@cotal-ai/manager 0.133.13 → 0.135.0

package/dist/manager.js

@@ -5,7 +5,7 @@ import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, s
 import { isAbsolute, join, dirname, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
 import Headless from "@xterm/headless";
-import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, MANAGER_LEASE_TTL_MS, awaitLeaseExpiry, leaseRemainingMs, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, fenceLifecycleAcl, DeprovisionError, addDeprovisionAccounting, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, identityFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, bindIssuedStores, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, oneLine, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, digestIdToken, } from "@cotal-ai/core";
+import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, MANAGER_LEASE_TTL_MS, awaitLeaseExpiry, leaseRemainingMs, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, fenceLifecycleAcl, DeprovisionError, addDeprovisionAccounting, isConcreteChannel, isChannelFamily, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, identityFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, bindIssuedStores, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, oneLine, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, digestIdToken, renderOnceTask, } from "@cotal-ai/core";
 import { loadLaunchPersonaFile, PersonaSourceError } from "@cotal-ai/workspace";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimIdentityRecord, claimManagerSiblingIdentities, connectorInstallHint, DEFAULT_SEAT_CAP, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, probeLiveness, remintDaemonCreds, resolveAgentType, resolveOnPath, runtimeInstallHint, createManagerInstanceIdentity, SEAT_CAP_UNLIMITED, spaceKey, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, exitProof, isCustodialRuntime, pollProvedExit, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, watchProvedExit, } from "./runtime/index.js";
@@ -34,7 +34,7 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 // The manager as an ordinary v0.4 `service` endpoint — the §13.1
 // endpoint-serve credential subsystem (gate provisioning, registration barrier, mint fence) plus
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
-import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, requestGoalCancel, goalAlreadyTerminal, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, turnNoticeSubject, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, seatCapRefused, lifecycleBlockedFrom, renderLifecycleBlocked, controlReplyFromThrown, } from "@cotal-ai/core";
+import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, requestGoalCancel, goalAlreadyTerminal, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, MAX_SCHEDULE_MS, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, turnNoticeSubject, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, seatCapRefused, lifecycleBlockedFrom, renderLifecycleBlocked, controlReplyFromThrown, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
 import { measureManagerVitals } from "./vitals.js";
 import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, walkStaticSlots, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
@@ -53,6 +53,14 @@ const TURN_SWEEP_MS = 5_000;
  *  The window a lost reply is retried in is seconds; five minutes is generous for that and short
  *  enough that the map drains between bursts rather than growing for the process lifetime. */
 const TURN_ANSWER_RETENTION_MS = 5 * 60_000;
+/** A `once` spawn's task deadline when the caller names none: one hour from the spawn's accept. */
+const ONCE_DEFAULT_DEADLINE_MS = 60 * 60_000;
+/** The bound on one {@link Connector.retireAfterExit} call. An expired bound is not proof: the debt
+ *  stays and the turn sweep asks again. */
+const ONCE_RETIRE_MS = 60_000;
+/** The goal index's bound on a relay note (core `GOAL_INDEX_NOTE_MAX`). A once task's note must
+ *  fit it, and is refused at admission when it cannot. */
+const TURN_NOTE_MAX = 65536;
 /** Backstop for the detached-launch readiness race (#159 B1). `startAgent` waits on two REAL outcomes —
  *  the assigned id joining the mesh (presence) = started, the child process exiting = failed — NOT a
  *  liveness-inferring timer. This is only the last-resort bound for "neither happened in time": the launch
@@ -62,6 +70,14 @@ const TURN_ANSWER_RETENTION_MS = 5 * 60_000;
  *  launch-parity smoke can assert every launch client's request timeout OUTLIVES this window — the tier
  *  rule forbids the clients importing it directly. */
 export const READINESS_TIMEOUT_MS = 30_000;
+/** How long a once seat whose connector needs a confirmed startup waits for its startup watch to end,
+ *  from its launch: the watch's 15s for the confirm prompt and 15s for its notice, plus 5s for the
+ *  last read. The readiness window applies when it is longer. */
+const STARTUP_OUTCOME_MS = 35_000;
+/** The cancel reason of an inherited once task whose spawn has no succeeded terminal. */
+const NEVER_SERVED = "never served: the manager restarted before the spawn's readiness verdict";
+/** Said by every settle of an inherited once task whose seat this manager does not hold. */
+const UNHELD_SEAT = "the manager does not hold the seat; it may still be running";
 /** How often the readiness race asks a runtime that streams no exit whether its child has exited, and
  *  how long it waits past the window for the proof of its last read. An operator waits on this reply,
  *  so it asks more often than the exit watch that outlives readiness. */
@@ -297,6 +313,18 @@ function stopCauseText(cause) {
         case "stopped-self": return "it stopped itself (self-stop)";
         case "stopped-reap": return `this manager stopped it because its parent ${cause.parent} left (recursive reap)`;
         case "stopped-shutdown": return "this manager stopped it on manager shutdown";
+        case "stopped-once": return `this manager stopped it: its once task ended (${cause.reason})`;
+        default: return cause;
+    }
+}
+/** The reason a once task is cancelled with when a stop of this kind ends its seat first. */
+function onceStopReason(cause) {
+    switch (cause.kind) {
+        case "stopped-requested": return "despawned";
+        case "stopped-self": return "stopped-itself";
+        case "stopped-reap": return "parent-left";
+        case "stopped-shutdown": return "manager-shutdown";
+        case "stopped-once": return cause.reason;
         default: return cause;
     }
 }
@@ -315,14 +343,47 @@ function parseTurnNote(raw) {
     if (o === null || typeof o !== "object")
         return undefined;
     const n = o;
-    if (typeof n.payload !== "string" || typeof n.deadlineAt !== "number"
-        || typeof n.holdEpoch !== "number")
+    if (n.once !== undefined && n.once !== true)
+        return undefined;
+    if (typeof n.payload !== "string" || typeof n.holdEpoch !== "number")
+        return undefined;
+    if (typeof n.deadlineAt !== "number" && !(n.once === true && n.deadlineAt === undefined))
         return undefined;
     if (n.holdToken !== undefined && typeof n.holdToken !== "string")
         return undefined;
     if (n.handoffFrom !== undefined && typeof n.handoffFrom !== "string")
         return undefined;
-    return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, ...(typeof n.holdToken === "string" ? { holdToken: n.holdToken } : {}), ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
+    if (n.retire !== undefined && (n.once !== true || typeof n.retire !== "string"))
+        return undefined;
+    if (n.spawn !== undefined && (n.once !== true || typeof n.spawn !== "string"))
+        return undefined;
+    return {
+        payload: n.payload, holdEpoch: n.holdEpoch,
+        ...(typeof n.deadlineAt === "number" ? { deadlineAt: n.deadlineAt } : {}),
+        ...(typeof n.holdToken === "string" ? { holdToken: n.holdToken } : {}),
+        ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}),
+        ...(n.once === true ? { once: true } : {}),
+        ...(typeof n.retire === "string" ? { retire: n.retire } : {}),
+        ...(typeof n.spawn === "string" ? { spawn: n.spawn } : {}),
+    };
+}
+function retireOf(d) {
+    return d.retire === undefined ? undefined : { connector: d.retire, name: d.seat.name, uid: d.seat.uid };
+}
+/** The relay record of a `once` task. The prompt is only ever the string value of `context`, so a
+ *  prompt shaped like a run payload stays text and cannot add an `ask` or a `checkpoint`; the
+ *  `once` block is the manager's, rendered by the seat beside the prompt. */
+function onceTurnNote(o) {
+    const payload = JSON.stringify({ context: o.prompt, once: { spawner: o.spawner, ...(o.deadlineAt !== undefined ? { deadlineAt: o.deadlineAt } : {}) } });
+    const note = JSON.stringify({
+        payload, holdEpoch: o.holdEpoch,
+        ...(o.deadlineAt !== undefined ? { deadlineAt: o.deadlineAt } : {}),
+        ...(o.holdToken !== undefined ? { holdToken: o.holdToken } : {}),
+        once: true,
+        ...(o.retire !== undefined ? { retire: o.retire } : {}),
+        spawn: o.spawn,
+    });
+    return { payload, note };
 }
 /** A goal's key in the manager's maps: the caller triple and goal id the goal plane stores the
  *  goal under, because a goal id is the caller's own (SPEC 13.6 item 1) and two callers may pick
@@ -598,6 +659,21 @@ export class Manager {
     /** The deadline sweep behind {@link pendingTurns}: takes the hold's fire into an expired
      *  settle and commits the deadline terminal. Unref'd; idle when no turn is pending. */
     turnSweepTimer;
+    /** Once tasks whose ending is owed, by {@link goalKey}: the task can no longer run (its seat's
+     *  exit is proved, or it was never served), so it is cancelled if it has no terminal and its index
+     *  entry is dropped. A settle that fails stays here and the turn sweep retries it. */
+    onceSettles = new Map();
+    /** Once tasks whose seat's exit is watched: that exit, not the spawn's outcome, settles the debt. */
+    onceWatched = new Set();
+    /** Once tasks a predecessor accepted, by seat uid, until this incarnation binds the seat or
+     *  proves it gone. `readinessMs` bounds how long a seat no reconcile here can account for is
+     *  waited for. */
+    onceInherited = new Map();
+    /** Inherited once seats this manager does not hold whose task has a terminal, by lifecycle uid.
