @@ class LocalTargetPort {
             }).globalId;
             const localDescriptor = this.options.localDescriptor?.(this.meshName);
             const nativeEntrySpot = localDescriptor?.entrySpotId === spotIdentity;
-            const actor = await this.requireActorManager().prepareRelocationActor(identity, participant.stableType, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, (nativeEntrySpot ? localDescriptor.rid : spotIdentity), nativeEntrySpot ? localDescriptor.lifecycleGeneration : membership.spotObjectGeneration, membership.membershipEpoch, signal);
+            const actor = await this.requireActorManager().prepareRelocationActor(identity, participant.stableType, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, nativeEntrySpot ? undefined : spotIdentity, membership.spotObjectGeneration, membership.membershipEpoch, signal);
             return {
                 authorityKey: participant.key,
                 participant,
@@ -3002,8 +3148,14 @@ class LocalTargetPort {
             const applicationSignaled = hidden.participant.objectKind === 'user_spot' &&
                 registration.options?.relocationCoordinationMode ===
                     contracts_1.ZLinkSpotRelocationCoordinationMode.ApplicationSignaled;
+            // createHidden could only predict the owner generation; the native Spot
+            // takes the committed authority, as the Actor branch does above.
+            const node = this.options.meshNode(this.meshName);
+            node?.restoreSpotAuthority?.(String(hidden.activation.spotId), 
+            // createHidden stages an activation only for a Spot participant.
+            hidden.participant.objectKind, hidden.participant.stableType, authority.objectGeneration, authority.authorityOwnerGeneration);
             await this.requireSpotManager().publishRelocationSpot(hidden.activation, applicationSignaled ? () => hidden.activation.notifyRelocatedBoundary() : undefined);
-            this.options.meshNode(this.meshName)?.rememberSpotRoute?.({
+            node?.rememberSpotRoute?.({
                 spot: {
                     spotId: String(hidden.activation.spotId),
                     generation: authority.objectGeneration
@@ -3033,15 +3185,14 @@ class LocalTargetPort {
         hidden.initialized = true;
     }
     async restoreBoundSession(hidden, payload) {
-        if (hidden.actor === undefined || payload.byteLength === 0)
+        const carried = decodeActorSession(payload);
+        if (hidden.actor === undefined || carried === undefined)
             return;
-        const target = decodeActorSession(payload);
-        const state = this.requireActorManager().getState(hidden.actor.context.actorId);
-        state.setRemoteBoundSessionTarget(target);
-        state.setBoundSessionTransferTarget(target);
-        if (target.bindingGeneration !== undefined) {
-            state.setBoundSessionBindingGeneration(target.bindingGeneration);
-        }
+        // The relocation delivers the binding it carried; the target installs it
+        // through the one install rule (Session–Actor binding §6, §8).
+        this.requireActorManager()
+            .getState(hidden.actor.context.actorId)
+            .installBoundSessionBinding(carried);
     }
     async replayQueuedMessage(hidden, message) {
         if (hidden.actor === undefined) {
@@ -3374,9 +3525,9 @@ function relocationWireId(value) {
 }
 function createServiceRelocationId(isInUse, entropy = node_crypto_1.randomBytes) {
     for (;;) {
-        const bytes = entropy(16);
-        if (bytes.byteLength !== 16) {
-            throw new Error('Relocation identity entropy must return exactly 16 bytes.');
+        const bytes = entropy(operation_identity_1.OPERATION_IDENTITY_BYTES);
+        if (bytes.byteLength !== operation_identity_1.OPERATION_IDENTITY_BYTES) {
+            throw new Error(`Relocation identity entropy must return exactly ${operation_identity_1.OPERATION_IDENTITY_BYTES} bytes.`);
         }
         let nonZero = false;
         for (const byte of bytes) {
@@ -3409,11 +3560,34 @@ function sameWireId(left, right) {
 }
 function sameCoordinator(left, right) {
     return (left.ownerId === right.ownerId &&
-        left.leaseGeneration === right.leaseGeneration &&
+        BigInt(left.leaseGeneration) === right.leaseGeneration &&
         left.nodeRid === right.nodeRid &&
-        left.nodeGeneration === right.nodeGeneration &&
+        BigInt(left.nodeGeneration) === right.nodeGeneration &&
         left.expectedAuthorityStoreVersion === right.expectedAuthorityStoreVersion);
