@cotal-ai/manager 0.16.0 → 0.18.0

package/dist/manager.js

@@ -3,14 +3,30 @@ import { createHash, randomUUID, randomBytes } from "node:crypto";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, readFileSync, rmSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
-import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_TTL_MS, STANDING_RENEWABLE_TTL_SEC, agentFilePath, clearSpaceHistory, connectorServers, deprovisionAgent, firstFreeName, idFromCreds, loadAgentFile, loadCotalConfig, mintCreds, mintLifecycleUid, mkSecretDir, newIdentity, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, CONTROL_PRIVILEGED, CONTROL_SELF_SERVICE, CONTROL_ADMIN, CONTROL_AUTH_ADMIN, controlServiceSubject, } from "@cotal-ai/core";
-import { agentActorTokenKey, agentAuthState, agentCredsDir, agentCredsKey, agentSecretFilePaths, agentSentinelCredsKey, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KEY, findCotalRoot, getSpaceAuth, hasUserAuthState, loadMeshes, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KEY, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
+import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_TTL_MS, STANDING_RENEWABLE_TTL_SEC, agentFilePath, clearSpaceHistory, connectorServers, deprovisionAgent, firstFreeName, idFromCreds, inspectCredHealth, loadAgentFile, loadCotalConfig, mintCreds, mintLifecycleUid, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, } from "@cotal-ai/core";
+import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KEY, findCotalRoot, getSpaceAuth, hasUserAuthState, loadManagerInstanceIdentity, loadMeshes, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KEY, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, saveManagerInstanceIdentity, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, } from "./runtime/index.js";
-import { AttachEndpoint, attachHost } from "./attach-endpoint.js";
+import { AttachEndpoint } from "./attach-endpoint.js";
+import { makeManagerEndpointEvictor } from "./endpoint-evict.js";
 import { launchSpecForRun, materializePersona, launchAgentToStartOpts, parseLaunchSpec, persistLaunchSpec } from "./launch.js";
 import { authorizeLaunch, authorizeNamedControl } from "./authorize.js";
 import { controlShutdown } from "./control-shutdown.js";
 import { parseResumeCommitArgs, parseResumeControlArgs, parseResumeFinalizeArgs } from "./resume.js";
+// Unit B (the static §13.1 lifecycle executor): the shared grammar/stores from core plus the
+// manager-side adapter (transport + slot orchestration + the F1 terminal) — see static-lifecycle.ts.
+import { jetstreamManager } from "@nats-io/jetstream";
+import { Kvm } from "@nats-io/kv";
+import { recordsBucket, epAuthBucket, ensureAuthorityStores, ensureContractStore, createEndpointStreams, contractStoreContext, publishContractArtifact, contractArtifactCanonicalBytes, standaloneConnectOpts, STATIC_SLOT_PREFIX, rawDigest, STANDING_RENEWABLE_TTL_SEC as MANAGED_STATIC_TTL_SEC, newArtifactSigner, sessionsBucket, SESSION_GRANT_MAX_TTL_MS, } from "@cotal-ai/core";
+// P2 item 6: the manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
+// standup for `attach`, over a dedicated standing session-LEDGER connection (the byte rails ride
+// per-session credentials on their own short-lived connections).
+import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
+// P2 item 1 (1a-serve): the manager as an ordinary v0.4 `service` endpoint — the §13.1
+// endpoint-serve credential subsystem (gate provisioning, registration barrier, mint fence) plus
+// the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
+import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, registerServiceInstance, authorizeServeGrant, writeServiceStatus, SERVICE_READY, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, } from "@cotal-ai/core";
+import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
+import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, } from "./static-lifecycle.js";
 /** Concurrency ceiling — the manager refuses to hold more than this many live + in-flight +
  *  cooling slots at once (P4a). Bounds a fork-bomb: spawn is a full agent process per call. */
 const MAX_AGENTS = 50;
@@ -75,17 +91,65 @@ function withTimeout(p, ms, msg) {
 function sameStrings(a, b) {
     return JSON.stringify([...(a ?? [])].sort()) === JSON.stringify([...(b ?? [])].sort());
 }
-/**
- * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
- * It serves control requests on the "manager" service and spawns/kills agents
- * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
- * mesh traffic — terminal I/O streams over its own attach endpoint instead.
- */
+/** One ep request/reply round-trip on the caller's OWN reply-plane filter (§13.2). The responder
+ *  derives the reply subject from the authenticated request, so there is no caller-selected reply
+ *  target to honour; the caller binds the answer off the reply SUBJECT — endpoint and nonce, both
+ *  broker-pinned by the responder's serve publish grant. A reply on another nonce belongs to a
+ *  different request (the rail is shared) and is ignored rather than allowed to fail this one. */
+export async function epAwaitReply(nc, space, caller, nonce, requestId, requestSubject, body, timeoutMs) {
+    let sub;
+    let timer;
+    try {
+        const got = new Promise((resolve, reject) => {
+            sub = nc.subscribe(epCallerReplyFilter(space, caller), {
+                callback: (err, msg) => {
+                    if (err) {
+                        reject(new Error(`the retirement reply subscription failed: ${err.message}`));
+                        return;
+                    }
+                    const parsed = parseEpSubject(msg.subject);
+                    if (!parsed || parsed.plane !== "reply" || parsed.endpoint !== AUTH_ENDPOINT || parsed.nonce !== nonce)
+                        return;
+                    let body;
+                    try {
+                        body = JSON.parse(new TextDecoder().decode(msg.data));
+                    }
+                    catch {
+                        return;
+                    } // a malformed body on our nonce is not an answer; keep waiting
+                    // REQUIRE THE ID ECHO. Binding on (endpoint, nonce) alone would accept a malformed or
+                    // WRONG-ID `{ok:true}` and clear a retirement hold on it. Ignore rather than fail: the
+                    // rail is shared across concurrent requests and a responder may publish at any nonce, so
+                    // an unmatched reply is someone else's answer, never grounds to fail the honest one.
+                    if (body.id !== requestId)
+                        return;
+                    resolve(body);
+                },
+            });
+            timer = setTimeout(() => reject(new Error("timeout")), timeoutMs);
+            nc.publish(requestSubject, new TextEncoder().encode(body));
+        });
+        return await got;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        try {
+            sub?.unsubscribe();
+        }
+        catch { /* connection already down */ }
+    }
+}
 export class Manager {
     space;
     servers;
+    /** P2 item 6: the broker ws listener port (loopback) `cotal up` allocated, for the console session
+     *  client's wsUrl. Undefined ⇒ no console session client (POST /session 503s). */
+    wsPort;
     name;
     workspaceRoot;
+    /** P2 item 6: the operator-set global live-session ceiling (see {@link ManagerOptions.maxSessions}). */
+    maxSessions;
     /** The ONE secret store for every kind this manager touches (daemon-cred remint + agent kinds).
      *  See {@link ManagerOptions.secretStore}. */
     secrets;
@@ -115,6 +179,82 @@ export class Manager {
      *  same-name SUCCESSOR (which can spawn after the hold clears but before this flight's `nc.close`
      *  yield settles) never joins the predecessor's rail request and skips its own retirement. */
     retiringFlight = new Map();
+    /** Wire principals of RETIRED static incarnations (Unit B, F5(a)): populated at every completed
+     *  static terminal and from the boot sweep's retired slot rows, so a copied credential of a
+     *  retired incarnation is refused at the control surface even across a manager restart. The
+     *  durable truth is the slot row + principal-keyed head; this set is the in-memory index of it
+     *  (one string per retired incarnation — bounded by lifecycle count, never pruned in-process). */
+    retiredPrincipals = new Set();
+    /** This manager process's own incarnation uid (SPEC 13.1; minted once per supervisor process,
+     *  never reused across restarts) — the endpoint's presence key AND the `managerInstance` audit
+     *  coordinate every static activation records. */
+    managerLifecycleUid = mintLifecycleUid();
+    /** The persisted LOGICAL instance id (SPEC 13.6 item 7, P2 item 3): STABLE across restart, so a
+     *  restart re-registers the SAME id with an ADVANCED epoch through the §13.1 gate (the successor
+     *  fences the predecessor's epoch — the (i) fence bites on a real restart). It is the registration
+     *  instanceId, the served-status id, the goal spec's executor.instanceId, the epe route, and the
+     *  resolveExecutorEpoch key — DISTINCT from {@link managerLifecycleUid} (per-process: the presence
+     *  node uid + the managerInstance audit coordinate every static activation records). Set in start(). */
+    managerInstanceId;
+    /** The persisted serve nkey identity: reusing the SAME principal across restart keeps
+     *  {@link provisionEndpointGateOpen} idempotent (no core barrier change) and gives verified
+     *  eviction a stable target (the predecessor's connections under this principal). Set in start(). */
+    managerServeIdentity;
+    /** P2 item 1 (1a-serve): the manager's v0.4 service-endpoint serve state — the serve handle +
+     *  its dedicated connection, the STABLE serve identity (renewals re-mint the same nkey), the
+     *  branded serve grant, and the CURRENT credential (the connection's authenticator reads it on
+     *  every (re)connect, so a renewal is adopted without re-registration). Absent on open meshes,
+     *  in user mode (the named 1a follow-up), and before registration completes. */
+    serviceServe;
+    /** P2 item 2 (spawn-as-action): the SELF-MEDIATED goal-writer connection + ActionContext — a
+     *  standing connection DISJOINT from the serve credential (Q2), scoped to exactly this endpoint's
+     *  goal bind/terminal facts + goal-record writes ({@link goalWriterGrants}). Auth mode mints the
+     *  `goal-writer` cred; an open mesh uses a bare connection (no credential system to mint from).
