@zlink-systems/framework 0.30.0 → 0.30.2

package/src/runtime/host/service-relocation-host-runtime.ts

@@ -1,3 +1,15 @@
+import { encodeActorReply } from '../actors/actor-reply';
+import { ZLinkStreamMessageKind } from '../streams/protocol';
+import {
+  decodeApplicationPayloadView,
+  encodeMultipartApplicationPayload
+} from '../foundation/service-wire-m6a-codec';
+import {
+  SERVICE_FRAMEWORK_MULTIPART_PACKET_NAME,
+  SERVICE_FRAMEWORK_MULTIPART_CONTENT_TYPE
+} from '../foundation/service-wire-constants.generated';
+import { OperationTimeoutError } from '../foundation/operation-registry';
+import { durableRequestCanReplay } from '../foundation/durable-service-request';
 import { UINT64_MAX, ZlinkStreamContentType } from '@zlink-systems/stream-wire';
 import { randomBytes } from 'node:crypto';
 import {
@@ -18,6 +30,12 @@ import {
   ZLinkSpotRelocationReadyOutcome,
   ZLinkUserSpotExecutionMode
 } from '../../contracts';
+import {
+  ZLinkDispatchErrorSurface,
+  ZLinkDispatchMessageKind,
+  ZLinkRuntimeDispatchErrorAction as ZLinkDispatchErrorAction,
+  ZLinkRuntimeMessageFlowOutcome as ZLinkMessageFlowOutcome
+} from '../../contracts/Dispatch/ZLinkDispatchOptions';
 
 import type { ZLinkProviderResolver } from '../../contracts/Common/ZLinkProviderResolver';
 import { zlinkRuntimeDefaultLocationOptions } from '../../contracts/Locations/Options';
@@ -29,7 +47,6 @@ import {
   rewriteActorAuthorityRoute
 } from '../actors/actor-authority-publication';
 import {
-  replayActorHandoffBacklog,
   type ZLinkActorHandoffPacket,
   type ZLinkActorHandoffResult
 } from '../actors/actor-handoff';
@@ -44,16 +61,23 @@ import {
   type ZLinkRemoteBoundSessionTarget
 } from '../actors/actor-runtime-state';
 import type { ZLinkBackendMeshNode, ZLinkMeshCompletionTable } from '../backend';
-import { RequestResult, SubmitResult } from '../backend/runtime-values';
+import { RequestResult, SubmitResult, ZLinkBackendResultError } from '../backend/runtime-values';
 import type { ZLinkFrameworkRegistration } from '../configuration';
 import {
   type ZLinkRuntimeEventPublisher,
+  type ZLinkRelocationMetricOperation,
   type ZLinkRuntimeMetrics,
   isRelocationDebugEnabled,
   relocationDebug
 } from '../diagnostics';
 
 import { METRIC_NAMES, MILLISECONDS_PER_SECOND } from '../diagnostics/runtime-metrics';
+import {
+  traceSessionBindingControlDrop,
+  flowIfEnabled,
+  type ZLinkMessageFlowTracer
+} from '../diagnostics/message-flow';
+import { dispatchErrorDetails } from '../diagnostics/dispatch-error-details';
 import { isStructuralGuardEnabled, trackDiagnosticCompletion } from '../execution/state-lane';
 import {
   RECREATE_RELOCATION_CONTENT_TYPE,
@@ -159,8 +183,9 @@ import type {
 } from '../locations/internal-location-contracts';
 import type { ZLinkTrackedInstanceAuthority } from '../locations/spot-location-claims';
 import { decodeRoutingId, encodeRoutingIdStorageHex, routingIdsEqual } from '../routing-id';
-import type { DefaultZLinkSpotManager, ZLinkSpotNodeRuntimeManager } from '../spots';
+import type { DefaultZLinkSpotManager } from '../spots';
 import type { ZLinkSpotActivation } from '../spots/spot-activation-state';
+import type { ZLinkSpotRouteTarget } from '../spots/spot-routing-internal';
 import { createProviderInstance } from '../spots/spot-provider';
 import { decodeHandoffBacklog } from '../spots/spot-remote-codec';
 import { committedActorOwnerFence, type ZLinkActorTransferRuntime } from './actor-transfer-runtime';
@@ -184,13 +209,13 @@ import {
 } from './relocation-state-adapter';
 import {
   decodeServiceRelocationControlRequest,
+  serviceRelocationControlCommand,
   decodeServiceRelocationControlResponse,
   encodeServiceRelocationControlRequest,
   encodeServiceRelocationControlResponse,
   type ZLinkServiceRelocationControlRequest,
   type ZLinkServiceRelocationControlResponse
 } from './service-relocation-control';
-const RELOCATION_ATTEMPT_TIMEOUT_MS = 250;
 
 const RELOCATION_AUTHORITY_RETRY_DELAY_MS = 25;
 
@@ -215,13 +240,18 @@ const RELOCATION_PARTICIPANT_STATE_LIMIT_BYTES = 64 * 1024 * 1024;
 const RELOCATION_TARGET_TOMBSTONE_LIMIT = 1024;
 const RELOCATION_OPERATION_RETENTION_MS = 5 * 60_000;
 const SERVICE_CONTROL_TERMINAL_CAPACITY = 4096;
+const INITIAL_MEMBERSHIP_EPOCH = 1n;
 
 interface ZLinkHostRelocationOptions {
+  readonly flowCreationEnabled?: () => boolean;
+  readonly messageFlow?: () => ZLinkMessageFlowTracer | undefined;
   readonly registration: ZLinkFrameworkRegistration;
   readonly providerResolver?: ZLinkProviderResolver;
   readonly locationStore: () => ZLinkLocationStore | undefined;
   readonly currentOwner: () => ZLinkLocationOwnerToken | undefined;
   readonly targetAdmissionSealed?: () => boolean;
+  readonly requestPeerReconcile?: (meshName: string, peerRid: string) => Promise<void>;
+  readonly sourceQuiescenceChanged?: () => void;
   readonly liveDescriptors: (
     meshName: string,
     signal?: AbortSignal
@@ -230,16 +260,16 @@ interface ZLinkHostRelocationOptions {
   readonly meshNode: (meshName: string) => ZLinkBackendMeshNode | undefined;
   readonly completions: (meshName: string) => ZLinkMeshCompletionTable | undefined;
   readonly spotManager: () => DefaultZLinkSpotManager | undefined;
-  readonly spotNodeRuntime: () => ZLinkSpotNodeRuntimeManager | undefined;
   readonly actorManager: () => DefaultZLinkActorManager | undefined;
   readonly actorTransfer: ZLinkActorTransferRuntime;
   readonly boundSessionRelocation?: {
     receiveSeal(
       value: ServiceSessionRelocationSeal,
-      signal?: AbortSignal
-    ): Promise<ServiceSessionRelocationSealed>;
+      signal?: AbortSignal,
+      onInstalled?: () => void
+    ): Promise<ServiceSessionRelocationSealed | undefined>;
     receiveRoute(value: ServiceSessionRelocationRoute): Promise<void>;
-    clear?(): void;
+    clear?(): void | Promise<void>;
   };
   readonly trackInstanceSpot?: (input: ZLinkTrackedInstanceAuthority) => void;
   readonly invalidateActorRoute?: (actorId: string) => void;
@@ -261,8 +291,11 @@ interface LocalHidden extends ServiceRelocationHiddenObject {
   readonly actor?: ZLinkActor;
   readonly activation?: ZLinkSpotActivation;
   initialized: boolean;
-  readonly restoredTimers: ServiceRelocationTimer[];
-  readonly replayResults: ZLinkActorHandoffResult[];
+  replayStart?: Promise<void>;
+  onReplayResult?: (
+    packet: ZLinkActorHandoffPacket,
+    result: ZLinkActorHandoffResult
+  ) => Promise<void>;
   readonly replayPackets: ZLinkActorHandoffPacket[];
   targetAuthorityOwnerGeneration?: bigint;
 }
@@ -280,6 +313,7 @@ interface LocalStage {
   finalize?: Promise<void>;
   /** The Restore's activation admission (MeshNode §5.1); held until target commit or abort. */
   readonly releaseActivation: () => void;
+  readonly releaseJoinAdmission: () => void;
 }
 
 interface TargetPayloadAssembly {
@@ -289,13 +323,19 @@ interface TargetPayloadAssembly {
   readonly assembly: ZLinkRelocationPayloadAssembly;
 }
 
+/** One authority read decides commit and the snapshots eligible for Follow. */
+type SourceAuthorityCommit = {
+  readonly kind: 'target';
+  readonly followAuthorities: ReadonlyMap<string, ZLinkAuthoritySnapshot>;
+};
+
 interface SourceCutoverWindow {
   readonly meshName: string;
   readonly targetNodeRid: RoutingId;
   /** Boundary batch frames plus the cutover frame, retained until authority settlement. */
   frames?: readonly Buffer[];
-  /** A failed submit or a lost target connection requires the whole batch again. */
-  resendPending: boolean;
+  /** The ready route used to submit the retained batch. */
+  submittedRouteGeneration?: bigint;
   readonly cutoverSubmittedAtMs: number;
   followTimer?: ReturnType<typeof setTimeout>;
   windowClosed: boolean;
@@ -339,12 +379,14 @@ interface SourceActorJoinProfile {
   readonly canonicalRecovery?: NonNullable<
     Parameters<ZLinkActorJoinRelocation['relocateActorJoin']>[0]['canonicalRecovery']
   >;
+  readonly relayReady: () => void;
   readonly ready: Promise<void>;
   readonly resolveReady: (failure?: ServiceRelocationPostCommitError) => void;
+  retirement?: Promise<void>;
 }
 
 interface PendingRelocationReplyRelay {
-  readonly ackTargetNodeRid: string;
+  readonly ackTargetNodeRid: RoutingId;
   readonly identityKey: string;
   readonly request: ServiceMaintenanceReplyRelay;
   readonly expectedRequestSource: ServiceWireRequestSourceFence;
@@ -366,9 +408,8 @@ interface PendingSessionRelocation {
 
 interface TerminalSessionRelocationControl {
   readonly targetNodeRid: string;
-  readonly request: ServiceSessionRelocationSeal;
   readonly requestFingerprint: string;
-  readonly responseFingerprint: string;
+  readonly response: ServiceSessionRelocationSealed;
 }
 
 /** Production host bridge from Retire inventory to remote RouteMesh owners. */
@@ -377,7 +418,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   private readonly terminalTargets = new BoundedReplayMap<string, string>(
     RELOCATION_TARGET_TOMBSTONE_LIMIT
   );
-  private readonly relocationAuthorityKeys = new Map<string, string>();
   private readonly targetPrepareOperations = new Map<string, TargetPrepareOperation>();
   private readonly pendingReplyRelays = new Map<string, PendingRelocationReplyRelay>();
   private readonly pendingSessionRelocations = new Map<string, PendingSessionRelocation>();
@@ -428,6 +468,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
    * checksum integrity failure — it must not be reported as DataLost(35).
    */
   private disposed = false;
+  private readonly targetPreparationStop = new AbortController();
 
   constructor(private readonly options: ZLinkHostRelocationOptions) {}
 
@@ -463,6 +504,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         else reject(failure.cause);
       };
     });
+    let acceptRelay!: () => void;
+    const relayReady = new Promise<void>((resolve) => {
+      acceptRelay = resolve;
+    });
     this.sourceActorJoinProfiles.set(input.relocationId, {
       actor: input.actor,
       state: input.state,
@@ -477,42 +522,53 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           : RECREATE_RELOCATION_CONTENT_TYPE,
       completionOperationId: input.completionOperationId,
       canonicalRecovery: input.canonicalRecovery,
+      relayReady: acceptRelay,
       ready,
       resolveReady
     });
     const membershipEpoch =
       input.state.spotMembershipEpoch > 0n ? input.state.spotMembershipEpoch : 1n;
     const spotGeneration = input.target.targetSpotGeneration ?? target.lifecycleGeneration;
-    try {
-      await this.relocateStandaloneActor(
-        input.meshName,
-        input.state,
-        target,
-        target.applicationVersion,
-        input.signal,
-        {
-          spotId: input.target.spotId,
-          spotKind:
-            input.target.spotKind === ZLinkSpotKind.Entry
-              ? ZLinkSpotKind.Entry
-              : ZLinkSpotKind.User,
-          spotObjectGeneration: spotGeneration
-        },
-        input.relocationId,
-        true,
-        input.advertisedReceiveChunkLimitBytes
-      );
-      resolveReady();
-    } catch (error) {
-      if (error instanceof ServiceRelocationPostCommitError) {
-        resolveReady(error);
-        this.completeActorJoinSourceCleanup(input.state.actorId);
-      } else {
-        this.sourceActorJoinProfiles.delete(input.relocationId);
-        throw error;
+    const cleanup = (async () => {
+      try {
+        await this.relocateStandaloneActor(
+          input.meshName,
+          input.state,
+          target,
+          target.applicationVersion,
+          input.signal,
+          {
+            ...input.target,
+            spotKind:
+              input.target.spotKind === ZLinkSpotKind.Entry
+                ? ZLinkSpotKind.Entry
+                : ZLinkSpotKind.User,
+            spotObjectGeneration: spotGeneration
+          },
+          input.relocationId,
+          true,
+          input.advertisedReceiveChunkLimitBytes,
+          input.deadlineAtMs
+        );
+        resolveReady();
+      } catch (error) {
+        if (error instanceof ServiceRelocationPostCommitError) {
+          resolveReady(error);
+          this.completeActorJoinSourceCleanup(input.state.actorId);
+        } else {
+          this.sourceActorJoinProfiles.delete(input.relocationId);
+          resolveReady();
+          throw error;
+        }
       }
-    }
+    })();
+    const settledCleanup = Promise.allSettled([cleanup]);
+    await Promise.race([relayReady, cleanup]);
     return {
+      sourceCleanup: async () => {
+        const [outcome] = await settledCleanup;
+        if (outcome.status === 'rejected') throw outcome.reason;
+      },
       actorRef: {
         actorId: sourceRef.actorId,
         generation: sourceRef.generation,
@@ -542,9 +598,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     for (const window of this.sourceCutoverWindows.values()) {
       if (window.followTimer !== undefined) clearTimeout(window.followTimer);
     }
+    const hadSourceWindows = this.sourceCutoverWindows.size !== 0;
     this.sourceCutoverWindows.clear();
-    const stopped = new Error('Relocation runtime stopped.');
-    stopped.name = 'AbortError';
+    if (hadSourceWindows) this.options.sourceQuiescenceChanged?.();
+    const stopped = new ServiceRelocationRuntimeStoppedError();
     this.targetPrepareOperations.clear();
     for (const pending of this.pendingReplyRelays.values()) {
       if (pending.timer !== undefined) clearTimeout(pending.timer);
@@ -559,16 +616,27 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     this.pendingSessionRelocations.clear();
     this.terminalSessionRelocations.clear();
     this.failedSessionRouteSubmits.clear();
-    this.sourceActorJoinProfiles.clear();
+    await this.drainActorJoinSources();
     this.terminalActorJoinSourceLeaves.clear();
-    this.options.boundSessionRelocation?.clear?.();
-    this.relocationAuthorityKeys.clear();
+    await this.options.boundSessionRelocation?.clear?.();
     if (errors.length === 1) throw errors[0];
     if (errors.length > 1) throw new AggregateError(errors, 'Relocation runtime stop failed.');
   }
 
   /** Host shutdown waits for the existing attempt terminal before releasing its lease. */
   async drainTargetAttempts(): Promise<void> {
+    this.targetPreparationStop.abort(
+      new ZLinkFrameworkException(
+        ZLinkFrameworkErrorKind.ShuttingDown,
+        'Relocation target is shutting down.'
+      )
+    );
+    for (const pending of this.targetAssemblies.values()) {
+      pending.assembly.fail('Relocation target is shutting down.');
+    }
+    await Promise.allSettled(
+      [...this.targetPrepareOperations.values()].map((value) => value.promise)
+    );
     const results = await Promise.allSettled(
       [...this.targetStages.entries()].map(([stagingId, stage]) => {
         if (stage.fallback !== undefined) clearTimeout(stage.fallback);
@@ -596,27 +664,58 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
 
   /** Spec 28 §4.4: the target owner alone orders shutdown seal and verified cutover. */
   private targetStageSealed(stage: LocalStage): boolean {
-    return (
-      !stage.cutoverReceived && (this.disposed || this.options.targetAdmissionSealed?.() === true)
-    );
+    return !stage.cutoverReceived && this.targetAdmissionSealed();
+  }
+
+  /** The Shutdown admission seal: closed once the target owner starts shutdown. */
+  private targetAdmissionSealed(): boolean {
+    return this.disposed || this.options.targetAdmissionSealed?.() === true;
   }
 
   completeActorJoinSourceCleanup(actorId: string): void {
     for (const [relocationId, profile] of this.sourceActorJoinProfiles) {
       if (profile.state.actorId !== actorId) continue;
-      this.sourceActorJoinProfiles.delete(relocationId);
-      this.terminalActorJoinSourceLeaves.remember(relocationId, actorId);
-      void this.finalizeActorJoinSource(profile);
+      void this.retireActorJoinSource(relocationId, profile);
     }
   }
 
