@zlink-systems/framework 0.25.0 → 0.26.0

package/dist/runtime/spots/index.js

@@ -44,7 +44,6 @@ Object.defineProperty(exports, "DefaultZLinkSpotHandlerRegistry", { enumerable:
 var spot_publisher_transport_1 = require("./spot-publisher-transport");
 Object.defineProperty(exports, "ZLinkRuntimeSpotPublisherTransport", { enumerable: true, get: function () { return spot_publisher_transport_1.ZLinkRuntimeSpotPublisherTransport; } });
 const spot_activation_registry_1 = require("./spot-activation-registry");
-const spot_activation_state_1 = require("./spot-activation-state");
 const spot_activation_1 = require("./spot-activation");
 const spot_actor_membership_1 = require("./spot-actor-membership");
 const formal_remote_actor_transfer_registry_1 = require("./formal-remote-actor-transfer-registry");
@@ -74,8 +73,7 @@ class DefaultZLinkSpotManager {
     //  callbacks (isInstanceMaterializing, sibling-generation lookups) resolve
     //  in O(1) instead of scanning every pending key.
     pendingInstanceMaterializationsByPrefix = new Map();
-    instanceActivationGates = new Map();
-    pendingInstanceCloses = new Map();
+    closeOperations = new Map();
     pendingInstanceTerminals = new Map();
     pendingInstanceTerminalGenerations = new Map();
     deferredInstanceAuthorityReleases = new Map();
@@ -83,7 +81,7 @@ class DefaultZLinkSpotManager {
     idleSweepRunning = false;
     constructor(options, timerClock) {
         this.options = options;
-        this.activations = new spot_activation_registry_1.ZLinkSpotActivationRegistry(options.metrics);
+        this.activations = new spot_activation_registry_1.ZLinkSpotActivationRegistry(options.metrics, (meshName, spotId) => this.isSpotClosing(meshName, spotId));
         this.factories = new Set(options.spotFactories);
         this.workerRuntime = options.workerRuntime ?? new workers_1.ZLinkWorkerRuntime();
         this.locationClaim = new spot_location_claim_1.ZLinkSpotLocationClaim({
@@ -101,6 +99,8 @@ class DefaultZLinkSpotManager {
             dispatchErrors: options.dispatchErrors
         });
         this.actorMembership = new spot_actor_membership_1.ZLinkSpotActorMembership({
+            isSpotClosing: (activation) => this.isSpotClosing(activation.meshName, activation.spotId) ||
+                this.activations.resolve(activation.meshName, activation.spotId) !== activation,
             resolveActivation: (spotId, meshName) => meshName === undefined
                 ? this.activations.resolveUnique(spotId)
                 : this.activations.resolve(meshName, spotId),
@@ -136,12 +136,12 @@ class DefaultZLinkSpotManager {
             spotRouterChannelIdForMesh: options.spotRouterChannelIdForMesh,
             providerResolver: options.providerResolver,
             dispatchErrors: options.dispatchErrors,
+            closeErrorSink: options.closeErrorSink,
             runtimeEventPublisher: options.runtimeEventPublisher,
             workerRuntime: this.workerRuntime,
             messageSerializers: options.messageSerializers,
             locationClaim: this.locationClaim,
             createNativeSpot: options.createNativeSpot,
-            createReceived: options.createReceived,
             createTopicMessage: options.createTopicMessage,
             nativeSpotNodeProvider: options.nativeSpotNodeProvider,
             actorResolver: options.actorResolver,
@@ -152,7 +152,9 @@ class DefaultZLinkSpotManager {
             admission: options.admission,
             statefulExecutionAllowed: options.statefulExecutionAllowed,
             leaveActor: (spotId, actor, signal, meshName) => this.actorMembership.leaveActor(spotId, actor, signal, meshName),
-            closeSpot: (meshName, spotId, signal, reason) => this.closeWithReason(meshName, spotId, signal, reason),
+            requestContextClose: (activation, objectGeneration, signal) => this.closeFromContext(activation, objectGeneration, signal),
+            isSpotClosing: (activation) => this.isSpotClosing(activation.meshName, activation.spotId) ||
+                this.activations.resolve(activation.meshName, activation.spotId) !== activation,
             registerActivation: (activation) => {
                 this.activations.register(activation);
                 this.scheduleIdleSweep();
@@ -199,10 +201,6 @@ class DefaultZLinkSpotManager {
     activeSpotCount(meshName) {
         return this.activations.list(meshName).length;
     }
-    instanceActivationConcurrency(meshName) {
-        const limit = this.options.activationConcurrencyLimitProvider?.(meshName) ?? 128;
-        return { active: this.instanceActivationGates.get(meshName)?.active ?? 0, limit };
-    }
     resolveRelocationActivation(meshName, spotId) {
         return this.activations.resolve(meshName, spotId);
     }
@@ -237,12 +235,12 @@ class DefaultZLinkSpotManager {
             await (0, abort_1.awaitWithAbort)(existing, signal);
             return;
         }
-        const release = await this.acquireInstanceActivation(meshName, signal);
+        const release = await this.options.activationAdmission?.acquire(meshName, signal);
         try {
             await this.materializeInstanceCore(meshName, instanceType, spotId, objectGeneration, readyTarget?.objectGeneration === objectGeneration, signal);
         }
         finally {
-            release();
+            release?.();
         }
     }
     async materializeInstanceCore(meshName, instanceType, spotId, objectGeneration, requiresReadyTarget, signal) {
@@ -260,11 +258,16 @@ class DefaultZLinkSpotManager {
             // explicit Instance intent arriving at that boundary must wait for the
             // old resources to be released before materializing the replacement.
