@zlink-systems/framework 0.26.0 → 0.28.0

package/src/runtime/host/service-relocation-host-runtime.ts

@@ -1,83 +1,79 @@
+import { UINT64_MAX, ZlinkStreamContentType } from '@zlink-systems/stream-wire';
 import { randomBytes } from 'node:crypto';
-import { SubmitResult } from '../backend/runtime-values';
-import type {
-  RoutingId,
-  Type,
-  ZLinkActor,
-  ZLinkActorRelocationAdapter,
-  ZLinkMeshNodeDescriptor,
-  ZLinkSpot,
-  ZLinkSpotRelocationAdapter,
-  ZLinkInstanceSpot
-} from '../../contracts';
-import type {
-  ZLinkAuthorityKey,
-  ZLinkAuthorityScanCursor,
-  ZLinkAuthoritySnapshot,
-  ZLinkCapacityVector,
-  ZLinkLocationOwnerToken
-} from '../locations/internal-location-contracts';
 import {
+  type RoutingId,
+  type Type,
+  type ZLinkActor,
+  type ZLinkActorRelocationAdapter,
+  type ZLinkInstanceSpot,
+  type ZLinkMeshNodeDescriptor,
+  type ZLinkSpot,
+  type ZLinkSpotRelocationAdapter,
   ZLinkFrameworkErrorKind,
   ZLinkFrameworkException,
   ZLinkFrameworkRuntimeState,
   ZLinkObjectRole,
+  ZLinkSpotKind,
   ZLinkSpotRelocationCoordinationMode,
   ZLinkSpotRelocationReadyOutcome,
-  ZLinkSpotKind,
   ZLinkUserSpotExecutionMode
 } from '../../contracts';
-import { zlinkRuntimeDefaultLocationOptions } from '../../contracts/Locations/Options';
-import {
-  ZLinkFrameworkInternalErrorKind,
-  createInternalFrameworkException
-} from '../framework-errors-internal';
-import type { ZLinkDomainLocationStore as ZLinkLocationStore } from '../locations/domain-store-contract';
-import type { ZLinkTrackedInstanceAuthority } from '../locations/spot-location-claims';
+
 import type { ZLinkProviderResolver } from '../../contracts/Common/ZLinkProviderResolver';
-import type { ZLinkRuntimeEventPublisher, ZLinkRuntimeMetrics } from '../diagnostics';
+import { zlinkRuntimeDefaultLocationOptions } from '../../contracts/Locations/Options';
+import { ZLINK_PROVIDER_MAX_PAGE_SIZE } from '../../contracts/Locations/Stores';
 import type { ZLinkActivationAdmission } from '../activation-admission';
-import type { ZLinkFrameworkRegistration } from '../configuration';
+import type { DefaultZLinkActorManager } from '../actors';
+import {
+  decodeRelocatingActorAuthorityIdentity,
+  rewriteActorAuthorityRoute
+} from '../actors/actor-authority-publication';
+import {
+  replayActorHandoffBacklog,
+  type ZLinkActorHandoffPacket,
+  type ZLinkActorHandoffResult
+} from '../actors/actor-handoff';
+import type { ZLinkActorJoinRelocation } from '../actors/actor-join-relocation';
+import {
+  ZLINK_REMOTE_ACTOR_SOURCE_LEAVE_TERMINAL,
+  decodeRemoteActorSourceLeaveTerminal
+} from '../actors/actor-remote-wire';
+import {
+  toFrameworkActorRef,
+  type ZLinkActorRuntimeState,
+  type ZLinkRemoteBoundSessionTarget
+} from '../actors/actor-runtime-state';
 import type { ZLinkBackendMeshNode, ZLinkMeshCompletionTable } from '../backend';
-import { ReceiveKind, type ReceiveRecord } from '../foundation/service-runtime-contracts';
-import { decodeRoutingId, encodeRoutingIdStorageHex, routingIdsEqual } from '../routing-id';
-import { ServiceWireProtocolError } from '../foundation/service-wire-m6a-codec';
-import type { ServiceSpotMessageFollowSeal } from '../foundation/service-stateful-runtime';
+import { RequestResult, SubmitResult } from '../backend/runtime-values';
+import type { ZLinkFrameworkRegistration } from '../configuration';
 import {
-  ServiceRelocationAuthorityPayloadCodec,
-  crc32c,
-  decodeServiceRelocationEnvelope,
-  encodeServiceRelocationEnvelope,
-  inventoryDigest,
-  projectServiceRelocationAuthorityTargetReady,
-  replaceServiceRelocationAuthorityApplicationPayload,
-  serviceRelocationAuthorityApplicationPayload,
-  serviceRelocationAuthoritySlotIdentity,
-  type ServiceRelocationEnvelope,
-  type ServiceRelocationMembership,
-  type ServiceRelocationParticipant,
-  type ServiceRelocationPublication,
-  type ServiceRelocationQueuedMessage,
-  type ServiceRelocationTimer
-} from '../foundation/service-relocation-runtime';
+  type ZLinkRuntimeEventPublisher,
+  type ZLinkRuntimeMetrics,
+  isRelocationDebugEnabled,
+  relocationDebug
+} from '../diagnostics';
+
+import { METRIC_NAMES, MILLISECONDS_PER_SECOND } from '../diagnostics/runtime-metrics';
+import { isStructuralGuardEnabled, trackDiagnosticCompletion } from '../execution/state-lane';
 import {
-  ZLinkRelocationInFlightBudget,
-  ZLinkRelocationPayloadAssembly,
-  effectiveActorJoinChunkLimitBytes,
-  effectiveRelocationBudgetBytes,
-  planRelocationChunks,
-  relocationChunkAt
-} from './relocation-direct-transfer';
+  RECREATE_RELOCATION_CONTENT_TYPE,
+  SNAPSHOT_RELOCATION_CONTENT_TYPE,
+  decodeCanonicalActorJoinRecoverySavedWork,
+  encodeCanonicalActorJoinRecoverySavedWork,
+  type CanonicalActorJoinRecovery
+} from '../foundation/actor-join-recovery-codec';
+import { OPERATION_IDENTITY_BYTES } from '../foundation/operation-identity';
+import { rewriteServiceAuthorityRoute } from '../foundation/service-authority-payload-codec';
+import { ServiceMaintenanceRuntime } from '../foundation/service-maintenance-runtime';
 import {
-  captureRelocationAdapterState,
-  restoreRelocationAdapterState,
-  type ZLinkRelocationStateAdapterLike
-} from './relocation-state-adapter';
+  ServiceRelocationAggregateCommitter,
+  type ServicePreparedRelocationAggregate,
+  type ServiceRelocationAggregatePlan
+} from '../foundation/service-relocation-aggregate-committer';
 import {
   ServiceRelocationAuthorityError,
   ServiceRelocationPostCommitError
 } from '../foundation/service-relocation-coordinator';
-import { ServiceMaintenanceRuntime } from '../foundation/service-maintenance-runtime';
 import {
   ServiceRelocationObjectCaptureOwner,
   ServiceRelocationObjectRestoreOwner,
@@ -88,89 +84,125 @@ import {
   type ServiceRelocationTargetObjectPort
 } from '../foundation/service-relocation-object-owner';
 import {
-  ServiceRelocationAggregateCommitter,
-  type ServicePreparedRelocationAggregate,
-  type ServiceRelocationAggregatePlan
-} from '../foundation/service-relocation-aggregate-committer';
-import { createProviderInstance } from '../spots/spot-provider';
-import type { DefaultZLinkSpotManager, ZLinkSpotNodeRuntimeManager } from '../spots';
-import type { ZLinkSpotActivation } from '../spots/spot-activation-state';
-import type { DefaultZLinkActorManager } from '../actors';
-import {
-  toFrameworkActorRef,
-  type ZLinkActorRuntimeState,
-  type ZLinkRemoteBoundSessionTarget
-} from '../actors/actor-runtime-state';
-import {
-  replayActorHandoffBacklog,
-  type ZLinkActorHandoffPacket,
-  type ZLinkActorHandoffResult
-} from '../actors/actor-handoff';
-import { decodeHandoffBacklog } from '../spots/spot-remote-codec';
-import {
-  decodeRelocatingActorAuthorityIdentity,
-  rewriteActorAuthorityRoute
-} from '../actors/actor-authority-publication';
-import { rewriteServiceAuthorityRoute } from '../foundation/service-authority-payload-codec';
-import { committedActorOwnerFence, type ZLinkActorTransferRuntime } from './actor-transfer-runtime';
-import { decodeAuthorityKey, encodeAuthorityKey } from '../locations/authority-key-codec';
+  ServiceRelocationAuthorityPayloadCodec,
+  crc32c,
+  decodeServiceRelocationEnvelope,
+  encodeServiceRelocationEnvelope,
+  inventoryDigest,
+  projectServiceRelocationAuthorityTargetReady,
+  replaceServiceRelocationAuthorityApplicationPayload,
+  serviceRelocationAuthorityApplicationPayload,
+  serviceRelocationAuthoritySlotIdentity,
+  type ServiceRelocationEnvelope,
+  type ServiceRelocationMembership,
+  type ServiceRelocationParticipant,
+  type ServiceRelocationPublication,
+  type ServiceRelocationQueuedMessage,
+  type ServiceRelocationTimer
+} from '../foundation/service-relocation-runtime';
 import {
-  decodeServiceRelocationControlRequest,
-  decodeServiceRelocationControlResponse,
-  encodeServiceRelocationControlRequest,
-  encodeServiceRelocationControlResponse,
-  type ZLinkServiceRelocationControlRequest,
-  type ZLinkServiceRelocationControlResponse
-} from './service-relocation-control';
+  MeshPeerRuntimeState,
+  ReceiveKind,
+  type ReceiveRecord
+} from '../foundation/service-runtime-contracts';
+import type { ServiceSpotMessageFollowSeal } from '../foundation/service-stateful-runtime';
 import {
+  M6bServiceWireCommand,
   decodeMaintenanceReplyRelay,
   decodeMaintenanceReplyRelayAck,
+  decodeServiceWireFrozenRecord,
   decodeSessionRelocationRoute,
   decodeSessionRelocationSeal,
   decodeSessionRelocationSealed,
   encodeMaintenanceReplyRelay,
   encodeMaintenanceReplyRelayAck,
+  encodeServiceWireFrozenActorApplicationRecord,
   encodeSessionRelocationRoute,
   encodeSessionRelocationSeal,
   encodeSessionRelocationSealed,
   serviceSessionRelocationIdentityKey,
-  decodeServiceWireFrozenRecord,
-  encodeServiceWireFrozenActorApplicationRecord,
-  M6bServiceWireCommand,
-  type ServiceMaintenanceReplyRelay,
-  type ServiceMaintenanceReplyRelayAck,
   type ServiceMaintenanceRelocationControl,
   type ServiceMaintenanceRelocationCutover,
   type ServiceMaintenanceRelocationData,
   type ServiceMaintenanceRelocationFailed,
-  type ServiceMaintenanceRelocationReady,
   type ServiceMaintenanceRelocationPrepare,
+  type ServiceMaintenanceRelocationReady,
   type ServiceMaintenanceRelocationState,
+  type ServiceMaintenanceReplyRelay,
+  type ServiceMaintenanceReplyRelayAck,
   type ServiceSessionRelocationRoute,
   type ServiceSessionRelocationSeal,
   type ServiceSessionRelocationSealed,
   type ServiceWireOperationId,
-  type ServiceWireRequestSourceFence,
-  type ServiceWireRelocationTarget,
   type ServiceWireRelocationCoordinatorFence,
-  type ServiceWireRelocationObject
+  type ServiceWireRelocationObject,
+  type ServiceWireRelocationTarget,
+  type ServiceWireRequestSourceFence
 } from '../foundation/service-stateful-wire-codec';
 import { ServiceWireFrameworkErrorCode } from '../foundation/service-wire-constants.generated';
+import { ServiceWireProtocolError } from '../foundation/service-wire-m6a-codec';
+import {
+  ZLinkFrameworkInternalErrorKind,
+  createInternalFrameworkException,
+  frameworkRelocationFailureCode,
+  internalFrameworkErrorKindFromWireFailureCode
+} from '../framework-errors-internal';
+import { decodeAuthorityKey, encodeAuthorityKey } from '../locations/authority-key-codec';
+import { isIndeterminateLocationStoreFailure } from '../locations/location-store-failure';
+import type { ZLinkDomainLocationStore as ZLinkLocationStore } from '../locations/domain-store-contract';
+import type {
+  ZLinkAuthorityKey,
+  ZLinkAuthorityScanCursor,
+  ZLinkAuthoritySnapshot,
+  ZLinkCapacityVector,
+  ZLinkLocationOwnerToken
+} from '../locations/internal-location-contracts';
+import type { ZLinkTrackedInstanceAuthority } from '../locations/spot-location-claims';
+import { decodeRoutingId, encodeRoutingIdStorageHex, routingIdsEqual } from '../routing-id';
+import type { DefaultZLinkSpotManager, ZLinkSpotNodeRuntimeManager } from '../spots';
+import type { ZLinkSpotActivation } from '../spots/spot-activation-state';
+import { createProviderInstance } from '../spots/spot-provider';
+import { decodeHandoffBacklog } from '../spots/spot-remote-codec';
+import { committedActorOwnerFence, type ZLinkActorTransferRuntime } from './actor-transfer-runtime';
 import { BoundedReplayMap } from './bounded-replay-map';
-import type { ZLinkActorJoinRelocation } from '../actors/actor-join-relocation';
+import {
+  ZLinkRelocationInFlightBudget,
+  ZLinkRelocationPayloadAssembly,
+  effectiveActorJoinChunkLimitBytes,
+  effectiveRelocationBudgetBytes,
+  planRelocationChunks,
+  relocationChunkAt
+} from './relocation-direct-transfer';
 import {
   ZLINK_INTERNAL_RELOCATION_INTEGRITY_FAULT_GATE,
   type ZLinkInternalRelocationIntegrityFaultGate
 } from './relocation-integrity-fault-gate';
 import {
-  decodeRemoteActorSourceLeaveTerminal,
-  ZLINK_REMOTE_ACTOR_SOURCE_LEAVE_TERMINAL
-} from '../actors/actor-remote-wire';
+  captureRelocationAdapterState,
+  restoreRelocationAdapterState,
+  type ZLinkRelocationStateAdapterLike
+} from './relocation-state-adapter';
 import {
-  decodeCanonicalActorJoinRecoverySavedWork,
-  encodeCanonicalActorJoinRecoverySavedWork,
-  type CanonicalActorJoinRecovery
-} from '../foundation/actor-join-recovery-codec';
+  decodeServiceRelocationControlRequest,
+  decodeServiceRelocationControlResponse,
+  encodeServiceRelocationControlRequest,
+  encodeServiceRelocationControlResponse,
+  type ZLinkServiceRelocationControlRequest,
+  type ZLinkServiceRelocationControlResponse
+} from './service-relocation-control';
+const RELOCATION_ATTEMPT_TIMEOUT_MS = 250;
+
+const RELOCATION_AUTHORITY_RETRY_DELAY_MS = 25;
+
+const RELOCATION_MAX_SEND_ATTEMPTS = 120;
+
+const RELOCATION_AUTHORITY_POLL_INTERVAL_MS = 10;
+
+const RELOCATION_RESEND_DELAY_MS = 250;
+
+const RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+
+const RELOCATION_OPERATION_TIMEOUT_MS = 30_000;
 