 }
+function sameRelocationTarget(left, right) {
+    return (left.nodeRid === right.nodeRid &&
+        BigInt(left.nodeGeneration) === right.nodeGeneration &&
+        left.ownerId === right.ownerId &&
+        BigInt(left.ownerLeaseGeneration) === right.ownerLeaseGeneration);
+}
+function sameRelocationObject(left, right) {
+    if (left.kind !== right.kind || BigInt(left.objectGeneration) !== right.objectGeneration) {
+        return false;
+    }
+    if (left.kind === 'actor' && right.kind === 'actor') {
+        return (left.actorId === right.actorId &&
+            BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration);
+    }
+    if (left.kind === 'userSpot' && right.kind === 'userSpot') {
+        return (left.spotId === right.spotId &&
+            BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration);
+    }
+    return (left.kind === 'instanceSpot' &&
+        right.kind === 'instanceSpot' &&
+        left.spotId === right.spotId &&
+        left.stableType === right.stableType);
+}
 function isExactSourceAuthority(current, expected) {
     return (current.storeVersion.value === expected.storeVersion.value && isSourceOwner(current, expected));
 }
@@ -3479,14 +3653,16 @@ function maintenanceReplyRelay(stage, coordinator, participantId, completion) {
         replyRouteId: BigInt(completion.source.replyRouteId),
         participantId,
         sequence: BigInt(completion.index + 1),
-        terminalResult: completion.result.ok ? 0 : 105,
-        failureCode: completion.result.ok ? 0 : 17,
+        terminalResult: completion.result.ok ? runtime_values_1.RequestResult.Ok : runtime_values_1.RequestResult.InternalError,
+        failureCode: completion.result.ok
+            ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.none
+            : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed,
         ...(value === undefined
             ? {}
             : {
                 payload: {
-                    packetName: 'zlink.relocation.reply',
-                    contentType: 'application/json',
+                    packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
+                    contentType: stream_wire_1.ZlinkStreamContentType.Json,
                     bytes: Buffer.from(JSON.stringify(value), 'utf8')
                 }
             })
@@ -3498,15 +3674,15 @@ function handoffResultFromRelay(relay) {
     }
     let value;
     if (relay.payload !== undefined) {
-        if (relay.terminalResult !== 0 ||
-            relay.payload.packetName !== 'zlink.relocation.reply' ||
-            relay.payload.contentType !== 'application/json') {
+        if (relay.terminalResult !== runtime_values_1.RequestResult.Ok ||
+            relay.payload.packetName !== SERVICE_RELOCATION_REPLY_PACKET_NAME ||
+            relay.payload.contentType !== stream_wire_1.ZlinkStreamContentType.Json) {
             throw new TypeError('Relocation terminal payload boundary is invalid.');
         }
         value = JSON.parse(Buffer.from(relay.payload.bytes).toString('utf8'));
     }
     const index = Number(relay.sequence - 1n);
-    return relay.terminalResult === 0
+    return relay.terminalResult === runtime_values_1.RequestResult.Ok
         ? { index, ok: true, ...(value === undefined ? {} : { response: value }) }
         : { index, ok: false, error: `Actor handoff failed with framework code ${relay.failureCode}.` };
 }
@@ -3521,73 +3697,15 @@ function wireIdText(value) {
 class ServiceRelocationDataLostError extends Error {
 }
 exports.ServiceRelocationDataLostError = ServiceRelocationDataLostError;
-/**
- * Maps a target-side relocation Prepare failure to the closest wire
- * framework-error code the generated schema
- * ({@link ServiceWireFrameworkErrorCode}) defines — mirrors the java
- * reference mapping (commit 97fc074058) and the dotnet/cpp ports. The wire
- * vocabulary predates the framework's typed error kinds and has no
- * one-to-one code for every kind, so several kinds share the nearest fit
- * (documented per case below); unresolvable vocabulary gaps belong at the
- * schema level, not invented here. {@link ServiceRelocationDataLostError}
- * is this runtime's dedicated tag for a verified checksum/assembly/digest
- * integrity failure — the case that keeps relocationDataLost(35). An
- * unclassified error carries no evidence of integrity loss and takes the
- * generic opaque requestFailed(17). `objectKind` (the Prepare's
- * ObjectFence.kind, spec 28 §4.2) picks between an Actor- and
- * Spot-specific code where the schema splits by object kind.
