@zlink-systems/framework 0.25.0 → 0.27.0

package/src/runtime/spots/index.ts

@@ -1,3 +1,4 @@
+import { dispatchReasonFromError } from '../diagnostics/dispatch-error-details';
 import type {
   ActorRef,
   RoutingId,
@@ -32,6 +33,7 @@ import {
   ZLinkMessage,
   ZLinkFrameworkException,
   ZLinkFrameworkErrorKind,
+  ZLinkFrameworkRuntimeState,
   ZLinkSpotCloseReason,
   ZLinkSpotKind
 } from '../../contracts';
@@ -48,6 +50,7 @@ import {
   runWithFlow,
   type ZLinkRuntimeEventPublisher
 } from '../diagnostics';
+import { diagnosticTextOrAbsent } from '../diagnostics/diagnostic-text';
 import { ZLinkBufferMessage as RuntimeMessage } from '../backend/runtime-message';
 import { SubmitResult } from '../backend/runtime-values';
 import {
@@ -59,10 +62,10 @@ import {
 } from '../foundation/service-runtime-contracts';
 import { zlinkMetadataByteLength, zlinkSerialWorkOptions } from '../execution/serial-work-size';
 import { ZLinkConfigurationException } from '../configuration';
+import { releaseApplicationJobPermitBeforeHandler } from '../application-jobs/application-job-queue-scope';
 import {
   ZLinkFrameworkInternalErrorKind,
   createInternalFrameworkException,
-  internalFrameworkErrorKind,
   internalFrameworkWireReply
 } from '../framework-errors-internal';
 import type { ZLinkBackendSpot, ZLinkBackendSpotNode } from '../backend/contracts';
@@ -72,7 +75,7 @@ import { ZLinkWorkerRuntime } from '../workers';
 import {
   type ZLinkActorHandoffPrefixAdmission,
   type ZLinkActorHandoffPrefixRecord,
-  type ZLinkDeferredJoinAcceptedRoot,
+  type ZLinkDeferredJoinCompletion,
   type ZLinkRemoteBoundSessionTarget
 } from '../actors';
 import type { ZLinkLocationLifecycle } from '../locations';
@@ -130,9 +133,9 @@ export {
 } from './spot-handler-registry';
 export { ZLinkRuntimeSpotPublisherTransport } from './spot-publisher-transport';
 import { ZLinkSpotActivationRegistry } from './spot-activation-registry';
-import { ZLinkSpotCloseOccupiedError, type ZLinkSpotActivation } from './spot-activation-state';
+import type { ZLinkSpotActivation } from './spot-activation-state';
 import { ZLinkSpotActivationLifecycle, type ZLinkNativeSpotAuthority } from './spot-activation';
-import { ZLinkSpotActorMembership, type ZLinkActorJoinRollback } from './spot-actor-membership';
+import { ZLinkSpotActorMembership } from './spot-actor-membership';
 import { ZLinkFormalRemoteActorTransferRegistry } from './formal-remote-actor-transfer-registry';
 import {
   ZLinkFormalRemoteActorAdmissionRegistry,
@@ -145,6 +148,7 @@ import type {
   ZLinkSpotBoundSessionRuntime
 } from './spot-runtime-ports';
 import type { ZLinkRuntimeAdmissionGate } from '../admission';
+import type { ZLinkActivationAdmission } from '../activation-admission';
 import type { ZLinkDetachedTaskRunner } from './spot-actor-join-dispatch';
 import type { ZLinkLocalSpotCreateResult } from './spot-manager-internal-contracts';
 export type { ZLinkLocalSpotCreateResult } from './spot-manager-internal-contracts';
@@ -203,6 +207,11 @@ export interface ZLinkSpotManagerOptions {
     actor: ZLinkActor,
     handoffBacklog?: readonly ZLinkActorHandoffPacket[]
   ) => Promise<void>;
+  readonly executeEntryActor?: <T>(
+    meshName: string,
+    actorId: string,
+    operation: () => Promise<T>
+  ) => Promise<T>;
   readonly actorCountProvider?: (spotId: RoutingId) => number;
   readonly userSpotExecutionMode?: (
     meshName: string,
@@ -216,7 +225,6 @@ export interface ZLinkSpotManagerOptions {
     readonly actorRef?: ActorRef;
     readonly spotId?: RoutingId;
   };
-  readonly actorBindingGenerationObserver?: (actorId: string, generation: bigint) => void;
   readonly channelClient?: ZLinkChannelClient;
   readonly fanoutClient?: ZLinkFanoutClient;
   readonly spotPublisherClient?: ZLinkSpotPublisherClient;
@@ -224,9 +232,9 @@ export interface ZLinkSpotManagerOptions {
   readonly routedTransport?: ZLinkSpotRoutedTransport;
   readonly addressTransport?: import('./spot-outbound').ZLinkSpotAddressTransport;
   readonly spotRouterChannelIdForMesh?: (meshName: string) => string;
-  readonly channelMeshNameForChannel?: (channelName: string) => string | undefined;
   readonly providerResolver?: ZLinkProviderResolver;
   readonly dispatchErrors?: ZLinkDispatchErrorReporter;
+  readonly closeErrorSink?: import('../diagnostics/dispatch-error-port').ZLinkDispatchErrorSink;
   readonly runtimeEventPublisher?: ZLinkRuntimeEventPublisher;
   readonly workerRuntime?: ZLinkWorkerRuntime;
   readonly messageSerializers?: ReadonlyMap<string, ZLinkMessageSerializer>;
@@ -238,12 +246,28 @@ export interface ZLinkSpotManagerOptions {
   ) => Promise<void>;
   readonly beginInstanceIdleClosingAuthority?: (
     meshName: string,
-    spotId: RoutingId
-  ) => Promise<{ restoreReady(): Promise<void> } | undefined>;
+    spotId: RoutingId,
+    onCommitted: () => void
+  ) => Promise<
+    import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+  >;
   readonly beginInstanceClosingAuthority?: (
     meshName: string,
-    spotId: RoutingId
-  ) => Promise<{ restoreReady(): Promise<void> } | undefined>;
+    spotId: RoutingId,
+    onCommitted: () => void,
+    objectGeneration: bigint
+  ) => Promise<
+    import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+  >;
+  /** Moves a local User Spot incarnation's authority to Closing for a context Close. */
+  readonly beginUserClosingAuthority?: (
+    meshName: string,
+    spotId: RoutingId,
+    objectGeneration: bigint,
+    onCommitted: () => void
+  ) => Promise<
+    import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+  >;
   readonly instanceSpotApplicationTargetProvider?: (
     meshName: string,
     spotId: RoutingId
@@ -261,7 +285,6 @@ export interface ZLinkSpotManagerOptions {
     spotId: RoutingId,
     authority?: ZLinkNativeSpotAuthority
   ) => ZLinkBackendSpot | undefined;
-  readonly createReceived?: () => import('../backend').ZLinkBackendReceived;
   readonly createTopicMessage?: () => import('../backend').ZLinkBackendTopicMessage;
   readonly nativeSpotNodeProvider?: (meshName: string) => ZLinkBackendSpotNode | undefined;
   readonly actorResolver?: (actorId: string) => ZLinkActor | undefined;
@@ -274,15 +297,33 @@ export interface ZLinkSpotManagerOptions {
     readonly ownerLeaseGeneration: bigint;
   }) => Promise<{ readonly actorType: string }>;
   readonly actorLifecycleResolver?: (actorId: string) => ZLinkActor | undefined;
-  readonly detachedTaskRunner?: ZLinkDetachedTaskRunner;
+  readonly detachedTaskRunner: ZLinkDetachedTaskRunner;
   readonly actorTransferRuntime?: ZLinkSpotActorTransferRuntime;
   readonly boundSessionRuntime?: ZLinkSpotBoundSessionRuntime;
   readonly actorHandoffRuntime?: ZLinkSpotActorHandoffRuntime;
   readonly metrics?: import('../diagnostics').ZLinkRuntimeMetrics;
   readonly admission?: ZLinkRuntimeAdmissionGate;
-  readonly statefulExecutionAllowed?: () => boolean;
-  readonly activationConcurrencyLimitProvider?: (meshName: string) => number;
-  readonly onInstanceActivationConcurrencyChanged?: (meshName: string) => void;
+  readonly statefulExecution?: {
+    readonly admissionOpen: () => boolean;
+    readonly hostState: () => ZLinkFrameworkRuntimeState;
+  };
+  readonly activationAdmission?: ZLinkActivationAdmission;
+}
+
+interface ZLinkTargetSpotCloseOperation {
+  readonly activation: ZLinkSpotActivation;
+  readonly reason: ZLinkSpotCloseReason;
+  readonly beginAuthority: (
+    onCommitted: () => void
+  ) => Promise<
+    import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+  >;
+  authority?: import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority;
+  authorityDecision?: Promise<void>;
+  ready?: Promise<boolean>;
+  canExecuteApplication?(
+    record: import('../execution/serial-execution-queue').ZLinkSerialWorkRecord<unknown>
+  ): boolean;
 }
 