+     *  `gate` (auth mode) is the own-issuance-gate READER for the must-5 (a) currency belt — the
+     *  manager reads its OWN `epgate.<e>.<iid>` epoch over this connection before a terminal commit
+     *  and skips a superseded commit (the fast-fail belt paired with the (b) barrier-revoke fence). */
+    goalWriter;
+    /** P2 item 2 must-5 (b): the STABLE goal-writer identity (auth mode) — minted once at
+     *  registration alongside the serve identity; a renewal re-mints the SAME nkey with a fresh
+     *  bounded exp and re-stages its distinct credId into the §13.1 revocation family. The current
+     *  goal-writer credential is minted INSIDE {@link registerManagerService}'s run block (fence
+     *  live) and stashed here for {@link startGoalWriter} to build the standing connection from. */
+    goalWriterIdentity;
+    goalWriterCreds;
+    /** P2 item 6: the manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
+     *  standup for `attach`. The face's establisher and the CLI attach handler both call THIS one
+     *  plane; the manager never constructs a second. Undefined until {@link startSessionPlane}. */
+    sessionPlane;
+    /** P2 item 6: the standing session-LEDGER connection + its mutable creds holder (the authenticator
+     *  presents the refreshed cred on the next reconnect after a half-TTL renewal — the goal-writer
+     *  precedent). Auth mode only; an open mesh runs the plane over a bare connection. */
+    sessionLedgerConn;
+    /** P2 item 6: credentialId → the nkey that credential was minted for, for the live per-session
+     *  SERVING credentials. The §13.1 ledger row records the holder principal, and the row is written
+     *  at stage time (after the mint), so the two steps need this one hop. Entries are dropped at
+     *  revoke; a session that never staged drops its entry when the manager exits. */
+    sessionServingKeys = new Map();
+    /** P2 item 6: the STABLE session-LEDGER identity (auth mode) — minted once at registration
+     *  alongside the serve + goal-writer identities; a renewal re-mints the SAME nkey with a fresh
+     *  bounded exp and re-stages its distinct credId into the §13.1 revocation family. The current
+     *  credential is minted INSIDE {@link registerManagerService}'s run block and stashed here. */
+    sessionLedgerIdentity;
+    sessionLedgerCreds;
+    /** P2 item 2: the acceptance replied for each in-flight goalId this incarnation accepted, so an
+     *  idempotent same-goalId retry serves the IDENTICAL acceptance (same allocated name/triple) without
+     *  a second spawn. Durable cross-incarnation reconstruction rides the must-5 goal-index; here the
+     *  live map covers same-incarnation retries, with the committed result fact as the fallback. */
+    goalAcceptances = new Map();
+    /** P2 item 2 must-5 Q-B: the boot reconcile of the durable goal index runs ONCE at start (a
+     *  fresh incarnation inherits the endpoint's accepted-but-unterminal goals from any predecessor).
+     *  Spawn-as-action REFUSES to accept until it completes, so the sweep never races a live goal's
+     *  acceptance (settling one mid-flight would steal its real terminal). */
+    goalReconcileDone = false;
+    /** P2 item 2 (M4): the live spawn goal ref for each managed agent name, so a despawn MID-GOAL
+     *  drives the cancel path (transition -> cancel terminal). Cleared when the goal terminalizes. */
+    agentGoals = new Map();
+    /** Process start, for the served `status` uptime. */
+    startedAtMs = Date.now();
     /** SINGLE-FLIGHT guard for {@link deprovision} (INT-2/C): one in-flight teardown per
      *  (name, lifecycleUid). The detached freeSlot teardown and every same-name-spawn nudge that
      *  re-drives it JOIN one promise instead of launching a SECOND, concurrent teardown. Without it,
@@ -168,6 +308,7 @@ export class Manager {
         this.servers = opts.servers;
         this.name = opts.name ?? "manager";
         this.workspaceRoot = opts.workspaceRoot ?? findCotalRoot();
+        this.maxSessions = opts.maxSessions;
         this.secrets = opts.secretStore ?? workspaceSecretStore(this.workspaceRoot);
         this.installedExtensions = opts.installedExtensions ?? false;
         this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
@@ -181,16 +322,19 @@ export class Manager {
         this.resumeAttemptId = opts.resumeAttemptId;
         this.resumeRequired = opts.resumeAttemptId !== undefined;
         this.resumeDurableCommitToken = opts.resumeDurableCommitToken;
-        this.attach = new AttachEndpoint((name) => this.maintenanceState === "active" && !this.resumeRequired ? this.agents.get(name)?.handle : undefined, () => this.list(), 
+        this.wsPort = opts.wsPort;
+        this.attach = new AttachEndpoint(() => this.list(), 
         // Initial /feed replay for a connecting console: the current peer roster.
         () => [{ event: "roster", data: this.ep?.getRoster() ?? [] }], opts.consolePort ?? 0, 
+        // P2 item 6: the console's mesh §13.6 session establisher — injected ONLY when a broker ws
+        // listener exists (cotal up allocated a wsPort). Never a second plane; it drives THE plane.
+        opts.wsPort !== undefined ? (name) => this.establishConsoleSession(name) : undefined, 
         // Loopback unless the OPERATOR said otherwise. A broker *dial* address is not a manager *bind*
         // address: deriving one from the other breaks every topology where they differ (a manager
         // supervising a broker on another host cannot bind that host's address at all, and a failover
-        // list's first entry need not be the server actually selected), and it would silently couple
-        // terminal exposure to `up --host`. Exposure is therefore an explicit decision, which
-        // `cotal up` passes down when it binds the broker somewhere reachable; every other caller — an
-        // embedded Manager, a bare `cotal supervise` — keeps the loopback-only endpoint it always had.
+        // list's first entry need not be the server actually selected). Exposure is therefore an
+        // explicit decision; every other caller — an embedded Manager, a bare `cotal supervise` —
+        // keeps the loopback-only console it always had.
         opts.attachHost ?? "127.0.0.1");
     }
     get runtimeKind() {
@@ -220,6 +364,24 @@ export class Manager {
             throw new Error(`space "${this.space}" has user-auth state on disk but no mesh registry entry - a user-mode manager needs the authoritative record (\`cotal up\` writes it before the control plane); \`cotal up --user-auth\` this space, or remove the stale ${userAuthStateDir(this.workspaceRoot, this.space)}`);
         if (this.userMode && !this.auth)
             throw new Error(`space "${this.space}" has user-auth state but no auth.json under ${authDir(this.workspaceRoot)} - the pre-flip manager still needs the space trust bundle; re-run \`cotal up --user-auth\` here`);
+        // P2 item 3 (SPEC 13.6 item 7): the LOGICAL instance id + serve identity PERSIST across restart
+        // (a space-scoped manager identity file under .cotal). A restart re-registers the SAME id with an
+        // ADVANCED epoch (the successor fences the predecessor); a fresh mint over a malformed file is
+        // refused loud (no-fallbacks - a restart never silently becomes a fresh instance). A second
+        // manager in a DIFFERENT workspace root is a DIFFERENT logical id by construction (its own state
+        // dir) - two managers in ONE space are two workspace roots.
+        {
+            const persisted = loadManagerInstanceIdentity(this.workspaceRoot, this.space);
+            if (persisted !== undefined) {
+                this.managerInstanceId = persisted.instanceId;
+                this.managerServeIdentity = persisted.serveIdentity;
+            }
+            else {
+                this.managerInstanceId = mintLifecycleUid();
+                this.managerServeIdentity = newIdentity();
+                saveManagerInstanceIdentity(this.workspaceRoot, this.space, { instanceId: this.managerInstanceId, serveIdentity: this.managerServeIdentity });
+            }
+        }
         let creds;
         let id;
         if (this.auth) {
@@ -244,9 +406,10 @@ export class Manager {
             creds,
             // The supervisor registers on the roster, and an authed presence-registering endpoint is
             // lifecycle-keyed (SPEC 13.1, fail-before-presence). The manager process is the top of its
-            // own launch chain (the operator command IS its launcher), so it mints its incarnation's
-            // uid here - one per supervisor process, never reused across restarts.
