@cotal-ai/core 0.3.2 → 0.5.0

package/dist/endpoint.js

@@ -1,23 +1,33 @@
 import { EventEmitter } from "node:events";
 import { randomUUID } from "node:crypto";
-import { connect, credsAuthenticator, nanos, AuthorizationError, PermissionViolationError, UserAuthenticationExpiredError, } from "@nats-io/transport-node";
+import { connect, credsAuthenticator, nanos, AuthorizationError, PermissionViolationError, UserAuthenticationExpiredError, NoRespondersError, RequestError, } from "@nats-io/transport-node";
 import { idFromCreds } from "./identity.js";
-import { createSpaceStreams, dmDurableConfig, taskDurableConfig, MAX_MSGS_PER_SUBJECT } from "./streams.js";
+import { assertValidName } from "./resolve.js";
+import { createSpaceStreams, dmDurableConfig, dlvDurableConfig, taskDurableConfig, fanoutDurableConfig, inboxReaderConfig, MAX_MSGS_PER_SUBJECT } from "./streams.js";
 import { jetstream, jetstreamManager, AckPolicy, DeliverPolicy, } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { openChannelRegistry, effectiveReplay, effectiveReplayWindowMs, readChannelConfig, readChannelDefaults, } from "./channels.js";
-import { anycastSubject, CHANNEL_DEFAULTS_KEY, chatStream, chatDurable, chatSubject, collapseFilterSubjects, controlServiceSubject, dmStream, dmDurable, isConcreteChannel, normalizeMentions, parseSubject, presenceBucket, spacePrefix, spaceWildcard, subjectMatches, taskStream, taskDurable, token, unicastSubject, } from "./subjects.js";
+import { openMembersRegistry, commitMember, tombstoneMember, activateMember, readMember, listMembers, durableEligible, StaleMembershipWrite, } from "./members.js";
+import { openChannelRegistry, effectiveReplay, effectiveReplayWindowMs, effectiveDeliveryClass, readChannelConfig, readChannelDefaults, } from "./channels.js";
+import { anycastSubject, CHANNEL_DEFAULTS_KEY, chatStream, chatHistDurable, chatSubject, controlServiceSubject, CONTROL_SELF_SERVICE, dmStream, dmDurable, dlvStream, dlvDurable, dlvSubject, dinboxSubject, inboxStream, parseDinboxOwner, FANOUT_DURABLE, INBOX_READER_DURABLE, chatWildcard, channelInAllow, isConcreteChannel, normalizeMentions, parseSubject, presenceBucket, spacePrefix, spaceWildcard, subjectMatches, taskStream, taskDurable, token, unicastSubject, } from "./subjects.js";
 export const DEFAULT_SERVER = "nats://127.0.0.1:4222";
 /** Space joined when none is given on the CLI (the `cotal-<space>` cmux tab, etc.). */
 export const DEFAULT_SPACE = "main";
 /**
- * Events: "message" (CotalMessage), "presence" (PresenceEvent), "roster" (Presence[]), "error" (Error).
+ * Events: "message" (CotalMessage), "presence" (PresenceEvent), "roster" (Presence[]), "error" (Error),
+ * "connection" ({ connected: boolean }) — true on every successful (re)bind (initial start, manual
+ * reconnect, AND background self-heal), false the moment the connection drops (rebuild null window /
+ * terminal close). Lets an in-process agent track connectedness off the endpoint's own (re)binds
+ * instead of an imperative flag the self-heal path can't reach.
  *
  * Callers MUST attach an "error" listener before `start()`: async faults (incl. NATS
  * permission denials, surfaced via `watchStatus`) are emitted as "error", and Node throws
  * synchronously on an unhandled "error" — a missing listener turns any such fault into a
  * process crash instead of a logged denial.
  */
+/** Plane-3 trusted-reader redelivery ceiling: a dinbox entry that keeps failing re-auth-defer
+ *  (unknown owner) or DELIVER transfer is `term()`d + surfaced after this many redeliveries, so one
+ *  stuck/poison entry can't head-of-line the single shared reader forever. */
+const READER_MAX_REDELIVERIES = 10;
 export class CotalEndpoint extends EventEmitter {
     card;
     space;
@@ -40,6 +50,11 @@ export class CotalEndpoint extends EventEmitter {
     jsm;
     kv;
     channelKv;
+    /** Plane-3 durable-membership registry KV — lazily opened by the privileged (manager) endpoint. */
+    membersKv;
+    /** When set, this endpoint hosts the Plane-3 fan-out writer + trusted reader (the manager). `aclFor`
+     *  maps an owner id to its current read ACL (`allowSubscribe`) for the reader's re-authorization. */
+    plane3;
     /** Live local cache of the channel registry (key = channel token), kept by a KV watch. */
     channelConfigs = new Map();
     channelDefaults = {};
@@ -48,17 +63,72 @@ export class CotalEndpoint extends EventEmitter {
      *  a lagging joiner + dedups the backfill overlap). Keyed by the subscription pattern (may be
      *  wildcard), so the drop matches every concrete channel the pattern subsumes. */
     joinSeq = new Map();
+    /** Serializes history reads ({@link collectHistory}): they share the fixed per-instance
+     *  `chathist_<id>` consumer, so overlapping reads would delete/recreate it under one another. */
+    histLock = Promise.resolve();
     subs = [];
     streamMsgs = [];
+    /** Per-channel native core subscriptions (SPEC v0.3) — the manager-free live read path for boot +
+     *  runtime channels (there is no per-instance chat durable). Keyed by channel so leave unsubscribes
+     *  just one. */
+    chatSubs = new Map();
+    /** Channels whose core-sub the broker refused (async sub.allow violation) — read by the
+     *  broker-confirmed join: a denied subscribe is NOT a successful join (SPEC conformance #13). */
+    chatSubDenied = new Set();
+    /** Channels this session has a Plane-3 durable backstop for (per-channel join GENERATION, from
+     *  durableJoin, so leave passes it back for the stale-leave guard). A durable channel's core-sub is
+     *  NOT coverage-dropped — it stays a live wake-hint, dedup-coalesced with the Plane-3 durable copy by
+     *  id-dedup. Drives the durable-state surface + routes leave to `durableLeave`. PERSISTS across
+     *  reconnect (like `this.channels`): the membership record + the `dlv_<id>` durable are persistent so
+     *  the backstop survives a reconnect on its own; the agent can't re-read the privileged members KV,
+     *  so this in-memory mirror is kept, not rebuilt. Cleared only on full stop. */
+    plane3Channels = new Map();
+    /** Channels whose live sub was REFUSED while they held a Plane-3 durable membership, whose §7
+     *  tombstone has not yet confirmed (channel → join generation). {@link closeRefusedMembership} retries
+     *  the tombstone until it lands; until then this is a `durable-unclosed` state surfaced via
+     *  {@link pendingDurableLeaves} (the connector shows it in `cotal_channels`, never as ordinary
+     *  absence). Persists across reconnect; cleared on tombstone success or full stop. */
+    pendingDurableLeave = new Map();
+    /** Chat-join subjects currently being broker-confirmed. An out-of-ACL subscribe among these trips an
+     *  EXPECTED async permission violation that joinChannel turns into a clean throw, so watchStatus
+     *  suppresses it rather than surfacing a spurious connection error. */
+    confirmingChatSubs = new Set();
+    /** True until the first successful connect completes its boot backfill — distinguishes first-connect
+     *  (backfill the boot channels' history) from a reconnect (reopen the core-subs, no re-backfill).
+     *  Persists across reconnect (NOT connection-scoped). Replaces the legacy chat-durable consumed-cursor
+     *  signal now that there is no per-instance chat durable. */
+    firstConnect = true;
     heartbeatTimer;
     sweepTimer;
     roster = new Map();
     status = "idle";
     activity;
+    /** Mirror of the connector's authoritative attention state, published in presence (advisory). The
+     *  endpoint never reads these back into delivery — they exist only to broadcast. */
+    attentionMode;
+    channelModes;
     stopped = false;
+    /** In-flight rebuild (drain+rebind) — serializes manual reconnect, the supervisor's
+     *  closed(), and reestablishLoop so only ONE rebuild runs at a time (a second trigger
+     *  coalesces onto the shared promise, never starts a parallel connectAndBind). */
+    rebuildPromise;
+    /** True only during the null window of a rebuild (this.nc unset) — user-facing ops then
+     *  throw a "reconnecting" message instead of the misleading "endpoint not started". */
+    reconnecting = false;
+    /** One reestablishLoop at a time; concurrent triggers coalesce via rebuild(). */
+    reestablishing = false;
+    /** Interruptible backoff for reestablishLoop — reconnect()/stop() resolves this to retry
+     *  now instead of awaiting the full retryMs. */
+    backoffResolve;
+    backoffTimer;
+    retryMs = 3000;
     constructor(opts) {
         super();
         this.space = opts.space;
+        // A display name is the client-side handle a peer is addressed by; reject the reserved `/`
+        // (the future owner/name separator) and surrounding whitespace at the one identity choke
+        // point every join/spawn path flows through.
+        assertValidName(opts.card.name);
         // Identity precedence: an explicit card.id, else the creds' identity, else a random
         // uuid. When both an id and creds are given they MUST name the same nkey — otherwise
         // the subject sender token wouldn't match the authenticated user and every publish
@@ -80,6 +150,9 @@ export class CotalEndpoint extends EventEmitter {
         this.doRegister = opts.registerPresence ?? true;
         this.doWatch = opts.watchPresence ?? true;
         this.doConsume = opts.consume ?? true;
+        // Seed the presence mirror so file-default channel modes are visible from the first publish
+        // (not only after the first runtime toggle). Mirror only — delivery reads the connector's state.
+        this.channelModes = opts.channelModes && Object.keys(opts.channelModes).length ? opts.channelModes : undefined;
         this.ackWaitMs = opts.ackWaitMs ?? 60_000;
         this.inactiveThresholdMs = opts.inactiveThresholdMs ?? 600_000;
     }
@@ -87,6 +160,19 @@ export class CotalEndpoint extends EventEmitter {
         return { id: this.card.id, name: this.card.name, role: this.card.role };
     }
     async start() {
+        await this.connectAndBind();
+        // nats.js auto-reconnects transient drops; when it exhausts its attempts and the
+        // connection closes for good, rebuild from scratch so an in-process agent (e.g. the
+        // OpenCode plugin) recovers without a host respawn. Armed only after a successful first
+        // connect — a first-connect failure throws to the caller's connect-retry loop instead.
+        this.superviseConnection();
+    }
+    /** Open the connection and bind everything that hangs off it: status watch, presence
+     *  watch + heartbeat, channel registry, and the durable consumers. Re-runnable — a
+     *  reconnect calls it again after {@link clearConnectionScoped}; every binding is
+     *  idempotent (durables bind by name, JetStream dedups by msgID, KV opens are idempotent). */
+    async connectAndBind() {
+        this.clearConnectionScoped();
         this.nc = await connect({
             servers: this.servers,
             name: `cotal:${this.card.name}`,
@@ -134,11 +220,199 @@ export class CotalEndpoint extends EventEmitter {
                 await this.ensureStreams();
             await this.startConsumers();
         }
+        // Re-arm Plane-3 (manager-hosted fan-out + trusted reader) on every (re)connect — no-op unless this
+        // endpoint hosts it. The first arm comes from startPlane3 (after start()); this re-binds the loops
+        // a reconnect's clearConnectionScoped() tore down, so a broker blip doesn't silently kill the backstop.
+        await this.armPlane3();
+        // Bound and live — covers initial start, manual reconnect, AND background self-heal (every
+        // path lands here). The single signal an in-process agent's connected flag tracks.
