@zlink-systems/framework 0.30.0 → 0.30.2

package/dist/runtime/host/service-relocation-host-runtime.js

@@ -5,18 +5,26 @@ exports.decodeQueuedHandoffPacket = decodeQueuedHandoffPacket;
 exports.createServiceRelocationId = createServiceRelocationId;
 exports.relocationFailedFailureCode = relocationFailedFailureCode;
 exports.encodeHandoffQueuedMessages = encodeHandoffQueuedMessages;
+const actor_reply_1 = require("../actors/actor-reply");
+const protocol_1 = require("../streams/protocol");
+const service_wire_m6a_codec_1 = require("../foundation/service-wire-m6a-codec");
+const service_wire_constants_generated_1 = require("../foundation/service-wire-constants.generated");
+const operation_registry_1 = require("../foundation/operation-registry");
+const durable_service_request_1 = require("../foundation/durable-service-request");
 const stream_wire_1 = require("@zlink-systems/stream-wire");
 const node_crypto_1 = require("node:crypto");
 const contracts_1 = require("../../contracts");
+const ZLinkDispatchOptions_1 = require("../../contracts/Dispatch/ZLinkDispatchOptions");
 const Options_1 = require("../../contracts/Locations/Options");
 const Stores_1 = require("../../contracts/Locations/Stores");
 const actor_authority_publication_1 = require("../actors/actor-authority-publication");
-const actor_handoff_1 = require("../actors/actor-handoff");
 const actor_remote_wire_1 = require("../actors/actor-remote-wire");
 const actor_runtime_state_1 = require("../actors/actor-runtime-state");
 const runtime_values_1 = require("../backend/runtime-values");
 const diagnostics_1 = require("../diagnostics");
 const runtime_metrics_1 = require("../diagnostics/runtime-metrics");
+const message_flow_1 = require("../diagnostics/message-flow");
+const dispatch_error_details_1 = require("../diagnostics/dispatch-error-details");
 const state_lane_1 = require("../execution/state-lane");
 const actor_join_recovery_codec_1 = require("../foundation/actor-join-recovery-codec");
 const operation_identity_1 = require("../foundation/operation-identity");
@@ -28,8 +36,8 @@ const service_relocation_object_owner_1 = require("../foundation/service-relocat
 const service_relocation_runtime_1 = require("../foundation/service-relocation-runtime");
 const service_runtime_contracts_1 = require("../foundation/service-runtime-contracts");
 const service_stateful_wire_codec_1 = require("../foundation/service-stateful-wire-codec");
-const service_wire_constants_generated_1 = require("../foundation/service-wire-constants.generated");
-const service_wire_m6a_codec_1 = require("../foundation/service-wire-m6a-codec");
+const service_wire_constants_generated_2 = require("../foundation/service-wire-constants.generated");
+const service_wire_m6a_codec_2 = require("../foundation/service-wire-m6a-codec");
 const framework_errors_internal_1 = require("../framework-errors-internal");
 const authority_key_codec_1 = require("../locations/authority-key-codec");
 const location_store_failure_1 = require("../locations/location-store-failure");
@@ -42,7 +50,6 @@ const relocation_direct_transfer_1 = require("./relocation-direct-transfer");
 const relocation_integrity_fault_gate_1 = require("./relocation-integrity-fault-gate");
 const relocation_state_adapter_1 = require("./relocation-state-adapter");
 const service_relocation_control_1 = require("./service-relocation-control");
-const RELOCATION_ATTEMPT_TIMEOUT_MS = 250;
 const RELOCATION_AUTHORITY_RETRY_DELAY_MS = 25;
 const RELOCATION_MAX_SEND_ATTEMPTS = 120;
 const RELOCATION_AUTHORITY_POLL_INTERVAL_MS = 10;
@@ -60,12 +67,12 @@ const RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES = 64 * 1024 * 1024;
 const RELOCATION_TARGET_TOMBSTONE_LIMIT = 1024;
 const RELOCATION_OPERATION_RETENTION_MS = 5 * 60_000;
 const SERVICE_CONTROL_TERMINAL_CAPACITY = 4096;
+const INITIAL_MEMBERSHIP_EPOCH = 1n;
 /** Production host bridge from Retire inventory to remote RouteMesh owners. */
 class ZLinkHostServiceRelocationRuntime {
     options;
     targetStages = new Map();
     terminalTargets = new bounded_replay_map_1.BoundedReplayMap(RELOCATION_TARGET_TOMBSTONE_LIMIT);
-    relocationAuthorityKeys = new Map();
     targetPrepareOperations = new Map();
     pendingReplyRelays = new Map();
     pendingSessionRelocations = new Map();
@@ -103,6 +110,7 @@ class ZLinkHostServiceRelocationRuntime {
      * checksum integrity failure — it must not be reported as DataLost(35).
      */
     disposed = false;
+    targetPreparationStop = new AbortController();
     constructor(options) {
         this.options = options;
     }
@@ -130,6 +138,10 @@ class ZLinkHostServiceRelocationRuntime {
                     reject(failure.cause);
             };
         });
+        let acceptRelay;
+        const relayReady = new Promise((resolve) => {
+            acceptRelay = resolve;
+        });
         this.sourceActorJoinProfiles.set(input.relocationId, {
             actor: input.actor,
             state: input.state,
@@ -143,32 +155,43 @@ class ZLinkHostServiceRelocationRuntime {
                 : actor_join_recovery_codec_1.RECREATE_RELOCATION_CONTENT_TYPE,
             completionOperationId: input.completionOperationId,
             canonicalRecovery: input.canonicalRecovery,
+            relayReady: acceptRelay,
             ready,
             resolveReady
         });
         const membershipEpoch = input.state.spotMembershipEpoch > 0n ? input.state.spotMembershipEpoch : 1n;
         const spotGeneration = input.target.targetSpotGeneration ?? target.lifecycleGeneration;
-        try {
-            await this.relocateStandaloneActor(input.meshName, input.state, target, target.applicationVersion, input.signal, {
-                spotId: input.target.spotId,
-                spotKind: input.target.spotKind === contracts_1.ZLinkSpotKind.Entry
-                    ? contracts_1.ZLinkSpotKind.Entry
-                    : contracts_1.ZLinkSpotKind.User,
-                spotObjectGeneration: spotGeneration
-            }, input.relocationId, true, input.advertisedReceiveChunkLimitBytes);
-            resolveReady();
-        }
-        catch (error) {
-            if (error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) {
-                resolveReady(error);
-                this.completeActorJoinSourceCleanup(input.state.actorId);
+        const cleanup = (async () => {
+            try {
+                await this.relocateStandaloneActor(input.meshName, input.state, target, target.applicationVersion, input.signal, {
+                    ...input.target,
+                    spotKind: input.target.spotKind === contracts_1.ZLinkSpotKind.Entry
+                        ? contracts_1.ZLinkSpotKind.Entry
+                        : contracts_1.ZLinkSpotKind.User,
+                    spotObjectGeneration: spotGeneration
+                }, input.relocationId, true, input.advertisedReceiveChunkLimitBytes, input.deadlineAtMs);
+                resolveReady();
             }
-            else {
-                this.sourceActorJoinProfiles.delete(input.relocationId);
-                throw error;
+            catch (error) {
+                if (error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) {
+                    resolveReady(error);
+                    this.completeActorJoinSourceCleanup(input.state.actorId);
+                }
+                else {
+                    this.sourceActorJoinProfiles.delete(input.relocationId);
+                    resolveReady();
+                    throw error;
+                }
             }
-        }
+        })();
+        const settledCleanup = Promise.allSettled([cleanup]);
+        await Promise.race([relayReady, cleanup]);
         return {
+            sourceCleanup: async () => {
+                const [outcome] = await settledCleanup;
+                if (outcome.status === 'rejected')
+                    throw outcome.reason;
+            },
             actorRef: {
                 actorId: sourceRef.actorId,
                 generation: sourceRef.generation,
@@ -199,9 +222,11 @@ class ZLinkHostServiceRelocationRuntime {
             if (window.followTimer !== undefined)
                 clearTimeout(window.followTimer);
         }
+        const hadSourceWindows = this.sourceCutoverWindows.size !== 0;
         this.sourceCutoverWindows.clear();
-        const stopped = new Error('Relocation runtime stopped.');
-        stopped.name = 'AbortError';
+        if (hadSourceWindows)
+            this.options.sourceQuiescenceChanged?.();
+        const stopped = new ServiceRelocationRuntimeStoppedError();
         this.targetPrepareOperations.clear();
         for (const pending of this.pendingReplyRelays.values()) {
             if (pending.timer !== undefined)
@@ -219,10 +244,9 @@ class ZLinkHostServiceRelocationRuntime {
         this.pendingSessionRelocations.clear();
         this.terminalSessionRelocations.clear();
         this.failedSessionRouteSubmits.clear();
-        this.sourceActorJoinProfiles.clear();
+        await this.drainActorJoinSources();
         this.terminalActorJoinSourceLeaves.clear();
-        this.options.boundSessionRelocation?.clear?.();
-        this.relocationAuthorityKeys.clear();
+        await this.options.boundSessionRelocation?.clear?.();
         if (errors.length === 1)
             throw errors[0];
         if (errors.length > 1)
@@ -230,6 +254,11 @@ class ZLinkHostServiceRelocationRuntime {
     }
     /** Host shutdown waits for the existing attempt terminal before releasing its lease. */
     async drainTargetAttempts() {
+        this.targetPreparationStop.abort(new contracts_1.ZLinkFrameworkException(contracts_1.ZLinkFrameworkErrorKind.ShuttingDown, 'Relocation target is shutting down.'));
+        for (const pending of this.targetAssemblies.values()) {
+            pending.assembly.fail('Relocation target is shutting down.');
+        }
+        await Promise.allSettled([...this.targetPrepareOperations.values()].map((value) => value.promise));
         const results = await Promise.allSettled([...this.targetStages.entries()].map(([stagingId, stage]) => {
             if (stage.fallback !== undefined)
                 clearTimeout(stage.fallback);
@@ -252,18 +281,34 @@ class ZLinkHostServiceRelocationRuntime {
     }
     /** Spec 28 §4.4: the target owner alone orders shutdown seal and verified cutover. */
     targetStageSealed(stage) {
-        return (!stage.cutoverReceived && (this.disposed || this.options.targetAdmissionSealed?.() === true));
+        return !stage.cutoverReceived && this.targetAdmissionSealed();
+    }
+    /** The Shutdown admission seal: closed once the target owner starts shutdown. */
+    targetAdmissionSealed() {
+        return this.disposed || this.options.targetAdmissionSealed?.() === true;
     }
     completeActorJoinSourceCleanup(actorId) {
         for (const [relocationId, profile] of this.sourceActorJoinProfiles) {
             if (profile.state.actorId !== actorId)
                 continue;
-            this.sourceActorJoinProfiles.delete(relocationId);
-            this.terminalActorJoinSourceLeaves.remember(relocationId, actorId);
-            void this.finalizeActorJoinSource(profile);
+            void this.retireActorJoinSource(relocationId, profile);
         }
     }
-    async finalizeActorJoinSource(profile) {
+    /** Drains the exact source scopes before their Spot lifecycle owners stop. */
+    async drainActorJoinSources(meshName) {
+        await Promise.all([...this.sourceActorJoinProfiles].map(([relocationId, profile]) => meshName === undefined || profile.state.meshName === meshName
+            ? this.retireActorJoinSource(relocationId, profile)
+            : undefined));
+    }
+    retireActorJoinSource(relocationId, profile) {
+        return (profile.retirement ??= this.finalizeActorJoinSource(profile, relocationId).finally(() => {
+            if (this.sourceActorJoinProfiles.get(relocationId) === profile) {
+                this.sourceActorJoinProfiles.delete(relocationId);
+                this.terminalActorJoinSourceLeaves.remember(relocationId, profile.state.actorId);
+            }
+        }));
+    }
+    async finalizeActorJoinSource(profile, relocationId) {
         const failures = [];
         try {
             await profile.ready;
@@ -271,6 +316,9 @@ class ZLinkHostServiceRelocationRuntime {
         catch (error) {
             failures.push(error);
         }
+        // A pre-commit failure removed this attempt and restored the source.
+        if (this.sourceActorJoinProfiles.get(relocationId) !== profile)
+            return;
         try {
             await this.options.actorTransfer.completeRelocationSourceLeave(profile.actor, profile.sourceSpotId);
         }
@@ -280,7 +328,7 @@ class ZLinkHostServiceRelocationRuntime {
         try {
             await this.options
                 .actorManager()
-                ?.completeRelocationSource(profile.state.actorId, profile.sourceActorRef);
+                ?.completeCoreRelocationSource(profile.state.actorId, profile.state);
         }
         catch (error) {
             failures.push(error);
@@ -326,10 +374,10 @@ class ZLinkHostServiceRelocationRuntime {
                         id: `actor:${state.actorId}`,
                         relocate: async (relocationSignal) => {
                             await relocateShell(relocationSignal);
+                            const spotAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(activation.spotId)), relocationSignal);
                             await this.relocateStandaloneActor(meshName, state, undefined, targetApplicationVersion, relocationSignal, {
-                                spotId: activation.spotId,
-                                spotKind: contracts_1.ZLinkSpotKind.User,
-                                spotObjectGeneration: (await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(activation.spotId)), relocationSignal)).objectGeneration
+                                ...committedSpotRoute(meshName, activation.spotId, contracts_1.ZLinkSpotKind.User, spotAuthority.allocation.descriptor.rid, spotAuthority),
+                                spotObjectGeneration: spotAuthority.objectGeneration
                             });
                         }
                     });
@@ -402,18 +450,27 @@ class ZLinkHostServiceRelocationRuntime {
         }
         throw failure;
     }
-    async tryHandleControl(meshName, record, signal) {
+    tryHandleControl(meshName, record, signal) {
         if (record.parts.length === 0)
             return false;
         const payload = record.parts[0].data();
-        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelay)) {
+        const command = (0, service_relocation_control_1.serviceRelocationControlCommand)(payload);
+        if (command === undefined) {
+            if (record.kind !== service_runtime_contracts_1.ReceiveKind.NodeSend || record.parts.length !== 1)
+                return false;
+            const sourceLeave = (0, actor_remote_wire_1.decodeRemoteActorSourceLeaveTerminal)(payload);
+            if (sourceLeave === undefined)
+                return false;
+            return this.acceptActorJoinSourceLeave(sourceLeave);
+        }
+        return this.handleControl(meshName, record, payload, command, signal);
+    }
+    async handleControl(meshName, record, payload, command, signal) {
+        if (command === service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelay) {
             await this.handleReplyRelay(meshName, (0, service_stateful_wire_codec_1.decodeMaintenanceReplyRelay)(record.parts.map((part) => part.data())), record.sourceNodeRid, signal);
             return true;
         }
-        const sideband = record.parts.length === 1
-            ? undefined
-            : decodePrepareSideband(record.parts.slice(1).map((part) => part.data()));
-        if (record.parts.length > 1 && sideband === undefined)
+        if (record.parts.length !== 1)
             return false;
         if (record.kind === service_runtime_contracts_1.ReceiveKind.NodeSend) {
             const sourceLeave = (0, actor_remote_wire_1.decodeRemoteActorSourceLeaveTerminal)(payload);
@@ -421,33 +478,57 @@ class ZLinkHostServiceRelocationRuntime {
                 return this.acceptActorJoinSourceLeave(sourceLeave);
             }
         }
-        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationSealed)) {
+        if (command === service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationSealed) {
             this.acceptSessionRelocationResponse((0, service_stateful_wire_codec_1.decodeSessionRelocationSealed)(payload), record.sourceNodeRid);
             return true;
         }
-        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationSeal)) {
-            const request = (0, service_stateful_wire_codec_1.decodeSessionRelocationSeal)(payload);
-            const response = await this.handleSessionRelocationSeal(meshName, request, record.sourceNodeRid, signal);
-            await this.sendSessionRelocationResponse(meshName, record.sourceNodeRid, (0, service_stateful_wire_codec_1.encodeSessionRelocationSealed)(response));
+        if (command === service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationSeal) {
+            let request;
+            try {
+                request = (0, service_stateful_wire_codec_1.decodeSessionRelocationSeal)(payload);
+            }
+            catch (error) {
+                const outcome = ZLinkDispatchOptions_1.ZLinkRuntimeMessageFlowOutcome.Error;
+                (0, message_flow_1.flowIfEnabled)(this.options.messageFlow?.(), outcome)?.trace({
+                    outcome,
+                    surface: ZLinkDispatchOptions_1.ZLinkDispatchErrorSurface.StreamSession,
+                    messageKind: ZLinkDispatchOptions_1.ZLinkDispatchMessageKind.Control,
+                    packetName: 'sessionRelocationSeal',
+                    sourceRid: record.sourceNodeRid ?? undefined,
+                    errorReason: 'invalid_frame',
+                    errorAction: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorAction.Drop,
+                    ...(0, dispatch_error_details_1.dispatchErrorDetails)(error)
+                });
+                throw error;
+            }
+            let response;
+            try {
+                response = await this.handleSessionRelocationSeal(meshName, request, record.sourceNodeRid, signal);
+            }
+            catch (error) {
+                (0, message_flow_1.traceSessionBindingControlDrop)(this.options.messageFlow?.(), record.sourceNodeRid ?? '', request.actor.actor.actorId, 'sessionRelocationSeal', error instanceof contracts_1.ZLinkFrameworkException &&
+                    error.kind === contracts_1.ZLinkFrameworkErrorKind.Unavailable
+                    ? 'location_unavailable'
+                    : 'stale_target', error);
+                throw error;
+            }
+            if (response !== undefined) {
+                await this.sendSessionRelocationResponse(meshName, record.sourceNodeRid, (0, service_stateful_wire_codec_1.encodeSessionRelocationSealed)(response));
+            }
             return true;
         }
-        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationRoute)) {
+        if (command === service_stateful_wire_codec_1.M6bServiceWireCommand.sessionRelocationRoute) {
             const request = (0, service_stateful_wire_codec_1.decodeSessionRelocationRoute)(payload);
             await this.handleSessionRelocationRoute(meshName, request, record.sourceNodeRid, signal);
             return true;
         }
-        if (isServiceWireCommand(payload, service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelayAck)) {
+        if (command === service_stateful_wire_codec_1.M6bServiceWireCommand.replyRelayAck) {
             await this.acceptReplyRelayAck(meshName, (0, service_stateful_wire_codec_1.decodeMaintenanceReplyRelayAck)(payload), record.sourceNodeRid, signal);
             return true;
         }
         let request = (0, service_relocation_control_1.decodeServiceRelocationControlRequest)(payload);
         if (request === undefined)
             return false;
-        if (sideband !== undefined) {
-            if (request.kind !== 'prepare')
-                return false;
-            request = { ...request, nodeInternalBoundSessions: sideband };
-        }
         // Ready(30) and Failed(53) are replies to Prepare(40), never independent
         // inbound controls. The source consumes them on Core's request reply leg.