 export class DefaultZLinkSpotManager {
@@ -306,27 +347,7 @@ export class DefaultZLinkSpotManager {
     string,
     Map<string, Promise<ZLinkSpotActivation>>
   >();
-  private readonly instanceActivationGates = new Map<
-    string,
-    {
-      readonly meshName: string;
-      readonly limit: number;
-      active: number;
-      //  Tombstone slots + head cursor keep abort O(1) and admit O(1) amortized
-      //  instead of indexOf/splice + shift scans under a cancellation storm.
-      readonly waiters: Array<
-        | {
-            resolve: (release: () => void) => void;
-            reject: (error: unknown) => void;
-            signal?: AbortSignal;
-            abort?: () => void;
-          }
-        | undefined
-      >;
-      waiterHead: number;
-    }
-  >();
-  private readonly pendingInstanceCloses = new Map<string, Promise<boolean>>();
+  private readonly closeOperations = new Map<string, ZLinkTargetSpotCloseOperation>();
   private readonly pendingInstanceTerminals = new Map<string, number>();
   private readonly pendingInstanceTerminalGenerations = new Map<string, Map<string, number>>();
   private readonly deferredInstanceAuthorityReleases = new Map<string, Set<bigint>>();
@@ -337,6 +358,9 @@ export class DefaultZLinkSpotManager {
     private readonly options: ZLinkSpotManagerOptions,
     timerClock?: import('./spot-timer').ZLinkTimerClock
   ) {
+    if ((options.detachedTaskRunner as unknown) === undefined) {
+      throw new ZLinkConfigurationException('Spot manager requires a detached task runner.');
+    }
     this.activations = new ZLinkSpotActivationRegistry(options.metrics);
     this.factories = new Set(options.spotFactories);
     this.workerRuntime = options.workerRuntime ?? new ZLinkWorkerRuntime();
@@ -347,7 +371,7 @@ export class DefaultZLinkSpotManager {
       nodeGenerationProvider: options.nodeGenerationProvider
     });
     this.routedSpotPackets = new ZLinkRoutedSpotPacketDispatch({
-      resolveActivation: (spotId) => this.activations.resolveUnique(spotId),
+      resolveActivation: (spotId) => this.resolveApplicationActivation(spotId),
       claimApplicationWork:
         options.admission === undefined
           ? undefined
@@ -392,12 +416,12 @@ export class DefaultZLinkSpotManager {
       spotRouterChannelIdForMesh: options.spotRouterChannelIdForMesh,
       providerResolver: options.providerResolver,
       dispatchErrors: options.dispatchErrors,
+      closeErrorSink: options.closeErrorSink,
       runtimeEventPublisher: options.runtimeEventPublisher,
       workerRuntime: this.workerRuntime,
       messageSerializers: options.messageSerializers,
       locationClaim: this.locationClaim,
       createNativeSpot: options.createNativeSpot,
-      createReceived: options.createReceived,
       createTopicMessage: options.createTopicMessage,
       nativeSpotNodeProvider: options.nativeSpotNodeProvider,
       actorResolver: options.actorResolver,
@@ -406,11 +430,11 @@ export class DefaultZLinkSpotManager {
       boundSessionRuntime: options.boundSessionRuntime,
       actorHandoffRuntime: options.actorHandoffRuntime,
       admission: options.admission,
-      statefulExecutionAllowed: options.statefulExecutionAllowed,
+      statefulExecutionAllowed: options.statefulExecution?.admissionOpen,
       leaveActor: (spotId, actor, signal, meshName) =>
         this.actorMembership.leaveActor(spotId, actor, signal, meshName),
-      closeSpot: (meshName, spotId, signal, reason) =>
-        this.closeWithReason(meshName, spotId, signal, reason),
+      requestContextClose: (activation, objectGeneration, signal) =>
+        this.closeFromContext(activation, objectGeneration, signal),
       registerActivation: (activation) => {
         this.activations.register(activation);
         this.scheduleIdleSweep();
@@ -470,14 +494,6 @@ export class DefaultZLinkSpotManager {
     return this.activations.list(meshName).length;
   }
 
-  instanceActivationConcurrency(meshName: string): {
-    readonly active: number;
-    readonly limit: number;
-  } {
-    const limit = this.options.activationConcurrencyLimitProvider?.(meshName) ?? 128;
-    return { active: this.instanceActivationGates.get(meshName)?.active ?? 0, limit };
-  }
-
   resolveRelocationActivation(
     meshName: string,
     spotId: RoutingId
@@ -548,7 +564,7 @@ export class DefaultZLinkSpotManager {
       await awaitWithAbort(existing, signal);
       return;
     }
-    const release = await this.acquireInstanceActivation(meshName, signal);
+    const release = await this.options.activationAdmission?.acquire(meshName, signal);
     try {
       await this.materializeInstanceCore(
         meshName,
@@ -559,7 +575,7 @@ export class DefaultZLinkSpotManager {
         signal
       );
     } finally {
-      release();
+      release?.();
     }
   }
 
@@ -590,7 +606,8 @@ export class DefaultZLinkSpotManager {
       // explicit Instance intent arriving at that boundary must wait for the
       // old resources to be released before materializing the replacement.
       // This is lifecycle convergence; it does not resubmit application work.
-      const pendingClose = this.pendingInstanceCloses.get(key);
+      const closeOperation = this.closeOperations.get(key);
+      const pendingClose = closeOperation?.ready;
       if (pendingClose !== undefined) {
         await awaitWithAbort(pendingClose, signal);
         continue;
@@ -687,94 +704,50 @@ export class DefaultZLinkSpotManager {
     }
   }
 
-  private async acquireInstanceActivation(
-    meshName: string,
-    signal?: AbortSignal
-  ): Promise<() => void> {
-    let gate = this.instanceActivationGates.get(meshName);
-    if (gate === undefined) {
-      gate = {
-        meshName,
-        limit: this.options.activationConcurrencyLimitProvider?.(meshName) ?? 128,
-        active: 0,
-        waiters: [],
-        waiterHead: 0
-      };
-      this.instanceActivationGates.set(meshName, gate);
-    }
-    if (signal?.aborted === true) throw signal.reason;
-    if (gate.active < gate.limit) {
-      gate.active += 1;
-      this.options.onInstanceActivationConcurrencyChanged?.(meshName);
-      return () => this.releaseInstanceActivation(gate!);
-    }
-    return new Promise<() => void>((resolve, reject) => {
-      const waiter = { resolve, reject, signal, abort: undefined as (() => void) | undefined };
-      const slot = gate!.waiters.length;
-      waiter.abort = () => {
-        if (gate!.waiters[slot] === waiter) gate!.waiters[slot] = undefined;
-        reject(signal?.reason);
-      };
-      signal?.addEventListener('abort', waiter.abort, { once: true });
-      gate!.waiters.push(waiter);
-    });
-  }
-
-  private releaseInstanceActivation(gate: {
-    readonly meshName: string;
-    readonly limit: number;
-    active: number;
-    readonly waiters: Array<
-      | {
-          resolve: (release: () => void) => void;
-          reject: (error: unknown) => void;
-          signal?: AbortSignal;
-          abort?: () => void;
-        }
-      | undefined
-    >;
-    waiterHead: number;
-  }): void {
-    while (gate.waiterHead < gate.waiters.length) {
-      const waiter = gate.waiters[gate.waiterHead];
-      gate.waiters[gate.waiterHead] = undefined;
-      gate.waiterHead += 1;
-      if (gate.waiterHead >= gate.waiters.length) {
-        gate.waiters.length = 0;
-        gate.waiterHead = 0;
-      }
-      if (waiter === undefined) continue;
-      if (waiter.abort !== undefined) waiter.signal?.removeEventListener('abort', waiter.abort);
-      waiter.resolve(() => this.releaseInstanceActivation(gate));
-      return;
-    }
-    gate.waiters.length = 0;
-    gate.waiterHead = 0;
-    gate.active -= 1;
-    this.options.onInstanceActivationConcurrencyChanged?.(gate.meshName);
-  }
-
   isInstanceMaterialized(meshName: string, instanceType: string, spotId: RoutingId): boolean {
-    const activation = this.activations.resolve(meshName, spotId);
+    const activation = this.resolveApplicationActivation(spotId, meshName);
     return (
       activation !== undefined &&
       activation.spotType === this.requireInstanceFactory(meshName, instanceType)
     );
   }
 
+  private resolveApplicationActivation(
+    spotId: RoutingId,
+    meshName?: string
+  ): ZLinkSpotActivation | undefined {
+    const current =
+      meshName === undefined
+        ? this.activations.resolveUnique(spotId)
+        : this.activations.resolve(meshName, spotId);
+    if (current !== undefined) return current;
+    if (meshName !== undefined)
+      return this.closeOperations.get(`${meshName}\0${String(spotId)}`)?.activation;
+    for (const operation of this.closeOperations.values()) {
+      if (String(operation.activation.spotId) === String(spotId)) return operation.activation;
+    }
+    return undefined;
+  }
+
   isInstanceMaterializing(meshName: string, spotId: RoutingId): boolean {
     const prefix = instanceMaterializationPrefix(meshName, spotId);
-    return (this.pendingInstanceMaterializationsByPrefix.get(prefix)?.size ?? 0) > 0;
+    return (
+      (this.pendingInstanceMaterializationsByPrefix.get(prefix)?.size ?? 0) > 0 ||
+      this.closeOperations.get(`${meshName}\0${String(spotId)}`)?.authority !== undefined
+    );
   }
 