-  private async finalizeActorJoinSource(profile: SourceActorJoinProfile): Promise<void> {
+  /** Drains the exact source scopes before their Spot lifecycle owners stop. */
+  async drainActorJoinSources(meshName?: string): Promise<void> {
+    await Promise.all(
+      [...this.sourceActorJoinProfiles].map(([relocationId, profile]) =>
+        meshName === undefined || profile.state.meshName === meshName
+          ? this.retireActorJoinSource(relocationId, profile)
+          : undefined
+      )
+    );
+  }
+
+  private retireActorJoinSource(
+    relocationId: string,
+    profile: SourceActorJoinProfile
+  ): Promise<void> {
+    return (profile.retirement ??= this.finalizeActorJoinSource(profile, relocationId).finally(
+      () => {
+        if (this.sourceActorJoinProfiles.get(relocationId) === profile) {
+          this.sourceActorJoinProfiles.delete(relocationId);
+          this.terminalActorJoinSourceLeaves.remember(relocationId, profile.state.actorId);
+        }
+      }
+    ));
+  }
+
+  private async finalizeActorJoinSource(
+    profile: SourceActorJoinProfile,
+    relocationId: string
+  ): Promise<void> {
     const failures: unknown[] = [];
     try {
       await profile.ready;
     } catch (error) {
       failures.push(error);
     }
+    // A pre-commit failure removed this attempt and restored the source.
+    if (this.sourceActorJoinProfiles.get(relocationId) !== profile) return;
     try {
       await this.options.actorTransfer.completeRelocationSourceLeave(
         profile.actor,
@@ -628,7 +727,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     try {
       await this.options
         .actorManager()
-        ?.completeRelocationSource(profile.state.actorId, profile.sourceActorRef);
+        ?.completeCoreRelocationSource(profile.state.actorId, profile.state);
     } catch (error) {
       failures.push(error);
     }
@@ -692,6 +791,11 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             id: `actor:${state.actorId}`,
             relocate: async (relocationSignal) => {
               await relocateShell(relocationSignal);
+              const spotAuthority = await requireAuthority(
+                this.requireLocationStore(),
+                encodeAuthorityKey('user_spot', String(activation.spotId)),
+                relocationSignal
+              );
               await this.relocateStandaloneActor(
                 meshName,
                 state,
@@ -699,15 +803,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
                 targetApplicationVersion,
                 relocationSignal,
                 {
-                  spotId: activation.spotId,
-                  spotKind: ZLinkSpotKind.User,
-                  spotObjectGeneration: (
-                    await requireAuthority(
-                      this.requireLocationStore(),
-                      encodeAuthorityKey('user_spot', String(activation.spotId)),
-                      relocationSignal
-                    )
-                  ).objectGeneration
+                  ...committedSpotRoute(
+                    meshName,
+                    activation.spotId,
+                    ZLinkSpotKind.User,
+                    spotAuthority.allocation.descriptor.rid,
+                    spotAuthority
+                  ),
+                  spotObjectGeneration: spotAuthority.objectGeneration
                 }
               );
             }
@@ -806,14 +909,31 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     throw failure;
   }
 
-  async tryHandleControl(
+  tryHandleControl(
     meshName: string,
     record: ReceiveRecord,
     signal?: AbortSignal
-  ): Promise<boolean> {
+  ): boolean | Promise<boolean> {
     if (record.parts.length === 0) return false;
     const payload = record.parts[0]!.data();
-    if (isServiceWireCommand(payload, M6bServiceWireCommand.replyRelay)) {
+    const command = serviceRelocationControlCommand(payload);
+    if (command === undefined) {
+      if (record.kind !== ReceiveKind.NodeSend || record.parts.length !== 1) return false;
+      const sourceLeave = decodeRemoteActorSourceLeaveTerminal(payload);
+      if (sourceLeave === undefined) return false;
+      return this.acceptActorJoinSourceLeave(sourceLeave);
+    }
+    return this.handleControl(meshName, record, payload, command, signal);
+  }
+
+  private async handleControl(
+    meshName: string,
+    record: ReceiveRecord,
+    payload: Buffer,
+    command: number,
+    signal?: AbortSignal
+  ): Promise<boolean> {
+    if (command === M6bServiceWireCommand.replyRelay) {
       await this.handleReplyRelay(
         meshName,
         decodeMaintenanceReplyRelay(record.parts.map((part) => part.data())),
@@ -822,45 +942,75 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       );
       return true;
     }
-    const sideband =
-      record.parts.length === 1
-        ? undefined
-        : decodePrepareSideband(record.parts.slice(1).map((part) => part.data()));
-    if (record.parts.length > 1 && sideband === undefined) return false;
+    if (record.parts.length !== 1) return false;
     if (record.kind === ReceiveKind.NodeSend) {
       const sourceLeave = decodeRemoteActorSourceLeaveTerminal(payload);
       if (sourceLeave !== undefined) {
         return this.acceptActorJoinSourceLeave(sourceLeave);
       }
     }
-    if (isServiceWireCommand(payload, M6bServiceWireCommand.sessionRelocationSealed)) {
+    if (command === M6bServiceWireCommand.sessionRelocationSealed) {
       this.acceptSessionRelocationResponse(
         decodeSessionRelocationSealed(payload),
         record.sourceNodeRid
       );
       return true;
     }
-    if (isServiceWireCommand(payload, M6bServiceWireCommand.sessionRelocationSeal)) {
-      const request = decodeSessionRelocationSeal(payload);
-      const response = await this.handleSessionRelocationSeal(
-        meshName,
-        request,
-        record.sourceNodeRid,
-        signal
-      );
-      await this.sendSessionRelocationResponse(
-        meshName,
-        record.sourceNodeRid,
-        encodeSessionRelocationSealed(response)
-      );
+    if (command === M6bServiceWireCommand.sessionRelocationSeal) {
+      let request: ServiceSessionRelocationSeal;
+      try {
+        request = decodeSessionRelocationSeal(payload);
+      } catch (error) {
+        const outcome = ZLinkMessageFlowOutcome.Error;
+        flowIfEnabled(this.options.messageFlow?.(), outcome)?.trace({
+          outcome,
+          surface: ZLinkDispatchErrorSurface.StreamSession,
+          messageKind: ZLinkDispatchMessageKind.Control,
+          packetName: 'sessionRelocationSeal',
+          sourceRid: record.sourceNodeRid ?? undefined,
+          errorReason: 'invalid_frame',
+          errorAction: ZLinkDispatchErrorAction.Drop,
+          ...dispatchErrorDetails(error)
+        });
+        throw error;
+      }
+      let response: ServiceSessionRelocationSealed | undefined;
+      try {
+        response = await this.handleSessionRelocationSeal(
+          meshName,
+          request,
+          record.sourceNodeRid,
+          signal
+        );
+      } catch (error) {
+        traceSessionBindingControlDrop(
+          this.options.messageFlow?.(),
+          record.sourceNodeRid ?? '',
+          request.actor.actor.actorId,
+          'sessionRelocationSeal',
+          error instanceof ZLinkFrameworkException &&
+            error.kind === ZLinkFrameworkErrorKind.Unavailable
+            ? 'location_unavailable'
+            : 'stale_target',
+          error
+        );
+        throw error;
+      }
+      if (response !== undefined) {
+        await this.sendSessionRelocationResponse(
+          meshName,
+          record.sourceNodeRid,
+          encodeSessionRelocationSealed(response)
+        );
+      }
       return true;
     }
-    if (isServiceWireCommand(payload, M6bServiceWireCommand.sessionRelocationRoute)) {
+    if (command === M6bServiceWireCommand.sessionRelocationRoute) {
       const request = decodeSessionRelocationRoute(payload);
       await this.handleSessionRelocationRoute(meshName, request, record.sourceNodeRid, signal);
       return true;
     }
-    if (isServiceWireCommand(payload, M6bServiceWireCommand.replyRelayAck)) {
+    if (command === M6bServiceWireCommand.replyRelayAck) {
       await this.acceptReplyRelayAck(
         meshName,
         decodeMaintenanceReplyRelayAck(payload),
@@ -871,10 +1021,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     }
     let request = decodeServiceRelocationControlRequest(payload);
     if (request === undefined) return false;
-    if (sideband !== undefined) {
-      if (request.kind !== 'prepare') return false;
-      request = { ...request, nodeInternalBoundSessions: sideband };
-    }
     // Ready(30) and Failed(53) are replies to Prepare(40), never independent
     // inbound controls. The source consumes them on Core's request reply leg.
     if (request.kind === 'ready' || request.kind === 'failed') return false;
@@ -901,7 +1047,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         this.targetAssemblies.get(operationKey)?.fingerprint ??
         this.targetStages.get(operationKey)?.offer.prepareFingerprint ??
         this.terminalTargets.get(operationKey);
-      if (request.sourceNodeRid !== String(record.sourceNodeRid)) return true;
+      if (!routingIdsEqual(request.sourceNodeRid, record.sourceNodeRid)) return true;
       if (acceptedFingerprint !== undefined && acceptedFingerprint !== fingerprint) {
         if (!samePrepareIdentity(acceptedFingerprint, request)) return true;
         this.replyPrepare(
@@ -931,7 +1077,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         // finish the restore and the Ready reply asynchronously.
         let promise: Promise<ServiceMaintenanceRelocationReady>;
         try {
-          this.registerTargetAssembly(operationKey, request, String(record.sourceNodeRid));
+          this.registerTargetAssembly(operationKey, request, record.sourceNodeRid);
           promise = this.handlePrepareControl(
             meshName,
             operationKey,
@@ -1066,7 +1212,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (
       pending === undefined ||
       sourceNodeRid === null ||
-      String(sourceNodeRid) !== pending.authenticatedSourceNodeRid ||
+      !routingIdsEqual(sourceNodeRid, pending.authenticatedSourceNodeRid) ||
       request.senderRole !== 'source' ||
       !sameCoordinator(request.coordinator, pending.prepare.coordinator) ||
       !sameRelocationObject(request.object, pending.prepare.object)
@@ -1145,7 +1291,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     //  to itself; RouteMesh has no self connection (NotConnected), so the
     //  control dispatches through the same inbound handler locally.
     const localRid = this.requireMeshNode(meshName).status().routingId;
-    if (String(localRid) === String(targetNodeRid)) {
+    if (routingIdsEqual(localRid, targetNodeRid)) {
       await this.handleSessionRelocationRoute(meshName, request, localRid, signal);
       return;
     }
@@ -1174,7 +1320,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const key = sessionRelocationPendingKey(request);
     const bytes = encodeSessionRelocationSeal(request);
     const requestFingerprint = bytes.toString('base64');
-    const expectedTarget = String(targetNodeRid);
+    const expectedTarget = encodeRoutingIdStorageHex(targetNodeRid);
     const terminal = this.terminalSessionRelocations.get(key);
     if (terminal !== undefined) {
       if (
@@ -1188,6 +1334,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         );
       }
       this.terminalSessionRelocations.touch(key);
+      return Promise.resolve(terminal.response);
     }
     const existing = this.pendingSessionRelocations.get(key);
     if (existing !== undefined) {
@@ -1251,7 +1398,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       //  connection (NotConnected); dispatch through the inbound handler
       //  locally instead of the wire.
       const localRid = this.requireMeshNode(meshName).status().routingId;
-      if (String(localRid) === expectedTarget) {
+      if (encodeRoutingIdStorageHex(localRid) === expectedTarget) {
         try {
           const response = await this.handleSessionRelocationSeal(
             meshName,
@@ -1259,7 +1406,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             localRid,
             signal
           );
-          pending.resolve(response);
+          if (response !== undefined) pending.resolve(response);
         } catch (error) {
           pending.reject(error);
         }
@@ -1310,9 +1457,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         finish(() => {
           this.terminalSessionRelocations.remember(key, {
             targetNodeRid: expectedTarget,
-            request,
             requestFingerprint,
-            responseFingerprint: sessionRelocationResponseFingerprint(response)
+            response
           });
           resolvePromise(response);
         }),
@@ -1358,19 +1504,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (pending === undefined) {
       const terminal = this.terminalSessionRelocations.get(key);
       if (terminal === undefined) return;
-      if (sourceNodeRid === null || String(sourceNodeRid) !== terminal.targetNodeRid) {
-        throw new ServiceWireProtocolError(`Session relocation ACK '${key}' source node changed.`);
-      }
-      validateSessionRelocationResponse(terminal.request, response);
-      if (sessionRelocationResponseFingerprint(response) !== terminal.responseFingerprint) {
-        throw new ServiceWireProtocolError(
-          `Session relocation ACK '${key}' repeated with different bytes.`
-        );
-      }
+      // Session–Actor binding §8.3: the first command 43 is final for this participant.
       this.terminalSessionRelocations.touch(key);
       return;
     }
-    if (sourceNodeRid === null || String(sourceNodeRid) !== pending.targetNodeRid) {
+    if (
+      sourceNodeRid === null ||
+      encodeRoutingIdStorageHex(sourceNodeRid) !== pending.targetNodeRid
+    ) {
       pending.reject(
         new ServiceWireProtocolError(`Session relocation ACK '${key}' source node changed.`)
       );
@@ -1394,12 +1535,12 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (sourceNodeRid === null) return undefined;
     const node = this.requireMeshNode(meshName);
     const status = node.status();
-    if (String(status.routingId) === String(sourceNodeRid)) {
+    if (routingIdsEqual(status.routingId, sourceNodeRid)) {
       return status.lifecycleGeneration;
     }
     return node
       .peers()
-      .find((peer) => peer.routingId !== null && String(peer.routingId) === String(sourceNodeRid))
+      .find((peer) => peer.routingId !== null && routingIdsEqual(peer.routingId, sourceNodeRid))
       ?.lifecycleGeneration;
   }
 
@@ -1408,11 +1549,11 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     request: ServiceSessionRelocationSeal,
     sourceNodeRid: RoutingId | null,
     signal?: AbortSignal
-  ): Promise<ServiceSessionRelocationSealed> {
+  ): Promise<ServiceSessionRelocationSealed | undefined> {
     if (
       sourceNodeRid === null ||
-      String(sourceNodeRid) !== request.coordinator.nodeRid ||
-      String(sourceNodeRid) !== request.actor.actor.nodeRid
+      !routingIdsEqual(sourceNodeRid, request.coordinator.nodeRid) ||
+      !routingIdsEqual(sourceNodeRid, request.actor.actor.nodeRid)
     ) {
       throw new ServiceWireProtocolError(
         'Session relocation seal source does not match its coordinator and Actor fence.'
@@ -1432,7 +1573,19 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (handler === undefined) {
       throw new Error('Session relocation seal ingress is not configured.');
     }
-    return await handler(request, signal);
+    return await handler(request, signal, () => {
+      const node = this.requireMeshNode(meshName);
+      if (
+        routingIdsEqual(node.status().routingId, request.targetNodeRid) ||
+        node.isPeerRouteReady?.(request.targetNodeRid, request.targetNodeGeneration) === true
+      )
+        return;
+      void this.options
+        .requestPeerReconcile?.(meshName, request.targetNodeRid)
+        .catch((error) =>
+          console.error('[zlink.runtime.relocation.session_route_reconcile_failed]', error)
+        );
+    });
   }
 