- */
-function relocationFailedFailureCode(error, objectKind) {
+/** Classifies relocation failure with the error model §2.1 mapping. */
+function relocationFailedFailureCode(error) {
     if (error instanceof ServiceRelocationDataLostError) {
-        return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost;
+        return (0, framework_errors_internal_1.frameworkRelocationFailureCode)(contracts_1.ZLinkFrameworkErrorKind.DataLost);
     }
     if (!(error instanceof contracts_1.ZLinkFrameworkException)) {
-        return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed;
-    }
-    switch (error.kind) {
-        case contracts_1.ZLinkFrameworkErrorKind.DataLost:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost;
-        case contracts_1.ZLinkFrameworkErrorKind.Rejected:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestRejected;
-        case contracts_1.ZLinkFrameworkErrorKind.ProtocolError:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestProtocolError;
-        //  No dedicated "deadline exceeded" wire code exists; a worker timeout
-        //  is the closest timeout-shaped signal.
-        case contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.workerTimedOut;
-        //  A stale generation/fence is the concrete cause of InvalidOperation
-        //  along this path (spec 15 failure table); pick the
-        //  object-kind-specific stale code.
-        case contracts_1.ZLinkFrameworkErrorKind.InvalidOperation:
-            return objectKind === 'actor'
-                ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorLocationStale
-                : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.spotGenerationStale;
-        //  No dedicated generic "unavailable" wire code exists; a disconnected
-        //  route is the closest "cannot reach/use the target" signal.
-        case contracts_1.ZLinkFrameworkErrorKind.Unavailable:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.routeNotConnected;
-        case contracts_1.ZLinkFrameworkErrorKind.NotFound:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestTargetNotFound;
-        //  The only "already exists" wire code is Actor-specific; not expected
-        //  along this target-failure path, mapped for completeness.
-        case contracts_1.ZLinkFrameworkErrorKind.AlreadyExists:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorAlreadyExists;
-        case contracts_1.ZLinkFrameworkErrorKind.TypeMismatch:
-            return objectKind === 'actor'
-                ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.actorTypeMismatch
-                : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.spotTypeMismatch;
-        //  No dedicated "not configured" wire code exists; a missing configured
-        //  handler is the closest analog.
-        case contracts_1.ZLinkFrameworkErrorKind.NotConfigured:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.handlerNotFound;
-        //  No dedicated generic "internal failure" or "shutting down" wire code
-        //  exists; the generic opaque request-failure code is the closest fit
-        //  for both (ShuttingDown included — re-judged 2026-08-19, C-10).
-        case contracts_1.ZLinkFrameworkErrorKind.ShuttingDown:
-        case contracts_1.ZLinkFrameworkErrorKind.InternalFailure:
-        default:
-            return service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed;
+        return (0, framework_errors_internal_1.frameworkRelocationFailureCode)(contracts_1.ZLinkFrameworkErrorKind.InternalFailure);
     }
+    return (0, framework_errors_internal_1.frameworkRelocationFailureCode)(error);
 }
 function relocationStagingId(value) {
     return `${value.relocation.high}:${value.relocation.low}:${value.targetAttemptGeneration}`;
@@ -3678,7 +3796,7 @@ function relocationFailed(request, failureCode) {
 function validatePrepareEnvelope(request, envelope) {
     if (!sameWireId(request.relocation, relocationWireId(envelope.aggregateId)) ||
         request.applicationVersion !== envelope.applicationVersion ||
-        stringifyWire(request.object) !== stringifyWire(relocationObject(envelope))) {
+        !sameRelocationObject(request.object, relocationObject(envelope))) {
         throw new Error('Relocation Prepare does not match its immutable root identity.');
     }
 }
@@ -3688,14 +3806,9 @@ function validateTargetOneWayControl(stage, request, sourceNodeRid) {
         !sameWireId(request.relocation, prepare.relocation) ||
         request.targetAttemptGeneration !== prepare.targetAttemptGeneration ||
         !sameCoordinator(request.coordinator, prepare.coordinator) ||
-        stringifyWire(request.object) !==
-            stringifyWire(request.kind === 'data' ? request.object : prepare.object)) {
+        (request.kind === 'cutover' && !sameRelocationObject(request.object, prepare.object))) {
         throw new Error('Relocation one-way control changed its exact Prepare fence.');
     }
-    if (request.kind === 'cutover' &&
-        stringifyWire(request.object) !== stringifyWire(prepare.object)) {
-        throw new Error('Relocation Cutover changed its prepared object.');
-    }
 }
 function relocationPublication(prepare, envelope) {
     // The direct transfer has no durable store root; the authority wrapper
@@ -3778,7 +3891,7 @@ function canonicalQueuedFrozenRecord(participant, message, coordinator, target)
         ...(packet.returnResponse ? { replyRouteId: BigInt(packet.source.replyRouteId) } : {}),
         payload: {
             packetName: '__zlink.actor.handoff.accepted',
