@cotal-ai/manager 0.100.1 → 0.101.0

package/dist/manager.js

@@ -4,7 +4,7 @@ import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
 import Headless from "@xterm/headless";
-import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, MANAGER_LEASE_TTL_MS, awaitLeaseExpiry, leaseRemainingMs, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, identityFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, digestIdToken, } from "@cotal-ai/core";
+import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, MANAGER_LEASE_TTL_MS, awaitLeaseExpiry, leaseRemainingMs, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, addDeprovisionAccounting, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, identityFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, oneLine, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, digestIdToken, } from "@cotal-ai/core";
 import { loadLaunchPersonaFile, PersonaSourceError } from "@cotal-ai/workspace";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimIdentityRecord, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, probeLiveness, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceKey, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, exitProof, isCustodialRuntime, pollProvedExit, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, watchProvedExit, } from "./runtime/index.js";
@@ -16,6 +16,7 @@ import { launchSpecForRun, materializePersona, launchAgentToStartOpts, parseLaun
 import { authorizeLaunch, authorizeNamedControl } from "./authorize.js";
 import { controlShutdown } from "./control-shutdown.js";
 import { RunHosting } from "./run-hosting.js";
+import { enrolledAcl } from "./remote-authority.js";
 import { controlSession } from "./control-session.js";
 import { MAX_AGENTS, parseResumeCommitArgs, parseResumeControlArgs, parseResumeFinalizeArgs, readSeatRecord, removeSeatRecord, writeSeatRecord } from "./resume.js";
 import { TranscriptReceiver } from "./transcript-receive.js";
@@ -140,7 +141,7 @@ const NO_OWNER_MATCHES = "-no-owner-";
  *  getter or `toString` throws. A handler that throws while building its text skips the work after
  *  it, and on a detached chain ends the manager with an unhandled rejection, so the coercion to text
  *  runs inside the guard. */
-function rejectionText(e) {
+export function rejectionText(e) {
     try {
         return String(e?.message ?? e);
     }
@@ -260,13 +261,13 @@ function parseTurnNote(raw) {
         return undefined;
     const n = o;
     if (typeof n.payload !== "string" || typeof n.deadlineAt !== "number"
-        || typeof n.holdEpoch !== "number" || typeof n.owner !== "string")
+        || typeof n.holdEpoch !== "number")
         return undefined;
     if (n.holdToken !== undefined && typeof n.holdToken !== "string")
         return undefined;
     if (n.handoffFrom !== undefined && typeof n.handoffFrom !== "string")
         return undefined;
-    return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, owner: n.owner, ...(typeof n.holdToken === "string" ? { holdToken: n.holdToken } : {}), ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
+    return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, ...(typeof n.holdToken === "string" ? { holdToken: n.holdToken } : {}), ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
 }
 /** A goal's key in the manager's maps: the caller triple and goal id the goal plane stores the
  *  goal under, because a goal id is the caller's own (SPEC 13.6 item 1) and two callers may pick
@@ -550,7 +551,6 @@ export class Manager {
     staticReconcileItems = new Map();
     staticReconcileLastSweep;
     staticReconcileLastSweepResources;
-    lastDeprovisionResources;
     staticReconcileSweepsInFlight = 0;
     staticReconcileDrainWaiters = [];
     staticReconcileStopping = false;
@@ -2482,7 +2482,7 @@ export class Manager {
                 await this.ep.releaseManagerLease(this.managerInstanceId, own.revision);
         }
         catch {
-            // Best-effort, like the release it wraps: a broker failure here is recovered by the bucket TTL.
+            // Best-effort: a release that did not commit is reported by the re-read below.
         }
         try {
             const stillOurs = await this.ep.readOwnManagerLease(this.managerInstanceId);
@@ -2534,7 +2534,7 @@ export class Manager {
         catch (e) {
             console.error(`! could not deregister manager instance ${iid}: ${rejectionText(e)}\n` +
                 `  Its registration now outlives this process and will be frozen into every class scatter in space "${this.space}", each paying the full deadline.\n` +
-                `  NEXT: remove it with \`cotal deregister-instance --instance ${iid}\` once this process is gone.`);
+                `  NEXT: once this process is gone, start this manager again and stop it cleanly; on a static space \`cotal endpoint deregister manager ${iid} --yes\` from the space's own root also removes it.`);
         }
     }
     /** Stop the v0.4 service-endpoint serve loop (drain subscriptions, await in-flight handlers)
@@ -3172,7 +3172,7 @@ export class Manager {
             // follows owner-domain reach on a user mesh. Resolve the caller's admin tier once for
             // the residual cross-owner case; opStart decides before connector resolution or grant
             // mutation. Static meshes resolve true and nothing changes.