         if (request.kind === 'ready' || request.kind === 'failed')
@@ -461,7 +542,7 @@ class ZLinkHostServiceRelocationRuntime {
                 throw new Error('Relocation prepare has no authenticated source node.');
             }
             if (record.kind !== service_runtime_contracts_1.ReceiveKind.NodeRequest) {
-                throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Relocation prepare requires a Core request leg.');
+                throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Relocation prepare requires a Core request leg.');
             }
             const operationKey = relocationStagingId(request);
             const fingerprint = stringifyWire(request);
@@ -474,12 +555,12 @@ class ZLinkHostServiceRelocationRuntime {
                 this.targetAssemblies.get(operationKey)?.fingerprint ??
                 this.targetStages.get(operationKey)?.offer.prepareFingerprint ??
                 this.terminalTargets.get(operationKey);
-            if (request.sourceNodeRid !== String(record.sourceNodeRid))
+            if (!(0, routing_id_1.routingIdsEqual)(request.sourceNodeRid, record.sourceNodeRid))
                 return true;
             if (acceptedFingerprint !== undefined && acceptedFingerprint !== fingerprint) {
                 if (!samePrepareIdentity(acceptedFingerprint, request))
                     return true;
-                this.replyPrepare(record, relocationFailed(request, service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.relocationDataLost));
+                this.replyPrepare(record, relocationFailed(request, service_wire_constants_generated_2.ServiceWireFrameworkErrorCode.relocationDataLost));
                 return true;
             }
             // A restore that failed outright is terminal: the source observes the
@@ -503,7 +584,7 @@ class ZLinkHostServiceRelocationRuntime {
                 // finish the restore and the Ready reply asynchronously.
                 let promise;
                 try {
-                    this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
+                    this.registerTargetAssembly(operationKey, request, record.sourceNodeRid);
                     promise = this.handlePrepareControl(meshName, operationKey, request, record.sourceNodeRid, signal);
                 }
                 catch (error) {
@@ -614,7 +695,7 @@ class ZLinkHostServiceRelocationRuntime {
         const pending = this.targetAssemblies.get(operationKey);
         if (pending === undefined ||
             sourceNodeRid === null ||
-            String(sourceNodeRid) !== pending.authenticatedSourceNodeRid ||
+            !(0, routing_id_1.routingIdsEqual)(sourceNodeRid, pending.authenticatedSourceNodeRid) ||
             request.senderRole !== 'source' ||
             !sameCoordinator(request.coordinator, pending.prepare.coordinator) ||
             !sameRelocationObject(request.object, pending.prepare.object)) {
@@ -666,7 +747,7 @@ class ZLinkHostServiceRelocationRuntime {
         //  to itself; RouteMesh has no self connection (NotConnected), so the
         //  control dispatches through the same inbound handler locally.
         const localRid = this.requireMeshNode(meshName).status().routingId;
-        if (String(localRid) === String(targetNodeRid)) {
+        if ((0, routing_id_1.routingIdsEqual)(localRid, targetNodeRid)) {
             await this.handleSessionRelocationRoute(meshName, request, localRid, signal);
             return;
         }
@@ -686,20 +767,21 @@ class ZLinkHostServiceRelocationRuntime {
         const key = sessionRelocationPendingKey(request);
         const bytes = (0, service_stateful_wire_codec_1.encodeSessionRelocationSeal)(request);
         const requestFingerprint = bytes.toString('base64');
-        const expectedTarget = String(targetNodeRid);
+        const expectedTarget = (0, routing_id_1.encodeRoutingIdStorageHex)(targetNodeRid);
         const terminal = this.terminalSessionRelocations.get(key);
         if (terminal !== undefined) {
             if (terminal.targetNodeRid !== expectedTarget ||
                 terminal.requestFingerprint !== requestFingerprint) {
-                return Promise.reject(new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation control '${key}' repeated with different bytes or target.`));
+                return Promise.reject(new service_wire_m6a_codec_2.ServiceWireProtocolError(`Session relocation control '${key}' repeated with different bytes or target.`));
             }
             this.terminalSessionRelocations.touch(key);
+            return Promise.resolve(terminal.response);
         }
         const existing = this.pendingSessionRelocations.get(key);
         if (existing !== undefined) {
             if (existing.targetNodeRid !== expectedTarget ||
                 existing.requestFingerprint !== requestFingerprint) {
-                return Promise.reject(new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation control '${key}' repeated with different bytes or target.`));
+                return Promise.reject(new service_wire_m6a_codec_2.ServiceWireProtocolError(`Session relocation control '${key}' repeated with different bytes or target.`));
             }
             return existing.promise;
         }
@@ -752,10 +834,11 @@ class ZLinkHostServiceRelocationRuntime {
             //  connection (NotConnected); dispatch through the inbound handler
             //  locally instead of the wire.
             const localRid = this.requireMeshNode(meshName).status().routingId;
-            if (String(localRid) === expectedTarget) {
+            if ((0, routing_id_1.encodeRoutingIdStorageHex)(localRid) === expectedTarget) {
                 try {
                     const response = await this.handleSessionRelocationSeal(meshName, request, localRid, signal);
-                    pending.resolve(response);
+                    if (response !== undefined)
+                        pending.resolve(response);
                 }
                 catch (error) {
                     pending.reject(error);
@@ -788,9 +871,8 @@ class ZLinkHostServiceRelocationRuntime {
             resolve: (response) => finish(() => {
                 this.terminalSessionRelocations.remember(key, {
                     targetNodeRid: expectedTarget,
-                    request,
                     requestFingerprint,
-                    responseFingerprint: sessionRelocationResponseFingerprint(response)
+                    response
                 });
                 resolvePromise(response);
             }),
@@ -816,18 +898,13 @@ class ZLinkHostServiceRelocationRuntime {
             const terminal = this.terminalSessionRelocations.get(key);
             if (terminal === undefined)
                 return;
-            if (sourceNodeRid === null || String(sourceNodeRid) !== terminal.targetNodeRid) {
-                throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation ACK '${key}' source node changed.`);
-            }
-            validateSessionRelocationResponse(terminal.request, response);
-            if (sessionRelocationResponseFingerprint(response) !== terminal.responseFingerprint) {
-                throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation ACK '${key}' repeated with different bytes.`);
-            }
+            // Session–Actor binding §8.3: the first command 43 is final for this participant.
             this.terminalSessionRelocations.touch(key);
             return;
         }
-        if (sourceNodeRid === null || String(sourceNodeRid) !== pending.targetNodeRid) {
-            pending.reject(new service_wire_m6a_codec_1.ServiceWireProtocolError(`Session relocation ACK '${key}' source node changed.`));
+        if (sourceNodeRid === null ||
+            (0, routing_id_1.encodeRoutingIdStorageHex)(sourceNodeRid) !== pending.targetNodeRid) {
+            pending.reject(new service_wire_m6a_codec_2.ServiceWireProtocolError(`Session relocation ACK '${key}' source node changed.`));
             return;
         }
         try {
@@ -846,44 +923,52 @@ class ZLinkHostServiceRelocationRuntime {
             return undefined;
         const node = this.requireMeshNode(meshName);
         const status = node.status();
-        if (String(status.routingId) === String(sourceNodeRid)) {
+        if ((0, routing_id_1.routingIdsEqual)(status.routingId, sourceNodeRid)) {
             return status.lifecycleGeneration;
         }
         return node
             .peers()
-            .find((peer) => peer.routingId !== null && String(peer.routingId) === String(sourceNodeRid))
+            .find((peer) => peer.routingId !== null && (0, routing_id_1.routingIdsEqual)(peer.routingId, sourceNodeRid))
             ?.lifecycleGeneration;
     }
     async handleSessionRelocationSeal(meshName, request, sourceNodeRid, signal) {
         if (sourceNodeRid === null ||
-            String(sourceNodeRid) !== request.coordinator.nodeRid ||
-            String(sourceNodeRid) !== request.actor.actor.nodeRid) {
-            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation seal source does not match its coordinator and Actor fence.');
+            !(0, routing_id_1.routingIdsEqual)(sourceNodeRid, request.coordinator.nodeRid) ||
+            !(0, routing_id_1.routingIdsEqual)(sourceNodeRid, request.actor.actor.nodeRid)) {
+            throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Session relocation seal source does not match its coordinator and Actor fence.');
         }
         this.validateSessionOwnerFence(meshName, request.session);
         const sealSourceGeneration = this.sourceLifecycleGeneration(meshName, sourceNodeRid);
         if (sealSourceGeneration !== request.actor.targetNodeGeneration ||
             sealSourceGeneration !== request.coordinator.nodeGeneration) {
-            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation seal source lifecycle generation is stale.');
+            throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Session relocation seal source lifecycle generation is stale.');
         }
         const handler = this.options.boundSessionRelocation?.receiveSeal;
         if (handler === undefined) {
             throw new Error('Session relocation seal ingress is not configured.');
         }
-        return await handler(request, signal);
+        return await handler(request, signal, () => {
+            const node = this.requireMeshNode(meshName);
+            if ((0, routing_id_1.routingIdsEqual)(node.status().routingId, request.targetNodeRid) ||
+                node.isPeerRouteReady?.(request.targetNodeRid, request.targetNodeGeneration) === true)
+                return;
+            void this.options
+                .requestPeerReconcile?.(meshName, request.targetNodeRid)
+                .catch((error) => console.error('[zlink.runtime.relocation.session_route_reconcile_failed]', error));
+        });
     }
     async handleSessionRelocationRoute(meshName, request, sourceNodeRid, _signal) {
         this.validateSessionOwnerFence(meshName, request.session);
         const expectedSource = request.route.action === 'commit' ? request.route.targetNodeRid : request.coordinator.nodeRid;
-        if (sourceNodeRid === null || String(sourceNodeRid) !== expectedSource) {
-            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation route source does not match its action fence.');
+        if (sourceNodeRid === null || !(0, routing_id_1.routingIdsEqual)(sourceNodeRid, expectedSource)) {
+            throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Session relocation route source does not match its action fence.');
         }
         const routeSourceGeneration = this.sourceLifecycleGeneration(meshName, sourceNodeRid);
         const expectedSourceGeneration = request.route.action === 'commit'
             ? request.route.targetNodeGeneration
             : request.coordinator.nodeGeneration;
         if (routeSourceGeneration !== expectedSourceGeneration) {
-            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation route source lifecycle generation is stale.');
+            throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Session relocation route source lifecycle generation is stale.');
         }
         const handler = this.options.boundSessionRelocation?.receiveRoute;
         if (handler === undefined) {
@@ -894,16 +979,20 @@ class ZLinkHostServiceRelocationRuntime {
     validateSessionOwnerFence(meshName, session) {
         const status = this.requireMeshNode(meshName).status();
         const owner = this.options.currentOwner();
-        if (String(status.routingId) !== session.sessionOwnerNodeRid ||
+        // Session-Actor binding §4: without this host's own descriptor the command is Unavailable.
+        if (owner === undefined) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, 'Session owner has no live MeshNode descriptor.');
+        }
+        if (!(0, routing_id_1.routingIdsEqual)(status.routingId, session.sessionOwnerNodeRid) ||
             status.lifecycleGeneration !== session.sessionOwnerNodeGeneration ||
-            owner?.ownerId !== session.sessionOwnerId ||
+            owner.ownerId !== session.sessionOwnerId ||
             owner.leaseGeneration !== session.sessionOwnerLeaseGeneration) {
-            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation command does not match the local Session owner fence.');
+            throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Session relocation command does not match the local Session owner fence.');
         }
     }
     async sendSessionRelocationResponse(meshName, targetNodeRid, bytes) {
         if (targetNodeRid === null) {
-            throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation command has no authenticated source.');
+            throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Session relocation command has no authenticated source.');
         }
         const submitted = await this.sendInfrastructureControl(meshName, targetNodeRid, bytes);
         if (submitted !== runtime_values_1.SubmitResult.Ok) {
@@ -928,7 +1017,7 @@ class ZLinkHostServiceRelocationRuntime {
         let readinessBoundaryConsumed = false;
         let interruptionStartedAt;
         const spotRegistration = this.spotRegistration(meshName, kind, spotAuthority.allocation.stableType);
-        target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, relocationTargetRequirements([
+        target ??= await this.selectTarget(meshName, this.requireMeshNode(meshName).status().routingId, targetApplicationVersion, relocationTargetRequirements([
             {
                 objectKind: kind,
                 stableType: spotAuthority.allocation.stableType,
@@ -953,23 +1042,32 @@ class ZLinkHostServiceRelocationRuntime {
             objectGeneration: spotAuthority.objectGeneration,
             authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
             seal: async (captureSignal) => {
+                // Relocation 04 §4.1: every bound member's Session is sealed before
+                // the Spot capture stops member dispatch.
+                const preparations = await Promise.allSettled(actorStates.map(async (state) => ({
+                    state,
+                    actor: state.actor,
+                    prepared: await this.options.actorTransfer.prepareMaintenanceSession(state.actor, state, captureSignal, false, relocationWireId(aggregateId), target)
+                })));
+                const failures = [];
+                for (const preparation of preparations) {
+                    if (preparation.status === 'fulfilled')
+                        sessions.push(preparation.value);
+                    else
+                        failures.push(preparation.reason);
+                }
+                if (failures.length === 1)
+                    throw failures[0];
+                if (failures.length > 1) {
+                    throw new AggregateError(failures, 'Spot relocation source preparation failed.');
+                }
                 const { spotCaptureOperation } = await this.afterSpotCloseDecision(meshName, activation.spotId, () => {
                     interruptionStartedAt = performance.now();
                     spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
-                    // Both seals run in the same event-loop turn after the Close decision.
+                    // Both Spot seals run in the same event-loop turn after the Close decision.
                     return { spotCaptureOperation: activation.captureRelocation(captureSignal) };
                 });
-                const preparedSessions = Promise.all(actorStates.map(async (state) => ({
-                    state,
-                    actor: state.actor,
-                    prepared: await this.options.actorTransfer.prepareMaintenanceSession(state.actor, state, captureSignal, false, relocationWireId(aggregateId))
-                })));
-                const preparedSessionsOutcome = preparedSessions.then((value) => ({ value }), (error) => ({ error }));
                 spotCapture = await spotCaptureOperation;
-                const preparation = await preparedSessionsOutcome;
-                if ('error' in preparation)
-                    throw preparation.error;
-                sessions.push(...preparation.value);
                 return {
                     boundSessionState: Buffer.alloc(0),
                     queuedMessages: [],
@@ -977,7 +1075,7 @@ class ZLinkHostServiceRelocationRuntime {
                 };
             },
             captureApplicationState: (captureSignal) => this.captureApplication(spotRegistration.relocation, activation.spot, captureSignal),
-            commitSeal: async () => {
+            commitSeal: async (followAuthorities) => {
                 const failures = [];
                 try {
                     if (!spotSealCommitted) {
@@ -987,7 +1085,7 @@ class ZLinkHostServiceRelocationRuntime {
                         spotSealCommitted = true;
                     }
                     if (spotMessageFollowSeal !== undefined) {
-                        await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
+                        await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, followAuthorities.get(spotKey.value), activation);
                     }
                 }
                 catch (error) {
@@ -995,20 +1093,17 @@ class ZLinkHostServiceRelocationRuntime {
                 }
                 for (const session of sessions) {
                     try {
-                        const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', session.state.actorId));
+                        const committedAuthority = followAuthorities.get((0, authority_key_codec_1.encodeAuthorityKey)('actor', session.state.actorId).value);
+                        const committedSpot = followAuthorities.get(spotKey.value);
                         const targetActorRef = {
                             actorId: session.state.actorId,
                             objectGeneration: actorAuthorities.get(session.state.actorId).objectGeneration,
                             meshName,
                             nodeRid: target.rid
                         };
-                        await session.prepared.commit({
-                            routerChannelId: meshName,
-                            targetNodeRid: target.rid,
-                            spotId: activation.spotId,
-                            spotKind: kind === 'user_spot' ? contracts_1.ZLinkSpotKind.User : contracts_1.ZLinkSpotKind.Instance,
-                            authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-                        }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(session.state.actorId, targetActorRef, committedAuthority));
+                        await session.prepared.commit(committedSpotRoute(meshName, activation.spotId, kind === 'user_spot' ? contracts_1.ZLinkSpotKind.User : contracts_1.ZLinkSpotKind.Instance, target.rid, committedSpot), targetActorRef, committedAuthority === undefined || committedSpot === undefined
+                            ? null
+                            : (0, actor_transfer_runtime_1.committedActorOwnerFence)(session.state.actorId, targetActorRef, committedAuthority));
                     }
                     catch (error) {
                         failures.push(error);
@@ -1040,6 +1135,15 @@ class ZLinkHostServiceRelocationRuntime {
             abortSeal: async () => {
                 const failures = [];
                 if (spotCapture !== undefined) {
+                    // Spot model §5.1: Continued completes while the source seal still holds jobs.