 export class ZLinkRelocationStateIncompatibleError extends Error {
   constructor(message: string) {
@@ -189,6 +221,7 @@ interface ZLinkHostRelocationOptions {
   readonly providerResolver?: ZLinkProviderResolver;
   readonly locationStore: () => ZLinkLocationStore | undefined;
   readonly currentOwner: () => ZLinkLocationOwnerToken | undefined;
+  readonly targetAdmissionSealed?: () => boolean;
   readonly liveDescriptors: (
     meshName: string,
     signal?: AbortSignal
@@ -307,7 +340,7 @@ interface SourceActorJoinProfile {
     Parameters<ZLinkActorJoinRelocation['relocateActorJoin']>[0]['canonicalRecovery']
   >;
   readonly ready: Promise<void>;
-  readonly resolveReady: () => void;
+  readonly resolveReady: (failure?: ServiceRelocationPostCommitError) => void;
 }
 
 interface PendingRelocationReplyRelay {
@@ -366,8 +399,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
    * Terminal restore failures (assembly/checksum/factory/restore error): the
    * target already sent relocationFailed (command 53) once. An exact-identity
    * Prepare resend replays the stored response rather than retrying the
-   * restore; a different exact identity reusing the same RelocationId+attempt
-   * key supersedes the stale entry (spec 28 §3, §9).
+   * restore. A different exact identity never changes this entry (spec 28 §4.3).
    */
   private readonly targetReadyFailures = new Map<
     string,
@@ -424,9 +456,12 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       );
     }
     this.reserveExactRelocationId(input.relocationId);
-    let resolveReady!: () => void;
-    const ready = new Promise<void>((resolve) => {
-      resolveReady = resolve;
+    let resolveReady!: (failure?: ServiceRelocationPostCommitError) => void;
+    const ready = new Promise<void>((resolve, reject) => {
+      resolveReady = (failure) => {
+        if (failure === undefined) resolve();
+        else reject(failure.cause);
+      };
     });
     this.sourceActorJoinProfiles.set(input.relocationId, {
       actor: input.actor,
@@ -438,8 +473,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       relocationContentType:
         this.actorRegistration(input.state.meshName ?? input.meshName, input.state.actorType ?? '')
           .relocation.kind === 'snapshot'
-          ? 'application/vnd.zlink.actor-relocation.snapshot'
-          : 'application/vnd.zlink.actor-relocation.recreate',
+          ? SNAPSHOT_RELOCATION_CONTENT_TYPE
+          : RECREATE_RELOCATION_CONTENT_TYPE,
       completionOperationId: input.completionOperationId,
       canonicalRecovery: input.canonicalRecovery,
       ready,
@@ -469,8 +504,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       );
       resolveReady();
     } catch (error) {
-      this.sourceActorJoinProfiles.delete(input.relocationId);
-      throw error;
+      if (error instanceof ServiceRelocationPostCommitError) {
+        resolveReady(error);
+        this.completeActorJoinSourceCleanup(input.state.actorId);
+      } else {
+        this.sourceActorJoinProfiles.delete(input.relocationId);
+        throw error;
+      }
     }
     return {
       actorRef: {
@@ -486,17 +526,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   async dispose(): Promise<void> {
     this.disposed = true;
     const errors: unknown[] = [];
-    for (const stage of this.targetStages.values()) {
-      if (stage.fallback !== undefined) clearTimeout(stage.fallback);
-      try {
-        if (stage.finalize !== undefined) {
-          await stage.finalize;
-        } else if (stage.phase === 'ready') {
-          await this.abortTargetStage(stage);
-        }
-      } catch (error) {
-        errors.push(error);
-      }
+    try {
+      await this.drainTargetAttempts();
+    } catch (error) {
+      errors.push(error);
     }
     this.targetStages.clear();
     this.terminalTargets.clear();
@@ -534,24 +567,78 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (errors.length > 1) throw new AggregateError(errors, 'Relocation runtime stop failed.');
   }
 
+  /** Host shutdown waits for the existing attempt terminal before releasing its lease. */
+  async drainTargetAttempts(): Promise<void> {
+    const results = await Promise.allSettled(
+      [...this.targetStages.entries()].map(([stagingId, stage]) => {
+        if (stage.fallback !== undefined) clearTimeout(stage.fallback);
+        return stage.lane.finally(() => {
+          if (stage.phase === 'failed') return stage.finalize;
+          if (this.targetStageSealed(stage)) {
+            const terminal = this.discardTargetStage(stagingId, stage);
+            stage.finalize = terminal;
+            return terminal;
+          }
+          return this.beginTargetFinalize(
+            stage.offer.reservation.prepared.plan.targetDescriptor.meshName,
+            stagingId,
+            stage
+          );
+        });
+      })
+    );
+    const errors = results.flatMap((result) =>
+      result.status === 'rejected' ? [result.reason as unknown] : []
+    );
+    if (errors.length === 1) throw errors[0];
+    if (errors.length > 1) throw new AggregateError(errors, 'Relocation target drain failed.');
+  }
+
+  /** Spec 28 §4.4: the target owner alone orders shutdown seal and verified cutover. */
+  private targetStageSealed(stage: LocalStage): boolean {
+    return (
+      !stage.cutoverReceived && (this.disposed || this.options.targetAdmissionSealed?.() === true)
+    );
+  }
+
   completeActorJoinSourceCleanup(actorId: string): void {
     for (const [relocationId, profile] of this.sourceActorJoinProfiles) {
       if (profile.state.actorId !== actorId) continue;
       this.sourceActorJoinProfiles.delete(relocationId);
       this.terminalActorJoinSourceLeaves.remember(relocationId, actorId);
-      void profile.ready
-        .then(async () => {
-          await this.options.actorTransfer.completeRelocationSourceLeave(
-            profile.actor,
-            profile.sourceSpotId
-          );
-          await this.options
-            .actorManager()
-            ?.completeRelocationSource(actorId, profile.sourceActorRef);
-        })
-        .catch((error) => {
-          console.error('[zlink.runtime.relocation.source_cleanup_failed]', error);
-        });
+      void this.finalizeActorJoinSource(profile);
+    }
+  }
+
+  private async finalizeActorJoinSource(profile: SourceActorJoinProfile): Promise<void> {
+    const failures: unknown[] = [];
+    try {
+      await profile.ready;
+    } catch (error) {
+      failures.push(error);
+    }
+    try {
+      await this.options.actorTransfer.completeRelocationSourceLeave(
+        profile.actor,
+        profile.sourceSpotId
+      );
+    } catch (error) {
+      failures.push(error);
+    }
+    try {
+      await this.options
+        .actorManager()
+        ?.completeRelocationSource(profile.state.actorId, profile.sourceActorRef);
+    } catch (error) {
+      failures.push(error);
+    }
+    if (failures.length > 0) {
+      console.error(
+        '[zlink.runtime.relocation.source_cleanup_failed]',
+        failures.length === 1
+          ? failures[0]
+          : new AggregateError(failures, 'Actor source retirement failed.')
+      );
     }
   }
 