-            spawn: (ctx) => this.serveGated(ctx, async () => this.serveSpawnGoal(ctx, async (h) => this.opStart(args(ctx), callerOf(ctx), await this.epAdminReach(ctx.subject.caller), h, ctx.subject.route, ctx.subject.caller))),
+            spawn: (ctx) => this.loggedSpawnRefusal(ctx, () => this.serveGated(ctx, async () => this.serveSpawnGoal(ctx, async (h) => this.opStart(args(ctx), callerOf(ctx), await this.epAdminReach(ctx.subject.caller), h, ctx.subject.route, ctx.subject.caller)))),
             despawn: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
                 const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
@@ -3265,7 +3265,7 @@ export class Manager {
                     return this.runHost().amend(input, this.runAnswerer(ctx), (accepted) => this.authorizeRunAmend(ctx, accepted), ctx);
                 return this.runHost().answer(input, this.runAnswerer(ctx), (open) => this.authorizeRunAnswer(ctx, input, open), ctx);
             }),
-            runStatus: (ctx) => this.serveGated(ctx, () => this.runHost().status(args(ctx))),
+            runStatus: (ctx) => this.serveGated(ctx, () => this.runHost().status(args(ctx), ctx)),
             runPs: (ctx) => this.serveGated(ctx, () => this.runHost().list(args(ctx), ctx)),
             preparePreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("preparePreservation", args(ctx)))),
             commitPreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("commitPreservation", args(ctx)))),
@@ -3726,7 +3726,14 @@ export class Manager {
             for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files])
                 await this.shredUserSecrets(unshredded, family);
             const leftover = unshredded.length ? `; cleanup failed: ${unshredded.join("; ")}` : "";
-            return { error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}` };
+            // A host that refused the enrollment enrolled nothing, so once every staged secret is gone
+            // this attempt left nothing behind. A failure after the host answered, or a host that did not
+            // answer, may have left a grant there.
+            const refusal = material === undefined && !unshredded.length ? caughtEnvelope(e) : undefined;
+            return {
+                error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}`,
+                ...(refusal?.outcome === "not-executed" ? { refused: refusal.code } : {}),
+            };
         }
     }
     /** Shred a user agent's secret family from the store and from disk. Every removal is attempted,
@@ -4233,7 +4240,8 @@ export class Manager {
      *  is NOT freed while any teardown phase is still in flight — the hold clears only after the
      *  standing-authority revoke AND the lifecycle retirement both confirm (see {@link driveRetirement}) —
      *  but the deletes here are still lifecycle-uid-pinned so even a replayed/stale teardown can never
-     *  reach a same-name successor's footprint (its names embed a different uid). */
+     *  reach a same-name successor's footprint (its names embed a different uid). Each call reports its
+     *  own accounting: the return value, or the {@link DeprovisionError} it throws once the deletes ran. */
     async deprovisionBroker(a) {
         // LIFECYCLE-PINNED (SPEC 13.1): both the credential's exact-name grants and the delete names
         // carry a.lifecycleUid, so a stale/replayed teardown for this retired incarnation is broker-denied
@@ -4255,26 +4263,16 @@ export class Manager {
         // Bound the detached broker teardown so a wedged broker can't leave the deprovision promise pending
         // forever with no log — the timeout rejects into freeSlot's fail-loud `.catch` (paired with the
         // helper's own fail-fast connect). The durables/ACL row still fall to space teardown as a backstop.