+                    if (readinessBoundaryConsumed) {
+                        try {
+                            await activation.completeConsumedRelocationBoundary(contracts_1.ZLinkSpotRelocationReadyOutcome.Continued);
+                        }
+                        catch (error) {
+                            failures.push(error);
+                        }
+                    }
                     try {
                         activation.abortRelocation(spotCapture);
                     }
@@ -1079,7 +1183,9 @@ class ZLinkHostServiceRelocationRuntime {
             spotObjectGeneration: spotAuthority.objectGeneration,
             membershipEpoch: state.spotMembershipEpoch > 0n ? state.spotMembershipEpoch : 1n
         }));
-        let outcome = 'completed';
+        const relocationMetric = spotRegistration.relocation.kind === 'disabled'
+            ? undefined
+            : this.options.metrics?.startRelocation(meshName, kind, spotRegistration.relocation.kind);
         try {
             const waitForRelocationBoundary = activation.waitForRelocationBoundary;
             readinessBoundaryConsumed =
@@ -1099,10 +1205,9 @@ class ZLinkHostServiceRelocationRuntime {
                     (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId).value,
                     actorAuthorities.get(state.actorId)
                 ])
-            ]), signal, sessions);
+            ]), signal, sessions, undefined, undefined, relocationMetric);
         }
         catch (error) {
-            outcome = 'failed';
             if (readinessBoundaryConsumed &&
                 !(error instanceof service_relocation_coordinator_1.ServiceRelocationPostCommitError) &&
                 !(error instanceof service_relocation_coordinator_1.ServiceRelocationAuthorityError)) {
@@ -1113,34 +1218,33 @@ class ZLinkHostServiceRelocationRuntime {
             throw error;
         }
         finally {
+            this.completeSourceRelocationMetric(relocationMetric);
             this.sourceRelocationIds.delete(aggregateId);
             if (interruptionStartedAt !== undefined) {
-                this.recordRelocationInterruption(meshName, kind, kind === 'user_spot' ? 'spot_wide' : undefined, interruptionStartedAt, outcome);
+                this.recordRelocationInterruption(meshName, kind, kind === 'user_spot' ? 'spot_wide' : undefined, interruptionStartedAt);
             }
         }
     }
     async relocateStandaloneActor(meshName, state, target, targetApplicationVersion, signal, targetMembership, aggregateIdOverride, retainSourceForActorJoin = false, 
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
-    advertisedReceiveChunkLimitBytes) {
+    advertisedReceiveChunkLimitBytes, deadlineAtMs) {
         if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
             (0, diagnostics_1.relocationDebug)('standalone_actor.begin', { actorId: state.actorId });
         }
         const authority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId), signal);
-        target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, [
+        const actorPolicy = this.actorRegistration(state.meshName ?? meshName, authority.allocation.stableType).relocation.kind;
+        target ??= await this.selectTarget(meshName, this.requireMeshNode(meshName).status().routingId, targetApplicationVersion, [
             {
                 objectKind: 'actor',
                 stableType: authority.allocation.stableType,
-                policy: this.actorRegistration(state.meshName ?? meshName, authority.allocation.stableType).relocation.kind,
+                policy: actorPolicy,
                 count: 1
             }
         ], signal);
         const sessions = [];
         const membershipSpotId = targetMembership?.spotId ?? (target.entrySpotId ?? String(target.rid));
         const aggregateId = aggregateIdOverride ?? this.reserveRelocationId();
-        const unit = this.actorCaptureUnit(state, authority, sessions, true, target, meshName, {
-            spotId: membershipSpotId,
-            spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry
-        }, relocationWireId(aggregateId), retainSourceForActorJoin);
+        const unit = this.actorCaptureUnit(state, authority, sessions, true, target, meshName, targetMembership, relocationWireId(aggregateId), retainSourceForActorJoin);
         const membership = {
             actorKey: (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId).value,
             spotKey: (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(membershipSpotId)).value,
@@ -1155,7 +1259,9 @@ class ZLinkHostServiceRelocationRuntime {
                 return unit.seal(captureSignal);
             }
         };
-        let outcome = 'completed';
+        const relocationMetric = actorPolicy === 'disabled'
+            ? undefined
+            : this.options.metrics?.startRelocation(meshName, 'actor', actorPolicy);
         try {
             if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
                 (0, diagnostics_1.relocationDebug)('standalone_actor.wait_budget', {
@@ -1171,16 +1277,13 @@ class ZLinkHostServiceRelocationRuntime {
             if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
                 (0, diagnostics_1.relocationDebug)('standalone_actor.capture_complete', { actorId: state.actorId });
             }
-            await this.runCoordinator(meshName, target, authority, captured, new Map([[measuredUnit.authorityKey, authority]]), signal, sessions, advertisedReceiveChunkLimitBytes);
-        }
-        catch (error) {
-            outcome = 'failed';
-            throw error;
+            await this.runCoordinator(meshName, target, authority, captured, new Map([[measuredUnit.authorityKey, authority]]), signal, sessions, advertisedReceiveChunkLimitBytes, deadlineAtMs, relocationMetric);
         }
         finally {
+            this.completeSourceRelocationMetric(relocationMetric);
             this.sourceRelocationIds.delete(aggregateId);
             if (interruptionStartedAt !== undefined) {
-                this.recordRelocationInterruption(meshName, 'actor', undefined, interruptionStartedAt, outcome);
+                this.recordRelocationInterruption(meshName, 'actor', undefined, interruptionStartedAt);
             }
         }
     }
@@ -1191,7 +1294,7 @@ class ZLinkHostServiceRelocationRuntime {
         const spotKey = (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', String(activation.spotId));
         const spotAuthority = await requireAuthority(this.requireLocationStore(), spotKey, signal);
         const spotRegistration = this.spotRegistration(meshName, 'user_spot', spotAuthority.allocation.stableType);
-        target ??= await this.selectTarget(meshName, String(this.requireMeshNode(meshName).status().routingId), targetApplicationVersion, [
+        target ??= await this.selectTarget(meshName, this.requireMeshNode(meshName).status().routingId, targetApplicationVersion, [
             {
                 objectKind: 'user_spot',
                 stableType: spotAuthority.allocation.stableType,
@@ -1225,7 +1328,7 @@ class ZLinkHostServiceRelocationRuntime {
             // PerActor User Spots are stateless shells. Application state and the
             // Spot relocation adapter are intentionally not part of this unit.
             captureApplicationState: async () => Buffer.alloc(0),
-            commitSeal: async () => {
+            commitSeal: async (followAuthorities) => {
                 if (!sealCommitted) {
                     if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
                         throw new Error(`PerActor Spot '${String(activation.spotId)}' relocation seal became stale.`);
@@ -1233,7 +1336,7 @@ class ZLinkHostServiceRelocationRuntime {
                     sealCommitted = true;
                 }
                 if (spotMessageFollowSeal !== undefined) {
-                    await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, spotKey, activation, target);
+                    await this.commitSpotMessageFollow(meshName, spotMessageFollowSeal, followAuthorities.get(spotKey.value), activation);
                 }
                 await this.requireSpotManager().completeRelocationSource(activation);
             },
@@ -1250,20 +1353,19 @@ class ZLinkHostServiceRelocationRuntime {
             }
         };
         const aggregateId = this.reserveRelocationId();
-        let outcome = 'completed';
+        const relocationMetric = spotRegistration.relocation.kind === 'disabled'
+            ? undefined
+            : this.options.metrics?.startRelocation(meshName, 'user_spot', spotRegistration.relocation.kind);
         try {
             await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
             const captured = await new service_relocation_object_owner_1.ServiceRelocationObjectCaptureOwner().captureUserSpotAggregate(aggregateId, 1n, spotUnit, [], [], signal);
-            await this.runCoordinator(meshName, target, spotAuthority, captured, new Map([[spotKey.value, spotAuthority]]), signal, []);
-        }
-        catch (error) {
-            outcome = 'failed';
-            throw error;
+            await this.runCoordinator(meshName, target, spotAuthority, captured, new Map([[spotKey.value, spotAuthority]]), signal, [], undefined, undefined, relocationMetric);
         }
         finally {
+            this.completeSourceRelocationMetric(relocationMetric);
             this.sourceRelocationIds.delete(aggregateId);
             if (interruptionStartedAt !== undefined) {
-                this.recordRelocationInterruption(meshName, 'user_spot', 'per_actor', interruptionStartedAt, outcome);
+                this.recordRelocationInterruption(meshName, 'user_spot', 'per_actor', interruptionStartedAt);
             }
         }
     }
@@ -1281,22 +1383,35 @@ class ZLinkHostServiceRelocationRuntime {
                     ownSession = {
                         state,
                         actor: state.actor,
-                        prepared: await this.options.actorTransfer.prepareMaintenanceSession(state.actor, state, signal, true, sessionRelocation)
+                        prepared: await this.options.actorTransfer.prepareMaintenanceSession(state.actor, state, signal, true, sessionRelocation, target)
                     };
                     sessions.push(ownSession);
                 }
                 const prepared = standalone ? ownSession : sessions.find((value) => value.state === state);
                 return {
-                    boundSessionState: encodeActorSession(prepared?.prepared.target),
+                    boundSessionState: Buffer.alloc(0),
+                    ...(prepared?.prepared.target?.serviceWireRelocation === undefined
+                        ? {}
+                        : {
+                            sessionBinding: {
+                                participantId: 1n,
+                                sessionOwnerNodeRid: Buffer.from((0, routing_id_1.encodeRoutingIdStorageHex)(prepared.prepared.target.sessionNodeRid), 'hex'),
+                                sessionOwnerNodeGeneration: prepared.prepared.target.serviceWireRelocation.session
+                                    .sessionOwnerNodeGeneration,
+                                sessionOwnerId: prepared.prepared.target.serviceWireRelocation.session.sessionOwnerId,
+                                sessionOwnerLeaseGeneration: prepared.prepared.target.serviceWireRelocation.session
+                                    .sessionOwnerLeaseGeneration,
+                                sessionRid: Buffer.from((0, routing_id_1.encodeRoutingIdStorageHex)(prepared.prepared.target.sessionRid), 'hex'),
+                                bindingGeneration: prepared.prepared.target.serviceWireRelocation.session.bindingGeneration
+                            }
+                        }),
                     queuedMessages: encodeHandoffQueuedMessages(prepared?.prepared.handoffBacklog ?? []),
                     timers: []
                 };
             },
-            // The canonical participant body (discriminator 1) is raw application
-            // state. The sealed bound-session target remains in sealed work and is
-            // transported only by Prepare's NODE-INTERNAL sideband frames.
+            // The sealed Session identity is part of the canonical participant vector.
             captureApplicationState: (signal) => this.captureApplication(registration.relocation, state.actor, signal),
-            commitSeal: async () => {
+            commitSeal: async (followAuthorities) => {
                 if (!standalone ||
                     ownSession === undefined ||
                     target === undefined ||
@@ -1304,33 +1419,36 @@ class ZLinkHostServiceRelocationRuntime {
                     return;
                 const failures = [];
                 try {
-                    const membershipSpotId = targetMembership?.spotId ?? (target.entrySpotId ?? String(target.rid));
-                    const committedAuthority = await requireAuthority(this.requireLocationStore(), (0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId));
+                    const committedAuthority = followAuthorities.get((0, authority_key_codec_1.encodeAuthorityKey)('actor', state.actorId).value);
                     const targetActorRef = {
                         actorId: state.actorId,
                         objectGeneration: authority.objectGeneration,
                         meshName,
                         nodeRid: target.rid
                     };
-                    await ownSession.prepared.commit({
+                    await ownSession.prepared.commit(targetMembership ?? {
                         routerChannelId: meshName,
                         targetNodeRid: target.rid,
-                        spotId: membershipSpotId,
-                        spotKind: targetMembership?.spotKind ?? contracts_1.ZLinkSpotKind.Entry,
-                        authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-                    }, targetActorRef, (0, actor_transfer_runtime_1.committedActorOwnerFence)(state.actorId, targetActorRef, committedAuthority));
+                        spotId: (target.entrySpotId ?? String(target.rid)),
+                        spotKind: contracts_1.ZLinkSpotKind.Entry
+                    }, targetActorRef, committedAuthority === undefined
+                        ? null
+                        : (0, actor_transfer_runtime_1.committedActorOwnerFence)(state.actorId, targetActorRef, committedAuthority));
                 }
                 catch (error) {
                     failures.push(error);
                 }
-                if (!retainSourceForActorJoin) {
-                    try {
-                        await this.requireActorManager().completeRelocationSource(state.actorId);
+                try {
+                    if (retainSourceForActorJoin) {
+                        this.requireActorManager().detachRelocationSource(state);
                     }
-                    catch (error) {
-                        failures.push(error);
+                    else {
+                        await this.requireActorManager().completeRelocationSource(state.actorId);
                     }
                 }
+                catch (error) {
+                    failures.push(error);
+                }
                 if (failures.length > 0)
                     throw failures.length === 1
                         ? failures[0]
@@ -1367,7 +1485,7 @@ class ZLinkHostServiceRelocationRuntime {
     }
     async runCoordinator(meshName, target, primary, captured, _authorities, signal, sessions = [], 
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
-    advertisedReceiveChunkLimitBytes) {
+    advertisedReceiveChunkLimitBytes, controlDeadlineAtMs = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS, relocationMetric) {
         if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
             (0, diagnostics_1.relocationDebug)('coordinator.begin', {
                 aggregateId: captured.envelope.aggregateId,
@@ -1375,18 +1493,15 @@ class ZLinkHostServiceRelocationRuntime {
             });
         }
         const localStatus = this.requireMeshNode(meshName).status();
-        const controlDeadlineAtMs = signal === undefined
-            ? performance.now() + RELOCATION_OPERATION_TIMEOUT_MS
-            : Number.MAX_SAFE_INTEGER;
         const coordinator = {
             ownerId: primary.ownerId,
             leaseGeneration: primary.ownerLeaseGeneration,
-            nodeRid: String(localStatus.routingId),
+            nodeRid: localStatus.routingId,
             nodeGeneration: localStatus.lifecycleGeneration,
             expectedAuthorityStoreVersion: primary.storeVersion.value
         };
         const targetFence = {
-            nodeRid: String(target.rid),
+            nodeRid: target.rid,
             nodeGeneration: target.lifecycleGeneration,
             ownerId: target.ownerId,
             ownerLeaseGeneration: target.leaseGeneration
@@ -1399,11 +1514,6 @@ class ZLinkHostServiceRelocationRuntime {
         // attempt even when it reuses the same routing id.
         const targetAttemptGeneration = target.lifecycleGeneration;
         const relayAuthorityId = wireIdText(relocationWireId(captured.envelope.aggregateId));
-        const relayAuthorityKey = primaryKey(captured.envelope);
-        if (this.relocationAuthorityKeys.has(relayAuthorityId)) {
-            throw new Error(`Relocation reply relay authority '${relayAuthorityId}' is already registered.`);
-        }
-        this.relocationAuthorityKeys.set(relayAuthorityId, relayAuthorityKey);
         // The captured payload stays in source memory: this copy is the only
         // handoff original until the cutover submit terminal and the
         // retransmission window end (spec 28 §4.2).
@@ -1413,6 +1523,7 @@ class ZLinkHostServiceRelocationRuntime {
             ? canonicalEnvelope
             : appendCanonicalActorJoinRecovery(canonicalEnvelope, actorJoinProfile, coordinator, primary);
         const encoded = (0, service_relocation_runtime_1.encodeServiceRelocationEnvelope)(transportEnvelope, target.applicationVersion);
+        relocationMetric?.recordBytes(encoded.byteLength);
         const limits = this.relocationLimits();
         // Actor Join threads the target's admission-time advertised cap in;
         // other relocation paths have no such negotiation and fall back to the
@@ -1440,29 +1551,24 @@ class ZLinkHostServiceRelocationRuntime {
                 payloadTotalLength: BigInt(plan.totalLength),
                 payloadChunkCount: plan.chunkCount,
                 payloadChecksumCrc32c: plan.checksumCrc32c,
-                applicationVersion: target.applicationVersion
+                applicationVersion: target.applicationVersion,
+                deadlineUnixMs: BigInt(Date.now() + Math.max(0, Math.ceil(controlDeadlineAtMs - performance.now())))
             };
             // Start the Restore request first (it also registers the temporary
             // queue and the assembly on the target), then stream the payload chunks
             // on the same ordered connection. The Ready reply arrives only after
             // the target assembled, verified, and restored the payload.