+     *  Every pull from one is answered `stop`, and its notice repeats until a pull has carried it. */
+    onceStops = new Map();
+    /** When the goal reconcile finished: the start of an inherited once task's wait for its seat. */
+    goalReconcileDoneAt = 0;
     /** Process start, for the served `status` uptime. */
     startedAtMs = Date.now();
     /** Connector harness paths resolved ONCE at boot. Missing binaries do not stop unrelated manager
@@ -2063,6 +2139,8 @@ export class Manager {
                 failures.push({ name: a.name, id: a.id, error: "a delegated seat is not resumed by a later manager; stop it before preserving" });
             if (a.seatHome)
                 failures.push({ name: a.name, id: a.id, error: "a carried resume seat's private home is not kept for a later manager; stop it before preserving" });
+            if (a.once)
+                failures.push({ name: a.name, id: a.id, error: "a once seat runs its one task in this process, and a later manager would start it again; let its task end or stop it before preserving" });
         }
         const unverifiedStops = this.unverifiedStops.filter((stopped) => {
             try {
@@ -3478,6 +3556,7 @@ export class Manager {
             // turns addressed to ITS incarnation and yields them; no reach beyond itself exists here.
             turnPending: (ctx) => this.serveGated(ctx, () => this.turnPendingFor(ctx.subject.caller)),
             turnYield: (ctx) => this.serveGated(ctx, () => this.serveTurnYield(ctx.subject.caller, args(ctx))),
+            turnUnconfirmed: (ctx) => this.serveGated(ctx, () => this.serveTurnUnconfirmed(ctx.subject.caller, args(ctx))),
             // The reserved goal cancel (SPEC 13.6 item 4), served for the relay: the goal ref is the
             // authenticated caller's own, so a run withdraws only the turns it submitted.
             cancel: (ctx) => this.serveGated(ctx, () => this.serveTurnCancel(ctx)),
@@ -3743,6 +3822,9 @@ export class Manager {
      * wait proves exit: nobody asked for those children to be gone, so they stay managed until the
      * runtime says otherwise, and a runtime that cannot prove exit records an unverified stop. */
     trackStoppedHandle(a, floor, cause, requireAuthoritativeExit = false) {
+        // What a once seat's task is cancelled with if this stop ends it before the task has a terminal.
+        if (a.once)
+            a.once.stopReason ??= onceStopReason(cause);
         if (!a.handle.waitForExit) {
             // Preserve ordinary external-runtime stop behavior, but retain enough evidence for a later
             // maintenance prepare to fail if that runtime still cannot prove the surface disappeared.
@@ -4596,7 +4678,7 @@ export class Manager {
         try {
             const r = await this.ep.requestDeliveryAdmin("lifecycleMemberships", { principal: principalKey(t.owner, t.actor).key, lifecycleUid: t.lifecycleUid }, 5_000);
             const data = r.data;
-            if (!r.ok || data?.complete !== true || !Array.isArray(data.channels) || !data.channels.every((c) => typeof c === "string" && isConcreteChannel(c)))
+            if (!r.ok || data?.complete !== true || !Array.isArray(data.channels) || !data.channels.every((c) => typeof c === "string" && (isConcreteChannel(c) || isChannelFamily(c))))
                 return { complete: false, channels: [], reason: r.ok ? "malformed inventory reply" : (r.error ?? "refused") };
             return { complete: true, channels: data.channels };
         }
@@ -5049,6 +5131,21 @@ export class Manager {
                 return Promise.resolve({ ok: false, error: "supervise.windowMs: expected a positive integer" });
             supervise = { restarts: rec.restarts, windowMs: rec.windowMs };
         }
+        let once;
+        if (args.once !== undefined) {
+            const raw = args.once;
+            if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+                return Promise.resolve({ ok: false, error: "once: expected { deadlineMs? }" });
+            const rec = raw;
+            const extra = Object.keys(rec).filter((k) => k !== "deadlineMs");
+            if (extra.length > 0)
+                return Promise.resolve({ ok: false, error: `once: unknown key ${extra[0]}; it takes deadlineMs` });
+            // The default is applied here, so every caller of the wire gets the same one.
+            const d = rec.deadlineMs ?? ONCE_DEFAULT_DEADLINE_MS;
+            if (d !== -1 && (typeof d !== "number" || !Number.isSafeInteger(d) || d < 1 || Date.now() + d > MAX_SCHEDULE_MS))
+                return Promise.resolve({ ok: false, error: "once.deadlineMs: expected -1 (no deadline) or a positive whole number of milliseconds that ends by the deadline scheduler's last instant (the end of year 9999)" });
+            once = { deadlineMs: d === -1 ? undefined : d };
+        }
         // ACL overrides arrive as string arrays or not at all — a malformed value is a bad request,
         // not something to coerce (no fallbacks).
         const strList = (v, flag) => {
@@ -5059,11 +5156,23 @@ export class Manager {
             return v;
         };
         let subscribe, allowSubscribe, allowPublish, shareTools;
+        let join, callerAcl;
         try {
             subscribe = strList(args.subscribe, "subscribe");
             allowSubscribe = strList(args.allowSubscribe, "allowSubscribe");
             allowPublish = strList(args.allowPublish, "allowPublish");
             shareTools = strList(args.shareTools, "shareTools");
+            join = strList(args.join, "join");
+            if (args.callerAcl !== undefined) {
+                const rec = args.callerAcl;
+                if (rec === null || typeof rec !== "object" || Array.isArray(rec))
+                    throw new Error("callerAcl: expected an object");
+                const sub = strList(rec.allowSubscribe, "callerAcl.allowSubscribe");
+                const pub = strList(rec.allowPublish, "callerAcl.allowPublish");
+                if (!sub || !pub)
+                    throw new Error("callerAcl: allowSubscribe and allowPublish are both required");
+                callerAcl = { allowSubscribe: sub, allowPublish: pub };
+            }
         }
         catch (e) {
             return Promise.resolve({ ok: false, error: rejectionText(e) });
@@ -5120,8 +5229,11 @@ export class Manager {
             subscribe,
             allowSubscribe,
             allowPublish,
+            join,
+            callerAcl,
             shareTools,
             ...(supervise !== undefined ? { supervise } : {}),
+            ...(once !== undefined ? { once } : {}),
             ...(typeof args.runtime === "string" ? { runtime: args.runtime.trim() } : {}),
             route,
         }, caller, hooks, authenticatedCaller);
@@ -5295,6 +5407,49 @@ export class Manager {
             return `${connector.name} connector does not support exact session continuity (continuity: exact)`;
         return undefined;
     }
+    /** The refusal for a `once` spawn this manager cannot run as one task: every check is made before
+     *  anything is allocated, so a refused spawn leaves nothing behind. */
+    onceRefusal(connector, runtime, launch, spawner, hooks) {
+        if (!hooks?.onOnce)
+            return "once: a once task rides the spawn action, which this launch door is not";
+        if (launch.prompt === undefined || launch.prompt.trim() === "")
+            return "once: needs a prompt, which is the task";
+        if (launch.supervise !== undefined)
+            return "once: a once seat is never restarted, so it cannot carry supervise";
+        if (!connector.supportsTurnRelay)
+            return `once: the ${connector.name} connector cannot take a once task${connector.turnRelayRefusal ? `: ${connector.turnRelayRefusal}` : ""}`;
+        if (connector.onceNeedsConfirmed !== undefined && !runtime.reportsStartupOutcome)
+            return `once: runtime "${runtime.kind}" does not report how a seat's startup ended, which a once seat on the ${connector.name} connector needs`;
+        if (runtime.spawnDelegated)
+            return `once: runtime "${runtime.kind}" starts seats outside this host, where this manager cannot prove the seat's exit`;
+        const operator = connector.waitsForOperator?.(launch.launchOptions);
+        if (operator !== undefined)
+            return `once: these launch options make the seat wait at ${operator} before it starts, so nothing could take its task`;
+        // The task's relay record, measured with the widest deadline it could carry.
+        const { note, payload } = onceTurnNote({
+            prompt: launch.prompt, spawner: this.spawnerName(spawner),
+            ...(launch.once.deadlineMs !== undefined ? { deadlineAt: MAX_SCHEDULE_MS, holdToken: turnHoldToken("") } : {}),
+            holdEpoch: this.serviceServe?.grant.epoch ?? 0,
+            ...(connector.retireAfterExit ? { retire: connector.name } : {}),
+            // The longest id token core accepts (endpoint-subjects `assertIdToken`).
+            spawn: "x".repeat(64),
+        });
+        if (note.length > TURN_NOTE_MAX)
+            return `once: the prompt is too long for one task (its relay record is ${note.length} characters, over ${TURN_NOTE_MAX})`;
+        if (connector.turnFrameLimit !== undefined) {
+            // The text the seat shows, rendered by the seat's own function with the widest values it could
+            // carry: the task's goal id is a digest token, and a deadline renders as one ISO instant.
+            const text = renderOnceTask({ goalId: digestIdToken("once"), payload, spawner: this.spawnerName(spawner), ...(launch.once.deadlineMs !== undefined ? { deadlineAt: MAX_SCHEDULE_MS } : {}) });
+            if (text.length > connector.turnFrameLimit)
+                return `once: the prompt is too long for one ${connector.name} turn (the task renders to ${text.length} characters, over ${connector.turnFrameLimit})`;
+        }
+        return undefined;
+    }
+    /** How a once task names who sent it: the spawner's roster name, else its principal. */
+    spawnerName(spawner) {
+        const id = spawner ?? this.ep.ref().id;
+        return this.ep.getRoster().find((p) => p.card.id === id)?.card.name ?? id;
+    }
     /** The refusal for an event-plane choice the registration policy or the connector cannot meet.