-        let accounting;
-        try {
-            accounting = await withTimeout(deprovisionAgent({
-                servers: this.servers ?? DEFAULT_SERVER,
-                space: this.space,
-                targetId: a.id,
-                lifecycleUid: a.lifecycleUid,
-                memberChannels: [...memberChannels],
-                creds,
-            }), DEPROVISION_TIMEOUT_MS, `deprovision ${a.name} (${a.id}): broker teardown timed out`);
-            this.lastDeprovisionResources = accounting;
-        }
-        catch (e) {
-            if (e instanceof DeprovisionError) {
-                this.lastDeprovisionResources = e.accounting;
-            }
-            throw e;
-        }
+        const accounting = await withTimeout(deprovisionAgent({
+            servers: this.servers ?? DEFAULT_SERVER,
+            space: this.space,
+            targetId: a.id,
+            lifecycleUid: a.lifecycleUid,
+            memberChannels: [...memberChannels],
+            creds,
+        }), DEPROVISION_TIMEOUT_MS, `deprovision ${a.name} (${a.id}): broker teardown timed out`);
         if (!inventory.complete)
-            throw new Error(`membership inventory incomplete (${inventory.reason}); rows on channels outside its launch policy stay RETAINED for uid ${a.lifecycleUid}`);
+            throw new DeprovisionError(`membership inventory incomplete (${inventory.reason}); rows on channels outside its launch policy stay RETAINED for uid ${a.lifecycleUid}`, accounting);
         return accounting;
     }
     /** The retiring lifecycle's durable membership channels, read from the delivery daemon's
@@ -5175,7 +5173,7 @@ export class Manager {
         else {
             configPath = agentFilePath(this.workspaceRoot, ref);
             if (!existsSync(configPath))
-                return { error: `no persona "${ref}" - ${configPath} not found; create it or pass --config (see \`cotal personas list\`)` };
+                return { error: `no persona "${ref}" in the catalog of manager ${this.managerInstanceId} on host ${hostname()}: ${configPath} not found; create it there` };
         }
         // Load the persona ONCE, here, ahead of the connector choice. The file's `agent:` pin feeds the
         // harness resolution below; the spawn path's identity/ACL profile block consumes the SAME def (no
@@ -5656,8 +5654,11 @@ export class Manager {
                         }
                         : undefined,
                 });
-                if ("error" in prep)
+                if ("error" in prep) {
+                    if (prep.refused !== undefined)
+                        hooks?.onUndone?.(prep.refused);
                     return { ok: false, error: prep.error };
+                }
                 // THE HOST'S UID WINS (#1972). On the local arm this is the value passed in, unchanged. On
                 // the hosted enrollment arm the host selected it, and from here every lifecycle-keyed thing
                 // this spawn records — the slot, the launch, the managed row, the teardown credential — must
@@ -5786,7 +5787,7 @@ export class Manager {
                 if (this.delegatedLaunched.has(lifecycleUid))
                     throw new Error(`lifecycle ${lifecycleUid} was already handed to runtime "${this.requiredRuntime.kind}"; a lifecycle is handed off at most once`);
                 this.delegatedLaunched.add(lifecycleUid);
-                handle = this.requiredRuntime.spawnDelegated({ agent, persona: readFileSync(configPath, "utf8"), role, model, variant, prompt, launchOptions: launchOptions, events }, handoff);
+                handle = this.requiredRuntime.spawnDelegated({ agent, persona: readFileSync(configPath, "utf8"), managerInstanceId: this.managerInstanceId, role, model, variant, prompt, launchOptions: launchOptions, events }, handoff);
             }
             else {
                 if (carried) {
@@ -5984,7 +5985,9 @@ export class Manager {
             // canonicalJson (undefined never coerces to null, SPEC 13.6), so a role-less spawn would
             // otherwise fail its succeeded terminal. The CLI/connector already render an absent role as
             // "no role", so dropping the key preserves the reply (surfaced by readiness:live).
-            const okData = { name, agent, id: managed.id, mode: handle.kind, lifecycleUid, ...(role !== undefined ? { role } : {}), ...(opts.eventsNotice !== undefined ? { eventsNotice: opts.eventsNotice } : {}) };
+            // A host that granted other channels than this spawn asked for: the receipt carries both.