-            const readyOperation = this.sendControl(meshName, target.rid, prepare, signal, controlDeadlineAtMs, encodePrepareSideband(captured.envelope));
-            try {
-                if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
+            const ready = await this.sendControl(meshName, target.rid, prepare, signal, controlDeadlineAtMs, async (attemptSignal) => {
+                if ((0, diagnostics_1.isRelocationDebugEnabled)())
                     (0, diagnostics_1.relocationDebug)('coordinator.state_transfer_begin', {
                         aggregateId: captured.envelope.aggregateId
                     });
-                }
-                await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, signal);
-            }
-            catch (chunkError) {
-                readyOperation.catch(() => undefined);
-                throw chunkError;
-            }
-            if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
-                (0, diagnostics_1.relocationDebug)('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
-            }
-            const ready = await readyOperation;
+                await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, attemptSignal);
+                if ((0, diagnostics_1.isRelocationDebugEnabled)())
+                    (0, diagnostics_1.relocationDebug)('coordinator.await_ready', {
+                        aggregateId: captured.envelope.aggregateId
+                    });
+            });
             if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
                 (0, diagnostics_1.relocationDebug)('coordinator.ready_received', {
                     aggregateId: captured.envelope.aggregateId
@@ -1473,6 +1579,7 @@ class ZLinkHostServiceRelocationRuntime {
             // forward the source can no longer reopen dispatch without risking two
             // owners.
             readyReceived = true;
+            actorJoinProfile?.relayReady();
             const boundaryBatch = [];
             for (const session of sessions) {
                 const participant = captured.envelope.participants.find((value) => value.objectKind === 'actor' &&
@@ -1511,7 +1618,7 @@ class ZLinkHostServiceRelocationRuntime {
             // The cutover submit result is not the authority result. The memory
             // copy of the boundary batch and cutover stays until the authority
             // settlement below (spec 28 §4.4).
-            let submitFailure;
+            const submittedRouteGeneration = this.requireMeshNode(meshName).observePeerRoute?.(target.rid).generation;
             try {
                 for (const record of boundaryBatch) {
                     await this.submitControlFrame(meshName, target.rid, record.frame, 'relay');
@@ -1519,12 +1626,13 @@ class ZLinkHostServiceRelocationRuntime {
                 await this.submitControlFrame(meshName, target.rid, cutoverFrame, 'cutover');
             }
             catch (error) {
-                submitFailure = error;
+                if (!(0, durable_service_request_1.durableRequestCanReplay)(error))
+                    throw error;
                 console.warn('[zlink.runtime.relocation.cutover_submit_failed]', relayAuthorityId, error);
             }
-            const window = this.beginSourceCutoverWindow(meshName, target.rid, relayAuthorityId, [...boundaryBatch.map((value) => value.frame), cutoverFrame], submitFailure !== undefined, limits);
+            const window = this.beginSourceCutoverWindow(meshName, target.rid, relayAuthorityId, [...boundaryBatch.map((value) => value.frame), cutoverFrame], submittedRouteGeneration, limits);
             try {
-                settlement = await this.settleSourceAuthority(captured.envelope, primary, targetFence, restoreDeadlineReached, window);
+                settlement = await this.settleSourceAuthority(captured.envelope, primary, targetFence, restoreDeadlineReached, window, relocationMetric);
             }
             finally {
                 this.closeSourceCutoverWindow(relayAuthorityId, window);
@@ -1539,22 +1647,31 @@ class ZLinkHostServiceRelocationRuntime {
                 // Preserve won: the captured queue, timers and held records return to
                 // the source queue in their accepted order, and dispatch reopens.
                 await captured.abortSource();
+                this.completeSourceRelocationMetric(relocationMetric, settlement);
                 throw new Error(`Relocation '${relayAuthorityId}' ended by the source Preserve fence; the source kept the authority.`);
             }
             if (settlement === 'lost') {
+                this.completeSourceRelocationMetric(relocationMetric, settlement);
                 // Expired owner: dispatch and Store changes stop for good and every
                 // pending request without a terminal gets one Unavailable.
-                const unavailable = (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `Relocation '${relayAuthorityId}' source owner lease ended before its authority settled.`, true);
+                const unavailable = (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RouteNotConnected, `Relocation '${relayAuthorityId}' source authority ended (source owner lease expired, authority Missing, or owner changed).`, true);
                 await captured.discardSource(unavailable);
                 throw new service_relocation_coordinator_1.ServiceRelocationAuthorityError(unavailable.message, { cause: unavailable });
             }
+            this.completeSourceRelocationMetric(relocationMetric, settlement);
             for (const session of sessions)
                 session.prepared.setReplayResults([]);
-            await captured.commitSource();
+            await captured.commitSource(settlement.followAuthorities);
             await this.options.reconcileStatefulAuthorityRoutes?.(signal);
         }
         catch (error) {
-            if (settlement !== 'target')
+            if (this.disposed &&
+                (error instanceof ServiceRelocationRuntimeStoppedError ||
+                    (error instanceof runtime_values_1.ZLinkBackendResultError &&
+                        error.result ===
+                            (error.operation === 'request' ? runtime_values_1.RequestResult.Terminated : runtime_values_1.SubmitResult.Terminated))))
+                this.completeSourceRelocationMetric(relocationMetric, undefined, true);
+            if (settlement === undefined || typeof settlement === 'string')
                 throw error;
             // Target commit is confirmed; later source cleanup failures cannot move
             // the authority back (spec 28 §10).
@@ -1562,22 +1679,32 @@ class ZLinkHostServiceRelocationRuntime {
             throw new service_relocation_coordinator_1.ServiceRelocationPostCommitError(authority, { id: `${captured.envelope.aggregateId}:${captured.envelope.aggregateGeneration}` }, error);
         }
         finally {
+            this.completeSourceRelocationMetric(relocationMetric);
             if (!readyReceived) {
                 // Only an explicit failure before the Ready reply becomes accepted
                 // restores the source from the memory payload (spec 28 §9).
                 await captured.abortSource().catch(() => undefined);
             }
-            if (this.relocationAuthorityKeys.get(relayAuthorityId) === relayAuthorityKey) {
-                this.relocationAuthorityKeys.delete(relayAuthorityId);
-            }
         }
     }
+    completeSourceRelocationMetric(metric, settlement, sourceStopped = false) {
+        metric?.complete(settlement === 'source'
+            ? 'aborted'
+            : settlement === 'lost'
+                ? 'failed'
+                : settlement !== undefined
+                    ? 'completed'
+                    : sourceStopped
+                        ? 'shutdown'
+                        : 'failed');
+    }
     /** Streams the payload chunks of one stage under the effective in-flight budgets. */
     async sendRelocationStateChunks(meshName, target, identity, encoded, plan, signal) {
         for (let ordinal = 0; ordinal < plan.chunkCount; ordinal += 1) {
             const chunkData = (0, relocation_direct_transfer_1.relocationChunkAt)(encoded, plan, ordinal);
             const releases = await this.acquireRelocationBudget(String(target.rid), chunkData.byteLength, signal);
             try {
+                signal?.throwIfAborted();
                 await this.sendControlOneWay(meshName, target.rid, {
                     kind: 'state',
                     relocation: identity.relocation,
@@ -1638,18 +1765,21 @@ class ZLinkHostServiceRelocationRuntime {
      * window. S4 — the Message Follow route removal point — closes the unit for
      * SafeToShutdown.
      */
-    beginSourceCutoverWindow(meshName, targetNodeRid, relocationKey, frames, initialSubmitFailed, limits) {
+    beginSourceCutoverWindow(meshName, targetNodeRid, relocationKey, frames, submittedRouteGeneration, limits) {
         const submittedAt = performance.now();
         const window = {
             meshName,
             targetNodeRid,
             frames,
-            resendPending: initialSubmitFailed,
+            submittedRouteGeneration,
             cutoverSubmittedAtMs: submittedAt,
             windowClosed: false,
             followExpired: false
         };
+        const wasQuiescent = this.isSafeToShutdown();
         this.sourceCutoverWindows.set(relocationKey, window);
+        if (wasQuiescent)
+            this.options.sourceQuiescenceChanged?.();
         window.followTimer = setTimeout(() => {
             window.followExpired = true;
             // S1→S4 route convergence: the span the source must keep its Message
@@ -1671,33 +1801,27 @@ class ZLinkHostServiceRelocationRuntime {
             window.followExpired &&
             this.sourceCutoverWindows.get(relocationKey) === window) {
             this.sourceCutoverWindows.delete(relocationKey);
+            if (this.isSafeToShutdown())
+                this.options.sourceQuiescenceChanged?.();
         }
     }
-    /**
-     * Sends the whole boundary batch and cutover again after a failed submit
-     * or an observed loss of the target connection (spec 28 §4.4). The target
-     * replaces its partial span with the whole batch.
-     */
+    /** Relocation flow §4.4: replay the whole batch on a different ready route. */
     async resendSourceCutover(window) {
         const frames = window.frames;
         if (frames === undefined)
             return;
-        const peers = this.requireMeshNode(window.meshName).peers();
-        const peer = peers.find((value) => value.routingId !== null && String(value.routingId) === String(window.targetNodeRid));
-        if (peer !== undefined && peer.state !== service_runtime_contracts_1.MeshPeerRuntimeState.Serving) {
-            window.resendPending = true;
-            return;
-        }
-        if (!window.resendPending)
+        const route = this.requireMeshNode(window.meshName).observePeerRoute?.(window.targetNodeRid);
+        if (route?.ready !== true || route.generation === window.submittedRouteGeneration)
             return;
+        window.submittedRouteGeneration = route.generation;
         try {
             for (const frame of frames) {
                 await this.submitControlFrame(window.meshName, window.targetNodeRid, frame, 'cutover retransmission');
             }
-            window.resendPending = false;
         }
-        catch {
-            // The next settlement round retries the whole batch.
+        catch (error) {
+            if (!(0, durable_service_request_1.durableRequestCanReplay)(error))
+                throw error;
         }
     }
     /**
@@ -1708,15 +1832,18 @@ class ZLinkHostServiceRelocationRuntime {
      * excludes a late target commit. `target`: the
      * target committed. `source`: Preserve fenced the target out while the
      * source owner lease was valid. `lost`: the source owner lease ended first
-     * or another authority owns the object. An uncertain Store or lease result
-     * keeps the work retained and repeats the same decision.
+     * or authority is Missing or fails the same-object, advanced-generation fence.
+     * A committed later owner has no Follow snapshot (Location runtime §10). An uncertain
+     * Store or lease result keeps the work retained and repeats the same decision.
      */
-    async settleSourceAuthority(envelope, primary, target, restoreDeadlineReached, window) {
+    async settleSourceAuthority(envelope, primary, target, restoreDeadlineReached, window, relocationMetric) {
         const owner = { ownerId: primary.ownerId, leaseGeneration: primary.ownerLeaseGeneration };
         const store = this.requireLocationStore();
         for (;;) {
-            if (this.disposed)
-                throw new Error('Relocation runtime stopped.');
+            if (this.disposed) {
+                this.completeSourceRelocationMetric(relocationMetric, undefined, true);
+                throw new ServiceRelocationRuntimeStoppedError();
+            }
             await this.resendSourceCutover(window);
             const observed = await this.readSourceSettlement(envelope, primary, target).catch((error) => {
                 if (!(0, location_store_failure_1.isIndeterminateLocationStoreFailure)(error))
@@ -1724,7 +1851,7 @@ class ZLinkHostServiceRelocationRuntime {
                 return undefined;
             });
             if (observed?.kind === 'target')
-                return 'target';
+                return observed;
             if (observed?.kind === 'other')
                 return 'lost';
             if (restoreDeadlineReached() && observed?.kind === 'source') {
@@ -1759,6 +1886,7 @@ class ZLinkHostServiceRelocationRuntime {
     async readSourceSettlement(envelope, primary, target) {
         const primaryAuthorityKey = primaryKey(envelope);
         let committed = 0;
+        const followAuthorities = new Map();
         let primaryCurrent;
         for (const participant of envelope.participants) {
             const current = await this.requireLocationStore().readAuthority({
@@ -1767,18 +1895,22 @@ class ZLinkHostServiceRelocationRuntime {
             if (current.kind !== 'snapshot')
                 return { kind: 'other' };
             if (current.objectGeneration === participant.objectGeneration &&
-                current.ownerId === target.ownerId &&
-                current.ownerLeaseGeneration === target.ownerLeaseGeneration &&
                 current.authorityOwnerGeneration > participant.authorityOwnerGeneration &&
-                String(current.allocation.descriptor.rid) === target.nodeRid &&
-                current.allocation.descriptorLifecycleGeneration === target.nodeGeneration) {
+                // Location runtime §6: an owner is the (OwnerId, OwnerLeaseGeneration) pair;
+                // a restarted node keeps its OwnerId under a new lease generation.
+                (current.ownerId !== primary.ownerId ||
+                    current.ownerLeaseGeneration !== primary.ownerLeaseGeneration)) {
                 committed += 1;
+                // Location runtime §10: only the observed first target can receive Follow.
+                if (current.ownerId === target.ownerId &&
+                    current.ownerLeaseGeneration === target.ownerLeaseGeneration)
+                    followAuthorities.set(participant.key, current);
             }
             if (participant.key === primaryAuthorityKey)
                 primaryCurrent = current;
         }
         if (committed === envelope.participants.length)
-            return { kind: 'target' };
+            return { kind: 'target', followAuthorities };
         if (primaryCurrent !== undefined && isSourceOwner(primaryCurrent, primary)) {
             return { kind: 'source', current: primaryCurrent };
         }
@@ -1813,11 +1945,21 @@ class ZLinkHostServiceRelocationRuntime {
     }
     /** Restores the hidden object and its saved-work prefix before Ready. */
     async handlePrepareControl(meshName, stagingId, request, sourceNodeRid, signal) {
+        // Host relocation flow 05: a sealed target refuses a new PREPARE before any
+        // staging. The typed ShuttingDown reaches the source as relocationFailed.
+        if (this.targetAdmissionSealed()) {
+            throw new contracts_1.ZLinkFrameworkException(contracts_1.ZLinkFrameworkErrorKind.ShuttingDown, 'Relocation target admission is sealed for shutdown.');
+        }
+        signal =
+            signal === undefined
+                ? this.targetPreparationStop.signal
+                : AbortSignal.any([signal, this.targetPreparationStop.signal]);
+        signal.throwIfAborted();
         const targetStatus = this.requireMeshNode(meshName).status();
         const targetOwner = this.options.currentOwner();
         const targetDescriptor = this.options.localDescriptor?.(meshName);
         if (targetOwner === undefined ||
-            String(targetStatus.routingId) !== request.target.nodeRid ||
+            !(0, routing_id_1.routingIdsEqual)(targetStatus.routingId, request.target.nodeRid) ||
             targetStatus.lifecycleGeneration !== request.target.nodeGeneration ||
             targetOwner.ownerId !== request.target.ownerId ||
             targetOwner.leaseGeneration !== request.target.ownerLeaseGeneration ||
@@ -1847,11 +1989,10 @@ class ZLinkHostServiceRelocationRuntime {
             payload = await pendingAssembly.assembly.payload();
         }
         catch (error) {
-            // A rejection observed after dispose() started is the runtime shutting
-            // down, not a chunk-assembly or checksum integrity failure — it must
-            // not be reported as DataLost(35). There is no dedicated ShuttingDown
-            // wire code in the vocabulary yet, so it falls through unwrapped to
-            // the generic InternalFailure code (spec 15 §4).
+            // Target shutdown preserves its lifecycle failure instead of reporting payload corruption.
+            this.targetAssemblies.delete(stagingId);
+            if (this.targetPreparationStop.signal.aborted)
+                throw this.targetPreparationStop.signal.reason;
             if (this.disposed)
                 throw error;
             const message = error !== null && typeof error === 'object' && 'message' in error
@@ -1860,23 +2001,61 @@ class ZLinkHostServiceRelocationRuntime {
             throw new ServiceRelocationDataLostError(String(message));
         }
         const envelope = (0, service_relocation_runtime_1.decodeServiceRelocationEnvelope)(payload, request.targetAttemptGeneration);
-        const inventoryEnvelope = attachPrepareBoundSessions(await this.resolveTargetParticipantInventory(request, envelope, signal), request.nodeInternalBoundSessions);
-        validatePrepareEnvelope(request, inventoryEnvelope);
-        const releaseActivation = (await this.options.activationAdmission?.acquire(meshName, signal)) ?? (() => undefined);
+        const recovery = canonicalActorJoinRecovery(envelope.participants);
+        const releaseJoinAdmission = recovery === undefined
+            ? () => undefined
+            : this.options.spotManager().beginActorJoinRelocation(recovery.request.handoffId);
         let materialized;
         let reservation;
+        let releaseActivation = () => undefined;
         try {
+            const inventoryEnvelope = attachCanonicalBoundSessions(await this.resolveTargetParticipantInventory(meshName, request, envelope, signal), request, meshName);
+            validatePrepareEnvelope(request, inventoryEnvelope);
+            releaseActivation =
+                (await this.options.activationAdmission?.acquire(meshName, signal)) ?? (() => undefined);
             // Deferred Join completion publishes into the source authority's
             // canonical relocation slot. Do that while the row is still CAS-able;
             // the aggregate marker installed by reserveTargetForPrepare deliberately
             // rejects unrelated authority CAS until commit/abort.
             materialized = await this.materializeTargetEnvelope(meshName, inventoryEnvelope, signal);
             await materialized.owner.restoreSavedWork(materialized.staging, signal);
+            for (const participant of inventoryEnvelope.participants) {
+                const binding = participant.sessionBinding;
+                if (binding === undefined)
+                    continue;
+                const peerRid = (0, routing_id_1.decodeRoutingId)('', Buffer.from(binding.sessionOwnerNodeRid).toString('hex'));
+                const node = this.requireMeshNode(meshName);
+                if ((0, routing_id_1.routingIdsEqual)(node.status().routingId, peerRid))
+                    continue;
+                if (node.isPeerRouteReady?.(peerRid, binding.sessionOwnerNodeGeneration) !== true) {
+                    // Subscribe before requesting reconciliation so a synchronous admission cannot be lost.