             // This is lifecycle convergence; it does not resubmit application work.
-            const pendingClose = this.pendingInstanceCloses.get(key);
+            const closeOperation = this.closeOperations.get(key);
+            const pendingClose = closeOperation?.ready;
             if (pendingClose !== undefined) {
                 await (0, abort_1.awaitWithAbort)(pendingClose, signal);
                 continue;
             }
+            if (closeOperation?.committed === true) {
+                await (0, abort_1.awaitWithAbort)(this.closeWithReason(meshName, spotId), signal);
+                continue;
+            }
             const closing = this.activations.closingOperation(meshName, spotId);
             if (closing !== undefined) {
                 await (0, abort_1.awaitWithAbort)(closing.ready, signal);
@@ -340,58 +343,6 @@ class DefaultZLinkSpotManager {
             return;
         }
     }
-    async acquireInstanceActivation(meshName, signal) {
-        let gate = this.instanceActivationGates.get(meshName);
-        if (gate === undefined) {
-            gate = {
-                meshName,
-                limit: this.options.activationConcurrencyLimitProvider?.(meshName) ?? 128,
-                active: 0,
-                waiters: [],
-                waiterHead: 0
-            };
-            this.instanceActivationGates.set(meshName, gate);
-        }
-        if (signal?.aborted === true)
-            throw signal.reason;
-        if (gate.active < gate.limit) {
-            gate.active += 1;
-            this.options.onInstanceActivationConcurrencyChanged?.(meshName);
-            return () => this.releaseInstanceActivation(gate);
-        }
-        return new Promise((resolve, reject) => {
-            const waiter = { resolve, reject, signal, abort: undefined };
-            const slot = gate.waiters.length;
-            waiter.abort = () => {
-                if (gate.waiters[slot] === waiter)
-                    gate.waiters[slot] = undefined;
-                reject(signal?.reason);
-            };
-            signal?.addEventListener('abort', waiter.abort, { once: true });
-            gate.waiters.push(waiter);
-        });
-    }
-    releaseInstanceActivation(gate) {
-        while (gate.waiterHead < gate.waiters.length) {
-            const waiter = gate.waiters[gate.waiterHead];
-            gate.waiters[gate.waiterHead] = undefined;
-            gate.waiterHead += 1;
-            if (gate.waiterHead >= gate.waiters.length) {
-                gate.waiters.length = 0;
-                gate.waiterHead = 0;
-            }
-            if (waiter === undefined)
-                continue;
-            if (waiter.abort !== undefined)
-                waiter.signal?.removeEventListener('abort', waiter.abort);
-            waiter.resolve(() => this.releaseInstanceActivation(gate));
-            return;
-        }
-        gate.waiters.length = 0;
-        gate.waiterHead = 0;
-        gate.active -= 1;
-        this.options.onInstanceActivationConcurrencyChanged?.(gate.meshName);
-    }
     isInstanceMaterialized(meshName, instanceType, spotId) {
         const activation = this.activations.resolve(meshName, spotId);
         return (activation !== undefined &&
@@ -401,10 +352,15 @@ class DefaultZLinkSpotManager {
         const prefix = instanceMaterializationPrefix(meshName, spotId);
         return (this.pendingInstanceMaterializationsByPrefix.get(prefix)?.size ?? 0) > 0;
     }
-    isInstanceClosing(meshName, spotId) {
+    isSpotClosing(meshName, spotId) {
         const key = `${meshName}\0${String(spotId)}`;
-        return (this.pendingInstanceCloses.has(key) ||
-            this.activations.closingOperation(meshName, spotId) !== undefined);
+        return this.closeOperations.get(key)?.committed === true;
+    }
+    pendingSpotCloseDecision(meshName, spotId) {
+        return this.closeOperations.get(`${meshName}\0${String(spotId)}`)?.authorityDecision;
+    }
+    isInstanceClosing(meshName, spotId) {
+        return this.closeOperations.has(`${meshName}\0${String(spotId)}`);
     }
     async discardInstance(meshName, spotId) {
         const activation = this.activations.resolve(meshName, spotId);
@@ -443,7 +399,7 @@ class DefaultZLinkSpotManager {
         }
         this.pendingInstanceTerminals.delete(key);
         this.pendingInstanceTerminalGenerations.delete(key);
-        const pendingClose = this.pendingInstanceCloses.get(key);
+        const pendingClose = this.closeOperations.get(key)?.ready;
         if (pendingClose !== undefined) {
             this.deferInstanceAuthorityRelease(key, objectGeneration);
             await pendingClose;
@@ -539,32 +495,16 @@ class DefaultZLinkSpotManager {
                     !activation.beginIdleEviction()) {
                     continue;
                 }
-                let durableClosing;
-                try {
-                    durableClosing = await (this.options.beginInstanceIdleClosingAuthority?.(activation.meshName, activation.spotId) ?? Promise.resolve({ restoreReady: async () => undefined }));
-                }
-                catch (error) {
-                    activation.abortIdleEviction();
-                    throw error;