-  isInstanceClosing(meshName: string, spotId: RoutingId): boolean {
-    const key = `${meshName}\0${String(spotId)}`;
+  isSpotClosing(meshName: string, spotId: RoutingId): boolean {
     return (
-      this.pendingInstanceCloses.has(key) ||
-      this.activations.closingOperation(meshName, spotId) !== undefined
+      this.closeOperations.get(`${meshName}\0${String(spotId)}`)?.authority !== undefined ||
+      this.activations.activationForClose(meshName, spotId)?.executionBarrier.isCloseSealed === true
     );
   }
 
+  pendingSpotCloseDecision(meshName: string, spotId: RoutingId): Promise<void> | undefined {
+    return this.closeOperations.get(`${meshName}\0${String(spotId)}`)?.authorityDecision;
+  }
+
   async discardInstance(meshName: string, spotId: RoutingId): Promise<void> {
     const activation = this.activations.resolve(meshName, spotId);
     if (activation === undefined) return;
@@ -835,7 +808,7 @@ export class DefaultZLinkSpotManager {
     }
     this.pendingInstanceTerminals.delete(key);
     this.pendingInstanceTerminalGenerations.delete(key);
-    const pendingClose = this.pendingInstanceCloses.get(key);
+    const pendingClose = this.closeOperations.get(key)?.ready;
     if (pendingClose !== undefined) {
       this.deferInstanceAuthorityRelease(key, objectGeneration);
       await pendingClose;
@@ -950,20 +923,6 @@ export class DefaultZLinkSpotManager {
         ) {
           continue;
         }
-        let durableClosing: { restoreReady(): Promise<void> } | undefined;
-        try {
-          durableClosing = await (this.options.beginInstanceIdleClosingAuthority?.(
-            activation.meshName,
-            activation.spotId
-          ) ?? Promise.resolve({ restoreReady: async () => undefined }));
-        } catch (error) {
-          activation.abortIdleEviction();
-          throw error;
-        }
-        if (durableClosing === undefined) {
-          activation.abortIdleEviction();
-          continue;
-        }
         const close = this.closeWithReason(
           activation.meshName,
           activation.spotId,
@@ -973,25 +932,17 @@ export class DefaultZLinkSpotManager {
         const run = async () => {
           try {
             const closed = await close;
-            if (!closed) {
-              await durableClosing.restoreReady();
-              activation.abortIdleEviction();
-            }
+            if (!closed) activation.abortIdleEviction();
           } catch (error) {
-            if (error instanceof ZLinkSpotCloseOccupiedError) {
-              await durableClosing.restoreReady();
-            }
-            activation.abortIdleEviction();
+            if (!this.isSpotClosing(activation.meshName, activation.spotId))
+              activation.abortIdleEviction();
             throw error;
           }
         };
-        this.options.detachedTaskRunner?.runDetached(
+        this.options.detachedTaskRunner.runDetached(
           `instance idle eviction ${String(activation.spotId)}`,
           run
         );
-        if (this.options.detachedTaskRunner === undefined) {
-          void run().catch(() => undefined);
-        }
       }
     } finally {
       this.idleSweepRunning = false;
@@ -1085,8 +1036,9 @@ export class DefaultZLinkSpotManager {
     requireMeshName(meshName);
     const args = normalizeSpotCreateArgs(requestOrSignal, signal);
     throwIfAborted(args.signal);
+    this.options.admission?.requireRequest('SPOT create', meshName);
     const operation = this.activations.getOrBegin(meshName, spotType, spotId, async () => {
-      this.options.admission?.requireRequest('SPOT create', meshName);
+      const release = await this.options.activationAdmission?.acquire(meshName, args.signal);
       const ownedRequest =
         args.request === undefined
           ? RuntimeMessage.from(Buffer.alloc(0))
@@ -1102,6 +1054,7 @@ export class DefaultZLinkSpotManager {
         );
       } finally {
         ownedRequest.close();
+        release?.();
       }
     });
     return await awaitWithAbort(operation.ready, args.signal);
@@ -1109,12 +1062,16 @@ export class DefaultZLinkSpotManager {
 
   async find(meshName: string, spotId: RoutingId): Promise<ZLinkSpotInfo | null> {
     requireMeshName(meshName);
-    return this.activations.has(meshName, spotId) ? { spotId } : null;
+    return this.activations.has(meshName, spotId) && !this.isSpotClosing(meshName, spotId)
+      ? { spotId }
+      : null;
   }
 
   async list(meshName: string): Promise<readonly ZLinkSpotInfo[]> {
     requireMeshName(meshName);
-    return this.activations.list(meshName);
+    return this.activations
+      .list(meshName)
+      .filter(({ spotId }) => !this.isSpotClosing(meshName, spotId));
   }
 
   async drainForShutdown(meshName: string, signal?: AbortSignal, deadline?: Date): Promise<void> {
@@ -1143,120 +1100,289 @@ export class DefaultZLinkSpotManager {
     return await this.closeWithReason(meshName, spotId, signal, ZLinkSpotCloseReason.ExplicitClose);
   }
 
+  async closeUserWithAuthority(
+    meshName: string,
+    spotId: RoutingId,
+    beginAuthority: (
+      onCommitted: () => void
+    ) => Promise<import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority>,
+    signal?: AbortSignal
+  ): Promise<boolean> {
+    return await this.closeWithReason(
+      meshName,
+      spotId,
+      signal,
+      ZLinkSpotCloseReason.ExplicitClose,
+      undefined,
+      beginAuthority
+    );
+  }
+
+  private closeFromContext(
+    activation: ZLinkSpotActivation,
+    objectGeneration: bigint,
+    signal?: AbortSignal
+  ): Promise<boolean> {
+    const { meshName, spotId } = activation;
+    const operation = this.closeOperations.get(`${meshName}\0${String(spotId)}`);
+    const current = operation?.activation ?? this.activations.resolve(meshName, spotId);
+    if (current === undefined) {
+      return Promise.resolve(false);
+    }
+    if (current !== activation || current.objectGeneration !== objectGeneration) {
+      return Promise.reject(
+        createInternalFrameworkException(
+          ZLinkFrameworkInternalErrorKind.InvalidOperation,
+          `Spot '${String(spotId)}' generation is stale.`
+        )
+      );
+    }
+    const beginUserAuthority =
+      activation.domain.kind === 'user' && this.options.beginUserClosingAuthority !== undefined
+        ? (onCommitted: () => void) =>
+            this.options.beginUserClosingAuthority!(meshName, spotId, objectGeneration, onCommitted)
+        : undefined;
+    return this.closeWithReason(
+      meshName,
+      spotId,
+      signal,
+      ZLinkSpotCloseReason.ExplicitClose,
+      undefined,
+      beginUserAuthority
+    );
+  }
+
   private async closeWithReason(
     meshName: string,
     spotId: RoutingId,
     signal?: AbortSignal,
     reason = ZLinkSpotCloseReason.ExplicitClose,
-    deadline?: Date
+    deadline?: Date,
+    beginUserAuthority?: (
+      onCommitted: () => void
+    ) => Promise<
+      import('../locations/spot-location-claims').ZLinkInstanceClosingAuthority | undefined
+    >
   ): Promise<boolean> {
     requireMeshName(meshName);
     const key = `${meshName}\0${String(spotId)}`;
-    const closing = this.activations.closingOperation(meshName, spotId);
-    if (closing !== undefined) {
-      return await closing.ready;
-    }
-    const pendingClose = this.pendingInstanceCloses.get(key);
-    if (pendingClose !== undefined) {
-      const pendingActivation = this.activations.resolve(meshName, spotId);
-      if (pendingActivation?.serial.isCurrentTurn === true) return true;
-      return await pendingClose;
-    }
-    const activation = this.activations.resolve(meshName, spotId);
-    if (activation === undefined) {
-      return false;
+    let operation = this.closeOperations.get(key);
+    if (operation === undefined) {
+      const activation = this.activations.resolve(meshName, spotId);
+      if (activation === undefined) return false;
+      if (
+        activation.domain.kind === 'user' &&
+        reason === ZLinkSpotCloseReason.ExplicitClose &&
+        beginUserAuthority === undefined
+      ) {
+        throw createInternalFrameworkException(
+          ZLinkFrameworkInternalErrorKind.InvalidOperation,
+          `User Spot '${String(spotId)}' Close requires its authority owner.`
+        );
+      }
+      const domain = activation.domain;
+      const beginAuthority =
+        beginUserAuthority ??
+        (domain.kind === 'instance' &&
+        reason === ZLinkSpotCloseReason.ExplicitClose &&
+        this.options.beginInstanceClosingAuthority !== undefined
+          ? (onCommitted) =>
+              this.options.beginInstanceClosingAuthority!(
+                meshName,
+                spotId,
+                onCommitted,
+                domain.objectGeneration
+              )
+          : domain.kind === 'instance' &&
+              reason === ZLinkSpotCloseReason.IdleEvicted &&
+              this.options.beginInstanceIdleClosingAuthority !== undefined
+            ? (onCommitted) =>
+                this.options.beginInstanceIdleClosingAuthority!(meshName, spotId, onCommitted)
+            : async (onCommitted) => {
+                onCommitted();
+                return { release: async () => undefined };
+              });
+      operation = {
+        activation,
+        reason,
+        beginAuthority
+      };
+      if (reason === ZLinkSpotCloseReason.ExplicitClose) {
+        operation.canExecuteApplication = (record) => {
+          const context = record.context as
+            import('./spot-serial-turn-executor').ZLinkSpotApplicationTurnContext | undefined;
+          return context === undefined;
+        };
+      }
+      this.closeOperations.set(key, operation);
     }
-    const currentTurn = activation.serial.isCurrentTurn;
-    const isInstance = activation.domain.kind === 'instance';
-    const beginClose = () => {
-      const seal = activation.sealExecution();
-      const operation = this.activations.startClose(
-        meshName,
-        spotId,
-        (target) => this.activationLifecycle.closeAfterSeal(target, seal, signal, reason, deadline),
-        (target) => this.activationLifecycle.resourcesReleased(target),
-        reason
+    if (operation.ready === undefined) {
+      const active = operation;
+      const run = active.activation.serial.executeControlLifecycleOperation(
+        () => this.runCloseOperation(meshName, spotId, active, signal, deadline),
+        active.canExecuteApplication === undefined
+          ? undefined
+          : (active as import('../execution/serial-execution-queue').ZLinkSerialLifecycleContext)
       );
-      if (operation === undefined) {
-        activation.abortExecutionSeal(seal);
-      }
-      return operation;
-    };
+      active.ready = run.finally(() => {
+        active.ready = undefined;
+        if (this.closeOperations.get(key) === active) {
+          this.closeOperations.delete(key);
+        }
+      });
+    }
+    return await operation.ready!;
+  }
 