+            const acl = enrolled ? enrolledAcl({ allowSubscribe, allowPublish }, enrolled.material) : undefined;
+            const okData = { name, agent, id: managed.id, mode: handle.kind, lifecycleUid, ...(role !== undefined ? { role } : {}), ...(opts.eventsNotice !== undefined ? { eventsNotice: opts.eventsNotice } : {}), ...(acl ? { acl } : {}) };
             await hooks?.onOutcome?.({ kind: "succeeded", data: okData });
             return { ok: true, data: okData };
         }
@@ -6822,7 +6825,7 @@ export class Manager {
             const uncertain = () => finish({
                 ok: false,
                 uncertain: true,
-                detail: `${a.name} (${a.id}): launch status uncertain - no process exit and no mesh presence within ${Math.round(readinessTimeoutMs / 1000)}s; it may still be booting or stuck before connector startup. Inspect with \`cotal attach ${a.name}\` / \`cotal ps\`; do not stop it solely because this bounded wait elapsed.`,
+                detail: `${a.name} (${a.id}): launch status uncertain - no process exit and no mesh presence within ${readinessTimeoutMs}ms; it may still be booting or stuck before connector startup. Inspect with \`cotal attach ${a.name}\` / \`cotal ps\`; do not stop it solely because this bounded wait elapsed.`,
             });
             // The exit poll read the runtime up to a poll ago, and a window can be shorter than a poll, so
             // the window closes on a fresh read: a child that exited by then is reported as exited. Nothing
@@ -8194,6 +8197,18 @@ export class Manager {
         if (observed.processEpoch !== epoch)
             throw new EpEnvelopeError("expired", `the manager's issuance gate epoch is ${observed.processEpoch} but this goal was accepted under epoch ${epoch}; a superseded incarnation never commits a goal terminal (SPEC 13.6)`);
     }
+    /** A spawn's refusal reaches only its caller's terminal, so the manager also writes one line for it
+     *  to its own log, naming the request ID the caller printed, the persona and the reason. */
+    async loggedSpawnRefusal(ctx, serve) {
+        try {
+            return await serve();
+        }
+        catch (e) {
+            const persona = ctx.request.args?.name;
+            console.error(oneLine(`! spawn request ${ctx.request.id} for persona "${String(persona ?? "")}" refused (${e instanceof EpEnvelopeError ? e.code : "error"}): ${rejectionText(e)}`));
+            throw e;
+        }
+    }
     /** Serve `spawn`/`launch` as an ACTION. Authz already ran in {@link serveGated}. The
      *  accept path runs INLINE on the handler ({@link startAgent} with hooks): the goal binds + the
      *  acceptance replies the moment the identity is minted, BEFORE any provision, or on the
@@ -8261,6 +8276,8 @@ export class Manager {
         let ownsGoal = false;
         // Set by onEffect. A refusal that arrives with it still false changed nothing.
         let effectStarted = false;
+        // Set by onUndone: the host's code for a later refusal that left nothing behind.
+        let undone;
         // The terminal commits OFF-handler on the goal-writer connection (manager-only authority; a
         // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): (a) reads THIS
         // incarnation's OWN gate epoch and REFUSES a superseded commit (the currency belt), and (b)
@@ -8381,14 +8398,16 @@ export class Manager {
             // `failed` that would race that `cancel` (first-terminal-fact-wins).
             onTerminalDeferred: () => { terminalEntered = true; },
             onEffect: () => { effectStarted = true; },
+            onUndone: (code) => { undone = code; },
         });
         bg.then((reply) => {
             // Refused BEFORE onAccepted (hard-pin collision, capacity, persona-not-found) — no goal bound.
-            // Only a refusal before the first effect states `not-executed`; a later one, such as the
-            // alias gate that re-drives a teardown, leaves the outcome unknown.
+            // Only a refusal before the first effect, or one whose effects were all removed, states
+            // `not-executed`; a later one, such as the alias gate that re-drives a teardown, leaves the
+            // outcome unknown.