-                }
-                if (durableClosing === undefined) {
-                    activation.abortIdleEviction();
-                    continue;
-                }
                 const close = this.closeWithReason(activation.meshName, activation.spotId, undefined, contracts_1.ZLinkSpotCloseReason.IdleEvicted);
                 const run = async () => {
                     try {
                         const closed = await close;
-                        if (!closed) {
-                            await durableClosing.restoreReady();
+                        if (!closed)
                             activation.abortIdleEviction();
-                        }
                     }
                     catch (error) {
-                        if (error instanceof spot_activation_state_1.ZLinkSpotCloseOccupiedError) {
-                            await durableClosing.restoreReady();
-                        }
-                        activation.abortIdleEviction();
+                        if (!this.isSpotClosing(activation.meshName, activation.spotId))
+                            activation.abortIdleEviction();
                         throw error;
                     }
                 };
@@ -603,6 +543,7 @@ class DefaultZLinkSpotManager {
         (0, abort_1.throwIfAborted)(args.signal);
         const operation = this.activations.getOrBegin(meshName, spotType, spotId, async () => {
             this.options.admission?.requireRequest('SPOT create', meshName);
+            const release = await this.options.activationAdmission?.acquire(meshName, args.signal);
             const ownedRequest = args.request === undefined
                 ? runtime_message_1.ZLinkBufferMessage.from(Buffer.alloc(0))
                 : (0, payload_codec_1.encodeFrameworkPayloadMessage)(args.request, this.options.messageSerializers);
@@ -611,6 +552,7 @@ class DefaultZLinkSpotManager {
             }
             finally {
                 ownedRequest.close();
+                release?.();
             }
         });
         return await (0, abort_1.awaitWithAbort)(operation.ready, args.signal);
@@ -639,99 +581,109 @@ class DefaultZLinkSpotManager {
     async close(meshName, spotId, signal) {
         return await this.closeWithReason(meshName, spotId, signal, contracts_1.ZLinkSpotCloseReason.ExplicitClose);
     }
-    async closeWithReason(meshName, spotId, signal, reason = contracts_1.ZLinkSpotCloseReason.ExplicitClose, deadline) {
-        requireMeshName(meshName);
-        const key = `${meshName}\0${String(spotId)}`;
-        const closing = this.activations.closingOperation(meshName, spotId);
-        if (closing !== undefined) {
-            return await closing.ready;
-        }
-        const pendingClose = this.pendingInstanceCloses.get(key);
-        if (pendingClose !== undefined) {
-            const pendingActivation = this.activations.resolve(meshName, spotId);
-            if (pendingActivation?.serial.isCurrentTurn === true)
-                return true;
-            return await pendingClose;
+    async closeUserWithAuthority(meshName, spotId, beginAuthority, signal) {
+        return await this.closeWithReason(meshName, spotId, signal, contracts_1.ZLinkSpotCloseReason.ExplicitClose, undefined, beginAuthority);
+    }
+    closeFromContext(activation, objectGeneration, signal) {
+        const { meshName, spotId } = activation;
+        const operation = this.closeOperations.get(`${meshName}\0${String(spotId)}`);
+        const current = operation?.activation ?? this.activations.resolve(meshName, spotId);
+        if (current === undefined) {
+            return Promise.resolve(false);
         }
-        const activation = this.activations.resolve(meshName, spotId);
-        if (activation === undefined) {
-            return false;
+        if (current !== activation || current.objectGeneration !== objectGeneration) {
+            return Promise.reject((0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.InvalidOperation, `Spot '${String(spotId)}' generation is stale.`));
         }
-        const currentTurn = activation.serial.isCurrentTurn;
-        const isInstance = activation.domain.kind === 'instance';
-        const beginClose = () => {
-            const seal = activation.sealExecution();
-            const operation = this.activations.startClose(meshName, spotId, (target) => this.activationLifecycle.closeAfterSeal(target, seal, signal, reason, deadline), (target) => this.activationLifecycle.resourcesReleased(target), reason);
-            if (operation === undefined) {
-                activation.abortExecutionSeal(seal);
-            }
-            return operation;
-        };
-        if (isInstance) {
-            const beginAuthorityClose = reason === contracts_1.ZLinkSpotCloseReason.ExplicitClose
-                ? this.options.beginInstanceClosingAuthority
-                : undefined;
-            // Register the close gate before waiting for the current application
-            // and activation-authority terminal completions. A close requested from
-            // a handler cannot publish Closing until that handler's durable inbox
-            // completion has removed the recovery fence.