@@ -671,13 +758,19 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         ready: () => true,
         relocate: (relocationSignal) => {
           const run = unit.relocate(relocationSignal);
+          if (isStructuralGuardEnabled()) {
+            trackDiagnosticCompletion(run, `relocation ${unit.id}`);
+          }
           started.push(run);
           return run;
         }
       });
     }
     const operationSignal = signal ?? new AbortController().signal;
-    const deadlineMs = signal === undefined ? 30_000 : 24 * 60 * 60 * 1000;
+    const deadlineMs =
+      signal === undefined
+        ? RELOCATION_OPERATION_TIMEOUT_MS
+        : RELOCATION_ABORTABLE_OPERATION_TIMEOUT_MS;
     let failure: unknown;
     try {
       const result = await raceAbort(
@@ -798,47 +891,57 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       }
       const operationKey = relocationStagingId(request);
       const fingerprint = stringifyWire(request);
+      const readyFailure = this.targetReadyFailures.get(operationKey);
+      const readyPending = this.targetReadyResponses.get(operationKey);
+      let operation = this.targetPrepareOperations.get(operationKey);
+      const acceptedFingerprint =
+        readyFailure?.fingerprint ??
+        readyPending?.fingerprint ??
+        operation?.fingerprint ??
+        this.targetAssemblies.get(operationKey)?.fingerprint ??
+        this.targetStages.get(operationKey)?.offer.prepareFingerprint ??
+        this.terminalTargets.get(operationKey);
+      if (request.sourceNodeRid !== String(record.sourceNodeRid)) return true;
+      if (acceptedFingerprint !== undefined && acceptedFingerprint !== fingerprint) {
+        if (!samePrepareIdentity(acceptedFingerprint, request)) return true;
+        this.replyPrepare(
+          record,
+          relocationFailed(request, ServiceWireFrameworkErrorCode.relocationDataLost)
+        );
+        return true;
+      }
       // A restore that failed outright is terminal: the source observes the
       // same explicit relocationFailed on every identical Prepare resend
-      // rather than a silent stall. A different exact identity reusing the
-      // same RelocationId+attempt key supersedes the stale failure — the
-      // newer attempt wins (spec 28 §3).
-      const readyFailure = this.targetReadyFailures.get(operationKey);
+      // rather than a silent stall.
       if (readyFailure !== undefined) {
-        if (readyFailure.fingerprint === fingerprint) {
-          this.replyPrepare(record, readyFailure.response);
-          return true;
-        }
-        this.targetReadyFailures.delete(operationKey);
+        this.replyPrepare(record, readyFailure.response);
+        return true;
       }
       // Spec 28: an exact-identity Restore resend against staging that
       // already restored successfully reuses that staging — it re-submits
       // READY rather than restarting the restore.
-      const readyPending = this.targetReadyResponses.get(operationKey);
       if (readyPending !== undefined) {
-        if (readyPending.fingerprint !== fingerprint) {
-          throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-        }
         this.submitTargetReady(meshName, operationKey, record, readyPending.response);
         return true;
       }
-      let operation = this.targetPrepareOperations.get(operationKey);
-      if (operation !== undefined && operation.fingerprint !== fingerprint) {
-        throw new Error(`Relocation '${operationKey}' repeated Prepare with different bytes.`);
-      }
       if (operation === undefined) {
         // The prepare turn must not block the ordered dispatch lane: the
         // payload chunks that complete this operation arrive as later records
         // on the same connection. Register the assembly synchronously, then
         // finish the restore and the Ready reply asynchronously.
-        this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
-        const promise = this.handlePrepareControl(
-          meshName,
-          operationKey,
-          request,
-          record.sourceNodeRid,
-          signal
-        );
+        let promise: Promise<ServiceMaintenanceRelocationReady>;
+        try {
+          this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
+          promise = this.handlePrepareControl(
+            meshName,
+            operationKey,
+            request,
+            record.sourceNodeRid,
+            signal
+          );
+        } catch (error) {
+          promise = Promise.reject(error);
+        }
         operation = { fingerprint, promise };
         this.targetPrepareOperations.set(operationKey, operation);
         void promise
@@ -872,10 +975,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       // restore or staging): this is terminal. Send relocationFailed
       // (command 53) once and remember it so an identical Prepare resend
       // replays the same response instead of retrying the restore.
-      const failed = relocationFailed(
-        request,
-        relocationFailedFailureCode(error, request.object.kind)
-      );
+      const failed = relocationFailed(request, relocationFailedFailureCode(error));
       this.targetReadyFailures.set(operationKey, {
         fingerprint: stringifyWire(request),
         response: failed
@@ -969,7 +1069,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       String(sourceNodeRid) !== pending.authenticatedSourceNodeRid ||
       request.senderRole !== 'source' ||
       !sameCoordinator(request.coordinator, pending.prepare.coordinator) ||
-      stringifyWire(request.object) !== stringifyWire(pending.prepare.object)
+      !sameRelocationObject(request.object, pending.prepare.object)
     ) {
       // Spec 28 §4.3 — a chunk with a different exact identity is never
       // attached to an in-progress assembly; it is discarded.
@@ -993,14 +1093,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   ): TargetPayloadAssembly {
     const existing = this.targetAssemblies.get(operationKey);
     if (existing !== undefined) {
-      if (existing.fingerprint !== stringifyWire(request)) {
-        // Same exact identity with a different declared length or checksum is
-        // an explicit conflict failure; the existing assembly is neither
-        // reused nor overwritten (spec 28 §4.3).
-        throw existing.assembly.fail(
-          `Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`
-        );
-      }
       return existing;
     }
     const pending: TargetPayloadAssembly = {
@@ -1015,15 +1107,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     };
     this.targetAssemblies.set(operationKey, pending);
     if (this.relocationIntegrityFaultGate()?.consumeIdentityConflict() === true) {
-      // Route a same-identity, different-manifest delivery through the normal
-      // conflict branch so existing staging is neither reused nor overwritten.
-      return this.registerTargetAssembly(
-        operationKey,
-        {
-          ...request,
-          payloadChecksumCrc32c: request.payloadChecksumCrc32c ^ 1
-        },
-        authenticatedSourceNodeRid
+      throw new ServiceRelocationDataLostError(
+        pending.assembly.fail(
+          `Relocation '${operationKey}' repeated Prepare with a conflicting manifest.`
+        ).message
       );
     }
     return pending;
@@ -1201,7 +1288,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           return;
         }
         if (this.pendingSessionRelocations.get(key) === pending) {
-          pending.retryTimer = setTimeout(() => void send(), 250);
+          pending.retryTimer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
         }
       } catch (error) {
         pending.reject(
@@ -1420,7 +1507,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     targetApplicationVersion: bigint | undefined,
     signal?: AbortSignal
   ): Promise<void> {
-    await activation.serial.executeLifecycleOperation(() =>
+    await activation.serial.executeControlLifecycleOperation(() =>
       this.relocateSpotAggregateCore(
         meshName,
         activation,
@@ -1537,47 +1624,72 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       captureApplicationState: (captureSignal) =>
         this.captureApplication(spotRegistration.relocation, activation.spot, captureSignal),
       commitSeal: async () => {
-        if (!spotSealCommitted) {
-          if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
-            throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+        const failures: unknown[] = [];
+        try {
+          if (!spotSealCommitted) {
+            if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
+              throw new Error(`Spot '${String(activation.spotId)}' relocation seal became stale.`);
+            }
+            spotSealCommitted = true;
           }
-          spotSealCommitted = true;
-        }
-        if (spotMessageFollowSeal !== undefined) {
-          await this.commitSpotMessageFollow(
-            meshName,
-            spotMessageFollowSeal,
-            spotKey,
-            activation,
-            target
-          );
+          if (spotMessageFollowSeal !== undefined) {
+            await this.commitSpotMessageFollow(
+              meshName,
+              spotMessageFollowSeal,
+              spotKey,
+              activation,
+              target
+            );
+          }
+        } catch (error) {
+          failures.push(error);
         }
         for (const session of sessions) {
-          const committedAuthority = await requireAuthority(
-            this.requireLocationStore(),
-            encodeAuthorityKey('actor', session.state.actorId)
-          );
-          const targetActorRef = {
-            actorId: session.state.actorId,
-            objectGeneration: actorAuthorities.get(session.state.actorId)!.objectGeneration,
-            meshName,
-            nodeRid: target.rid
-          };
-          await session.prepared.commit(
-            {
-              routerChannelId: meshName,
-              targetNodeRid: target.rid,
-              spotId: activation.spotId,
-              spotKind: kind === 'user_spot' ? ZLinkSpotKind.User : ZLinkSpotKind.Instance,
-              authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-            } as never,
-            targetActorRef,
-            committedActorOwnerFence(session.state.actorId, targetActorRef, committedAuthority)
-          );
-          activation.commitActorDeparture(session.state.actorId);
-          await this.requireActorManager().completeRelocationSource(session.state.actorId);
+          try {
+            const committedAuthority = await requireAuthority(
+              this.requireLocationStore(),
+              encodeAuthorityKey('actor', session.state.actorId)
+            );
+            const targetActorRef = {
+              actorId: session.state.actorId,
+              objectGeneration: actorAuthorities.get(session.state.actorId)!.objectGeneration,
+              meshName,
+              nodeRid: target.rid
+            };
+            await session.prepared.commit(
+              {
+                routerChannelId: meshName,
+                targetNodeRid: target.rid,
+                spotId: activation.spotId,
+                spotKind: kind === 'user_spot' ? ZLinkSpotKind.User : ZLinkSpotKind.Instance,
+                authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+              } as never,
+              targetActorRef,
+              committedActorOwnerFence(session.state.actorId, targetActorRef, committedAuthority)
+            );
+          } catch (error) {
+            failures.push(error);
+          }
+          try {
+            activation.commitActorDeparture(session.state.actorId);
+          } catch (error) {
+            failures.push(error);
+          }
+          try {
+            await this.requireActorManager().completeRelocationSource(session.state.actorId);
+          } catch (error) {
+            failures.push(error);
+          }
         }
-        await this.requireSpotManager().completeRelocationSource(activation);
+        try {
+          await this.requireSpotManager().completeRelocationSource(activation);
+        } catch (error) {
+          failures.push(error);
+        }
+        if (failures.length > 0)
+          throw failures.length === 1
+            ? failures[0]
+            : new AggregateError(failures, 'Spot source retirement failed.');
       },
       abortSeal: async () => {
         const failures: unknown[] = [];
@@ -1723,7 +1835,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes?: number
   ): Promise<void> {
-    relocationDebug('standalone_actor.begin', { actorId: state.actorId });
+    if (isRelocationDebugEnabled()) {
+      relocationDebug('standalone_actor.begin', { actorId: state.actorId });
+    }
     const authority = await requireAuthority(
       this.requireLocationStore(),
       encodeAuthorityKey('actor', state.actorId),
@@ -1780,12 +1894,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     };
     let outcome = 'completed';
     try {
-      relocationDebug('standalone_actor.wait_budget', {
-        actorId: state.actorId,
-        targetRid: String(target.rid)
-      });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('standalone_actor.wait_budget', {
+          actorId: state.actorId,
+          targetRid: String(target.rid)
+        });
+      }
       await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
-      relocationDebug('standalone_actor.capture_begin', { actorId: state.actorId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('standalone_actor.capture_begin', { actorId: state.actorId });
+      }
       const captured = await new ServiceRelocationObjectCaptureOwner().captureStandaloneActor(
         aggregateId,
         1n,
@@ -1793,7 +1911,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         membership,
         signal
       );
-      relocationDebug('standalone_actor.capture_complete', { actorId: state.actorId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('standalone_actor.capture_complete', { actorId: state.actorId });
+      }
       await this.runCoordinator(
         meshName,
         target,
@@ -1828,7 +1948,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     targetApplicationVersion: bigint | undefined,
     signal?: AbortSignal
   ): Promise<void> {
-    await activation.serial.executeLifecycleOperation(() =>
+    await activation.serial.executeControlLifecycleOperation(() =>
       this.relocatePerActorSpotShellCore(
         meshName,
         activation,
@@ -2026,32 +2146,45 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           meshName === undefined
         )
           return;
-        const membershipSpotId =
-          targetMembership?.spotId ?? ((target.entrySpotId ?? String(target.rid)) as RoutingId);
-        const committedAuthority = await requireAuthority(
-          this.requireLocationStore(),
-          encodeAuthorityKey('actor', state.actorId)
-        );
-        const targetActorRef = {
-          actorId: state.actorId,
-          objectGeneration: authority.objectGeneration,
-          meshName,
-          nodeRid: target.rid
-        };
-        await ownSession.prepared.commit(
-          {
-            routerChannelId: meshName,
-            targetNodeRid: target.rid,
-            spotId: membershipSpotId,
-            spotKind: targetMembership?.spotKind ?? ZLinkSpotKind.Entry,
-            authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-          } as never,
-          targetActorRef,
-          committedActorOwnerFence(state.actorId, targetActorRef, committedAuthority)
-        );
+        const failures: unknown[] = [];
+        try {
+          const membershipSpotId =
+            targetMembership?.spotId ?? ((target.entrySpotId ?? String(target.rid)) as RoutingId);
+          const committedAuthority = await requireAuthority(
+            this.requireLocationStore(),
+            encodeAuthorityKey('actor', state.actorId)
+          );
+          const targetActorRef = {
+            actorId: state.actorId,
+            objectGeneration: authority.objectGeneration,
+            meshName,
+            nodeRid: target.rid
+          };
+          await ownSession.prepared.commit(
+            {
+              routerChannelId: meshName,
+              targetNodeRid: target.rid,
+              spotId: membershipSpotId,
+              spotKind: targetMembership?.spotKind ?? ZLinkSpotKind.Entry,
+              authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
+            } as never,
+            targetActorRef,
+            committedActorOwnerFence(state.actorId, targetActorRef, committedAuthority)
+          );
+        } catch (error) {
+          failures.push(error);
+        }
         if (!retainSourceForActorJoin) {
-          await this.requireActorManager().completeRelocationSource(state.actorId);
+          try {
+            await this.requireActorManager().completeRelocationSource(state.actorId);
+          } catch (error) {
+            failures.push(error);
+          }
         }
+        if (failures.length > 0)
+          throw failures.length === 1
+            ? failures[0]
+            : new AggregateError(failures, 'Actor source retirement failed.');
       },
       abortSeal: async () => {
         if (standalone && ownSession !== undefined) await ownSession.prepared.rollback();
@@ -2098,13 +2231,17 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
     advertisedReceiveChunkLimitBytes?: number
   ): Promise<void> {
-    relocationDebug('coordinator.begin', {
-      aggregateId: captured.envelope.aggregateId,
-      targetRid: String(target.rid)
-    });
+    if (isRelocationDebugEnabled()) {
+      relocationDebug('coordinator.begin', {
+        aggregateId: captured.envelope.aggregateId,
+        targetRid: String(target.rid)
+      });
+    }
     const localStatus = this.requireMeshNode(meshName).status();
     const controlDeadlineAtMs =
-      signal === undefined ? performance.now() + 30_000 : Number.MAX_SAFE_INTEGER;
+      signal === undefined
+        ? performance.now() + RELOCATION_OPERATION_TIMEOUT_MS
+        : Number.MAX_SAFE_INTEGER;
     const coordinator = {
       ownerId: primary.ownerId,
       leaseGeneration: primary.ownerLeaseGeneration,
@@ -2169,7 +2306,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       signal?.aborted === true || performance.now() >= controlDeadlineAtMs;
     let readyReceived = false;
     let settlement: 'target' | 'source' | 'lost' | undefined;
-    let sourceCommitted = false;
     try {
       const prepare = {
         kind: 'prepare',
@@ -2199,17 +2335,25 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         encodePrepareSideband(captured.envelope)
       );
       try {
-        relocationDebug('coordinator.state_transfer_begin', {
-          aggregateId: captured.envelope.aggregateId
-        });
+        if (isRelocationDebugEnabled()) {
+          relocationDebug('coordinator.state_transfer_begin', {
+            aggregateId: captured.envelope.aggregateId
+          });
+        }
         await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, signal);
       } catch (chunkError) {
         readyOperation.catch(() => undefined);
         throw chunkError;
       }
-      relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
+      }
       const ready = await readyOperation;
-      relocationDebug('coordinator.ready_received', { aggregateId: captured.envelope.aggregateId });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('coordinator.ready_received', {
+          aggregateId: captured.envelope.aggregateId
+        });
+      }
       validateControlResponse(prepare, ready);
       // Ready arms the target's cutover-wait fallback. From this point
       // forward the source can no longer reopen dispatch without risking two
@@ -2298,10 +2442,12 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       } finally {
         this.closeSourceCutoverWindow(relayAuthorityId, window);
       }
-      relocationDebug('coordinator.authority_settled', {
-        aggregateId: captured.envelope.aggregateId,
-        settlement
-      });
+      if (isRelocationDebugEnabled()) {
+        relocationDebug('coordinator.authority_settled', {
+          aggregateId: captured.envelope.aggregateId,
+          settlement
+        });
+      }
       if (settlement === 'source') {
         // Preserve won: the captured queue, timers and held records return to
         // the source queue in their accepted order, and dispatch reopens.
@@ -2323,17 +2469,11 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       }
       for (const session of sessions) session.prepared.setReplayResults([]);
       await captured.commitSource();
-      sourceCommitted = true;
       await this.options.reconcileStatefulAuthorityRoutes?.(signal);
     } catch (error) {
       if (settlement !== 'target') throw error;
       // Target commit is confirmed; later source cleanup failures cannot move
-      // the authority back (spec 28 §9).
-      if (!sourceCommitted) {
-        for (const session of sessions) session.prepared.setReplayResults([]);
-        await captured.commitSource().catch(() => undefined);
-      }
-      await this.options.reconcileStatefulAuthorityRoutes?.().catch(() => undefined);
+      // the authority back (spec 28 §10).
       const authority = await requireAuthority(
         this.requireLocationStore(),
         { value: primaryKey(captured.envelope) } as ZLinkAuthorityKey,
@@ -2476,8 +2616,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       // S1→S4 route convergence: the span the source must keep its Message
       // Follow route (spec 30 §7.1).
       this.options.metrics?.duration(
-        'zlink.relocation.route_convergence',
-        Math.max(0, performance.now() - submittedAt) / 1000,
+        METRIC_NAMES.RelocationRouteConvergence,
+        Math.max(0, performance.now() - submittedAt) / MILLISECONDS_PER_SECOND,
         { mesh_name: meshName }
       );
       this.releaseSourceCutoverWindow(relocationKey, window);
@@ -2516,8 +2656,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       (value) =>
         value.routingId !== null && String(value.routingId) === String(window.targetNodeRid)
     );
-    // Backend peer state 3 is Ready.
-    if (peer !== undefined && peer.state !== 3) {
+    if (peer !== undefined && peer.state !== MeshPeerRuntimeState.Serving) {
       window.resendPending = true;
       return;
     }
@@ -2561,13 +2700,22 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       if (this.disposed) throw new Error('Relocation runtime stopped.');
       await this.resendSourceCutover(window);
       const observed = await this.readSourceSettlement(envelope, primary, target).catch(
-        () => undefined
+        (error: unknown) => {
+          if (!isIndeterminateLocationStoreFailure(error)) throw error;
+          return undefined;
+        }
       );
       if (observed?.kind === 'target') return 'target';
       if (observed?.kind === 'other') return 'lost';
       if (restoreDeadlineReached() && observed?.kind === 'source') {
         // An unreadable lease is an uncertain result, not an expiry.
-        if (await this.exactSourceLeaseExpired(owner).catch(() => false)) return 'lost';
+        if (
+          await this.exactSourceLeaseExpired(owner).catch((error: unknown) => {
+            if (!isIndeterminateLocationStoreFailure(error)) throw error;
+            return false;
+          })
+        )
+          return 'lost';
         const publication = this.codec.read(observed.current.payload);
         const preserved = await store
           .compareExchangeAuthority(
@@ -2582,11 +2730,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
                   : this.codec.clear(observed.current.payload, publication.reference)
             }
           )
-          .catch(() => undefined);
+          .catch((error: unknown) => {
+            if (!isIndeterminateLocationStoreFailure(error)) throw error;
+            return undefined;
+          });
         if (preserved?.kind === 'stored') return 'source';
       }
       // The caller awaits this settlement, so the retry timer keeps the loop alive.
-      await new Promise<void>((resolve) => setTimeout(resolve, 10));
+      await new Promise<void>((resolve) =>
+        setTimeout(resolve, RELOCATION_AUTHORITY_POLL_INTERVAL_MS)
+      );
     }
   }
 