   private async handleSessionRelocationRoute(
@@ -1444,7 +1597,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     this.validateSessionOwnerFence(meshName, request.session);
     const expectedSource =
       request.route.action === 'commit' ? request.route.targetNodeRid : request.coordinator.nodeRid;
-    if (sourceNodeRid === null || String(sourceNodeRid) !== expectedSource) {
+    if (sourceNodeRid === null || !routingIdsEqual(sourceNodeRid, expectedSource)) {
       throw new ServiceWireProtocolError(
         'Session relocation route source does not match its action fence.'
       );
@@ -1472,10 +1625,17 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   ): void {
     const status = this.requireMeshNode(meshName).status();
     const owner = this.options.currentOwner();
+    // Session-Actor binding §4: without this host's own descriptor the command is Unavailable.
+    if (owner === undefined) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.RouteNotConnected,
+        'Session owner has no live MeshNode descriptor.'
+      );
+    }
     if (
-      String(status.routingId) !== session.sessionOwnerNodeRid ||
+      !routingIdsEqual(status.routingId, session.sessionOwnerNodeRid) ||
       status.lifecycleGeneration !== session.sessionOwnerNodeGeneration ||
-      owner?.ownerId !== session.sessionOwnerId ||
+      owner.ownerId !== session.sessionOwnerId ||
       owner.leaseGeneration !== session.sessionOwnerLeaseGeneration
     ) {
       throw new ServiceWireProtocolError(
@@ -1552,7 +1712,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     );
     target ??= await this.selectTarget(
       meshName,
-      String(this.requireMeshNode(meshName).status().routingId),
+      this.requireMeshNode(meshName).status().routingId,
       targetApplicationVersion,
       relocationTargetRequirements([
         {
@@ -1584,17 +1744,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       objectGeneration: spotAuthority.objectGeneration,
       authorityOwnerGeneration: spotAuthority.authorityOwnerGeneration,
       seal: async (captureSignal) => {
-        const { spotCaptureOperation } = await this.afterSpotCloseDecision(
-          meshName,
-          activation.spotId,
-          () => {
-            interruptionStartedAt = performance.now();
-            spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
-            // Both seals run in the same event-loop turn after the Close decision.
-            return { spotCaptureOperation: activation.captureRelocation(captureSignal) };
-          }
-        );
-        const preparedSessions = Promise.all(
+        // Relocation 04 §4.1: every bound member's Session is sealed before
+        // the Spot capture stops member dispatch.
+        const preparations = await Promise.allSettled(
           actorStates.map(async (state) => ({
             state,
             actor: state.actor!,
@@ -1603,27 +1755,40 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
               state,
               captureSignal,
               false,
-              relocationWireId(aggregateId)
+              relocationWireId(aggregateId),
+              target
             )
           }))
         );
-        const preparedSessionsOutcome = preparedSessions.then(
-          (value) => ({ value }),
-          (error) => ({ error })
+        const failures: unknown[] = [];
+        for (const preparation of preparations) {
+          if (preparation.status === 'fulfilled') sessions.push(preparation.value);
+          else failures.push(preparation.reason);
+        }
+        if (failures.length === 1) throw failures[0];
+        if (failures.length > 1) {
+          throw new AggregateError(failures, 'Spot relocation source preparation failed.');
+        }
+        const { spotCaptureOperation } = await this.afterSpotCloseDecision(
+          meshName,
+          activation.spotId,
+          () => {
+            interruptionStartedAt = performance.now();
+            spotMessageFollowSeal = this.sealSpotMessageFollow(meshName, spotAuthority, activation);
+            // Both Spot seals run in the same event-loop turn after the Close decision.
+            return { spotCaptureOperation: activation.captureRelocation(captureSignal) };
+          }
         );
         spotCapture = await spotCaptureOperation;
-        const preparation = await preparedSessionsOutcome;
-        if ('error' in preparation) throw preparation.error;
-        sessions.push(...preparation.value);
         return {
           boundSessionState: Buffer.alloc(0),
           queuedMessages: [],
-          timers: spotCapture.timers.map(toServiceTimer)
+          timers: spotCapture!.timers.map(toServiceTimer)
         };
       },
       captureApplicationState: (captureSignal) =>
         this.captureApplication(spotRegistration.relocation, activation.spot, captureSignal),
-      commitSeal: async () => {
+      commitSeal: async (followAuthorities) => {
         const failures: unknown[] = [];
         try {
           if (!spotSealCommitted) {
@@ -1636,9 +1801,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             await this.commitSpotMessageFollow(
               meshName,
               spotMessageFollowSeal,
-              spotKey,
-              activation,
-              target
+              followAuthorities.get(spotKey.value),
+              activation
             );
           }
         } catch (error) {
@@ -1646,10 +1810,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         }
         for (const session of sessions) {
           try {
-            const committedAuthority = await requireAuthority(
-              this.requireLocationStore(),
-              encodeAuthorityKey('actor', session.state.actorId)
+            const committedAuthority = followAuthorities.get(
+              encodeAuthorityKey('actor', session.state.actorId).value
             );
+            const committedSpot = followAuthorities.get(spotKey.value);
             const targetActorRef = {
               actorId: session.state.actorId,
               objectGeneration: actorAuthorities.get(session.state.actorId)!.objectGeneration,
@@ -1657,15 +1821,21 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
               nodeRid: target.rid
             };
             await session.prepared.commit(
-              {
-                routerChannelId: meshName,
-                targetNodeRid: target.rid,
-                spotId: activation.spotId,
-                spotKind: kind === 'user_spot' ? ZLinkSpotKind.User : ZLinkSpotKind.Instance,
-                authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-              } as never,
+              committedSpotRoute(
+                meshName,
+                activation.spotId,
+                kind === 'user_spot' ? ZLinkSpotKind.User : ZLinkSpotKind.Instance,
+                target.rid,
+                committedSpot
+              ),
               targetActorRef,
-              committedActorOwnerFence(session.state.actorId, targetActorRef, committedAuthority)
+              committedAuthority === undefined || committedSpot === undefined
+                ? null
+                : committedActorOwnerFence(
+                    session.state.actorId,
+                    targetActorRef,
+                    committedAuthority
+                  )
             );
           } catch (error) {
             failures.push(error);
@@ -1694,6 +1864,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       abortSeal: async () => {
         const failures: unknown[] = [];
         if (spotCapture !== undefined) {
+          // Spot model §5.1: Continued completes while the source seal still holds jobs.
+          if (readinessBoundaryConsumed) {
+            try {
+              await activation.completeConsumedRelocationBoundary(
+                ZLinkSpotRelocationReadyOutcome.Continued
+              );
+            } catch (error) {
+              failures.push(error);
+            }
+          }
           try {
             activation.abortRelocation(spotCapture);
           } catch (error) {
@@ -1742,7 +1922,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       spotObjectGeneration: spotAuthority.objectGeneration,
       membershipEpoch: state.spotMembershipEpoch > 0n ? state.spotMembershipEpoch : 1n
     }));
-    let outcome = 'completed';
+    const relocationMetric =
+      spotRegistration.relocation.kind === 'disabled'
+        ? undefined
+        : this.options.metrics?.startRelocation(meshName, kind, spotRegistration.relocation.kind);
     try {
       const waitForRelocationBoundary = (
         activation as unknown as {
@@ -1791,10 +1974,12 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           )
         ]),
         signal,
-        sessions
+        sessions,
+        undefined,
+        undefined,
+        relocationMetric
       );
     } catch (error) {
-      outcome = 'failed';
       if (
         readinessBoundaryConsumed &&
         !(error instanceof ServiceRelocationPostCommitError) &&
@@ -1806,14 +1991,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       }
       throw error;
     } finally {
+      this.completeSourceRelocationMetric(relocationMetric);
       this.sourceRelocationIds.delete(aggregateId);
       if (interruptionStartedAt !== undefined) {
         this.recordRelocationInterruption(
           meshName,
           kind,
           kind === 'user_spot' ? 'spot_wide' : undefined,
-          interruptionStartedAt,
-          outcome
+          interruptionStartedAt
         );
       }
     }
@@ -1825,15 +2010,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     target: ZLinkMeshNodeDescriptor | undefined,
     targetApplicationVersion: bigint | undefined,
     signal?: AbortSignal,
-    targetMembership?: {
-      readonly spotId: RoutingId;
+    targetMembership?: ZLinkSpotRouteTarget & {
       readonly spotKind: ZLinkSpotKind.Entry | ZLinkSpotKind.User;
       readonly spotObjectGeneration: bigint;
     },
     aggregateIdOverride?: string,
     retainSourceForActorJoin = false,
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
-    advertisedReceiveChunkLimitBytes?: number
+    advertisedReceiveChunkLimitBytes?: number,
+    deadlineAtMs?: number
   ): Promise<void> {
     if (isRelocationDebugEnabled()) {
       relocationDebug('standalone_actor.begin', { actorId: state.actorId });
@@ -1843,18 +2028,19 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       encodeAuthorityKey('actor', state.actorId),
       signal
     );
+    const actorPolicy = this.actorRegistration(
+      state.meshName ?? meshName,
+      authority.allocation.stableType
+    ).relocation.kind;
     target ??= await this.selectTarget(
       meshName,
-      String(this.requireMeshNode(meshName).status().routingId),
+      this.requireMeshNode(meshName).status().routingId,
       targetApplicationVersion,
       [
         {
           objectKind: 'actor',
           stableType: authority.allocation.stableType,
-          policy: this.actorRegistration(
-            state.meshName ?? meshName,
-            authority.allocation.stableType
-          ).relocation.kind,
+          policy: actorPolicy,
           count: 1
         }
       ],
@@ -1871,10 +2057,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       true,
       target,
       meshName,
-      {
-        spotId: membershipSpotId,
-        spotKind: targetMembership?.spotKind ?? ZLinkSpotKind.Entry
-      },
+      targetMembership,
       relocationWireId(aggregateId),
       retainSourceForActorJoin
     );
@@ -1892,7 +2075,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         return unit.seal(captureSignal);
       }
     };
-    let outcome = 'completed';
+    const relocationMetric =
+      actorPolicy === 'disabled'
+        ? undefined
+        : this.options.metrics?.startRelocation(meshName, 'actor', actorPolicy);
     try {
       if (isRelocationDebugEnabled()) {
         relocationDebug('standalone_actor.wait_budget', {
@@ -1922,21 +2108,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         new Map([[measuredUnit.authorityKey, authority]]),
         signal,
         sessions,
-        advertisedReceiveChunkLimitBytes
+        advertisedReceiveChunkLimitBytes,
+        deadlineAtMs,
+        relocationMetric
       );
-    } catch (error) {
-      outcome = 'failed';
-      throw error;
     } finally {
+      this.completeSourceRelocationMetric(relocationMetric);
       this.sourceRelocationIds.delete(aggregateId);
       if (interruptionStartedAt !== undefined) {
-        this.recordRelocationInterruption(
-          meshName,
-          'actor',
-          undefined,
-          interruptionStartedAt,
-          outcome
-        );
+        this.recordRelocationInterruption(meshName, 'actor', undefined, interruptionStartedAt);
       }
     }
   }
@@ -1975,7 +2155,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     );
     target ??= await this.selectTarget(
       meshName,
-      String(this.requireMeshNode(meshName).status().routingId),
+      this.requireMeshNode(meshName).status().routingId,
       targetApplicationVersion,
       [
         {
@@ -2017,7 +2197,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       // PerActor User Spots are stateless shells. Application state and the
       // Spot relocation adapter are intentionally not part of this unit.
       captureApplicationState: async () => Buffer.alloc(0),
-      commitSeal: async () => {
+      commitSeal: async (followAuthorities) => {
         if (!sealCommitted) {
           if (spotCapture === undefined || !(await activation.commitRelocation(spotCapture))) {
             throw new Error(
@@ -2030,9 +2210,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           await this.commitSpotMessageFollow(
             meshName,
             spotMessageFollowSeal,
-            spotKey,
-            activation,
-            target
+            followAuthorities.get(spotKey.value),
+            activation
           );
         }
         await this.requireSpotManager().completeRelocationSource(activation);
@@ -2049,7 +2228,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       }
     };
     const aggregateId = this.reserveRelocationId();
-    let outcome = 'completed';
+    const relocationMetric =
+      spotRegistration.relocation.kind === 'disabled'
+        ? undefined
+        : this.options.metrics?.startRelocation(
+            meshName,
+            'user_spot',
+            spotRegistration.relocation.kind
+          );
     try {
       await this.waitForRelocationBudgetHeadroom(String(target.rid), signal);
       const captured = await new ServiceRelocationObjectCaptureOwner().captureUserSpotAggregate(
@@ -2067,20 +2253,20 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         captured,
         new Map([[spotKey.value, spotAuthority]]),
         signal,
-        []
+        [],
+        undefined,
+        undefined,
+        relocationMetric
       );
-    } catch (error) {
-      outcome = 'failed';
-      throw error;
     } finally {
+      this.completeSourceRelocationMetric(relocationMetric);
       this.sourceRelocationIds.delete(aggregateId);
       if (interruptionStartedAt !== undefined) {
         this.recordRelocationInterruption(
           meshName,
           'user_spot',
           'per_actor',
-          interruptionStartedAt,
-          outcome
+          interruptionStartedAt
         );
       }
     }
@@ -2093,10 +2279,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     standalone = false,
     target?: ZLinkMeshNodeDescriptor,
     meshName?: string,
-    targetMembership?: {
-      readonly spotId: RoutingId;
-      readonly spotKind: ZLinkSpotKind.Entry | ZLinkSpotKind.User;
-    },
+    targetMembership?: ZLinkSpotRouteTarget,
     sessionRelocation?: ServiceWireOperationId,
     retainSourceForActorJoin = false
   ): ServiceRelocationCaptureUnit {
@@ -2121,24 +2304,48 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
               state,
               signal,
               true,
-              sessionRelocation
+              sessionRelocation,
+              target
             )
           };
           sessions.push(ownSession);
         }
         const prepared = standalone ? ownSession : sessions.find((value) => value.state === state);
         return {
-          boundSessionState: encodeActorSession(prepared?.prepared.target),
+          boundSessionState: Buffer.alloc(0),
+          ...(prepared?.prepared.target?.serviceWireRelocation === undefined
+            ? {}
+            : {
+                sessionBinding: {
+                  participantId: 1n,
+                  sessionOwnerNodeRid: Buffer.from(
+                    encodeRoutingIdStorageHex(prepared.prepared.target.sessionNodeRid!),
+                    'hex'
+                  ),
+                  sessionOwnerNodeGeneration:
+                    prepared.prepared.target.serviceWireRelocation.session
+                      .sessionOwnerNodeGeneration,
+                  sessionOwnerId:
+                    prepared.prepared.target.serviceWireRelocation.session.sessionOwnerId,
+                  sessionOwnerLeaseGeneration:
+                    prepared.prepared.target.serviceWireRelocation.session
+                      .sessionOwnerLeaseGeneration,
+                  sessionRid: Buffer.from(
+                    encodeRoutingIdStorageHex(prepared.prepared.target.sessionRid!),
+                    'hex'
+                  ),
+                  bindingGeneration:
+                    prepared.prepared.target.serviceWireRelocation.session.bindingGeneration
+                }
+              }),
           queuedMessages: encodeHandoffQueuedMessages(prepared?.prepared.handoffBacklog ?? []),
           timers: []
         };
       },
-      // The canonical participant body (discriminator 1) is raw application
-      // state. The sealed bound-session target remains in sealed work and is
-      // transported only by Prepare's NODE-INTERNAL sideband frames.
+      // The sealed Session identity is part of the canonical participant vector.
       captureApplicationState: (signal) =>
         this.captureApplication(registration.relocation, state.actor!, signal),
-      commitSeal: async () => {
+      commitSeal: async (followAuthorities) => {
         if (
           !standalone ||
           ownSession === undefined ||
@@ -2148,11 +2355,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           return;
         const failures: unknown[] = [];
         try {
-          const membershipSpotId =
-            targetMembership?.spotId ?? ((target.entrySpotId ?? String(target.rid)) as RoutingId);
-          const committedAuthority = await requireAuthority(
-            this.requireLocationStore(),
-            encodeAuthorityKey('actor', state.actorId)
+          const committedAuthority = followAuthorities.get(
+            encodeAuthorityKey('actor', state.actorId).value
           );
           const targetActorRef = {
             actorId: state.actorId,
@@ -2161,25 +2365,28 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             nodeRid: target.rid
           };
           await ownSession.prepared.commit(
-            {
+            targetMembership ?? {
               routerChannelId: meshName,
               targetNodeRid: target.rid,
-              spotId: membershipSpotId,
-              spotKind: targetMembership?.spotKind ?? ZLinkSpotKind.Entry,
-              authorityOwnerGeneration: committedAuthority.authorityOwnerGeneration
-            } as never,
+              spotId: (target.entrySpotId ?? String(target.rid)) as RoutingId,
+              spotKind: ZLinkSpotKind.Entry
+            },
             targetActorRef,
-            committedActorOwnerFence(state.actorId, targetActorRef, committedAuthority)
+            committedAuthority === undefined
+              ? null
+              : committedActorOwnerFence(state.actorId, targetActorRef, committedAuthority)
           );
         } catch (error) {
           failures.push(error);
         }
-        if (!retainSourceForActorJoin) {
-          try {
+        try {
+          if (retainSourceForActorJoin) {
+            this.requireActorManager().detachRelocationSource(state);
+          } else {
             await this.requireActorManager().completeRelocationSource(state.actorId);
-          } catch (error) {
-            failures.push(error);
           }
+        } catch (error) {
+          failures.push(error);
         }
         if (failures.length > 0)
           throw failures.length === 1
@@ -2229,7 +2436,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     signal?: AbortSignal,
     sessions: readonly SourceActorSession[] = [],
     /** Target's advertised relocation state chunk cap (Actor Join only; spec 15 §4.2). */
-    advertisedReceiveChunkLimitBytes?: number
+    advertisedReceiveChunkLimitBytes?: number,
+    controlDeadlineAtMs = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS,
+    relocationMetric?: ZLinkRelocationMetricOperation
   ): Promise<void> {
     if (isRelocationDebugEnabled()) {
       relocationDebug('coordinator.begin', {
@@ -2238,19 +2447,15 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       });
     }
     const localStatus = this.requireMeshNode(meshName).status();
-    const controlDeadlineAtMs =
-      signal === undefined
-        ? performance.now() + RELOCATION_OPERATION_TIMEOUT_MS
-        : Number.MAX_SAFE_INTEGER;
     const coordinator = {
       ownerId: primary.ownerId,
       leaseGeneration: primary.ownerLeaseGeneration,
-      nodeRid: String(localStatus.routingId),
+      nodeRid: localStatus.routingId,
       nodeGeneration: localStatus.lifecycleGeneration,
       expectedAuthorityStoreVersion: primary.storeVersion.value
     } satisfies ServiceWireRelocationCoordinatorFence;
     const targetFence = {
-      nodeRid: String(target.rid),
+      nodeRid: target.rid,
       nodeGeneration: target.lifecycleGeneration,
       ownerId: target.ownerId,
       ownerLeaseGeneration: target.leaseGeneration
@@ -2263,13 +2468,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     // attempt even when it reuses the same routing id.
     const targetAttemptGeneration = target.lifecycleGeneration;
     const relayAuthorityId = wireIdText(relocationWireId(captured.envelope.aggregateId));
-    const relayAuthorityKey = primaryKey(captured.envelope);
-    if (this.relocationAuthorityKeys.has(relayAuthorityId)) {
-      throw new Error(
-        `Relocation reply relay authority '${relayAuthorityId}' is already registered.`
-      );
-    }
-    this.relocationAuthorityKeys.set(relayAuthorityId, relayAuthorityKey);
     // The captured payload stays in source memory: this copy is the only
     // handoff original until the cutover submit terminal and the
     // retransmission window end (spec 28 §4.2).
@@ -2289,6 +2487,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             primary
           );
     const encoded = encodeServiceRelocationEnvelope(transportEnvelope, target.applicationVersion);
+    relocationMetric?.recordBytes(encoded.byteLength);
     const limits = this.relocationLimits();
     // Actor Join threads the target's admission-time advertised cap in;
     // other relocation paths have no such negotiation and fall back to the
@@ -2305,7 +2504,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const restoreDeadlineReached = () =>
       signal?.aborted === true || performance.now() >= controlDeadlineAtMs;
     let readyReceived = false;
-    let settlement: 'target' | 'source' | 'lost' | undefined;
+    let settlement:
+      Awaited<ReturnType<ZLinkHostServiceRelocationRuntime['settleSourceAuthority']>> | undefined;
     try {
       const prepare = {
         kind: 'prepare',
@@ -2320,35 +2520,40 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         payloadTotalLength: BigInt(plan.totalLength),
         payloadChunkCount: plan.chunkCount,
         payloadChecksumCrc32c: plan.checksumCrc32c,
-        applicationVersion: target.applicationVersion
+        applicationVersion: target.applicationVersion,
+        deadlineUnixMs: BigInt(
+          Date.now() + Math.max(0, Math.ceil(controlDeadlineAtMs - performance.now()))
+        )
       } satisfies ServiceMaintenanceRelocationPrepare;
       // Start the Restore request first (it also registers the temporary
       // queue and the assembly on the target), then stream the payload chunks
       // on the same ordered connection. The Ready reply arrives only after
       // the target assembled, verified, and restored the payload.
-      const readyOperation = this.sendControl(
+      const ready = await this.sendControl(
         meshName,
         target.rid,
         prepare,
         signal,
         controlDeadlineAtMs,
-        encodePrepareSideband(captured.envelope)
-      );
-      try {
-        if (isRelocationDebugEnabled()) {
-          relocationDebug('coordinator.state_transfer_begin', {
-            aggregateId: captured.envelope.aggregateId
-          });
+        async (attemptSignal) => {
+          if (isRelocationDebugEnabled())
+            relocationDebug('coordinator.state_transfer_begin', {
+              aggregateId: captured.envelope.aggregateId
+            });
+          await this.sendRelocationStateChunks(
+            meshName,
+            target,
+            prepare,
+            encoded,
+            plan,
+            attemptSignal
+          );
+          if (isRelocationDebugEnabled())
+            relocationDebug('coordinator.await_ready', {
+              aggregateId: captured.envelope.aggregateId
+            });
         }
-        await this.sendRelocationStateChunks(meshName, target, prepare, encoded, plan, signal);
-      } catch (chunkError) {
-        readyOperation.catch(() => undefined);
-        throw chunkError;
-      }
-      if (isRelocationDebugEnabled()) {
-        relocationDebug('coordinator.await_ready', { aggregateId: captured.envelope.aggregateId });
-      }
-      const ready = await readyOperation;
+      );
       if (isRelocationDebugEnabled()) {
         relocationDebug('coordinator.ready_received', {
           aggregateId: captured.envelope.aggregateId
@@ -2359,6 +2564,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       // forward the source can no longer reopen dispatch without risking two
       // owners.
       readyReceived = true;
+      actorJoinProfile?.relayReady();
 