-            const trackedClosePromise = (async () => {
-                const waitForApplication = this.options.instanceSpotApplicationQuiescenceProvider?.(meshName, spotId, signal);
-                if (waitForApplication !== undefined) {
-                    await waitForApplication;
-                }
-                const closingAuthority = beginAuthorityClose === undefined
-                    ? undefined
-                    : await beginAuthorityClose(meshName, spotId);
-                if (beginAuthorityClose !== undefined && closingAuthority === undefined) {
-                    return false;
-                }
-                const operation = beginClose();
-                if (operation === undefined) {
-                    await closingAuthority?.restoreReady();
-                    return false;
-                }
-                const closed = await operation.ready;
-                if (!closed)
-                    await closingAuthority?.restoreReady();
-                return closed;
-            })().finally(() => {
-                if (this.pendingInstanceCloses.get(key) === trackedClosePromise) {
-                    this.pendingInstanceCloses.delete(key);
+        const beginUserAuthority = activation.domain.kind === 'user' && this.options.beginUserClosingAuthority !== undefined
+            ? (onCommitted) => this.options.beginUserClosingAuthority(meshName, spotId, objectGeneration, onCommitted)
+            : undefined;
+        return this.closeWithReason(meshName, spotId, signal, contracts_1.ZLinkSpotCloseReason.ExplicitClose, undefined, beginUserAuthority);
+    }
+    async closeWithReason(meshName, spotId, signal, reason = contracts_1.ZLinkSpotCloseReason.ExplicitClose, deadline, beginUserAuthority) {
+        requireMeshName(meshName);
+        const key = `${meshName}\0${String(spotId)}`;
+        let operation = this.closeOperations.get(key);
+        if (operation === undefined) {
+            const activation = this.activations.resolve(meshName, spotId);
+            if (activation === undefined)
+                return false;
+            if (activation.domain.kind === 'user' &&
+                reason === contracts_1.ZLinkSpotCloseReason.ExplicitClose &&
+                beginUserAuthority === undefined) {
+                throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.InvalidOperation, `User Spot '${String(spotId)}' Close requires its authority owner.`);
+            }
+            const beginAuthority = beginUserAuthority ??
+                (activation.domain.kind === 'instance' &&
+                    reason === contracts_1.ZLinkSpotCloseReason.ExplicitClose &&
+                    this.options.beginInstanceClosingAuthority !== undefined
+                    ? (onCommitted) => this.options.beginInstanceClosingAuthority(meshName, spotId, onCommitted)
+                    : activation.domain.kind === 'instance' &&
+                        reason === contracts_1.ZLinkSpotCloseReason.IdleEvicted &&
+                        this.options.beginInstanceIdleClosingAuthority !== undefined
+                        ? (onCommitted) => this.options.beginInstanceIdleClosingAuthority(meshName, spotId, onCommitted)
+                        : async (onCommitted) => {
+                            onCommitted();
+                            return { release: async () => undefined };
+                        });
+            operation = {
+                activation,
+                reason,
+                beginAuthority,
+                committed: false
+            };
+            this.closeOperations.set(key, operation);
+        }
+        if (operation.ready === undefined) {
+            const active = operation;
+            const run = active.activation.serial.executeLifecycleOperation(() => this.runCloseOperation(meshName, spotId, active, signal, deadline));
+            active.ready = run.finally(() => {
+                active.ready = undefined;
+                if (this.closeOperations.get(key) === active) {
+                    this.closeOperations.delete(key);
                 }
             });
-            this.pendingInstanceCloses.set(key, trackedClosePromise);
-            if (currentTurn) {
-                // The current turn must return before its terminal completion can
-                // release the activation recovery fence and allow the durable close
-                // CAS. The registered close gate prevents a second admission while
-                // that detached close finishes.