      *  Spawn and resume both ask before a seat's launch is built, so a seat retained without the
      *  plane cannot come back on a space that now requires it. An absent choice arms the plane. */
@@ -5558,6 +5713,8 @@ export class Manager {
             if (!policy.success)
                 return { ok: false, error: `supervise.${policy.error.issues[0]?.path.join(".")}: expected a positive integer` };
         }
+        if (opts.once)
+            opts.once = { deadlineMs: opts.once.deadlineMs };
         let runtime;
         try {
             await this.loadSeatRuntime(opts.runtime);
@@ -5719,8 +5876,8 @@ export class Manager {
         if (opts.resolved) {
             // A manifest launch is the access + identity authority: imperative overrides arriving
             // alongside `resolved` are a caller contract error, not something to merge (no fallbacks).
-            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || opts.shareTools || opts.identity)
-                return { ok: false, error: "a manifest launch (resolved) rejects imperative overrides (identity/subscribe/allow*/prompt/shareTools)" };
+            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.join || opts.callerAcl || opts.prompt || opts.shareTools || opts.identity)
+                return { ok: false, error: "a manifest launch (resolved) rejects imperative overrides (identity/subscribe/allow*/join/callerAcl/prompt/shareTools)" };
             const r = opts.resolved;
             identityName = r.name;
             role = opts.role ?? r.role;
@@ -5746,9 +5903,20 @@ export class Manager {
             // Flags > persona file — the same precedence as foreground `cotal spawn`, so the two launch
             // paths of the merged grammar can't diverge. One source feeds BOTH the minted creds and the
             // connector env below.
-            subscribe = opts.subscribe ?? def.subscribe;
-            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? [];
-            allowPublish = opts.allowPublish ?? def.allowPublish;
+            // A persona that names no channel field at all is scoped to its spawner's ACL (`callerAcl`,
+            // when the door sent one). The spawner's own event channel is dropped from it: that plane is
+            // foreign to the child, and the guard below refuses any spawn that asks for one. The joined
+            // set is never copied from the spawner: a helper starts on what its persona lists plus what
+            // the caller passes in `join`, and nothing else.
+            const personaNamesChannels = def.subscribe !== undefined || def.allowSubscribe !== undefined || def.allowPublish !== undefined;
+            const scoped = !personaNamesChannels && opts.callerAcl ? {
+                allowSubscribe: opts.callerAcl.allowSubscribe.filter((ch) => eventChannelPrincipal(ch) === null),
+                allowPublish: opts.callerAcl.allowPublish.filter((ch) => eventChannelPrincipal(ch) === null),
+            } : undefined;
+            const base = opts.subscribe ?? def.subscribe;
+            subscribe = opts.join?.length ? [...new Set([...(base ?? []), ...opts.join])] : base;
+            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? scoped?.allowSubscribe ?? [];
+            allowPublish = opts.allowPublish ?? def.allowPublish ?? scoped?.allowPublish;
             capabilities = def.capabilities;
             // #651: fold the persona's model into the launch record, mirroring the variant line below
             // and the manifest branch above. Without this, a persona-file model (the common pin source)
@@ -5835,6 +6003,9 @@ export class Manager {
         const unsupported = this.capabilityRefusal(connector, { variant, prompt, exact });
         if (unsupported)
             return { ok: false, error: unsupported };
+        const onceRefused = opts.once && this.onceRefusal(connector, runtime, { ...opts, launchOptions, prompt }, spawner, hooks);
+        if (onceRefused)
+            return { ok: false, error: onceRefused };
         let reopenSession;
         if (exact) {
             try {
@@ -5998,8 +6169,20 @@ export class Manager {
             // The hosted enrollment arm accepts only once the host has answered: the floor names the uid
             // the agent runs at, and before the host picks it there is no such uid to name.
             const hostedEnrollment = this.userMode && (opts.delegatedIntent !== undefined || this.remoteAuthority?.enrollManagedAgent !== undefined);
-            if (!hostedEnrollment)
+            // A once spawn's task is accepted with the spawn, before anything launches.
+            let onceTask;
+            const acceptOnce = async (seat) => {
+                if (opts.once === undefined)
+                    return;
+                onceTask = await hooks.onOnce({
+                    seat: { name, ...seat }, prompt: prompt, spawner: this.spawnerName(spawner), deadlineMs: opts.once.deadlineMs, readinessDeadlineMs: readinessTimeoutMs,
+                    ...(connector.retireAfterExit ? { retire: connector.name } : {}),
+                });
+            };
+            if (!hostedEnrollment) {
                 await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple });
+                await acceptOnce(agentTriple);
+            }
             // In auth mode, mint the agent's creds from the space signing key and write them where the
             // spawned session reads them (COTAL_CREDS path). Open mesh → no creds. Scope = the resolved
             // subscribe/allowSubscribe (read) + allowPublish (post, default-deny).
@@ -6047,6 +6230,7 @@ export class Manager {
                 if (hostedEnrollment) {
                     try {
                         await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple: { owner: prep.owner, actor: name, uid: lifecycleUid } });
+                        await acceptOnce({ owner: prep.owner, actor: name, uid: lifecycleUid });
                     }
                     catch (e) {
                         // A refused accept rolls the enrollment back: the host's grant through `provisioned`, and
@@ -6083,7 +6267,7 @@ export class Manager {
                 // evidence activates only once the row exists, and the row exists only after the evidence
                 // was staged. The agent learns the generation by reading the accepted row under its token.
                 // The generation's horizon bounds every renewal of this incarnation's credential.
-                issued = { generation: mintGeneration(now + STATIC_GENERATION_HORIZON_SEC), acceptedToken: mintAcceptedToken() };
+                issued = { generation: mintGeneration(now + STATIC_GENERATION_HORIZON_SEC), acceptedToken: mintAcceptedToken(), listing: true };
                 const issuedAgent = { name, id: identity.id, lifecycleUid };
                 const creds = await this.withIssuer((i) => this.withProvisioner((prov) => provisionAgent(prov, this.auth, identity, {
                     subscribe,
@@ -6142,8 +6326,10 @@ export class Manager {
                 resume: opts.resume,
                 reopenSession,
                 // Initial prompt: the `--prompt` flag, or the manifest entry's `prompt:` on a resolved launch.
-                // A reopened session already had its kickoff turn, so it is not submitted again.
-                prompt: reopenSession === undefined ? prompt : undefined,
+                // A reopened session already had its kickoff turn, so it is not submitted again. A once
+                // seat gets its prompt as its one relayed task instead.
+                prompt: reopenSession === undefined && opts.once === undefined ? prompt : undefined,
+                ...(opts.once !== undefined ? { once: true } : {}),
                 // The SAME access set the creds were minted from (above) — forwarded so the session's
                 // runtime read/post set matches its credentials. Without this a manifest-spawned agent
                 // (materialized persona has no access frontmatter) has no channel set to read and joins
@@ -6178,6 +6364,9 @@ export class Manager {
                 spec.env = { ...spec.env, COTAL_MANAGER_INSTANCE: this.managerInstanceId };
                 handle = await this.spawnCustodied(runtime, name, spec, cwd, custody);
             }
+            if (onceTask && !handle.waitForExit)
+                throw new Error(`once: runtime "${handle.kind}" cannot prove the seat's exit, which is what ends its task when the seat goes first`);
+            const launchedAt = Date.now();
             hooks?.onLaunched?.(); // The "launched" progress edge (process spawned, pre-presence)
             const managed = {
                 name,
@@ -6215,8 +6404,9 @@ export class Manager {
                     model,
                     variant,
                     // The kickoff prompt is part of the launch form: a stale-restart re-submits it, so the
-                    // recorded launch must carry it for the restart gate (and preserve) to see it.
-                    prompt,
+                    // recorded launch must carry it for the restart gate (and preserve) to see it. A once
+                    // seat's prompt is its task, which no relaunch may submit again.
+                    prompt: onceTask ? undefined : prompt,
                     subscribe,
                     allowSubscribe,
                     allowPublish,
@@ -6232,8 +6422,10 @@ export class Manager {
                         ? Object.keys(opts.launchOptions).sort()
                         : undefined,
                 },
-                // A delegated agent is never restarted (SPEC 13.16), so its slot arms no recovery.
-                ...(spec && (connector.supportsSessionContinuation || opts.supervise !== undefined) && !opts.delegatedIntent
+                // A delegated agent is never restarted (SPEC 13.16), and a once seat never runs its task
+                // twice, so neither slot arms recovery.
+                ...(onceTask ? { once: { ref: onceTask.ref, ...(connector.retireAfterExit ? { retire: connector.name } : {}) } } : {}),
+                ...(spec && (connector.supportsSessionContinuation || opts.supervise !== undefined) && !opts.delegatedIntent && !onceTask
                     ? {
                         restart: {
                             opts: launchOpts,
@@ -6262,6 +6454,8 @@ export class Manager {
             }
             this.agents.set(name, managed);
             this.reservedLive.add(name);
+            if (managed.once)
+                this.watchOnceExit(managed);
             // The live slot now owns teardown — freeSlot deprovisions this identity on exit — so the
             // orphan-rollback in `finally` no longer applies to it.
             provisioned = undefined;
@@ -6286,6 +6480,8 @@ export class Manager {
                 const error = reopenSession === undefined ? readiness.detail
                     : `${readiness.detail} (continuity: exact was reopening recorded session ${reopenSession}; if the harness no longer has it, ` +
                         `remove ${join(this.workspaceRoot, ".cotal", "continuity", `${name}.json`)} to start a new session)`;
+                if (managed.once)
+                    managed.once.stopReason ??= "launch-failed";
                 await hooks?.onOutcome?.({ kind: "failed", data: { error } });
                 return { ok: false, error };
             }
@@ -6295,9 +6491,36 @@ export class Manager {
                 this.watchExit(managed);
                 if (managed.launch.carried)
                     void this.refuseLateCarriedFork(managed, readinessTimeoutMs);
+                // A once seat is never left running with nothing to do, and its stop does not wait on the
+                // spawn's terminal, whose write can stall. The spawn keeps that terminal: the stop lets go
+                // of the spawn goal first. Its task was never served and is cancelled with the verdict.