             if (acceptance === undefined) {
                 const details = reply.details;
-                rejectAccept(new EpEnvelopeError("failed-precondition", reply.error ?? "spawn refused at accept", details, effectStarted ? undefined : "not-executed"));
+                rejectAccept(new EpEnvelopeError(undone ?? "failed-precondition", reply.error ?? "spawn refused at accept", details, effectStarted && undone === undefined ? undefined : "not-executed"));
                 return;
             }
             // H1: `run` CATCHES its own body (a throw in buildLaunch/runtime.spawn) and RESOLVES `{ok:false}`
@@ -8506,7 +8525,7 @@ export class Manager {
         const deadlineMs = deadlineAt - acceptedAt;
         const handoffFrom = raw.handoffFrom === undefined ? undefined : String(raw.handoffFrom);
         const holdToken = turnHoldToken(key);
-        const note = JSON.stringify({ payload, deadlineAt, holdEpoch: executor.epoch, owner: t.owner, holdToken, ...(handoffFrom !== undefined ? { handoffFrom } : {}) });
+        const note = JSON.stringify({ payload, deadlineAt, holdEpoch: executor.epoch, holdToken, ...(handoffFrom !== undefined ? { handoffFrom } : {}) });
         // A goal that already ENDED is never accepted again, whatever the retry carries: the bind is
         // create-only and outlives an unwind (the failed terminal, the cleared index), so a retry of an
         // unwound accept would otherwise re-record an index entry over a tombstone and, before that
@@ -8518,7 +8537,7 @@ export class Manager {
             throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" already ended ${ended.state}; a bound goal is never accepted again (SPEC 13.6)`);
         // Index-CAS-before-bind, exactly as spawn: the entry (floor + note) is the durable relay
         // record a successor rebuilds from, so it must exist before the acceptance is servable.
-        const idx = await recordGoalIndex(gw.ctx, ref, executor.lifecycleUid, { name: a.name, actor: t.actor, uid: t.lifecycleUid, readinessDeadlineMs: deadlineMs }, note);
+        const idx = await recordGoalIndex(gw.ctx, ref, executor.lifecycleUid, { name: a.name, owner: t.owner, actor: t.actor, uid: t.lifecycleUid, readinessDeadlineMs: deadlineMs }, note);
         if (!idx.recorded && idx.existing.iid !== executor.lifecycleUid)
             throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted by instance "${idx.existing.iid}"; that instance owns its relay and this attempt provisions nothing (SPEC 13.6)`);
         const b = await bindGoal(gw.ctx, ref, fingerprint);
@@ -8917,8 +8936,8 @@ export class Manager {
      *  entry carrying a parseable note rebuilds its pending relay — never an `uncertain` settle,
      *  because the deadline hold IS this goal's bounded ending and it survived the restart. No
      *  liveness verdict is made here (the agents map is empty during reconcile, so absence means
-     *  "not yet re-registered", never "dead"); a garbled note or a missing floor is logged and
-     *  left, the dead-pointer honesty rule. */
+     *  "not yet re-registered", never "dead"); a garbled note or a floor that does not name the
+     *  seat's owner is logged and left, the dead-pointer honesty rule. */
     async adoptTurnGoal(entry) {
         const gw = this.goalWriter;
         if (!gw)
@@ -8935,8 +8954,8 @@ export class Manager {
             return;
         }
         const parsed = entry.note !== undefined ? parseTurnNote(entry.note) : undefined;
-        if (entry.allocated === undefined || parsed === undefined) {
-            console.error(`turn reconcile ${entry.ref.goalId}: the relay record is garbled (no floor, or an unparseable note); left unsettled`);
+        if (entry.allocated?.owner === undefined || parsed === undefined) {
+            console.error(`turn reconcile ${entry.ref.goalId}: the relay record is garbled (no floor naming the seat's owner, or an unparseable note); left unsettled`);
             return;
         }
         const spec = await readGoalSpec(gw.ctx, entry.ref);
@@ -8951,7 +8970,7 @@ export class Manager {
         }
         const p = {
             ref: entry.ref, goalId: entry.ref.goalId,
-            seat: { name: entry.allocated.name, owner: parsed.owner, actor: entry.allocated.actor, uid: entry.allocated.uid },
+            seat: { name: entry.allocated.name, owner: entry.allocated.owner, actor: entry.allocated.actor, uid: entry.allocated.uid },
             payload: parsed.payload,
             acceptedAt: spec.value.acceptedAt,
             deadlineAt: parsed.deadlineAt,
@@ -9307,8 +9326,9 @@ export class Manager {
      *  wire principal joins {@link retiredPrincipals} (the F5 refusal index) and the name hold
      *  clears (ABA-guarded by uid). A PRE-UNIT-B lifecycle (no slot row — spawned before the
      *  durable registry existed) has nothing to terminalize: its footprint teardown runs directly
-     *  and the hold clears, the honest upgrade path. */
-    async driveStaticRetirement(a, surfaceFailure = false) {
+     *  and the hold clears, the honest upgrade path. `onDeprovision` receives the accounting of the
+     *  broker teardown this call ran, on success or on a {@link DeprovisionError}. */
+    async driveStaticRetirement(a, surfaceFailure = false, onDeprovision) {
         // A renewal that published its flight before the synchronous terminal latch is accepted work.