-            contentType: 'application/json',
+            contentType: stream_wire_1.ZlinkStreamContentType.Json,
             bytes: message.payload
         }
     });
@@ -3799,14 +3912,22 @@ function parseHandoffOperationId(value) {
 function stringifyWire(value) {
     return JSON.stringify(value, (_key, item) => (typeof item === 'bigint' ? item.toString() : item));
 }
+function samePrepareIdentity(acceptedFingerprint, incoming) {
+    const accepted = JSON.parse(acceptedFingerprint);
+    return (accepted.sourceNodeRid === incoming.sourceNodeRid &&
+        BigInt(accepted.sourceNodeGeneration) === incoming.sourceNodeGeneration &&
+        sameCoordinator(accepted.coordinator, incoming.coordinator) &&
+        sameRelocationTarget(accepted.target, incoming.target) &&
+        sameRelocationObject(accepted.object, incoming.object));
+}
 function validateControlResponse(request, response) {
     if (request.kind !== 'prepare' ||
         response.kind !== 'ready' ||
         !sameWireId(response.relocation, request.relocation) ||
         response.targetAttemptGeneration !== request.targetAttemptGeneration ||
         !sameCoordinator(response.coordinator, request.coordinator) ||
-        stringifyWire(response.target) !== stringifyWire(request.target) ||
-        stringifyWire(response.object) !== stringifyWire(request.object) ||
+        !sameRelocationTarget(response.target, request.target) ||
+        !sameRelocationObject(response.object, request.object) ||
         response.senderRole !== 'target') {
         throw new Error('Relocation control response does not match the request fence.');
     }
@@ -3823,78 +3944,16 @@ function validateControlFailureResponse(request, response) {
         !sameWireId(response.relocation, request.relocation) ||
         response.targetAttemptGeneration !== request.targetAttemptGeneration ||
         !sameCoordinator(response.coordinator, request.coordinator) ||
-        stringifyWire(response.target) !== stringifyWire(request.target) ||
-        stringifyWire(response.object) !== stringifyWire(request.object) ||
+        !sameRelocationTarget(response.target, request.target) ||
+        !sameRelocationObject(response.object, request.object) ||
         response.senderRole !== 'target') {
         throw new Error('Relocation control response does not match the request fence.');
     }
 }
-/**
- * Maps a relocationFailed(53) wire failureCode (the generated
- * ServiceWireFrameworkErrorCode vocabulary) to its internal error kind, so a
- * source-side reject carries the same classification the target chose
- * instead of a generic Error. Direct 1:1 correspondence with the generated
- * names; an unrecognised or absent code falls back to RequestFailed
- * (InternalFailure) — the closest existing kind (spec 15 §"Failed.Kind").
- */
-function relocationFailureCodeKind(failureCode) {
-    switch (failureCode) {
-        case 1:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorRouteNotFound;
-        case 2:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorCreateFailed;
-        case 3:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorAlreadyExists;
-        case 4:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorTypeMismatch;
-        case 5:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotCreateFailed;
-        case 6:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotRouteNotFound;
-        case 7:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotTypeMismatch;
-        case 8:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorSessionNotBound;
-        case 9:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.HandlerNotFound;
-        case 10:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteHandlerNotFound;
-        case 11:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorDispatchHandlerNotFound;
-        case 12:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.PayloadDecodeFailed;
-        case 13:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected;
-        case 14:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestTargetNotFound;
-        case 15:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestRejected;
-        case 16:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestProtocolError;
-        case 18:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerQueueFull;
-        case 19:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerTimedOut;
-        case 20:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.WorkerFailed;
-        case 21:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorLocationStale;
-        case 22:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.ActorCreateRejected;
-        case 33:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotGenerationStale;
-        case 34:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving;
-        case 35:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RelocationDataLost;
-        case 17:
-        default:
-            return framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestFailed;
-    }
-}
 /** Builds the typed exception a Prepare waiter rejects with on an explicit Failed(53). */
 function relocationFailureException(response) {
-    return (0, framework_errors_internal_1.createInternalFrameworkException)(relocationFailureCodeKind(response.failureCode), `Relocation '${response.relocation.high}:${response.relocation.low}:` +
+    return (0, framework_errors_internal_1.createInternalFrameworkException)((0, framework_errors_internal_1.internalFrameworkErrorKindFromWireFailureCode)(response.failureCode) ??