-    if (isInstance) {
-      const beginAuthorityClose =
-        reason === ZLinkSpotCloseReason.ExplicitClose
-          ? this.options.beginInstanceClosingAuthority
+  private async runCloseOperation(
+    meshName: string,
+    spotId: RoutingId,
+    operation: ZLinkTargetSpotCloseOperation,
+    signal?: AbortSignal,
+    deadline?: Date
+  ): Promise<boolean> {
+    const seal = await this.beginCloseAuthority(meshName, spotId, operation, signal);
+    if (seal === undefined) return false;
+    if (seal !== true) {
+      await this.activationLifecycle.sealForClose(operation.activation, seal);
+    } else {
+      await operation.activation.executionBarrier.waitForStartedTurns(signal);
+    }
+    const closingFailure = await this.activationLifecycle.cleanupClosedActivation(
+      operation.activation,
+      operation.reason,
+      deadline
+    );
+    this.activations.finishClose(meshName, spotId);
+    const intentRecords: unknown[] = [];
+    operation.activation.serial.visitPendingApplication((record) => {
+      const context = record.context as
+        import('./spot-serial-turn-executor').ZLinkSpotApplicationTurnContext | undefined;
+      if (context?.replay !== undefined) intentRecords.push(record);
+    });
+    const hasIntent = intentRecords.length > 0;
+    // Spot messaging §7 step 3: with no Instance intent message waiting, the
+    // release decision also ends this Instance incarnation's admission in this turn.
+    if (!hasIntent && operation.activation.domain.kind === 'instance')
+      operation.activation.serial.closeAdmission();
+    const hostState = this.options.statefulExecution?.hostState();
+    const intentFailure = !hasIntent
+      ? undefined
+      : hostState === ZLinkFrameworkRuntimeState.Draining
+        ? createInternalFrameworkException(
+            ZLinkFrameworkInternalErrorKind.RuntimeShutdown,
+            'Instance intent cannot continue while the host is draining.'
+          )
+        : hostState === ZLinkFrameworkRuntimeState.Relocating ||
+            hostState === ZLinkFrameworkRuntimeState.Relocated ||
+            this.options.statefulExecution?.admissionOpen() === false ||
+            (operation.activation.executionBarrier.isSealed &&
+              !operation.activation.executionBarrier.isCloseSealed)
+          ? createInternalFrameworkException(
+              ZLinkFrameworkInternalErrorKind.SpotMoving,
+              'Instance intent cannot continue on an unavailable or relocating owner.'
+            )
           : undefined;
-      // Register the close gate before waiting for the current application
-      // and activation-authority terminal completions. A close requested from
-      // a handler cannot publish Closing until that handler's durable inbox
-      // completion has removed the recovery fence.
-      const trackedClosePromise = (async () => {
-        const waitForApplication = this.options.instanceSpotApplicationQuiescenceProvider?.(
-          meshName,
-          spotId,
-          signal
-        );
-        if (waitForApplication !== undefined) {
-          await waitForApplication;
-        }
-        const closingAuthority =
-          beginAuthorityClose === undefined
-            ? undefined
-            : await beginAuthorityClose(meshName, spotId);
-        if (beginAuthorityClose !== undefined && closingAuthority === undefined) {
-          return false;
-        }
-        const operation = beginClose();
-        if (operation === undefined) {
-          await closingAuthority?.restoreReady();
-          return false;
+    if (
+      operation.reason === ZLinkSpotCloseReason.ExplicitClose &&
+      hasIntent &&
+      intentFailure === undefined &&
+      operation.authority?.reincarnate !== undefined
+    ) {
+      try {
+        await operation.authority.reincarnate(async (authority) => {
+          await this.activationLifecycle.materializeInstance(
+            meshName,
+            authority.stableType,
+            operation.activation.spotType as Type<ZLinkInstanceSpot>,
+            spotId,
+            authority.objectGeneration,
+            signal,
+            operation.activation
+          );
+        });
+        // The new incarnation shares this serial owner and admits membership work again.
+        operation.activation.serial.setLifecycleAdmissionClosed(false);
+      } catch (error) {
+        const initialized = this.activations.resolve(meshName, spotId);
+        if (initialized !== undefined && initialized !== operation.activation) {
+          await this.activationLifecycle.cleanupFailedIncarnation(initialized);
         }
-        const closed = await operation.ready;
-        if (!closed) await closingAuthority?.restoreReady();
-        return closed;
-      })().finally(() => {
-        if (this.pendingInstanceCloses.get(key) === trackedClosePromise) {
-          this.pendingInstanceCloses.delete(key);
+        this.activations.finishClose(meshName, spotId);
+        operation.activation.serial.visitPendingApplication((record) => {
+          const context = record.context as
+            import('./spot-serial-turn-executor').ZLinkSpotApplicationTurnContext | undefined;
+          if (context?.replay !== undefined) record.operation = () => context.replay!(error);
+        });
+        operation.activation.serial.closeAdmission();
+        throw error;
+      }
+    } else {
+      await operation.authority?.release();
+      operation.activation.serial.closeAdmission();
+      if (!operation.activation.executionBarrier.isSealed) {
+        const closed = operation.activation.sealExecution('close');
+        operation.activation.commitExecutionSeal(closed);
+      }
+    }
+    if (operation.reason === ZLinkSpotCloseReason.ExplicitClose) {
+      operation.activation.serial.visitPendingApplication((record) => {
+        const context = record.context as
+          import('./spot-serial-turn-executor').ZLinkSpotApplicationTurnContext | undefined;
+        if (context?.replay !== undefined) {
+          record.operation =
+            intentFailure === undefined ? context.replay : () => context.replay!(intentFailure);
         }
       });
-      this.pendingInstanceCloses.set(key, trackedClosePromise);
-      if (currentTurn) {
-        // The current turn must return before its terminal completion can
-        // release the activation recovery fence and allow the durable close
-        // CAS. The registered close gate prevents a second admission while
-        // that detached close finishes.
-        this.options.detachedTaskRunner?.runDetached(
-          `instance spot close ${String(spotId)}`,
-          async () => {
-            await trackedClosePromise;
-          }
-        );
-        if (this.options.detachedTaskRunner === undefined) {
-          void trackedClosePromise.catch(() => undefined);
-        }
-        return true;
-      }
-      return await trackedClosePromise;
     }
+    this.closeOperations.delete(`${meshName}\0${String(spotId)}`);
+    // An OnClosing failure never changes a Close result; host shutdown alone
+    // reports it as its teardown outcome after cleanup has finished.
+    if (closingFailure !== undefined && operation.reason === ZLinkSpotCloseReason.HostShutdown) {
+      throw closingFailure;
+    }
+    return true;
+  }
 