+                if (managed.once) {
+                    this.agentGoals.delete(managed.name);
+                    this.stopOnceSeat(managed, "readiness-timeout");
+                }
                 await hooks?.onOutcome?.({ kind: "uncertain", data: { reason: readiness.detail, ...(readiness.running ? { running: true } : {}) } });
                 return { ok: false, error: readiness.detail };
             }
+            // A once seat whose connector needs a confirmed startup is served only on that outcome. Any
+            // other ends it like a seat that never joined: stopped before the failed terminal, and its
+            // task, never served, cancelled with the verdict.
+            if (onceTask && connector.onceNeedsConfirmed !== undefined) {
+                const startup = await this.awaitStartupOutcome(managed, launchedAt, readinessTimeoutMs);
+                if (managed.terminalizing) {
+                    hooks?.onTerminalDeferred?.();
+                    return { ok: false, error: `${name} was stopped before its startup ended` };
+                }
+                if (startup !== "confirmed") {
+                    const watch = { ready: "opened its input screen without the prompt", failed: "failed", exited: "saw the seat exit", pending: "had not ended" }[startup];
+                    const error = `${name} joined, but ${connector.onceNeedsConfirmed}: its startup watch ${watch}, so it cannot take a once task`;
+                    this.watchExit(managed);
+                    this.agentGoals.delete(managed.name);
+                    managed.once.stopReason ??= "launch-failed";
+                    this.stopOnceSeat(managed, "launch-failed");
+                    await hooks?.onOutcome?.({ kind: "failed", data: { error } });
+                    return { ok: false, error };
+                }
+            }
             if (managed.launch.carried) {
                 const refused = await this.refuseCarriedFork(managed, readinessTimeoutMs);
                 if (refused !== undefined && managed.terminalizing) {
@@ -6367,8 +6590,18 @@ export class Manager {
             // "no role", so dropping the key preserves the reply (surfaced by readiness:live).
             // A host that granted other channels than this spawn asked for: the receipt carries both.
             const acl = enrolled ? enrolledAcl({ allowSubscribe, allowPublish }, enrolled.material) : undefined;
-            const okData = { name, agent, id: managed.id, mode: handle.kind, streamsTerminal: runtime.streamsTerminal, lifecycleUid, ...(role !== undefined ? { role } : {}), ...(opts.eventsNotice !== undefined ? { eventsNotice: opts.eventsNotice } : {}), ...(acl ? { acl } : {}), ...(readiness.operator !== undefined ? { waitingFor: readiness.operator } : {}) };
-            await hooks?.onOutcome?.({ kind: "succeeded", data: okData });
+            const okData = { name, agent, id: managed.id, mode: handle.kind, streamsTerminal: runtime.streamsTerminal, lifecycleUid, ...(role !== undefined ? { role } : {}), ...(opts.eventsNotice !== undefined ? { eventsNotice: opts.eventsNotice } : {}), ...(acl ? { acl } : {}), ...(readiness.operator !== undefined ? { waitingFor: readiness.operator } : {}), ...(onceTask ? { once: { goalId: onceTask.ref.goalId, ...(onceTask.deadlineAt !== undefined ? { deadlineAt: onceTask.deadlineAt } : {}) } } : {}) };
+            // The task is served once the succeeded terminal is written, so a served task always has it
+            // and a successor reads it as the readiness verdict. Every failure arm above ran before it. A
+            // terminal this call did not commit never served the task: the seat is stopped, which cancels it.
+            const committed = await hooks?.onOutcome?.({ kind: "succeeded", data: okData });
+            if (onceTask && committed === true)
+                this.openOnceDelivery(onceTask.ref);
+            else if (onceTask) {
+                this.agentGoals.delete(managed.name);
+                managed.once.stopReason ??= "launch-failed";
+                this.stopOnceSeat(managed, "launch-failed");
+            }
             return { ok: true, data: okData };
         }
         catch (e) {
@@ -8544,6 +8777,7 @@ export class Manager {
         }
         finally {
             this.goalReconcileDone = true;
+            this.goalReconcileDoneAt = Date.now();
             // A seat that pulled during the window was refused, and a predecessor may have died before
             // its notice went out, so every seat holding a rebuilt turn is told once.
             const seats = new Map([...this.pendingTurns.values()].map((p) => [`${p.seat.owner}.${p.seat.actor}.${p.seat.uid}`, p.seat]));
@@ -8729,6 +8963,8 @@ export class Manager {
         let effectStarted = false;
         // Set by onUndone: the host's code for a later refusal that left nothing behind.
         let undone;
+        // The task of a once spawn, once accepted.
+        let onceRef;
         // The terminal commits OFF-handler on the goal-writer connection (manager-only authority; a
         // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): (a) reads THIS
         // incarnation's OWN gate epoch and REFUSES a superseded commit (the currency belt), and (b)
@@ -8745,8 +8981,19 @@ export class Manager {
             // incarnation or a sibling. Refusing here rather than at each unwind site is the point --
             // there is exactly one commit path, so this fences every route into it, present and future.
             if (!ownsGoal)
-                return;
+                return false;
             terminalEntered = true; // entered, not succeeded — see the catch below
+            // A once spawn that did not succeed never served its task (delivery opens only with a
+            // succeeded verdict), so the task is cancelled now rather than at the seat's exit. A launched
+            // seat's debt is still settled by its exit, which proves the seat gone first; a spawn that
+            // never launched one owes nothing more.
+            if (o.kind !== "succeeded" && onceRef !== undefined) {
+                const reason = o.kind === "uncertain" ? "readiness-timeout" : "launch-failed";
+                if (this.onceWatched.has(goalKey(onceRef)))
+                    void this.commitOnceCancel(onceRef, reason).catch((e) => console.error(`! once task ${onceRef.goalId} (${reason}): ${rejectionText(e)}; its seat's exit cancels it`));
+                else
+                    void this.settleOnceTurn(onceRef, reason);
+            }
             try {
                 await this.assertGoalWriterEpochCurrent(epoch); // a superseded corpse never commits
                 let fact;
@@ -8768,6 +9015,7 @@ export class Manager {
                 await clearGoalIndex(gw.ctx, ref); // terminal reached - the successor never reconciles it
                 if (acceptance)
                     this.agentGoals.delete(acceptance.name); // goal terminal - no cancel path left
+                return true;
             }
             catch (e) {
                 // THE NARROWER LEG, LEFT OPEN DELIBERATELY. If the COMMIT ITSELF throws (the currency belt
@@ -8778,6 +9026,7 @@ export class Manager {
                 // next boot, which is why the index is NOT cleared above on this path. Do not "close" it
                 // here with a retry loop.
                 console.error(`! goal terminal commit for ${goalId} failed: ${rejectionText(e)}`);
+                return false;
             }
         };
         const bg = run({
@@ -8850,6 +9099,18 @@ export class Manager {
             onTerminalDeferred: () => { terminalEntered = true; },
             onEffect: () => { effectStarted = true; },
             onUndone: (code) => { undone = code; },
+            onOnce: async (task) => {
+                try {
+                    const accepted = await this.acceptOnceTurn({ spawnRef: ref, fingerprint, command: ctx.subject.command, executor, acceptedAt, ...task });
+                    onceRef = accepted.ref;
+                    return accepted;
+                }
+                catch (e) {
+                    // The spawn goal is already bound, so its refusal is a terminal: nothing has launched.
+                    await onOutcome({ kind: "failed", data: { error: `the once task was not accepted: ${rejectionText(e)}` } });
+                    throw e;
+                }
+            },
         });
         bg.then((reply) => {
             // Refused BEFORE onAccepted (hard-pin collision, capacity, persona-not-found) — no goal bound.
@@ -8970,6 +9231,8 @@ export class Manager {
         }
         // Refused here, before anything durable, so the caller's goal id stays free for another seat.
         this.assertSeatTurnFree(name, t, goalId);
+        if (target.kind === "managed" && target.agent.once)
+            throw new EpEnvelopeError("failed-precondition", `seat "${name}" is a once seat; it takes only the task it was spawned with`, undefined, "not-executed");
         const raw = (ctx.request.args ?? {});
         const payload = String(raw.payload);
         const deadlineAt = raw.deadlineAt === undefined ? acceptedAt + Number(raw.deadlineMs) : Number(raw.deadlineAt);
@@ -9089,21 +9352,30 @@ export class Manager {
         // window has to refuse, the same way `serveTurnGoal` does.
         if (!this.goalReconcileDone)
             throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; the pending-turn index is not rebuilt yet, retry (SPEC 13.6)");
+        // A once seat this manager does not hold, whose task has ended, is told to end itself. Nothing
+        // else rides that answer, and the settled task is never served again.
+        const stop = this.onceStops.get(c.uid);
+        if (stop !== undefined && stop.owner === c.owner && stop.actor === c.actor) {
+            stop.told = true;
+            return { turns: [], notices: true, stop: true };
+        }
         // Two turns on one seat are serialized at the dispatch (cotal-lang 6.5): only the oldest
         // unsettled one is served, and the next surfaces once it yields or its deadline denies, so a
         // seat is never shown two turns at once.
         // An ELAPSED turn is not servable: its hold is expirable and its run has already thrown from
         // its own pause, so handing it to the seat buys work whose yield is refused. It also cannot be
-        // allowed to stay the head, or one expired turn dams every later turn for that seat.