       const boundaryBatch: Array<{
         readonly frame: Buffer;
@@ -2413,14 +2619,16 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       // The cutover submit result is not the authority result. The memory
       // copy of the boundary batch and cutover stays until the authority
       // settlement below (spec 28 §4.4).
-      let submitFailure: unknown;
+      const submittedRouteGeneration = this.requireMeshNode(meshName).observePeerRoute?.(
+        target.rid
+      ).generation;
       try {
         for (const record of boundaryBatch) {
           await this.submitControlFrame(meshName, target.rid, record.frame, 'relay');
         }
         await this.submitControlFrame(meshName, target.rid, cutoverFrame, 'cutover');
       } catch (error) {
-        submitFailure = error;
+        if (!durableRequestCanReplay(error)) throw error;
         console.warn('[zlink.runtime.relocation.cutover_submit_failed]', relayAuthorityId, error);
       }
       const window = this.beginSourceCutoverWindow(
@@ -2428,7 +2636,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         target.rid,
         relayAuthorityId,
         [...boundaryBatch.map((value) => value.frame), cutoverFrame],
-        submitFailure !== undefined,
+        submittedRouteGeneration,
         limits
       );
       try {
@@ -2437,7 +2645,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           primary,
           targetFence,
           restoreDeadlineReached,
-          window
+          window,
+          relocationMetric
         );
       } finally {
         this.closeSourceCutoverWindow(relayAuthorityId, window);
@@ -2452,26 +2661,37 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         // Preserve won: the captured queue, timers and held records return to
         // the source queue in their accepted order, and dispatch reopens.
         await captured.abortSource();
+        this.completeSourceRelocationMetric(relocationMetric, settlement);
         throw new Error(
           `Relocation '${relayAuthorityId}' ended by the source Preserve fence; the source kept the authority.`
         );
       }
       if (settlement === 'lost') {
+        this.completeSourceRelocationMetric(relocationMetric, settlement);
         // Expired owner: dispatch and Store changes stop for good and every
         // pending request without a terminal gets one Unavailable.
         const unavailable = createInternalFrameworkException(
           ZLinkFrameworkInternalErrorKind.RouteNotConnected,
-          `Relocation '${relayAuthorityId}' source owner lease ended before its authority settled.`,
+          `Relocation '${relayAuthorityId}' source authority ended (source owner lease expired, authority Missing, or owner changed).`,
           true
         );
         await captured.discardSource(unavailable);
         throw new ServiceRelocationAuthorityError(unavailable.message, { cause: unavailable });
       }
+      this.completeSourceRelocationMetric(relocationMetric, settlement);
       for (const session of sessions) session.prepared.setReplayResults([]);
-      await captured.commitSource();
+      await captured.commitSource(settlement.followAuthorities);
       await this.options.reconcileStatefulAuthorityRoutes?.(signal);
     } catch (error) {
-      if (settlement !== 'target') throw error;
+      if (
+        this.disposed &&
+        (error instanceof ServiceRelocationRuntimeStoppedError ||
+          (error instanceof ZLinkBackendResultError &&
+            error.result ===
+              (error.operation === 'request' ? RequestResult.Terminated : SubmitResult.Terminated)))
+      )
+        this.completeSourceRelocationMetric(relocationMetric, undefined, true);
+      if (settlement === undefined || typeof settlement === 'string') throw error;
       // Target commit is confirmed; later source cleanup failures cannot move
       // the authority back (spec 28 §10).
       const authority = await requireAuthority(
@@ -2485,17 +2705,33 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         error
       );
     } finally {
+      this.completeSourceRelocationMetric(relocationMetric);
       if (!readyReceived) {
         // Only an explicit failure before the Ready reply becomes accepted
         // restores the source from the memory payload (spec 28 §9).
         await captured.abortSource().catch(() => undefined);
       }
-      if (this.relocationAuthorityKeys.get(relayAuthorityId) === relayAuthorityKey) {
-        this.relocationAuthorityKeys.delete(relayAuthorityId);
-      }
     }
   }
 
+  private completeSourceRelocationMetric(
+    metric: ZLinkRelocationMetricOperation | undefined,
+    settlement?: SourceAuthorityCommit | 'source' | 'lost',
+    sourceStopped = false
+  ): void {
+    metric?.complete(
+      settlement === 'source'
+        ? 'aborted'
+        : settlement === 'lost'
+          ? 'failed'
+          : settlement !== undefined
+            ? 'completed'
+            : sourceStopped
+              ? 'shutdown'
+              : 'failed'
+    );
+  }
+
   /** Streams the payload chunks of one stage under the effective in-flight budgets. */
   private async sendRelocationStateChunks(
     meshName: string,
@@ -2518,6 +2754,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         signal
       );
       try {
+        signal?.throwIfAborted();
         await this.sendControlOneWay(meshName, target.rid, {
           kind: 'state',
           relocation: identity.relocation,
@@ -2597,7 +2834,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     targetNodeRid: RoutingId,
     relocationKey: string,
     frames: readonly Buffer[],
-    initialSubmitFailed: boolean,
+    submittedRouteGeneration: bigint | undefined,
     limits: ReturnType<ZLinkHostServiceRelocationRuntime['relocationLimits']>
   ): SourceCutoverWindow {
     const submittedAt = performance.now();
@@ -2605,12 +2842,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       meshName,
       targetNodeRid,
       frames,
-      resendPending: initialSubmitFailed,
+      submittedRouteGeneration,
       cutoverSubmittedAtMs: submittedAt,
       windowClosed: false,
       followExpired: false
     };
+    const wasQuiescent = this.isSafeToShutdown();
     this.sourceCutoverWindows.set(relocationKey, window);
+    if (wasQuiescent) this.options.sourceQuiescenceChanged?.();
     window.followTimer = setTimeout(() => {
       window.followExpired = true;
       // S1→S4 route convergence: the span the source must keep its Message
@@ -2640,27 +2879,17 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       this.sourceCutoverWindows.get(relocationKey) === window
     ) {
       this.sourceCutoverWindows.delete(relocationKey);
+      if (this.isSafeToShutdown()) this.options.sourceQuiescenceChanged?.();
     }
   }
 
-  /**
-   * Sends the whole boundary batch and cutover again after a failed submit
-   * or an observed loss of the target connection (spec 28 §4.4). The target
-   * replaces its partial span with the whole batch.
-   */
+  /** Relocation flow §4.4: replay the whole batch on a different ready route. */
   private async resendSourceCutover(window: SourceCutoverWindow): Promise<void> {
     const frames = window.frames;
     if (frames === undefined) return;
-    const peers = this.requireMeshNode(window.meshName).peers();
-    const peer = peers.find(
-      (value) =>
-        value.routingId !== null && String(value.routingId) === String(window.targetNodeRid)
-    );
-    if (peer !== undefined && peer.state !== MeshPeerRuntimeState.Serving) {
-      window.resendPending = true;
-      return;
-    }
-    if (!window.resendPending) return;
+    const route = this.requireMeshNode(window.meshName).observePeerRoute?.(window.targetNodeRid);
+    if (route?.ready !== true || route.generation === window.submittedRouteGeneration) return;
+    window.submittedRouteGeneration = route.generation;
     try {
       for (const frame of frames) {
         await this.submitControlFrame(
@@ -2670,9 +2899,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           'cutover retransmission'
         );
       }
-      window.resendPending = false;
-    } catch {
-      // The next settlement round retries the whole batch.
+    } catch (error) {
+      if (!durableRequestCanReplay(error)) throw error;
     }
   }
 