-    const operation = beginClose();
-    if (operation === undefined) {
-      return false;
+  private async beginCloseAuthority(
+    meshName: string,
+    spotId: RoutingId,
+    operation: ZLinkTargetSpotCloseOperation,
+    signal?: AbortSignal
+  ): Promise<import('../execution').ZLinkExecutionBarrierSeal | true | undefined> {
+    // Spot messaging §4 step 12 with §7 step 1: a Close of any reason begins its
+    // Closing CAS only after the first terminal record of an activated message.
+    await this.options.instanceSpotApplicationQuiescenceProvider?.(meshName, spotId, signal);
+    if (!operation.activation.canClose(operation.reason)) return undefined;
+    if (operation.activation.executionBarrier.isSealed) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.SpotMoving,
+        `Spot '${String(spotId)}' is sealed for relocation.`,
+        true
+      );
     }
-    if (currentTurn) {
-      if (operation.started) {
-        this.options.detachedTaskRunner?.runDetached(`spot close ${String(spotId)}`, async () => {
-          await operation.ready;
-        });
-        if (this.options.detachedTaskRunner === undefined) {
-          void operation.ready.catch(() => undefined);
+    let seal: import('../execution').ZLinkExecutionBarrierSeal | true | undefined;
+    const authorityPromise = Promise.resolve().then(() =>
+      operation.beginAuthority(() => {
+        if (operation.reason === ZLinkSpotCloseReason.ExplicitClose) {
+          operation.activation.serial.setLifecycleAdmissionClosed(true);
+          seal = true;
+        } else {
+          seal = operation.activation.sealExecution('close');
         }
-      }
-      return true;
+      })
+    );
+    operation.authorityDecision = authorityPromise.then(
+      () => undefined,
+      () => undefined
+    );
+    const authority = await authorityPromise;
+    if (authority === undefined) return undefined;
+    operation.authority = authority;
+    if (seal === undefined) {
+      throw new Error(`Spot '${String(spotId)}' Closing authority did not confirm its commit.`);
     }
-    return await operation.ready;
+    return seal;
   }
 
   async executeOnSpot<TSpot extends ZLinkSpot, TResult>(
@@ -1286,10 +1412,6 @@ export class DefaultZLinkSpotManager {
     return this.activations.resolveUnique(spotId) !== undefined;
   }
 
-  canCloseUserSpot(meshName: string, spotId: RoutingId): boolean {
-    return this.activations.canClose(meshName, spotId);
-  }
-
   beginUserSpotPublication(meshName: string, spotId: RoutingId): void {
     this.activations.stage(meshName, spotId);
   }
@@ -1326,15 +1448,19 @@ export class DefaultZLinkSpotManager {
     spotId: RoutingId,
     actor: ZLinkActor,
     request: Message,
-    commit: (
-      spot: ZLinkSpot
-    ) => Promise<ZLinkActorJoinRollback | void> | ZLinkActorJoinRollback | void,
+    commit: (spot: ZLinkSpot) => Promise<void> | void,
     signal?: AbortSignal,
     leaveSource?: () => Promise<void>,
     contentType = 'application/json'
   ): Promise<ZLinkSpotActorJoinResult> {
     const meshName = this.activations.resolveUnique(spotId)?.meshName;
     this.options.admission?.requireRequest('Actor join admission', meshName);
+    if (meshName !== undefined && this.isSpotClosing(meshName, spotId)) {
+      throw createInternalFrameworkException(
+        ZLinkFrameworkInternalErrorKind.RequestRejected,
+        `Spot '${String(spotId)}' is closing.`
+      );
+    }
     return await this.actorMembership.admitActorJoin(
       spotId,
       actor,
@@ -1562,14 +1688,7 @@ export class DefaultZLinkSpotManager {
         record.reply(encodeChannelReplyParts(envelope.header, response, codecs))
       );
     } catch (error) {
-      requireMeshSpotReply(
-        record.reply(
-          encodeChannelErrorReplyParts(
-            envelope.header,
-            error instanceof Error ? error.message : String(error)
-          )
-        )
-      );
+      requireMeshSpotReply(record.reply(encodeChannelErrorReplyParts(envelope.header, error)));
     }
   }
 
@@ -1580,7 +1699,7 @@ export class DefaultZLinkSpotManager {
     let target = this.options.instanceSpotApplicationTargetProvider?.(meshName, spotId);
     if (target === undefined) return;
     for (;;) {
-      const current = this.activations.resolve(meshName, spotId);
+      const current = this.resolveApplicationActivation(spotId, meshName);
       if (
         current !== undefined &&
         current.objectGeneration === target.objectGeneration &&
@@ -1634,7 +1753,7 @@ export class DefaultZLinkSpotManager {
       );
       try {
         await this.ensureInstanceApplicationActivation(meshName, spotId);
-        const activation = this.activations.resolve(meshName, spotId);
+        const activation = this.resolveApplicationActivation(spotId, meshName);
         if (activation === undefined || activation.domain.kind !== 'instance') {
           throw new ZLinkConfigurationException(
             `MeshNode Instance Spot target '${String(spotId)}' is not active.`
@@ -1659,12 +1778,39 @@ export class DefaultZLinkSpotManager {
           channelName: envelope.header.channelName,
           contentType: envelope.header.contentType,
           awaitFirstHandlerTurn: record.kind === ReceiveKind.InstanceSpotActivation,
+          activationRecord: record,
+          onOneWayError:
+            this.options.dispatchErrors?.captureEnabled() === true
+              ? (error: unknown) =>
+                  this.reportInstanceDispatchFailure(
+                    meshName,
+                    spotId,
+                    record,
+                    envelope,
+                    false,
+                    error
+                  )
+              : undefined,
           workOptions: zlinkSerialWorkOptions(
             envelope.payload.byteLength,
             record.applicationMetadata?.byteLength ??
               zlinkMetadataByteLength(envelope.header.metadata)
           )
         };
+        // Spot messaging §7 step 3: an Instance intent request that reaches an
+        // incarnation whose Close ended admission is refused before admission
+        // with the owner fence terminal, so its caller re-reads authority.
+        const instanceIntent =
+          record.activationRecord?.activation === 'missing' ||
+          (record.activationRecord?.activation === 'ready' &&
+            record.activationRecord.instanceIntent);
+        const refusal = activation.serial.applicationAdmissionRefusal(instanceIntent === true);
+        if (request && refusal !== undefined && record.replyFailure !== undefined) {
+          this.reportInstanceDispatchFailure(meshName, spotId, record, envelope, request, refusal);
+          const terminal = internalFrameworkWireReply(refusal);
+          requireMeshSpotReply(record.replyFailure(terminal.terminalResult, terminal.failureCode));
+          return;
+        }
         this.traceInstanceMessage(
           ZLinkMessageFlowOutcome.Admitted,
           meshName,
@@ -1729,7 +1875,8 @@ export class DefaultZLinkSpotManager {
           target?.stableType
         );
       } catch (error) {
-        const reason = instanceDispatchErrorReason(error);
+        this.reportInstanceDispatchFailure(meshName, spotId, record, envelope, request, error);
+        const reason = dispatchReasonFromError(error);
         if (!request) {
           this.traceInstanceMessage(
             ZLinkMessageFlowOutcome.Dropped,
@@ -1743,36 +1890,42 @@ export class DefaultZLinkSpotManager {
           );
           return;
         }
-        this.options.dispatchErrors?.report({
-          surface: ZLinkDispatchErrorSurface.InstanceSpot,
-          messageKind: ZLinkDispatchMessageKind.Request,
-          packetName: envelope.packetName,
-          channelName: envelope.header.channelName,
-          meshName,
-          correlationId: envelope.header.correlationId ?? undefined,
-          sourceRid: record.sourceNodeRid === null ? undefined : String(record.sourceNodeRid),
-          spotId: String(spotId),
-          instanceSpotType: this.options.instanceSpotApplicationTargetProvider?.(meshName, spotId)
-            ?.stableType,
-          activationState: 'closing',
-          flowId: envelope.header.flowId,
-          flowOrigin: envelope.header.flowOrigin,
-          reason,
-          action: ZLinkDispatchErrorAction.ReplyError,
-          error
-        });
-        requireMeshSpotReply(
-          record.reply(
-            encodeChannelErrorReplyParts(
-              envelope.header,
-              error instanceof Error ? error.message : String(error)
-            )
-          )
-        );
+
+        requireMeshSpotReply(record.reply(encodeChannelErrorReplyParts(envelope.header, error)));
       }
     });
   }
 