+        this.emit("connection", { connected: true });
+    }
+    /** Tear down everything {@link connectAndBind} (re)creates, so a rebind can't leak a
+     *  second heartbeat, double-pump a consumer, or keep stale roster ghosts. Caller-owned
+     *  subs (tap/serve) are left alone — they aren't rebuilt here. */
+    clearConnectionScoped() {
+        if (this.heartbeatTimer) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = undefined;
+        }
+        if (this.sweepTimer) {
+            clearInterval(this.sweepTimer);
+            this.sweepTimer = undefined;
+        }
+        for (const msgs of this.streamMsgs) {
+            try {
+                msgs.stop();
+            }
+            catch {
+                /* already closed with the connection */
+            }
+        }
+        this.streamMsgs.length = 0;
+        for (const sub of this.chatSubs.values()) {
+            try {
+                sub.unsubscribe();
+            }
+            catch {
+                /* already closed with the connection */
+            }
+        }
+        this.chatSubs.clear();
+        this.chatSubDenied.clear();
+        this.confirmingChatSubs.clear();
+        this.roster.clear();
+        this.joinSeq.clear();
+        this.channelConfigs.clear();
+        this.channelDefaults = {};
+    }
+    /** If stop() ran during a rebuild's `await connectAndBind`, the just-bound connection +
+     *  heartbeat + supervisor would be left live on a stopped endpoint. Tear that fresh
+     *  connection back down and report it. Reads `this.nc` in its own scope (a bare `this.nc`
+     *  in doRebuild narrows to `never` via TS inlining connectAndBind's assignment). Returns
+     *  true iff it tore something down (caller bails out of the rebuild). */
+    async tearDownIfStopped() {
+        if (!this.stopped)
+            return false;
+        const nc = this.nc;
+        this.clearConnectionScoped();
+        try {
+            await nc?.drain();
+        }
+        catch {
+            /* already closing */
+        }
+        this.nc = undefined;
+        return true;
+    }
+    /** Watch for a terminal close (nats.js has exhausted its own reconnect) and rebuild.
+     *  Our own stop()/drain also resolves closed(), so the `stopped` guard keeps a clean
+     *  shutdown from re-establishing. The identity guard (`this.nc !== nc`) no-ops a STALE
+     *  supervisor — one whose connection reconnect()/rebuild already replaced — so only a
+     *  close of the CURRENT connection triggers a rebuild. The rebuild itself is serialized
+     *  with the manual path via {@link rebuild}. */
+    superviseConnection() {
+        const nc = this.nc;
+        if (!nc)
+            return;
+        void nc.closed().then((err) => {
+            if (this.stopped)
+                return;
+            if (this.nc !== nc)
+                return; // epoch-stale — a rebuild already swapped this connection
+            this.emit("connection", { connected: false }); // dropped — report it before the rebuild kicks in
+            this.emit("error", new Error(`mesh connection closed${err ? `: ${err.message}` : ""} — re-establishing`));
+            void this.reestablishLoop();
+        });
+    }
+    /** Single serialized rebuild: drain the old connection and rebind via {@link connectAndBind},
+     *  guarded so concurrent triggers (manual {@link reconnect}, the supervisor's closed(), the
+     *  retry loop) coalesce onto ONE in-flight rebuild instead of racing two connectAndBinds and
+     *  leaking a connection. Returns the shared promise; a second caller gets the in-flight one. */
+    rebuild() {
+        if (this.rebuildPromise)
+            return this.rebuildPromise;
+        const p = this.doRebuild().finally(() => {
+            if (this.rebuildPromise === p)
+                this.rebuildPromise = undefined;
+        });
+        this.rebuildPromise = p;
+        return p;
+    }
+    /** The transition: stop the connection-scoped timers FIRST (so nothing live touches
+     *  this.nc during the null window), drop the connection refs, drain the old nc, then
+     *  rebind + re-arm the supervisor on the fresh connection. clearConnectionScoped is
+     *  idempotent, so connectAndBind's own call here is a noop. */
+    async doRebuild() {
+        const oldNc = this.nc;
+        this.reconnecting = true;
+        try {
+            this.clearConnectionScoped();
+            this.nc = undefined;
+            this.js = undefined;
+            this.jsm = undefined;
+            this.kv = undefined;
+            this.channelKv = undefined;
+            this.emit("connection", { connected: false }); // null window opened — not live until the rebind below
+            try {
+                await oldNc?.drain();
+            }
+            catch {
+                /* already closing */
+            }
+            await this.connectAndBind();
+            // stop() may have run during the await — don't leave a live connection + heartbeat +
+            // supervisor on a stopped endpoint. (Reads this.nc in its own scope — a bare `this.nc`
+            // here in doRebuild narrows to `never` via TS inlining connectAndBind's assignment.)
+            if (await this.tearDownIfStopped())
+                return;
+            this.superviseConnection(); // re-arm on the fresh nc
+        }
+        finally {
+            this.reconnecting = false;
+        }
+    }
+    /** Rebuild with backoff until it sticks or we're stopped. Interruptible: a manual
+     *  {@link reconnect} kicks the backoff so the next attempt runs immediately instead of
+     *  awaiting the full retryMs. One loop at a time ({@link reestablishing}); concurrent
+     *  triggers coalesce via {@link rebuild}. */
+    async reestablishLoop() {
+        if (this.reestablishing)
+            return;
+        this.reestablishing = true;
+        try {
+            while (!this.stopped) {
+                try {
+                    await this.rebuild();
+                    return; // success — re-armed; the supervisor re-triggers on the next terminal close
+                }
+                catch (e) {
+                    if (!this.stopped)
+                        this.emit("error", e);
+                    await new Promise((resolve) => {
+                        this.backoffResolve = resolve;
+                        this.backoffTimer = setTimeout(resolve, this.retryMs);
+                    });
+                }
+            }
+        }
+        finally {
+            this.reestablishing = false;
+        }
+    }
+    /** Cut an in-flight reestablish backoff short so the next attempt runs immediately, and
+     *  clear its timer so it can't fire later on a stopped/restarted loop. */
+    kickBackoff() {
+        this.backoffResolve?.();
+        if (this.backoffTimer) {
+            clearTimeout(this.backoffTimer);
+            this.backoffTimer = undefined;
+        }
+    }
+    /** Manual reconnect: tear down the current connection and rebuild, WITHOUT the permanent
+     *  stop (stopped/stopping stay false). Serialized with the self-heal supervisor via
+     *  {@link rebuild}, and interruptible — if a backoff is in flight, kick it so the attempt
+     *  is now, not in retryMs. Throws if stopped. On failure, leaves {@link reestablishLoop}
+     *  running in the background so the endpoint never stays dead, and rethrows so the caller
+     *  can report it. */
+    async reconnect() {
+        if (this.stopped)
+            throw new Error("endpoint stopped — cannot reconnect");
+        this.kickBackoff();
+        try {
+            await this.rebuild();
+        }
+        catch (e) {
+            void this.reestablishLoop(); // background retry until success or stop
+            throw e;
+        }
     }
     async stop() {
         if (this.stopped)
             return;
         this.stopped = true;
+        // Wake a reestablishLoop sitting in backoff so it sees `stopped` and exits instead of
+        // sleeping out retryMs; also clears the timer so it can't fire later.
+        this.kickBackoff();
         if (this.heartbeatTimer)
             clearInterval(this.heartbeatTimer);
         if (this.sweepTimer)
@@ -286,7 +560,7 @@ export class CotalEndpoint extends EventEmitter {
     /** Send a control request to a service and await its reply (client side). */
     async requestControl(service, req, timeoutMs = 5000) {
         if (!this.nc)
-            throw new Error("endpoint not started");
+            throw new Error(this.notLiveMsg());
         const body = { ...req, from: req.from ?? this.ref() };
         const m = await this.nc.request(controlServiceSubject(this.space, service, this.card.id), JSON.stringify(body), { timeout: timeoutMs });
         return m.json();
@@ -303,6 +577,30 @@ export class CotalEndpoint extends EventEmitter {
         this.status = status;
         await this.publishPresence();
     }
+    /** Publish the agent's global attention mode into presence (advisory observability). Mirror only —
+     *  delivery decisions stay in the connector's authoritative state. */
+    async setAttention(attention) {
+        this.attentionMode = attention;
+        await this.publishPresence();
+    }
+    /** Publish the agent's per-channel attention overrides into presence (advisory). An empty map drops
+     *  the field. Mirror only — never read back into delivery. */
+    async setChannelModes(modes) {
+        this.channelModes = Object.keys(modes).length ? modes : undefined;
+        await this.publishPresence();
+    }
+    /** Overlay the host's live model onto the card's display-only `meta.model` and republish presence.
+     *  For connectors that learn the actual model only *after* launch (e.g. Claude Code's `SessionStart`
+     *  hook payload) rather than from an operator pin. Display-only discovery metadata; a no-op when the
+     *  value is empty or already current (no redundant publish). The mutated card is read live by every
+     *  later publish, so even a pre-connect call surfaces on the first presence write. */
+    async setCardModel(model) {
+        const m = model.trim();
+        if (!m || this.card.meta?.model === m)
+            return;
+        this.card.meta = { ...(this.card.meta ?? {}), model: m };
+        await this.publishPresence();
+    }
     // ---- channel discovery ---------------------------------------------------
     /** This channel's registry config from the live local cache (undefined if unset). */
     getChannelConfig(channel) {
@@ -319,45 +617,102 @@ export class CotalEndpoint extends EventEmitter {
         return [...this.channels];
     }
     /**
-     * Join a channel mid-session: add it to our chat durable's `filter_subjects` (same durable,
-     * same ack-floor, no teardown — `update` rides the self-scoped create grant), capture the
-     * stream frontier as this channel's join watermark, and backfill its history if replay is on.
-     * Idempotent: re-joining a channel already in our filter is a no-op (no re-backfill). Returns
-     * the number of historical messages backfilled (emitted as `historical` "message" events).
+     * Join a channel mid-session: open a native core subscription (manager-free live read, broker-
+     * confirmed against `sub.allow`), capture the stream frontier as the join watermark, backfill its
+     * history if replay is on, and — for a `durable`-class channel under a manager — request a Plane-3
+     * durable backstop. Idempotent: re-joining is a no-op (no re-backfill). Returns the backfill count +
+     * whether the durable backstop is active (+ a `reason` when a durable channel couldn't get one).
      */
     async joinChannel(channel) {
         if (!this.jsm)
-            throw new Error("endpoint not started");
+            throw new Error(this.notLiveMsg());
         if (this.channels.includes(channel))
-            return { joined: false, backfilled: 0 };
-        const next = collapseFilterSubjects([...this.channels, channel].map((ch) => chatSubject(this.space, "*", ch)));
-        // Arm the watermark BEFORE the filter flip (single-delivery: a tail message on the new
-        // channel is then either ≤ frontier → backfill-only or > frontier → tail-only, never both),
-        // and filter BEFORE backfill (gap-safe: backfill-first leaves a window in neither stream).
+            return { joined: false, backfilled: 0, durable: this.plane3Channels.has(channel) };
+        // Arm the watermark BEFORE going live: the backfill reads ≤ frontier and the core-sub only ever
+        // delivers post-subscribe live messages (> frontier), so the two never overlap.
         const armed = await this.armJoin([channel]);
-        await this.jsm.consumers.update(chatStream(this.space), chatDurable(this.card.id), {
-            filter_subjects: next,
-        });
+        // Live read (SPEC v0.3): open the native core subscription — MANAGER-FREE, broker-enforced by
+        // sub.allow. This is what lets an agent join a channel's live feed on its own. The sub.allow
+        // refusal is async — broker-confirm before committing local join state; the subscribe handler
+        // ALSO drops a channel on ANY refusal (incl. a late one), so this is not a timing gamble (#13).