+                    const wait = node.waitForPeerRoute;
+                    if (wait === undefined)
+                        throw new Error('Mesh peer route observation is unavailable.');
+                    const ready = wait.call(node, peerRid, binding.sessionOwnerNodeGeneration, request.deadlineUnixMs, signal);
+                    void this.options
+                        .requestPeerReconcile?.(meshName, String(peerRid))
+                        .catch((error) => console.error('[zlink.runtime.relocation.session_route_reconcile_failed]', error));
+                    try {
+                        await ready;
+                    }
+                    catch (error) {
+                        if (error instanceof operation_registry_1.OperationTimeoutError) {
+                            throw new contracts_1.ZLinkFrameworkException(contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded, 'Relocation source operation deadline exceeded waiting for Session owner route.');
+                        }
+                        throw error;
+                    }
+                }
+            }
+            if (request.deadlineUnixMs <= BigInt(Date.now())) {
+                throw new contracts_1.ZLinkFrameworkException(contracts_1.ZLinkFrameworkErrorKind.DeadlineExceeded, 'Relocation source operation deadline exceeded before relay-ready.');
+            }
+            signal.throwIfAborted();
             reservation = await this.reserveTargetForPrepare(meshName, request, inventoryEnvelope, signal);
             const offer = {
                 prepare: request,
                 prepareFingerprint: fingerprint,
-                authenticatedSourceNodeRid: String(sourceNodeRid),
+                authenticatedSourceNodeRid: sourceNodeRid,
                 envelope: inventoryEnvelope,
                 reservation
             };
@@ -1887,11 +2066,14 @@ class ZLinkHostServiceRelocationRuntime {
                 lane: Promise.resolve(),
                 cutoverReceived: false,
                 boundaryRelay: [],
-                releaseActivation
+                releaseActivation,
+                releaseJoinAdmission
             };
             this.targetStages.set(stagingId, stage);
         }
         catch (error) {
+            this.targetAssemblies.delete(stagingId);
+            releaseJoinAdmission();
             releaseActivation();
             if (reservation !== undefined) {
                 await this.abortTargetReservation(reservation, signal).catch(() => undefined);
@@ -2031,24 +2213,13 @@ class ZLinkHostServiceRelocationRuntime {
             stage.releaseActivation();
             resumeStartedAt = performance.now();
             stage.phase = 'committed';
-            await stage.owner.normalize(stage.staging, authority, signal);
             await stage.owner.publish(stage.staging, authority, signal);
-            // The target may have visited this Actor before and still retain that
-            // tenure in its private Actor-client resolver. The target-only CAS is
-            // now authoritative, so expire the old projection before OnJoinedActor
-            // can issue an Actor request and deadlock behind source leave.
-            for (const hidden of stage.staging.hidden.values()) {
-                if (hidden.actor !== undefined) {
-                    this.options.invalidateActorRoute?.(hidden.actor.context.actorId);
-                }
-            }
-            await this.finalizeActorJoinProfiles(meshName, stage, signal);
             // Clear the final relocation publication before admission becomes
             // externally visible so a later Join cannot reserve against the
             // previous root. A bounded CAS conflict must not roll back already
             // committed target ownership or strand its staged object.
             try {
-                await this.clearTargetRelocationPublication(stage, authority, signal);
+                authority = await this.clearTargetRelocationPublication(stage, authority, signal);
             }
             catch (error) {
                 console.warn('[zlink.runtime.relocation.publication_clear_failed]', stagingId, error);
@@ -2056,15 +2227,33 @@ class ZLinkHostServiceRelocationRuntime {
                     mesh_name: meshName
                 });
             }
-            await stage.owner.openAdmission(stage.staging, signal);
-            // S2→S3: owner confirmation to application dispatch opening.
-            this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationTargetResume, Math.max(0, performance.now() - resumeStartedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND, { mesh_name: meshName });
+            for (const [index, participant] of stage.staging.envelope.participants.entries()) {
+                const hidden = stage.staging.hidden.get(participant.key);
+                if (hidden?.actor === undefined || hidden.replayPackets.length === 0)
+                    continue;
+                const coordinator = this.targetReplyRelayCoordinator(meshName, stage, authority);
+                hidden.replayStart = stage.finalize;
+                hidden.onReplayResult = (packet, result) => this.relayTerminalReply(meshName, stage, coordinator, BigInt(index + 1), packet, result, signal);
+            }
+            await stage.owner.normalize(stage.staging, authority, signal);
+            // The target may have visited this Actor before and still retain that
+            // tenure in its private Actor-client resolver. The target-only CAS is
+            // now authoritative, so expire the old projection before OnJoinedActor
+            // can issue an Actor request and deadlock behind source leave.
+            for (const hidden of stage.staging.hidden.values()) {
+                if (hidden.actor !== undefined) {
+                    this.options.invalidateActorRoute?.(hidden.actor.context.actorId);
+                }
+            }
+            await this.finalizeActorJoinProfiles(meshName, stage, signal);
             await this.publishSessionRoutes(stage.staging);
-            await this.relayTerminalReplies(meshName, stage, this.targetReplyRelayCoordinator(meshName, stage, authority), signal);
             stage.phase = 'open';
             this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
             this.targetStages.delete(stagingId);
             this.targetAssemblies.delete(stagingId);
+            await stage.owner.openAdmission(stage.staging, signal);
+            // S2→S3: owner confirmation to application dispatch opening.
+            this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationTargetResume, Math.max(0, performance.now() - resumeStartedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND, { mesh_name: meshName });
         }
         catch (error) {
             this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
@@ -2082,6 +2271,9 @@ class ZLinkHostServiceRelocationRuntime {
             }
             throw error;
         }
+        finally {
+            stage.releaseJoinAdmission();
+        }
     }
     validateRelocationData(stage, request) {
         const frozen = request.frozenRecord;
@@ -2096,7 +2288,7 @@ class ZLinkHostServiceRelocationRuntime {
             target.generation !== request.object.objectGeneration ||
             target.targetNodeRid !== preparedTarget.nodeRid ||
             target.targetNodeGeneration !== preparedTarget.nodeGeneration ||
-            target.authorityOwnerGeneration !== request.object.expectedAuthorityOwnerGeneration + 1n ||
+            target.authorityOwnerGeneration !== request.object.expectedAuthorityOwnerGeneration ||
             target.ownerLeaseGeneration !== preparedTarget.ownerLeaseGeneration) {
             throw new Error('Relocation data does not target the exact temporary Actor queue.');
         }
@@ -2158,9 +2350,7 @@ class ZLinkHostServiceRelocationRuntime {
         if (profile.state.actorId !== input.actorId || !input.succeeded) {
             throw new Error(`Actor Join relocation '${input.transferId}' source leave identity changed.`);
         }
-        this.sourceActorJoinProfiles.delete(input.transferId);
-        this.terminalActorJoinSourceLeaves.remember(input.transferId, input.actorId);
-        void this.finalizeActorJoinSource(profile);
+        void this.retireActorJoinSource(input.transferId, profile);
         return true;
     }
     async sendControlOneWay(meshName, targetNodeRid, request) {
@@ -2169,7 +2359,9 @@ class ZLinkHostServiceRelocationRuntime {
     async submitControlFrame(meshName, targetNodeRid, frame, kind) {
         const submitted = await this.sendInfrastructureControl(meshName, targetNodeRid, frame);
         if (submitted !== runtime_values_1.SubmitResult.Ok) {
-            throw new Error(`Relocation ${kind} was not accepted by RouteMesh.`);
+            throw new runtime_values_1.ZLinkBackendResultError('submit', submitted, undefined, {
+                cause: new Error(`Relocation ${kind} was not accepted by RouteMesh.`)
+            });
         }
     }
     async clearTargetRelocationPublication(stage, primary, signal) {
@@ -2180,7 +2372,7 @@ class ZLinkHostServiceRelocationRuntime {
         //  row; the caller records it and leaves the committed ownership intact.
         const publication = this.codec.read(primary.payload);
         if (publication === undefined)
-            return;
+            return primary;
         const result = await this.requireLocationStore().compareExchangeAuthority(stage.staging.primaryAuthorityKey, primary.storeVersion, {
             kind: 'put',
             generationTransition: 'preserve',
@@ -2189,39 +2381,52 @@ class ZLinkHostServiceRelocationRuntime {
         if (result.kind !== 'stored') {
             throw new Error('Relocation target authority normalization CAS failed.');
         }
+        return { ...result, kind: 'snapshot' };
     }
     async handleReplyRelay(meshName, relay, sourceNodeRid, signal) {
         if (sourceNodeRid === null) {
             throw new Error('Relocation reply relay has no authenticated target node.');
         }
-        await this.requireAdmittedPeer(meshName, String(sourceNodeRid), relay.coordinator, signal);
-        const relocationId = wireIdText(relay.relocation);
-        const authorityKey = this.relocationAuthorityKeys.get(relocationId);
-        if (authorityKey === undefined) {
-            throw new Error('Relocation reply relay has no registered durable authority.');
-        }
-        const authority = await requireAuthority(this.requireLocationStore(), { value: authorityKey }, signal);
-        if (authority.storeVersion.value !== relay.coordinator.expectedAuthorityStoreVersion ||
-            authority.ownerId !== relay.coordinator.ownerId ||
-            authority.ownerLeaseGeneration !== relay.coordinator.leaseGeneration ||
-            String(authority.allocation.descriptor.rid) !== relay.coordinator.nodeRid ||
-            authority.allocation.descriptorLifecycleGeneration !== relay.coordinator.nodeGeneration) {
-            throw new Error('Relocation reply relay coordinator authority fence is stale.');
-        }
-        const accepted = this.options.actorTransfer.relayCanonicalMaintenanceTerminal(wireIdText(relay.operation), relay.replyRouteId.toString(), handoffResultFromRelay(relay), sourceNodeRid);
-        if ((accepted.status !== 'terminalReceived' && accepted.status !== 'alreadyTerminal') ||
-            accepted.source === undefined) {
-            throw new Error('Canonical relocation reply relay collided with another source route.');
-        }
-        const requestSource = handoffSourceFence(accepted.source);
-        const localStatus = this.requireMeshNode(meshName).status();
+        await this.requireAdmittedPeer(meshName, sourceNodeRid, relay.coordinator, signal);
+        const node = this.requireMeshNode(meshName);
+        const localStatus = node.status();
         const localOwner = this.options.currentOwner();
-        if (localOwner === undefined ||
-            requestSource.ownerId !== localOwner.ownerId ||
-            requestSource.leaseGeneration !== localOwner.leaseGeneration ||
-            !(0, routing_id_1.routingIdsEqual)(requestSource.nodeRid, localStatus.routingId) ||
-            requestSource.nodeGeneration !== localStatus.lifecycleGeneration) {
-            throw new Error('Relocation reply relay request-source fence changed after capture.');
+        if (localOwner === undefined)
+            throw new Error('Relocation requester owner lease is unavailable.');
+        let status = node.acceptRelocatedActorTerminal?.(relay.operation, relay.replyRouteId, {
+            terminalResult: relay.terminalResult,
+            failureCode: relay.failureCode,
+            ...(relay.payload === undefined
+                ? {}
+                : {
+                    payload: {
+                        packetName: relay.payload.packetName,
+                        contentType: relay.payload.contentType,
+                        payload: Buffer.from(relay.payload.bytes)
+                    }
+                })
+        });
+        let requestSource = {
+            ownerId: localOwner.ownerId,
+            leaseGeneration: localOwner.leaseGeneration,
+            nodeRid: localStatus.routingId,
+            nodeGeneration: localStatus.lifecycleGeneration
+        };
+        if (status === undefined) {
+            const accepted = this.options.actorTransfer.relayCanonicalMaintenanceTerminal(relay.operation.high.toString(16).padStart(16, '0') +
+                relay.operation.low.toString(16).padStart(16, '0'), relay.replyRouteId.toString(), handoffResultFromRelay(relay), sourceNodeRid);
+            if (accepted.status === 'notAcknowledged' || accepted.source === undefined) {
+                throw new Error('Canonical relocation reply relay collided with another source route.');
+            }
+            requestSource = handoffSourceFence(accepted.source);
+            if (!sameRequestSource(requestSource, {
+                ownerId: localOwner.ownerId,
+                leaseGeneration: localOwner.leaseGeneration,
+                nodeRid: localStatus.routingId,
+                nodeGeneration: localStatus.lifecycleGeneration
+            }))
+                throw new Error('Relocation reply relay request-source fence changed after capture.');
+            status = accepted.status;
         }
         const ack = {
             relocation: relay.relocation,
@@ -2229,16 +2434,15 @@ class ZLinkHostServiceRelocationRuntime {
             operation: relay.operation,
             replyRouteId: relay.replyRouteId,
             requestSource,
-            status: accepted.status
+            status
         };
         if ((await this.sendInfrastructureControl(meshName, sourceNodeRid, (0, service_stateful_wire_codec_1.encodeMaintenanceReplyRelayAck)(ack))) !== runtime_values_1.SubmitResult.Ok) {
             throw new Error('Relocation reply relay ACK send was rejected.');
         }
     }
     async sendReplyRelay(meshName, ackTargetNodeRid, request, expectedRequestSource, signal) {
-        const targetRid = String(ackTargetNodeRid);
         const identityKey = replyRelayIdentityKey(request);
-        const key = replyRelayPendingKey(targetRid, request);
+        const key = replyRelayPendingKey(ackTargetNodeRid, request);
         if (this.pendingReplyRelays.has(key)) {
             throw new Error(`Relocation reply relay ACK '${key}' is already pending.`);
         }
@@ -2252,7 +2456,7 @@ class ZLinkHostServiceRelocationRuntime {
                 action();
             };
             const pending = {
-                ackTargetNodeRid: targetRid,
+                ackTargetNodeRid,
                 identityKey,
                 request,
                 expectedRequestSource,
@@ -2288,7 +2492,7 @@ class ZLinkHostServiceRelocationRuntime {
     }
     async acceptReplyRelayAck(meshName, ack, sourceNodeRid, signal) {
         const identityKey = replyRelayIdentityKey(ack);
-        const exactKey = sourceNodeRid === null ? undefined : replyRelayPendingKey(String(sourceNodeRid), ack);
+        const exactKey = sourceNodeRid === null ? undefined : replyRelayPendingKey(sourceNodeRid, ack);
         const pending = exactKey === undefined ? undefined : this.pendingReplyRelays.get(exactKey);
         if (pending === undefined) {
             const collision = [...this.pendingReplyRelays.values()].find((value) => value.identityKey === identityKey);
@@ -2311,12 +2515,12 @@ class ZLinkHostServiceRelocationRuntime {
         }
     }
     async requireAdmittedPeer(meshName, authenticatedRid, expected, signal) {
-        const descriptor = (await this.options.liveDescriptors(meshName, signal)).find((value) => String(value.rid) === authenticatedRid && value.state === 1);
+        const descriptor = (await this.options.liveDescriptors(meshName, signal)).find((value) => (0, routing_id_1.routingIdsEqual)(value.rid, authenticatedRid) && value.state === 1);
         if (descriptor === undefined ||
             (expected !== undefined &&
                 (descriptor.ownerId !== expected.ownerId ||
                     descriptor.leaseGeneration !== expected.leaseGeneration ||
-                    String(descriptor.rid) !== expected.nodeRid ||
+                    !(0, routing_id_1.routingIdsEqual)(descriptor.rid, expected.nodeRid) ||
                     descriptor.lifecycleGeneration !== expected.nodeGeneration))) {
             throw new Error('Relocation reply relay peer is not the exact admitted source fence.');
         }
@@ -2328,39 +2532,32 @@ class ZLinkHostServiceRelocationRuntime {
         if (owner === undefined ||
             owner.ownerId !== target.ownerId ||
             owner.leaseGeneration !== target.ownerLeaseGeneration ||
-            String(status.routingId) !== target.nodeRid ||
+            !(0, routing_id_1.routingIdsEqual)(status.routingId, target.nodeRid) ||
             status.lifecycleGeneration !== target.nodeGeneration) {
             throw new Error('Relocation reply relay target coordinator fence is stale.');
         }
         return {
             ownerId: owner.ownerId,
             leaseGeneration: owner.leaseGeneration,
-            nodeRid: String(status.routingId),
+            nodeRid: status.routingId,
             nodeGeneration: status.lifecycleGeneration,
             expectedAuthorityStoreVersion: authority.storeVersion.value
         };
     }
-    async relayTerminalReplies(meshName, stage, coordinator, signal) {
-        for (const [participantIndex, participant] of stage.staging.envelope.participants.entries()) {
-            const hidden = stage.staging.hidden.get(participant.key);
-            if (hidden?.actor === undefined)
-                continue;
-            for (const [resultIndex, packet] of hidden.replayPackets.entries()) {
-                if (!packet.returnResponse || packet.source === undefined)
-                    continue;
-                const result = hidden.replayResults.at(resultIndex);
-                if (result === undefined || result.index !== packet.index) {
-                    throw new Error('Relocation request result changed after target dispatch.');
-                }
-                const completion = {
-                    index: packet.index,
-                    operationId: packet.messageFollowContext.operationId,
-                    source: packet.source,
-                    result
-                };
-                await this.sendReplyRelay(meshName, packet.source.nodeRid, maintenanceReplyRelay(stage, coordinator, BigInt(participantIndex + 1), completion), handoffSourceFence(packet.source), signal);
-            }
-        }
+    async relayTerminalReply(meshName, stage, coordinator, participantId, packet, result, signal) {
+        if (!packet.returnResponse || packet.source === undefined)
+            return;
+        if (result.index !== packet.index) {
+            throw new Error('Relocation request result changed after target dispatch.');
+        }
+        const completion = {
+            index: packet.index,
+            operationId: packet.messageFollowContext.operationId,
+            source: packet.source,
+            result
+        };
+        const source = handoffSourceFence(packet.source);
+        await this.sendReplyRelay(meshName, source.nodeRid, maintenanceReplyRelay(stage, coordinator, participantId, completion, packet, this.options.registration.messageSerializers, this.options.flowCreationEnabled?.() ?? false), source, signal);
     }
     async exactSourceLeaseExpired(source, signal) {
         const lease = await this.requireLocationStore().readOwnerLease(source.ownerId, signal);
@@ -2378,60 +2575,34 @@ class ZLinkHostServiceRelocationRuntime {
             await this.options.actorTransfer.publishRoutedActorOwnership(hidden.actor, carried === undefined ? undefined : decodeActorSession(carried.boundSessionState));
         }
     }
-    async sendControl(meshName, targetNodeRid, request, signal, deadlineAtMs = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS, sideband = []) {