-            lifecycleUid: mintLifecycleUid(),
+            // own launch chain (the operator command IS its launcher): its incarnation uid is the
+            // per-process `managerLifecycleUid` field (also the `managerInstance` audit coordinate on
+            // every static activation, Unit B).
+            lifecycleUid: this.managerLifecycleUid,
             // The supervisor serves control + watches presence; it never consumes chat/dm/task
             // (no message handler). consume:false avoids binding consumers it doesn't use — and
             // under auth avoids trying to bind its own DM/task durables that nothing pre-created.
@@ -263,38 +426,39 @@ export class Manager {
         this.ep.on("error", (e) => console.error(`! manager endpoint: ${e.message}`));
         await this.ep.start();
         await this.ep.setActivity(`supervisor (${this.runtime.kind})`);
-        // Singleton guard: exactly one manager per space. Acquire the lease (atomic CAS create); if a live
-        // manager already holds it, REFUSE to start (fail loud) rather than become a second supervisor that
-        // queue-splits control with the incumbent. A crashed holder's lease auto-expires (bucket TTL).
-        this.leaseInfo = { holder: this.ep.ref().id, runtime: this.runtime.kind, root: resolve(this.workspaceRoot), pid: process.pid };
+        // Per-instance liveness lease (P2 item 3 — the old per-space singleton is DEMOTED per D9). Acquire
+        // THIS logical instance's own key (atomic CAS create). A DIFFERENT instance (a second manager in a
+        // second workspace root) has a distinct id ⇒ a distinct key ⇒ it coexists; the create THROWS only
+        // when the SAME instance id is already live (a same-root double-start, or a restart racing the
+        // crashed predecessor's not-yet-expired key), and we REFUSE loud. A crashed holder's key auto-expires
+        // (bucket TTL). Losing this key later stops THIS instance only, never the space (security pin 6).
+        this.leaseInfo = { holder: this.ep.ref().id, instanceId: this.managerInstanceId, runtime: this.runtime.kind, root: resolve(this.workspaceRoot), pid: process.pid };
         try {
             this.leaseRevision = await this.ep.acquireManagerLease(this.leaseInfo);
         }
         catch (e) {
-            // A live holder ⇒ refuse (the singleton point). Anything else (e.g. a KV/JS error) is a real
-            // failure to surface, not a silent "held" — keep the cause so it isn't misread as a conflict.
+            // Our OWN instance id already holds a live key ⇒ refuse. Anything else (e.g. a KV/JS error) is a
+            // real failure to surface, not a silent "held" — keep the cause so it isn't misread as a conflict.
             const held = await this.ep.readManagerLease().catch(() => undefined);
             await this.ep.stop();
             await this.attach.stop();
             throw new Error(held
-                ? `a manager already serves space "${this.space}" (id ${held.holder}, ${held.runtime}, pid ${held.pid}, root ${held.root}) - stop it first; one manager per space`
+                ? `manager instance ${this.managerInstanceId} already serves space "${this.space}" from this workspace root (${held.runtime}, pid ${held.pid}, root ${held.root}) - stop it first before restarting the same instance`
                 : `could not acquire the manager lease for space "${this.space}": ${e.message}`);
         }
         this.leaseTimer = setInterval(() => { void this.renewLease(); }, MANAGER_LEASE_TTL_MS / 2);
         this.leaseTimer.unref?.();
-        // Serve all three control tiers (P2a): self-service (no-name self stop/despawn), privileged
-        // (start / own-child stop-despawn-attach / own definePersona), and admin (purge / cross-agent
-        // stop-despawn-attach / cross-agent definePersona). The cred layer grants self-service to every
-        // agent, privileged only to spawn-capable ones, and admin only to the manager's own profile
-        // (no agent ever reaches it); the handler then routes by op↔tier (fail-closed on mismatch) so a
-        // misrouted op is rejected before anything acts.
-        // `boundReply` (closure (i)): each tier replies ONLY into the requester's own subtree
-        // (`${reqSubject}.reply.…`), never the per-id `_INBOX`. This both keeps the confused-deputy guard
-        // (a caller can't redirect a reply onto a peer's lane) AND lets the manager cred drop its position-1
-        // inbox publish wildcard — callers subscribe `ctl.<tier>.<id>.reply.>`, granted per tier they may call.
-        this.ep.serveControl(CONTROL_PRIVILEGED, (req) => this.handle(req, CONTROL_PRIVILEGED), { boundReply: true });
-        this.ep.serveControl(CONTROL_SELF_SERVICE, (req) => this.handle(req, CONTROL_SELF_SERVICE), { boundReply: true });
-        this.ep.serveControl(CONTROL_ADMIN, (req) => this.handle(req, CONTROL_ADMIN), { boundReply: true });
+        // Unit B (static §13.1): ensure the two authority stores exist with their normative shape,
+        // then sweep the durable slot rows and reconcile — re-drive any crashed activation/terminal
+        // (exact-op) and terminalize dead-but-active slots (F3 "no active orphan"). Runs ONLY under
+        // the just-acquired lease (a refused second manager must never sweep-terminal live slots) and
+        // BEFORE control serving, so no spawn races the reconciliation.
+        if (this.auth && !this.userMode)
+            await this.reconcileStaticLifecycles();
+        // P2 item 1 (1d): the manager serves NO ctl tiers - its whole control surface is the v0.4
+        // service endpoint registered below. The old three-tier rail (self/manager/admin) is deleted;
+        // `ctl.delivery`/`ctl.delivery-admin` (the delivery daemon) and `ctl.auth-admin` (the auth
+        // plane) are separate services and keep their rails.
         // D5 slice 5 class 2: the manager is the CLASS-2 RENEWAL OWNER — the one control-plane process
         // that is resident in EVERY mesh mode (foreground `up`, `up --detach`, same-root refresh) and
         // holds the signer. Ordered initial pass NOW (ensureControlPlane starts delivery BEFORE the
@@ -306,6 +470,24 @@ export class Manager {
             this.credRenewTimer = setInterval(() => { void this.renewDaemonCreds(); }, (STANDING_RENEWABLE_TTL_SEC / 2) * 1000);
             this.credRenewTimer.unref?.();
         }
+        // P2 item 1: register the manager as an ordinary v0.4 `service` endpoint (SPEC §13.7/§13.9)
+        // and serve its typed command surface on the ep rails - since 1d the ONLY control door, in
+        // EVERY mesh mode. Static + user meshes mint the scoped executor + endpoint-serve credential;
+        // an open mesh runs the same gate/registration ceremony over bare connections and never mints
+        // (there is no credential system - the broker enforces nothing, matching the old open-mesh ctl
+        // trust). Fail-loud: a manager that cannot register does not start half-registered.
+        await this.registerManagerService();
+        // P2 item 2: stand up the standing goal-writer connection for spawn-as-action — AFTER
+        // registration (it writes this endpoint's goal facts/records), disjoint from the serve cred.
+        await this.startGoalWriter();
+        // P2 item 6: stand up the ONE §13.6 session plane for `attach` — AFTER registration too (it
+        // rides the serve grant's epoch + the family-staged session-ledger cred), on its own standing
+        // connection disjoint from both the serve and goal-writer creds.
+        await this.startSessionPlane();
+        // P2 item 2 must-5 Q-B: reconcile any accepted-but-unterminal goals inherited from a predecessor
+        // BEFORE spawn-as-action begins accepting (the goalReconcileDone gate) — a fresh incarnation
+        // never drops a goal a dead predecessor accepted. Never fatal; the gate opens either way.
+        await this.reconcileGoalIndex();
         // Plane-3 (durable backstop) is NOT the manager's job — the manager only manages agent lifecycle.
         // The server-side delivery daemon hosts the fan-out writer + trusted reader, owns the durable
         // membership registry, and serves the runtime durable join/leave/list ops (on `ctl.delivery`). The
@@ -364,6 +546,97 @@ export class Manager {
             // `writeRenewalRecord` redacts the ephemeral fingerprint at the persistence boundary (covering
             // the `doctor auth --fix` writer too), so the results pass straight through.
             writeRenewalRecord(this.workspaceRoot, { ts: new Date().toISOString(), owner: "manager", results, adoption });
+            this.warnOnSystemCredExpiry();
+            // F5(b) (Unit B): the MANAGER is the renewal owner for its managed-static agent creds —
+            // supervisor-side PUSH remint for recorded LIVE slots (the child JWT is never proof of
+            // incarnation; a copied credential cannot drive this and is stranded at its own row's TTL).
+            // Same class-2 mechanics as the daemon creds: re-sign the file for the SAME nkey; the
+            // agent endpoint's 75% source re-read adopts it.
+            if (!this.userMode) {
+                for (const a of [...this.agents.values()]) {
+                    // The `terminalizing` test here is an OPTIMISATION, NOT THE GUARD. There are awaits below
+                    // it, so an agent can latch mid-iteration and this filter will have already let it
+                    // through — what actually refuses is the same test at the top of
+                    // {@link renewManagedStaticCred}, which every renewal on this path goes through.