+        this.subscribeChat(channel);
+        try {
+            await this.confirmChatSub();
+        }
+        catch (e) {
+            // The confirm boundary (flush) failed — the connection drained/closed mid-join, so we have NO
+            // confirmation the subscribe was accepted. Fail closed: undo the half-open join rather than
+            // returning as if it were confirmed (a reconnect re-confirms from this.channels, which we never
+            // pushed to). unsubscribeChat clears chatSubs + confirmingChatSubs.
+            this.unsubscribeChat(channel);
+            this.joinSeq.delete(channel);
+            throw new Error(`cannot join "${channel}": live subscription could not be confirmed (${e.message})`);
+        }
+        this.confirmingChatSubs.delete(chatSubject(this.space, "*", channel));
+        if (this.chatSubDenied.has(channel)) {
+            this.unsubscribeChat(channel);
+            this.joinSeq.delete(channel);
+            throw new Error(`cannot join "${channel}": not within this agent's read ACL (allowSubscribe)`);
+        }
         this.channels.push(channel);
+        // Durable backstop. The live core-sub above already delivers (manager-free). For a `durable`-class
+        // channel, request a Plane-3 per-member backstop from the manager (durableJoin) so a post reaches a
+        // busy/offline turn — the core-sub stays as the live wake-hint, dedup-coalesced with the Plane-3
+        // copy by id-dedup. No manager (open dev / manager-less) ⇒ joined LIVE only, surfaced via `reason`
+        // (never silent). A `live`-class channel takes no backstop (joined live is the contract).
+        let durable = false;
+        let reason;
+        if (effectiveDeliveryClass(this.channelConfigs.get(channel), this.channelDefaults) === "durable") {
+            try {
+                const r = await this.durableJoinChannel(channel);
+                if (r.durable) {
+                    this.plane3Channels.set(channel, r.generation ?? 0);
+                    durable = true;
+                }
+                else {
+                    reason = r.reason ?? "durable backstop unavailable";
+                }
+            }
+            catch (e) {
+                // No privileged writer (manager-less) or the write was rejected — joined live, backstop
+                // unavailable. NOT a join failure: the live subscription is up and authorized.
+                reason = `durable backstop unavailable (${e.message})`;
+            }
+        }
         const backfilled = await this.backfillArmed(armed);
-        return { joined: true, backfilled };
+        return { joined: true, backfilled, durable, ...(reason !== undefined ? { reason } : {}) };
     }
-    /** Leave a channel mid-session: drop it from the durable's `filter_subjects`. Refuses to leave
-     *  the *last* channel (an empty filter would match every chat subject — the opposite of
-     *  leaving). Returns whether anything changed. */
+    /** Leave a channel mid-session — MANAGER-FREE for the live read: close the core subscription. For a
+     *  Plane-3 durable channel, the membership is tombstoned FIRST at the leave cursor (SPEC §7: leave is
+     *  a hard read boundary for the backstop — a pre-leave entry stays deliverable, `seq > leaveCursor` is
+     *  denied). FAIL-CLOSED: if the tombstone can't be confirmed the call throws and the leave is NOT
+     *  applied (live sub stays up, local mirror intact) so the caller can retry — never close the live
+     *  read while the backstop keeps delivering. */
     async leaveChannel(channel) {
         if (!this.jsm)
-            throw new Error("endpoint not started");
-        const i = this.channels.indexOf(channel);
-        if (i < 0)
+            throw new Error(this.notLiveMsg());
+        if (!this.channels.includes(channel))
             return { left: false };
-        if (this.channels.length === 1)
-            throw new Error(`cannot leave "${channel}" — it is your only channel (an empty filter would subscribe to all)`);
-        const remaining = this.channels.filter((c) => c !== channel);
-        await this.jsm.consumers.update(chatStream(this.space), chatDurable(this.card.id), {
-            filter_subjects: collapseFilterSubjects(remaining.map((ch) => chatSubject(this.space, "*", ch))),
-        });
-        this.channels.splice(i, 1);
+        // Auth + durable-class ⇒ a Plane-3 membership may exist; tombstone it BEFORE touching local state.
+        // The join generation comes from the local mirror, but a BOOT membership whose hydration was missed
+        // (transient manager error at connect) is NOT in the mirror — so re-resolve it from the manager on
+        // demand. FAIL-CLOSED: fetchMemberships throws on a responder-present error, so a leave whose
+        // tombstone can't be confirmed propagates (live sub stays up, mirror intact) for the caller to retry
+        // — reporting `left` while the trusted reader keeps transferring to DLV is the fail-open leak. A
+        // genuine no-responder (open / manager-less, no Plane-3) means there is no membership to tombstone.
+        if (this.creds && effectiveDeliveryClass(this.channelConfigs.get(channel), this.channelDefaults) === "durable") {
+            let generation = this.plane3Channels.get(channel);
+            if (generation === undefined)
+                generation = (await this.fetchMemberships())?.find((m) => m.channel === channel)?.generation;
+            if (generation !== undefined) {
+                await this.durableLeaveChannel(channel, generation);
+                this.plane3Channels.delete(channel);
+            }
+        }
+        this.unsubscribeChat(channel);
+        const i = this.channels.indexOf(channel);
+        if (i >= 0)
+            this.channels.splice(i, 1);
         this.joinSeq.delete(channel);
         return { left: true };
     }
@@ -366,7 +721,7 @@ export class CotalEndpoint extends EventEmitter {
      *  observer endpoints (no consumers needed). */
     async listChannels() {
         if (!this.nc)
-            throw new Error("endpoint not started");
+            throw new Error(this.notLiveMsg());
         const mgr = await jetstreamManager(this.nc);
         // Subjects carry the sender (chat.<sender>.<channel>), so collapse across senders: sum
         // each channel's counts regardless of who published.
@@ -394,56 +749,32 @@ export class CotalEndpoint extends EventEmitter {
             .sort((a, b) => a.channel.localeCompare(b.channel));
     }
     async channelMembers(channel) {
-        const mgr = await this.manager();
-        // Group channel patterns by each consumer's durable id-token (chat_<id> → token(id)).
-        // One peer has one chat consumer, so this is a straight per-peer collection; join/leave
-        // just mutates that consumer's filter_subjects, which the next call re-reads live.
-        const byTok = new Map();
-        for await (const ci of mgr.consumers.list(chatStream(this.space))) {
-            const tok = chatDurableToken(ci.config.durable_name ?? ci.name);
-            if (tok === null)
-                continue;
-            // The server may report a single filter as `filter_subject` or `filter_subjects` — both
-            // are the same datum; read whichever is present. Filters are already collapsed (the
-            // effective subscription), so parse the channel straight out of each.
-            const filters = ci.config.filter_subjects ?? (ci.config.filter_subject ? [ci.config.filter_subject] : []);
-            const set = byTok.get(tok) ?? new Set();
-            for (const f of filters) {
-                const p = parseSubject(f);
-                if (p?.kind === "chat")
-                    set.add(p.rest);
-            }
-            byTok.set(tok, set);
-        }
-        // Join with presence for liveness. token() is lossy, so match forward: index the roster
-        // by token(id). A durable with no roster match is a ghost/foreign id — keep its token,
-        // never drop it.
-        const byToken = new Map();
+        const members = (await listMembers(await this.membersRegistry())).filter((r) => r.leaveCursor === undefined && r.activated === true);
+        const byId = new Map();
         for (const p of this.roster.values())
-            byToken.set(token(p.card.id), p);
-        const memberFor = (tok) => {
-            const p = byToken.get(tok);
+            byId.set(p.card.id, p);
+        const memberForId = (id) => {
+            const p = byId.get(id);
             return p
                 ? { id: p.card.id, name: p.card.name, role: p.card.role, live: p.status !== "offline" }
-                : { id: tok, name: tok, live: false };
+                : { id, name: id, live: false };
         };
         const byName = (a, b) => a.name.localeCompare(b.name);
-        if (channel !== undefined) {
-            const out = [];
-            for (const [tok, patterns] of byTok)
-                if ([...patterns].some((pat) => subjectMatches(pat, channel)))
-                    out.push(memberFor(tok));
-            return out.sort(byName);
-        }
+        if (channel !== undefined)
+            return members
+                .filter((r) => subjectMatches(r.channel, channel))
+                .map((r) => memberForId(r.owner))
+                .sort(byName);
         const map = new Map();
-        for (const [tok, patterns] of byTok) {
-            const m = memberFor(tok);
-            for (const pat of patterns) {
-                const arr = map.get(pat);
-                if (arr)
+        for (const r of members) {
+            const arr = map.get(r.channel);
+            const m = memberForId(r.owner);
+            if (arr) {
+                if (!arr.some((x) => x.id === m.id))
                     arr.push(m);
-                else
-                    map.set(pat, [m]);
+            }
+            else {
+                map.set(r.channel, [m]);
             }
         }
         for (const arr of map.values())
@@ -504,17 +835,32 @@ export class CotalEndpoint extends EventEmitter {
             return;
         void (async () => {
             for await (const s of this.nc.status()) {
-                if (s.type === "error")
-                    this.emit("error", describeStatusError(s.error));
+                if (s.type !== "error")
+                    continue;
+                // Suppress the EXPECTED permission violation from a manager-free join we're confirming: an
+                // out-of-ACL `nc.subscribe` is refused async on its chat subject, which joinChannel catches
+                // and turns into a clean throw — it is not a connection error to surface.
+                if (s.error instanceof PermissionViolationError && this.confirmingChatSubs.has(s.error.subject))
+                    continue;
+                this.emit("error", describeStatusError(s.error));
             }
         })().catch((e) => {
             if (!this.stopped)
                 this.emit("error", e);
         });
     }
+    /** The error message for a guard that finds the endpoint unbound: "reconnecting" during a
+     *  rebuild's null window OR an inter-retry backoff (so a concurrent op reports the real
+     *  reason, not "not started" — `reestablishing` spans the whole retry loop incl. backoff),
+     *  else "endpoint not started" (genuine pre-start). */
+    notLiveMsg() {
+        return this.reconnecting || this.reestablishing
+            ? "reconnecting — try again shortly"
+            : "endpoint not started";
+    }
     async publishMsg(subject, msg) {
         if (!this.js)
-            throw new Error("endpoint not started");
+            throw new Error(this.notLiveMsg());
         // msgID = message id → free server-side dedup across JetStream redelivery.
         await this.js.publish(subject, JSON.stringify(msg), { msgID: msg.id });
     }
@@ -525,6 +871,28 @@ export class CotalEndpoint extends EventEmitter {
             throw new Error("endpoint not started");
         await createSpaceStreams(this.jsm, this.space);
     }
+    /**
+     * Privileged: write an agent's BOOT durable membership — each `durable`-class channel in its boot
+     * subscribe set gets a Plane-3 durable-active record (via {@link durableJoinFor}: cursor capture +
+     * activation catch-up), so it receives durable backstop copies from boot exactly like a runtime
+     * `durableJoin`. `live`-class (and non-concrete) channels are skipped. Idempotent.
+     *
+     * Writes the durable RECORDS with the caller's privileged creds — it does NOT require this endpoint
+     * to host the runtime fan-out/reader loops (a space-level manager service), so EVERY auth launcher
+     * provisions identically: the manager AND the short-lived `cotal spawn` provisioner both write boot
+     * records, which the space's manager then delivers (no silent no-op — that would hide a boot
+     * membership; AGENTS.md "no fallbacks"). A space running no manager is live-only for everyone (the
+     * records exist; nothing delivers them until a manager hosts the loops).