+    async sendControl(meshName, targetNodeRid, request, signal, deadlineAtMs = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS, onSubmitted) {
         const key = controlAckKey(request);
-        const frames = sideband.length === 0
-            ? [(0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request)]
-            : [(0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request), ...sideband];
-        let lastRequestError;
-        for (;;) {
-            signal?.throwIfAborted();
-            const remainingMs = deadlineAtMs - performance.now();
-            if (remainingMs <= 0) {
-                throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Relocation control ACK '${key}' timed out.`, true, lastRequestError);
-            }
-            const attemptTimeoutMs = Math.max(1, Math.min(RELOCATION_ATTEMPT_TIMEOUT_MS, Math.ceil(remainingMs)));
-            const startedAtMs = performance.now();
-            try {
-                const replyFrames = await this.requestInfrastructureControl(meshName, targetNodeRid, frames, attemptTimeoutMs);
-                if (replyFrames.length !== 1) {
-                    throw new service_wire_m6a_codec_1.ServiceWireProtocolError(`Relocation control '${key}' reply must contain exactly one frame.`);
-                }
-                const response = (0, service_relocation_control_1.decodeServiceRelocationControlResponse)(Buffer.from(replyFrames[0]));
-                if (response.kind === 'failed') {
-                    validateControlFailureResponse(request, response);
-                    throw relocationFailureException(response);
-                }
-                validateControlResponse(request, response);
-                return response;
-            }
-            catch (error) {
-                if (error instanceof service_wire_m6a_codec_1.ServiceWireProtocolError || error instanceof contracts_1.ZLinkFrameworkException) {
-                    throw error;
-                }
-                lastRequestError = error;
-                if ((0, diagnostics_1.isRelocationDebugEnabled)()) {
-                    (0, diagnostics_1.relocationDebug)('control.request_retry', {
-                        key,
-                        kind: request.kind,
-                        targetRid: String(targetNodeRid)
-                    });
-                }
-                const retryDelayMs = Math.min(Math.max(0, attemptTimeoutMs - (performance.now() - startedAtMs)), Math.max(0, deadlineAtMs - performance.now()));
-                if (retryDelayMs > 0) {
-                    await waitForRelocationRetry(retryDelayMs, signal);
-                }
-            }
+        const frames = [(0, service_relocation_control_1.encodeServiceRelocationControlRequest)(request)];
+        signal?.throwIfAborted();
+        const remainingMs = Math.ceil(deadlineAtMs - performance.now());
+        if (remainingMs <= 0) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.DeadlineExceeded, `Relocation control ACK '${key}' timed out.`, true);
         }
+        const replyFrames = await this.requestInfrastructureControl(meshName, targetNodeRid, frames, remainingMs, signal, onSubmitted);
+        if (replyFrames.length !== 1) {
+            throw new service_wire_m6a_codec_2.ServiceWireProtocolError(`Relocation control '${key}' reply must contain exactly one frame.`);
+        }
+        const response = (0, service_relocation_control_1.decodeServiceRelocationControlResponse)(Buffer.from(replyFrames[0]));
+        if (response.kind === 'failed') {
+            validateControlFailureResponse(request, response);
+            throw relocationFailureException(response);
+        }
+        validateControlResponse(request, response);
+        return response;
     }
     async selectTarget(meshName, localRid, targetApplicationVersion, requirements = [], signal) {
         const descriptors = await this.options.liveDescriptors(meshName, signal);
         const local = this.options.localDescriptor?.(meshName) ??
-            descriptors.find((descriptor) => String(descriptor.rid) === localRid);
+            descriptors.find((descriptor) => (0, routing_id_1.routingIdsEqual)(descriptor.rid, localRid));
         const requiredVersion = targetApplicationVersion ?? local?.applicationVersion;
         const peers = this.requireMeshNode(meshName).peers();
         const candidates = descriptors
-            .filter((descriptor) => String(descriptor.rid) !== localRid &&
+            .filter((descriptor) => !(0, routing_id_1.routingIdsEqual)(descriptor.rid, localRid) &&
             descriptor.state === contracts_1.ZLinkFrameworkRuntimeState.Serving &&
             descriptor.objectRole === contracts_1.ZLinkObjectRole.Server &&
             descriptor.placementWeight > 0 &&
@@ -2439,7 +2610,7 @@ class ZLinkHostServiceRelocationRuntime {
             (local?.maintenanceWave === undefined ||
                 descriptor.maintenanceWave !== local.maintenanceWave) &&
             peers.some((peer) => peer.routingId !== null &&
-                String(peer.routingId) === String(descriptor.rid) &&
+                (0, routing_id_1.routingIdsEqual)(peer.routingId, descriptor.rid) &&
                 peer.lifecycleGeneration === descriptor.lifecycleGeneration &&
                 peer.state === service_runtime_contracts_1.MeshPeerRuntimeState.Serving) &&
             relocationTargetSupports(descriptor, requirements))
@@ -2473,7 +2644,7 @@ class ZLinkHostServiceRelocationRuntime {
         const publication = relocationPublication(prepare, envelope);
         const participants = envelope.participants.map((participant) => {
             const expected = authorities.get(participant.key);
-            const membership = actorMembershipTarget(envelope, participant.key);
+            const membership = actorMembershipTarget(envelope.memberships.find((value) => value.actorKey === participant.key), this.options.localDescriptor?.(meshName));
             const entrySpotId = expected.allocation.objectKind === 'actor' && membership === undefined
                 ? this.options.spotManager()?.entrySpotIdForMesh(meshName)
                 : undefined;
@@ -2497,18 +2668,14 @@ class ZLinkHostServiceRelocationRuntime {
                     objectGeneration: expected.objectGeneration,
                     targetAttemptGeneration: prepare.targetAttemptGeneration,
                     coordinatorExpectedStoreVersion: expected.storeVersion.value,
-                    ...(membership === undefined
-                        ? expected.allocation.objectKind === 'actor'
+                    ...(membership ??
+                        (expected.allocation.objectKind === 'actor'
                             ? {
                                 actorSpotId: entrySpotId,
                                 actorSpotGeneration: prepare.target.nodeGeneration,
                                 actorSpotKind: contracts_1.ZLinkSpotKind.Entry
                             }
-                            : {}
-                        : {
-                            ...membership,
-                            actorSpotKind: contracts_1.ZLinkSpotKind.User
-                        })
+                            : {}))
                 }),
                 membershipMutation: encodeMembershipMutation(envelope.memberships, participant.key)
             };
@@ -2599,6 +2766,7 @@ class ZLinkHostServiceRelocationRuntime {
             failures.push(error);
         }
         stage.phase = 'failed';
+        stage.releaseJoinAdmission();
         if (failures.length === 1)
             throw failures[0];
         if (failures.length > 1) {
@@ -2729,7 +2897,7 @@ class ZLinkHostServiceRelocationRuntime {
         return { owner, staging, target };
     }
     /** Maps schema ordinals to the authoritative Location Store inventory. */
-    async resolveTargetParticipantInventory(request, envelope, signal) {
+    async resolveTargetParticipantInventory(meshName, request, envelope, signal) {
         if (!envelope.participants.some((value) => value.rootSpotId !== undefined)) {
             return envelope;
         }
@@ -2752,7 +2920,8 @@ class ZLinkHostServiceRelocationRuntime {
                         (0, authority_key_codec_1.decodeAuthorityKey)(candidate.key).kind !== 'actor')
                         continue;
                     const actor = (0, actor_authority_publication_1.decodeRelocatingActorAuthorityIdentity)(candidate.snapshot.payload, candidate.snapshot.objectGeneration);
-                    if (actor?.spotId === request.object.spotId) {
+                    if (actor?.spotId === request.object.spotId &&
+                        actor.spotGeneration === request.object.objectGeneration) {
                         entries.push(candidate);
                     }
                 }
@@ -2794,20 +2963,17 @@ class ZLinkHostServiceRelocationRuntime {
                 authorityOwnerGeneration: snapshot.authorityOwnerGeneration
             };
         });
-        // Actor-root saved work is admitted against the destination membership.
-        // The canonical root intentionally omits a membership vector; meanwhile
-        // Location Store still names the source Spot until target cutover. Rebuild
-        // the Actor lane from the already accepted ActorJoin admission, preserving
-        // the target queue boundary for decoded saved-work.
+        // Join recovery uses its accepted target membership. Maintenance Actor
+        // roots restore into the target's startup Entry incarnation (§10.1).
         const memberships = request.object.kind === 'actor'
-            ? actorJoinTargetMembership(manager, envelope.aggregateId, participants)
+            ? actorRootTargetMembership(manager, envelope.aggregateId, participants, this.options.localDescriptor?.(meshName))
             : entries
                 .filter((entry) => entry.snapshot.allocation.objectKind === 'actor')
                 .map((entry) => ({
                 actorKey: entry.key.value,
                 spotKey: primaryKey.value,
                 spotObjectGeneration: primary.objectGeneration,
-                membershipEpoch: 1n
+                membershipEpoch: INITIAL_MEMBERSHIP_EPOCH
             }));
         return {
             ...envelope,
@@ -2857,19 +3023,13 @@ class ZLinkHostServiceRelocationRuntime {
     async createRelocationAdapter(adapterType) {
         return (await (0, spot_provider_1.createProviderInstance)(adapterType, this.options.providerResolver));
     }
-    recordRelocationInterruption(meshName, unitKind, executionMode, startedAt, outcome) {
+    recordRelocationInterruption(meshName, unitKind, executionMode, startedAt) {
         const seconds = Math.max(0, performance.now() - startedAt) / runtime_metrics_1.MILLISECONDS_PER_SECOND;
         const attributes = {
             unit_kind: unitKind,
             ...(executionMode === undefined ? {} : { execution_mode: executionMode })
         };
         this.options.metrics?.duration(runtime_metrics_1.METRIC_NAMES.RelocationInterruption, seconds, attributes);
-        this.options.metrics?.count(runtime_metrics_1.METRIC_NAMES.RelocationCompleted, 1, {
-            mesh_name: meshName,
-            object_kind: unitKind,
-            policy: unitKind === 'user_spot' && executionMode === 'per_actor' ? 'recreate' : 'configured',
-            outcome
-        });
         if (seconds <= 1)
             return;
         console.warn(`[zlink.runtime.relocation.changed] ${unitKind} admission interruption ` +
@@ -2912,24 +3072,25 @@ class ZLinkHostServiceRelocationRuntime {
         }
         return result;
     }
-    async commitSpotMessageFollow(meshName, seal, authorityKey, activation, target) {
+    async commitSpotMessageFollow(meshName, seal, committed, activation) {
         const node = this.requireMeshNode(meshName);
         const commit = node.commitSpotMessageFollowIngress;
         if (commit === undefined) {
             throw new Error('Spot Message Follow backend support is incomplete.');
         }
-        const committed = await requireAuthority(this.requireLocationStore(), authorityKey);
-        const accepted = await commit.call(node, seal, {
-            spot: {
-                spotId: String(activation.spotId),
-                generation: committed.objectGeneration
-            },
-            targetNodeRid: String(target.rid),
-            targetNodeGeneration: target.lifecycleGeneration,
-            authorityOwnerGeneration: committed.authorityOwnerGeneration,
-            ownerLeaseGeneration: committed.ownerLeaseGeneration,
-            storeVersion: committed.storeVersion.value
-        }, this.relocationLimits().messageFollowDurationMs);
+        const accepted = await commit.call(node, seal, committed === undefined
+            ? null
+            : {
+                spot: {
+                    spotId: String(activation.spotId),
+                    generation: committed.objectGeneration
+                },
+                targetNodeRid: String(committed.allocation.descriptor.rid),
+                targetNodeGeneration: committed.allocation.descriptorLifecycleGeneration,
+                authorityOwnerGeneration: committed.authorityOwnerGeneration,
+                ownerLeaseGeneration: committed.ownerLeaseGeneration,
+                storeVersion: committed.storeVersion.value
+            }, this.relocationLimits().messageFollowDurationMs);
         if (!accepted) {
             throw new Error(`Spot '${String(activation.spotId)}' Message Follow route became stale.`);
         }
@@ -3002,16 +3163,30 @@ class ZLinkHostServiceRelocationRuntime {
         }
         return await send.call(node, targetNodeRid, record);
     }
-    async requestInfrastructureControl(meshName, targetNodeRid, frames, timeoutMs) {
+    async requestInfrastructureControl(meshName, targetNodeRid, frames, timeoutMs, signal, onSubmitted) {
         const node = this.requireMeshNode(meshName);
         const request = node.requestInfrastructureControlFrames;
         if (request === undefined) {
             throw new Error('RouteMesh backend cannot submit bare infrastructure requests.');
         }
-        return await request.call(node, targetNodeRid, frames, { timeoutMs });
+        return await request.call(node, targetNodeRid, frames, { timeoutMs, signal, onSubmitted });
     }
 }
 exports.ZLinkHostServiceRelocationRuntime = ZLinkHostServiceRelocationRuntime;
+function committedSpotRoute(meshName, spotId, spotKind, targetNodeRid, authority) {
+    return {
+        routerChannelId: meshName,
+        targetNodeRid,
+        spotId,
+        spotKind,
+        targetSpotGeneration: authority?.objectGeneration,
+        targetNodeGeneration: authority?.allocation.descriptorLifecycleGeneration,
+        authorityOwnerGeneration: authority?.authorityOwnerGeneration,
+        targetOwnerId: authority?.ownerId,
+        ownerLeaseGeneration: authority?.ownerLeaseGeneration,
+        authorityStoreVersion: authority?.storeVersion.value
+    };
+}
 function canonicalActorJoinRecovery(participants) {
     const matches = participants.flatMap((participant) => participant.queuedMessages.flatMap((message) => {
         const recovery = (0, actor_join_recovery_codec_1.decodeCanonicalActorJoinRecoverySavedWork)(message.payload);
@@ -3025,11 +3200,24 @@ function canonicalActorJoinRecovery(participants) {
 function actorJoinAdmissionIdentity(envelope) {
     return (canonicalActorJoinRecovery(envelope.participants)?.request.handoffId ?? envelope.aggregateId);
 }
-function actorJoinTargetMembership(manager, relocationId, participants) {
+function actorRootTargetMembership(manager, relocationId, participants, localDescriptor) {
     const recovery = canonicalActorJoinRecovery(participants);
-    const admissionId = recovery?.request.handoffId ?? relocationId;
-    const admission = manager?.formalRemoteActorAdmissions?.get(admissionId);
     const actor = participants.find((value) => value.objectKind === 'actor');
+    if (recovery === undefined) {
+        if (actor === undefined || localDescriptor?.entrySpotId === undefined) {
+            throw new Error(`Actor relocation '${relocationId}' has no target Entry membership.`);
+        }
+        return [
+            {
+                actorKey: actor.key,
+                spotKey: (0, authority_key_codec_1.encodeAuthorityKey)('user_spot', localDescriptor.entrySpotId).value,
+                spotObjectGeneration: localDescriptor.lifecycleGeneration,
+                membershipEpoch: INITIAL_MEMBERSHIP_EPOCH
+            }
+        ];
+    }
+    const admissionId = recovery.request.handoffId;
+    const admission = manager?.formalRemoteActorAdmissions?.get(admissionId);
     if (admission === undefined || actor === undefined) {
         throw new Error(`Actor relocation '${relocationId}' has no accepted target membership.`);
     }
@@ -3054,34 +3242,43 @@ class LocalTargetPort {
     async createHidden(participant, signal) {
         const identity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: participant.key }).globalId;
         if (participant.objectKind === 'actor') {
+            if (participant.timers.length !== 0) {
+                throw new Error('Actor relocation cannot restore a Spot timer.');
+            }
             const membership = this.envelope.memberships.find((value) => value.actorKey === participant.key);
             if (membership === undefined)
                 throw new Error(`Actor '${identity}' relocation membership is missing.`);
-            const spotIdentity = (0, authority_key_codec_1.decodeAuthorityKey)({
-                value: membership.spotKey
-            }).globalId;
-            const localDescriptor = this.options.localDescriptor?.(this.meshName);
-            const nativeEntrySpot = localDescriptor?.entrySpotId === spotIdentity;
-            const actor = await this.requireActorManager().prepareRelocationActor(identity, participant.stableType, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, nativeEntrySpot ? undefined : spotIdentity, membership.spotObjectGeneration, membership.membershipEpoch, signal);
+            const targetMembership = actorMembershipTarget(membership, this.options.localDescriptor?.(this.meshName));
+            const actor = await this.requireActorManager().prepareRelocationActor(identity, participant.stableType, participant.objectGeneration, participant.authorityOwnerGeneration, targetMembership.actorSpotKind === contracts_1.ZLinkSpotKind.Entry
+                ? undefined
+                : targetMembership.actorSpotId, targetMembership.actorSpotGeneration, membership.membershipEpoch, signal);
             return {
                 authorityKey: participant.key,
                 participant,
                 actor,
                 initialized: false,
-                restoredTimers: [],
-                replayResults: [],
                 replayPackets: []
             };
         }
         const registration = this.registration(participant.objectKind, participant.stableType);
-        const activation = await this.requireSpotManager().prepareRelocationSpot(this.meshName, participant.objectKind, participant.stableType, registration.implementation, identity, participant.objectGeneration, participant.authorityOwnerGeneration + 1n, signal);
+        const activation = await this.requireSpotManager().prepareRelocationSpot(this.meshName, participant.objectKind, participant.stableType, registration.implementation, identity, participant.objectGeneration, participant.authorityOwnerGeneration, participant.timers.map((value) => ({
+            name: value.timerId,
+            handlerType: value.handlerType,
+            periodMs: value.intervalMs,
+            overrunPolicy: value.overrunPolicy,
+            maxCatchUpTicks: value.maxCatchUpTicks,
+            stopOnUnhandledException: value.stopOnUnhandledException,
+            startedAtUnixMs: value.startedAtUnixMs,
+            deliveryIndex: value.deliveryIndex,
+            lastScheduledIndex: value.lastScheduledIndex,
+            nextDueAtUnixMs: value.dueAtUnixMs,
+            pendingTicks: value.pendingTicks
+        })), signal);
         return {
             authorityKey: participant.key,
             participant,
             activation,
             initialized: false,
-            restoredTimers: [],
-            replayResults: [],
             replayPackets: []
         };
     }
@@ -3102,17 +3299,14 @@ class LocalTargetPort {
     async restoreMemberships(hidden, memberships) {
         for (const membership of memberships) {
             const actor = hidden.get(membership.actorKey)?.actor;
-            const spotIdentity = (0, authority_key_codec_1.decodeAuthorityKey)({
-                value: membership.spotKey
-            }).globalId;
+            const targetMembership = actorMembershipTarget(membership, this.options.localDescriptor?.(this.meshName));
+            const spotIdentity = targetMembership.actorSpotId;
             const spot = hidden.get(membership.spotKey)?.activation ??