@@ -2684,20 +2912,25 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
    * excludes a late target commit. `target`: the
    * target committed. `source`: Preserve fenced the target out while the
    * source owner lease was valid. `lost`: the source owner lease ended first
-   * or another authority owns the object. An uncertain Store or lease result
-   * keeps the work retained and repeats the same decision.
+   * or authority is Missing or fails the same-object, advanced-generation fence.
+   * A committed later owner has no Follow snapshot (Location runtime §10). An uncertain
+   * Store or lease result keeps the work retained and repeats the same decision.
    */
   private async settleSourceAuthority(
     envelope: ServiceRelocationEnvelope,
     primary: ZLinkAuthoritySnapshot,
     target: ServiceWireRelocationTarget,
     restoreDeadlineReached: () => boolean,
-    window: SourceCutoverWindow
-  ): Promise<'target' | 'source' | 'lost'> {
+    window: SourceCutoverWindow,
+    relocationMetric?: ZLinkRelocationMetricOperation
+  ): Promise<SourceAuthorityCommit | 'source' | 'lost'> {
     const owner = { ownerId: primary.ownerId, leaseGeneration: primary.ownerLeaseGeneration };
     const store = this.requireLocationStore();
     for (;;) {
-      if (this.disposed) throw new Error('Relocation runtime stopped.');
+      if (this.disposed) {
+        this.completeSourceRelocationMetric(relocationMetric, undefined, true);
+        throw new ServiceRelocationRuntimeStoppedError();
+      }
       await this.resendSourceCutover(window);
       const observed = await this.readSourceSettlement(envelope, primary, target).catch(
         (error: unknown) => {
@@ -2705,7 +2938,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           return undefined;
         }
       );
-      if (observed?.kind === 'target') return 'target';
+      if (observed?.kind === 'target') return observed;
       if (observed?.kind === 'other') return 'lost';
       if (restoreDeadlineReached() && observed?.kind === 'source') {
         // An unreadable lease is an uncertain result, not an expiry.
@@ -2748,12 +2981,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     primary: ZLinkAuthoritySnapshot,
     target: ServiceWireRelocationTarget
   ): Promise<
-    | { readonly kind: 'target' }
+    | SourceAuthorityCommit
     | { readonly kind: 'source'; readonly current: ZLinkAuthoritySnapshot }
     | { readonly kind: 'other' }
   > {
     const primaryAuthorityKey = primaryKey(envelope);
     let committed = 0;
+    const followAuthorities = new Map<string, ZLinkAuthoritySnapshot>();
     let primaryCurrent: ZLinkAuthoritySnapshot | undefined;
     for (const participant of envelope.participants) {
       const current = await this.requireLocationStore().readAuthority({
@@ -2762,17 +2996,23 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       if (current.kind !== 'snapshot') return { kind: 'other' };
       if (
         current.objectGeneration === participant.objectGeneration &&
-        current.ownerId === target.ownerId &&
-        current.ownerLeaseGeneration === target.ownerLeaseGeneration &&
         current.authorityOwnerGeneration > participant.authorityOwnerGeneration &&
-        String(current.allocation.descriptor.rid) === target.nodeRid &&
-        current.allocation.descriptorLifecycleGeneration === target.nodeGeneration
+        // Location runtime §6: an owner is the (OwnerId, OwnerLeaseGeneration) pair;
+        // a restarted node keeps its OwnerId under a new lease generation.
+        (current.ownerId !== primary.ownerId ||
+          current.ownerLeaseGeneration !== primary.ownerLeaseGeneration)
       ) {
         committed += 1;
+        // Location runtime §10: only the observed first target can receive Follow.
+        if (
+          current.ownerId === target.ownerId &&
+          current.ownerLeaseGeneration === target.ownerLeaseGeneration
+        )
+          followAuthorities.set(participant.key, current);
       }
       if (participant.key === primaryAuthorityKey) primaryCurrent = current;
     }
-    if (committed === envelope.participants.length) return { kind: 'target' };
+    if (committed === envelope.participants.length) return { kind: 'target', followAuthorities };
     if (primaryCurrent !== undefined && isSourceOwner(primaryCurrent, primary)) {
       return { kind: 'source', current: primaryCurrent };
     }
@@ -2823,12 +3063,25 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     sourceNodeRid: RoutingId,
     signal?: AbortSignal
   ): Promise<ServiceMaintenanceRelocationReady> {
+    // Host relocation flow 05: a sealed target refuses a new PREPARE before any
+    // staging. The typed ShuttingDown reaches the source as relocationFailed.
+    if (this.targetAdmissionSealed()) {
+      throw new ZLinkFrameworkException(
+        ZLinkFrameworkErrorKind.ShuttingDown,
+        'Relocation target admission is sealed for shutdown.'
+      );
+    }
+    signal =
+      signal === undefined
+        ? this.targetPreparationStop.signal
+        : AbortSignal.any([signal, this.targetPreparationStop.signal]);
+    signal.throwIfAborted();
     const targetStatus = this.requireMeshNode(meshName).status();
     const targetOwner = this.options.currentOwner();
     const targetDescriptor = this.options.localDescriptor?.(meshName);
     if (
       targetOwner === undefined ||
-      String(targetStatus.routingId) !== request.target.nodeRid ||
+      !routingIdsEqual(targetStatus.routingId, request.target.nodeRid) ||
       targetStatus.lifecycleGeneration !== request.target.nodeGeneration ||
       targetOwner.ownerId !== request.target.ownerId ||
       targetOwner.leaseGeneration !== request.target.ownerLeaseGeneration ||
@@ -2858,11 +3111,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     try {
       payload = await pendingAssembly.assembly.payload();
     } catch (error) {
-      // A rejection observed after dispose() started is the runtime shutting
-      // down, not a chunk-assembly or checksum integrity failure — it must
-      // not be reported as DataLost(35). There is no dedicated ShuttingDown
-      // wire code in the vocabulary yet, so it falls through unwrapped to
-      // the generic InternalFailure code (spec 15 §4).
+      // Target shutdown preserves its lifecycle failure instead of reporting payload corruption.
+      this.targetAssemblies.delete(stagingId);
+      if (this.targetPreparationStop.signal.aborted) throw this.targetPreparationStop.signal.reason;
       if (this.disposed) throw error;
       const message =
         error !== null && typeof error === 'object' && 'message' in error
@@ -2871,23 +3122,75 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       throw new ServiceRelocationDataLostError(String(message));
     }
     const envelope = decodeServiceRelocationEnvelope(payload, request.targetAttemptGeneration);
-    const inventoryEnvelope = attachPrepareBoundSessions(
-      await this.resolveTargetParticipantInventory(request, envelope, signal),
-      request.nodeInternalBoundSessions
-    );
-    validatePrepareEnvelope(request, inventoryEnvelope);
-    const releaseActivation =
-      (await this.options.activationAdmission?.acquire(meshName, signal)) ?? (() => undefined);
+    const recovery = canonicalActorJoinRecovery(envelope.participants);
+    const releaseJoinAdmission =
+      recovery === undefined
+        ? () => undefined
+        : this.options.spotManager()!.beginActorJoinRelocation(recovery.request.handoffId);
     let materialized:
       (Pick<LocalStage, 'owner' | 'staging'> & { readonly target: LocalTargetPort }) | undefined;
     let reservation: TargetRelocationReservation | undefined;
+    let releaseActivation: () => void = () => undefined;
     try {
+      const inventoryEnvelope = attachCanonicalBoundSessions(
+        await this.resolveTargetParticipantInventory(meshName, request, envelope, signal),
+        request,
+        meshName
+      );
+      validatePrepareEnvelope(request, inventoryEnvelope);
+      releaseActivation =
+        (await this.options.activationAdmission?.acquire(meshName, signal)) ?? (() => undefined);
       // Deferred Join completion publishes into the source authority's
       // canonical relocation slot. Do that while the row is still CAS-able;
       // the aggregate marker installed by reserveTargetForPrepare deliberately
       // rejects unrelated authority CAS until commit/abort.
       materialized = await this.materializeTargetEnvelope(meshName, inventoryEnvelope, signal);
       await materialized.owner.restoreSavedWork(materialized.staging, signal);
+      for (const participant of inventoryEnvelope.participants) {
+        const binding = participant.sessionBinding;
+        if (binding === undefined) continue;
+        const peerRid = decodeRoutingId(
+          '',
+          Buffer.from(binding.sessionOwnerNodeRid).toString('hex')
+        );
+        const node = this.requireMeshNode(meshName);
+        if (routingIdsEqual(node.status().routingId, peerRid)) continue;
+        if (node.isPeerRouteReady?.(peerRid, binding.sessionOwnerNodeGeneration) !== true) {
+          // Subscribe before requesting reconciliation so a synchronous admission cannot be lost.
+          const wait = node.waitForPeerRoute;
+          if (wait === undefined) throw new Error('Mesh peer route observation is unavailable.');
+          const ready = wait.call(
+            node,
+            peerRid,
+            binding.sessionOwnerNodeGeneration,
+            request.deadlineUnixMs,
+            signal
+          );
+          void this.options
+            .requestPeerReconcile?.(meshName, String(peerRid))
+            .catch((error) =>
+              console.error('[zlink.runtime.relocation.session_route_reconcile_failed]', error)
+            );
+          try {
+            await ready;
+          } catch (error) {
+            if (error instanceof OperationTimeoutError) {
+              throw new ZLinkFrameworkException(
+                ZLinkFrameworkErrorKind.DeadlineExceeded,
+                'Relocation source operation deadline exceeded waiting for Session owner route.'
+              );
+            }
+            throw error;
+          }
+        }
+      }
+      if (request.deadlineUnixMs <= BigInt(Date.now())) {
+        throw new ZLinkFrameworkException(
+          ZLinkFrameworkErrorKind.DeadlineExceeded,
+          'Relocation source operation deadline exceeded before relay-ready.'
+        );
+      }
+      signal.throwIfAborted();
       reservation = await this.reserveTargetForPrepare(
         meshName,
         request,
@@ -2897,7 +3200,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       const offer: TargetRelocationOffer = {
         prepare: request,
         prepareFingerprint: fingerprint,
-        authenticatedSourceNodeRid: String(sourceNodeRid),
+        authenticatedSourceNodeRid: sourceNodeRid,
         envelope: inventoryEnvelope,
         reservation
       };
@@ -2908,10 +3211,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         lane: Promise.resolve(),
         cutoverReceived: false,
         boundaryRelay: [],
-        releaseActivation
+        releaseActivation,
+        releaseJoinAdmission
       };
       this.targetStages.set(stagingId, stage);
     } catch (error) {
+      this.targetAssemblies.delete(stagingId);
+      releaseJoinAdmission();
       releaseActivation();
       if (reservation !== undefined) {
         await this.abortTargetReservation(reservation, signal).catch(() => undefined);
@@ -3078,30 +3384,51 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       stage.releaseActivation();
       resumeStartedAt = performance.now();
       stage.phase = 'committed';
-      await stage.owner.normalize(stage.staging, authority, signal);
       await stage.owner.publish(stage.staging, authority, signal);
-      // The target may have visited this Actor before and still retain that
-      // tenure in its private Actor-client resolver. The target-only CAS is
-      // now authoritative, so expire the old projection before OnJoinedActor
-      // can issue an Actor request and deadlock behind source leave.
-      for (const hidden of stage.staging.hidden.values()) {
-        if (hidden.actor !== undefined) {
-          this.options.invalidateActorRoute?.(hidden.actor.context.actorId);
-        }
-      }
-      await this.finalizeActorJoinProfiles(meshName, stage, signal);
       // Clear the final relocation publication before admission becomes
       // externally visible so a later Join cannot reserve against the
       // previous root. A bounded CAS conflict must not roll back already
       // committed target ownership or strand its staged object.
       try {
-        await this.clearTargetRelocationPublication(stage, authority, signal);
+        authority = await this.clearTargetRelocationPublication(stage, authority, signal);
       } catch (error) {
         console.warn('[zlink.runtime.relocation.publication_clear_failed]', stagingId, error);
         this.options.metrics?.count('zlink.relocation.publication_clear_failed', 1, {
           mesh_name: meshName
         });
       }
+      for (const [index, participant] of stage.staging.envelope.participants.entries()) {
+        const hidden = stage.staging.hidden.get(participant.key);
+        if (hidden?.actor === undefined || hidden.replayPackets.length === 0) continue;
+        const coordinator = this.targetReplyRelayCoordinator(meshName, stage, authority);
+        hidden.replayStart = stage.finalize;
+        hidden.onReplayResult = (packet, result) =>
+          this.relayTerminalReply(
+            meshName,
+            stage,
+            coordinator,
+            BigInt(index + 1),
+            packet,
+            result,
+            signal
+          );
+      }
+      await stage.owner.normalize(stage.staging, authority, signal);
+      // The target may have visited this Actor before and still retain that
+      // tenure in its private Actor-client resolver. The target-only CAS is
+      // now authoritative, so expire the old projection before OnJoinedActor
+      // can issue an Actor request and deadlock behind source leave.
+      for (const hidden of stage.staging.hidden.values()) {
+        if (hidden.actor !== undefined) {
+          this.options.invalidateActorRoute?.(hidden.actor.context.actorId);
+        }
+      }
+      await this.finalizeActorJoinProfiles(meshName, stage, signal);
+      await this.publishSessionRoutes(stage.staging);
+      stage.phase = 'open';
+      this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
+      this.targetStages.delete(stagingId);
+      this.targetAssemblies.delete(stagingId);
       await stage.owner.openAdmission(stage.staging, signal);
       // S2→S3: owner confirmation to application dispatch opening.
       this.options.metrics?.duration(
@@ -3109,17 +3436,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         Math.max(0, performance.now() - resumeStartedAt) / MILLISECONDS_PER_SECOND,
         { mesh_name: meshName }
       );
-      await this.publishSessionRoutes(stage.staging);
-      await this.relayTerminalReplies(
-        meshName,
-        stage,
-        this.targetReplyRelayCoordinator(meshName, stage, authority),
-        signal
-      );
-      stage.phase = 'open';
-      this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
-      this.targetStages.delete(stagingId);
-      this.targetAssemblies.delete(stagingId);
     } catch (error) {
       this.terminalTargets.remember(stagingId, stage.offer.prepareFingerprint);
       this.targetStages.delete(stagingId);
@@ -3134,6 +3450,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         throw new ServiceRelocationPostCommitError(authority, stage.staging, error);
       }
       throw error;
+    } finally {
+      stage.releaseJoinAdmission();
     }
   }
 
@@ -3154,7 +3472,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       target.generation !== request.object.objectGeneration ||
       target.targetNodeRid !== preparedTarget.nodeRid ||
       target.targetNodeGeneration !== preparedTarget.nodeGeneration ||
-      target.authorityOwnerGeneration !== request.object.expectedAuthorityOwnerGeneration + 1n ||
+      target.authorityOwnerGeneration !== request.object.expectedAuthorityOwnerGeneration ||
       target.ownerLeaseGeneration !== preparedTarget.ownerLeaseGeneration
     ) {
       throw new Error('Relocation data does not target the exact temporary Actor queue.');
@@ -3263,9 +3581,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (profile.state.actorId !== input.actorId || !input.succeeded) {
       throw new Error(`Actor Join relocation '${input.transferId}' source leave identity changed.`);
     }
-    this.sourceActorJoinProfiles.delete(input.transferId);
-    this.terminalActorJoinSourceLeaves.remember(input.transferId, input.actorId);
-    void this.finalizeActorJoinSource(profile);
+    void this.retireActorJoinSource(input.transferId, profile);
     return true;
   }
 
@@ -3293,7 +3609,9 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   ): Promise<void> {
     const submitted = await this.sendInfrastructureControl(meshName, targetNodeRid, frame);
     if (submitted !== SubmitResult.Ok) {
-      throw new Error(`Relocation ${kind} was not accepted by RouteMesh.`);
+      throw new ZLinkBackendResultError('submit', submitted, undefined, {
+        cause: new Error(`Relocation ${kind} was not accepted by RouteMesh.`)
+      });
     }
   }
 
@@ -3301,7 +3619,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     stage: LocalStage,
     primary: ZLinkAuthoritySnapshot,
     signal?: AbortSignal
-  ): Promise<void> {
+  ): Promise<ZLinkAuthoritySnapshot> {
     await this.releaseParticipantAuthorities(
       stage.staging.envelope,
       stage.staging.primaryAuthorityKey.value,
@@ -3312,7 +3630,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     //  committed snapshot decides. A conflict means another owner changed the
     //  row; the caller records it and leaves the committed ownership intact.
     const publication = this.codec.read(primary.payload);
-    if (publication === undefined) return;
+    if (publication === undefined) return primary;
     const result = await this.requireLocationStore().compareExchangeAuthority(
       stage.staging.primaryAuthorityKey,
       primary.storeVersion,
@@ -3326,6 +3644,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (result.kind !== 'stored') {
       throw new Error('Relocation target authority normalization CAS failed.');
     }
+    return { ...result, kind: 'snapshot' };
   }
 
   private async handleReplyRelay(
@@ -3337,49 +3656,53 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     if (sourceNodeRid === null) {
       throw new Error('Relocation reply relay has no authenticated target node.');
     }
-    await this.requireAdmittedPeer(meshName, String(sourceNodeRid), relay.coordinator, signal);
-    const relocationId = wireIdText(relay.relocation);
-    const authorityKey = this.relocationAuthorityKeys.get(relocationId);
-    if (authorityKey === undefined) {
-      throw new Error('Relocation reply relay has no registered durable authority.');
-    }
-    const authority = await requireAuthority(
-      this.requireLocationStore(),
-      { value: authorityKey } as ZLinkAuthorityKey,
-      signal
-    );
-    if (
-      authority.storeVersion.value !== relay.coordinator.expectedAuthorityStoreVersion ||
-      authority.ownerId !== relay.coordinator.ownerId ||
-      authority.ownerLeaseGeneration !== relay.coordinator.leaseGeneration ||
-      String(authority.allocation.descriptor.rid) !== relay.coordinator.nodeRid ||
-      authority.allocation.descriptorLifecycleGeneration !== relay.coordinator.nodeGeneration
-    ) {
-      throw new Error('Relocation reply relay coordinator authority fence is stale.');
-    }
-    const accepted = this.options.actorTransfer.relayCanonicalMaintenanceTerminal(
-      wireIdText(relay.operation),
-      relay.replyRouteId.toString(),
-      handoffResultFromRelay(relay),
-      sourceNodeRid
-    );
-    if (
-      (accepted.status !== 'terminalReceived' && accepted.status !== 'alreadyTerminal') ||
-      accepted.source === undefined
-    ) {
-      throw new Error('Canonical relocation reply relay collided with another source route.');
-    }
-    const requestSource = handoffSourceFence(accepted.source);
-    const localStatus = this.requireMeshNode(meshName).status();
+    await this.requireAdmittedPeer(meshName, sourceNodeRid, relay.coordinator, signal);
+    const node = this.requireMeshNode(meshName);
+    const localStatus = node.status();
     const localOwner = this.options.currentOwner();
-    if (
-      localOwner === undefined ||
-      requestSource.ownerId !== localOwner.ownerId ||
-      requestSource.leaseGeneration !== localOwner.leaseGeneration ||
-      !routingIdsEqual(requestSource.nodeRid, localStatus.routingId) ||
-      requestSource.nodeGeneration !== localStatus.lifecycleGeneration
-    ) {
-      throw new Error('Relocation reply relay request-source fence changed after capture.');
+    if (localOwner === undefined)
+      throw new Error('Relocation requester owner lease is unavailable.');
+    let status = node.acceptRelocatedActorTerminal?.(relay.operation, relay.replyRouteId, {
+      terminalResult: relay.terminalResult,
+      failureCode: relay.failureCode,
+      ...(relay.payload === undefined
+        ? {}
+        : {
+            payload: {
+              packetName: relay.payload.packetName,
+              contentType: relay.payload.contentType,
+              payload: Buffer.from(relay.payload.bytes)
+            }
+          })
+    });
+    let requestSource: ServiceWireRequestSourceFence = {
+      ownerId: localOwner.ownerId,
+      leaseGeneration: localOwner.leaseGeneration,
+      nodeRid: localStatus.routingId,
+      nodeGeneration: localStatus.lifecycleGeneration
+    };
+    if (status === undefined) {
+      const accepted = this.options.actorTransfer.relayCanonicalMaintenanceTerminal(
+        relay.operation.high.toString(16).padStart(16, '0') +
+          relay.operation.low.toString(16).padStart(16, '0'),
+        relay.replyRouteId.toString(),
+        handoffResultFromRelay(relay),
+        sourceNodeRid
+      );
+      if (accepted.status === 'notAcknowledged' || accepted.source === undefined) {
+        throw new Error('Canonical relocation reply relay collided with another source route.');
+      }
+      requestSource = handoffSourceFence(accepted.source);
+      if (
+        !sameRequestSource(requestSource, {
+          ownerId: localOwner.ownerId,
+          leaseGeneration: localOwner.leaseGeneration,
+          nodeRid: localStatus.routingId,
+          nodeGeneration: localStatus.lifecycleGeneration
+        })
+      )
+        throw new Error('Relocation reply relay request-source fence changed after capture.');
+      status = accepted.status;
     }
     const ack: ServiceMaintenanceReplyRelayAck = {
       relocation: relay.relocation,
@@ -3387,7 +3710,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       operation: relay.operation,
       replyRouteId: relay.replyRouteId,
       requestSource,
-      status: accepted.status
+      status
     };
     if (
       (await this.sendInfrastructureControl(
@@ -3407,9 +3730,8 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     expectedRequestSource: ServiceWireRequestSourceFence,
     signal?: AbortSignal
   ): Promise<RelocationTerminalDelivery> {
-    const targetRid = String(ackTargetNodeRid);
     const identityKey = replyRelayIdentityKey(request);
-    const key = replyRelayPendingKey(targetRid, request);
+    const key = replyRelayPendingKey(ackTargetNodeRid, request);
     if (this.pendingReplyRelays.has(key)) {
       throw new Error(`Relocation reply relay ACK '${key}' is already pending.`);
     }
@@ -3422,7 +3744,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         action();
       };
       const pending: PendingRelocationReplyRelay = {
-        ackTargetNodeRid: targetRid,
+        ackTargetNodeRid,
         identityKey,
         request,
         expectedRequestSource,
@@ -3467,8 +3789,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     signal?: AbortSignal
   ): Promise<void> {
     const identityKey = replyRelayIdentityKey(ack);
-    const exactKey =
-      sourceNodeRid === null ? undefined : replyRelayPendingKey(String(sourceNodeRid), ack);
+    const exactKey = sourceNodeRid === null ? undefined : replyRelayPendingKey(sourceNodeRid, ack);
     const pending = exactKey === undefined ? undefined : this.pendingReplyRelays.get(exactKey);
     if (pending === undefined) {
       const collision = [...this.pendingReplyRelays.values()].find(
@@ -3506,14 +3827,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     signal?: AbortSignal
   ): Promise<void> {
     const descriptor = (await this.options.liveDescriptors(meshName, signal)).find(
-      (value) => String(value.rid) === authenticatedRid && value.state === 1
+      (value) => routingIdsEqual(value.rid, authenticatedRid) && value.state === 1
     );
     if (
       descriptor === undefined ||
       (expected !== undefined &&
         (descriptor.ownerId !== expected.ownerId ||
           descriptor.leaseGeneration !== expected.leaseGeneration ||
-          String(descriptor.rid) !== expected.nodeRid ||
+          !routingIdsEqual(descriptor.rid, expected.nodeRid) ||
           descriptor.lifecycleGeneration !== expected.nodeGeneration))
     ) {
       throw new Error('Relocation reply relay peer is not the exact admitted source fence.');
@@ -3532,7 +3853,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       owner === undefined ||
       owner.ownerId !== target.ownerId ||
       owner.leaseGeneration !== target.ownerLeaseGeneration ||
-      String(status.routingId) !== target.nodeRid ||
+      !routingIdsEqual(status.routingId, target.nodeRid) ||
       status.lifecycleGeneration !== target.nodeGeneration
     ) {
       throw new Error('Relocation reply relay target coordinator fence is stale.');
@@ -3540,42 +3861,47 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     return {
       ownerId: owner.ownerId,
       leaseGeneration: owner.leaseGeneration,
-      nodeRid: String(status.routingId),
+      nodeRid: status.routingId,
       nodeGeneration: status.lifecycleGeneration,
       expectedAuthorityStoreVersion: authority.storeVersion.value
     };
   }
 