+  private reportInstanceDispatchFailure(
+    meshName: string,
+    spotId: RoutingId,
+    record: ReceiveRecord,
+    envelope: ReturnType<typeof decodeChannelEnvelope>,
+    request: boolean,
+    error: unknown
+  ): void {
+    const reporter = this.options.dispatchErrors;
+    if (reporter?.captureEnabled() !== true) return;
+    reporter.report({
+      surface: ZLinkDispatchErrorSurface.InstanceSpot,
+      messageKind: request ? ZLinkDispatchMessageKind.Request : ZLinkDispatchMessageKind.Send,
+      packetName: envelope.packetName,
+      channelName: envelope.header.channelName,
+      meshName,
+      correlationId: envelope.header.correlationId ?? undefined,
+      sourceRid: record.sourceNodeRid === null ? undefined : String(record.sourceNodeRid),
+      spotId: String(spotId),
+      instanceSpotType: this.options.instanceSpotApplicationTargetProvider?.(meshName, spotId)
+        ?.stableType,
+      activationState: 'closing',
+      flowId: envelope.header.flowId,
+      flowOrigin: envelope.header.flowOrigin,
+      reason: dispatchReasonFromError(error),
+      action: request ? ZLinkDispatchErrorAction.ReplyError : ZLinkDispatchErrorAction.Drop,
+      error
+    });
+  }
+
   private traceInstanceMessage(
     outcome: ZLinkMessageFlowOutcome,
     meshName: string,
@@ -1825,9 +1978,6 @@ export class DefaultZLinkSpotManager {
       throw new ZLinkConfigurationException('MeshNode Actor record is missing its Actor owner.');
     }
     const request = record.kind === ReceiveKind.ActorRequest;
-    if (record.sourceBindingGeneration > 0n) {
-      this.options.actorBindingGenerationObserver?.(actor.actorId, record.sourceBindingGeneration);
-    }
     const resolvedOwner = this.options.actorDispatchOwnerResolver?.(actor.actorId);
     const resolvedActorRef = resolvedOwner?.actorRef ?? {
       actorId: actor.actorId,
@@ -1918,10 +2068,7 @@ export class DefaultZLinkSpotManager {
         record.reply(
           this.encodeMeshActorReply(record.parts[0], ZLinkStreamMessageKind.Error, {
             message: error instanceof Error ? error.message : String(error),
-            kind:
-              error instanceof ZLinkFrameworkException
-                ? error.kind
-                : ZLinkFrameworkErrorKind.InternalFailure
+            kind: spotActorFailureKind(error)
           })
         )
       );
@@ -1932,6 +2079,54 @@ export class DefaultZLinkSpotManager {
     meshName: string,
     owner: ReadyRecord,
     record: ReceiveRecord
+  ): Promise<void> {
+    const spotId = owner.spotId as unknown as RoutingId | null;
+    const activation = spotId === null ? undefined : this.activations.resolve(meshName, spotId);
+    const replyState = { targetCommitPublished: false };
+    try {
+      if (
+        record.kindData?.kind === 'actorControl' &&
+        record.kindData.canonicalActorJoin !== undefined
+      ) {
+        const entrySpotId = this.options.entryNodeRidProvider?.() ?? this.options.entryNodeRid;
+        if (
+          spotId !== null && entrySpotId !== undefined && String(spotId) === String(entrySpotId)
+            ? this.options.dispatchEntryActorJoin === undefined
+            : activation === undefined
+        ) {
+          throw createInternalFrameworkException(
+            ZLinkFrameworkInternalErrorKind.RouteNotConnected,
+            `Spot '${String(spotId)}' is not active on this node.`
+          );
+        }
+      }
+      if (activation?.domain.kind === 'user') {
+        await activation.serial.executeLifecycleOperation(() =>
+          this.dispatchMeshActorJoinCore(meshName, owner, record, replyState)
+        );
+        return;
+      }
+      await this.dispatchMeshActorJoinCore(meshName, owner, record, replyState);
+    } catch (error) {
+      if (replyState.targetCommitPublished || record.replyFailure === undefined) throw error;
+      const failure =
+        error instanceof ZLinkFrameworkException
+          ? error
+          : createInternalFrameworkException(
+              ZLinkFrameworkInternalErrorKind.RequestFailed,
+              'Actor Join target admission failed.',
+              error
+            );
+      const terminal = internalFrameworkWireReply(failure);
+      requireMeshSpotReply(record.replyFailure(terminal.terminalResult, terminal.failureCode));
+    }
+  }
+
+  private async dispatchMeshActorJoinCore(
+    meshName: string,
+    owner: ReadyRecord,
+    record: ReceiveRecord,
+    replyState: { targetCommitPublished: boolean }
   ): Promise<void> {
     const spotId = owner.spotId as unknown as RoutingId | null;
     const control = record.kindData;
@@ -1996,14 +2191,10 @@ export class DefaultZLinkSpotManager {
       admissionRecord = provisional.record;
       canonicalAdmissionCreated = provisional.created;
       try {
+        releaseApplicationJobPermitBeforeHandler();
         canonicalActorType = (await resolver({ actorId, ...control.canonicalActorJoin })).actorType;
       } catch (error) {
         this.formalRemoteActorAdmissions.fail(control.canonicalActorJoin.handoffId, error);
-        if (error instanceof ZLinkFrameworkException && record.replyFailure !== undefined) {
-          const terminal = internalFrameworkWireReply(error);
-          requireMeshSpotReply(record.replyFailure(terminal.terminalResult, terminal.failureCode));
-          return;
-        }
         throw error;
       }
     }
@@ -2027,12 +2218,11 @@ export class DefaultZLinkSpotManager {
     let ownedCallbackRequest: Message | undefined;
     let materialized = false;
     let reply: Message | undefined;
-    let deferredJoinRoot: ZLinkDeferredJoinAcceptedRoot | undefined;
+    let deferredJoinCompletion: ZLinkDeferredJoinCompletion | undefined;
     let preparedTransferState: Message | undefined;
     let admissionOutcome: ZLinkFormalRemoteActorAdmissionResult | undefined;
     let accepted = false;
     let committedAdmissionReplay = isRemoteCommit && admissionRecord?.state === 'committed';
-    let targetCommitPublished: boolean | undefined;
     const actorJoinIsCurrent = (): boolean =>
       (record.deadlineUnixMs === undefined || record.deadlineUnixMs > BigInt(Date.now())) &&
       (record.isPending?.() ?? true);
@@ -2093,14 +2283,12 @@ export class DefaultZLinkSpotManager {
         if (canonicalAdmissionCreated) {
           if (targetsEntrySpot) {
             admissionOutcome = {
-              accepted: this.options.dispatchEntryActorJoin !== undefined,
+              accepted: true,
               actorRef
             };
-          } else if (activation === undefined) {
-            admissionOutcome = { accepted: false, actorRef };
           } else {
-            const response: ZLinkSpotActorJoinResult = await activation.serial.execute(async () =>
-              activation.spot.onActorJoin(
+            const response: ZLinkSpotActorJoinResult = await activation!.serial.execute(async () =>
+              activation!.spot.onActorJoin(
                 actorRef.actorId,
                 wrapFrameworkPayloadMessage(
                   callbackRequest!,
@@ -2176,8 +2364,8 @@ export class DefaultZLinkSpotManager {
                 transferRequest.completionOperationId !== undefined &&
                 this.options.actorTransferRuntime !== undefined
               ) {
-                deferredJoinRoot =
-                  await this.options.actorTransferRuntime.prepareDeferredJoinAccepted(
+                deferredJoinCompletion =
+                  this.options.actorTransferRuntime.prepareDeferredJoinAccepted(
                     actorId,
                     transferRequest.completionOperationId,
                     actorRef,
@@ -2187,7 +2375,7 @@ export class DefaultZLinkSpotManager {
               admissionOutcome = {
                 accepted: this.options.dispatchEntryActorJoin !== undefined,
                 actorRef,
-                ...(deferredJoinRoot === undefined ? {} : { deferredJoinRoot })
+                ...(deferredJoinCompletion === undefined ? {} : { deferredJoinCompletion })
               };
             } else if (activation === undefined) {
               admissionOutcome = { accepted: false, actorRef };
@@ -2220,8 +2408,8 @@ export class DefaultZLinkSpotManager {
                   transferRequest.completionOperationId !== undefined &&
                   this.options.actorTransferRuntime !== undefined
                 ) {
-                  deferredJoinRoot =
-                    await this.options.actorTransferRuntime.prepareDeferredJoinAccepted(
+                  deferredJoinCompletion =
+                    this.options.actorTransferRuntime.prepareDeferredJoinAccepted(
                       actorId,
                       transferRequest.completionOperationId,
                       actorRef,
@@ -2240,7 +2428,7 @@ export class DefaultZLinkSpotManager {
                 admissionOutcome = {
                   accepted: response.accepted,
                   actorRef,
-                  ...(deferredJoinRoot === undefined ? {} : { deferredJoinRoot }),
+                  ...(deferredJoinCompletion === undefined ? {} : { deferredJoinCompletion }),
                   ...(encodedReply === undefined
                     ? {}
                     : {
@@ -2277,7 +2465,7 @@ export class DefaultZLinkSpotManager {
         if ('error' in admissionOutcome) {
           throw admissionOutcome.error;
         }
-        deferredJoinRoot = admissionOutcome.deferredJoinRoot;
+        deferredJoinCompletion = admissionOutcome.deferredJoinCompletion;
       }
       if (
         actor === undefined &&
@@ -2361,7 +2549,7 @@ export class DefaultZLinkSpotManager {
           transferRequest?.completionOperationId !== undefined &&
           this.options.actorTransferRuntime !== undefined
         ) {
-          deferredJoinRoot = await this.options.actorTransferRuntime.prepareDeferredJoinAccepted(
+          deferredJoinCompletion = this.options.actorTransferRuntime.prepareDeferredJoinAccepted(
             actorId,
             transferRequest.completionOperationId,
             actorRef,
@@ -2424,21 +2612,6 @@ export class DefaultZLinkSpotManager {
           return;
         }
       }
-      if (
-        accepted &&
-        transferRequest !== undefined &&
-        this.options.actorTransferRuntime !== undefined &&
-        !isRemoteAdmission
-      ) {
-        // A lightweight Core actor-join notification can create the Actor
-        // before the formal transfer request reaches this branch. Preserve
-        // the full relocation fence in that race so a later Session bind
-        // refresh cannot erase the seal or accepted journal.
-        this.options.actorTransferRuntime.rememberRoutedActorTransferTarget(
-          actorId,
-          transferRequest.remoteBoundSessionTarget
-        );
-      }
       if (
         accepted &&
         actor !== undefined &&
@@ -2451,7 +2624,8 @@ export class DefaultZLinkSpotManager {
           spotId,
           transferId: transferRequest.transferId,
           handoffBacklog: transferRequest.handoffBacklog,
-          deferredJoinRoot
+          deferredJoinCompletion,
+          sealedSession: transferRequest.remoteBoundSessionTarget
         });
         if (isRemoteCommit && admissionRecord !== undefined) {
           this.formalRemoteActorAdmissions.markCommitted(transferRequest.transferId, actor);
@@ -2471,7 +2645,7 @@ export class DefaultZLinkSpotManager {
           // Core commits the target membership while it accepts this reply.
           // From this call onward a later callback/transport failure is
           // post-commit and must not roll the materialized Actor back.
-          targetCommitPublished = true;
+          replyState.targetCommitPublished = true;
         }
         requireMeshSpotReply(joinReplyResult);
         return true;
@@ -2496,60 +2670,85 @@ export class DefaultZLinkSpotManager {
           if (!replyActorJoin()) return;
           const commitEntryTransfer = async (): Promise<void> => {
             try {
-              await this.options.dispatchEntryActorJoin?.(meshName, entryActor, []);
-            } finally {
-              this.formalRemoteTransfers.completeTargetLifecycle(
-                entryActor.context.actorId,
-                pendingTransfer.transferId
-              );
-            }
-            const sourceLeaveSubmitted = await pendingTransfer.sourceLeaveSubmitted;
-            if (!sourceLeaveSubmitted) {
-              throw new Error(
-                `Actor '${entryActor.context.actorId}' source authority commit failed before leave submission.`
-              );
-            }
-            const handoffResults = await replayActorHandoffBacklog(
-              pendingTransfer.handoffBacklog,
-              async (parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef) => {
-                if (this.options.dispatchEntryActorPacket === undefined) {
-                  throw new Error(
-                    'Entry Spot saved handoff replay requires its Actor packet runtime.'
-                  );
-                }
-                return await this.options.dispatchEntryActorPacket(
+              try {
+                await this.options.dispatchEntryActorJoin?.(meshName, entryActor, []);
+              } finally {
+                this.formalRemoteTransfers.completeTargetLifecycle(
                   entryActor.context.actorId,
-                  parts,
-                  returnResponse,
-                  remoteBoundSessionTarget,
-                  fallbackActorRef
+                  pendingTransfer.transferId
                 );
-              },
-              (index) =>
-                this.options.runtimeEventPublisher?.publish({