                 this.requireSpotManager().resolveRelocationActivation(this.meshName, spotIdentity);
             if (actor === undefined)
                 throw new Error('Relocation membership Actor staging is missing.');
             const state = this.requireActorManager().getState(actor.context.actorId);
-            const localDescriptor = this.options.localDescriptor?.(this.meshName);
-            const isEntryMembership = localDescriptor?.entrySpotId === spotIdentity;
-            if (isEntryMembership) {
+            if (targetMembership.actorSpotKind === contracts_1.ZLinkSpotKind.Entry) {
                 // Entry Spot identity is published as a Location membership key, but
                 // it is not a User Spot activation in the Actor runtime. The native
                 // restore already received the target MeshNode RID as its Entry
@@ -3121,7 +3315,7 @@ class LocalTargetPort {
                 state.clearJoinedSpot();
             }
             else {
-                state.setJoinedSpot(spotIdentity, spot?.spot, membership.membershipEpoch);
+                state.setJoinedSpot(spotIdentity, spot?.spot, membership.membershipEpoch, membership.spotObjectGeneration);
             }
             spot?.commitActorJoin(actor);
         }
@@ -3213,47 +3407,20 @@ class LocalTargetPort {
         hidden.replayPackets.push(packet);
     }
     async openAdmission(hidden) {
-        if (hidden.actor === undefined)
-            return;
-        this.requireActorManager().publishRelocationActor(hidden.actor.context.actorId);
-        if (hidden.replayPackets.length === 0)
-            return;
-        const state = this.requireActorManager().getState(hidden.actor.context.actorId);
-        if (state === undefined)
-            throw new Error('Relocated Actor state is not staged.');
-        const results = await (0, actor_handoff_1.replayActorHandoffBacklog)(hidden.replayPackets, (parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef) => {
-            if (state.spotId === undefined) {
-                const runtime = this.options.spotNodeRuntime();
-                if (runtime === undefined) {
-                    throw new Error('Relocated Entry Spot Actor dispatch is unavailable.');
-                }
-                return runtime.dispatchEntryActorPacket('remote', hidden.actor.context.actorId, parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef);
-            }
-            return this.requireSpotManager().dispatchRoutedActorPacket('remote', state.spotId, hidden.actor.context.actorId, parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef);
-        });
-        hidden.replayResults.push(...results);
+        if (hidden.actor !== undefined) {
+            this.requireActorManager().publishRelocationActor(hidden.actor.context.actorId);
+            this.requireSpotManager().openActorJoinRelocation(this.meshName, actorJoinAdmissionIdentity(this.envelope), hidden.actor);
+        }
     }
-    async restoreTimer(hidden, timer) {
-        if (hidden.activation === undefined)
-            throw new Error('Actor relocation cannot restore a Spot timer.');
-        hidden.restoredTimers.push(timer);
-        if (hidden.restoredTimers.length !== hidden.participant.timers.length)
+    async normalize(hidden) {
+        if (hidden.actor === undefined || hidden.replayPackets.length === 0)
             return;
-        hidden.activation.timers.restoreRelocation(hidden.restoredTimers.map((value) => ({
-            name: value.timerId,
-            handlerType: value.handlerType,
-            periodMs: value.intervalMs,
-            overrunPolicy: value.overrunPolicy,
-            maxCatchUpTicks: value.maxCatchUpTicks,
-            stopOnUnhandledException: value.stopOnUnhandledException,
-            startedAtUnixMs: value.startedAtUnixMs,
-            deliveryIndex: value.deliveryIndex,
-            lastScheduledIndex: value.lastScheduledIndex,
-            nextDueAtUnixMs: value.dueAtUnixMs,
-            pendingTicks: value.pendingTicks
-        })));
+        if (hidden.replayStart === undefined || hidden.onReplayResult === undefined) {
+            throw new Error('Relocated Actor backlog has no target activation owner.');
+        }
+        this.options.actorTransfer.admitRelocationPrefix(hidden.actor, hidden.participant.objectGeneration, hidden.replayPackets, hidden.replayStart, hidden.onReplayResult);
+        hidden.replayPackets.length = 0;
     }
-    async normalize(_hidden) { }
     async abort(hidden) {
         if (hidden.actor !== undefined) {
             await this.requireActorManager().abortRelocationActor(hidden.actor.context.actorId);
@@ -3311,13 +3478,14 @@ function rewriteAuthorityApplicationRoute(payload, target) {
     }
     return ((0, service_authority_payload_codec_1.rewriteServiceAuthorityRoute)(applicationPayload, target.owner, target) ?? applicationPayload);
 }
-function actorMembershipTarget(envelope, actorKey) {
-    const membership = envelope.memberships.find((value) => value.actorKey === actorKey);
+function actorMembershipTarget(membership, localDescriptor) {
     if (membership === undefined)
         return undefined;
+    const spotId = (0, authority_key_codec_1.decodeAuthorityKey)({ value: membership.spotKey }).globalId;
     return {
-        actorSpotId: (0, authority_key_codec_1.decodeAuthorityKey)({ value: membership.spotKey }).globalId,
-        actorSpotGeneration: membership.spotObjectGeneration
+        actorSpotId: spotId,
+        actorSpotGeneration: membership.spotObjectGeneration,
+        actorSpotKind: spotId === localDescriptor?.entrySpotId ? contracts_1.ZLinkSpotKind.Entry : contracts_1.ZLinkSpotKind.User
     };
 }
 function primaryKey(envelope) {
@@ -3403,6 +3571,19 @@ function decodeQueuedHandoffPacket(message) {
             ...(messageFollowOrigin === undefined ? {} : { messageFollowOrigin })
         }
     ])[0];
+    const requestSource = decoded.source === undefined ? undefined : handoffSourceFence(decoded.source);
+    if (messageFollowOrigin !== undefined &&
+        requestSource !== undefined &&
+        (0, routing_id_1.routingIdsEqual)(messageFollowOrigin.sourceNodeRid, requestSource.nodeRid)) {
+        return {
+            ...decoded,
+            index: index,
+            messageFollowOrigin: {
+                ...messageFollowOrigin,
+                requestSource
+            }
+        };
+    }
     return { ...decoded, index: index };
 }
 /**
@@ -3545,28 +3726,18 @@ function createServiceRelocationId(isInUse, entropy = node_crypto_1.randomBytes)
             return candidate;
     }
 }
-function operationWireId(value) {
-    const match = /^(\d+):(\d+)$/.exec(value);
-    if (match === null)
-        throw new Error(`Actor handoff operation '${value}' is not canonical.`);
-    const result = { high: BigInt(match[1]), low: BigInt(match[2]) };
-    if (result.high === 0n && result.low === 0n) {
-        throw new Error('Actor handoff operation identity must not be zero.');
-    }
-    return result;
-}
 function sameWireId(left, right) {
     return left.high === right.high && left.low === right.low;
 }
 function sameCoordinator(left, right) {
     return (left.ownerId === right.ownerId &&
         BigInt(left.leaseGeneration) === right.leaseGeneration &&
-        left.nodeRid === right.nodeRid &&
+        (0, routing_id_1.routingIdsEqual)(left.nodeRid, right.nodeRid) &&
         BigInt(left.nodeGeneration) === right.nodeGeneration &&
         left.expectedAuthorityStoreVersion === right.expectedAuthorityStoreVersion);
 }
 function sameRelocationTarget(left, right) {
-    return (left.nodeRid === right.nodeRid &&
+    return ((0, routing_id_1.routingIdsEqual)(left.nodeRid, right.nodeRid) &&
         BigInt(left.nodeGeneration) === right.nodeGeneration &&
         left.ownerId === right.ownerId &&
         BigInt(left.ownerLeaseGeneration) === right.ownerLeaseGeneration);
@@ -3600,7 +3771,7 @@ function isSourceOwner(current, expected) {
         current.allocation.state === expected.allocation.state &&
         current.allocation.objectKind === expected.allocation.objectKind &&
         current.allocation.stableType === expected.allocation.stableType &&
-        String(current.allocation.descriptor.rid) === String(expected.allocation.descriptor.rid) &&
+        (0, routing_id_1.routingIdsEqual)(current.allocation.descriptor.rid, expected.allocation.descriptor.rid) &&
         current.allocation.descriptorLifecycleGeneration ===
             expected.allocation.descriptorLifecycleGeneration);
 }
@@ -3609,7 +3780,7 @@ function isExactCommittedTarget(current, expected, target, payload) {
         current.authorityOwnerGeneration > expected.authorityOwnerGeneration &&
         current.ownerId === target.ownerId &&
         current.ownerLeaseGeneration === target.ownerLeaseGeneration &&
-        String(current.allocation.descriptor.rid) === target.nodeRid &&
+        (0, routing_id_1.routingIdsEqual)(current.allocation.descriptor.rid, target.nodeRid) &&
         current.allocation.descriptorLifecycleGeneration === target.nodeGeneration &&
         Buffer.from(current.payload).equals(Buffer.from(payload)));
 }
@@ -3632,40 +3803,52 @@ async function waitForRelocationRetry(delayMs, signal) {
 function sameRequestSource(left, right) {
     return (left.ownerId === right.ownerId &&
         left.leaseGeneration === right.leaseGeneration &&
-        left.nodeRid === right.nodeRid &&
+        (0, routing_id_1.routingIdsEqual)(left.nodeRid, right.nodeRid) &&
         left.nodeGeneration === right.nodeGeneration);
 }
 function handoffSourceFence(value) {
     return {
         ownerId: value.ownerId,
         leaseGeneration: BigInt(value.ownerLeaseGeneration),
-        nodeRid: value.nodeRid,
+        nodeRid: (0, routing_id_1.decodeRoutingId)(value.nodeRid, value.nodeRidHex),
         nodeGeneration: BigInt(value.nodeGeneration)
     };
 }
-function maintenanceReplyRelay(stage, coordinator, participantId, completion) {
+function maintenanceReplyRelay(stage, coordinator, participantId, completion, packet, serializers, flowEnabled) {
     const value = completion.result.ok ? completion.result.response : undefined;
+    const direct = packet.messageFollowOrigin?.requestSource !== undefined;
+    const application = direct && completion.result.ok
+        ? (0, service_wire_m6a_codec_1.decodeApplicationPayloadView)((0, service_wire_m6a_codec_1.encodeMultipartApplicationPayload)((0, actor_reply_1.encodeActorReply)(Buffer.from(packet.header, 'base64'), protocol_1.ZLinkStreamMessageKind.Response, value, serializers, flowEnabled), service_wire_constants_generated_1.SERVICE_FRAMEWORK_MULTIPART_PACKET_NAME, service_wire_constants_generated_1.SERVICE_FRAMEWORK_MULTIPART_CONTENT_TYPE))
+        : undefined;
     return {
         relocation: relocationWireId(stage.staging.envelope.aggregateId),
         targetAttemptGeneration: stage.offer.prepare.targetAttemptGeneration,
         coordinator,
-        operation: operationWireId(completion.operationId),
+        operation: parseHandoffOperationId(completion.operationId),
         replyRouteId: BigInt(completion.source.replyRouteId),
         participantId,
         sequence: BigInt(completion.index + 1),
         terminalResult: completion.result.ok ? runtime_values_1.RequestResult.Ok : runtime_values_1.RequestResult.InternalError,
         failureCode: completion.result.ok
-            ? service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.none
-            : service_wire_constants_generated_1.ServiceWireFrameworkErrorCode.requestFailed,
-        ...(value === undefined
-            ? {}
-            : {
+            ? service_wire_constants_generated_2.ServiceWireFrameworkErrorCode.none
+            : service_wire_constants_generated_2.ServiceWireFrameworkErrorCode.requestFailed,
+        ...(application !== undefined
+            ? {
                 payload: {
-                    packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
-                    contentType: stream_wire_1.ZlinkStreamContentType.Json,
-                    bytes: Buffer.from(JSON.stringify(value), 'utf8')
+                    packetName: application.packetName,
+                    contentType: application.contentType,
+                    bytes: application.payload
                 }
-            })
+            }
+            : value === undefined
+                ? {}
+                : {
+                    payload: {
+                        packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
+                        contentType: stream_wire_1.ZlinkStreamContentType.Json,
+                        bytes: Buffer.from(JSON.stringify(value), 'utf8')
+                    }
+                })
     };
 }
 function handoffResultFromRelay(relay) {
@@ -3697,6 +3880,13 @@ function wireIdText(value) {
 class ServiceRelocationDataLostError extends Error {
 }
 exports.ServiceRelocationDataLostError = ServiceRelocationDataLostError;
+/** The local source lifecycle ended a pending relocation operation. */
+class ServiceRelocationRuntimeStoppedError extends Error {
+    constructor() {
+        super('Relocation runtime stopped.');
+        this.name = 'AbortError';
+    }
+}
 /** Classifies relocation failure with the error model §2.1 mapping. */
 function relocationFailedFailureCode(error) {
     if (error instanceof ServiceRelocationDataLostError) {
@@ -3802,7 +3992,7 @@ function validatePrepareEnvelope(request, envelope) {
 }
 function validateTargetOneWayControl(stage, request, sourceNodeRid) {
     const prepare = stage.offer.prepare;
-    if (String(sourceNodeRid) !== stage.offer.authenticatedSourceNodeRid ||
+    if (!(0, routing_id_1.routingIdsEqual)(sourceNodeRid, stage.offer.authenticatedSourceNodeRid) ||
         !sameWireId(request.relocation, prepare.relocation) ||
         request.targetAttemptGeneration !== prepare.targetAttemptGeneration ||
         !sameCoordinator(request.coordinator, prepare.coordinator) ||
@@ -3859,12 +4049,7 @@ function canonicalQueuedFrozenRecord(participant, message, coordinator, target)
     const identity = (0, authority_key_codec_1.decodeAuthorityKey)({ value: participant.key }).globalId;
     const source = packet.source === undefined
         ? coordinatorSource(coordinator)
-        : {
-            ownerId: packet.source.ownerId,
-            leaseGeneration: BigInt(packet.source.ownerLeaseGeneration),
-            nodeRid: packet.source.nodeRid,
-            nodeGeneration: BigInt(packet.source.nodeGeneration)
-        };
+        : handoffSourceFence(packet.source);
     const operationId = parseHandoffOperationId(packet.messageFollowContext.operationId);
     if (packet.returnResponse && packet.source === undefined) {
         throw new Error('Captured Actor request has no exact request-source fence.');
@@ -3884,7 +4069,7 @@ function canonicalQueuedFrozenRecord(participant, message, coordinator, target)
             objectGeneration: participant.objectGeneration,
             nodeRid: target.nodeRid,
             nodeGeneration: target.nodeGeneration,
-            authorityOwnerGeneration: participant.authorityOwnerGeneration + 1n,
+            authorityOwnerGeneration: participant.authorityOwnerGeneration,
             ownerLeaseGeneration: target.ownerLeaseGeneration
         },
         operationId,
@@ -3967,43 +4152,40 @@ function sessionRelocationPendingKey(request) {
     return sessionRelocationIdentityKey(request);
 }
 function sessionRelocationRouteSubmitKey(request, targetNodeRid) {
-    return `${sessionRelocationIdentityKey(request)}:${String(targetNodeRid)}`;
+    return `${sessionRelocationIdentityKey(request)}:${(0, routing_id_1.encodeRoutingIdStorageHex)(targetNodeRid)}`;
 }
 function sessionRelocationResponseKey(response) {
     return sessionRelocationIdentityKey(response);
 }