+        // allowed to stay the head, or one expired turn dams every later turn for that seat. A once
+        // task is not served before its spawn's readiness verdict, and one with no deadline never
+        // elapses.
         const now = Date.now();
         const head = [...this.pendingTurns.values()]
             .filter((p) => p.seat.owner === c.owner && p.seat.actor === c.actor && p.seat.uid === c.uid)
-            .filter((p) => now < p.deadlineAt)
+            .filter((p) => (p.deadlineAt === undefined || now < p.deadlineAt) && p.once?.deliverable !== false)
             .sort((x, y) => x.acceptedAt - y.acceptedAt)
             .slice(0, 1);
         for (const p of head)
             p.pulledAt ??= now;
-        const turns = head.map((p) => ({ goalId: p.goalId, payload: p.payload, acceptedAt: p.acceptedAt, deadlineAt: p.deadlineAt }));
+        const turns = head.map((p) => ({ goalId: p.goalId, payload: p.payload, acceptedAt: p.acceptedAt, ...(p.deadlineAt !== undefined ? { deadlineAt: p.deadlineAt } : {}), ...(p.once ? { once: true } : {}) }));
         return { turns, notices: true };
     }
     /** Tell a seat that its `turn-pending` answer changed (SPEC 14.3 turn notice), over the serve
@@ -9164,28 +9436,66 @@ export class Manager {
         if (key === undefined)
             throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
         const p = this.pendingTurns.get(key);
-        if (!p) {
-            // A YIELD WHOSE REPLY WAS LOST IS NOT A YIELD THAT FAILED. The commit deleted the pending
-            // turn, so a retry found nothing and heard `not-found` — which a seat reads as "drop it",
-            // reporting failure for work the run already has. The answer the first reply carried is
-            // served again instead, to the addressee it was addressed to and nobody else.
-            const settled = this.turnAcceptances.get(key);
-            if (settled !== undefined) {
-                if (settled.settled !== undefined)
-                    return { goalId, state: settled.settled.state };
-                // The in-memory answer is not yet remembered (pending deleted before the terminal CAS,
-                // or a concurrent sweep dropped `settled` while the commit was still in flight). The
-                // durable terminal is the one the run already has; name it, never `not-found`.
-                if (settled.ref !== undefined) {
-                    const ended = await readGoalResult(gw.ctx, settled.ref);
-                    if (ended !== undefined) {
-                        this.rememberSettledTurn(key, ended.state, ended.ts);
-                        return { goalId, state: ended.state };
-                    }
+        if (!p)
+            return this.settledTurnAnswer(key, goalId);
+        await this.claimTurnHold(p);
+        const epoch = this.serviceServe?.grant.epoch ?? 0;
+        await this.assertGoalWriterEpochCurrent(epoch);
+        const at = Date.now();
+        const data = { status, ...(to !== undefined ? { to } : {}), ...(yieldNote !== undefined ? { note: yieldNote } : {}), ...(p.handoffFrom !== undefined ? { handoffFrom: p.handoffFrom } : {}), at };
+        // The goal is TARGET-PINNED, so this completion proves the EXECUTOR's (the seat's) fresh
+        // currency, not the manager's: managed-seat epochs are 0 within an incarnation (the same
+        // convention resolveTarget serves), and the resolver answers from the live agents map — a
+        // seat that died between its yield call and this commit refuses `expired` here.
+        const { fact } = await commitGoalResult(gw.ctx, {
+            ref: p.ref, now: at, cause: "complete", state: "succeeded", data,
+            committer: { instanceId: this.managerInstanceId, epoch },
+            executor: { lifecycleUid: p.seat.uid, epoch: 0 },
+            resolveCurrentEpoch: (target) => this.turnExecutorEpoch(p.seat.name, p.seat.owner, p.seat.actor, target.lifecycleUid),
+        });
+        this.emitGoalProgress(p.ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
+        // A once task's index entry is its seat's debt, dropped at the seat's proved exit.
+        if (!p.once)
+            await clearGoalIndex(gw.ctx, p.ref);
+        this.pendingTurns.delete(key);
+        this.noticeSeatTurns(p.seat);
+        this.markTurnLatchDropped(key, at);
+        this.rememberSettledTurn(key, fact.state, at);
+        if (p.once)
+            this.endOnceSeat(p, `yielded ${status}`);
+        this.maybeStopTurnSweep();
+        return { goalId, state: fact.state };
+    }
+    /** A seat's answer for a turn no longer pending. A REPLY THAT WAS LOST IS NOT AN ANSWER THAT
+     *  FAILED: the commit deleted the pending turn, so a retry found nothing and heard `not-found`,
+     *  which a seat reads as "drop it", reporting failure for work the run already has. The answer
+     *  the first reply carried is served again instead, to the addressee it was addressed to and
+     *  nobody else. */
+    async settledTurnAnswer(key, goalId) {
+        const settled = this.turnAcceptances.get(key);
+        if (settled !== undefined) {
+            if (settled.settled !== undefined)
+                return { goalId, state: settled.settled.state };
+            // The in-memory answer is not yet remembered (pending deleted before the terminal CAS,
+            // or a concurrent sweep dropped `settled` while the commit was still in flight). The
+            // durable terminal is the one the run already has; name it, never `not-found`.
+            if (settled.ref !== undefined && this.goalWriter) {
+                const ended = await readGoalResult(this.goalWriter.ctx, settled.ref);
+                if (ended !== undefined) {
+                    this.rememberSettledTurn(key, ended.state, ended.ts);
+                    return { goalId, state: ended.state };
                 }
             }
-            throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
         }
+        throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
+    }
+    /** Claim a pending turn's deadline hold before the seat's answer commits: one use, and a hold
+     *  that already expired drives the deadline terminal instead and refuses the answer. A once task
+     *  with no deadline has no hold. */
+    async claimTurnHold(p) {
+        if (p.holdToken === undefined)
+            return;
+        const gw = this.goalWriter;
         const cpRef = { endpoint: p.ref.endpoint, token: p.holdToken };
         try {
             await resumeCheckpoint(gw.ctx.kv, gw.ctx.js, gw.ctx.jsm, this.space, { ref: cpRef, presenter: { id: MANAGER_ENDPOINT, lifecycleUid: this.managerInstanceId }, now: Date.now() });
@@ -9194,33 +9504,53 @@ export class Manager {
             const settle = await readCheckpointSettle(gw.ctx.jsm, this.space, cpRef).catch(() => undefined);
             if (settle?.settle === "expired") {
                 await this.commitTurnDeadline(p);
-                throw new EpEnvelopeError("failed-precondition", `turn "${goalId}" elapsed its deadline before the yield; the deadline terminal stands (SPEC 13.6)`);
+                throw new EpEnvelopeError("failed-precondition", `turn "${p.goalId}" elapsed its deadline before the seat answered; the deadline terminal stands (SPEC 13.6)`);
             }
-            // Already resumed BY THIS MANAGER (the hold is holder-bound): a prior yield attempt claimed
-            // it and then failed to commit. Fall through and commit — the claim is ours to finish.
+            // Already resumed BY THIS MANAGER (the hold is holder-bound): a prior attempt claimed it
+            // and then failed to commit. Fall through and commit; the claim is ours to finish.
             if (settle?.settle !== "resumed")
                 throw e;
         }
+    }
+    /** A once seat's report that its task's handoff to its harness was not confirmed. The seat sealed
+     *  the task before it reported, so nothing hands it over again; the task fails
+     *  `delivery-unconfirmed` and the seat is stopped. The commit proves the seat's live currency, as
+     *  a yield's does: a seat already gone commits nothing here, and its exit cancels the task. Only
+     *  the addressed seat may report, only for its once task; a repeat after the terminal is answered
+     *  with it. */
+    async serveTurnUnconfirmed(c, raw) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
+        if (!this.goalReconcileDone)
+            throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; this report's turn may not be indexed yet, retry (SPEC 13.6)");
+        const gw = this.goalWriter;
+        if (!gw)
+            throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing (SPEC 13.6)");
+        const goalId = String(raw.goalId);
+        const key = this.seatTurnKey(c, goalId);
+        if (key === undefined)
+            throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
+        const p = this.pendingTurns.get(key);
+        if (!p)
+            return this.settledTurnAnswer(key, goalId);
+        if (!p.once)
+            throw new EpEnvelopeError("failed-precondition", `turn "${goalId}" is a run's turn; turn-unconfirmed reports only a once task, and a run's turn is offered again`);
+        await this.claimTurnHold(p);
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         await this.assertGoalWriterEpochCurrent(epoch);
         const at = Date.now();
-        const data = { status, ...(to !== undefined ? { to } : {}), ...(yieldNote !== undefined ? { note: yieldNote } : {}), ...(p.handoffFrom !== undefined ? { handoffFrom: p.handoffFrom } : {}), at };
-        // The goal is TARGET-PINNED, so this completion proves the EXECUTOR's (the seat's) fresh
-        // currency, not the manager's: managed-seat epochs are 0 within an incarnation (the same
-        // convention resolveTarget serves), and the resolver answers from the live agents map — a
-        // seat that died between its yield call and this commit refuses `expired` here.