         // Drain it before the durable terminal enumerates credential ids and before cleanup deletes its
         // material; a failed renewal must not block retirement because it may still have staged an id.
@@ -9340,7 +9360,17 @@ export class Manager {
                 await attemptCleanup(failed, `secret ${creds}`, () => secrets.delete(agentSecretKeyForFile(creds, this.space)));
                 await attemptCleanup(failed, `file ${creds}`, () => rmSync(creds, { force: true }));
             }
-            await attemptCleanup(failed, "broker teardown", () => this.deprovisionBroker(a));
+            await attemptCleanup(failed, "broker teardown", async () => {
+                try {
+                    const accounting = await this.deprovisionBroker(a);
+                    onDeprovision?.(accounting);
+                }
+                catch (e) {
+                    if (e instanceof DeprovisionError)
+                        onDeprovision?.(e.accounting);
+                    throw e;
+                }
+            });
             if (failed.length)
                 throw new Error(`cleanup failed: ${failed.join("; ")}`);
         };
@@ -9799,12 +9829,12 @@ export class Manager {
         if (item.flight)
             return item.flight;
         if (item.timer)
-            return Promise.resolve(false);
+            return Promise.resolve({ succeeded: false });
         // A timer/retry driver increments before its mandatory durable re-read, then calls with
         // countAttempt=false. Let that already-consumed budget entry enter the terminal. Only a fresh
         // sweep entry (countAttempt=true) is refused once the per-process budget is exhausted.
         if (countAttempt && item.attempts >= item.maxAttempts)
-            return Promise.resolve(false);
+            return Promise.resolve({ succeeded: false });
         const flight = (async () => {
             if (countAttempt)
                 item.attempts++;
@@ -9813,8 +9843,9 @@ export class Manager {
             item.nextRetryAt = undefined;
             this.reconcilingAliases.add(row.alias);
             console.error(`static reconcile terminal alias=${row.alias} phase=${row.phase} uid=${row.lifecycleUid} attempt=${item.attempts}/${item.maxAttempts}`);
+            let deprovision;
             try {
-                await this.driveStaticRetirement({ id: row.actor, name: row.alias, lifecycleUid: row.lifecycleUid, runtime: row.runtime }, true);
+                await this.driveStaticRetirement({ id: row.actor, name: row.alias, lifecycleUid: row.lifecycleUid, runtime: row.runtime }, true, (accounting) => { deprovision = accounting; });
                 if (item.attempts === 1) {
                     this.staticReconcileItems.delete(key);
                 }
@@ -9825,7 +9856,7 @@ export class Manager {
                     item.lastError = undefined;
                     console.error(`✓ static reconcile recovered alias=${item.alias} phase=retired uid=${item.lifecycleUid} attempts=${item.attempts}/${item.maxAttempts}`);
                 }
-                return true;
+                return { succeeded: true, deprovision };
             }
             catch (error) {
                 item.lastError = rejectionText(error);
@@ -9856,7 +9887,7 @@ export class Manager {
                     else
                         this.scheduleStaticReconcileRetry(key, item);
                 }
-                return false;
+                return { succeeded: false, deprovision };
             }
             finally {
                 this.reconcilingAliases.delete(row.alias);
@@ -10058,34 +10089,10 @@ export class Manager {
                         };
                         this.staticReconcileItems.set(key, item);
                     }
-                    this.lastDeprovisionResources = undefined;
-                    const succeeded = await this.attemptStaticReconcile(key, item, row);
-                    const acc = this.lastDeprovisionResources;
-                    if (acc) {
-                        sweepDeprovision.examined += acc.examined;
-                        sweepDeprovision.deleted = sweepDeprovision.deleted === null || acc.deleted === null ? null : sweepDeprovision.deleted + acc.deleted;
-                        sweepDeprovision.absent += acc.absent;
-                        sweepDeprovision.refused += acc.refused;
-                        sweepDeprovision.acknowledged += acc.acknowledged;
-                        sweepDeprovision.disappeared += acc.disappeared;