-                this.options.detachedTaskRunner?.runDetached(`instance spot close ${String(spotId)}`, async () => {
-                    await trackedClosePromise;
-                });
-                if (this.options.detachedTaskRunner === undefined) {
-                    void trackedClosePromise.catch(() => undefined);
-                }
-                return true;
-            }
-            return await trackedClosePromise;
         }
-        const operation = beginClose();
-        if (operation === undefined) {
+        return await operation.ready;
+    }
+    async runCloseOperation(meshName, spotId, operation, signal, deadline) {
+        const began = await this.beginCloseAuthority(meshName, spotId, operation, signal);
+        if (!began)
             return false;
+        const seal = operation.activation.sealExecution(true);
+        await this.activationLifecycle.sealForClose(operation.activation, seal);
+        const closingFailure = await this.activationLifecycle.cleanupClosedActivation(operation.activation, operation.reason, deadline);
+        await operation.authority?.release();
+        // The incarnation has no further lifecycle item once its authority is
+        // released, so its lifecycle lane admission closes with this Close.
+        operation.activation.serial.closeAdmission();
+        this.activations.finishClose(meshName, spotId);
+        this.closeOperations.delete(`${meshName}\0${String(spotId)}`);
+        // An OnClosing failure never changes a Close result; host shutdown alone
+        // reports it as its teardown outcome after cleanup has finished.
+        if (closingFailure !== undefined && operation.reason === contracts_1.ZLinkSpotCloseReason.HostShutdown) {
+            throw closingFailure;
         }
-        if (currentTurn) {
-            if (operation.started) {
-                this.options.detachedTaskRunner?.runDetached(`spot close ${String(spotId)}`, async () => {
-                    await operation.ready;
-                });
-                if (this.options.detachedTaskRunner === undefined) {
-                    void operation.ready.catch(() => undefined);
-                }
-            }
-            return true;
+        return true;
+    }
+    async beginCloseAuthority(meshName, spotId, operation, signal) {
+        await this.options.instanceSpotApplicationQuiescenceProvider?.(meshName, spotId, signal);
+        if (!operation.activation.canClose(operation.reason))
+            return false;
+        if (operation.activation.executionBarrier.isSealed) {
+            throw (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.SpotMoving, `Spot '${String(spotId)}' is sealed for relocation.`, true);
+        }
+        const authorityPromise = Promise.resolve().then(() => operation.beginAuthority(() => {
+            operation.committed = true;
+        }));
+        operation.authorityDecision = authorityPromise.then(() => undefined, () => undefined);
+        const authority = await authorityPromise;
+        if (authority === undefined)
+            return false;
+        operation.authority = authority;
+        if (!this.isSpotClosing(meshName, spotId)) {
+            throw new Error(`Spot '${String(spotId)}' Closing authority did not confirm its commit.`);
         }
-        return await operation.ready;
+        return true;
     }
     async executeOnSpot(spotType, spotId, operation, signal) {
         (0, abort_1.throwIfAborted)(signal);
@@ -750,9 +702,6 @@ class DefaultZLinkSpotManager {
     hasActiveSpot(spotId) {
         return this.activations.resolveUnique(spotId) !== undefined;
     }
-    canCloseUserSpot(meshName, spotId) {
-        return this.activations.canClose(meshName, spotId);
-    }
     beginUserSpotPublication(meshName, spotId) {
         this.activations.stage(meshName, spotId);
     }
@@ -884,7 +833,7 @@ class DefaultZLinkSpotManager {
             requireMeshSpotReply(record.reply((0, channel_envelope_1.encodeChannelReplyParts)(envelope.header, response, codecs)));
         }
         catch (error) {
-            requireMeshSpotReply(record.reply((0, channel_envelope_1.encodeChannelErrorReplyParts)(envelope.header, error instanceof Error ? error.message : String(error))));
+            requireMeshSpotReply(record.reply((0, channel_envelope_1.encodeChannelErrorReplyParts)(envelope.header, error)));
         }
     }
     async ensureInstanceApplicationActivation(meshName, spotId) {
@@ -975,7 +924,7 @@ class DefaultZLinkSpotManager {
                     action: ZLinkDispatchOptions_1.ZLinkRuntimeDispatchErrorAction.ReplyError,
                     error
                 });
-                requireMeshSpotReply(record.reply((0, channel_envelope_1.encodeChannelErrorReplyParts)(envelope.header, error instanceof Error ? error.message : String(error))));
+                requireMeshSpotReply(record.reply((0, channel_envelope_1.encodeChannelErrorReplyParts)(envelope.header, error)));
             }
         });
     }
@@ -1074,6 +1023,29 @@ class DefaultZLinkSpotManager {
         }
     }
     async dispatchMeshActorJoin(meshName, owner, record) {
+        const spotId = owner.spotId;
+        const activation = spotId === null ? undefined : this.activations.resolve(meshName, spotId);
+        if (activation?.domain.kind === 'user') {
+            await activation.serial.executeLifecycleOperation(async () => {
+                if (this.isSpotClosing(meshName, activation.spotId) ||