         const { fact } = await commitGoalResult(gw.ctx, {
-            ref: p.ref, now: at, cause: "complete", state: "succeeded", data,
+            ref: p.ref, now: at, cause: "complete", state: "failed", data: { reason: "delivery-unconfirmed", at },
             committer: { instanceId: this.managerInstanceId, epoch },
             executor: { lifecycleUid: p.seat.uid, epoch: 0 },
             resolveCurrentEpoch: (target) => this.turnExecutorEpoch(p.seat.name, p.seat.owner, p.seat.actor, target.lifecycleUid),
         });
         this.emitGoalProgress(p.ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
-        await clearGoalIndex(gw.ctx, p.ref);
         this.pendingTurns.delete(key);
         this.noticeSeatTurns(p.seat);
         this.markTurnLatchDropped(key, at);
         this.rememberSettledTurn(key, fact.state, at);
+        this.endOnceSeat(p, "delivery-unconfirmed");
         this.maybeStopTurnSweep();
         return { goalId, state: fact.state };
     }
@@ -9275,7 +9605,10 @@ export class Manager {
         this.noticeSeatTurns(p.seat);
         this.markTurnLatchDropped(key);
         this.rememberSettledTurn(key, fact.state, Date.now());
-        await clearGoalIndex(gw.ctx, ref);
+        if (p.once)
+            this.endOnceSeat(p, "cancelled");
+        else
+            await clearGoalIndex(gw.ctx, ref);
         this.maybeStopTurnSweep();
         return { goalId, state: fact.state };
     }
@@ -9295,17 +9628,27 @@ export class Manager {
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         try {
             await this.assertGoalWriterEpochCurrent(epoch);
-            const { fact } = await commitGoalResult(gw.ctx, { ref: p.ref, now: Date.now(), cause: "deny", denial: { kind: "hold-expired", token: p.holdToken }, data: { reason: "turn-deadline", ...(p.seatDiedAt !== undefined ? { agentDownAt: p.seatDiedAt } : {}), ...(p.handoffFrom !== undefined ? { handoffFrom: p.handoffFrom } : {}) }, committer: { instanceId: this.managerInstanceId, epoch } });
+            const { fact } = await commitGoalResult(gw.ctx, { ref: p.ref, now: Date.now(), cause: "deny", denial: { kind: "hold-expired", token: p.holdToken }, data: { reason: "turn-deadline", ...(p.seatDiedAt !== undefined ? { agentDownAt: p.seatDiedAt } : {}), ...(p.handoffFrom !== undefined ? { handoffFrom: p.handoffFrom } : {}), ...(this.onceSeatUnheld(p) ? { seat: UNHELD_SEAT } : {}) }, committer: { instanceId: this.managerInstanceId, epoch } });
             this.emitGoalProgress(p.ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
             // Remember BEFORE the index clear: a late yield that arrives after the pending latch
             // (the delete at the top of this function) and after this CAS has to name this terminal.
             // Clearing first, then remembering, left a window where maybeStopTurnSweep saw no pending
             // turn and no settled answer, wiped the acceptance, and rememberSettledTurn no-op'd.
             this.rememberSettledTurn(key, fact.state, Date.now());
-            await clearGoalIndex(gw.ctx, p.ref);
+            if (p.once)
+                this.endOnceSeat(p, "turn-deadline");
+            else
+                await clearGoalIndex(gw.ctx, p.ref);
         }
         catch (e) {
             console.error(`! turn deadline terminal for ${p.goalId}: ${rejectionText(e)}`);
+            // A once seat stops at its deadline whether or not the terminal landed, and the task stays
+            // pending so the turn sweep writes the terminal again while this manager runs.
+            if (p.once) {
+                this.pendingTurns.set(key, p);
+                this.endOnceSeat(p, "turn-deadline");
+                this.ensureTurnSweep();
+            }
         }
         this.maybeStopTurnSweep();
     }
@@ -9361,7 +9704,7 @@ export class Manager {
      *  terminals AND drops settled answers once their retry window has passed, so a stop while the
      *  second is still owed would leave one entry per turn for the process lifetime. */
     maybeStopTurnSweep() {
-        if (this.pendingTurns.size > 0)
+        if (this.pendingTurns.size > 0 || this.onceSettles.size > 0 || this.onceInherited.size > 0 || [...this.onceStops.values()].some((s) => !s.told))
             return;
         // An acceptance with no `settled` yet is the in-flight deadline commit: pending was the
         // latch and is already gone, the terminal CAS has not returned, and a concurrent sweep
@@ -9401,7 +9744,7 @@ export class Manager {
         // Repeat the notice until it does; a seat that pulled is not told again for that turn.
         const heads = new Map();
         for (const p of this.pendingTurns.values()) {
-            if (now >= p.deadlineAt)
+            if ((p.deadlineAt !== undefined && now >= p.deadlineAt) || p.once?.deliverable === false)
                 continue;
             const k = `${p.seat.owner}.${p.seat.actor}.${p.seat.uid}`;
             const h = heads.get(k);
@@ -9411,8 +9754,16 @@ export class Manager {
         for (const p of heads.values())
             if (p.pulledAt === undefined)
                 this.noticeSeatTurns(p.seat);
+        for (const stop of this.onceStops.values())
+            if (!stop.told)
+                this.noticeSeatTurns(stop);
+        for (const owed of [...this.onceSettles.values()])
+            if (!owed.flight)
+                void this.settleOnceTurn(owed.ref, owed.reason);
+        if (this.onceInherited.size > 0)
+            await this.settleInheritedOnce().catch((e) => console.error(`! inherited once tasks: ${rejectionText(e)}`));
         for (const p of [...this.pendingTurns.values()]) {
-            if (now < p.deadlineAt)
+            if (p.deadlineAt === undefined || now < p.deadlineAt)
                 continue;
             try {
                 const settle = await this.expireTurnHold(p);
@@ -9437,15 +9788,21 @@ export class Manager {
         const status = await readGoalStatus(gw.ctx, entry.ref);
         if (status === undefined)
             return; // index points at no goal record: a dead pointer, left for honesty
+        const parsed = entry.note !== undefined ? parseTurnNote(entry.note) : undefined;
+        const ownOnce = parsed?.once === true && entry.iid === this.managerInstanceId && entry.allocated?.owner !== undefined;
         if (GOAL_TERMINAL_STATES.includes(status.value.state)) {
-            await clearGoalIndex(gw.ctx, entry.ref);
+            // A once task's entry is its seat's debt until that seat's exit is proved, so it outlives
+            // the terminal: the stop the predecessor owed may never have landed.
+            if (ownOnce)
+                await this.inheritOnce(entry.ref, entry.allocated, parsed);
+            else
+                await clearGoalIndex(gw.ctx, entry.ref);
             return;
         }
         if (entry.iid !== this.managerInstanceId) {
             console.error(`turn reconcile ${entry.ref.goalId}: accepted by instance "${entry.iid}", not this incarnation "${this.managerInstanceId}"; left for its owner (never a cross-instance settle)`);
             return;
         }
-        const parsed = entry.note !== undefined ? parseTurnNote(entry.note) : undefined;
         if (entry.allocated?.owner === undefined || parsed === undefined) {
             console.error(`turn reconcile ${entry.ref.goalId}: the relay record is garbled (no floor naming the seat's owner, or an unparseable note); left unsettled`);
             return;
@@ -9465,17 +9822,33 @@ export class Manager {
             seat: { name: entry.allocated.name, owner: entry.allocated.owner, actor: entry.allocated.actor, uid: entry.allocated.uid },
             payload: parsed.payload,
             acceptedAt: spec.value.acceptedAt,
-            deadlineAt: parsed.deadlineAt,
-            holdToken: parsed.holdToken ?? turnHoldToken(entry.ref.goalId), holdEpoch: parsed.holdEpoch,
+            holdEpoch: parsed.holdEpoch,
+            ...(parsed.deadlineAt !== undefined ? { deadlineAt: parsed.deadlineAt, holdToken: parsed.holdToken ?? turnHoldToken(entry.ref.goalId) } : {}),
             ...(parsed.handoffFrom !== undefined ? { handoffFrom: parsed.handoffFrom } : {}),
+            // An inherited once task is served again only once its seat is bound to this incarnation.
+            ...(parsed.once ? { once: { deliverable: false } } : {}),
         };
         // The hold is the relay's bounded ending, minted AFTER the index entry and the goal record,
         // so a crash between them leaves a goal with no hold: nothing could ever settle it, and the
         // sweep would report the same missing pause every tick. Left unsettled, said once.
-        if ((await readCheckpointSpec(gw.ctx.kv, { endpoint: p.ref.endpoint, token: p.holdToken })) === undefined) {
+        if (p.holdToken !== undefined && (await readCheckpointSpec(gw.ctx.kv, { endpoint: p.ref.endpoint, token: p.holdToken })) === undefined) {
+            // A once task's hold is minted before its seat launches, so without one no seat ever ran it:
+            // the task is cancelled and its entry dropped, with nothing launched to prove gone.
+            if (parsed.once) {
+                await this.settleOnceTurn(p.ref, "launch-failed");
+                return;
+            }
             console.error(`turn reconcile ${p.goalId}: its deadline hold was never minted (the accept crashed before it); left unsettled`);
             return;
         }
+        // A once task whose spawn has no succeeded terminal was never served, whatever seat exists:
+        // it is cancelled, its row is not rebuilt so a later pull finds nothing, and its seat is
+        // settled as an inherited debt.
+        if (parsed.once && !(await this.onceServed(entry.ref, parsed))) {
+            await this.commitOnceCancel(entry.ref, NEVER_SERVED);
+            await this.inheritOnce(entry.ref, entry.allocated, parsed);
+            return;
+        }
         const key = goalKey(p.ref);
         this.pendingTurns.set(key, p);
         // THE ACCEPTANCE TOO, or the adopted turn's answer is never remembered: `rememberSettledTurn`
@@ -9497,7 +9870,312 @@ export class Manager {
         // terminal then carried `agentDownAt`, so the run raised L4002 for a seat that was alive the
         // whole time where the reference says L4003. The reap hook is the only honest writer of that
         // fact: it fires when a managed seat actually dies.