+                    // COUPLING: deleting or weakening that check silently promotes this line from an
+                    // optimisation into the whole guard, and nothing fails at the moment of the change.
+                    if (a.userOwner || a.terminalizing || !a.seed || !a.secretPaths?.creds)
+                        continue;
+                    try {
+                        const stored = await this.secrets.get(agentSecretKeyForFile(a.secretPaths.creds));
+                        if (stored === undefined)
+                            continue; // no materialized cred (never minted here) - nothing to renew
+                        const health = inspectCredHealth(stored);
+                        if (health.state === "healthy")
+                            continue;
+                        if (health.state === "unbounded" || health.state === "unreadable") {
+                            console.error(`! managed cred renewal ${a.name}: credential is ${health.state}${health.error ? ` (${health.error})` : ""} - not renewed (a pre-TTL credential stays as minted until respawn)`);
+                            continue;
+                        }
+                        await this.renewManagedStaticCred(a);
+                    }
+                    catch (e) {
+                        console.error(`! managed cred renewal ${a.name}: ${e.message} - the agent dies loud at this cred's expiry unless it is reminted`);
+                    }
+                }
+            }
+            // P2 item 1 (checklist 7): the manager is the `endpoint-serve` renewal owner for its OWN
+            // service credential — re-mint the SAME serve identity with a fresh bounded exp THROUGH the
+            // §13.1 mint fence over a scoped one-shot executor (every renewal stages a distinct ledger
+            // row and wins the gate CAS; never the standing connection). The serve connection's
+            // authenticator presents the refreshed credential on its next (re)connect.
+            if (this.serviceServe?.creds && this.auth) {
+                const s = this.serviceServe;
+                const authRef = this.auth;
+                try {
+                    const health = inspectCredHealth(this.serviceServe.creds);
+                    if (health.state !== "healthy") {
+                        s.creds = await this.withEndpointServeExecutor(({ authKv }) => mintCreds(authRef, s.identity, "endpoint-serve", {
+                            serveIssuance: serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId }),
+                            endpointServe: s.grant,
+                        }));
+                    }
+                }
+                catch (e) {
+                    console.error(`! endpoint-serve renewal: ${e.message} - the manager's service endpoint dies loud at this cred's expiry unless it is re-registered`);
+                }
+            }
+            // P2 item 2 must-5 (b): the manager is also the goal-writer's renewal owner — re-mint the SAME
+            // goal-writer nkey with a fresh bounded exp AND re-stage its new credId into the §13.1 family,
+            // through the scoped executor (never the standing seed). Without this the standing goal-writer
+            // connection dies at its TTL and spawn-as-action stops accepting until a restart. The
+            // connection's authenticator presents the refreshed credential on its next (re)connect.
+            if (this.goalWriter && this.goalWriterCreds && this.auth) {
+                const gw = this.goalWriter;
+                try {
+                    if (inspectCredHealth(this.goalWriterCreds).state !== "healthy") {
+                        const fresh = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageGoalWriter(authKv));
+                        this.goalWriterCreds = fresh;
+                        gw.creds = fresh;
+                    }
+                }
+                catch (e) {
+                    console.error(`! goal-writer renewal: ${e.message} - spawn-as-action stops accepting at this cred's expiry unless the manager restarts`);
+                }
+            }
+            // P2 item 6: the manager is also the session-ledger's renewal owner — re-mint the SAME nkey
+            // with a fresh bounded exp AND re-stage its new credId into the §13.1 family, through the
+            // scoped executor. Without this the standing session-ledger connection dies at its TTL and
+            // `attach` stops establishing sessions until a restart. The connection's authenticator presents
+            // the refreshed credential on its next (re)connect.
+            if (this.sessionLedgerConn && this.sessionLedgerCreds && this.auth) {
+                const sw = this.sessionLedgerConn;
+                try {
+                    if (inspectCredHealth(this.sessionLedgerCreds).state !== "healthy") {
+                        const fresh = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageSessionLedger(authKv));
+                        this.sessionLedgerCreds = fresh;
+                        sw.creds = fresh;
+                    }
+                }
+                catch (e) {
+                    console.error(`! session-ledger renewal: ${e.message} - attach stops establishing sessions at this cred's expiry unless the manager restarts`);
+                }
+            }
         }
         catch (e) {
             console.error(`! credential renewal pass failed: ${e.message}`);
@@ -372,6 +645,38 @@ export class Manager {
             release();
         }
     }
+    /** Warn, on every renewal pass, when a $SYS credential is at or past its renewal point.
+     *
+     *  The manager is the renewal owner for every credential it CAN re-sign, and these two are the ones
+     *  it cannot: they are `rotation-renewed`, so no resident process re-mints them and they simply die
+     *  on their 30-day horizon. Before this, a mesh that never ran `doctor auth` got no signal at all,
+     *  it discovered the expiry as an "Authorization Violation" in the delivery log and a refused
+     *  membership adoption, weeks after the warning would have been actionable (#338). The pass runs
+     *  every half-TTL of the 24h class, so this repeats about twice a day for the ~7 days between the
+     *  renewal point and expiry: loud enough to be seen, bounded enough not to be noise.
+     *
+     *  Diagnostic only, and deliberately non-fatal: renewal is an operator action (`cotal down` then
+     *  `cotal up --rotate-sys`, which needs a broker restart), so the manager must report it, never
+     *  attempt it. An absent file is the unprovisioned space, reported by the daemon that needs it. */
+    warnOnSystemCredExpiry() {
+        for (const file of SYSTEM_CREDS_FILES) {
+            const path = join(this.workspaceRoot, ".cotal", file);
+            if (!existsSync(path))
+                continue;
+            let health;
+            try {
+                health = inspectCredHealth(readFileSync(path, "utf8"));
+            }
+            catch {
+                continue; // an unreadable $SYS file is the daemon's loud failure, not a renewal-pass crash
+            }
+            const when = health.exp ? new Date(health.exp * 1000).toISOString() : "an unknown date";
+            if (health.state === "expired")
+                console.error(`! $SYS credential ${file} EXPIRED ${when} - the broker denies it, and NOTHING renews it in place (it is rotation-renewed). Live eviction and the membership feed stay down until: \`cotal down\` then \`cotal up --rotate-sys\` (agents, creds and data survive)`);
+            else if (health.state === "near-expiry")
+                console.error(`! $SYS credential ${file} expires ${when} and nothing renews it in place (it is rotation-renewed) - schedule: \`cotal down\` then \`cotal up --rotate-sys\` (agents, creds and data survive)`);
+        }
+    }
     /** Admit one lifecycle/control operation while active. The synchronous increment is the fence:
      * preserveState flips state before its first await, so work is either counted or rejected. */
     beginLifecycle(resumeOperation = false) {
@@ -679,19 +984,30 @@ export class Manager {
             : { owner: DEV_OWNER, actor: a.id };
         if (!principal)
             throw new Error(`managed agent ${a.name} has an invalid principal ${a.id}`);
-        const files = agentSecretFilePaths(this.workspaceRoot, a.name);
+        // The RECORDED secret-family paths (set at spawn or adoption) — never a re-derivation by name:
+        // under mixed generations (a name-keyed pre-split incarnation adopted by this manager) the
+        // recorded path is the only truth, and re-deriving would preserve a family that isn't there.
+        const files = a.secretPaths;
         const identity = a.userOwner
-            ? {
-                mode: "user",
-                owner: principal.owner,
-                actor: principal.actor,
-                lifecycleUid: a.lifecycleUid,
-                actorToken: { kind: "file", path: files.actorToken, sha256: this.fileDigestOrEmpty(files.actorToken) },
-                sentinelCredential: { kind: "file", path: files.sentinelCreds, sha256: this.fileDigestOrEmpty(files.sentinelCreds) },
-                health: { kind: "file", path: files.health },
-            }
+            ? (() => {
+                if (!files?.actorToken || !files.sentinelCreds || !files.health)
+                    throw new Error(`managed agent ${a.name} is user-mode but its secret-family paths were not recorded`);
+                return {
+                    mode: "user",
+                    owner: principal.owner,
+                    actor: principal.actor,
+                    lifecycleUid: a.lifecycleUid,
+                    actorToken: { kind: "file", path: files.actorToken, sha256: this.fileDigestOrEmpty(files.actorToken) },
+                    sentinelCredential: { kind: "file", path: files.sentinelCreds, sha256: this.fileDigestOrEmpty(files.sentinelCreds) },
+                    health: { kind: "file", path: files.health },
+                };
+            })()
             : this.auth
-                ? { mode: "static", id: principal.actor, lifecycleUid: a.lifecycleUid, credential: { kind: "file", path: files.creds, sha256: this.fileDigestOrEmpty(files.creds) } }
+                ? (() => {
+                    if (!files?.creds)
+                        throw new Error(`managed agent ${a.name} is static-auth but its credential path was not recorded`);
+                    return { mode: "static", id: principal.actor, lifecycleUid: a.lifecycleUid, credential: { kind: "file", path: files.creds, sha256: this.fileDigestOrEmpty(files.creds) } };
+                })()
                 : { mode: "open", id: principal.actor, lifecycleUid: a.lifecycleUid };
         const dependencies = [a.launch.source.configPath];
         if (a.launch.source.kind === "manifest" && a.launch.source.runId)
@@ -779,14 +1095,42 @@ export class Manager {
             // A signal after a partial preservation must never fall back into destructive teardown.