@@ -2667,14 +2820,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     meshName: string,
     stagingId: string,
     request: ServiceMaintenanceRelocationPrepare,
-    sourceNodeRid: RoutingId | null,
+    sourceNodeRid: RoutingId,
     signal?: AbortSignal
   ): Promise<ServiceMaintenanceRelocationReady> {
-    if (sourceNodeRid === null || String(sourceNodeRid) !== request.sourceNodeRid) {
-      throw new Error(
-        'Relocation prepare source node fence does not match the authenticated peer.'
-      );
-    }
     const targetStatus = this.requireMeshNode(meshName).status();
     const targetOwner = this.options.currentOwner();
     const targetDescriptor = this.options.localDescriptor?.(meshName);
@@ -2692,24 +2840,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const fingerprint = stringifyWire(request);
     const existing = this.targetStages.get(stagingId);
     if (existing !== undefined) {
-      if (
-        existing.offer.authenticatedSourceNodeRid !== String(sourceNodeRid) ||
-        existing.offer.prepareFingerprint !== fingerprint
-      ) {
-        throw new Error('Relocation prepare retry source node changed.');
-      }
       return relocationReady(request);
     }
     const terminal = this.terminalTargets.get(stagingId);
     if (terminal !== undefined) {
-      if (terminal !== fingerprint) {
-        throw new Error(`Relocation '${stagingId}' repeated Prepare with different bytes.`);
-      }
       this.terminalTargets.touch(stagingId);
       return relocationReady(request);
     }
     const pendingAssembly = this.targetAssemblies.get(stagingId);
-    if (pendingAssembly === undefined || pendingAssembly.fingerprint !== fingerprint) {
+    if (pendingAssembly === undefined) {
       throw new Error(`Relocation '${stagingId}' has no matching payload assembly.`);
     }
     // The directly transferred payload replaces the shared durable root: the
@@ -2798,7 +2937,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     stage.fallback = setTimeout(() => {
       if (stage.finalize !== undefined) return;
       console.warn('[zlink.runtime.relocation.cutover_timeout]', stagingId);
-      this.options.metrics?.count('zlink.relocation.cutover_timeout', 1, {
+      this.options.metrics?.count(METRIC_NAMES.RelocationCutoverTimeout, 1, {
         mesh_name: meshName
       });
       void this.beginTargetFinalize(meshName, stagingId, stage).catch((error) =>
@@ -2820,7 +2959,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const stagingId = relocationStagingId(request);
     const stage = this.targetStages.get(stagingId);
     if (stage === undefined) {
-      if (this.terminalTargets.get(stagingId) !== undefined) {
+      if (this.disposed || this.terminalTargets.get(stagingId) !== undefined) {
         if (request.kind === 'cutover') {
           console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
         }
@@ -2829,21 +2968,24 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       throw new Error(`Relocation staging '${stagingId}' is missing.`);
     }
     validateTargetOneWayControl(stage, request, sourceNodeRid);
-    // A verified cutover closes the boundary batch. A later record or cutover
-    // is a duplicate retransmission and never changes the staged batch.
-    if (stage.cutoverReceived || (stage.phase !== 'ready' && stage.phase !== 'finalizing')) {
-      if (request.kind === 'cutover') {
-        console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+    stage.lane = stage.lane.then(() => {
+      // A verified cutover closes the boundary batch. A later record or cutover
+      // is a duplicate retransmission and never changes the staged batch.
+      if (stage.cutoverReceived || (stage.phase !== 'ready' && stage.phase !== 'finalizing')) {
+        if (request.kind === 'cutover') {
+          console.warn('[zlink.runtime.relocation.late_cutover]', stagingId);
+        }
+        return;
       }
-      return;
-    }
-    if (request.kind === 'data') {
-      stage.lane = stage.lane.then(() => this.stageBoundaryRelay(stage, request));
-      await stage.lane;
-      return;
-    }
-    this.reconcileBoundaryRelay(stage, request, stagingId);
-    stage.cutoverReceived = true;
+      if (request.kind === 'data') {
+        return this.stageBoundaryRelay(stage, request);
+      }
+      if (this.targetStageSealed(stage)) return;
+      this.reconcileBoundaryRelay(stage, request, stagingId);
+      stage.cutoverReceived = true;
+    });
+    await stage.lane;
+    if (request.kind === 'data') return;
     // A settlement started by the cutover wait Warning is still reading the
     // Store; it submits the CAS on its next round now that cutover verified.
     if (stage.finalize !== undefined) return;
@@ -2928,10 +3070,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     try {
       authority = await this.commitTargetReservation(stage, stage.offer.reservation, signal);
       if (authority === undefined) {
-        // Source Preserve, a definitive conflict or the target lease ended
-        // this staging before any target commit (Location runtime §10).
-        console.warn('[zlink.runtime.relocation.target_staging_discarded]', stagingId);
-        throw new Error(`Relocation '${stagingId}' target staging lost the authority settlement.`);
+        // The seal owner may have ended staging while a Store read was pending.
+        if ((stage as LocalStage).phase === 'failed') return;
+        return this.discardTargetStage(stagingId, stage, signal);
       }
       authorityCommitted = true;
       stage.releaseActivation();
@@ -2964,8 +3105,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       await stage.owner.openAdmission(stage.staging, signal);
       // S2→S3: owner confirmation to application dispatch opening.
       this.options.metrics?.duration(
-        'zlink.relocation.target_resume',
-        Math.max(0, performance.now() - resumeStartedAt) / 1000,
+        METRIC_NAMES.RelocationTargetResume,
+        Math.max(0, performance.now() - resumeStartedAt) / MILLISECONDS_PER_SECOND,
         { mesh_name: meshName }
       );
       await this.publishSessionRoutes(stage.staging);
@@ -2980,14 +3121,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       this.targetStages.delete(stagingId);
       this.targetAssemblies.delete(stagingId);
     } catch (error) {
-      stage.phase = 'failed';
       this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
       this.targetStages.delete(stagingId);
       this.targetAssemblies.delete(stagingId);
       if (!authorityCommitted) {
-        await this.abortTargetStage(stage).catch(() => undefined);
+        // abortTargetStage may already have assigned failed before throwing.
+        if ((stage as LocalStage).phase !== 'failed') await this.abortTargetStage(stage);
         throw error;
       }
+      stage.phase = 'failed';
       if (authority !== undefined) {
         throw new ServiceRelocationPostCommitError(authority, stage.staging, error);
       }
@@ -3123,19 +3265,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     }
     this.sourceActorJoinProfiles.delete(input.transferId);
     this.terminalActorJoinSourceLeaves.remember(input.transferId, input.actorId);
-    void profile.ready
-      .then(async () => {
-        await this.options.actorTransfer.completeRelocationSourceLeave(
-          profile.actor,
-          profile.sourceSpotId
-        );
-        await this.options
-          .actorManager()
-          ?.completeRelocationSource(input.actorId, profile.sourceActorRef);
-      })
-      .catch((error) => {
-        console.error('[zlink.runtime.relocation.source_leave_failed]', error);
-      });
+    void this.finalizeActorJoinSource(profile);
     return true;
   }
 