+     */
+    async provisionMembership(targetId, channels) {
+        for (const ch of channels) {
+            if (!isConcreteChannel(ch))
+                continue; // durable membership is per-concrete-channel
+            if ((await this.deliveryClassFresh(ch)) !== "durable")
+                continue;
+            await this.durableJoinFor(targetId, ch);
+        }
+    }
     /**
      * Privileged: pre-create an agent's DM inbox durable (auth mode), so the agent can BIND
      * it without holding CONSUMER.CREATE on DM_<space>. The creator sets the filter to
@@ -536,6 +904,17 @@ export class CotalEndpoint extends EventEmitter {
         const jsm = await this.manager();
         await jsm.consumers.add(dmStream(this.space), dmDurableConfig(this.space, targetId));
     }
+    /**
+     * Privileged: pre-create an agent's bind-only Plane-3 DELIVER durable (`dlv_<id>`, filtered to
+     * `dlv.<id>`), so the agent can BIND its per-member durable handoff without holding CONSUMER.CREATE
+     * on the DLV stream. Same bind-only model as {@link provisionDmInbox}: the creator sets the filter,
+     * the agent never does. The trusted reader transfers re-authorized copies onto `dlv.<id>`; the agent
+     * acks them via native JetStream (SPEC §8). Idempotent. The caller must be permissive on DLV.
+     */
+    async provisionDlvInbox(targetId) {
+        const jsm = await this.manager();
+        await jsm.consumers.add(dlvStream(this.space), dlvDurableConfig(this.space, targetId));
+    }
     /**
      * Privileged: pre-create a role's shared TASK work-queue durable (auth mode), so agents
      * of that role can BIND it without holding CONSUMER.CREATE on TASK_<space>. The creator
@@ -546,6 +925,524 @@ export class CotalEndpoint extends EventEmitter {
         const jsm = await this.manager();
         await jsm.consumers.add(taskStream(this.space), taskDurableConfig(this.space, role));
     }
+    // ---- Plane-3: durable backstop (SPEC §8) — privileged, manager-hosted ----------------------------
+    //
+    // Two manager loops + two privileged membership ops. The FAN-OUT writer (routing, not auth) reads
+    // every chat message and copies it into each eligible owner's MIXED inbox (`dinbox.<owner>`); the
+    // TRUSTED READER (the auth gate) re-authorizes each entry against the CURRENT ACL + membership
+    // interval and TRANSFERS the authorized copy to the owner's per-member DELIVER store
+    // (`dlv.<owner>`), which the agent binds + acks via native JetStream. The agent holds no read on the
+    // mixed store. See `.internal/research/stage4-impl-design.md`.
+    /** Lazily open the privileged members registry KV (manager / open-mode self). */
+    async membersRegistry() {
+        if (!this.nc)
+            throw new Error("endpoint not started");
+        this.membersKv ??= await openMembersRegistry(this.nc, this.space);
+        return this.membersKv;
+    }
+    /** Privileged: one owner's NON-TOMBSTONED durable memberships as `{channel, generation, activated}` —
+     *  the manager serves this to a connecting agent (via the `listMemberships` self-service op). The agent
+     *  hydrates its leave mirror from the ACTIVATED ones (the confirmed backstops), but the non-activated
+     *  ones are returned too so `leaveChannel` can discover + close a record that still routes under the
+     *  pure-interval predicate (a crash-stuck pending activation) — without reading the privileged KV. */
+    async ownerMemberships(owner) {
+        const recs = await listMembers(await this.membersRegistry(), { owner });
+        return recs
+            .filter((r) => r.leaveCursor === undefined)
+            .map((r) => ({ channel: r.channel, generation: r.generation, activated: r.activated === true }));
+    }
+    /** Effective delivery class read AUTHORITATIVELY from the registry KV (not the watch cache) — so a
+     *  `live`→`durable` flip is seen by fan-out without a cache-propagation gap (red-team MED-3). */
+    async deliveryClassFresh(channel) {
+        if (!this.channelKv)
+            return effectiveDeliveryClass(undefined, undefined);
+        const [cfg, defaults] = await Promise.all([
+            isConcreteChannel(channel) ? readChannelConfig(this.channelKv, channel) : Promise.resolve(undefined),
+            readChannelDefaults(this.channelKv),
+        ]);
+        return effectiveDeliveryClass(cfg, defaults);
+    }
+    /** Collision-safe `@mention` → owner-id resolution: a name that resolves to exactly one present
+     *  peer wins; 0 or >1 matches drop (never fan a directed durable copy to an unrelated same-named
+     *  bystander — red-team LOW; SPEC §4 unique instance id). */
+    resolveOwnerByName(name) {
+        const matches = [...this.roster.values()].filter((p) => p.card.name.toLowerCase() === name.toLowerCase());
+        return matches.length === 1 ? matches[0].card.id : undefined;
+    }
+    /** Publish one fan-out entry into an owner's mixed inbox, idempotent via `Nats-Msg-Id`
+     *  (`<msgId>:<owner>:<generation>`) so a catch-up copy and a racing fan-out copy collapse. */
+    async publishDinbox(owner, entry) {
+        if (!this.js)
+            return;
+        await this.js.publish(dinboxSubject(this.space, owner), JSON.stringify(entry), {
+            msgID: `${entry.msg.id}:${owner}:${entry.generation}`,
+        });
+    }
+    /** The fan-out consumer's delivered stream-seq — the activation-fence upper bound (red-team
+     *  BLOCKER-1: the shared fan-out cursor advances independently of the stream frontier). */
+    async fanoutDeliveredSeq() {
+        const info = await this.consumerInfo(chatStream(this.space), FANOUT_DURABLE);
+        return info?.delivered?.stream_seq ?? 0;
+    }
+    /**
+     * Privileged durable-JOIN write (the manager calls this after validating channel ⊆ allowSubscribe;
+     * {@link provisionMembership} calls it at provision time for boot channels): capture `joinCursor`,
+     * commit a `durable-active` record (CAS + generation bump), then ACTIVATION CATCH-UP idempotently
+     * copies `(joinCursor, fence]` into the owner inbox where `fence = max(frontier, fanoutDelivered)` —
+     * fan-out owns `seq > fence`. Idempotent against a timeout-retry (an already-activated membership
+     * no-ops). Returns `{durable:false}` (honest degrade) only if the catch-up window was evicted.
+     *
+     * This writes durable KV + dinbox state with the caller's privileged creds; it does NOT require THIS
+     * endpoint to host the fan-out/reader loops (those are a space-level manager service). So a
+     * short-lived provisioner can write a boot membership a separate long-lived manager then delivers.
+     */
+    async durableJoinFor(owner, channel) {
+        if (!this.js)
+            throw new Error("endpoint not started");
+        await this.manager(); // ensure jsm — a non-consuming provisioner inits it lazily; catch-up + fence need it
+        const kv = await this.membersRegistry();
+        const existing = await readMember(kv, channel, owner);
+        const open = existing?.record.state === "durable-active" && existing.record.leaveCursor === undefined;
+        if (open && existing.record.activated)
+            return { durable: true, generation: existing.record.generation }; // fully activated — idempotent
+        // Either a NEW join (no record / a tombstone to supersede) → fresh joinCursor + bumped generation,
+        // OR a retry of an INCOMPLETE activation (durable-active but not yet activated, from an earlier
+        // eviction/crash) → re-run catch-up over the SAME join window, no bump. The record is committed
+        // `activated:false` first and routes IN-INTERVAL immediately (fan-out + reader deliver via the
+        // pure-interval durableEligible) so no live message published during catch-up is lost. `activated`
+        // gates only the REPORT — durableJoin returns true / channelMembers lists the owner only after the
+        // catch-up confirms. A join that never completes catch-up still routes live (harmless: the agent is
+        // live-subscribed and DLV is id-deduped) but honestly reports durable:false and stays hidden.
+        const joinCursor = open ? existing.record.joinCursor : await this.chatFrontier();
+        const generation = open ? existing.record.generation : (existing?.record.generation ?? 0) + 1;
+        const base = {
+            channel, owner, state: "durable-active", joinCursor, generation,
+            activated: false, writerIdentity: this.card.id, updatedAt: Date.now(),
+        };
+        if (!open)
+            await commitMember(kv, base);
+        const fence = Math.max(await this.chatFrontier(), await this.fanoutDeliveredSeq());
+        const cu = await this.catchupCopy(owner, channel, joinCursor, fence, generation);
+        if (cu.evicted) {
+            // Catch-up window irreparably evicted (the oldest in-window message aged out) — this join can never
+            // be a complete backstop. TOMBSTONE the just-committed record at `fence` so it does NOT route:
+            // pure-interval durableEligible would otherwise keep delivering to a record the agent was told is
+            // durable:false AND can't discover to leave (critic BLOCKER-1). Pass `generation` as the expected
+            // generation (ux stale-write guard) so this cleanup can't tombstone a concurrent NEWER rejoin — if
+            // one won, StaleMembershipWrite is the correct no-op (the rejoin is the live record). Then degrade
+            // honestly — a retry is a fresh join (no longer `open`, so a current joinCursor is captured).
+            try {
+                await tombstoneMember(kv, channel, owner, fence, this.card.id, generation);
+            }
+            catch (e) {
+                if (!(e instanceof StaleMembershipWrite))
+                    throw e;
+            }
+            return { durable: false, reason: "activation catch-up window partially evicted by retention", generation };
+        }
+        // Flip → reported durable, ATOMICALLY: refuse if a concurrent SAME-generation leave (tombstone) or a
+        // rejoin superseded this pending join while catch-up ran. A blind same-gen commit would clobber the
+        // tombstone (clear leaveCursor) and resurrect the membership, reopening §7 (review-general-2 BLOCKER).
+        const activated = await activateMember(kv, channel, owner, generation, joinCursor);
+        if (!activated)
+            return { durable: false, reason: "activation superseded by a concurrent leave or rejoin", generation };
+        return { durable: true, generation };
+    }
+    /** Privileged durable-LEAVE write: tombstone the membership at `leaveCursor = frontier` so the
+     *  backstop denies `seq > leaveCursor` while a pre-leave entry stays deliverable (SPEC §7 interval). */
+    async durableLeaveFor(owner, channel, expectedGeneration) {
+        if (!this.plane3)
+            return; // not a Plane-3 host — no membership to tombstone
+        const kv = await this.membersRegistry();
+        // expectedGeneration (captured by the agent at durableJoin) refuses a stale leave from tombstoning
+        // a newer rejoin (StaleMembershipWrite) — a durable-disable primitive otherwise.
+        await tombstoneMember(kv, channel, owner, await this.chatFrontier(), this.card.id, expectedGeneration);
+    }
+    /** Idempotently copy the eligible chat messages in `(fromSeqExcl, toSeqIncl]` for `channel` into the
+     *  owner inbox, via a DEDICATED per-(owner,join) ephemeral consumer (NOT the agent-scoped
+     *  `chathist_<id>`/`histLock` — red-team HIGH-8). `evicted` ⇒ the oldest eligible seq aged out under
+     *  `discard=Old` (the start seq could not be served), a durable shortfall the caller surfaces. */
+    async catchupCopy(owner, channel, fromSeqExcl, toSeqIncl, generation) {
+        if (!this.js || !this.jsm || toSeqIncl <= fromSeqExcl)
+            return { copied: 0, evicted: false };
+        const subject = chatSubject(this.space, "*", channel);
+        // Eviction = a message in `(joinCursor, …]` on THIS channel's subject aged out under discard=Old.
+        // Judged PER-SUBJECT (reuse channelDropped: oldest-retained-for-subject vs the watermark, only at
+        // the per-subject cap), NOT against the stream-global joinCursor+1 — other channels' traffic
+        // inflates the global seq, so a naive "first delivered seq > joinCursor+1" false-positives on any
+        // busy multi-channel space (impl-review HIGH-2). A true eviction → durableJoin reports durable:false.