             await this.stopRetainedAgentsOnExit();
         }
-        await this.ep.releaseManagerLease(this.leaseRevision);
+        await this.ep.releaseManagerLease(this.managerInstanceId, this.leaseRevision);
+        await this.stopServiceServe();
+        await this.stopGoalWriter();
+        await this.stopSessionPlane();
         await this.ep.stop();
         await this.attach.stop();
     }
-    /** Refresh the singleton lease before the bucket TTL expires it. On loss (missed the TTL, or another
-     *  manager took over after a gap) FAIL CLOSED: stop serving control at once so we can't double-process
-     *  with the new holder, and exit. We deliberately do NOT re-acquire (a replacement may already be live
-     *  while we'd still be serving) and do NOT release the key — it now belongs to that replacement. */
+    /** Stop the v0.4 service-endpoint serve loop (drain subscriptions, await in-flight handlers)
+     *  and drop its dedicated connection. Best-effort by design — both exit paths (graceful stop,
+     *  lease-loss fail-close) must complete their remaining teardown even if the broker is gone. */
+    async stopServiceServe() {
+        const s = this.serviceServe;
+        if (!s)
+            return;
+        this.serviceServe = undefined;
+        try {
+            await s.handle.stop();
+        }
+        catch { /* best effort */ }
+        try {
+            await s.nc.drain();
+        }
+        catch {
+            try {
+                s.nc.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    /** Refresh THIS instance's liveness lease before the bucket TTL expires it. On loss (missed the TTL —
+     *  this instance stalled past the renew window) FAIL CLOSED for THIS INSTANCE ONLY: stop serving +
+     *  tear down OUR managed agents + exit, so a stalled instance can't keep double-processing under a key
+     *  a same-id restart may re-acquire. Keyed per instance, so this NEVER frees or touches a sibling
+     *  manager's key and NEVER freezes the space (security pin 6) — the sibling keeps serving. We do NOT
+     *  re-acquire (a same-id restart may already be live) and do NOT release the key (it may be the
+     *  restart's). A DIFFERENT instance losing ITS key is a separate, independent event. */
     async renewLease() {
         try {
             if (!this.leaseInfo || this.leaseRevision === undefined)
@@ -794,7 +1138,7 @@ export class Manager {
             this.leaseRevision = await this.ep.renewManagerLease(this.leaseInfo, this.leaseRevision);
         }
         catch (e) {
-            console.error(`! manager lost its singleton lease for space "${this.space}" (${e.message}) - shutting down to avoid two managers serving it`);
+            console.error(`! manager instance ${this.managerInstanceId} lost its liveness lease for space "${this.space}" (${e.message}) - shutting down THIS instance (its serving only; siblings keep the space)`);
             if (this.leaseTimer)
                 clearInterval(this.leaseTimer);
             // Tear down our managed agents' footprints too (#159 B2) — this exit path leaks them otherwise. Do
@@ -806,6 +1150,9 @@ export class Manager {
                     await this.stopRetainedAgentsOnExit();
             }
             catch { /* best effort */ }
+            await this.stopServiceServe();
+            await this.stopGoalWriter();
+            await this.stopSessionPlane();
             try {
                 await this.ep.stop();
             }
@@ -817,13 +1164,11 @@ export class Manager {
             process.exit(1);
         }
     }
-    async handle(req, tier) {
-        if (req.op === "finalizeResume") {
-            if (tier !== CONTROL_ADMIN)
-                return { ok: false, error: "finalizeResume is admin-only; not allowed on this control subject" };
+    async opFinalizeResume(rawArgs) {
+        {
             let args;
             try {
-                args = parseResumeFinalizeArgs(req.args);
+                args = parseResumeFinalizeArgs(rawArgs);
             }
             catch (e) {
                 return { ok: false, error: e.message };
@@ -853,16 +1198,27 @@ export class Manager {
                 if (managed)
                     managed.suppressCleanup = false;
             }
+            // Unit B (F3, distsys/security CONDITIONAL @ 9e13648): the boot sweep DEFERRED every active
+            // slot while a resume was pending (it could not know which would be adopted). Now adoption
+            // is complete and `this.agents` is EXACTLY the adopted set, so re-sweep to terminalize any
+            // active slot the resume did NOT claim — a durable ACTIVE ORPHAN (crashed after slot->active
+            // before agents.set, then not in the resumed inventory). This runs while `resumeRequired` is
+            // still true, so no ordinary spawn can race it (beginLifecycle refuses non-resume ops), and
+            // it closes both the alias wedge AND the F5(a) gap (the orphan's principal enters
+            // retiredPrincipals, so a copied JWT is refused). Best-effort + loud: a sweep failure must
+            // not fail the finalize (the next non-resume boot re-drives it), but it is never swallowed.
+            if (this.auth && !this.userMode)
+                await this.reconcileStaticLifecycles(true).catch((e) => console.error(`! post-resume static reconcile: ${e.message} - a durable active orphan may still wedge its alias until the next non-resume restart`));
             this.resumeFinalized = true;
             this.resumeRequired = false;
             return { ok: true, data: { attemptId: args.attemptId, state: "active" } };
         }
-        if (req.op === "commitResume") {
-            if (tier !== CONTROL_ADMIN)
-                return { ok: false, error: "commitResume is admin-only; not allowed on this control subject" };
+    }
+    async opCommitResume(rawArgs) {
+        {
             let attemptId;
             try {
-                attemptId = parseResumeCommitArgs(req.args).attemptId;
+                attemptId = parseResumeCommitArgs(rawArgs).attemptId;
             }
             catch (e) {
                 return { ok: false, error: e.message };
@@ -890,11 +1246,11 @@ export class Manager {
                     this.resumeCommitTask = undefined;
             }
         }
-        if (req.op === "resumePreserved") {
-            if (tier !== CONTROL_ADMIN)
-                return { ok: false, error: "resumePreserved is admin-only; not allowed on this control subject" };
+    }
+    async opResumePreserved(rawArgs) {
+        {
             try {
-                const args = parseResumeControlArgs(req.args);
+                const args = parseResumeControlArgs(rawArgs);
                 const inventoryDigest = createHash("sha256").update(JSON.stringify(args.inventory)).digest("hex");
                 if (!this.resumeAttemptId)
                     return { ok: false, error: "resumePreserved requires a manager started with --resume-attempt" };
@@ -925,44 +1281,220 @@ export class Manager {
                 return { ok: false, error: e.message };
             }
         }
-        if (req.op === "preparePreservation" || req.op === "commitPreservation" || req.op === "abortPreservation") {
-            if (tier !== CONTROL_ADMIN)
-                return { ok: false, error: `${req.op} is admin-only; not allowed on this control subject` };
-            if (this.resumeRequired)
-                return { ok: false, error: this.maintenanceError() };
-            const attemptId = String(req.args?.attemptId ?? "").trim();
-            if (!attemptId)
-                return { ok: false, error: `${req.op} requires attemptId` };
-            try {
-                if (req.op === "abortPreservation") {
-                    this.abortPreservation(attemptId);
-                    return { ok: true, data: { attemptId, state: "active" } };
-                }
-                const result = req.op === "preparePreservation"
-                    ? await this.preparePreservation(attemptId)
-                    : await this.commitPreservation(attemptId);
-                return result.ok
-                    ? { ok: true, data: result }
-                    : {
-                        ok: false,
-                        data: result,
-                        error: `preservation incomplete: ${result.failures.map((f) => `${f.name}: ${f.error}`).join("; ")}`,
-                    };
-            }
-            catch (e) {
-                return { ok: false, error: e.message };
+    }
+    async opPreservationCtl(op, rawArgs) {
+        if (this.resumeRequired)
+            return { ok: false, error: this.maintenanceError() };
+        const attemptId = String(rawArgs?.attemptId ?? "").trim();
+        if (!attemptId)
+            return { ok: false, error: `${op} requires attemptId` };
+        try {
+            if (op === "abortPreservation") {
+                this.abortPreservation(attemptId);
+                return { ok: true, data: { attemptId, state: "active" } };
             }
+            const result = op === "preparePreservation"
+                ? await this.preparePreservation(attemptId)
+                : await this.commitPreservation(attemptId);
+            return result.ok
+                ? { ok: true, data: result }
+                : {
+                    ok: false,
+                    data: result,
+                    error: `preservation incomplete: ${result.failures.map((f) => `${f.name}: ${f.error}`).join("; ")}`,
+                };
+        }
+        catch (e) {
+            return { ok: false, error: e.message };
         }
+    }
+    /** The ONE shared control-admission chokepoint (P2 item 1, checklist 3/8) BOTH dispatch doors
+     *  run — the v0.3 `ctl` door ({@link handle}) and the v0.4 `ep` service handlers
+     *  ({@link serveGated}): the maintenance/resume fence (`beginLifecycle`: a resume-pending or