@@ -3309,7 +3439,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             pending.resolve('sourceLeaseExpired');
             return;
           }
-          if (++attempts > 120) {
+          if (++attempts > RELOCATION_MAX_SEND_ATTEMPTS) {
             pending.reject(new Error(`Relocation reply relay ACK '${key}' timed out.`));
             return;
           }
@@ -3319,7 +3449,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             encodeMaintenanceReplyRelay(request)
           );
           if (this.pendingReplyRelays.get(key) === pending) {
-            pending.timer = setTimeout(() => void send(), 250);
+            pending.timer = setTimeout(() => void send(), RELOCATION_RESEND_DELAY_MS);
           }
         } catch (error) {
           pending.reject(error);
@@ -3464,10 +3594,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   private async publishSessionRoutes(
     staging: ServiceObjectRelocationStaging<LocalHidden>
   ): Promise<void> {
-    for (const hidden of staging.hidden.values()) {
-      if (hidden.actor !== undefined) {
-        await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor);
-      }
+    for (const [key, hidden] of staging.hidden) {
+      if (hidden.actor === undefined) continue;
+      // The Session seal travels with the relocation envelope, not the Actor.
+      const carried = staging.envelope.participants.find((value) => value.key === key);
+      await this.options.actorTransfer.publishRoutedActorOwnership(
+        hidden.actor,
+        carried === undefined ? undefined : decodeActorSession(carried.boundSessionState)
+      );
     }
   }
 
@@ -3476,7 +3610,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     targetNodeRid: RoutingId,
     request: ZLinkServiceRelocationControlRequest,
     signal?: AbortSignal,
-    deadlineAtMs = performance.now() + 30_000,
+    deadlineAtMs: number = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS,
     sideband: readonly Uint8Array[] = []
   ): Promise<ReturnType<typeof decodeServiceRelocationControlResponse>> {
     const key = controlAckKey(request);
@@ -3496,7 +3630,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           lastRequestError
         );
       }
-      const attemptTimeoutMs = Math.max(1, Math.min(250, Math.ceil(remainingMs)));
+      const attemptTimeoutMs = Math.max(
+        1,
+        Math.min(RELOCATION_ATTEMPT_TIMEOUT_MS, Math.ceil(remainingMs))
+      );
       const startedAtMs = performance.now();
       try {
         const replyFrames = await this.requestInfrastructureControl(
@@ -3522,11 +3659,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           throw error;
         }
         lastRequestError = error;
-        relocationDebug('control.request_retry', {
-          key,
-          kind: request.kind,
-          targetRid: String(targetNodeRid)
-        });
+        if (isRelocationDebugEnabled()) {
+          relocationDebug('control.request_retry', {
+            key,
+            kind: request.kind,
+            targetRid: String(targetNodeRid)
+          });
+        }
         const retryDelayMs = Math.min(
           Math.max(0, attemptTimeoutMs - (performance.now() - startedAtMs)),
           Math.max(0, deadlineAtMs - performance.now())
@@ -3566,7 +3705,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
               peer.routingId !== null &&
               String(peer.routingId) === String(descriptor.rid) &&
               peer.lifecycleGeneration === descriptor.lifecycleGeneration &&
-              peer.state === 3
+              peer.state === MeshPeerRuntimeState.Serving
           ) &&
           relocationTargetSupports(descriptor, requirements)
       )
@@ -3801,6 +3940,22 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     }
   }
 