+                    this.activations.resolve(meshName, activation.spotId) !== activation) {
+                    const rejection = (0, framework_errors_internal_1.createInternalFrameworkException)(framework_errors_internal_1.ZLinkFrameworkInternalErrorKind.RequestRejected, `User Spot '${String(spotId)}' is closing.`);
+                    if (record.replyFailure !== undefined) {
+                        const terminal = (0, framework_errors_internal_1.internalFrameworkWireReply)(rejection);
+                        requireMeshSpotReply(record.replyFailure(terminal.terminalResult, terminal.failureCode));
+                    }
+                    else {
+                        requireMeshSpotReply(record.replyActorJoin(1, []));
+                    }
+                    return;
+                }
+                await this.dispatchMeshActorJoinCore(meshName, owner, record);
+            });
+            return;
+        }
+        await this.dispatchMeshActorJoinCore(meshName, owner, record);
+    }
+    async dispatchMeshActorJoinCore(meshName, owner, record) {
         const spotId = owner.spotId;
         const control = record.kindData;
         if (control?.kind !== 'actorControl') {
@@ -1157,7 +1129,7 @@ class DefaultZLinkSpotManager {
         let ownedCallbackRequest;
         let materialized = false;
         let reply;
-        let deferredJoinRoot;
+        let deferredJoinCompletion;
         let preparedTransferState;
         let admissionOutcome;
         let accepted = false;
@@ -1286,13 +1258,13 @@ class DefaultZLinkSpotManager {
                             if (this.options.dispatchEntryActorJoin !== undefined &&
                                 transferRequest.completionOperationId !== undefined &&
                                 this.options.actorTransferRuntime !== undefined) {
-                                deferredJoinRoot =
-                                    await this.options.actorTransferRuntime.prepareDeferredJoinAccepted(actorId, transferRequest.completionOperationId, actorRef, Buffer.alloc(0));
+                                deferredJoinCompletion =
+                                    this.options.actorTransferRuntime.prepareDeferredJoinAccepted(actorId, transferRequest.completionOperationId, actorRef, Buffer.alloc(0));
                             }
                             admissionOutcome = {
                                 accepted: this.options.dispatchEntryActorJoin !== undefined,
                                 actorRef,
-                                ...(deferredJoinRoot === undefined ? {} : { deferredJoinRoot })
+                                ...(deferredJoinCompletion === undefined ? {} : { deferredJoinCompletion })
                             };
                         }
                         else if (activation === undefined) {
@@ -1313,8 +1285,8 @@ class DefaultZLinkSpotManager {
                                 if (response.accepted &&
                                     transferRequest.completionOperationId !== undefined &&
                                     this.options.actorTransferRuntime !== undefined) {
-                                    deferredJoinRoot =
-                                        await this.options.actorTransferRuntime.prepareDeferredJoinAccepted(actorId, transferRequest.completionOperationId, actorRef, encodedReply?.data() ?? Buffer.alloc(0), encodedReply === undefined
+                                    deferredJoinCompletion =
+                                        this.options.actorTransferRuntime.prepareDeferredJoinAccepted(actorId, transferRequest.completionOperationId, actorRef, encodedReply?.data() ?? Buffer.alloc(0), encodedReply === undefined
                                             ? undefined
                                             : (0, payload_codec_1.frameworkPayloadContentType)(encodedReply));
                                     this.options.runtimeEventPublisher?.publish({
@@ -1327,7 +1299,7 @@ class DefaultZLinkSpotManager {
                                 admissionOutcome = {
                                     accepted: response.accepted,
                                     actorRef,
-                                    ...(deferredJoinRoot === undefined ? {} : { deferredJoinRoot }),
+                                    ...(deferredJoinCompletion === undefined ? {} : { deferredJoinCompletion }),
                                     ...(encodedReply === undefined
                                         ? {}
                                         : {
@@ -1366,7 +1338,7 @@ class DefaultZLinkSpotManager {
                 if ('error' in admissionOutcome) {
                     throw admissionOutcome.error;
                 }
-                deferredJoinRoot = admissionOutcome.deferredJoinRoot;
+                deferredJoinCompletion = admissionOutcome.deferredJoinCompletion;
             }
             if (actor === undefined &&
                 transferRequest !== undefined &&
@@ -1436,7 +1408,7 @@ class DefaultZLinkSpotManager {
                 if (accepted &&
                     transferRequest?.completionOperationId !== undefined &&
                     this.options.actorTransferRuntime !== undefined) {
-                    deferredJoinRoot = await this.options.actorTransferRuntime.prepareDeferredJoinAccepted(actorId, transferRequest.completionOperationId, actorRef, reply?.data() ?? Buffer.alloc(0), reply === undefined ? undefined : (0, payload_codec_1.frameworkPayloadContentType)(reply));