+     *  non-active manager accepts no ordinary control work) and then the F5(a) membership gate
+     *  ({@link lifecycleMembershipRefusal}: a retiring/terminalizing/retired managed incarnation's
+     *  AUTHENTICATED principal holds no control authority even with a valid JWT). Refusal carries
+     *  WHICH fence refused so the ep door can map onto the §13.3 catalog; admission returns the
+     *  accepted-work release. Never re-implemented per door — a fence on one door is a bypass. */
+    admitControl(caller) {
         const release = this.beginLifecycle();
         if (!release)
-            return { ok: false, error: this.maintenanceError() };
+            return { refusal: this.maintenanceError(), fence: "maintenance" };
+        const membership = this.lifecycleMembershipRefusal(caller);
+        if (membership) {
+            release();
+            return { refusal: membership, fence: "membership" };
+        }
+        return { release };
+    }
+    /** Run one v0.4 service-command handler through the SHARED admission chokepoint
+     *  ({@link admitControl}) on the broker-authenticated caller principal, mapping the two fences
+     *  onto the §13.3 catalog: maintenance/resume → `unavailable`, F5(a) membership →
+     *  `permission-denied`. The serve boundary publishes the structured error reply. */
+    async serveGated(ctx, fn) {
+        const caller = principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
+        const admission = this.admitControl(caller);
+        if (admission.refusal !== undefined)
+            throw new EpEnvelopeError(admission.fence === "membership" ? "permission-denied" : "unavailable", admission.refusal);
         try {
-            return await this.handleActive(req, tier);
+            return await fn();
         }
         finally {
-            release();
+            admission.release();
+        }
+    }
+    /** The ep door's ADMIN flag for a caller (the 1c tier refinement). Static mesh: `true` — the
+     *  admin-grade rows (any-mode despawn/attach, the `manager.admin` family, `launch`) are minted
+     *  only into operator instruments (§13.2: `any` is operator-policy-mintable; the agent/spawn
+     *  rollups never carry them), so REACHING the handler is holding the admin tier, exactly as
+     *  holding `ctl.<admin>` is today. User mesh: the caller's CURRENT ledger scope must carry
+     *  `admin` — the same fresh-read authority {@link psOwnerFilter} consults, so a revoked scope
+     *  demotes the very next call even on a still-valid bearer. Fail-closed: an unreadable ledger
+     *  authorizes nothing. NAMED RESIDUAL (critic, 1c.2b): the static `true` has no serve-time
+     *  re-check — a LEAKED static admin instrument keeps its reach until the credential's bounded
+     *  TTL (the one-shot 5-minute profile), the same static-revoke≠reconnect-death class ruled
+     *  across this campaign; static revocation is the TTL, not a ledger. */
+    async epAdminReach(caller) {
+        if (!this.userMode)
+            return true;
+        const key = parsePrincipalKey(caller);
+        if (!key)
+            return false;
+        try {
+            const scope = await resolveAuthProvider().actorScope({
+                dir: userAuthStateDir(this.workspaceRoot, this.space),
+                owner: key.owner,
+                actor: key.actor,
+            });
+            return scope?.includes("admin") === true;
+        }
+        catch {
+            return false;
         }
     }
+    /** A targeted request's admin flag: mode `any` (the operator instrument's cross-agent form,
+     *  rev 3) resolves through {@link epAdminReach}; a user-mode any-mode caller whose CURRENT
+     *  ledger row lost `admin` since its rows were minted refuses loud rather than silently
+     *  downgrading to the owner path (the request's declared mode is honored or denied, never
+     *  reinterpreted). Owner mode is always the privileged (own-domain) path. */
+    async epAnyModeAdmin(ctx) {
+        if (ctx.subject.target?.mode !== "any")
+            return false;
+        if (!(await this.epAdminReach(principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key)))
+            throw new EpEnvelopeError("permission-denied", `an any-mode ${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`);
+        return true;
+    }
+    /** The v0.4 typed command table (P2 item 1, slice 1b): every ordinary handler runs the SHARED
+     *  admission chokepoint ({@link serveGated}) and then delegates to the SAME op core the ctl
+     *  door dispatches (checklist 8: one core, two thin doors). The resume/preservation family
+     *  deliberately BYPASSES serveGated — exactly as it sits before {@link admitControl} on the ctl
+     *  door (those ops must run while `resumeRequired` fences ordinary work) — riding its own state
+     *  fences; its ep gate is the admin-grade `manager.admin` capability grant (the 1b rule: static
+     *  admin-class commands are capability-gated + untargeted, never a fabricated ledger mode).
+     *
+     *  TIER SEMANTICS on the ep door (the 1c grant-migration table): the tier lives in the CALLER'S
+     *  GRANT, refined per-op exactly as the ctl doors refine their subject tier. Owner-mode
+     *  `despawn`/`attach` keep the privileged semantics (`admin=false`, own-domain via
+     *  {@link authorizeNamed}) — every spawn-capable agent holds those rows. ANY-mode requests are
+     *  the operator instrument's cross-agent reach (rev 3): the any-mode subject row is mintable
+     *  only under operator policy (§13.2), so on a static mesh holding it IS the admin tier, and in
+     *  user mode the caller's CURRENT ledger scope must still carry `admin`
+     *  ({@link epAdminReach}, the same fresh-read authority `psOwnerFilter` consults). The
+     *  `manager.admin` family (purge + the resume/preservation ops) is capability-gated at mint AND
+     *  re-checked at serve time via {@link epAdminReach} (the `adminGated` wrapper) so a user's
+     *  revoked scope demotes the next call. `launch` is OWNER-EQUALITY on this door for everyone
+     *  (freelance HIGH #2): the deploy path is its only consumer and stamps the caller's own owner,
+     *  so cross-owner launch was a ctl-tier incidental never exercised, and keying it on the actor's
+     *  ledger scope broke the deployer-view attenuation - uniform owner-equality is the safe tier.
+     *  TWO DELIBERATE NARROWINGS vs the ctl doors (NOT bit-exact parity, panel-accepted): (1)
+     *  `define-persona` is `admin=false` for everyone (own-persona discipline; no ep consumer needs
+     *  cross-owner persona writes - an operator redefines via config, not the wire), where the ctl
+     *  admin tier allowed operator cross-owner redefine; (2) launch is owner-equality-only, above.
+     *  Both are least-privilege reductions, never widenings. */
+    managerServiceDefs() {
+        const args = (ctx) => (ctx.request.args ?? {});
+        const callerOf = (ctx) => principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
+        // A ctl-core failure reply becomes the §13.3 structured error the serve boundary publishes.
+        // The data half of a failure reply (e.g. a degraded resume result) rides the error MESSAGE
+        // only — the item-2 action model gives failures a typed channel.
+        const unwrap = (r) => {
+            if (!r.ok)
+                throw new EpEnvelopeError("failed-precondition", r.error ?? "the operation failed");
+            return r.data;
+        };
+        // The admin-family serve gate (1c.2c, security4's hardening): every `manager.admin`-class
+        // command re-checks operator reach AT SERVE TIME - static: true (the mint boundary already
+        // gates the rows to instruments); user mesh: the caller's CURRENT ledger scope must still
+        // carry `admin` ({@link epAdminReach}'s fresh read), so a revoked scope demotes the very next
+        // call instead of riding the bearer's remaining JWT-row lifetime. The resume family keeps its
+        // serveGated BYPASS (those ops must run while the maintenance fence holds) but not the gate.
+        const adminGated = async (ctx, fn) => {
+            if (!(await this.epAdminReach(callerOf(ctx))))
+                throw new EpEnvelopeError("permission-denied", `${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`);
+            return fn();
+        };
+        const targetAgent = (ctx) => {
+            const t = ctx.request.target; // targeted commands only: the serve boundary enforced body-target presence + fresh currency
+            const a = this.findManagedByTarget(t);
+            if (!a)
+                throw new EpEnvelopeError("expired", `target ${t.owner}.${t.actor} (lifecycle ${t.lifecycleUid}) is not a live managed agent of this manager`);
+            return a;
+        };
+        return managerCommandDefs({
+            status: (ctx) => this.serveGated(ctx, () => this.managerStatusData()),
+            ps: (ctx) => this.serveGated(ctx, async () => this.list(await this.psOwnerFilter(callerOf(ctx), false))),
+            inspect: (ctx) => this.serveGated(ctx, async () => {
+                const name = String(args(ctx).name ?? "").trim();
+                const row = this.list(await this.psOwnerFilter(callerOf(ctx), false)).find((x) => x.name === name);
+                if (!row)
+                    throw new EpEnvelopeError("not-found", `no agent "${name}"`);
+                return row;
+            }),
+            models: (ctx) => this.serveGated(ctx, async () => {
+                const data = unwrap(await this.opModels(args(ctx)));
+                return { catalogs: Array.isArray(data) ? data : [data] };
+            }),
+            // P2 item 2: `spawn` is an ACTION - accept a goal + reply the acceptance floor payload, drive
+            // progress + terminal off-handler (no ~30s block). The blocking reply path is gone (pin 8).