+        const evicted = await this.channelDropped(subject, fromSeqExcl);
+        const name = `cu_${token(owner)}_${generation}`;
+        try {
+            await this.jsm.consumers.delete(chatStream(this.space), name);
+        }
+        catch { /* none */ }
+        await this.jsm.consumers.add(chatStream(this.space), {
+            name, filter_subject: subject, ack_policy: AckPolicy.None, mem_storage: true,
+            inactive_threshold: nanos(30_000), deliver_policy: DeliverPolicy.StartSequence, opt_start_seq: fromSeqExcl + 1,
+        });
+        let copied = 0;
+        try {
+            const consumer = await this.js.consumers.get(chatStream(this.space), name);
+            let pending = (await consumer.info()).num_pending;
+            while (pending > 0) {
+                const want = Math.min(pending, 256);
+                const iter = await consumer.fetch({ max_messages: want, expires: 5_000 });
+                let got = 0;
+                for await (const m of iter) {
+                    got++;
+                    if (m.seq > toSeqIncl)
+                        return { copied, evicted };
+                    let msg;
+                    try {
+                        msg = m.json();
+                    }
+                    catch {
+                        continue;
+                    }
+                    const parsed = parseSubject(m.subject);
+                    if (!parsed || msg.from?.id !== parsed.sender || msg.from.id === owner)
+                        continue;
+                    await this.publishDinbox(owner, { msg, channel, seq: m.seq, reason: "durable-channel", generation });
+                    copied++;
+                }
+                if (got < want)
+                    break;
+                pending -= got;
+            }
+        }
+        finally {
+            try {
+                await this.jsm.consumers.delete(chatStream(this.space), name);
+            }
+            catch { /* gone */ }
+        }
+        return { copied, evicted };
+    }
+    /** Start the Plane-3 fan-out writer + trusted reader on THIS (privileged) endpoint. `aclFor` maps an
+     *  owner id to its current read ACL for the reader's re-authorization (the manager passes its managed
+     *  set). Call once after connect; idempotent durable creation lets it resume on a manager restart. */
+    async startPlane3(aclFor) {
+        if (!this.js)
+            throw new Error("endpoint not started");
+        this.plane3 = { aclFor };
+        await this.armPlane3();
+    }
+    /** (Re)bind the Plane-3 fan-out writer + trusted reader. Idempotent — the durables resume from their
+     *  cursor. Called by {@link startPlane3} once AND by {@link connectAndBind} on every (re)connect, so
+     *  a manager-endpoint reconnect RE-ARMS the backstop. Without this, a broker blip would silently kill
+     *  the loops while `durableJoinFor` kept reporting `durable:true` (the impl-review's BLOCKER-1). No-op
+     *  unless this endpoint hosts Plane-3 (`this.plane3` set). */
+    async armPlane3() {
+        if (!this.plane3 || !this.js)
+            return;
+        await this.manager(); // the manager runs consume:false, so this.jsm is lazy — ensure it
+        await this.runFanout();
+        await this.runReader();
+    }
+    /** Fan-out loop: bind the privileged `fanout` durable on CHAT and route each message (routing only —
+     *  the trusted reader is the auth gate). */
+    async runFanout() {
+        if (!this.js || !this.jsm)
+            return;
+        try {
+            await this.jsm.consumers.add(chatStream(this.space), fanoutDurableConfig(this.space, { ackWaitMs: this.ackWaitMs }));
+        }
+        catch { /* exists */ }
+        const consumer = await this.js.consumers.get(chatStream(this.space), FANOUT_DURABLE);
+        const msgs = await consumer.consume();
+        this.streamMsgs.push(msgs);
+        void (async () => {
+            for await (const m of msgs) {
+                try {
+                    await this.fanOutMessage(m);
+                }
+                catch (e) {
+                    if (!this.stopped)
+                        this.emit("error", e);
+                    try {
+                        m.nak();
+                    }
+                    catch { /* draining */ }
+                }
+            }
+        })().catch((e) => { if (!this.stopped)
+            this.emit("error", e); });
+    }
+    /** Route ONE chat message to eligible owners' mixed inboxes. `durable` channel → its `durable-active`
+     *  members within interval; `live` channel → `@mention` targets authorized to read it (ACL only).
+     *  Members KV is scanned FRESH per message (no cache — red-team BLOCKER-1 catch-up correctness). */
+    async fanOutMessage(m) {
+        const parsed = parseSubject(m.subject);
+        if (!parsed || parsed.kind !== "chat") {
+            m.ack();
+            return;
+        }
+        const channel = parsed.rest;
+        let msg;
+        try {
+            msg = m.json();
+        }
+        catch {
+            m.ack();
+            return;
+        }
+        if (!msg.from || msg.from.id !== parsed.sender) {
+            m.ack();
+            return;
+        } // authenticity
+        const seq = m.seq;
+        if ((await this.deliveryClassFresh(channel)) === "durable") {
+            for (const rec of await listMembers(await this.membersRegistry(), { channel })) {
+                if (rec.owner === msg.from.id)
+                    continue; // never backstop the sender's own post
+                if (!durableEligible(rec, seq))
+                    continue; // routing fast-filter (reader re-checks)
+                await this.publishDinbox(rec.owner, { msg, channel, seq, reason: "durable-channel", generation: rec.generation });
+            }
+        }
+        else {
+            for (const name of msg.mentions ?? []) {
+                const owner = this.resolveOwnerByName(name);
+                if (!owner || owner === msg.from.id)
+                    continue;
+                const acl = this.plane3?.aclFor(owner);
+                if (!acl || !channelInAllow(acl, channel))
+                    continue; // @mention can't bypass the read ACL
+                await this.publishDinbox(owner, { msg, channel, seq, reason: "live-mention", generation: 0 });
+            }
+        }
+        m.ack();
+    }
+    /** Trusted-reader loop: bind the single privileged `reader` durable over `dinbox.>` and re-authorize
+     *  + transfer each entry. */
+    async runReader() {
+        if (!this.js || !this.jsm)
+            return;
+        try {
+            await this.jsm.consumers.add(inboxStream(this.space), inboxReaderConfig(this.space, { ackWaitMs: this.ackWaitMs }));
+        }
+        catch { /* exists */ }
+        const consumer = await this.js.consumers.get(inboxStream(this.space), INBOX_READER_DURABLE);
+        const msgs = await consumer.consume();
+        this.streamMsgs.push(msgs);
+        void (async () => {
+            for await (const m of msgs) {
+                try {
+                    await this.readerHandle(m);
+                }
+                catch (e) {
+                    if (!this.stopped)
+                        this.emit("error", e);
+                    try {
+                        m.nak();
+                    }
+                    catch { /* draining */ }
+                }
+            }
+        })().catch((e) => { if (!this.stopped)
+            this.emit("error", e); });
+    }
+    /** Re-authorize ONE mixed-inbox entry and transfer it to the owner's DELIVER store. Deny (drop) on a
+     *  revoked/narrowed ACL or out-of-interval seq; on transfer success, ack the mixed entry (durability
+     *  has moved to DLV — an §8 equivalent per-member at-least-once mechanism). The agent acks DLV. */
+    async readerHandle(m) {
+        const owner = parseDinboxOwner(m.subject);
+        if (!owner) {
+            m.ack();
+            return;
+        } // unparseable subject — not a real entry
+        let entry;
+        try {
+            entry = m.json();
+        }
+        catch {
+            m.ack();
+            return;
+        } // undecodable — drop
+        const redeliveries = m.info?.deliveryCount ?? 1; // JsMsg delivery attempts (1 on first delivery)
+        const acl = this.plane3?.aclFor(owner);
+        if (acl === undefined) {
+            // UNKNOWN owner — the manager has not (re)hydrated this owner's ACL yet (e.g. right after a
+            // manager PROCESS restart). This is NOT a revocation: DEFER (redeliver), never drop — an ack here
+            // would lose at-least-once on restart (impl-review BLOCKER-2). A delayed nak + a redelivery
+            // ceiling stops one perma-unknown owner from head-of-lining the shared reader.
+            // (Follow-up: the manager does not yet rehydrate its managed set across a process restart — until
+            // it does, a long-unknown owner's entries term after the ceiling; tracked, not a silent ack-drop.)
+            if (redeliveries >= READER_MAX_REDELIVERIES) {
+                m.term();
+                this.emit("error", new Error(`plane-3 reader: gave up on entry for unknown owner ${owner} after ${redeliveries} redeliveries`));
+                return;
+            }
+            m.nak(2000);
+            return;
+        }
+        // KNOWN owner whose CURRENT ACL no longer covers the channel — a revocation/narrowing. Drop: the
+        // entry is no longer authorized (SPEC §7 current-ACL gate before surfacing).
+        if (!channelInAllow(acl, entry.channel)) {
+            m.ack();
+            return;
+        }
+        if (entry.reason === "durable-channel") {
+            const rec = await readMember(await this.membersRegistry(), entry.channel, owner);
+            // INTERVAL re-auth (not a current-member boolean): a pre-leave entry (seq ≤ leaveCursor) stays
+            // deliverable; seq > leaveCursor (or after a rejoin's newer joinCursor) is the hard cut.
+            if (!rec || !durableEligible(rec.record, entry.seq)) {
+                m.ack();
+                return;
+            }
+        }
+        try {
+            await this.js.publish(dlvSubject(this.space, owner), JSON.stringify(entry.msg), {
+                msgID: `${entry.msg.id}:${owner}:${entry.generation}`,
+            });
+        }
+        catch {
+            // Transfer failed — keep the entry pending (redeliver), bounded by the same ceiling so a poison
+            // entry can't head-of-line the shared reader forever.