-        console.error(`turn reconcile ${p.goalId}: pending relay to ${p.seat.name}/${p.seat.uid} adopted (deadline ${p.deadlineAt})`);
+        console.error(`turn reconcile ${p.goalId}: pending relay to ${p.seat.name}/${p.seat.uid} adopted (deadline ${p.deadlineAt ?? "none"})`);
+        if (parsed.once)
+            await this.inheritOnce(entry.ref, entry.allocated, parsed);
+        this.ensureTurnSweep();
+    }
+    // ---- once (a spawn whose prompt is its one relayed task) ----------------------------------------
+    //
+    // A once spawn's prompt is not a kickoff: the manager accepts it as one turn addressed to the
+    // allocated incarnation, under the spawner's own caller triple and a goal id derived from the
+    // spawn's, so the spawner reads the task's outcome with `goal-result`. The seat is served it from
+    // the spawn's readiness verdict on. The task's terminal (yield, deadline) stops the seat, and the
+    // seat's proved exit cancels a task that has none. Until that exit, the task's index entry is the
+    // seat's debt: a successor finds it there.
+    /** Accept a once spawn's task, inline in the spawn's accept seam: nothing has launched yet, so a
+     *  refusal here fails the spawn and leaves no seat. Mirrors {@link serveTurnGoal}'s accept, with
+     *  the goal ref and the seat given rather than read off a request. A task with no deadline mints
+     *  no hold; its goal still records the spawn's readiness budget, which a successor needs to settle
+     *  it. */
+    async acceptOnceTurn(o) {
+        const gw = this.goalWriter;
+        if (!gw)
+            throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing; a once task cannot be accepted (SPEC 13.6)");
+        const serve = this.serviceServe;
+        if (o.deadlineMs !== undefined && !serve)
+            throw new EpEnvelopeError("unavailable", "the manager service endpoint is not serving; a once task's deadline hold is armed over its connection (SPEC 13.9)");
+        const ref = { endpoint: o.spawnRef.endpoint, caller: { ...o.spawnRef.caller }, goalId: digestIdToken(`${o.spawnRef.goalId}:once`) };
+        const key = goalKey(ref);
+        const deadlineAt = o.deadlineMs === undefined ? undefined : o.acceptedAt + o.deadlineMs;
+        if (deadlineAt !== undefined && deadlineAt > MAX_SCHEDULE_MS)
+            throw new EpEnvelopeError("failed-precondition", `once: the deadline ends after the deadline scheduler's last instant (the end of year 9999)`);
+        const holdToken = deadlineAt === undefined ? undefined : turnHoldToken(key);
+        const { payload, note } = onceTurnNote({ prompt: o.prompt, spawner: o.spawner, holdEpoch: o.executor.epoch, ...(deadlineAt !== undefined ? { deadlineAt, holdToken } : {}), ...(o.retire !== undefined ? { retire: o.retire } : {}), spawn: o.spawnRef.goalId });
+        const { seat } = o;
+        const idx = await recordGoalIndex(gw.ctx, ref, o.executor.lifecycleUid, { name: seat.name, owner: seat.owner, actor: seat.actor, uid: seat.uid, readinessDeadlineMs: o.readinessDeadlineMs }, note);
+        if (!idx.recorded)
+            throw new EpEnvelopeError("failed-precondition", `once: the task goal "${ref.goalId}" is already recorded; a spawn accepts its task once (SPEC 13.6)`);
+        const b = await bindGoal(gw.ctx, ref, o.fingerprint);
+        if (!b.bound) {
+            await clearGoalIndex(gw.ctx, ref);
+            throw new EpEnvelopeError("failed-precondition", `once: the task goal "${ref.goalId}" is already bound; a spawn accepts its task once (SPEC 13.6)`);
+        }
+        try {
+            await createGoal(gw.ctx, ref, {
+                fingerprint: o.fingerprint,
+                command: o.command,
+                caller: { id: `${ref.caller.owner}.${ref.caller.actor}`, lifecycleUid: ref.caller.uid },
+                acceptedEpoch: o.executor.epoch,
+                requestId: ref.goalId,
+                sourceSeq: 0,
+                acceptedAt: o.acceptedAt,
+                readinessDeadlineMs: o.readinessDeadlineMs,
+                target: { owner: seat.owner, actor: seat.actor, lifecycleUid: seat.uid, mappingRevision: 0 },
+            });
+            if (deadlineAt !== undefined)
+                await mintCheckpoint(gw.ctx.kv, jetstream(serve.nc), this.space, {
+                    ref: { endpoint: ref.endpoint, token: holdToken },
+                    instanceId: this.managerInstanceId,
+                    epoch: o.executor.epoch,
+                    goal: { caller: { ...ref.caller }, goalId: ref.goalId },
+                    holder: { id: MANAGER_ENDPOINT, lifecycleUid: this.managerInstanceId },
+                    deadline: deadlineAt,
+                    now: o.acceptedAt,
+                });
+        }
+        catch (e) {
+            // Nothing launched and nothing was served, so the task is withdrawn with `cancel`.
+            try {
+                await transitionGoal(gw.ctx, ref, "cancelling", { fields: { cancelMode: "terminate" } });
+                await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "cancel", data: { cancelledBy: "manager", reason: "accept-failed" }, committer: { instanceId: this.managerInstanceId, epoch: o.executor.epoch } });
+                await clearGoalIndex(gw.ctx, ref);
+            }
+            catch (e2) {
+                console.error(`! once task accept unwind for ${ref.goalId}: ${rejectionText(e2)}`);
+            }
+            throw e;
+        }
+        this.pendingTurns.set(key, {
+            ref, goalId: ref.goalId, seat: { ...seat }, payload, acceptedAt: o.acceptedAt, holdEpoch: o.executor.epoch,
+            ...(deadlineAt !== undefined ? { deadlineAt, holdToken } : {}),
+            once: { deliverable: false },
+        });
+        this.turnAcceptances.set(key, {
+            acceptance: { name: seat.name, owner: seat.owner, actor: seat.actor, uid: seat.uid, goalId: ref.goalId, fingerprint: o.fingerprint, ...(deadlineAt !== undefined ? { deadlineAt } : {}), executor: o.executor },
+            ref,
+        });
+        this.ensureTurnSweep();
+        this.emitGoalProgress(ref, o.executor.epoch, { phase: "relayed" });
+        return { ref, ...(deadlineAt !== undefined ? { deadlineAt } : {}) };
+    }
+    /** How a once seat's startup watch ended, waited for until {@link STARTUP_OUTCOME_MS} after its
+     *  launch or the readiness window, whichever is longer. A watch that has not ended by then, or a
+     *  seat being stopped, answers what the handle reports at that moment. */
+    async awaitStartupOutcome(a, launchedAt, readinessTimeoutMs) {
+        const until = launchedAt + Math.max(readinessTimeoutMs, STARTUP_OUTCOME_MS);
+        for (;;) {
+            const outcome = a.handle.startupOutcome?.() ?? "pending";
+            if (outcome !== "pending" || a.terminalizing || Date.now() >= until)
+                return outcome;
+            await new Promise((resolve) => setTimeout(resolve, 250));
+        }
+    }
+    /** Serve a once task from now on: its spawn's succeeded terminal is written. */
+    openOnceDelivery(ref) {
+        const p = this.pendingTurns.get(goalKey(ref));
+        if (p?.once === undefined || p.once.deliverable)
+            return;
+        p.once.deliverable = true;
+        this.noticeSeatTurns(p.seat);
+    }
+    /** Stop the seat of a once task that just ended, found by its incarnation and never by its name.
+     *  After the readiness verdict the spawn goal's outcome belongs to that verdict, so the stop lets
+     *  go of the spawn goal first and never cancels it. Before the verdict it is a deliberate stop,
+     *  which cancels the spawn like a despawn does. */
+    endOnceSeat(p, reason) {
+        const a = this.findManagedByTarget({ owner: p.seat.owner, actor: p.seat.actor, lifecycleUid: p.seat.uid });
+        if (a?.once === undefined || a.terminalizing)
+            return;
+        if (p.once?.deliverable)
+            this.agentGoals.delete(a.name);
+        this.stopOnceSeat(a, reason);
+    }
+    /** A once seat's helpers end with its task. A natural exit reaps them in {@link onAgentExit}; a
+     *  stop frees the slot first, so this stop reaps them itself. */
+    stopOnceSeat(a, reason) {
+        this.reapChildrenOf(this.managedPrincipal(a));
+        this.stopHandle(a, true);
+        this.trackStoppedHandle(a, false, { kind: "stopped-once", reason });
+        void this.cancelAgentGoal(a.name, "graceful");
+    }
+    /** The once task's exit hook, on the handle the seat was launched with: whichever path ends the
+     *  seat, its proved exit cancels a task that has no terminal yet and discharges the seat's debt. An
+     *  exit that cannot be proved leaves both. */
+    watchOnceExit(a) {
+        const once = a.once;
+        this.onceWatched.add(goalKey(once.ref));
+        const retire = once.retire === undefined ? undefined : { connector: once.retire, name: a.name, uid: a.lifecycleUid };
+        // A startup watch that failed stopped the seat itself, possibly before the launch read that outcome.
+        void a.handle.waitForExit().then(() => this.settleOnceTurn(once.ref, once.stopReason ?? (a.handle.startupOutcome?.() === "failed" ? "launch-failed" : "seat-exited"), retire), (e) => console.error(`! ${a.name}: its exit could not be proved (${rejectionText(e)}); its once task stays owed`));
+    }
+    /** End a once task that can no longer run: once its connector, when it has a `retire` hook, proves
+     *  the seat's launched processes gone, cancel the task with `reason` if it has no terminal yet,
+     *  then drop its index entry. One flight per task; a failure keeps it in {@link onceSettles} and
+     *  the turn sweep retries it. */
+    settleOnceTurn(ref, reason, retire) {
+        const key = goalKey(ref);
+        const owed = this.onceSettles.get(key) ?? { ref, reason, ...(retire !== undefined ? { retire } : {}) };
+        if (owed.flight)
+            return owed.flight;
+        this.onceSettles.set(key, owed);
+        const flight = this.runOnceSettle(key, owed).finally(() => { owed.flight = undefined; });
+        owed.flight = flight;
+        return flight;
+    }
+    async runOnceSettle(key, owed) {
+        const gw = this.goalWriter;
+        if (!gw)
+            return;
+        // The pending entry is the latch the yield and the deadline race on; a task settled here is
+        // served to no one again.