-                  sourceName: 'zlink.framework.actor-handoff',
-                  timestamp: new Date(),
-                  marker: 'backlog_enqueued',
-                  actorId: entryActor.context.actorId,
-                  index
-                })
-            );
-            const failedHandoff = handoffResults.find((result) => !result.ok);
-            if (failedHandoff !== undefined) {
-              throw new Error(
-                `Actor '${entryActor.context.actorId}' saved Entry handoff packet ` +
-                  `${failedHandoff.index} failed: ${failedHandoff.error ?? 'unknown error'}.`
+              }
+              const sourceLeaveSubmitted = await pendingTransfer.sourceLeaveSubmitted;
+              if (!sourceLeaveSubmitted) {
+                throw new Error(
+                  `Actor '${entryActor.context.actorId}' source authority commit failed before leave submission.`
+                );
+              }
+              const handoffResults = await replayActorHandoffBacklog(
+                pendingTransfer.handoffBacklog,
+                async (parts, returnResponse, remoteBoundSessionTarget, fallbackActorRef) => {
+                  if (this.options.dispatchEntryActorPacket === undefined) {
+                    throw new Error(
+                      'Entry Spot saved handoff replay requires its Actor packet runtime.'
+                    );
+                  }
+                  return await this.options.dispatchEntryActorPacket(
+                    entryActor.context.actorId,
+                    parts,
+                    returnResponse,
+                    remoteBoundSessionTarget,
+                    fallbackActorRef
+                  );
+                },
+                (index) =>
+                  this.options.runtimeEventPublisher?.publish({
+                    sourceName: 'zlink.framework.actor-handoff',
+                    timestamp: new Date(),
+                    marker: 'backlog_enqueued',
+                    actorId: entryActor.context.actorId,
+                    index
+                  })
+              );
+              const failedHandoff = handoffResults.find((result) => !result.ok);
+              if (failedHandoff !== undefined) {
+                throw new Error(
+                  `Actor '${entryActor.context.actorId}' saved Entry handoff packet ` +
+                    `${failedHandoff.index} failed: ${diagnosticTextOrAbsent(failedHandoff.error)}.`
+                );
+              }
+            } catch (error) {
+              const completion = pendingTransfer.deferredJoinCompletion;
+              if (completion !== undefined) {
+                await this.options.actorTransferRuntime?.deliverDeferredJoinCompletion(
+                  {
+                    ...completion,
+                    status: 'failed',
+                    kind: spotActorFailureKind(error)
+                  },
+                  entryActor,
+                  completion.actor,
+                  (operation) =>
+                    this.options.executeEntryActor!(meshName, entryActor.context.actorId, operation)
+                );
+              }
+              throw error;
+            }
+            const completion = pendingTransfer.deferredJoinCompletion;
+            if (completion !== undefined) {
+              await this.options.actorTransferRuntime?.deliverDeferredJoinCompletion(
+                completion,
+                entryActor,
+                completion.actor,
+                (operation) =>
+                  this.options.executeEntryActor!(meshName, entryActor.context.actorId, operation)
               );
             }
             this.formalRemoteTransfers.delete(entryActor.context.actorId);
           };
-          this.options.detachedTaskRunner?.runDetached(
+          this.options.detachedTaskRunner.runDetached(
             `actor Entry Spot transfer ${entryActor.context.actorId}`,
             commitEntryTransfer
           );
-          if (this.options.detachedTaskRunner === undefined) {
-            void commitEntryTransfer().catch(() => undefined);
-          }
         }
       } else {
         if (!replyActorJoin()) return;
@@ -2558,13 +2757,10 @@ export class DefaultZLinkSpotManager {
       if (control.canonicalActorJoin !== undefined) {
         this.formalRemoteActorAdmissions.fail(control.canonicalActorJoin.handoffId, error);
       }
-      if (deferredJoinRoot !== undefined && targetCommitPublished !== true) {
-        await this.options.actorTransferRuntime?.discardDeferredJoinAccepted(deferredJoinRoot);
-      }
-      if (targetCommitPublished !== true) {
+      if (!replyState.targetCommitPublished) {
         this.formalRemoteTransfers.delete(actorId);
       }
-      if (materialized && targetCommitPublished !== true) {
+      if (materialized && !replyState.targetCommitPublished) {
         await this.options.actorTransferRuntime?.rollbackRoutedActor(actor!);
       }
       throw error;
@@ -2580,6 +2776,42 @@ export class DefaultZLinkSpotManager {
     meshName: string,
     owner: ReadyRecord,
     record: ReceiveRecord
+  ): Promise<void> {
+    const spotId = owner.spotId as unknown as RoutingId | null;
+    const activation = spotId === null ? undefined : this.activations.resolve(meshName, spotId);
+    if (activation?.domain.kind === 'user') {
+      const transfer = { terminal: undefined as Promise<void> | undefined };
+      const operation = activation.serial.executeLifecycleOperation(async () => {
+        await this.dispatchMeshSpotControlCore(meshName, owner, record, (terminal) => {
+          transfer.terminal = terminal;
+        });
+        await transfer.terminal;
+      });
+      const control = record.kindData;
+      const actorId = control?.kind === 'actorControl' ? control.currentActor?.actorId : undefined;
+      if (
+        control?.kind === 'actorControl' &&
+        control.lifecycleKind === ActorLifecycleKind.Joined &&
+        actorId !== undefined &&
+        this.formalRemoteTransfers.get(actorId) !== undefined
+      ) {
+        this.options.detachedTaskRunner.runDetached(
+          `actor transfer target commit ${actorId}`,
+          async () => await operation
+        );
+        return;
+      }
+      await operation;
+      return;
+    }
+    await this.dispatchMeshSpotControlCore(meshName, owner, record);
+  }
+
+  private async dispatchMeshSpotControlCore(
+    meshName: string,
+    owner: ReadyRecord,
+    record: ReceiveRecord,
+    onDetachedTerminal?: (terminal: Promise<void>) => void
   ): Promise<void> {
     const spotId = owner.spotId as unknown as RoutingId | null;
     const control = record.kindData;
@@ -2664,8 +2896,8 @@ export class DefaultZLinkSpotManager {
           await activation.spot.onJoinedActor(actor);
         };
         const completePublicJoin = async (): Promise<void> => {
-          const deferredJoinRoot = pendingTransfer?.deferredJoinRoot;
-          if (deferredJoinRoot !== undefined) {
+          const deferredJoinCompletion = pendingTransfer?.deferredJoinCompletion;
+          if (deferredJoinCompletion !== undefined) {
             const currentRef =
               this.options.actorTransferRuntime === undefined
                 ? null
@@ -2675,8 +2907,8 @@ export class DefaultZLinkSpotManager {
                 `Actor '${actor.context.actorId}' has no target ref for deferred Join completion.`
               );
             }
-            await this.options.actorTransferRuntime?.commitAndDeliverDeferredJoinAccepted(
-              deferredJoinRoot,
+            await this.options.actorTransferRuntime?.deliverDeferredJoinCompletion(
+              deferredJoinCompletion,
               actor,
               currentRef,
               (operation) =>
@@ -2710,7 +2942,7 @@ export class DefaultZLinkSpotManager {
             if (failedHandoff !== undefined) {
               throw new Error(
                 `Actor '${actor.context.actorId}' saved handoff packet ` +
-                  `${failedHandoff.index} failed: ${failedHandoff.error ?? 'unknown error'}.`
+                  `${failedHandoff.index} failed: ${diagnosticTextOrAbsent(failedHandoff.error)}.`
               );
             }
             // Spec 15 §4.2 relocation temporary queue: arrivals parked at
@@ -2724,13 +2956,17 @@ export class DefaultZLinkSpotManager {
             // the Session binding aggregate after this boundary.
             this.formalRemoteTransfers.delete(actor.context.actorId);
           }
+          const sealedSession = pendingTransfer?.sealedSession;
           const updateBoundSessionRoute = async (): Promise<void> => {
-            await this.options.actorTransferRuntime?.publishRoutedActorOwnership(actor);
+            await this.options.actorTransferRuntime?.publishRoutedActorOwnership(
+              actor,
+              sealedSession
+            );
             await this.options.actorTransferRuntime?.openRoutedActorSession(actor);
           };
-          // Session routing is an independent post-Ready branch. Callback
-          // sends are retained by the Session owner seal until this converges.
-          if (pendingTransfer !== undefined && this.options.detachedTaskRunner !== undefined) {
+          // Session routing is an independent post-Ready branch. The Session
+          // owner submits current-binding pushes while the route seal remains installed.
+          if (pendingTransfer !== undefined) {
             this.options.detachedTaskRunner.runDetached(
               `actor transfer Session route ${actor.context.actorId}`,
               updateBoundSessionRoute
@@ -2760,12 +2996,14 @@ export class DefaultZLinkSpotManager {
             // them only after the lifecycle turn above has been released.
             await completeTargetReady();
           };
-          this.options.detachedTaskRunner?.runDetached(
-            `actor transfer target commit ${actor.context.actorId}`,
-            resume
-          );
-          if (this.options.detachedTaskRunner === undefined) {
-            void resume().catch(() => undefined);
+          const terminal = resume();
+          if (onDetachedTerminal !== undefined) {
+            onDetachedTerminal(terminal);
+          } else {
+            this.options.detachedTaskRunner.runDetached(
+              `actor transfer target commit ${actor.context.actorId}`,
+              async () => await terminal
+            );
           }
           return;
         }
@@ -2832,43 +3070,64 @@ export class DefaultZLinkSpotManager {
     const entrySpotId = this.options.entryNodeRidProvider?.() ?? this.options.entryNodeRid;
     const targetsEntry =
       entrySpotId !== undefined && String(admission.admission.spotId) === String(entrySpotId);
-    if (targetsEntry) {
-      await this.options.dispatchEntryActorJoin?.(meshName, actor, []);
-    } else {
-      const activation = this.activations.resolve(meshName, admission.admission.spotId);
-      if (activation === undefined) {
-        throw new Error(`Actor Join relocation '${relocationId}' target Spot is not active.`);
+    const activation = targetsEntry
+      ? undefined
+      : this.activations.resolve(meshName, admission.admission.spotId);
+    let lifecycleFailure: { readonly error: unknown } | undefined;
+    try {
+      if (targetsEntry) {
+        await this.options.dispatchEntryActorJoin?.(meshName, actor, []);
+      } else {
+        if (activation === undefined) {
+          throw new Error(`Actor Join relocation '${relocationId}' target Spot is not active.`);
+        }
+        await activation.serial.execute(() => activation.spot.onJoinedActor(actor));
       }
-      await activation.serial.execute(() => activation.spot.onJoinedActor(actor));
+    } catch (error) {
+      lifecycleFailure = { error };
     }
-    await submitSourceLeave(admission.admission.actorRef.nodeRid);
-    if (outcome.deferredJoinRoot !== undefined && this.options.actorTransferRuntime !== undefined) {
+    if (lifecycleFailure === undefined) {
+      const sourceLeave = submitSourceLeave(admission.admission.actorRef.nodeRid);
+      this.options.detachedTaskRunner.runDetached(
+        `actor Join source leave ${actor.context.actorId}`,
+        () => sourceLeave
+      );
+    }
+    if (
+      outcome.deferredJoinCompletion !== undefined &&
+      this.options.actorTransferRuntime !== undefined
+    ) {
       const submitMailbox = targetsEntry
         ? <T>(operation: () => Promise<T>): Promise<T> => operation()
         : <T>(operation: () => Promise<T>): Promise<T> => {
-            const activation = this.activations.resolve(meshName, admission.admission.spotId);
             if (activation === undefined) {
               throw new Error(`Actor Join relocation '${relocationId}' target mailbox is missing.`);
             }
             return activation.executeActor(actor.context.actorId, operation);
           };
-      await this.options.actorTransferRuntime.commitAndDeliverDeferredJoinAccepted(
-        outcome.deferredJoinRoot,
+      await this.options.actorTransferRuntime.deliverDeferredJoinCompletion(
+        lifecycleFailure === undefined
+          ? outcome.deferredJoinCompletion
+          : {
+              ...outcome.deferredJoinCompletion,
+              status: 'failed',
+              kind: spotActorFailureKind(lifecycleFailure.error)
+            },
         actor,
         actorRef,
         submitMailbox,
         signal
       );
     }
+    if (lifecycleFailure !== undefined) throw lifecycleFailure.error;
     this.formalRemoteActorAdmissions.markCommitted(relocationId, actor);
     return true;
   }
 