+            if (redeliveries >= READER_MAX_REDELIVERIES) {
+                m.term();
+                this.emit("error", new Error(`plane-3 reader: gave up transferring ${entry.msg.id} for ${owner} after ${redeliveries} redeliveries`));
+                return;
+            }
+            m.nak(2000);
+            return;
+        }
+        m.ack();
+    }
+    /** Agent-side: bind + pump our pre-created Plane-3 DELIVER durable (`dlv_<id>`). Every message here is
+     *  manager-written (DLV is manager-write-only, broker-enforced) and is a CHANNEL message by contract
+     *  (the backstop never carries DMs), so `kind=channel` is path-derived (SPEC §4) and the body is
+     *  trusted (no spoof-guard). `durable:true` — real JetStream ack, coalesced with the core-sub live
+     *  copy by `MeshAgent.ingest`. No-op when the durable isn't present (open mode / not provisioned). */
+    async pumpDlv() {
+        if (!this.js)
+            return;
+        let consumer;
+        try {
+            consumer = await this.js.consumers.get(dlvStream(this.space), dlvDurable(this.card.id));
+        }
+        catch {
+            return;
+        } // no DLV durable — Plane-3 not active for us
+        const msgs = await consumer.consume();
+        this.streamMsgs.push(msgs);
+        void (async () => {
+            for await (const m of msgs) {
+                let msg;
+                try {
+                    msg = m.json();
+                }
+                catch (e) {
+                    this.emit("error", e);
+                    try {
+                        m.term();
+                    }
+                    catch { /* draining */ }
+                    continue;
+                }
+                if (msg.from?.id === this.card.id) {
+                    m.ack();
+                    continue;
+                } // own echo (defensive)
+                const delivery = { ack: () => m.ack(), nak: () => m.nak(), durable: true };
+                this.emit("message", msg, delivery, { historical: false, kind: "channel" });
+            }
+        })().catch((e) => { if (!this.stopped)
+            this.emit("error", e); });
+    }
+    /** Agent-side: request a Plane-3 durable backstop for a channel via the manager (ctl.self). Throws
+     *  when no privileged writer is present (open / manager-less). 30s timeout — activation catch-up may
+     *  run before the reply (the window is small, but a busy channel can take more than the 5s default). */
+    async durableJoinChannel(channel) {
+        const reply = await this.requestControl(CONTROL_SELF_SERVICE, { op: "durableJoin", args: { channel } }, 30_000);
+        if (!reply.ok)
+            throw new Error(reply.error ?? "durable join rejected");
+        return reply.data ?? { durable: false };
+    }
+    /** Agent-side: release a Plane-3 durable backstop (tombstone membership at the leave cursor). Passes
+     *  the join generation so a stale leave can't tombstone a newer rejoin (the manager validates it). */
+    async durableLeaveChannel(channel, generation) {
+        const reply = await this.requestControl(CONTROL_SELF_SERVICE, { op: "durableLeave", args: { channel, generation } });
+        if (!reply.ok)
+            throw new Error(reply.error ?? "durable leave rejected");
+    }
+    /** Fail-closed async cleanup for a channel forced out by a LATE sub.allow refusal (the broker revoked
+     *  the live read). The sync sub callback can't await, so this RETRIES the Plane-3 tombstone with capped
+     *  backoff UNTIL IT SUCCEEDS (or the endpoint stops) — the §7 boundary always closes once the manager
+     *  is reachable, never a silent give-up. While pending, the channel is tracked in
+     *  {@link pendingDurableLeave} and surfaced via {@link pendingDurableLeaves} (the connector shows it in
+     *  `cotal_channels` as `durable-unclosed`, never ordinary absence). The generation is kept the whole
+     *  time. Authoritative closure of a revoked membership is also the manager's job (revocation). */
+    async closeRefusedMembership(channel, generation) {
+        this.pendingDurableLeave.set(channel, generation);
+        for (let attempt = 0;; attempt++) {
+            if (this.stopped)
+                return;
+            try {
+                await this.durableLeaveChannel(channel, generation);
+                this.plane3Channels.delete(channel);
+                this.pendingDurableLeave.delete(channel);
+                return;
+            }
+            catch (e) {
+                if (attempt === 0)
+                    this.emit("error", new Error(`channel "${channel}": Plane-3 durable membership (generation ${generation}) not yet tombstoned after a refused live sub — retrying; §7 boundary may be open until it succeeds (${e.message})`));
+                await new Promise((r) => setTimeout(r, Math.min(30_000, 1000 * 2 ** attempt)));
+            }
+        }
+    }
+    /** Channels with a Plane-3 durable membership whose §7 tombstone is still pending after a refused live
+     *  sub (see {@link closeRefusedMembership}) — surfaced by the connector as a `durable-unclosed` state so
+     *  it is never presented as ordinary "not subscribed". */
+    pendingDurableLeaves() {
+        return [...this.pendingDurableLeave.keys()];
+    }
+    /** A control request that found NO responder — open / manager-less (no privileged control plane),
+     *  distinct from a responder that errored. nats.js surfaces it as NoRespondersError, or a RequestError
+     *  whose `isNoResponders()` is true. */
+    isNoResponders(e) {
+        return e instanceof NoRespondersError || (e instanceof RequestError && e.isNoResponders());
+    }
+    /** Agent-side: this session's CURRENT durable memberships (channel + join generation) from the
+     *  manager — the agent holds no read on the privileged members KV. `undefined` ⇒ NO control responder
+     *  (open / manager-less, so there is no Plane-3 and no memberships). THROWS on a responder-present RPC
+     *  failure, so a caller can FAIL-CLOSED rather than mistaking a transient error for "no membership". */
+    async fetchMemberships() {
+        let reply;
+        try {
+            reply = await this.requestControl(CONTROL_SELF_SERVICE, { op: "listMemberships", args: {} }, 5_000);
+        }
+        catch (e) {
+            if (this.isNoResponders(e))
+                return undefined; // no manager — open / manager-less, no Plane-3
+            throw e; // responder present but errored — surface it (leaveChannel fails closed)
+        }
+        if (!reply.ok)
+            throw new Error(reply.error ?? "listMemberships failed");
+        return reply.data?.memberships ?? [];
+    }
+    /** Agent-side: seed `plane3Channels` with this session's boot durable memberships + generations on
+     *  first connect (the agent holds no read on the privileged members KV). A best-effort OPTIMIZATION: it
+     *  pre-fills the leave-generation mirror + the durable-state surface. If it can't (a transient manager
+     *  error), {@link leaveChannel} re-resolves the generation on demand and fails closed there — so a
+     *  missed hydration never silently leaves a boot durable channel untombstonable. */
+    async hydrateMemberships() {
+        let memberships;
+        try {
+            memberships = await this.fetchMemberships();
+        }
+        catch {
+            return; // transient manager error at boot — leaveChannel re-resolves on demand (fail-closed there)
+        }
+        if (!memberships)
+            return; // no manager — live-only
+        // Seed the mirror (+ durable-state surface) with CONFIRMED backstops only; leaveChannel re-resolves a
+        // non-activated record on demand if it ever needs to close one.
+        for (const m of memberships)
+            if (m.activated && this.channels.includes(m.channel))
+                this.plane3Channels.set(m.channel, m.generation);
+    }
     /** Lazily obtain a JetStream manager — so a non-consuming endpoint (e.g. the supervisor,
      *  consume:false) can still pre-create others' durables. */
     async manager() {
@@ -559,8 +1456,6 @@ export class CotalEndpoint extends EventEmitter {
         if (!this.jsm)
             throw new Error("endpoint not started");
         const id = this.card.id;
-        const ack_wait = nanos(this.ackWaitMs);
-        const inactive_threshold = nanos(this.inactiveThresholdMs);
         // Unicast: this instance's private DM inbox. Open mode self-creates; auth mode BINDS a
         // durable the provisioner pre-created (agents are denied CONSUMER.CREATE on DM_<space>,
         // since the create-time filter_subject is the attack surface — see provisionDmInbox).
@@ -571,48 +1466,36 @@ export class CotalEndpoint extends EventEmitter {
             }));
         }
         await this.pump(dmStream(this.space), dmDurable(id));
-        // Multicast: a DeliverPolicy.New *tail* of our channels. History is NOT a durable replay —
-        // it's an explicit, per-channel backfill on join (replay-policy gated, below), the only
-        // shape that can honor per-channel policy given deliver_policy is consumer-wide.
+        // Plane-3 (SPEC §8): bind + pump our per-member DELIVER durable (`dlv_<id>`) — the re-authorized
+        // durable-backstop channel copies the trusted reader transfers to us. No-op when it isn't present
+        // (open mode / un-provisioned). Auth-only feature; the pump self-guards on the durable's existence.
+        await this.pumpDlv();
+        // Multicast: open a native CORE subscription for each channel (live, manager-free, broker-enforced
+        // by sub.allow) — boot + runtime joins use the SAME path; there is no per-instance chat durable.
+        // The durable backstop (a busy/offline turn) is Plane-3 (auth: membership written at provision, the
+        // manager's fan-out writer + trusted reader deliver via the `dlv_<id>` pump above; open dev mode is
+        // live-only — the durable plane needs the manager's trusted reader, the security boundary). Per-
+        // channel history is the explicit replay-gated backfill, on FIRST connect only; a reconnect reopens
+        // the subs without re-backfilling (the durable backstop redelivers any missed window via dlv).
         if (this.channels.length) {
-            const durable = chatDurable(id);
-            const want = collapseFilterSubjects(this.channels.map((ch) => chatSubject(this.space, "*", ch)));
-            const info = await this.consumerInfo(chatStream(this.space), durable);
-            if (!info) {
-                // Fresh durable: a New tail (history is the explicit backfill below — the only shape
-                // that honors per-channel policy given deliver_policy is consumer-wide).
-                await this.jsm.consumers.add(chatStream(this.space), {
-                    durable_name: durable,
-                    filter_subjects: want,
-                    ack_policy: AckPolicy.Explicit,
-                    ack_wait,
-                    deliver_policy: DeliverPolicy.New,
-                    inactive_threshold,
-                });
-                // Arm the tail-drop watermarks BEFORE pump starts, so the tail can never deliver a
-                // just-created channel's message un-watermarked (which would double-emit: live + backfill).
-                const armed = await this.armJoin(this.channels);
-                await this.pump(chatStream(this.space), durable);
+            // Arm the per-channel join watermarks BEFORE opening the subs: the backfill reads <= frontier and
+            // the core-sub delivers > frontier, so they never overlap (first connect). On reconnect we reopen
+            // without arming/backfilling.
+            const armed = this.firstConnect ? await this.armJoin(this.channels) : undefined;
+            for (const ch of this.channels)
+                this.subscribeChat(ch);
+            await this.confirmChatSub();
+            for (const ch of this.channels)
+                this.confirmingChatSubs.delete(chatSubject(this.space, "*", ch));
+            if (armed)
                 await this.backfillArmed(armed);
-            }
-            else {
-                // Rebind: reconcile the durable's filter to the CURRENT config (a config that changed
-                // between restarts is honored). Channels the config GAINED are backfilled like a fresh
-                // join; channels it LOST are dropped from the filter. An unchanged config = pure resume,
-                // empty diff, no re-replay.
-                await this.pump(chatStream(this.space), durable);
-                const haveFilters = info.config.filter_subjects ?? (info.config.filter_subject ? [info.config.filter_subject] : []);
-                // Channels the config gained = those not already covered by the durable's filters (a
-                // wildcard already covers its sub-channels). Backfill only those.
-                const gained = this.channels.filter((c) => !haveFilters.some((f) => subjectMatches(f, chatSubject(this.space, "*", c))));
-                // Arm watermarks for the gained channels BEFORE the filter reconcile flips them on.
-                const armed = gained.length ? await this.armJoin(gained) : undefined;
-                if (!sameSet(haveFilters, want))
-                    await this.jsm.consumers.update(chatStream(this.space), durable, { filter_subjects: want });
-                if (armed)
-                    await this.backfillArmed(armed);
-            }
         }
+        // First connect, auth mode: hydrate the local generation mirror for BOOT durable memberships (the
+        // manager provisioned them server-side, so they are not in plane3Channels yet) — without it,
+        // leaving a boot durable channel could not tombstone its §7 boundary. Open mode has no Plane-3.
+        if (this.firstConnect && this.creds && this.channels.length)
+            await this.hydrateMemberships();
+        this.firstConnect = false;
         // Anycast: a shared work-queue consumer for our role — one instance grabs each task.
         // Open mode self-creates; auth mode BINDS the provisioner-pre-created svc_<role>
         // durable (agents are denied CONSUMER.CREATE on TASK_<space>, since the create-time
@@ -667,8 +1550,14 @@ export class CotalEndpoint extends EventEmitter {
                         m.ack();
                         continue;
                     }
+                    // No pre-commit dedup here: the durable is the at-least-once path, so it must NEVER ack a copy
+                    // just because an id was "seen" — that would drop an unhandled message (the security/critic
+                    // HIGH). Steady state is single-path (coverage-partition: the core-sub drops durable-covered
+                    // channels). The only overlap is the brief live-first transition window, and a duplicate there
+                    // is coalesced downstream by the receiver's commit-aware id-dedup (MeshAgent.ingest keeps ONE
+                    // entry and takes THIS durable ack handle) — so the durable copy is acked only once handled.