+        framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestFailed, `Relocation '${response.relocation.high}:${response.relocation.low}:` +
         `${response.targetAttemptGeneration}' failed with wire failureCode ${response.failureCode}.`, true);
 }
 function controlAckKey(request) {
@@ -4023,7 +4082,7 @@ function queuedMessageU64(value, field) {
         throw new TypeError(`Relocation Actor Message Follow ${field} is invalid.`);
     }
     const result = BigInt(value);
-    if (result > 0xffffffffffffffffn) {
+    if (result > stream_wire_1.UINT64_MAX) {
         throw new TypeError(`Relocation Actor Message Follow ${field} is outside u64.`);
     }
     return result;
@@ -4043,6 +4102,14 @@ function toServiceTimer(value) {
         pendingTicks: value.pendingTicks
     };
 }
+const PREPARE_SIDEBAND_MAGIC = 'ZLNI';
+const PREPARE_SIDEBAND_VERSION = 1;
+const PREPARE_SIDEBAND_HEADER_BYTES = 11;
+const PREPARE_SIDEBAND_VERSION_OFFSET = 4;
+const PREPARE_SIDEBAND_KEY_LENGTH_OFFSET = 5;
+const PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET = 7;
+const ACTOR_SESSION_JOURNAL_VERSION = 1;
+const SERVICE_RELOCATION_REPLY_PACKET_NAME = 'zlink.relocation.reply';
 /**
  * NODE-INTERNAL Prepare sideband. Frame zero remains the exact canonical
  * command-40 schema record; each following ZLNI frame carries one sealed
@@ -4058,11 +4125,11 @@ function encodePrepareSideband(envelope) {
         if (key.byteLength === 0 || key.byteLength > 0xffff || payload.byteLength > 0xffff_ffff) {
             throw new TypeError('Bound-session relocation sideband is out of bounds.');
         }
-        const header = Buffer.allocUnsafe(11);
-        header.write('ZLNI', 0, 'ascii');
-        header[4] = 1;
-        header.writeUInt16BE(key.byteLength, 5);
-        header.writeUInt32BE(payload.byteLength, 7);
+        const header = Buffer.allocUnsafe(PREPARE_SIDEBAND_HEADER_BYTES);
+        header.write(PREPARE_SIDEBAND_MAGIC, 0, 'ascii');
+        header[PREPARE_SIDEBAND_VERSION_OFFSET] = PREPARE_SIDEBAND_VERSION;
+        header.writeUInt16BE(key.byteLength, PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+        header.writeUInt32BE(payload.byteLength, PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
         return Buffer.concat([header, key, payload]);
     });
 }
@@ -4071,20 +4138,27 @@ function decodePrepareSideband(frames) {
     const keys = new Set();
     for (const frame of frames) {
         const bytes = Buffer.from(frame);
-        if (bytes.byteLength < 11 ||
-            bytes.subarray(0, 4).toString('ascii') !== 'ZLNI' ||
-            bytes[4] !== 1) {
+        if (bytes.byteLength < PREPARE_SIDEBAND_HEADER_BYTES ||
+            bytes.subarray(0, PREPARE_SIDEBAND_VERSION_OFFSET).toString('ascii') !==
+                PREPARE_SIDEBAND_MAGIC ||
+            bytes[PREPARE_SIDEBAND_VERSION_OFFSET] !== PREPARE_SIDEBAND_VERSION) {
             return undefined;
         }
-        const keyLength = bytes.readUInt16BE(5);
-        const payloadLength = bytes.readUInt32BE(7);
-        if (11 + keyLength + payloadLength !== bytes.byteLength || keyLength === 0)
+        const keyLength = bytes.readUInt16BE(PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+        const payloadLength = bytes.readUInt32BE(PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
+        if (PREPARE_SIDEBAND_HEADER_BYTES + keyLength + payloadLength !== bytes.byteLength ||
+            keyLength === 0)
             return undefined;
-        const participantKey = bytes.subarray(11, 11 + keyLength).toString('utf8');