-function sessionRelocationResponseFingerprint(response) {
-    return (0, service_stateful_wire_codec_1.encodeSessionRelocationSealed)(response).toString('base64');
-}
 function sessionRelocationIdentityKey(value) {
     return `session-relocation:${(0, service_stateful_wire_codec_1.serviceSessionRelocationIdentityKey)(value)}:sealed`;
 }
 function validateSessionRelocationResponse(request, response) {
     const sameCoordinator = request.coordinator.ownerId === response.coordinator.ownerId &&
         request.coordinator.leaseGeneration === response.coordinator.leaseGeneration &&
-        request.coordinator.nodeRid === response.coordinator.nodeRid &&
+        (0, routing_id_1.routingIdsEqual)(request.coordinator.nodeRid, response.coordinator.nodeRid) &&
         request.coordinator.nodeGeneration === response.coordinator.nodeGeneration &&
         request.coordinator.expectedAuthorityStoreVersion ===
             response.coordinator.expectedAuthorityStoreVersion;
-    const sameSession = request.session.sessionOwnerNodeRid === response.session.sessionOwnerNodeRid &&
+    const sameSession = (0, routing_id_1.routingIdsEqual)(request.session.sessionOwnerNodeRid, response.session.sessionOwnerNodeRid) &&
         request.session.sessionOwnerNodeGeneration === response.session.sessionOwnerNodeGeneration &&
         request.session.sessionOwnerId === response.session.sessionOwnerId &&
         request.session.sessionOwnerLeaseGeneration === response.session.sessionOwnerLeaseGeneration &&
-        request.session.sessionRid === response.session.sessionRid &&
+        (0, routing_id_1.routingIdsEqual)(request.session.sessionRid, response.session.sessionRid) &&
         request.session.bindingGeneration === response.session.bindingGeneration;
     if (request.relocation.high !== response.relocation.high ||
         request.relocation.low !== response.relocation.low ||
         !sameCoordinator ||
         !sameSession) {
-        throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Session relocation ACK changed its exact fence.');
+        throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Session relocation ACK changed its exact fence.');
     }
     if (request.actor.actor.actorId !== response.actor.actor.actorId ||
         request.actor.actor.generation !== response.actor.actor.generation ||
-        request.actor.actor.nodeRid !== response.actor.actor.nodeRid ||
+        !(0, routing_id_1.routingIdsEqual)(request.actor.actor.nodeRid, response.actor.actor.nodeRid) ||
         request.actor.targetNodeGeneration !== response.actor.targetNodeGeneration ||
         request.actor.authorityOwnerGeneration !== response.actor.authorityOwnerGeneration ||
         request.actor.ownerLeaseGeneration !== response.actor.ownerLeaseGeneration) {
-        throw new service_wire_m6a_codec_1.ServiceWireProtocolError('Command 43 ACK does not echo command 42.');
+        throw new service_wire_m6a_codec_2.ServiceWireProtocolError('Command 43 ACK does not echo command 42.');
     }
 }
 function replyRelayIdentityKey(value) {
@@ -4015,20 +4197,16 @@ function replyRelayIdentityKey(value) {
         value.relocation.low.toString(),
         value.coordinator.ownerId,
         value.coordinator.leaseGeneration.toString(),
-        value.coordinator.nodeRid,
+        (0, routing_id_1.encodeRoutingIdStorageHex)(value.coordinator.nodeRid),
         value.coordinator.nodeGeneration.toString(),
         value.coordinator.expectedAuthorityStoreVersion
     ]);
 }
 function replyRelayPendingKey(ackTargetNodeRid, value) {
-    return JSON.stringify([ackTargetNodeRid, replyRelayIdentityKey(value)]);
-}
-function isServiceWireCommand(payload, command) {
-    return (payload.byteLength >= 5 &&
-        payload[0] === 0x5a &&
-        payload[1] === 0x4d &&
-        payload[2] === 1 &&
-        payload[3] === command);
+    return JSON.stringify([
+        (0, routing_id_1.encodeRoutingIdStorageHex)(ackTargetNodeRid),
+        replyRelayIdentityKey(value)
+    ]);
 }
 function encodeHandoffQueuedMessages(backlog) {
     return backlog.map((packet) => ({
@@ -4102,83 +4280,50 @@ function toServiceTimer(value) {
         pendingTicks: value.pendingTicks
     };
 }
-const PREPARE_SIDEBAND_MAGIC = 'ZLNI';
-const PREPARE_SIDEBAND_VERSION = 1;
-const PREPARE_SIDEBAND_HEADER_BYTES = 11;
-const PREPARE_SIDEBAND_VERSION_OFFSET = 4;
-const PREPARE_SIDEBAND_KEY_LENGTH_OFFSET = 5;
-const PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET = 7;
 const ACTOR_SESSION_JOURNAL_VERSION = 1;
 const SERVICE_RELOCATION_REPLY_PACKET_NAME = 'zlink.relocation.reply';
-/**
- * NODE-INTERNAL Prepare sideband. Frame zero remains the exact canonical
- * command-40 schema record; each following ZLNI frame carries one sealed
- * actor-session journal keyed by its canonical participant authority key.
- * Sessionless relocation remains a single-frame, wire-identical Prepare.
- */
-function encodePrepareSideband(envelope) {
-    return envelope.participants
-        .filter((participant) => participant.boundSessionState.byteLength !== 0)
-        .map((participant) => {
-        const key = Buffer.from(participant.key, 'utf8');
-        const payload = Buffer.from(participant.boundSessionState);
-        if (key.byteLength === 0 || key.byteLength > 0xffff || payload.byteLength > 0xffff_ffff) {
-            throw new TypeError('Bound-session relocation sideband is out of bounds.');
-        }
-        const header = Buffer.allocUnsafe(PREPARE_SIDEBAND_HEADER_BYTES);
-        header.write(PREPARE_SIDEBAND_MAGIC, 0, 'ascii');
-        header[PREPARE_SIDEBAND_VERSION_OFFSET] = PREPARE_SIDEBAND_VERSION;
-        header.writeUInt16BE(key.byteLength, PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
-        header.writeUInt32BE(payload.byteLength, PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
-        return Buffer.concat([header, key, payload]);
-    });
-}
-function decodePrepareSideband(frames) {
-    const result = [];
-    const keys = new Set();
-    for (const frame of frames) {
-        const bytes = Buffer.from(frame);
-        if (bytes.byteLength < PREPARE_SIDEBAND_HEADER_BYTES ||
-            bytes.subarray(0, PREPARE_SIDEBAND_VERSION_OFFSET).toString('ascii') !==
-                PREPARE_SIDEBAND_MAGIC ||
-            bytes[PREPARE_SIDEBAND_VERSION_OFFSET] !== PREPARE_SIDEBAND_VERSION) {
-            return undefined;
-        }
-        const keyLength = bytes.readUInt16BE(PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
-        const payloadLength = bytes.readUInt32BE(PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
-        if (PREPARE_SIDEBAND_HEADER_BYTES + keyLength + payloadLength !== bytes.byteLength ||
-            keyLength === 0)
-            return undefined;
-        const participantKey = bytes
-            .subarray(PREPARE_SIDEBAND_HEADER_BYTES, PREPARE_SIDEBAND_HEADER_BYTES + keyLength)
-            .toString('utf8');
-        if (keys.has(participantKey))
-            return undefined;
-        keys.add(participantKey);
-        result.push({
-            participantKey,
-            payload: Buffer.from(bytes.subarray(PREPARE_SIDEBAND_HEADER_BYTES + keyLength))
-        });
-    }
-    return result;
-}
-function attachPrepareBoundSessions(envelope, sideband) {
-    if (sideband === undefined || sideband.length === 0)
-        return envelope;
-    const byKey = new Map(sideband.map((value) => [value.participantKey, Buffer.from(value.payload)]));
-    const participants = envelope.participants.map((participant) => {
-        const payload = byKey.get(participant.key);
-        if (payload === undefined)
-            return participant;
-        if (participant.objectKind !== 'actor') {
-            throw new TypeError('Bound-session relocation sideband names a non-Actor participant.');
-        }
-        byKey.delete(participant.key);
-        return { ...participant, boundSessionState: payload };
-    });
-    if (byKey.size !== 0)
-        throw new TypeError('Bound-session relocation sideband names an unknown participant.');
-    return { ...envelope, participants };
+function attachCanonicalBoundSessions(envelope, request, meshName) {
+    return {
+        ...envelope,
+        participants: envelope.participants.map((participant) => {
+            const binding = participant.sessionBinding;
+            if (binding === undefined)
+                return participant;
+            if (participant.objectKind !== 'actor')
+                throw new TypeError('Session binding names a non-Actor participant.');
+            const sessionNodeRid = (0, routing_id_1.decodeRoutingId)('', Buffer.from(binding.sessionOwnerNodeRid).toString('hex'));
+            const sessionRid = (0, routing_id_1.decodeRoutingId)('', Buffer.from(binding.sessionRid).toString('hex'));
+            const session = {
+                sessionOwnerNodeRid: sessionNodeRid,
+                sessionOwnerNodeGeneration: binding.sessionOwnerNodeGeneration,
+                sessionOwnerId: binding.sessionOwnerId,
+                sessionOwnerLeaseGeneration: binding.sessionOwnerLeaseGeneration,
+                sessionRid: sessionRid,
+                bindingGeneration: binding.bindingGeneration
+            };
+            const target = {
+                routerChannelId: meshName,
+                targetNodeRid: sessionNodeRid,
+                spotId: request.object.kind === 'actor'
+                    ? (participant.rootSpotId ?? '')
+                    : request.object.spotId,
+                sessionNodeRid,
+                sessionRid,
+                sessionOwnerNodeGeneration: binding.sessionOwnerNodeGeneration,
+                sessionOwnerId: binding.sessionOwnerId,
+                sessionOwnerLeaseGeneration: binding.sessionOwnerLeaseGeneration,
+                bindingGeneration: binding.bindingGeneration,
+                previousAuthorityOwnerGeneration: participant.authorityOwnerGeneration,
+                relocationSealId: envelope.aggregateId,
+                serviceWireRelocation: {
+                    relocation: request.relocation,
+                    coordinator: request.coordinator,
+                    session
+                }
+            };
+            return { ...participant, boundSessionState: encodeActorSession(target) };
+        })
+    };
 }
 function encodeActorSession(target) {
     if (target === undefined)
@@ -4187,9 +4332,14 @@ function encodeActorSession(target) {
         version: ACTOR_SESSION_JOURNAL_VERSION,
         routerChannelId: target.routerChannelId,
         targetNodeRid: String(target.targetNodeRid),
+        targetNodeRidHex: (0, routing_id_1.encodeRoutingIdStorageHex)(target.targetNodeRid),
         spotId: String(target.spotId),
         sessionNodeRid: target.sessionNodeRid === undefined ? undefined : String(target.sessionNodeRid),
+        sessionNodeRidHex: target.sessionNodeRid === undefined
+            ? undefined
+            : (0, routing_id_1.encodeRoutingIdStorageHex)(target.sessionNodeRid),
         sessionRid: target.sessionRid === undefined ? undefined : String(target.sessionRid),
+        sessionRidHex: target.sessionRid === undefined ? undefined : (0, routing_id_1.encodeRoutingIdStorageHex)(target.sessionRid),
         sessionOwnerNodeGeneration: target.sessionOwnerNodeGeneration?.toString(),
         sessionOwnerId: target.sessionOwnerId,
         sessionOwnerLeaseGeneration: target.sessionOwnerLeaseGeneration?.toString(),
@@ -4204,14 +4354,17 @@ function encodeActorSession(target) {
                 relocationLow: target.serviceWireRelocation.relocation.low.toString(),
                 coordinatorOwnerId: target.serviceWireRelocation.coordinator.ownerId,
                 coordinatorLeaseGeneration: target.serviceWireRelocation.coordinator.leaseGeneration.toString(),
-                coordinatorNodeRid: target.serviceWireRelocation.coordinator.nodeRid,
+                coordinatorNodeRid: String(target.serviceWireRelocation.coordinator.nodeRid),
+                coordinatorNodeRidHex: (0, routing_id_1.encodeRoutingIdStorageHex)(target.serviceWireRelocation.coordinator.nodeRid),
                 coordinatorNodeGeneration: target.serviceWireRelocation.coordinator.nodeGeneration.toString(),
                 expectedAuthorityStoreVersion: target.serviceWireRelocation.coordinator.expectedAuthorityStoreVersion,
-                sessionOwnerNodeRid: target.serviceWireRelocation.session.sessionOwnerNodeRid,
+                sessionOwnerNodeRid: String(target.serviceWireRelocation.session.sessionOwnerNodeRid),
+                sessionOwnerNodeRidHex: (0, routing_id_1.encodeRoutingIdStorageHex)(target.serviceWireRelocation.session.sessionOwnerNodeRid),
                 sessionOwnerNodeGeneration: target.serviceWireRelocation.session.sessionOwnerNodeGeneration.toString(),
                 sessionOwnerId: target.serviceWireRelocation.session.sessionOwnerId,
                 sessionOwnerLeaseGeneration: target.serviceWireRelocation.session.sessionOwnerLeaseGeneration.toString(),
-                sessionRid: target.serviceWireRelocation.session.sessionRid,
+                sessionRid: String(target.serviceWireRelocation.session.sessionRid),
+                sessionRidHex: (0, routing_id_1.encodeRoutingIdStorageHex)(target.serviceWireRelocation.session.sessionRid),
                 bindingGeneration: target.serviceWireRelocation.session.bindingGeneration.toString()
             }
     }), 'utf8');
@@ -4230,12 +4383,14 @@ function decodeActorSession(payload) {
     const serviceWire = decodeActorSessionServiceWireFence(value.serviceWireRelocation);
     return {
         routerChannelId: value.routerChannelId,
-        targetNodeRid: value.targetNodeRid,
+        targetNodeRid: (0, routing_id_1.decodeRoutingId)(value.targetNodeRid, value.targetNodeRidHex),
         spotId: value.spotId,
         ...(typeof value.sessionNodeRid === 'string'
-            ? { sessionNodeRid: value.sessionNodeRid }
+            ? { sessionNodeRid: (0, routing_id_1.decodeRoutingId)(value.sessionNodeRid, value.sessionNodeRidHex) }
+            : {}),
+        ...(typeof value.sessionRid === 'string'
+            ? { sessionRid: (0, routing_id_1.decodeRoutingId)(value.sessionRid, value.sessionRidHex) }
             : {}),
-        ...(typeof value.sessionRid === 'string' ? { sessionRid: value.sessionRid } : {}),
         ...(optionalBigInt('sessionOwnerNodeGeneration') === undefined
             ? {}
             : { sessionOwnerNodeGeneration: optionalBigInt('sessionOwnerNodeGeneration') }),
@@ -4297,16 +4452,16 @@ function decodeActorSessionServiceWireFence(input) {
         coordinator: {
             ownerId: text('coordinatorOwnerId'),
             leaseGeneration: positive('coordinatorLeaseGeneration'),
-            nodeRid: text('coordinatorNodeRid'),
+            nodeRid: (0, routing_id_1.decodeRoutingId)(text('coordinatorNodeRid'), value.coordinatorNodeRidHex),
             nodeGeneration: positive('coordinatorNodeGeneration'),
             expectedAuthorityStoreVersion: text('expectedAuthorityStoreVersion')
         },
         session: {
-            sessionOwnerNodeRid: text('sessionOwnerNodeRid'),
+            sessionOwnerNodeRid: (0, routing_id_1.decodeRoutingId)(typeof value.sessionOwnerNodeRid === 'string' ? value.sessionOwnerNodeRid : '', value.sessionOwnerNodeRidHex),
             sessionOwnerNodeGeneration: positive('sessionOwnerNodeGeneration'),
             sessionOwnerId: text('sessionOwnerId'),
             sessionOwnerLeaseGeneration: positive('sessionOwnerLeaseGeneration'),
-            sessionRid: text('sessionRid'),
+            sessionRid: (0, routing_id_1.decodeRoutingId)(typeof value.sessionRid === 'string' ? value.sessionRid : '', value.sessionRidHex),
             bindingGeneration: positive('bindingGeneration')
         }
     };