-  private async relayTerminalReplies(
+  private async relayTerminalReply(
     meshName: string,
     stage: LocalStage,
     coordinator: ServiceWireRelocationCoordinatorFence,
+    participantId: bigint,
+    packet: ZLinkActorHandoffPacket,
+    result: ZLinkActorHandoffResult,
     signal?: AbortSignal
   ): Promise<void> {
-    for (const [participantIndex, participant] of stage.staging.envelope.participants.entries()) {
-      const hidden = stage.staging.hidden.get(participant.key);
-      if (hidden?.actor === undefined) continue;
-      for (const [resultIndex, packet] of hidden.replayPackets.entries()) {
-        if (!packet.returnResponse || packet.source === undefined) continue;
-        const result = hidden.replayResults.at(resultIndex);
-        if (result === undefined || result.index !== packet.index) {
-          throw new Error('Relocation request result changed after target dispatch.');
-        }
-        const completion: RelocationTerminalCompletion = {
-          index: packet.index,
-          operationId: packet.messageFollowContext.operationId,
-          source: packet.source,
-          result
-        };
-        await this.sendReplyRelay(
-          meshName,
-          packet.source.nodeRid as RoutingId,
-          maintenanceReplyRelay(stage, coordinator, BigInt(participantIndex + 1), completion),
-          handoffSourceFence(packet.source),
-          signal
-        );
-      }
-    }
+    if (!packet.returnResponse || packet.source === undefined) return;
+    if (result.index !== packet.index) {
+      throw new Error('Relocation request result changed after target dispatch.');
+    }
+    const completion: RelocationTerminalCompletion = {
+      index: packet.index,
+      operationId: packet.messageFollowContext.operationId,
+      source: packet.source,
+      result
+    };
+    const source = handoffSourceFence(packet.source);
+    await this.sendReplyRelay(
+      meshName,
+      source.nodeRid,
+      maintenanceReplyRelay(
+        stage,
+        coordinator,
+        participantId,
+        completion,
+        packet,
+        this.options.registration.messageSerializers,
+        this.options.flowCreationEnabled?.() ?? false
+      ),
+      source,
+      signal
+    );
   }
 
   private async exactSourceLeaseExpired(
@@ -3611,70 +3937,39 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     request: ZLinkServiceRelocationControlRequest,
     signal?: AbortSignal,
     deadlineAtMs: number = performance.now() + RELOCATION_OPERATION_TIMEOUT_MS,
-    sideband: readonly Uint8Array[] = []
+    onSubmitted?: (signal: AbortSignal) => Promise<void>
   ): Promise<ReturnType<typeof decodeServiceRelocationControlResponse>> {
     const key = controlAckKey(request);
-    const frames =
-      sideband.length === 0
-        ? [encodeServiceRelocationControlRequest(request)]
-        : [encodeServiceRelocationControlRequest(request), ...sideband];
-    let lastRequestError: unknown;
-    for (;;) {
-      signal?.throwIfAborted();
-      const remainingMs = deadlineAtMs - performance.now();
-      if (remainingMs <= 0) {
-        throw createInternalFrameworkException(
-          ZLinkFrameworkInternalErrorKind.DeadlineExceeded,
-          `Relocation control ACK '${key}' timed out.`,
-          true,
-          lastRequestError
-        );
-      }
-      const attemptTimeoutMs = Math.max(
-        1,
-        Math.min(RELOCATION_ATTEMPT_TIMEOUT_MS, Math.ceil(remainingMs))
+    const frames = [encodeServiceRelocationControlRequest(request)];
+    signal?.throwIfAborted();
+    const remainingMs = Math.ceil(deadlineAtMs - performance.now());
+    if (remainingMs <= 0) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.DeadlineExceeded,
+        `Relocation control ACK '${key}' timed out.`,
+        true
       );
-      const startedAtMs = performance.now();
-      try {
-        const replyFrames = await this.requestInfrastructureControl(
-          meshName,
-          targetNodeRid,
-          frames,
-          attemptTimeoutMs
-        );
-        if (replyFrames.length !== 1) {
-          throw new ServiceWireProtocolError(
-            `Relocation control '${key}' reply must contain exactly one frame.`
-          );
-        }
-        const response = decodeServiceRelocationControlResponse(Buffer.from(replyFrames[0]!));
-        if (response.kind === 'failed') {
-          validateControlFailureResponse(request, response);
-          throw relocationFailureException(response);
-        }
-        validateControlResponse(request, response);
-        return response;
-      } catch (error) {
-        if (error instanceof ServiceWireProtocolError || error instanceof ZLinkFrameworkException) {
-          throw error;
-        }
-        lastRequestError = error;
-        if (isRelocationDebugEnabled()) {
-          relocationDebug('control.request_retry', {
-            key,
-            kind: request.kind,
-            targetRid: String(targetNodeRid)
-          });
-        }
-        const retryDelayMs = Math.min(
-          Math.max(0, attemptTimeoutMs - (performance.now() - startedAtMs)),
-          Math.max(0, deadlineAtMs - performance.now())
-        );
-        if (retryDelayMs > 0) {
-          await waitForRelocationRetry(retryDelayMs, signal);
-        }
-      }
     }
+    const replyFrames = await this.requestInfrastructureControl(
+      meshName,
+      targetNodeRid,
+      frames,
+      remainingMs,
+      signal,
+      onSubmitted
+    );
+    if (replyFrames.length !== 1) {
+      throw new ServiceWireProtocolError(
+        `Relocation control '${key}' reply must contain exactly one frame.`
+      );
+    }
+    const response = decodeServiceRelocationControlResponse(Buffer.from(replyFrames[0]!));
+    if (response.kind === 'failed') {
+      validateControlFailureResponse(request, response);
+      throw relocationFailureException(response);
+    }
+    validateControlResponse(request, response);
+    return response;
   }
 
   private async selectTarget(
@@ -3687,13 +3982,13 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const descriptors = await this.options.liveDescriptors(meshName, signal);
     const local =
       this.options.localDescriptor?.(meshName) ??
-      descriptors.find((descriptor) => String(descriptor.rid) === localRid);
+      descriptors.find((descriptor) => routingIdsEqual(descriptor.rid, localRid));
     const requiredVersion = targetApplicationVersion ?? local?.applicationVersion;
     const peers = this.requireMeshNode(meshName).peers();
     const candidates = descriptors
       .filter(
         (descriptor) =>
-          String(descriptor.rid) !== localRid &&
+          !routingIdsEqual(descriptor.rid, localRid) &&
           descriptor.state === ZLinkFrameworkRuntimeState.Serving &&
           descriptor.objectRole === ZLinkObjectRole.Server &&
           descriptor.placementWeight > 0 &&
@@ -3703,7 +3998,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           peers.some(
             (peer) =>
               peer.routingId !== null &&
-              String(peer.routingId) === String(descriptor.rid) &&
+              routingIdsEqual(peer.routingId, descriptor.rid) &&
               peer.lifecycleGeneration === descriptor.lifecycleGeneration &&
               peer.state === MeshPeerRuntimeState.Serving
           ) &&
@@ -3761,7 +4056,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     const publication = relocationPublication(prepare, envelope);
     const participants = envelope.participants.map((participant) => {
       const expected = authorities.get(participant.key)!;
-      const membership = actorMembershipTarget(envelope, participant.key);
+      const membership = actorMembershipTarget(
+        envelope.memberships.find((value) => value.actorKey === participant.key),
+        this.options.localDescriptor?.(meshName)
+      );
       const entrySpotId =
         expected.allocation.objectKind === 'actor' && membership === undefined
           ? this.options.spotManager()?.entrySpotIdForMesh(meshName)
@@ -3788,18 +4086,14 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
           objectGeneration: expected.objectGeneration,
           targetAttemptGeneration: prepare.targetAttemptGeneration,
           coordinatorExpectedStoreVersion: expected.storeVersion.value,
-          ...(membership === undefined
-            ? expected.allocation.objectKind === 'actor'
+          ...(membership ??
+            (expected.allocation.objectKind === 'actor'
               ? {
                   actorSpotId: entrySpotId!,
                   actorSpotGeneration: prepare.target.nodeGeneration,
                   actorSpotKind: ZLinkSpotKind.Entry as const
                 }
-              : {}
-            : {
-                ...membership,
-                actorSpotKind: ZLinkSpotKind.User as const
-              })
+              : {}))
         }),
         membershipMutation: encodeMembershipMutation(envelope.memberships, participant.key)
       };
@@ -3934,6 +4228,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       failures.push(error);
     }
     stage.phase = 'failed';
+    stage.releaseJoinAdmission();
     if (failures.length === 1) throw failures[0];
     if (failures.length > 1) {
       throw new AggregateError(failures, 'Relocation target rollback was incomplete.');
@@ -4098,6 +4393,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
 
   /** Maps schema ordinals to the authoritative Location Store inventory. */
   private async resolveTargetParticipantInventory(
+    meshName: string,
     request: ServiceMaintenanceRelocationPrepare,
     envelope: ServiceRelocationEnvelope,
     signal?: AbortSignal
@@ -4136,7 +4432,10 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
             candidate.snapshot.payload,
             candidate.snapshot.objectGeneration
           );
-          if (actor?.spotId === request.object.spotId) {
+          if (
+            actor?.spotId === request.object.spotId &&
+            actor.spotGeneration === request.object.objectGeneration
+          ) {
             entries.push(candidate);
           }
         }
@@ -4184,21 +4483,23 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
         authorityOwnerGeneration: snapshot.authorityOwnerGeneration
       };
     });
-    // Actor-root saved work is admitted against the destination membership.
-    // The canonical root intentionally omits a membership vector; meanwhile
-    // Location Store still names the source Spot until target cutover. Rebuild
-    // the Actor lane from the already accepted ActorJoin admission, preserving
-    // the target queue boundary for decoded saved-work.
+    // Join recovery uses its accepted target membership. Maintenance Actor
+    // roots restore into the target's startup Entry incarnation (§10.1).
     const memberships =
       request.object.kind === 'actor'
-        ? actorJoinTargetMembership(manager, envelope.aggregateId, participants)
+        ? actorRootTargetMembership(
+            manager,
+            envelope.aggregateId,
+            participants,
+            this.options.localDescriptor?.(meshName)
+          )
         : entries
             .filter((entry) => entry.snapshot.allocation.objectKind === 'actor')
             .map((entry) => ({
               actorKey: entry.key.value,
               spotKey: primaryKey.value,
               spotObjectGeneration: primary.objectGeneration,
-              membershipEpoch: 1n
+              membershipEpoch: INITIAL_MEMBERSHIP_EPOCH
             }));
     return {
       ...envelope,
@@ -4285,8 +4586,7 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     meshName: string,
     unitKind: 'actor' | 'user_spot' | 'instance_spot',
     executionMode: 'spot_wide' | 'per_actor' | undefined,
-    startedAt: number,
-    outcome: string
+    startedAt: number
   ): void {
     const seconds = Math.max(0, performance.now() - startedAt) / MILLISECONDS_PER_SECOND;
     const attributes = {
@@ -4294,12 +4594,6 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
       ...(executionMode === undefined ? {} : { execution_mode: executionMode })
     };
     this.options.metrics?.duration(METRIC_NAMES.RelocationInterruption, seconds, attributes);
-    this.options.metrics?.count(METRIC_NAMES.RelocationCompleted, 1, {
-      mesh_name: meshName,
-      object_kind: unitKind,
-      policy: unitKind === 'user_spot' && executionMode === 'per_actor' ? 'recreate' : 'configured',
-      outcome
-    });
     if (seconds <= 1) return;
     console.warn(
       `[zlink.runtime.relocation.changed] ${unitKind} admission interruption ` +
@@ -4353,30 +4647,30 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
   private async commitSpotMessageFollow(
     meshName: string,
     seal: ServiceSpotMessageFollowSeal,
-    authorityKey: ZLinkAuthorityKey,
-    activation: ZLinkSpotActivation,
-    target: ZLinkMeshNodeDescriptor
+    committed: ZLinkAuthoritySnapshot | undefined,
+    activation: ZLinkSpotActivation
   ): Promise<void> {
     const node = this.requireMeshNode(meshName);
     const commit = node.commitSpotMessageFollowIngress;
     if (commit === undefined) {
       throw new Error('Spot Message Follow backend support is incomplete.');
     }
-    const committed = await requireAuthority(this.requireLocationStore(), authorityKey);
     const accepted = await commit.call(
       node,
       seal,
-      {
-        spot: {
-          spotId: String(activation.spotId),
-          generation: committed.objectGeneration
-        },
-        targetNodeRid: String(target.rid),
-        targetNodeGeneration: target.lifecycleGeneration,
-        authorityOwnerGeneration: committed.authorityOwnerGeneration,
-        ownerLeaseGeneration: committed.ownerLeaseGeneration,
-        storeVersion: committed.storeVersion.value
-      },
+      committed === undefined
+        ? null
+        : {
+            spot: {
+              spotId: String(activation.spotId),
+              generation: committed.objectGeneration
+            },
+            targetNodeRid: String(committed.allocation.descriptor.rid),
+            targetNodeGeneration: committed.allocation.descriptorLifecycleGeneration,
+            authorityOwnerGeneration: committed.authorityOwnerGeneration,
+            ownerLeaseGeneration: committed.ownerLeaseGeneration,
+            storeVersion: committed.storeVersion.value
+          },
       this.relocationLimits().messageFollowDurationMs
     );
     if (!accepted) {
@@ -4482,17 +4776,40 @@ export class ZLinkHostServiceRelocationRuntime implements ZLinkActorJoinRelocati
     meshName: string,
     targetNodeRid: RoutingId,
     frames: readonly Uint8Array[],
-    timeoutMs: number
+    timeoutMs: number,
+    signal?: AbortSignal,
+    onSubmitted?: (signal: AbortSignal) => Promise<void>
   ): Promise<readonly Uint8Array[]> {
     const node = this.requireMeshNode(meshName);
     const request = node.requestInfrastructureControlFrames;
     if (request === undefined) {
       throw new Error('RouteMesh backend cannot submit bare infrastructure requests.');
     }
-    return await request.call(node, targetNodeRid, frames, { timeoutMs });
+    return await request.call(node, targetNodeRid, frames, { timeoutMs, signal, onSubmitted });
   }
 }
 
+function committedSpotRoute<TKind extends ZLinkSpotKind.User | ZLinkSpotKind.Instance>(
+  meshName: string,
+  spotId: RoutingId,
+  spotKind: TKind,
+  targetNodeRid: RoutingId,
+  authority: ZLinkAuthoritySnapshot | undefined
+): ZLinkSpotRouteTarget & { readonly spotKind: TKind } {
+  return {
+    routerChannelId: meshName,
+    targetNodeRid,
+    spotId,
+    spotKind,
+    targetSpotGeneration: authority?.objectGeneration,
+    targetNodeGeneration: authority?.allocation.descriptorLifecycleGeneration,
+    authorityOwnerGeneration: authority?.authorityOwnerGeneration,
+    targetOwnerId: authority?.ownerId,
+    ownerLeaseGeneration: authority?.ownerLeaseGeneration,
+    authorityStoreVersion: authority?.storeVersion.value
+  };
+}
+
 function canonicalActorJoinRecovery(
   participants: readonly ServiceRelocationParticipant[]
 ): CanonicalActorJoinRecovery | undefined {
@@ -4514,13 +4831,28 @@ function actorJoinAdmissionIdentity(envelope: ServiceRelocationEnvelope): string
   );
 }
 