+            spawn: (ctx) => this.serveGated(ctx, () => this.serveSpawnGoal(ctx, (h) => this.opStart(args(ctx), callerOf(ctx), h))),
+            despawn: (ctx) => this.serveGated(ctx, async () => {
+                const a = targetAgent(ctx);
+                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx));
+                if (denied)
+                    throw new EpEnvelopeError("permission-denied", denied);
+                return unwrap(this.despawnAuthorized(a, args(ctx).graceful !== false, true));
+            }),
+            attach: (ctx) => this.serveGated(ctx, async () => {
+                const a = targetAgent(ctx);
+                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx));
+                if (denied)
+                    throw new EpEnvelopeError("permission-denied", denied);
+                return unwrap(await this.attachAuthorized(a, ctx.subject.caller));
+            }),
+            stopSelf: (ctx) => this.serveGated(ctx, () => unwrap(this.opStopSelf(callerOf(ctx), args(ctx)))),
+            definePersona: (ctx) => this.serveGated(ctx, () => unwrap(this.opDefinePersona(args(ctx), callerOf(ctx), false))),
+            purge: (ctx) => this.serveGated(ctx, () => adminGated(ctx, async () => unwrap(await this.opPurge(args(ctx), callerOf(ctx))))),
+            // launch is OWNER-EQUALITY on the ep door for every caller (freelance HIGH #2): the deploy
+            // path is the only launch consumer and its spec stamps the CALLER's own owner, so
+            // owner-equality always holds for a legitimate deploy; cross-owner launch was a ctl
+            // admin-tier INCIDENTAL never exercised by a real flow (static is single-owner, so the flag
+            // is a no-op there). Keying admin on epAdminReach read the ACTOR's ledger scope, which does
+            // NOT reflect the deployer VIEW's privileged-tier attenuation - an admin user's stolen
+            // deployer bearer would then bypass owner-equality (operator launch) despite the view holding
+            // no admin rows. Uniform owner-equality removes that divergence in the least-privilege
+            // direction (consistent with the delta-(b) tier narrowing the panel endorsed).
+            // P2 item 2 (ruling 3): manifest `launch` is an ACTION through the SAME chokepoint as spawn -
+            // the manifest resolve + owner-equality authz run in opLaunch's accept path, then the goal
+            // drives progress + terminal. The acceptance floor is the allocated identity + goal coords.
+            launch: (ctx) => this.serveGated(ctx, () => this.serveSpawnGoal(ctx, (h) => this.opLaunch(args(ctx), callerOf(ctx), false, h))),
+            resumePreserved: (ctx) => adminGated(ctx, async () => unwrap(await this.opResumePreserved(args(ctx)))),
+            commitResume: (ctx) => adminGated(ctx, async () => unwrap(await this.opCommitResume(args(ctx)))),
+            finalizeResume: (ctx) => adminGated(ctx, async () => unwrap(await this.opFinalizeResume(args(ctx)))),
+            preparePreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("preparePreservation", args(ctx)))),
+            commitPreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("commitPreservation", args(ctx)))),
+            abortPreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("abortPreservation", args(ctx)))),
+        });
+    }
     async commitResumeActivation(attemptId) {
         if (!this.resumeAwaitingCommit || !this.resumeResult?.ok)
             return { ok: false, error: `resume attempt ${attemptId} has no successful activation to commit` };
@@ -998,83 +1530,12 @@ export class Manager {
             data: { attemptId, state: "awaitingFinalize", durableCommitToken: this.resumeDurableCommitToken },
         };
     }
-    async handleActive(req, tier) {
-        const args = req.args ?? {};
-        // `req.from.id` is non-forgeable in auth mode: serveControl rejects any request whose payload
-        // `from.id` doesn't match the subject sender (endpoint.ts). In open mode there are no creds, so
-        // from.id is self-asserted — the spawner ledger + this routing are auth-mode guarantees,
-        // advisory in open mode (consistent with "open = single-trusted-host"). Thread it to every op
-        // so authz (P2c) and the spawner ledger (P4b) can act on it.
-        const caller = req.from.id;
-        const name = String(args.name ?? "").trim();
-        // Op↔tier binding — the real enforcement per the split. The cred gates WHO can reach each
-        // subject; this gates WHAT each subject will honor, fail-closed. A privileged op arriving on
-        // the self-service subject (publishable by all) must be rejected or the split does nothing.
-        if (tier === CONTROL_SELF_SERVICE) {
-            // Self-service honors self-ops only: a no-name stop (self-despawn). Durable join/leave/list moved
-            // OFF the manager onto the server-side delivery daemon's `ctl.delivery` service (the manager is
-            // lifecycle-only). A named stop (belongs on privileged/admin) or anything else is a misroute.
-            if (req.op !== "stop")
-                return { ok: false, error: `op "${req.op}" not allowed on self-service control subject` };
-            if (name)
-                return { ok: false, error: "named stop not allowed on self-service subject; send it on the privileged subject" };
-            return this.opStopSelf(caller, args);
-        }
-        const admin = tier === CONTROL_ADMIN;
-        // Privileged + admin tiers. A no-name stop is a self-op and belongs on the self-service subject.
-        switch (req.op) {
-            case "start":
-                // Spawn is a privileged-tier op; reaching it via admin is fine (admin ⊇ privileged powers).
-                return this.opStart(args, caller);
-            case "launch":
-                // SECURITY: on a STATIC mesh, manifest launch is operator-only (admin tier). It is
-                // higher-power than `start` — it boots an operator-authored, coordinated policy set from a
-                // run spec and underpins the ownership ledger — so a merely spawn-capable agent (which CAN
-                // publish to the privileged subject) must not reach it. Gate at the handler like `purge`;
-                // the subject alone isn't a boundary because `spawn` grants privileged-subject publish and
-                // dispatch is by op here. On a USER mesh, a spawn-scoped operator deploys THEIR OWN team on
-                // the privileged tier: opLaunch enforces owner-equality (the spec's apply-time stamped
-                // owner === the subject-pinned caller's owner) BEFORE any side effect.
-                if (!admin && !this.userMode)
-                    return { ok: false, error: "launch is admin-only; not allowed on the privileged subject" };
-                return this.opLaunch(args, caller, admin);
-            case "stop": {
-                if (!name)
-                    return { ok: false, error: "self-stop not allowed on privileged subject; send it on the self-service subject" };
-                return this.opStop(args, caller, admin);
-            }
-            case "definePersona":
-                return this.opDefinePersona(args, caller, admin);
-            case "purge":
-                // SECURITY: purge clears space history incl. DMs — admin-only. On the privileged tier any
-                // spawn-capable agent could wipe the space, so it must not be honored there.
-                if (!admin)
-                    return { ok: false, error: "purge is admin-only; not allowed on the privileged subject" };
-                return this.opPurge(args, caller);
-            case "attach":
-                return this.opAttach(args, caller, admin);
-            case "ps":
-                // USER mesh, privileged tier: `ps` lists only the CALLER's own owner-domain (the admin tier
-                // OR a fresh ledger `admin` scope sees all) — cross-owner agent metadata (principals,
-                // personas, auth health) is operator-grade. Fail-closed: an unparseable caller sees nothing.
-                // Static meshes are unchanged.
-                return { ok: true, data: this.list(await this.psOwnerFilter(caller, admin)) };
-            case "models":
-                return this.opModels(args);
-            case "status": {
-                // Same owner-domain bound as `ps`: a cross-owner target reads as absent, never as metadata.