+  private async discardTargetStage(
+    stagingId: string,
+    stage: LocalStage,
+    signal?: AbortSignal
+  ): Promise<void> {
+    stage.phase = 'failed';
+    console.warn('[zlink.runtime.relocation.target_staging_discarded]', stagingId);
+    try {
+      await this.abortTargetStage(stage, signal);
+    } finally {
+      this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
+      this.targetStages.delete(stagingId);
+      this.targetAssemblies.delete(stagingId);
+    }
+  }
+
   private async commitTargetReservation(
     stage: LocalStage,
     reservation: TargetRelocationReservation,
@@ -3827,8 +3982,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   ): Promise<ZLinkAuthoritySnapshot | undefined> {
     const target = stage.offer.prepare.target;
     for (;;) {
+      if (stage.phase === 'failed') return undefined;
       signal?.throwIfAborted();
-      if (this.disposed) throw new Error('Relocation runtime stopped.');
+      if (this.targetStageSealed(stage)) return undefined;
       let conflict = false;
       if (stage.cutoverReceived) {
         // The boundary relay span is applied to the temporary queue before
@@ -3840,13 +3996,17 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         // A thrown provider call has an unknown result; the read below decides.
         const result = await this.requireLocationStore()
           .commitAggregate(prepared.fence, signal)
-          .catch(() => undefined);
+          .catch((error: unknown) => {
+            if (!isIndeterminateLocationStoreFailure(error, signal)) throw error;
+            return undefined;
+          });
         if (result?.kind === 'generationExhausted') {
           throw new Error('location_update_failed: relocation aggregate commit exhausted.');
         }
         conflict = result?.kind === 'stale';
       }
       const observed = await this.readAggregateForCommitRetry(prepared, signal);
+      if ((stage as LocalStage).phase === 'failed') return undefined;
       if (observed.kind === 'committed') {
         const primary = observed.authorities.get(stage.staging.primaryAuthorityKey.value);
         if (primary === undefined) {
@@ -3860,11 +4020,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         await this.exactSourceLeaseExpired(
           { ownerId: target.ownerId, leaseGeneration: target.ownerLeaseGeneration },
           signal
-        ).catch(() => false)
+        ).catch((error: unknown) => {
+          if (!isIndeterminateLocationStoreFailure(error, signal)) throw error;
+          return false;
+        })
       ) {
         return undefined;
       }
-      await waitForRelocationRetry(25, signal);
+      await waitForRelocationRetry(RELOCATION_AUTHORITY_RETRY_DELAY_MS, signal);
     }
   }
 
@@ -3906,7 +4069,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           return { kind: 'stale' };
         }
       }
-    } catch {
+    } catch (error) {
+      if (!isIndeterminateLocationStoreFailure(error, signal)) throw error;
       return { kind: 'unknown' };
     }
     if (committed === prepared.plan.participants.length) {
@@ -3958,7 +4122,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (request.object.kind === 'userSpot' || request.object.kind === 'instanceSpot') {
       let cursor: ZLinkAuthorityScanCursor | undefined;
       for (;;) {
-        const page = await store.listAuthorities('', cursor, 1000, signal);
+        const page = await store.listAuthorities('', cursor, ZLINK_PROVIDER_MAX_PAGE_SIZE, signal);
         if (page.kind === 'scanExpired') {
           throw new Error('Location Store authority scan expired during relocation.');
         }
@@ -4103,7 +4267,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     );
     if (captured.byteLength > RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES) {
       throw new ZLinkRelocationStateIncompatibleError(
-        'Relocation application state exceeds the 64 MiB participant limit.'
+        `Relocation application state exceeds the ${RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES / (1024 * 1024)} MiB participant limit.`
       );
     }
     return captured;
@@ -4124,13 +4288,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     startedAt: number,
     outcome: string
   ): void {
-    const seconds = Math.max(0, performance.now() - startedAt) / 1000;
+    const seconds = Math.max(0, performance.now() - startedAt) / MILLISECONDS_PER_SECOND;
     const attributes = {
       unit_kind: unitKind,
       ...(executionMode === undefined ? {} : { execution_mode: executionMode })
     };
-    this.options.metrics?.duration('zlink.relocation.interruption', seconds, attributes);
-    this.options.metrics?.count('zlink.relocation.completed', 1, {
+    this.options.metrics?.duration(METRIC_NAMES.RelocationInterruption, seconds, attributes);
+    this.options.metrics?.count(METRIC_NAMES.RelocationCompleted, 1, {
       mesh_name: meshName,
       object_kind: unitKind,
       policy: unitKind === 'user_spot' && executionMode === 'per_actor' ? 'recreate' : 'configured',
@@ -4388,11 +4552,6 @@ function actorJoinTargetMembership(
   ];
 }
 
-function relocationDebug(marker: string, detail: Record<string, unknown>): void {
-  if (process.env.ZLINK_DEBUG_FRAMEWORK_RELOCATION !== '1') return;
-  console.error('[zlink.runtime.relocation]', marker, detail);
-}
-
 class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden> {
   constructor(
     private readonly options: ZLinkHostRelocationOptions,
@@ -4421,8 +4580,8 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
         participant.stableType,
         participant.objectGeneration,
         participant.authorityOwnerGeneration + 1n,
-        (nativeEntrySpot ? localDescriptor.rid : spotIdentity) as RoutingId,
-        nativeEntrySpot ? localDescriptor.lifecycleGeneration : membership.spotObjectGeneration,
+        nativeEntrySpot ? undefined : (spotIdentity as RoutingId),
+        membership.spotObjectGeneration,
         membership.membershipEpoch,
         signal
       );
@@ -4562,11 +4721,22 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
         hidden.participant.objectKind === 'user_spot' &&
         registration.options?.relocationCoordinationMode ===
           ZLinkSpotRelocationCoordinationMode.ApplicationSignaled;
+      // createHidden could only predict the owner generation; the native Spot
+      // takes the committed authority, as the Actor branch does above.
+      const node = this.options.meshNode(this.meshName);
+      node?.restoreSpotAuthority?.(
+        String(hidden.activation.spotId),
+        // createHidden stages an activation only for a Spot participant.
+        hidden.participant.objectKind as 'user_spot' | 'instance_spot',
+        hidden.participant.stableType,
+        authority.objectGeneration,
+        authority.authorityOwnerGeneration
+      );
       await this.requireSpotManager().publishRelocationSpot(
         hidden.activation,
         applicationSignaled ? () => hidden.activation!.notifyRelocatedBoundary() : undefined
       );
-      this.options.meshNode(this.meshName)?.rememberSpotRoute?.({
+      node?.rememberSpotRoute?.({
         spot: {
           spotId: String(hidden.activation.spotId),
           generation: authority.objectGeneration
@@ -4597,14 +4767,13 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
   }
 
   async restoreBoundSession(hidden: LocalHidden, payload: Uint8Array): Promise<void> {
-    if (hidden.actor === undefined || payload.byteLength === 0) return;
-    const target = decodeActorSession(payload);
-    const state = this.requireActorManager().getState(hidden.actor.context.actorId)!;
-    state.setRemoteBoundSessionTarget(target);
-    state.setBoundSessionTransferTarget(target);
-    if (target.bindingGeneration !== undefined) {
-      state.setBoundSessionBindingGeneration(target.bindingGeneration);
-    }
+    const carried = decodeActorSession(payload);
+    if (hidden.actor === undefined || carried === undefined) return;
+    // The relocation delivers the binding it carried; the target installs it
+    // through the one install rule (Session–Actor binding §6, §8).
+    this.requireActorManager()
+      .getState(hidden.actor.context.actorId)!
+      .installBoundSessionBinding(carried);
   }
 
   async replayQueuedMessage(
@@ -5060,9 +5229,11 @@ export function createServiceRelocationId(
   entropy: (size: number) => Uint8Array = randomBytes
 ): string {
   for (;;) {
-    const bytes = entropy(16);
-    if (bytes.byteLength !== 16) {
-      throw new Error('Relocation identity entropy must return exactly 16 bytes.');
+    const bytes = entropy(OPERATION_IDENTITY_BYTES);
+    if (bytes.byteLength !== OPERATION_IDENTITY_BYTES) {
+      throw new Error(
+        `Relocation identity entropy must return exactly ${OPERATION_IDENTITY_BYTES} bytes.`
+      );
     }
     let nonZero = false;
     for (const byte of bytes) {
@@ -5103,13 +5274,52 @@ function sameCoordinator(
 ): boolean {
   return (
     left.ownerId === right.ownerId &&
-    left.leaseGeneration === right.leaseGeneration &&
+    BigInt(left.leaseGeneration) === right.leaseGeneration &&
     left.nodeRid === right.nodeRid &&
-    left.nodeGeneration === right.nodeGeneration &&
+    BigInt(left.nodeGeneration) === right.nodeGeneration &&
     left.expectedAuthorityStoreVersion === right.expectedAuthorityStoreVersion
   );
 }
 
+function sameRelocationTarget(
+  left: ServiceWireRelocationTarget,
+  right: ServiceWireRelocationTarget
+): boolean {
+  return (
+    left.nodeRid === right.nodeRid &&
+    BigInt(left.nodeGeneration) === right.nodeGeneration &&
+    left.ownerId === right.ownerId &&
+    BigInt(left.ownerLeaseGeneration) === right.ownerLeaseGeneration
+  );
+}
+
+function sameRelocationObject(
+  left: ServiceWireRelocationObject,
+  right: ServiceWireRelocationObject
+): boolean {
+  if (left.kind !== right.kind || BigInt(left.objectGeneration) !== right.objectGeneration) {
+    return false;
+  }
+  if (left.kind === 'actor' && right.kind === 'actor') {
+    return (
+      left.actorId === right.actorId &&
+      BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration
+    );
+  }
+  if (left.kind === 'userSpot' && right.kind === 'userSpot') {
+    return (
+      left.spotId === right.spotId &&
+      BigInt(left.expectedAuthorityOwnerGeneration) === right.expectedAuthorityOwnerGeneration
+    );
+  }
+  return (
+    left.kind === 'instanceSpot' &&
+    right.kind === 'instanceSpot' &&
+    left.spotId === right.spotId &&
+    left.stableType === right.stableType
+  );
+}
+
 function isExactSourceAuthority(
   current: ZLinkAuthoritySnapshot,
   expected: ZLinkAuthoritySnapshot
@@ -5206,14 +5416,16 @@ function maintenanceReplyRelay(
     replyRouteId: BigInt(completion.source.replyRouteId),
     participantId,
     sequence: BigInt(completion.index + 1),
-    terminalResult: completion.result.ok ? 0 : 105,
-    failureCode: completion.result.ok ? 0 : 17,
+    terminalResult: completion.result.ok ? RequestResult.Ok : RequestResult.InternalError,
+    failureCode: completion.result.ok
+      ? ServiceWireFrameworkErrorCode.none
+      : ServiceWireFrameworkErrorCode.requestFailed,
     ...(value === undefined
       ? {}
       : {
           payload: {
-            packetName: 'zlink.relocation.reply',
-            contentType: 'application/json',
+            packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
+            contentType: ZlinkStreamContentType.Json,
             bytes: Buffer.from(JSON.stringify(value), 'utf8')
           }
         })
@@ -5227,16 +5439,16 @@ function handoffResultFromRelay(relay: ServiceMaintenanceReplyRelay): ZLinkActor
   let value: unknown;
   if (relay.payload !== undefined) {
     if (
-      relay.terminalResult !== 0 ||
-      relay.payload.packetName !== 'zlink.relocation.reply' ||
-      relay.payload.contentType !== 'application/json'
+      relay.terminalResult !== RequestResult.Ok ||
+      relay.payload.packetName !== SERVICE_RELOCATION_REPLY_PACKET_NAME ||
+      relay.payload.contentType !== ZlinkStreamContentType.Json
     ) {
       throw new TypeError('Relocation terminal payload boundary is invalid.');
     }
     value = JSON.parse(Buffer.from(relay.payload.bytes).toString('utf8')) as unknown;
   }
   const index = Number(relay.sequence - 1n);
-  return relay.terminalResult === 0
+  return relay.terminalResult === RequestResult.Ok
     ? { index, ok: true, ...(value === undefined ? {} : { response: value }) }
     : { index, ok: false, error: `Actor handoff failed with framework code ${relay.failureCode}.` };
 }
@@ -5252,76 +5464,15 @@ function wireIdText(value: { readonly high: bigint; readonly low: bigint }): str
  */
 export class ServiceRelocationDataLostError extends Error {}
 