+        const p = this.pendingTurns.get(key);
+        // A task past its deadline owes the deadline terminal, which the turn sweep writes again until
+        // it lands; the settle waits for it rather than record a cancel in its place.
+        const denyOwed = p?.deadlineAt !== undefined && p.deadlineAt <= Date.now();
+        if (p && !denyOwed) {
+            this.pendingTurns.delete(key);
+            this.markTurnLatchDropped(key);
+            this.noticeSeatTurns(p.seat);
+        }
+        try {
+            if (denyOwed)
+                throw new Error("its deadline terminal is not written yet");
+            // A seat whose exit is proved may have left processes of its own running the task: the task
+            // is not recorded as ended, nor its debt cleared, before they are proved gone.
+            const retired = owed.retire === undefined ? undefined : await this.retireOnceSeat(owed.retire);
+            await this.commitOnceCancel(owed.ref, owed.reason);
+            await clearGoalIndex(gw.ctx, owed.ref);
+            this.onceSettles.delete(key);
+            this.onceWatched.delete(key);
+            await retired?.discard().catch((e) => console.error(`! once task ${owed.ref.goalId}: its retirement receipt was not discarded (${rejectionText(e)})`));
+        }
+        catch (e) {
+            console.error(`! once task ${owed.ref.goalId} (${owed.reason}): ${rejectionText(e)}; retried by the turn sweep`);
+            this.ensureTurnSweep();
+        }
+        this.maybeStopTurnSweep();
+    }
+    /** Cancel a once task with `reason` unless it already has a terminal. */
+    async commitOnceCancel(ref, reason) {
+        const gw = this.goalWriter;
+        if ((await readGoalResult(gw.ctx, ref)) !== undefined)
+            return;
+        const epoch = this.serviceServe?.grant.epoch ?? 0;
+        await this.assertGoalWriterEpochCurrent(epoch);
+        if ((await readGoalStatus(gw.ctx, ref))?.value.state !== "cancelling")
+            await transitionGoal(gw.ctx, ref, "cancelling", { fields: { cancelMode: "terminate" } });
+        const { fact } = await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "cancel", data: { cancelledBy: "manager", reason }, committer: { instanceId: this.managerInstanceId, epoch } });
+        this.emitGoalProgress(ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
+        this.rememberSettledTurn(goalKey(ref), fact.state, Date.now());
+    }
+    /** Ask the seat's connector to prove its launched processes gone, within {@link ONCE_RETIRE_MS}.
+     *  Throws without that proof. */
+    async retireOnceSeat(r) {
+        const connector = await this.resolveConnector(r.connector);
+        if (!connector.retireAfterExit)
+            throw new Error(`the ${r.connector} connector cannot prove seat ${r.name}'s launched processes gone`);
+        return withTimeout(connector.retireAfterExit({ space: this.space, name: r.name, lifecycleUid: r.uid, workspaceRoot: this.workspaceRoot }), ONCE_RETIRE_MS, `seat ${r.name}'s launched processes were not proved gone within ${ONCE_RETIRE_MS}ms`);
+    }
+    /** Record a once task a predecessor accepted, and bind its seat if this incarnation already
+     *  adopted it. The static adoption and the goal reconcile run in either order, so each side
+     *  binds what the other has already found. */
+    async inheritOnce(ref, allocated, note) {
+        this.onceInherited.set(allocated.uid, {
+            ref, seat: { name: allocated.name, owner: allocated.owner, actor: allocated.actor, uid: allocated.uid },
+            ...(note.deadlineAt !== undefined ? { deadlineAt: note.deadlineAt } : {}),
+            readinessMs: allocated.readinessDeadlineMs ?? this.readinessTimeoutMs,
+            ...(note.retire !== undefined ? { retire: note.retire } : {}),
+        });
+        const a = this.findManagedByTarget({ owner: allocated.owner, actor: allocated.actor, lifecycleUid: allocated.uid });
+        if (a !== undefined)
+            await this.bindOnceSeat(a);
+        this.ensureTurnSweep();
+    }
+    /** An inherited once task whose seat this manager cannot hold: it adopts no seats (an open or
+     *  user-mode mesh) and the seat is not bound here. */
+    onceSeatUnheld(p) {
+        return p.once !== undefined && this.onceInherited.has(p.seat.uid) && !(this.auth !== undefined && !this.userMode);
+    }
+    /** Whether a once task was served: its spawn's succeeded terminal is written. */
+    async onceServed(ref, note) {
+        if (note.spawn === undefined)
+            return false;
+        const spawn = await readGoalResult(this.goalWriter.ctx, { endpoint: ref.endpoint, caller: ref.caller, goalId: note.spawn });
+        return spawn?.state === "succeeded";
+    }
+    /** Make an adopted seat a once seat again: its exit settles its task, and the task is served to
+     *  it. A task that ended before the restart owes the stop the predecessor may not have made. */
+    async bindOnceSeat(a) {
+        const inherited = this.onceInherited.get(a.lifecycleUid);
+        if (inherited === undefined || a.once !== undefined)
+            return;
+        this.onceInherited.delete(a.lifecycleUid);
+        a.once = { ref: inherited.ref, ...(inherited.retire !== undefined ? { retire: inherited.retire } : {}) };
+        this.watchOnceExit(a);
+        const p = this.pendingTurns.get(goalKey(inherited.ref));
+        if (p?.once) {
+            p.once.deliverable = true;
+            this.noticeSeatTurns(p.seat);
+            return;
+        }
+        const ended = this.goalWriter ? await readGoalResult(this.goalWriter.ctx, inherited.ref) : undefined;
+        if (ended !== undefined)
+            this.stopOnceSeat(a, "turn-ended");
+    }
+    /** Inherited once tasks whose seat is not bound here. On a static mesh the boot reconcile adopts
+     *  every seat it can and reaps the rest by their custody reference, so once it has finished with
+     *  a seat's slot, an unbound seat is proved gone. A manager that adopts no seats cannot reach the
+     *  old seat or prove its exit: it does not serve the task to it, a task with a deadline ends at
+     *  that deadline, and one without is settled `uncertain` after one readiness window. Its debt is
+     *  never cleared here, since nothing proves that seat gone. */
+    async settleInheritedOnce() {
+        const gw = this.goalWriter;
+        if (!gw || !this.goalReconcileDone)
+            return;
+        const adopts = this.auth !== undefined && !this.userMode;
+        for (const [uid, d] of [...this.onceInherited]) {
+            const live = this.findManagedByTarget({ owner: d.seat.owner, actor: d.seat.actor, lifecycleUid: uid });
+            if (live !== undefined) {
+                await this.bindOnceSeat(live);
+                continue;
+            }
+            if (adopts) {
+                const reconciling = this.staticReconcileSweepsInFlight > 0
+                    || [...this.staticReconcileItems.values()].some((i) => i.lifecycleUid === uid && i.disposition !== "recovered");
+                if (reconciling)
+                    continue;
+                this.onceInherited.delete(uid);
+                void this.settleOnceTurn(d.ref, "seat-exited", retireOf(d));
+                continue;
+            }
+            if ((await readGoalResult(gw.ctx, d.ref)) !== undefined) {
+                this.onceInherited.delete(uid);
+                this.keepUnprovedOnceDebt(d);
+                continue;
+            }
+            if (d.deadlineAt !== undefined || Date.now() - this.goalReconcileDoneAt < d.readinessMs)
+                continue;
+            this.onceInherited.delete(uid);
+            const key = goalKey(d.ref);
+            this.pendingTurns.delete(key);
+            this.markTurnLatchDropped(key);
+            try {
+                await settleGoalUncertain(gw.ctx, { ref: d.ref, now: Date.now(), committer: { instanceId: this.managerInstanceId, epoch: this.serviceServe?.grant.epoch ?? 0 }, reason: `the manager restarted and could not reach the seat; ${UNHELD_SEAT}, and the task may have run in part or in full` });
+                this.keepUnprovedOnceDebt(d);
+            }
+            catch (e) {
+                console.error(`! inherited once task ${d.ref.goalId}: ${rejectionText(e)}`);
+            }
+        }
+    }
+    /** An inherited task's seat this manager cannot reach: its terminal stands, and its index entry,
+     *  the seat's debt, stays recorded, because nothing here can prove that seat gone. The seat is
+     *  told to end itself on its next pull, and its notice repeats until a pull carries that. */
+    keepUnprovedOnceDebt(d) {
+        console.error(`! once task ${d.ref.goalId}: this manager cannot reach seat ${d.seat.name}/${d.seat.uid} to prove it gone; its debt stays in the goal index, and the seat is told to end itself`);
+        this.onceStops.set(d.seat.uid, { ...d.seat });
+        this.noticeSeatTurns(d.seat);
         this.ensureTurnSweep();
     }
     /** Settle race: a despawn MID-GOAL drives the goal's cancel terminal - transition to
@@ -9750,6 +10428,7 @@ export class Manager {
         this.agents.set(entry.name, managed);
         this.watchExit(managed);
         console.error(`! ${entry.name}: adopted the seat its previous manager left (${row.runtime.kind}:${row.runtime.id})`);
+        await this.bindOnceSeat(managed);
         // A credential that came close to its expiry while no manager ran is renewed now, not at the
         // next pass.
         const health = inspectCredHealth(stored).state;