                 }
-                const delivery = { ack: () => m.ack(), nak: () => m.nak() };
+                const delivery = { ack: () => m.ack(), nak: () => m.nak(), durable: true };
                 this.emit("message", msg, delivery, {
                     historical: false,
                     kind: kindFromParsed(parsed.kind),
@@ -679,6 +1568,98 @@ export class CotalEndpoint extends EventEmitter {
                 this.emit("error", e);
         });
     }
+    /** Open a native core subscription to a channel's live feed (the manager-free live read path,
+     *  broker-enforced by `sub.allow`). At-most-once — no replay, no ack; it is the live delivery for
+     *  every channel (boot + runtime). For a `durable` channel it is also the low-latency wake-hint
+     *  alongside the Plane-3 durable copy, coalesced by the receiver's id-dedup. Drops our own echo +
+     *  spoofed senders. */
+    subscribeChat(channel) {
+        if (!this.nc || this.chatSubs.has(channel))
+            return;
+        this.chatSubDenied.delete(channel);
+        const subject = chatSubject(this.space, "*", channel);
+        this.confirmingChatSubs.add(subject);
+        const sub = this.nc.subscribe(subject, {
+            callback: (err, m) => {
+                if (err) {
+                    // async sub.allow refusal (or sub error): the live feed for this channel is dead — never a
+                    // leak (the broker refused it). Drop the channel from local joined state even if it was
+                    // already treated as joined — a LATE refusal beyond the confirm window: conformance #13
+                    // "drop on late refusal". (During the join's own confirm the channel isn't pushed yet, so
+                    // this fires nothing then; joinChannel reads `chatSubDenied` and throws cleanly.)
+                    this.chatSubDenied.add(channel);
+                    this.chatSubs.delete(channel);
+                    // NOTE: do NOT remove `subject` from confirmingChatSubs here — that set gates watchStatus's
+                    // suppression of this expected violation, and is cleared by joinChannel after confirm (or by
+                    // unsubscribeChat). Removing it in the callback races the watcher and leaks a spurious error.
+                    const i = this.channels.indexOf(channel);
+                    if (i >= 0) {
+                        this.channels.splice(i, 1);
+                        this.joinSeq.delete(channel);
+                        // A late sub.allow refusal forces this agent out of the channel (the broker revoked its live
+                        // read). If it held a Plane-3 durable membership, the §7 boundary must close too. This sub
+                        // callback can't await, so a fail-closed async helper RETRIES the tombstone (backoff) UNTIL it
+                        // succeeds, clearing the mirror only then; while pending it is surfaced via cotal_channels —
+                        // never a silent drop, never lost retry state.
+                        const gen = this.plane3Channels.get(channel);
+                        if (gen !== undefined)
+                            void this.closeRefusedMembership(channel, gen);
+                        this.emit("error", new Error(`left channel "${channel}": its live subscription was refused by the broker`));
+                    }
+                    return;
+                }
+                const parsed = parseSubject(m.subject);
+                if (!parsed || parsed.kind !== "chat")
+                    return;
+                let msg;
+                try {
+                    msg = m.json();
+                }
+                catch (e) {
+                    this.emit("error", e);
+                    return;
+                }
+                if (!msg.from || msg.from.id !== parsed.sender)
+                    return; // spoof/malformed — drop (at-most-once)
+                if (msg.from.id === this.card.id)
+                    return; // our own echo
+                const delivery = { ack: () => { }, nak: () => { }, durable: false }; // live = at-most-once, not acked
+                this.emit("message", msg, delivery, {
+                    historical: false,
+                    kind: kindFromParsed(parsed.kind),
+                });
+            },
+        });
+        this.chatSubs.set(channel, sub);
+    }
+    /** Close a channel's core subscription (manager-free leave). */
+    unsubscribeChat(channel) {
+        this.confirmingChatSubs.delete(chatSubject(this.space, "*", channel));
+        const sub = this.chatSubs.get(channel);
+        if (sub) {
+            try {
+                sub.unsubscribe();
+            }
+            catch {
+                /* closing with the connection */
+            }
+            this.chatSubs.delete(channel);
+        }
+        this.chatSubDenied.delete(channel);
+    }
+    /** Confirm a just-opened core subscription was accepted by the broker. A `sub.allow` violation is
+     *  async in NATS, so flush (round-trips the SUB) then settle briefly to let the refusal land — a
+     *  denied subscribe must not read as a successful join (SPEC conformance #13). */
+    async confirmChatSub() {
+        if (!this.nc)
+            throw new Error("connection not established");
+        // flush() is the deterministic boundary: the broker's -ERR for an out-of-ACL SUB arrives BEFORE the
+        // PONG, so once flush resolves the subscribe callback has already recorded any denial. A flush
+        // FAILURE means the connection drained/closed mid-join — we have no confirmation, so let it throw
+        // (joinChannel fails closed) instead of swallowing it and continuing as if confirmed.
+        await this.nc.flush();
+        await new Promise((r) => setTimeout(r, 50));
+    }
     /** The highest join watermark among the joined subscriptions that cover `concreteChannel`
      *  (a wildcard sub like `team.>` covers `team.backend`), or undefined if none — the tail
      *  drops a chat message with `seq <= ` this. */
@@ -709,8 +1690,8 @@ export class CotalEndpoint extends EventEmitter {
         return (await this.jsm.streams.info(chatStream(this.space))).state.last_seq;
     }
     /** Phase 1 of a join — arm each channel's tail-drop watermark at the current frontier. MUST run
-     *  BEFORE the filter flip (consumers.update, or pump on a fresh create) so the tail can never
-     *  carry a just-joined message un-watermarked — which would double-emit it (live + backfill).
+     *  BEFORE opening the core subscription so the live tail can never carry a just-joined message
+     *  un-watermarked — which would double-emit it (live + backfill).
      *  Returns the per-channel frontiers for {@link backfillArmed}. */
     async armJoin(channels) {
         const frontiers = new Map();
@@ -738,73 +1719,122 @@ export class CotalEndpoint extends EventEmitter {
     async joinPolicyFresh(channel) {
         if (!this.channelKv)
             return { replay: effectiveReplay(undefined, undefined) };
+        // A wildcard subscription (`review.>`) has no single registry entry — and `>`/`*` are illegal
+        // KV keys, so a per-channel get would throw. Read only the space defaults for it; concrete
+        // channels still get their per-channel override.
         const [cfg, defaults] = await Promise.all([
-            readChannelConfig(this.channelKv, channel),
+            isConcreteChannel(channel) ? readChannelConfig(this.channelKv, channel) : Promise.resolve(undefined),
             readChannelDefaults(this.channelKv),
         ]);
         return { replay: effectiveReplay(cfg, defaults), windowMs: effectiveReplayWindowMs(cfg, defaults) };
     }
-    /** Read a channel's retained history up to `upToSeq` via JetStream **Direct Get** (a read
-     *  verb — no consumer create, so it rides a read-only grant) and emit each message as a
-     *  `historical` "message" event. `sinceMs` bounds how far back via a native Direct-Get
-     *  `start_time` (now − window); unset ⇒ the full retained window. New messages (`seq > upToSeq`)
-     *  are skipped — the live tail owns them. Pages the batch API; the ack handle is a no-op. */
-    async backfillChannel(channel, upToSeq, sinceMs) {
-        if (!this.jsm)
+    /**
+     * Read retained chat history on ONE channel subject through a name-scoped, single-filter
+     * EPHEMERAL pull consumer — the broker-contained replacement for the removed Direct Get. The
+     * create rides `$JS.API.CONSUMER.CREATE.<CHAT>.<chathist_id>.<subject>`, whose trailing filter
+     * token nats-server pins to the request body (JSConsumerCreateFilterSubjectMismatchErr, code
+     * 10131) — so an agent can only ever replay a channel its `allowSubscribe` grants. Single filter
+     * only (plural isn't ACL-constrainable); `AckPolicy.None` + `mem_storage` so it leaves no durable
+     * state, and it is deleted right after. Returns raw messages in stream order from `start`,
+     * stopping once past `untilSeq` (exclusive of it) or after `limit`. The per-instance name means
+     * calls must be serial — every reader here awaits to completion, so they are.
+     */
+    async collectHistory(subject, start, opts = {}) {
+        // Serialize on the per-instance lock: the fixed `chathist_<id>` name means two concurrent reads
+        // (recall + join-backfill + drop-marker can race in-process) would delete/recreate the consumer
+        // under each other and cross-feed results. The chain makes the "serial callers" assumption true.
+        const run = this.histLock.then(() => this.collectHistoryInner(subject, start, opts));
+        this.histLock = run.catch(() => { }); // keep the chain alive on error
+        return run;
+    }
+    async collectHistoryInner(subject, start, opts = {}) {
+        if (!this.jsm || !this.js)
             throw new Error("endpoint not started");
-        const subject = chatSubject(this.space, "*", channel);
-        const collected = [];
-        // First page starts by time when a window is set (native), else from seq 1; after that we
-        // always page by sequence.
-        const startTime = sinceMs === undefined ? undefined : new Date(Date.now() - sinceMs);
-        let startSeq = 1;
-        let first = true;
-        pages: for (;;) {
-            let last = 0;
-            let got = 0;
-            try {
-                const query = first && startTime !== undefined
-                    ? { start_time: startTime, next_by_subj: subject, batch: 256 }
-                    : { seq: startSeq, next_by_subj: subject, batch: 256 };
-                first = false;
-                const iter = await this.jsm.direct.getBatch(chatStream(this.space), query);
-                for await (const sm of iter) {
+        const stream = chatStream(this.space);
+        const name = chatHistDurable(this.card.id);
+        const out = [];
+        // Clear any consumer leaked by a crashed prior read before re-creating it with THIS read's
+        // single filter (the read ACL is enforced at create — see the doc above).
+        try {
+            await this.jsm.consumers.delete(stream, name);
+        }
+        catch { /* none — fine */ }
+        await this.jsm.consumers.add(stream, {
+            name,
+            filter_subject: subject,
+            ack_policy: AckPolicy.None,
+            mem_storage: true,
+            inactive_threshold: nanos(30_000),
+            ...("time" in start
+                ? { deliver_policy: DeliverPolicy.StartTime, opt_start_time: start.time.toISOString() }
+                : { deliver_policy: DeliverPolicy.StartSequence, opt_start_seq: start.seq }),
+        });
+        try {
+            const consumer = await this.js.consumers.get(stream, name);
+            let pending = (await consumer.info()).num_pending;
+            while (pending > 0) {
+                const want = Math.min(pending, 256);
+                const iter = await consumer.fetch({ max_messages: want, expires: 5_000 });
+                let got = 0;
+                for await (const m of iter) {
                     got++;
-                    if (sm.seq > upToSeq)
-                        break pages; // crossed the frontier — the tail owns the rest
-                    last = sm.seq;
-                    let msg;
-                    try {
-                        msg = sm.json();
-                    }
-                    catch {
-                        continue; // skip undecodable
-                    }
-                    // Same authenticity guard as the tail; skip our own echoes in history.
-                    const parsed = parseSubject(sm.subject);
-                    if (!parsed || msg.from?.id !== parsed.sender || msg.from.id === this.card.id)
+                    if (opts.untilSeq !== undefined && m.seq > opts.untilSeq)
+                        return out; // crossed the frontier
+                    // Belt-and-suspenders over the lock: only keep messages on the requested channel subject
+                    // (the consumer's filter already bounds this; guards against any stale-consumer edge).
+                    if (!subjectMatches(subject, m.subject))
                         continue;
-                    collected.push({ msg, seq: sm.seq });
+                    out.push(m);
+                    if (opts.limit !== undefined && out.length >= opts.limit)
+                        return out;
                 }
+                if (got < want)
+                    break; // drained early
+                pending -= got;
             }
-            catch (e) {
-                // Batch Direct Get raises a 404 ("message not found") when no message matches from
-                // `start` — the normal "no more history" signal (empty channel or last page), not a
-                // fault. Anything else is real.