-/**
- * Maps a target-side relocation Prepare failure to the closest wire
- * framework-error code the generated schema
- * ({@link ServiceWireFrameworkErrorCode}) defines — mirrors the java
- * reference mapping (commit 97fc074058) and the dotnet/cpp ports. The wire
- * vocabulary predates the framework's typed error kinds and has no
- * one-to-one code for every kind, so several kinds share the nearest fit
- * (documented per case below); unresolvable vocabulary gaps belong at the
- * schema level, not invented here. {@link ServiceRelocationDataLostError}
- * is this runtime's dedicated tag for a verified checksum/assembly/digest
- * integrity failure — the case that keeps relocationDataLost(35). An
- * unclassified error carries no evidence of integrity loss and takes the
- * generic opaque requestFailed(17). `objectKind` (the Prepare's
- * ObjectFence.kind, spec 28 §4.2) picks between an Actor- and
- * Spot-specific code where the schema splits by object kind.
- */
-export function relocationFailedFailureCode(
-  error: unknown,
-  objectKind: ServiceWireRelocationObject['kind']
-): number {
+/** Classifies relocation failure with the error model §2.1 mapping. */
+export function relocationFailedFailureCode(error: unknown): number {
   if (error instanceof ServiceRelocationDataLostError) {
-    return ServiceWireFrameworkErrorCode.relocationDataLost;
+    return frameworkRelocationFailureCode(ZLinkFrameworkErrorKind.DataLost);
   }
   if (!(error instanceof ZLinkFrameworkException)) {
-    return ServiceWireFrameworkErrorCode.requestFailed;
-  }
-  switch (error.kind) {
-    case ZLinkFrameworkErrorKind.DataLost:
-      return ServiceWireFrameworkErrorCode.relocationDataLost;
-    case ZLinkFrameworkErrorKind.Rejected:
-      return ServiceWireFrameworkErrorCode.requestRejected;
-    case ZLinkFrameworkErrorKind.ProtocolError:
-      return ServiceWireFrameworkErrorCode.requestProtocolError;
-    //  No dedicated "deadline exceeded" wire code exists; a worker timeout
-    //  is the closest timeout-shaped signal.
-    case ZLinkFrameworkErrorKind.DeadlineExceeded:
-      return ServiceWireFrameworkErrorCode.workerTimedOut;
-    //  A stale generation/fence is the concrete cause of InvalidOperation
-    //  along this path (spec 15 failure table); pick the
-    //  object-kind-specific stale code.
-    case ZLinkFrameworkErrorKind.InvalidOperation:
-      return objectKind === 'actor'
-        ? ServiceWireFrameworkErrorCode.actorLocationStale
-        : ServiceWireFrameworkErrorCode.spotGenerationStale;
-    //  No dedicated generic "unavailable" wire code exists; a disconnected
-    //  route is the closest "cannot reach/use the target" signal.
-    case ZLinkFrameworkErrorKind.Unavailable:
-      return ServiceWireFrameworkErrorCode.routeNotConnected;
-    case ZLinkFrameworkErrorKind.NotFound:
-      return ServiceWireFrameworkErrorCode.requestTargetNotFound;
-    //  The only "already exists" wire code is Actor-specific; not expected
-    //  along this target-failure path, mapped for completeness.
-    case ZLinkFrameworkErrorKind.AlreadyExists:
-      return ServiceWireFrameworkErrorCode.actorAlreadyExists;
-    case ZLinkFrameworkErrorKind.TypeMismatch:
-      return objectKind === 'actor'
-        ? ServiceWireFrameworkErrorCode.actorTypeMismatch
-        : ServiceWireFrameworkErrorCode.spotTypeMismatch;
-    //  No dedicated "not configured" wire code exists; a missing configured
-    //  handler is the closest analog.
-    case ZLinkFrameworkErrorKind.NotConfigured:
-      return ServiceWireFrameworkErrorCode.handlerNotFound;
-    //  No dedicated generic "internal failure" or "shutting down" wire code
-    //  exists; the generic opaque request-failure code is the closest fit
-    //  for both (ShuttingDown included — re-judged 2026-08-19, C-10).
-    case ZLinkFrameworkErrorKind.ShuttingDown:
-    case ZLinkFrameworkErrorKind.InternalFailure:
-    default:
-      return ServiceWireFrameworkErrorCode.requestFailed;
+    return frameworkRelocationFailureCode(ZLinkFrameworkErrorKind.InternalFailure);
   }
+  return frameworkRelocationFailureCode(error);
 }
 
 function relocationStagingId(value: {
@@ -5434,7 +5585,7 @@ function validatePrepareEnvelope(
   if (
     !sameWireId(request.relocation, relocationWireId(envelope.aggregateId)) ||
     request.applicationVersion !== envelope.applicationVersion ||
-    stringifyWire(request.object) !== stringifyWire(relocationObject(envelope))
+    !sameRelocationObject(request.object, relocationObject(envelope))
   ) {
     throw new Error('Relocation Prepare does not match its immutable root identity.');
   }
@@ -5451,17 +5602,10 @@ function validateTargetOneWayControl(
     !sameWireId(request.relocation, prepare.relocation) ||
     request.targetAttemptGeneration !== prepare.targetAttemptGeneration ||
     !sameCoordinator(request.coordinator, prepare.coordinator) ||
-    stringifyWire(request.object) !==
-      stringifyWire(request.kind === 'data' ? request.object : prepare.object)
+    (request.kind === 'cutover' && !sameRelocationObject(request.object, prepare.object))
   ) {
     throw new Error('Relocation one-way control changed its exact Prepare fence.');
   }
-  if (
-    request.kind === 'cutover' &&
-    stringifyWire(request.object) !== stringifyWire(prepare.object)
-  ) {
-    throw new Error('Relocation Cutover changed its prepared object.');
-  }
 }
 
 function relocationPublication(
@@ -5566,7 +5710,7 @@ function canonicalQueuedFrozenRecord(
     ...(packet.returnResponse ? { replyRouteId: BigInt(packet.source!.replyRouteId) } : {}),
     payload: {
       packetName: '__zlink.actor.handoff.accepted',
-      contentType: 'application/json',
+      contentType: ZlinkStreamContentType.Json,
       bytes: message.payload
     }
   });
@@ -5590,6 +5734,20 @@ function stringifyWire(value: unknown): string {
   return JSON.stringify(value, (_key, item) => (typeof item === 'bigint' ? item.toString() : item));
 }
 
+function samePrepareIdentity(
+  acceptedFingerprint: string,
+  incoming: ServiceMaintenanceRelocationPrepare
+): boolean {
+  const accepted = JSON.parse(acceptedFingerprint) as ServiceMaintenanceRelocationPrepare;
+  return (
+    accepted.sourceNodeRid === incoming.sourceNodeRid &&
+    BigInt(accepted.sourceNodeGeneration) === incoming.sourceNodeGeneration &&
+    sameCoordinator(accepted.coordinator, incoming.coordinator) &&
+    sameRelocationTarget(accepted.target, incoming.target) &&
+    sameRelocationObject(accepted.object, incoming.object)
+  );
+}
+
 function validateControlResponse(
   request: ZLinkServiceRelocationControlRequest,
   response: ZLinkServiceRelocationControlResponse
@@ -5600,8 +5758,8 @@ function validateControlResponse(
     !sameWireId(response.relocation, request.relocation) ||
     response.targetAttemptGeneration !== request.targetAttemptGeneration ||
     !sameCoordinator(response.coordinator, request.coordinator) ||
-    stringifyWire(response.target) !== stringifyWire(request.target) ||
-    stringifyWire(response.object) !== stringifyWire(request.object) ||
+    !sameRelocationTarget(response.target, request.target) ||
+    !sameRelocationObject(response.object, request.object) ||
     response.senderRole !== 'target'
   ) {
     throw new Error('Relocation control response does not match the request fence.');
@@ -5624,82 +5782,19 @@ function validateControlFailureResponse(
     !sameWireId(response.relocation, request.relocation) ||
     response.targetAttemptGeneration !== request.targetAttemptGeneration ||
     !sameCoordinator(response.coordinator, request.coordinator) ||
-    stringifyWire(response.target) !== stringifyWire(request.target) ||
-    stringifyWire(response.object) !== stringifyWire(request.object) ||
+    !sameRelocationTarget(response.target, request.target) ||
+    !sameRelocationObject(response.object, request.object) ||
     response.senderRole !== 'target'
   ) {
     throw new Error('Relocation control response does not match the request fence.');
   }
 }
 