-                        sweepDeprovision.consumers.examined += acc.consumers.examined;
-                        sweepDeprovision.consumers.deleted = sweepDeprovision.consumers.deleted === null || acc.consumers.deleted === null ? null : sweepDeprovision.consumers.deleted + acc.consumers.deleted;
-                        sweepDeprovision.consumers.absent += acc.consumers.absent;
-                        sweepDeprovision.consumers.refused += acc.consumers.refused;
-                        sweepDeprovision.consumers.acknowledged += acc.consumers.acknowledged;
-                        sweepDeprovision.consumers.disappeared += acc.consumers.disappeared;
-                        sweepDeprovision.acls.examined += acc.acls.examined;
-                        sweepDeprovision.acls.deleted += acc.acls.deleted;
-                        sweepDeprovision.acls.absent += acc.acls.absent;
-                        sweepDeprovision.acls.refused += acc.acls.refused;
-                        sweepDeprovision.acls.disappeared += acc.acls.disappeared;
-                        sweepDeprovision.members.examined += acc.members.examined;
-                        sweepDeprovision.members.deleted += acc.members.deleted;
-                        sweepDeprovision.members.absent += acc.members.absent;
-                        sweepDeprovision.members.refused += acc.members.refused;
-                        sweepDeprovision.members.disappeared += acc.members.disappeared;
-                    }
-                    if (succeeded)
+                    const attempt = await this.attemptStaticReconcile(key, item, row);
+                    if (attempt.deprovision)
+                        addDeprovisionAccounting(sweepDeprovision, attempt.deprovision);
+                    if (attempt.succeeded)
                         sweep.succeeded++;
                     else
                         sweep.failed++;
@@ -10217,9 +10224,9 @@ export class Manager {
      *  arrive as explicit arguments or as a leading frontmatter block inside `persona`. A prompt
      *  that starts with `---` is parsed and merged (explicit args win) so the written file has one
      *  frontmatter block; a malformed block is refused by name rather than wrapped. A fresh name is
-     *  created with owner = caller. Redefining an EXISTING file is allowed on the privileged tier
-     *  only if `file.owner == caller`, else admin is required. Fail-closed: an ownerless file
-     *  (legacy / operator-written) is admin-only. */
+     *  created with the owner {@link personaOwner} records. Redefining an EXISTING file is allowed on
+     *  the privileged tier only if `file.owner == caller`, else admin is required. Fail-closed: an
+     *  ownerless file (legacy / operator-written) is admin-only. */
     opDefinePersona(args, caller, admin) {
         if (this.execution === "none")
             throw new EpEnvelopeError("unimplemented", this.executionRefusal());
@@ -10256,7 +10263,7 @@ export class Manager {
         try {
             def = composeWirePersona({
                 name,
-                owner: caller,
+                owner: this.personaOwner(caller),
                 prompt: persona,
                 model,
                 role: args.role !== undefined && args.role !== null && String(args.role) !== "" ? String(args.role) : undefined,
@@ -10277,6 +10284,19 @@ export class Manager {
         }
         return { ok: true, data: { name, path } };
     }
+    /** The owner a fresh wire-defined persona records. A user-auth caller's principal is stable, and
+     *  so is one of this manager's own seats for its life. Any other static caller, such as the CLI's
+     *  operator instrument minted for one call, would leave an owner no later call matches, so it
+     *  records none and the file is operator-owned, as a local `persona create` writes it. A peer
+     *  joined with its own credential is such a caller too. */
+    personaOwner(caller) {
+        if (this.userMode)
+            return caller;
+        for (const a of this.agents.values())
+            if (this.managedPrincipal(a) === caller)
+                return caller;
+        return undefined;
+    }
     /** Whether this caller may READ a catalog card's details (role/model/description/body). Same
      *  ownership rule as redefine: owner == caller, or admin. Ownerless / operator-written files are
      *  admin-only. Names of parseable files still appear on the list so a definer can see a taken