+                    deferredJoinCompletion = this.options.actorTransferRuntime.prepareDeferredJoinAccepted(actorId, transferRequest.completionOperationId, actorRef, reply?.data() ?? Buffer.alloc(0), reply === undefined ? undefined : (0, payload_codec_1.frameworkPayloadContentType)(reply));
                     this.options.runtimeEventPublisher?.publish({
                         sourceName: 'zlink.framework.actor-handoff',
                         timestamp: new Date(),
@@ -1481,7 +1453,7 @@ class DefaultZLinkSpotManager {
                 // A lightweight Core actor-join notification can create the Actor
                 // before the formal transfer request reaches this branch. Preserve
                 // the full relocation fence in that race so a later Session bind
-                // refresh cannot erase the seal or accepted journal.
+                // refresh cannot erase the seal.
                 this.options.actorTransferRuntime.rememberRoutedActorTransferTarget(actorId, transferRequest.remoteBoundSessionTarget);
             }
             if (accepted &&
@@ -1494,7 +1466,7 @@ class DefaultZLinkSpotManager {
                     spotId,
                     transferId: transferRequest.transferId,
                     handoffBacklog: transferRequest.handoffBacklog,
-                    deferredJoinRoot
+                    deferredJoinCompletion
                 });
                 if (isRemoteCommit && admissionRecord !== undefined) {
                     this.formalRemoteActorAdmissions.markCommitted(transferRequest.transferId, actor);
@@ -1583,9 +1555,6 @@ class DefaultZLinkSpotManager {
             if (control.canonicalActorJoin !== undefined) {
                 this.formalRemoteActorAdmissions.fail(control.canonicalActorJoin.handoffId, error);
             }
-            if (deferredJoinRoot !== undefined && targetCommitPublished !== true) {
-                await this.options.actorTransferRuntime?.discardDeferredJoinAccepted(deferredJoinRoot);
-            }
             if (targetCommitPublished !== true) {
                 this.formalRemoteTransfers.delete(actorId);
             }
@@ -1602,6 +1571,33 @@ class DefaultZLinkSpotManager {
         }
     }
     async dispatchMeshSpotControl(meshName, owner, record) {
+        const spotId = owner.spotId;
+        const activation = spotId === null ? undefined : this.activations.resolve(meshName, spotId);
+        if (activation?.domain.kind === 'user') {
+            const transfer = { terminal: undefined };
+            const operation = activation.serial.executeLifecycleOperation(async () => {
+                await this.dispatchMeshSpotControlCore(meshName, owner, record, (terminal) => {
+                    transfer.terminal = terminal;
+                });
+                await transfer.terminal;
+            });
+            const control = record.kindData;
+            const actorId = control?.kind === 'actorControl' ? control.currentActor?.actorId : undefined;
+            if (control?.kind === 'actorControl' &&
+                control.lifecycleKind === service_runtime_contracts_1.ActorLifecycleKind.Joined &&
+                actorId !== undefined &&
+                this.formalRemoteTransfers.get(actorId) !== undefined) {
+                this.options.detachedTaskRunner?.runDetached(`actor transfer target commit ${actorId}`, async () => await operation);
+                if (this.options.detachedTaskRunner === undefined)
+                    void operation.catch(() => undefined);
+                return;
+            }
+            await operation;
+            return;
+        }
+        await this.dispatchMeshSpotControlCore(meshName, owner, record);
+    }
+    async dispatchMeshSpotControlCore(meshName, owner, record, onDetachedTerminal) {
         const spotId = owner.spotId;
         const control = record.kindData;
         if (control?.kind !== 'actorControl') {
@@ -1664,15 +1660,15 @@ class DefaultZLinkSpotManager {
                     await activation.spot.onJoinedActor(actor);
                 };
                 const completePublicJoin = async () => {
-                    const deferredJoinRoot = pendingTransfer?.deferredJoinRoot;
-                    if (deferredJoinRoot !== undefined) {
+                    const deferredJoinCompletion = pendingTransfer?.deferredJoinCompletion;
+                    if (deferredJoinCompletion !== undefined) {
                         const currentRef = this.options.actorTransferRuntime === undefined
                             ? null
                             : control.currentActor;
                         if (currentRef === null) {
                             throw new Error(`Actor '${actor.context.actorId}' has no target ref for deferred Join completion.`);
                         }
-                        await this.options.actorTransferRuntime?.commitAndDeliverDeferredJoinAccepted(deferredJoinRoot, actor, currentRef, (operation) => activation.executeActor(actor.context.actorId, async () => await operation()));
+                        await this.options.actorTransferRuntime?.deliverDeferredJoinAccepted(deferredJoinCompletion, actor, currentRef, (operation) => activation.executeActor(actor.context.actorId, async () => await operation()));
                     }
                 };
                 const completeTargetReady = async () => {
@@ -1730,9 +1726,15 @@ class DefaultZLinkSpotManager {
                         // them only after the lifecycle turn above has been released.