-function actorJoinTargetMembership(
+function actorRootTargetMembership(
   manager: DefaultZLinkSpotManager | undefined,
   relocationId: string,
-  participants: readonly ServiceRelocationParticipant[]
+  participants: readonly ServiceRelocationParticipant[],
+  localDescriptor: ZLinkMeshNodeDescriptor | undefined
 ): readonly ServiceRelocationMembership[] {
   const recovery = canonicalActorJoinRecovery(participants);
-  const admissionId = recovery?.request.handoffId ?? relocationId;
+  const actor = participants.find((value) => value.objectKind === 'actor');
+  if (recovery === undefined) {
+    if (actor === undefined || localDescriptor?.entrySpotId === undefined) {
+      throw new Error(`Actor relocation '${relocationId}' has no target Entry membership.`);
+    }
+    return [
+      {
+        actorKey: actor.key,
+        spotKey: encodeAuthorityKey('user_spot', localDescriptor.entrySpotId).value,
+        spotObjectGeneration: localDescriptor.lifecycleGeneration,
+        membershipEpoch: INITIAL_MEMBERSHIP_EPOCH
+      }
+    ];
+  }
+  const admissionId = recovery.request.handoffId;
   const admission = (
     manager as unknown as
       | {
@@ -4538,7 +4870,6 @@ function actorJoinTargetMembership(
         }
       | undefined
   )?.formalRemoteActorAdmissions?.get(admissionId);
-  const actor = participants.find((value) => value.objectKind === 'actor');
   if (admission === undefined || actor === undefined) {
     throw new Error(`Actor relocation '${relocationId}' has no accepted target membership.`);
   }
@@ -4565,23 +4896,27 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
   ): Promise<LocalHidden> {
     const identity = decodeAuthorityKey({ value: participant.key } as ZLinkAuthorityKey).globalId;
     if (participant.objectKind === 'actor') {
+      if (participant.timers.length !== 0) {
+        throw new Error('Actor relocation cannot restore a Spot timer.');
+      }
       const membership = this.envelope.memberships.find(
         (value) => value.actorKey === participant.key
       );
       if (membership === undefined)
         throw new Error(`Actor '${identity}' relocation membership is missing.`);
-      const spotIdentity = decodeAuthorityKey({
-        value: membership.spotKey
-      } as ZLinkAuthorityKey).globalId;
-      const localDescriptor = this.options.localDescriptor?.(this.meshName);
-      const nativeEntrySpot = localDescriptor?.entrySpotId === spotIdentity;
+      const targetMembership = actorMembershipTarget(
+        membership,
+        this.options.localDescriptor?.(this.meshName)
+      )!;
       const actor = await this.requireActorManager().prepareRelocationActor(
         identity,
         participant.stableType,
         participant.objectGeneration,
-        participant.authorityOwnerGeneration + 1n,
-        nativeEntrySpot ? undefined : (spotIdentity as RoutingId),
-        membership.spotObjectGeneration,
+        participant.authorityOwnerGeneration,
+        targetMembership.actorSpotKind === ZLinkSpotKind.Entry
+          ? undefined
+          : (targetMembership.actorSpotId as RoutingId),
+        targetMembership.actorSpotGeneration,
         membership.membershipEpoch,
         signal
       );
@@ -4590,8 +4925,6 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
         participant,
         actor,
         initialized: false,
-        restoredTimers: [],
-        replayResults: [],
         replayPackets: []
       };
     }
@@ -4603,7 +4936,20 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
       registration.implementation as Type<ZLinkSpot | ZLinkInstanceSpot>,
       identity as RoutingId,
       participant.objectGeneration,
-      participant.authorityOwnerGeneration + 1n,
+      participant.authorityOwnerGeneration,
+      participant.timers.map((value) => ({
+        name: value.timerId,
+        handlerType: value.handlerType,
+        periodMs: value.intervalMs,
+        overrunPolicy: value.overrunPolicy as never,
+        maxCatchUpTicks: value.maxCatchUpTicks,
+        stopOnUnhandledException: value.stopOnUnhandledException,
+        startedAtUnixMs: value.startedAtUnixMs,
+        deliveryIndex: value.deliveryIndex,
+        lastScheduledIndex: value.lastScheduledIndex,
+        nextDueAtUnixMs: value.dueAtUnixMs,
+        pendingTicks: value.pendingTicks
+      })),
       signal
     );
     return {
@@ -4611,8 +4957,6 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
       participant,
       activation,
       initialized: false,
-      restoredTimers: [],
-      replayResults: [],
       replayPackets: []
     };
   }
@@ -4654,9 +4998,11 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
   ): Promise<void> {
     for (const membership of memberships) {
       const actor = hidden.get(membership.actorKey)?.actor;
-      const spotIdentity = decodeAuthorityKey({
-        value: membership.spotKey
-      } as ZLinkAuthorityKey).globalId;
+      const targetMembership = actorMembershipTarget(
+        membership,
+        this.options.localDescriptor?.(this.meshName)
+      )!;
+      const spotIdentity = targetMembership.actorSpotId;
       const spot =
         hidden.get(membership.spotKey)?.activation ??
         this.requireSpotManager().resolveRelocationActivation(
@@ -4665,9 +5011,7 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
         );
       if (actor === undefined) throw new Error('Relocation membership Actor staging is missing.');
       const state = this.requireActorManager().getState(actor.context.actorId)!;
-      const localDescriptor = this.options.localDescriptor?.(this.meshName);
-      const isEntryMembership = localDescriptor?.entrySpotId === spotIdentity;
-      if (isEntryMembership) {
+      if (targetMembership.actorSpotKind === ZLinkSpotKind.Entry) {
         // Entry Spot identity is published as a Location membership key, but
         // it is not a User Spot activation in the Actor runtime. The native
         // restore already received the target MeshNode RID as its Entry
@@ -4675,7 +5019,12 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
         // local Entry Spot path after the target commit.
         state.clearJoinedSpot();
       } else {
-        state.setJoinedSpot(spotIdentity as RoutingId, spot?.spot, membership.membershipEpoch);
+        state.setJoinedSpot(
+          spotIdentity as RoutingId,
+          spot?.spot,
+          membership.membershipEpoch,
+          membership.spotObjectGeneration
+        );
       }
       spot?.commitActorJoin(actor);
     }
@@ -4798,66 +5147,31 @@ class LocalTargetPort implements ServiceRelocationTargetObjectPort<LocalHidden>
   }
 
   async openAdmission(hidden: LocalHidden): Promise<void> {
-    if (hidden.actor === undefined) return;
-    this.requireActorManager().publishRelocationActor(hidden.actor.context.actorId);
-    if (hidden.replayPackets.length === 0) return;
-    const state = this.requireActorManager().getState(hidden.actor.context.actorId);
-    if (state === undefined) throw new Error('Relocated Actor state is not staged.');
-    const results = await replayActorHandoffBacklog(
-      hidden.replayPackets,
-      (parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef) => {
-        if (state.spotId === undefined) {
-          const runtime = this.options.spotNodeRuntime();
-          if (runtime === undefined) {
-            throw new Error('Relocated Entry Spot Actor dispatch is unavailable.');
-          }
-          return runtime.dispatchEntryActorPacket(
-            'remote',
-            hidden.actor!.context.actorId,
-            parts,
-            returnResponse,
-            remoteBoundSessionTarget,
-            fallbackActorRef
-          );
-        }
-        return this.requireSpotManager().dispatchRoutedActorPacket(
-          'remote',
-          state.spotId,
-          hidden.actor!.context.actorId,
-          parts,
-          returnResponse,
-          remoteBoundSessionTarget,
-          fallbackActorRef
-        );
-      }
-    );
-    hidden.replayResults.push(...results);
+    if (hidden.actor !== undefined) {
+      this.requireActorManager().publishRelocationActor(hidden.actor.context.actorId);
+      this.requireSpotManager().openActorJoinRelocation(
+        this.meshName,
+        actorJoinAdmissionIdentity(this.envelope),
+        hidden.actor
+      );
+    }
   }
 
-  async restoreTimer(hidden: LocalHidden, timer: ServiceRelocationTimer): Promise<void> {
-    if (hidden.activation === undefined)
-      throw new Error('Actor relocation cannot restore a Spot timer.');
-    hidden.restoredTimers.push(timer);
-    if (hidden.restoredTimers.length !== hidden.participant.timers.length) return;
-    hidden.activation.timers.restoreRelocation(
-      hidden.restoredTimers.map((value) => ({
-        name: value.timerId,
-        handlerType: value.handlerType,
-        periodMs: value.intervalMs,
-        overrunPolicy: value.overrunPolicy as never,
-        maxCatchUpTicks: value.maxCatchUpTicks,
-        stopOnUnhandledException: value.stopOnUnhandledException,
-        startedAtUnixMs: value.startedAtUnixMs,
-        deliveryIndex: value.deliveryIndex,
-        lastScheduledIndex: value.lastScheduledIndex,
-        nextDueAtUnixMs: value.dueAtUnixMs,
-        pendingTicks: value.pendingTicks
-      }))
+  async normalize(hidden: LocalHidden): Promise<void> {
+    if (hidden.actor === undefined || hidden.replayPackets.length === 0) return;
+    if (hidden.replayStart === undefined || hidden.onReplayResult === undefined) {
+      throw new Error('Relocated Actor backlog has no target activation owner.');
+    }
+    this.options.actorTransfer.admitRelocationPrefix(
+      hidden.actor,
+      hidden.participant.objectGeneration,
+      hidden.replayPackets,
+      hidden.replayStart,
+      hidden.onReplayResult
     );
+    hidden.replayPackets.length = 0;
   }
 
-  async normalize(_hidden: LocalHidden): Promise<void> {}
-
   async abort(hidden: LocalHidden): Promise<void> {
     if (hidden.actor !== undefined) {
       await this.requireActorManager().abortRelocationActor(hidden.actor.context.actorId);
@@ -4944,14 +5258,22 @@ function rewriteAuthorityApplicationRoute(
 }
 
 function actorMembershipTarget(
-  envelope: ServiceRelocationEnvelope,
-  actorKey: string
-): { readonly actorSpotId: string; readonly actorSpotGeneration: bigint } | undefined {
-  const membership = envelope.memberships.find((value) => value.actorKey === actorKey);
+  membership: ServiceRelocationMembership | undefined,
+  localDescriptor: ZLinkMeshNodeDescriptor | undefined
+):
+  | {
+      readonly actorSpotId: string;
+      readonly actorSpotGeneration: bigint;
+      readonly actorSpotKind: ZLinkSpotKind.Entry | ZLinkSpotKind.User;
+    }
+  | undefined {
   if (membership === undefined) return undefined;
+  const spotId = decodeAuthorityKey({ value: membership.spotKey } as ZLinkAuthorityKey).globalId;
   return {
-    actorSpotId: decodeAuthorityKey({ value: membership.spotKey } as ZLinkAuthorityKey).globalId,
-    actorSpotGeneration: membership.spotObjectGeneration
+    actorSpotId: spotId,
+    actorSpotGeneration: membership.spotObjectGeneration,
+    actorSpotKind:
+      spotId === localDescriptor?.entrySpotId ? ZLinkSpotKind.Entry : ZLinkSpotKind.User
   };
 }
 
@@ -5079,6 +5401,22 @@ export function decodeQueuedHandoffPacket(
       ...(messageFollowOrigin === undefined ? {} : { messageFollowOrigin })
     }
   ])[0]!;
+  const requestSource =
+    decoded.source === undefined ? undefined : handoffSourceFence(decoded.source);
+  if (
+    messageFollowOrigin !== undefined &&
+    requestSource !== undefined &&
+    routingIdsEqual(messageFollowOrigin.sourceNodeRid, requestSource.nodeRid)
+  ) {
+    return {
+      ...decoded,
+      index: index as number,
+      messageFollowOrigin: {
+        ...messageFollowOrigin,
+        requestSource
+      }
+    };
+  }
   return { ...decoded, index: index as number };
 }
 
@@ -5253,16 +5591,6 @@ export function createServiceRelocationId(
   }
 }
 
-function operationWireId(value: string): { readonly high: bigint; readonly low: bigint } {
-  const match = /^(\d+):(\d+)$/.exec(value);
-  if (match === null) throw new Error(`Actor handoff operation '${value}' is not canonical.`);
-  const result = { high: BigInt(match[1]!), low: BigInt(match[2]!) };
-  if (result.high === 0n && result.low === 0n) {
-    throw new Error('Actor handoff operation identity must not be zero.');
-  }
-  return result;
-}
-
 function sameWireId(
   left: { readonly high: bigint; readonly low: bigint },
   right: { readonly high: bigint; readonly low: bigint }
@@ -5277,7 +5605,7 @@ function sameCoordinator(
   return (
     left.ownerId === right.ownerId &&
     BigInt(left.leaseGeneration) === right.leaseGeneration &&
-    left.nodeRid === right.nodeRid &&
+    routingIdsEqual(left.nodeRid, right.nodeRid) &&
     BigInt(left.nodeGeneration) === right.nodeGeneration &&
     left.expectedAuthorityStoreVersion === right.expectedAuthorityStoreVersion
   );
@@ -5288,7 +5616,7 @@ function sameRelocationTarget(
   right: ServiceWireRelocationTarget
 ): boolean {
   return (
-    left.nodeRid === right.nodeRid &&
+    routingIdsEqual(left.nodeRid, right.nodeRid) &&
     BigInt(left.nodeGeneration) === right.nodeGeneration &&
     left.ownerId === right.ownerId &&
     BigInt(left.ownerLeaseGeneration) === right.ownerLeaseGeneration
@@ -5341,7 +5669,7 @@ function isSourceOwner(current: ZLinkAuthoritySnapshot, expected: ZLinkAuthority
     current.allocation.state === expected.allocation.state &&
     current.allocation.objectKind === expected.allocation.objectKind &&
     current.allocation.stableType === expected.allocation.stableType &&
-    String(current.allocation.descriptor.rid) === String(expected.allocation.descriptor.rid) &&
+    routingIdsEqual(current.allocation.descriptor.rid, expected.allocation.descriptor.rid) &&
     current.allocation.descriptorLifecycleGeneration ===
       expected.allocation.descriptorLifecycleGeneration
   );
@@ -5358,7 +5686,7 @@ function isExactCommittedTarget(
     current.authorityOwnerGeneration > expected.authorityOwnerGeneration &&
     current.ownerId === target.ownerId &&
     current.ownerLeaseGeneration === target.ownerLeaseGeneration &&
-    String(current.allocation.descriptor.rid) === target.nodeRid &&
+    routingIdsEqual(current.allocation.descriptor.rid, target.nodeRid) &&
     current.allocation.descriptorLifecycleGeneration === target.nodeGeneration &&
     Buffer.from(current.payload).equals(Buffer.from(payload))
   );
@@ -5387,7 +5715,7 @@ function sameRequestSource(
   return (
     left.ownerId === right.ownerId &&
     left.leaseGeneration === right.leaseGeneration &&
-    left.nodeRid === right.nodeRid &&
+    routingIdsEqual(left.nodeRid, right.nodeRid) &&
     left.nodeGeneration === right.nodeGeneration
   );
 }
@@ -5398,7 +5726,7 @@ function handoffSourceFence(
   return {
     ownerId: value.ownerId,
     leaseGeneration: BigInt(value.ownerLeaseGeneration),
-    nodeRid: value.nodeRid,
+    nodeRid: decodeRoutingId(value.nodeRid, value.nodeRidHex),
     nodeGeneration: BigInt(value.nodeGeneration)
   };
 }
@@ -5407,14 +5735,34 @@ function maintenanceReplyRelay(
   stage: LocalStage,
   coordinator: ServiceWireRelocationCoordinatorFence,
   participantId: bigint,
-  completion: RelocationTerminalCompletion
+  completion: RelocationTerminalCompletion,
+  packet: ZLinkActorHandoffPacket,
+  serializers: Parameters<typeof encodeActorReply>[3],
+  flowEnabled: boolean
 ): ServiceMaintenanceReplyRelay {
   const value = completion.result.ok ? completion.result.response : undefined;
+  const direct = packet.messageFollowOrigin?.requestSource !== undefined;
+  const application =
+    direct && completion.result.ok
+      ? decodeApplicationPayloadView(
+          encodeMultipartApplicationPayload(
+            encodeActorReply(
+              Buffer.from(packet.header, 'base64'),
+              ZLinkStreamMessageKind.Response,
+              value,
+              serializers,
+              flowEnabled
+            ),
+            SERVICE_FRAMEWORK_MULTIPART_PACKET_NAME,
+            SERVICE_FRAMEWORK_MULTIPART_CONTENT_TYPE
+          )
+        )
+      : undefined;
   return {
     relocation: relocationWireId(stage.staging.envelope.aggregateId),
     targetAttemptGeneration: stage.offer.prepare.targetAttemptGeneration,
     coordinator,
-    operation: operationWireId(completion.operationId),
+    operation: parseHandoffOperationId(completion.operationId),
     replyRouteId: BigInt(completion.source.replyRouteId),
     participantId,
     sequence: BigInt(completion.index + 1),
@@ -5422,15 +5770,23 @@ function maintenanceReplyRelay(
     failureCode: completion.result.ok
       ? ServiceWireFrameworkErrorCode.none
       : ServiceWireFrameworkErrorCode.requestFailed,
-    ...(value === undefined
-      ? {}
-      : {
+    ...(application !== undefined
+      ? {
           payload: {
-            packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
-            contentType: ZlinkStreamContentType.Json,
-            bytes: Buffer.from(JSON.stringify(value), 'utf8')
+            packetName: application.packetName,
+            contentType: application.contentType,
+            bytes: application.payload
           }
-        })
+        }
+      : value === undefined
+        ? {}
+        : {
+            payload: {
+              packetName: SERVICE_RELOCATION_REPLY_PACKET_NAME,
+              contentType: ZlinkStreamContentType.Json,
+              bytes: Buffer.from(JSON.stringify(value), 'utf8')
+            }
+          })
   };
 }
 
@@ -5466,6 +5822,14 @@ function wireIdText(value: { readonly high: bigint; readonly low: bigint }): str
  */
 export class ServiceRelocationDataLostError extends Error {}
 
+/** The local source lifecycle ended a pending relocation operation. */
+class ServiceRelocationRuntimeStoppedError extends Error {
+  constructor() {
+    super('Relocation runtime stopped.');
+    this.name = 'AbortError';
+  }
+}
+
 /** Classifies relocation failure with the error model §2.1 mapping. */
 export function relocationFailedFailureCode(error: unknown): number {
   if (error instanceof ServiceRelocationDataLostError) {
@@ -5600,7 +5964,7 @@ function validateTargetOneWayControl(
 ): void {
   const prepare = stage.offer.prepare;
   if (
-    String(sourceNodeRid) !== stage.offer.authenticatedSourceNodeRid ||
+    !routingIdsEqual(sourceNodeRid, stage.offer.authenticatedSourceNodeRid) ||
     !sameWireId(request.relocation, prepare.relocation) ||
     request.targetAttemptGeneration !== prepare.targetAttemptGeneration ||
     !sameCoordinator(request.coordinator, prepare.coordinator) ||
@@ -5678,12 +6042,7 @@ function canonicalQueuedFrozenRecord(
   const source =
     packet.source === undefined
       ? coordinatorSource(coordinator)
-      : {
-          ownerId: packet.source.ownerId,
-          leaseGeneration: BigInt(packet.source.ownerLeaseGeneration),
-          nodeRid: packet.source.nodeRid,
-          nodeGeneration: BigInt(packet.source.nodeGeneration)
-        };
+      : handoffSourceFence(packet.source);
   const operationId = parseHandoffOperationId(packet.messageFollowContext.operationId);
   if (packet.returnResponse && packet.source === undefined) {
     throw new Error('Captured Actor request has no exact request-source fence.');
@@ -5705,7 +6064,7 @@ function canonicalQueuedFrozenRecord(
       objectGeneration: participant.objectGeneration,
       nodeRid: target.nodeRid,
       nodeGeneration: target.nodeGeneration,
-      authorityOwnerGeneration: participant.authorityOwnerGeneration + 1n,
+      authorityOwnerGeneration: participant.authorityOwnerGeneration,
       ownerLeaseGeneration: target.ownerLeaseGeneration
     },
     operationId,
@@ -5821,17 +6180,13 @@ function sessionRelocationRouteSubmitKey(
   request: ServiceSessionRelocationRoute,
   targetNodeRid: RoutingId
 ): string {
-  return `${sessionRelocationIdentityKey(request)}:${String(targetNodeRid)}`;
+  return `${sessionRelocationIdentityKey(request)}:${encodeRoutingIdStorageHex(targetNodeRid)}`;
 }
 
 function sessionRelocationResponseKey(response: ServiceSessionRelocationSealed): string {
   return sessionRelocationIdentityKey(response);
 }
 