-                if (e.code === 404)
-                    break;
-                this.emit("error", e);
-                break;
+        }
+        finally {
+            try {
+                await this.jsm.consumers.delete(stream, name);
             }
-            if (got === 0 || last === 0)
-                break; // drained
-            startSeq = last + 1;
+            catch { /* already gone */ }
+        }
+        return out;
+    }
+    /** Read a channel's retained history up to `upToSeq` (the join frontier) and emit each message
+     *  as a `historical` "message" event. `sinceMs` bounds how far back via a native consumer
+     *  `start_time` (now − window); unset ⇒ the full retained window. New messages (`seq > upToSeq`)
+     *  are skipped — the live tail owns them. Reads through the contained {@link collectHistory}. */
+    async backfillChannel(channel, upToSeq, sinceMs) {
+        const subject = chatSubject(this.space, "*", channel);
+        const start = sinceMs === undefined ? { seq: 1 } : { time: new Date(Date.now() - sinceMs) };
+        let msgs;
+        try {
+            msgs = await this.collectHistory(subject, start, { untilSeq: upToSeq });
         }
-        const noop = { ack: () => { }, nak: () => { } };
-        for (const { msg } of collected)
-            // Backfill only ever pages the chat stream, so the authenticated class is always "channel".
+        catch (e) {
+            this.emit("error", e);
+            return 0;
+        }
+        const noop = { ack: () => { }, nak: () => { }, durable: false };
+        let n = 0;
+        for (const sm of msgs) {
+            let msg;
+            try {
+                msg = sm.json();
+            }
+            catch {
+                continue; // skip undecodable
+            }
+            // Same authenticity guard as the tail; skip our own echoes in history.
+            const parsed = parseSubject(sm.subject);
+            if (!parsed || msg.from?.id !== parsed.sender || msg.from.id === this.card.id)
+                continue;
+            // Backfill only ever reads the chat stream, so the authenticated class is always "channel".
             this.emit("message", msg, noop, { historical: true, kind: "channel" });
-        return collected.length;
+            n++;
+        }
+        return n;
     }
     /**
      * Replay-gated pull of a channel's retained ambient from `sinceSeq` (exclusive) forward — the
@@ -815,55 +1845,40 @@ export class CotalEndpoint extends EventEmitter {
      *
      * Honors the **same** per-channel replay gate as join-backfill ({@link joinPolicyFresh}): a
      * `replay=off` channel returns nothing, so `focus` can't become a history bypass for a channel
-     * that denies replay to everyone else (chat is `allow_direct` with no broker-level ACL, so this
-     * app gate is the entire boundary).
+     * that denies replay to everyone else (the read ACL bounds *which* channels recall can touch; this
+     * app gate bounds *whether* a permitted channel replays).
      */
     async recallChannel(channel, sinceSeq) {
         if (!this.jsm)
-            throw new Error("endpoint not started");
+            throw new Error(this.notLiveMsg());
         if (!isConcreteChannel(channel))
             return { messages: [], dropped: false };
         const policy = await this.joinPolicyFresh(channel);
         if (!policy.replay)
             return { messages: [], dropped: false };
         const subject = chatSubject(this.space, "*", channel);
+        let raw;
+        try {
+            raw = await this.collectHistory(subject, { seq: sinceSeq + 1 });
+        }
+        catch (e) {
+            this.emit("error", e);
+            raw = [];
+        }
         const collected = [];
-        let startSeq = sinceSeq + 1;
-        pages: for (;;) {
-            let last = 0;
-            let got = 0;
+        for (const sm of raw) {
+            let msg;
             try {
-                const iter = await this.jsm.direct.getBatch(chatStream(this.space), {
-                    seq: startSeq,
-                    next_by_subj: subject,
-                    batch: 256,
-                });
-                for await (const sm of iter) {
-                    got++;
-                    last = sm.seq;
-                    let msg;
-                    try {
-                        msg = sm.json();
-                    }
-                    catch {
-                        continue; // skip undecodable
-                    }
-                    // Same authenticity guard as the tail/backfill; skip our own echoes.
-                    const parsed = parseSubject(sm.subject);
-                    if (!parsed || msg.from?.id !== parsed.sender || msg.from.id === this.card.id)
-                        continue;
-                    collected.push(msg);
-                }
+                msg = sm.json();
             }
-            catch (e) {
-                if (e.code === 404)
-                    break; // no more history (empty or last page)
-                this.emit("error", e);
-                break;
+            catch {
+                continue; // skip undecodable
             }
-            if (got === 0 || last === 0)
-                break;
-            startSeq = last + 1;
+            // Same authenticity guard as the tail/backfill; skip our own echoes.
+            const parsed = parseSubject(sm.subject);
+            if (!parsed || msg.from?.id !== parsed.sender || msg.from.id === this.card.id)
+                continue;
+            collected.push(msg);
         }
         const dropped = await this.channelDropped(subject, sinceSeq);
         return { messages: collected, dropped };
@@ -895,24 +1910,18 @@ export class CotalEndpoint extends EventEmitter {
         return oldest !== undefined && oldest > sinceSeq + 1;
     }
     /** Sequence of the earliest message still retained on a channel subject (any sender), or
-     *  undefined if nothing is retained. One 1-message Direct Get — used for the recall drop marker. */
+     *  undefined if nothing is retained. One message through the contained {@link collectHistory} —
+     *  used for the recall drop marker. */
     async channelOldestSeq(subject) {
         if (!this.jsm)
             return undefined;
         try {
-            const iter = await this.jsm.direct.getBatch(chatStream(this.space), {
-                seq: 1,
-                next_by_subj: subject,
-                batch: 1,
-            });
-            for await (const sm of iter)
-                return sm.seq;
-            return undefined;
+            const [first] = await this.collectHistory(subject, { seq: 1 }, { limit: 1 });
+            return first?.seq;
         }
         catch (e) {
-            if (e.code !== 404)
-                this.emit("error", e);
-            return undefined; // 404 = nothing retained on this subject (normal)
+            this.emit("error", e);
+            return undefined;
         }
     }
     async publishPresence() {
@@ -922,9 +1931,15 @@ export class CotalEndpoint extends EventEmitter {
             card: this.card,
             status: this.status,
             activity: this.activity,
+            attention: this.attentionMode,
+            channelModes: this.channelModes,
             ts: Date.now(),
         };
-        await this.kv.put(this.card.id, JSON.stringify(p));
+        // Wire contract (SPEC §6): an OFFLINE record must not carry the advisory attention fields. Scrub at
+        // the publisher — this covers stop(), setStatus("offline"), and any future offline publish site, so
+        // the raw KV record is compliant, not only the observer-side roster materialization.
+        const record = this.status === "offline" ? this.toOffline(p) : p;
+        await this.kv.put(this.card.id, JSON.stringify(record));
     }
     async startPresenceWatch() {
         if (!this.kv)
@@ -989,7 +2004,9 @@ export class CotalEndpoint extends EventEmitter {
     applyPresence(id, raw) {
         const prev = this.roster.get(id);
         const stale = Date.now() - raw.ts > this.ttlMs;
-        const p = stale && raw.status !== "offline" ? { ...raw, status: "offline" } : raw;
+        // Any offline materialization (a stale snapshot OR a graceful-leave record) drops the advisory
+        // attention fields — an offline peer must not carry a stale `[focus]`/`locally muted` hint.
+        const p = stale || raw.status === "offline" ? this.toOffline(raw) : raw;
         // First time we hear about an already-offline peer (stale snapshot): record quietly.
         if (!prev && p.status === "offline") {
             this.roster.set(id, p);
@@ -1002,7 +2019,9 @@ export class CotalEndpoint extends EventEmitter {
             prev.status !== "offline" &&
             p.status !== "offline" &&
             prev.status === p.status &&
-            prev.activity === p.activity) {
+            prev.activity === p.activity &&
+            prev.attention === p.attention &&
+            sameChannelModes(prev.channelModes, p.channelModes)) {
             this.roster.set(id, p);
             return;
         }
@@ -1015,12 +2034,18 @@ export class CotalEndpoint extends EventEmitter {
         this.emit("presence", { type, presence: p });
         this.emit("roster", this.getRoster());
     }
+    /** Materialize an OFFLINE presence record: drop the advisory attention fields. An offline peer must
+     *  not show a stale `[focus]` or "locally muted #x" hint — SPEC: attention removed on offline sweep,
+     *  channel modes reset on restart. card/activity/ts are kept. */
+    toOffline(p) {
+        return { ...p, status: "offline", attention: undefined, channelModes: undefined };
+    }
     /** Mark a known peer offline (on KV delete/purge), keeping it in the roster. */
     markOffline(id) {
         const prev = this.roster.get(id);
         if (!prev || prev.status === "offline")
             return;
-        const offline = { ...prev, status: "offline" };
+        const offline = this.toOffline(prev);
         this.roster.set(id, offline);
         this.emit("presence", { type: "offline", presence: offline });
         this.emit("roster", this.getRoster());
@@ -1028,10 +2053,11 @@ export class CotalEndpoint extends EventEmitter {
     sweep() {
         const now = Date.now();
         let changed = false;
-        for (const [, p] of this.roster) {
+        for (const [id, p] of this.roster) {
             if (p.status !== "offline" && now - p.ts > this.ttlMs) {
-                p.status = "offline";
-                this.emit("presence", { type: "offline", presence: p });
+                const offline = this.toOffline(p);
+                this.roster.set(id, offline);
+                this.emit("presence", { type: "offline", presence: offline });
                 changed = true;
             }
         }
@@ -1039,13 +2065,6 @@ export class CotalEndpoint extends EventEmitter {
             this.emit("roster", this.getRoster());
     }
 }
-/** The id token of a chat-stream durable, or null if it isn't one — the inverse of
- *  `chatDurable` (`chat_<token(id)>`). token() is lossy, so this returns the token, not the
- *  original id; callers match it forward against `token(card.id)`. */
-function chatDurableToken(durable) {
-    const prefix = "chat_";
-    return durable.startsWith(prefix) ? durable.slice(prefix.length) : null;
-}
 /** Map an authenticated parsed-subject kind to the message class surfaced to "message" listeners.
  *  Throws on `ctl` (control-plane is request/reply, never a "message") — per repo convention, no
  *  silent default: an unexpected delivering kind is a bug, not something to swallow. */
@@ -1061,12 +2080,14 @@ function kindFromParsed(kind) {
             throw new Error(`cannot derive a message kind from subject kind "${kind}"`);
     }
 }
-/** Set equality over two subject lists (order/duplicate-insensitive). */
-function sameSet(a, b) {
-    if (a.length !== b.length)
+/** Shallow-equal two per-channel-mode maps (presence dedup): a change must re-emit, so an attention
+ *  toggle isn't swallowed as a quiet heartbeat. Absent and empty compare equal. */
+function sameChannelModes(a, b) {
+    const ak = a ? Object.keys(a) : [];
+    const bk = b ? Object.keys(b) : [];
+    if (ak.length !== bk.length)
         return false;
-    const s = new Set(a);
-    return b.every((x) => s.has(x));
+    return ak.every((k) => a[k] === b?.[k]);
 }
 function authOpts(a) {
     const tls = a.tls ? {} : undefined;
@@ -1088,6 +2109,19 @@ function describeStatusError(err) {
     }
     return err;
 }
+/** True when a failure is a NATS *permission denial* — the subject is forbidden to this
+ *  endpoint's creds — rather than a missing responder or a timeout. The two need opposite
+ *  fixes (grant the capability vs. start/await the service), so callers (e.g. a control
+ *  request that can't reach the manager) must tell them apart instead of defaulting to
+ *  "service down". Unwraps a wrapped `cause` and falls back to the server's error text, since
+ *  a denied publish can surface either as the typed error or inside a request rejection. */
+export function isPermissionDenied(e) {
+    if (e instanceof PermissionViolationError)
+        return true;
+    if (e?.cause instanceof PermissionViolationError)
+        return true;
+    return /permissions?\s+violation/i.test(String(e?.message ?? ""));
+}
 /** Whether a NATS server is *running* at `servers`. True on a successful connect AND on an
  *  auth rejection — an auth error means a server is there, just refusing these creds (so the
  *  caller should surface the real auth failure, not a misleading "server down", and `up`