-/**
- * Maps a relocationFailed(53) wire failureCode (the generated
- * ServiceWireFrameworkErrorCode vocabulary) to its internal error kind, so a
- * source-side reject carries the same classification the target chose
- * instead of a generic Error. Direct 1:1 correspondence with the generated
- * names; an unrecognised or absent code falls back to RequestFailed
- * (InternalFailure) — the closest existing kind (spec 15 §"Failed.Kind").
- */
-function relocationFailureCodeKind(failureCode: number): ZLinkFrameworkInternalErrorKind {
-  switch (failureCode) {
-    case 1:
-      return ZLinkFrameworkInternalErrorKind.ActorRouteNotFound;
-    case 2:
-      return ZLinkFrameworkInternalErrorKind.ActorCreateFailed;
-    case 3:
-      return ZLinkFrameworkInternalErrorKind.ActorAlreadyExists;
-    case 4:
-      return ZLinkFrameworkInternalErrorKind.ActorTypeMismatch;
-    case 5:
-      return ZLinkFrameworkInternalErrorKind.SpotCreateFailed;
-    case 6:
-      return ZLinkFrameworkInternalErrorKind.SpotRouteNotFound;
-    case 7:
-      return ZLinkFrameworkInternalErrorKind.SpotTypeMismatch;
-    case 8:
-      return ZLinkFrameworkInternalErrorKind.ActorSessionNotBound;
-    case 9:
-      return ZLinkFrameworkInternalErrorKind.HandlerNotFound;
-    case 10:
-      return ZLinkFrameworkInternalErrorKind.RouteHandlerNotFound;
-    case 11:
-      return ZLinkFrameworkInternalErrorKind.ActorDispatchHandlerNotFound;
-    case 12:
-      return ZLinkFrameworkInternalErrorKind.PayloadDecodeFailed;
-    case 13:
-      return ZLinkFrameworkInternalErrorKind.RouteNotConnected;
-    case 14:
-      return ZLinkFrameworkInternalErrorKind.RequestTargetNotFound;
-    case 15:
-      return ZLinkFrameworkInternalErrorKind.RequestRejected;
-    case 16:
-      return ZLinkFrameworkInternalErrorKind.RequestProtocolError;
-    case 18:
-      return ZLinkFrameworkInternalErrorKind.WorkerQueueFull;
-    case 19:
-      return ZLinkFrameworkInternalErrorKind.WorkerTimedOut;
-    case 20:
-      return ZLinkFrameworkInternalErrorKind.WorkerFailed;
-    case 21:
-      return ZLinkFrameworkInternalErrorKind.ActorLocationStale;
-    case 22:
-      return ZLinkFrameworkInternalErrorKind.ActorCreateRejected;
-    case 33:
-      return ZLinkFrameworkInternalErrorKind.SpotGenerationStale;
-    case 34:
-      return ZLinkFrameworkInternalErrorKind.SpotMoving;
-    case 35:
-      return ZLinkFrameworkInternalErrorKind.RelocationDataLost;
-    case 17:
-    default:
-      return ZLinkFrameworkInternalErrorKind.RequestFailed;
-  }
-}
-
 /** Builds the typed exception a Prepare waiter rejects with on an explicit Failed(53). */
 function relocationFailureException(response: ServiceMaintenanceRelocationFailed) {
   return createInternalFrameworkException(
-    relocationFailureCodeKind(response.failureCode),
+    internalFrameworkErrorKindFromWireFailureCode(response.failureCode) ??
+      ZLinkFrameworkInternalErrorKind.RequestFailed,
     `Relocation '${response.relocation.high}:${response.relocation.low}:` +
       `${response.targetAttemptGeneration}' failed with wire failureCode ${response.failureCode}.`,
     true
@@ -5879,7 +5974,7 @@ function queuedMessageU64(value: unknown, field: string): bigint {
     throw new TypeError(`Relocation Actor Message Follow ${field} is invalid.`);
   }
   const result = BigInt(value);
-  if (result > 0xffff_ffff_ffff_ffffn) {
+  if (result > UINT64_MAX) {
     throw new TypeError(`Relocation Actor Message Follow ${field} is outside u64.`);
   }
   return result;
@@ -5903,6 +5998,15 @@ function toServiceTimer(
   };
 }
 
+const PREPARE_SIDEBAND_MAGIC = 'ZLNI';
+const PREPARE_SIDEBAND_VERSION = 1;
+const PREPARE_SIDEBAND_HEADER_BYTES = 11;
+const PREPARE_SIDEBAND_VERSION_OFFSET = 4;
+const PREPARE_SIDEBAND_KEY_LENGTH_OFFSET = 5;
+const PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET = 7;
+const ACTOR_SESSION_JOURNAL_VERSION = 1;
+const SERVICE_RELOCATION_REPLY_PACKET_NAME = 'zlink.relocation.reply';
+
 /**
  * NODE-INTERNAL Prepare sideband. Frame zero remains the exact canonical
  * command-40 schema record; each following ZLNI frame carries one sealed
@@ -5918,11 +6022,11 @@ function encodePrepareSideband(envelope: ServiceRelocationEnvelope): readonly Bu
       if (key.byteLength === 0 || key.byteLength > 0xffff || payload.byteLength > 0xffff_ffff) {
         throw new TypeError('Bound-session relocation sideband is out of bounds.');
       }
-      const header = Buffer.allocUnsafe(11);
-      header.write('ZLNI', 0, 'ascii');
-      header[4] = 1;
-      header.writeUInt16BE(key.byteLength, 5);
-      header.writeUInt32BE(payload.byteLength, 7);
+      const header = Buffer.allocUnsafe(PREPARE_SIDEBAND_HEADER_BYTES);
+      header.write(PREPARE_SIDEBAND_MAGIC, 0, 'ascii');
+      header[PREPARE_SIDEBAND_VERSION_OFFSET] = PREPARE_SIDEBAND_VERSION;
+      header.writeUInt16BE(key.byteLength, PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+      header.writeUInt32BE(payload.byteLength, PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
       return Buffer.concat([header, key, payload]);
     });
 }
@@ -5938,19 +6042,29 @@ function decodePrepareSideband(frames: readonly Uint8Array[]):
   for (const frame of frames) {
     const bytes = Buffer.from(frame);
     if (
-      bytes.byteLength < 11 ||
-      bytes.subarray(0, 4).toString('ascii') !== 'ZLNI' ||
-      bytes[4] !== 1
+      bytes.byteLength < PREPARE_SIDEBAND_HEADER_BYTES ||
+      bytes.subarray(0, PREPARE_SIDEBAND_VERSION_OFFSET).toString('ascii') !==
+        PREPARE_SIDEBAND_MAGIC ||
+      bytes[PREPARE_SIDEBAND_VERSION_OFFSET] !== PREPARE_SIDEBAND_VERSION
     ) {
       return undefined;
     }
-    const keyLength = bytes.readUInt16BE(5);
-    const payloadLength = bytes.readUInt32BE(7);
-    if (11 + keyLength + payloadLength !== bytes.byteLength || keyLength === 0) return undefined;
-    const participantKey = bytes.subarray(11, 11 + keyLength).toString('utf8');
+    const keyLength = bytes.readUInt16BE(PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
+    const payloadLength = bytes.readUInt32BE(PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
+    if (
+      PREPARE_SIDEBAND_HEADER_BYTES + keyLength + payloadLength !== bytes.byteLength ||
+      keyLength === 0
+    )
+      return undefined;
+    const participantKey = bytes
+      .subarray(PREPARE_SIDEBAND_HEADER_BYTES, PREPARE_SIDEBAND_HEADER_BYTES + keyLength)
+      .toString('utf8');
     if (keys.has(participantKey)) return undefined;
     keys.add(participantKey);
-    result.push({ participantKey, payload: Buffer.from(bytes.subarray(11 + keyLength)) });
+    result.push({
+      participantKey,
+      payload: Buffer.from(bytes.subarray(PREPARE_SIDEBAND_HEADER_BYTES + keyLength))
+    });
   }
   return result;
 }
@@ -5981,13 +6095,16 @@ function encodeActorSession(target: ZLinkRemoteBoundSessionTarget | undefined):
   if (target === undefined) return Buffer.alloc(0);
   return Buffer.from(
     JSON.stringify({
-      version: 1,
+      version: ACTOR_SESSION_JOURNAL_VERSION,
       routerChannelId: target.routerChannelId,
       targetNodeRid: String(target.targetNodeRid),
       spotId: String(target.spotId),
       sessionNodeRid:
         target.sessionNodeRid === undefined ? undefined : String(target.sessionNodeRid),
       sessionRid: target.sessionRid === undefined ? undefined : String(target.sessionRid),
+      sessionOwnerNodeGeneration: target.sessionOwnerNodeGeneration?.toString(),
+      sessionOwnerId: target.sessionOwnerId,
+      sessionOwnerLeaseGeneration: target.sessionOwnerLeaseGeneration?.toString(),
       bindingGeneration: target.bindingGeneration?.toString(),
       previousAuthorityOwnerGeneration: target.previousAuthorityOwnerGeneration?.toString(),
       previousOwnerLeaseGeneration: target.previousOwnerLeaseGeneration?.toString(),
@@ -6020,12 +6137,13 @@ function encodeActorSession(target: ZLinkRemoteBoundSessionTarget | undefined):
   );
 }
 
-function decodeActorSession(payload: Uint8Array): ZLinkRemoteBoundSessionTarget {
+function decodeActorSession(payload: Uint8Array): ZLinkRemoteBoundSessionTarget | undefined {
+  if (payload.byteLength === 0) return undefined;
   const value = JSON.parse(Buffer.from(payload).toString('utf8')) as Record<string, unknown>;
   const optionalBigInt = (field: string) =>
     typeof value[field] === 'string' ? BigInt(value[field] as string) : undefined;
   if (
-    value.version !== 1 ||
+    value.version !== ACTOR_SESSION_JOURNAL_VERSION ||
     typeof value.routerChannelId !== 'string' ||
     typeof value.targetNodeRid !== 'string' ||
     typeof value.spotId !== 'string'
@@ -6041,6 +6159,13 @@ function decodeActorSession(payload: Uint8Array): ZLinkRemoteBoundSessionTarget
       ? { sessionNodeRid: value.sessionNodeRid as RoutingId }
       : {}),
     ...(typeof value.sessionRid === 'string' ? { sessionRid: value.sessionRid as RoutingId } : {}),
+    ...(optionalBigInt('sessionOwnerNodeGeneration') === undefined
+      ? {}
+      : { sessionOwnerNodeGeneration: optionalBigInt('sessionOwnerNodeGeneration') }),
+    ...(typeof value.sessionOwnerId === 'string' ? { sessionOwnerId: value.sessionOwnerId } : {}),
+    ...(optionalBigInt('sessionOwnerLeaseGeneration') === undefined
+      ? {}
+      : { sessionOwnerLeaseGeneration: optionalBigInt('sessionOwnerLeaseGeneration') }),
     ...(optionalBigInt('bindingGeneration') === undefined
       ? {}
       : { bindingGeneration: optionalBigInt('bindingGeneration') }),
@@ -6153,3 +6278,16 @@ function addCapacity(left: ZLinkCapacityVector, right: ZLinkCapacityVector): ZLi
         })
   };
 }
+
+if (isStructuralGuardEnabled()) {
+  const relocateActorJoin = ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin;
+  ZLinkHostServiceRelocationRuntime.prototype.relocateActorJoin = function (
+    this: ZLinkHostServiceRelocationRuntime,
+    input: Parameters<ZLinkActorJoinRelocation['relocateActorJoin']>[0]
+  ): ReturnType<ZLinkActorJoinRelocation['relocateActorJoin']> {
+    return trackDiagnosticCompletion(
+      relocateActorJoin.call(this, input),
+      `relocation join actor:${input.state.actorId}`
+    );
+  };
+}