-function sessionRelocationResponseFingerprint(response: ServiceSessionRelocationSealed): string {
-  return encodeSessionRelocationSealed(response).toString('base64');
-}
-
 function sessionRelocationIdentityKey(
   value:
     ServiceSessionRelocationSeal | ServiceSessionRelocationSealed | ServiceSessionRelocationRoute
@@ -5846,16 +6201,16 @@ function validateSessionRelocationResponse(
   const sameCoordinator =
     request.coordinator.ownerId === response.coordinator.ownerId &&
     request.coordinator.leaseGeneration === response.coordinator.leaseGeneration &&
-    request.coordinator.nodeRid === response.coordinator.nodeRid &&
+    routingIdsEqual(request.coordinator.nodeRid, response.coordinator.nodeRid) &&
     request.coordinator.nodeGeneration === response.coordinator.nodeGeneration &&
     request.coordinator.expectedAuthorityStoreVersion ===
       response.coordinator.expectedAuthorityStoreVersion;
   const sameSession =
-    request.session.sessionOwnerNodeRid === response.session.sessionOwnerNodeRid &&
+    routingIdsEqual(request.session.sessionOwnerNodeRid, response.session.sessionOwnerNodeRid) &&
     request.session.sessionOwnerNodeGeneration === response.session.sessionOwnerNodeGeneration &&
     request.session.sessionOwnerId === response.session.sessionOwnerId &&
     request.session.sessionOwnerLeaseGeneration === response.session.sessionOwnerLeaseGeneration &&
-    request.session.sessionRid === response.session.sessionRid &&
+    routingIdsEqual(request.session.sessionRid, response.session.sessionRid) &&
     request.session.bindingGeneration === response.session.bindingGeneration;
   if (
     request.relocation.high !== response.relocation.high ||
@@ -5868,7 +6223,7 @@ function validateSessionRelocationResponse(
   if (
     request.actor.actor.actorId !== response.actor.actor.actorId ||
     request.actor.actor.generation !== response.actor.actor.generation ||
-    request.actor.actor.nodeRid !== response.actor.actor.nodeRid ||
+    !routingIdsEqual(request.actor.actor.nodeRid, response.actor.actor.nodeRid) ||
     request.actor.targetNodeGeneration !== response.actor.targetNodeGeneration ||
     request.actor.authorityOwnerGeneration !== response.actor.authorityOwnerGeneration ||
     request.actor.ownerLeaseGeneration !== response.actor.ownerLeaseGeneration
@@ -5891,27 +6246,20 @@ function replyRelayIdentityKey(value: {
     value.relocation.low.toString(),
     value.coordinator.ownerId,
     value.coordinator.leaseGeneration.toString(),
-    value.coordinator.nodeRid,
+    encodeRoutingIdStorageHex(value.coordinator.nodeRid),
     value.coordinator.nodeGeneration.toString(),
     value.coordinator.expectedAuthorityStoreVersion
   ]);
 }
 
 function replyRelayPendingKey(
-  ackTargetNodeRid: string,
+  ackTargetNodeRid: RoutingId,
   value: Parameters<typeof replyRelayIdentityKey>[0]
 ): string {
-  return JSON.stringify([ackTargetNodeRid, replyRelayIdentityKey(value)]);
-}
-
-function isServiceWireCommand(payload: Uint8Array, command: number): boolean {
-  return (
-    payload.byteLength >= 5 &&
-    payload[0] === 0x5a &&
-    payload[1] === 0x4d &&
-    payload[2] === 1 &&
-    payload[3] === command
-  );
+  return JSON.stringify([
+    encodeRoutingIdStorageHex(ackTargetNodeRid),
+    replyRelayIdentityKey(value)
+  ]);
 }
 
 export function encodeHandoffQueuedMessages(
@@ -6000,97 +6348,58 @@ function toServiceTimer(
   };
 }
 
-const PREPARE_SIDEBAND_MAGIC = 'ZLNI';
-const PREPARE_SIDEBAND_VERSION = 1;
-const PREPARE_SIDEBAND_HEADER_BYTES = 11;
-const PREPARE_SIDEBAND_VERSION_OFFSET = 4;
-const PREPARE_SIDEBAND_KEY_LENGTH_OFFSET = 5;
-const PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET = 7;
 const ACTOR_SESSION_JOURNAL_VERSION = 1;
 const SERVICE_RELOCATION_REPLY_PACKET_NAME = 'zlink.relocation.reply';
 
-/**
- * NODE-INTERNAL Prepare sideband. Frame zero remains the exact canonical
- * command-40 schema record; each following ZLNI frame carries one sealed
- * actor-session journal keyed by its canonical participant authority key.
- * Sessionless relocation remains a single-frame, wire-identical Prepare.
- */
-function encodePrepareSideband(envelope: ServiceRelocationEnvelope): readonly Buffer[] {
-  return envelope.participants
-    .filter((participant) => participant.boundSessionState.byteLength !== 0)
-    .map((participant) => {
-      const key = Buffer.from(participant.key, 'utf8');
-      const payload = Buffer.from(participant.boundSessionState);
-      if (key.byteLength === 0 || key.byteLength > 0xffff || payload.byteLength > 0xffff_ffff) {
-        throw new TypeError('Bound-session relocation sideband is out of bounds.');
-      }
-      const header = Buffer.allocUnsafe(PREPARE_SIDEBAND_HEADER_BYTES);
-      header.write(PREPARE_SIDEBAND_MAGIC, 0, 'ascii');
-      header[PREPARE_SIDEBAND_VERSION_OFFSET] = PREPARE_SIDEBAND_VERSION;
-      header.writeUInt16BE(key.byteLength, PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
-      header.writeUInt32BE(payload.byteLength, PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
-      return Buffer.concat([header, key, payload]);
-    });
-}
-
-function decodePrepareSideband(frames: readonly Uint8Array[]):
-  | readonly {
-      readonly participantKey: string;
-      readonly payload: Buffer;
-    }[]
-  | undefined {
-  const result: Array<{ readonly participantKey: string; readonly payload: Buffer }> = [];
-  const keys = new Set<string>();
-  for (const frame of frames) {
-    const bytes = Buffer.from(frame);
-    if (
-      bytes.byteLength < PREPARE_SIDEBAND_HEADER_BYTES ||
-      bytes.subarray(0, PREPARE_SIDEBAND_VERSION_OFFSET).toString('ascii') !==
-        PREPARE_SIDEBAND_MAGIC ||
-      bytes[PREPARE_SIDEBAND_VERSION_OFFSET] !== PREPARE_SIDEBAND_VERSION
-    ) {
-      return undefined;
-    }
-    const keyLength = bytes.readUInt16BE(PREPARE_SIDEBAND_KEY_LENGTH_OFFSET);
-    const payloadLength = bytes.readUInt32BE(PREPARE_SIDEBAND_PAYLOAD_LENGTH_OFFSET);
-    if (
-      PREPARE_SIDEBAND_HEADER_BYTES + keyLength + payloadLength !== bytes.byteLength ||
-      keyLength === 0
-    )
-      return undefined;
-    const participantKey = bytes
-      .subarray(PREPARE_SIDEBAND_HEADER_BYTES, PREPARE_SIDEBAND_HEADER_BYTES + keyLength)
-      .toString('utf8');
-    if (keys.has(participantKey)) return undefined;
-    keys.add(participantKey);
-    result.push({
-      participantKey,
-      payload: Buffer.from(bytes.subarray(PREPARE_SIDEBAND_HEADER_BYTES + keyLength))
-    });
-  }
-  return result;
-}
-
-function attachPrepareBoundSessions(
+function attachCanonicalBoundSessions(
   envelope: ServiceRelocationEnvelope,
-  sideband: ServiceMaintenanceRelocationPrepare['nodeInternalBoundSessions']
+  request: ServiceMaintenanceRelocationPrepare,
+  meshName: string
 ): ServiceRelocationEnvelope {
-  if (sideband === undefined || sideband.length === 0) return envelope;
-  const byKey = new Map(
-    sideband.map((value) => [value.participantKey, Buffer.from(value.payload)])
-  );
-  const participants = envelope.participants.map((participant) => {
-    const payload = byKey.get(participant.key);
-    if (payload === undefined) return participant;
-    if (participant.objectKind !== 'actor') {
-      throw new TypeError('Bound-session relocation sideband names a non-Actor participant.');
-    }
-    byKey.delete(participant.key);
-    return { ...participant, boundSessionState: payload };
-  });
-  if (byKey.size !== 0)
-    throw new TypeError('Bound-session relocation sideband names an unknown participant.');
-  return { ...envelope, participants };
+  return {
+    ...envelope,
+    participants: envelope.participants.map((participant) => {
+      const binding = participant.sessionBinding;
+      if (binding === undefined) return participant;
+      if (participant.objectKind !== 'actor')
+        throw new TypeError('Session binding names a non-Actor participant.');
+      const sessionNodeRid = decodeRoutingId(
+        '',
+        Buffer.from(binding.sessionOwnerNodeRid).toString('hex')
+      );
+      const sessionRid = decodeRoutingId('', Buffer.from(binding.sessionRid).toString('hex'));
+      const session = {
+        sessionOwnerNodeRid: sessionNodeRid as string,
+        sessionOwnerNodeGeneration: binding.sessionOwnerNodeGeneration,
+        sessionOwnerId: binding.sessionOwnerId,
+        sessionOwnerLeaseGeneration: binding.sessionOwnerLeaseGeneration,
+        sessionRid: sessionRid as string,
+        bindingGeneration: binding.bindingGeneration
+      };
+      const target: ZLinkRemoteBoundSessionTarget = {
+        routerChannelId: meshName,
+        targetNodeRid: sessionNodeRid,
+        spotId:
+          request.object.kind === 'actor'
+            ? ((participant.rootSpotId ?? '') as RoutingId)
+            : (request.object.spotId as RoutingId),
+        sessionNodeRid,
+        sessionRid,
+        sessionOwnerNodeGeneration: binding.sessionOwnerNodeGeneration,
+        sessionOwnerId: binding.sessionOwnerId,
+        sessionOwnerLeaseGeneration: binding.sessionOwnerLeaseGeneration,
+        bindingGeneration: binding.bindingGeneration,
+        previousAuthorityOwnerGeneration: participant.authorityOwnerGeneration,
+        relocationSealId: envelope.aggregateId,
+        serviceWireRelocation: {
+          relocation: request.relocation,
+          coordinator: request.coordinator,
+          session
+        }
+      };
+      return { ...participant, boundSessionState: encodeActorSession(target) };
+    })
+  };
 }
 
 function encodeActorSession(target: ZLinkRemoteBoundSessionTarget | undefined): Buffer {
@@ -6100,10 +6409,17 @@ function encodeActorSession(target: ZLinkRemoteBoundSessionTarget | undefined):
       version: ACTOR_SESSION_JOURNAL_VERSION,
       routerChannelId: target.routerChannelId,
       targetNodeRid: String(target.targetNodeRid),
+      targetNodeRidHex: encodeRoutingIdStorageHex(target.targetNodeRid),
       spotId: String(target.spotId),
       sessionNodeRid:
         target.sessionNodeRid === undefined ? undefined : String(target.sessionNodeRid),
+      sessionNodeRidHex:
+        target.sessionNodeRid === undefined
+          ? undefined
+          : encodeRoutingIdStorageHex(target.sessionNodeRid),
       sessionRid: target.sessionRid === undefined ? undefined : String(target.sessionRid),
+      sessionRidHex:
+        target.sessionRid === undefined ? undefined : encodeRoutingIdStorageHex(target.sessionRid),
       sessionOwnerNodeGeneration: target.sessionOwnerNodeGeneration?.toString(),
       sessionOwnerId: target.sessionOwnerId,
       sessionOwnerLeaseGeneration: target.sessionOwnerLeaseGeneration?.toString(),
@@ -6120,18 +6436,27 @@ function encodeActorSession(target: ZLinkRemoteBoundSessionTarget | undefined):
               coordinatorOwnerId: target.serviceWireRelocation.coordinator.ownerId,
               coordinatorLeaseGeneration:
                 target.serviceWireRelocation.coordinator.leaseGeneration.toString(),
-              coordinatorNodeRid: target.serviceWireRelocation.coordinator.nodeRid,
+              coordinatorNodeRid: String(target.serviceWireRelocation.coordinator.nodeRid),
+              coordinatorNodeRidHex: encodeRoutingIdStorageHex(
+                target.serviceWireRelocation.coordinator.nodeRid
+              ),
               coordinatorNodeGeneration:
                 target.serviceWireRelocation.coordinator.nodeGeneration.toString(),
               expectedAuthorityStoreVersion:
                 target.serviceWireRelocation.coordinator.expectedAuthorityStoreVersion,
-              sessionOwnerNodeRid: target.serviceWireRelocation.session.sessionOwnerNodeRid,
+              sessionOwnerNodeRid: String(target.serviceWireRelocation.session.sessionOwnerNodeRid),
+              sessionOwnerNodeRidHex: encodeRoutingIdStorageHex(
+                target.serviceWireRelocation.session.sessionOwnerNodeRid as RoutingId
+              ),
               sessionOwnerNodeGeneration:
                 target.serviceWireRelocation.session.sessionOwnerNodeGeneration.toString(),
               sessionOwnerId: target.serviceWireRelocation.session.sessionOwnerId,
               sessionOwnerLeaseGeneration:
                 target.serviceWireRelocation.session.sessionOwnerLeaseGeneration.toString(),
-              sessionRid: target.serviceWireRelocation.session.sessionRid,
+              sessionRid: String(target.serviceWireRelocation.session.sessionRid),
+              sessionRidHex: encodeRoutingIdStorageHex(
+                target.serviceWireRelocation.session.sessionRid as RoutingId
+              ),
               bindingGeneration: target.serviceWireRelocation.session.bindingGeneration.toString()
             }
     }),
@@ -6155,12 +6480,14 @@ function decodeActorSession(payload: Uint8Array): ZLinkRemoteBoundSessionTarget
   const serviceWire = decodeActorSessionServiceWireFence(value.serviceWireRelocation);
   return {
     routerChannelId: value.routerChannelId,
-    targetNodeRid: value.targetNodeRid as RoutingId,
+    targetNodeRid: decodeRoutingId(value.targetNodeRid, value.targetNodeRidHex),
     spotId: value.spotId as RoutingId,
     ...(typeof value.sessionNodeRid === 'string'
-      ? { sessionNodeRid: value.sessionNodeRid as RoutingId }
+      ? { sessionNodeRid: decodeRoutingId(value.sessionNodeRid, value.sessionNodeRidHex) }
+      : {}),
+    ...(typeof value.sessionRid === 'string'
+      ? { sessionRid: decodeRoutingId(value.sessionRid, value.sessionRidHex) }
       : {}),
-    ...(typeof value.sessionRid === 'string' ? { sessionRid: value.sessionRid as RoutingId } : {}),
     ...(optionalBigInt('sessionOwnerNodeGeneration') === undefined
       ? {}
       : { sessionOwnerNodeGeneration: optionalBigInt('sessionOwnerNodeGeneration') }),
@@ -6224,16 +6551,22 @@ function decodeActorSessionServiceWireFence(
     coordinator: {
       ownerId: text('coordinatorOwnerId'),
       leaseGeneration: positive('coordinatorLeaseGeneration'),
-      nodeRid: text('coordinatorNodeRid'),
+      nodeRid: decodeRoutingId(text('coordinatorNodeRid'), value.coordinatorNodeRidHex),
       nodeGeneration: positive('coordinatorNodeGeneration'),
       expectedAuthorityStoreVersion: text('expectedAuthorityStoreVersion')
     },
     session: {
-      sessionOwnerNodeRid: text('sessionOwnerNodeRid'),
+      sessionOwnerNodeRid: decodeRoutingId(
+        typeof value.sessionOwnerNodeRid === 'string' ? value.sessionOwnerNodeRid : '',
+        value.sessionOwnerNodeRidHex
+      ) as string,
       sessionOwnerNodeGeneration: positive('sessionOwnerNodeGeneration'),
       sessionOwnerId: text('sessionOwnerId'),
       sessionOwnerLeaseGeneration: positive('sessionOwnerLeaseGeneration'),
-      sessionRid: text('sessionRid'),
+      sessionRid: decodeRoutingId(
+        typeof value.sessionRid === 'string' ? value.sessionRid : '',
+        value.sessionRidHex
+      ) as string,
       bindingGeneration: positive('bindingGeneration')
     }
   };