                         await completeTargetReady();
                     };
-                    this.options.detachedTaskRunner?.runDetached(`actor transfer target commit ${actor.context.actorId}`, resume);
-                    if (this.options.detachedTaskRunner === undefined) {
-                        void resume().catch(() => undefined);
+                    const terminal = resume();
+                    if (onDetachedTerminal !== undefined) {
+                        onDetachedTerminal(terminal);
+                    }
+                    else {
+                        this.options.detachedTaskRunner?.runDetached(`actor transfer target commit ${actor.context.actorId}`, async () => await terminal);
+                        if (this.options.detachedTaskRunner === undefined) {
+                            void terminal.catch(() => undefined);
+                        }
                     }
                     return;
                 }
@@ -1793,7 +1795,8 @@ class DefaultZLinkSpotManager {
             await activation.serial.execute(() => activation.spot.onJoinedActor(actor));
         }
         await submitSourceLeave(admission.admission.actorRef.nodeRid);
-        if (outcome.deferredJoinRoot !== undefined && this.options.actorTransferRuntime !== undefined) {
+        if (outcome.deferredJoinCompletion !== undefined &&
+            this.options.actorTransferRuntime !== undefined) {
             const submitMailbox = targetsEntry
                 ? (operation) => operation()
                 : (operation) => {
@@ -1803,12 +1806,12 @@ class DefaultZLinkSpotManager {
                     }
                     return activation.executeActor(actor.context.actorId, operation);
                 };
-            await this.options.actorTransferRuntime.commitAndDeliverDeferredJoinAccepted(outcome.deferredJoinRoot, actor, actorRef, submitMailbox, signal);
+            await this.options.actorTransferRuntime.deliverDeferredJoinAccepted(outcome.deferredJoinCompletion, actor, actorRef, submitMailbox, signal);
         }
         this.formalRemoteActorAdmissions.markCommitted(relocationId, actor);
         return true;
     }
-    async restoreCanonicalActorJoinRecovery(recovery, signal, canonicalInventoryDigest) {
+    async restoreCanonicalActorJoinRecovery(recovery, signal) {
         (0, abort_1.throwIfAborted)(signal);
         const admission = this.formalRemoteActorAdmissions.get(recovery.request.handoffId);
         if (admission === undefined) {
@@ -1850,15 +1853,14 @@ class DefaultZLinkSpotManager {
         }
         // Command 28 carries a present reply in one outer framework-multipart
         // part. The accepted target admission still owns the inner typed content
-        // type, which the durable completion must retain for application decode.
+        // type, which the process-local completion keeps for application decode.
         const admittedContentType = admittedReply.byteLength === 0 ? recovery.replyContentType : outcome.replyContentType;
         const transfer = this.options.actorTransferRuntime;
         if (transfer === undefined) {
             throw new Error('Canonical Actor Join recovery requires the Actor transfer runtime.');
         }
-        const deferred = await transfer.prepareDeferredJoinAccepted(recovery.request.actorId, recovery.operationId, admitted.actorRef, recovery.reply, admittedContentType, signal, canonicalInventoryDigest);
-        this.formalRemoteActorAdmissions.attachDeferredJoinRoot(recovery.request.handoffId, deferred);
-        return deferred;
+        const deferred = transfer.prepareDeferredJoinAccepted(recovery.request.actorId, recovery.operationId, admitted.actorRef, recovery.reply, admittedContentType);
+        this.formalRemoteActorAdmissions.attachDeferredJoinCompletion(recovery.request.handoffId, deferred);
     }
     encodeMeshActorReply(requestHeaderPart, kind, payload) {
         // Spec 27 §4/§7: the decode gate strips the observation-only flow pair at