+        const participantKey = bytes
+            .subarray(PREPARE_SIDEBAND_HEADER_BYTES, PREPARE_SIDEBAND_HEADER_BYTES + keyLength)
+            .toString('utf8');
         if (keys.has(participantKey))
             return undefined;
         keys.add(participantKey);
-        result.push({ participantKey, payload: Buffer.from(bytes.subarray(11 + keyLength)) });
+        result.push({
+            participantKey,
+            payload: Buffer.from(bytes.subarray(PREPARE_SIDEBAND_HEADER_BYTES + keyLength))
+        });
     }
     return result;
 }
@@ -4110,12 +4184,15 @@ function encodeActorSession(target) {
     if (target === undefined)
         return Buffer.alloc(0);
     return Buffer.from(JSON.stringify({
-        version: 1,
+        version: ACTOR_SESSION_JOURNAL_VERSION,
         routerChannelId: target.routerChannelId,
         targetNodeRid: String(target.targetNodeRid),
         spotId: String(target.spotId),
         sessionNodeRid: target.sessionNodeRid === undefined ? undefined : String(target.sessionNodeRid),
         sessionRid: target.sessionRid === undefined ? undefined : String(target.sessionRid),
+        sessionOwnerNodeGeneration: target.sessionOwnerNodeGeneration?.toString(),
+        sessionOwnerId: target.sessionOwnerId,
+        sessionOwnerLeaseGeneration: target.sessionOwnerLeaseGeneration?.toString(),
         bindingGeneration: target.bindingGeneration?.toString(),
         previousAuthorityOwnerGeneration: target.previousAuthorityOwnerGeneration?.toString(),
         previousOwnerLeaseGeneration: target.previousOwnerLeaseGeneration?.toString(),
@@ -4140,9 +4217,11 @@ function encodeActorSession(target) {
     }), 'utf8');
 }
 function decodeActorSession(payload) {
+    if (payload.byteLength === 0)
+        return undefined;
     const value = JSON.parse(Buffer.from(payload).toString('utf8'));
     const optionalBigInt = (field) => typeof value[field] === 'string' ? BigInt(value[field]) : undefined;
-    if (value.version !== 1 ||
+    if (value.version !== ACTOR_SESSION_JOURNAL_VERSION ||
         typeof value.routerChannelId !== 'string' ||
         typeof value.targetNodeRid !== 'string' ||
         typeof value.spotId !== 'string') {
@@ -4157,6 +4236,13 @@ function decodeActorSession(payload) {
             ? { sessionNodeRid: value.sessionNodeRid }
             : {}),
         ...(typeof value.sessionRid === 'string' ? { sessionRid: value.sessionRid } : {}),
+        ...(optionalBigInt('sessionOwnerNodeGeneration') === undefined
+            ? {}
+            : { sessionOwnerNodeGeneration: optionalBigInt('sessionOwnerNodeGeneration') }),
+        ...(typeof value.sessionOwnerId === 'string' ? { sessionOwnerId: value.sessionOwnerId } : {}),
+        ...(optionalBigInt('sessionOwnerLeaseGeneration') === undefined
+            ? {}
+            : { sessionOwnerLeaseGeneration: optionalBigInt('sessionOwnerLeaseGeneration') }),
         ...(optionalBigInt('bindingGeneration') === undefined
             ? {}
             : { bindingGeneration: optionalBigInt('bindingGeneration') }),
@@ -4255,3 +4341,9 @@ function addCapacity(left, right) {
             })
     };
 }
+if ((0, state_lane_1.isStructuralGuardEnabled)()) {
+    const relocateActorJoin = ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin;
+    ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin = function (input) {
+        return (0, state_lane_1.trackDiagnosticCompletion)(relocateActorJoin.call(this, input), `relocation join actor:${input.state.actorId}`);
+    };
+}