   async restoreCanonicalActorJoinRecovery(
     recovery: CanonicalActorJoinRecovery,
-    signal?: AbortSignal,
-    canonicalInventoryDigest?: string
-  ): Promise<ZLinkDeferredJoinAcceptedRoot | undefined> {
+    signal?: AbortSignal
+  ): Promise<void> {
     throwIfAborted(signal);
     const admission = this.formalRemoteActorAdmissions.get(recovery.request.handoffId);
     if (admission === undefined) {
@@ -2930,24 +3189,24 @@ export class DefaultZLinkSpotManager {
     }
     // Command 28 carries a present reply in one outer framework-multipart
     // part. The accepted target admission still owns the inner typed content
-    // type, which the durable completion must retain for application decode.
+    // type, which the process-local completion keeps for application decode.
     const admittedContentType =
       admittedReply.byteLength === 0 ? recovery.replyContentType : outcome.replyContentType;
     const transfer = this.options.actorTransferRuntime;
     if (transfer === undefined) {
       throw new Error('Canonical Actor Join recovery requires the Actor transfer runtime.');
     }
-    const deferred = await transfer.prepareDeferredJoinAccepted(
+    const deferred = transfer.prepareDeferredJoinAccepted(
       recovery.request.actorId,
       recovery.operationId,
       admitted.actorRef,
       recovery.reply,
-      admittedContentType,
-      signal,
-      canonicalInventoryDigest
+      admittedContentType
+    );
+    this.formalRemoteActorAdmissions.attachDeferredJoinCompletion(
+      recovery.request.handoffId,
+      deferred
     );
-    this.formalRemoteActorAdmissions.attachDeferredJoinRoot(recovery.request.handoffId, deferred);
-    return deferred;
   }
 
   private encodeMeshActorReply(
@@ -3096,19 +3355,10 @@ export class DefaultZLinkSpotManager {
   }
 }
 
-function instanceDispatchErrorReason(error: unknown): ZLinkDispatchErrorReason {
-  if (error instanceof ZLinkFrameworkException) {
-    const kind = internalFrameworkErrorKind(error);
-    if (
-      kind === ZLinkFrameworkInternalErrorKind.SpotGenerationStale ||
-      kind === ZLinkFrameworkInternalErrorKind.SpotMoving ||
-      kind === ZLinkFrameworkInternalErrorKind.SpotRouteNotFound ||
-      kind === ZLinkFrameworkInternalErrorKind.RequestTargetNotFound
-    ) {
-      return ZLinkDispatchErrorReason.StaleTarget;
-    }
-  }
-  return ZLinkDispatchErrorReason.HandlerException;
+function spotActorFailureKind(error: unknown): ZLinkFrameworkErrorKind {
+  return error instanceof ZLinkFrameworkException
+    ? error.kind
+    : ZLinkFrameworkErrorKind.InternalFailure;
 }
 
 interface ZLinkFormalRemoteTransferRequest {