-                const a = this.list(await this.psOwnerFilter(caller, admin)).find((x) => x.name === name);
-                return a ? { ok: true, data: a } : { ok: false, error: `no agent "${name}"` };
-            }
-            default:
-                return { ok: false, error: `unknown op: ${req.op}` };
-        }
-    }
-    /** Collapsed despawn/attach authorization (P4b). The caller already reached the privileged or
-     *  admin tier (cred-gated). On the admin tier any named target is allowed (operator). On the
-     *  privileged tier a named target is allowed if it's the caller's OWN child (`spawner ==
-     *  caller`) — and, on a user mesh, if it runs under the CALLER'S OWNER (owner-domain) or the
-     *  caller's ledger row holds `admin`, read fresh. The policy is the pure
+    /** Collapsed despawn/attach authorization (P4b). The caller already reached the command's ep
+     *  row (cred-gated: owner-mode rows via the spawn capability, any-mode rows only in admin
+     *  instruments). With admin=true (any-mode) any named target is allowed (operator). Otherwise
+     *  a named target is allowed if it's the caller's OWN child (`spawner == caller`) — and, on a
+     *  user mesh, if it runs under the CALLER'S OWNER (owner-domain) or the caller's ledger row
+     *  holds `admin`, read fresh. The policy is the pure
      *  {@link authorizeNamedControl}; this wrapper only binds the manager's state (the mode flag +
      *  the provider-backed ledger read — a build with no provider authorizes nothing extra,
      *  fail-closed via the policy's catch). Error string when denied, `undefined` when allowed. */
@@ -1174,6 +1635,9 @@ export class Manager {
      *  footprint, nor (in `reapChildrenOf`) abort the reap of later siblings. The failure is logged loudly,
      *  never swallowed silently. Being the single stop chokepoint, guarding here covers all callers at once. */
     stopHandle(a, graceful) {
+        // The F5 TERMINALIZING latch (Unit B): flipped SYNCHRONOUSLY, before any await anywhere on
+        // this stop path — from here this principal's control ops refuse and no credential renews.
+        a.terminalizing = true;
         try {
             if (graceful && process.platform === "win32" && a.control)
                 controlShutdown(a.control);
@@ -1258,7 +1722,9 @@ export class Manager {
         // user-mode spawn reads the callout material from it — the same store the auth-store kinds
         // (callout/issuer/…) were migrated onto — so this is no longer a local-only path.
         const secrets = this.secrets;
-        const files = agentSecretFilePaths(this.workspaceRoot, name);
+        // LIFECYCLE-KEYED family (SPEC 13.1 name-disjointness on the FS): this incarnation's files
+        // embed its uid, so no teardown addressed to another incarnation can ever reach them.
+        const files = agentLifecycleSecretFilePaths(this.workspaceRoot, name, opts.lifecycleUid);
         const { actorToken: tokenPath, sentinelCreds: sentinelPath, health: healthPath } = files;
         try {
             // The GRANT first — it is the envelope-rule enforcement point (a delegation must sit within
@@ -1289,10 +1755,10 @@ export class Manager {
             // The store holds the source of truth; the bearer re-exec (`--token-file`) and the launch's
             // sentinel handoff read FILES, so materialize both at the canonical paths (under the local
             // FS composition, a byte-identical rewrite of the keys' own locations).
-            await secrets.put(agentActorTokenKey(name), grant.actorToken);
-            await secrets.put(agentSentinelCredsKey(name), grant.sentinelCreds);
-            await materializeSecretToFile(secrets, agentActorTokenKey(name), tokenPath);
-            await materializeSecretToFile(secrets, agentSentinelCredsKey(name), sentinelPath);
+            await secrets.put(agentSecretKeyForFile(tokenPath), grant.actorToken);
+            await secrets.put(agentSecretKeyForFile(sentinelPath), grant.sentinelCreds);
+            await materializeSecretToFile(secrets, agentSecretKeyForFile(tokenPath), tokenPath);
+            await materializeSecretToFile(secrets, agentSecretKeyForFile(sentinelPath), sentinelPath);
             rmSync(healthPath, { force: true }); // a fresh start opens a fresh health window
             const bearerCmd = [
                 // The manager's own invocation prefix (node + loader flags + the cotal entry) — the agent
@@ -1311,7 +1777,7 @@ export class Manager {
                 "--health-file", healthPath,
             ];
             await execBearerPreflight(bearerCmd);
-            return { owner, launch: { owner, actor: name, sentinelCredsPath: sentinelPath, bearerCmd } };
+            return { owner, files, launch: { owner, actor: name, sentinelCredsPath: sentinelPath, bearerCmd } };
         }
         catch (e) {
             // Roll back everything this attempt materialized — a refused spawn must leave no standing
@@ -1319,12 +1785,12 @@ export class Manager {
             // may respawn the moment it reads the refusal, and a detached teardown would race (and
             // delete) that fresh spawn's just-provisioned durables.
             await provider.revokeAgent({ dir, owner, actor: name }).catch(() => { });
-            await secrets.delete(agentActorTokenKey(name)).catch(() => { });
-            await secrets.delete(agentSentinelCredsKey(name)).catch(() => { });
+            await secrets.delete(agentSecretKeyForFile(tokenPath)).catch(() => { });
+            await secrets.delete(agentSecretKeyForFile(sentinelPath)).catch(() => { });
             rmSync(tokenPath, { force: true });
             rmSync(sentinelPath, { force: true });
             rmSync(healthPath, { force: true });
-            await this.deprovision({ id: principalKey(owner, name).key, name, lifecycleUid: opts.lifecycleUid, userOwner: owner }).catch((err) => console.error(`rollback deprovision ${name}: ${err.message}`));
+            await this.deprovision({ id: principalKey(owner, name).key, name, lifecycleUid: opts.lifecycleUid, userOwner: owner, secretPaths: files }).catch((err) => console.error(`rollback deprovision ${name}: ${err.message}`));
             return { error: `agent auth preflight failed for "${name}": ${e.message}` };
         }
     }
@@ -1336,7 +1802,12 @@ export class Manager {
     freeSlot(a, floor, acceptedBeforeFence = false) {
         if (this.agents.get(a.name) !== a)
             return; // already freed (exit raced despawn, etc.)
+        a.terminalizing = true; // F5 latch (Unit B): also covers exit/reap paths that never rode stopHandle
         this.agents.delete(a.name);
+        // P2 item 6 (pin 4): end any live §13.6 attach session bound to THIS incarnation with the honest
+        // `target-despawn` reason. Fires once per agent on every free path (despawn / self-stop / reap /
+        // exit) via the `agents` guard above; a no-op when no plane or no live session for the target.
+        this.sessionPlane?.endForTarget(a.name, a.lifecycleUid, "target-despawn");
         if (floor && Date.now() - a.startedAt < MIN_LIFETIME)
             this.cooling.push(a.startedAt + MIN_LIFETIME);
         // #29 piece 3: on a USER mesh the name is RESERVED PENDING RETIREMENT — despawn started this
@@ -1350,7 +1821,14 @@ export class Manager {
         if (this.userMode) {
             const p = parsePrincipalKey(a.id);
             if (p)
-                this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: p.owner, actor: p.actor, agentId: a.id, userOwner: a.userOwner, startedAt: Date.now() });
+                this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: p.owner, actor: p.actor, agentId: a.id, userOwner: a.userOwner, secretPaths: a.secretPaths, startedAt: Date.now() });
+        }
+        else if (this.auth) {
+            // Unit B: a STATIC lifecycle now also holds its name pending its own terminal (the F1
+            // static retirement the detached deprovision below drives) — the alias frees only when the
+            // gate+head terminal completes, exactly the user-mode discipline. The wire principal is the
+            // incarnation-unique nkey (F5-bind); owner is the dev owner.
+            this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: DEV_OWNER, actor: a.id, agentId: a.id, secretPaths: a.secretPaths, startedAt: Date.now() });
         }
         // Auth mode: tear down the departed agent's minted broker footprint + creds file (#159 B2). The
         // process is already gone, so this must never block the slot free or throw into the caller — it runs
@@ -1392,25 +1870,44 @@ export class Manager {
     async driveDeprovision(a) {
         if (!this.auth)
             return; // guaranteed by deprovision; re-checked for the deprovisionBroker narrowing
+        if (!this.userMode && !a.userOwner) {
+            // Unit B: a STATIC lifecycle retires through the F1 terminal barrier — freeze → head
+            // retiring → B1 ledger revoke → footprint cleanup (creds file + broker durables/ACL, INSIDE
+            // the barrier) → gate retired → head retired → alias free. The eviction step is the process
+            // kill the stop path already performed (static's best-effort eviction).
+            return this.driveStaticRetirement(a);
+        }
         // Drop the local creds file FIRST + unconditionally — it is a usable identity on disk, useless for a
         // departed agent, so it must not survive even if the broker teardown below fails or times out. The
         // teardown mints its OWN deprovisioner cred (not this file), so removing it early is independent.
         // Migrated kinds: the store delete is the authoritative removal; the rmSync clears the FS
-        // materialization (a byte-identical no-op under the local composition, real once the manager's
+        // materialization (a byte-identical no-op under the local composition, real once the manager
         // `secretStore` is a non-FS store).
+        //
+        // LIFECYCLE-OWNED (SPEC 13.1, the manager-local half): the family deleted here is the RECORDED
+        // one (spawn/adoption), else the lifecycle-keyed derivation for THIS uid — never a name-only
+        // derivation, so a stale/replayed teardown addresses only names a same-alias successor never
+        // uses. It deliberately CANNOT remove a name-keyed family it holds no record of (an operator's
+        // standing `cotal mint` cred, a seeded workstation cred, a pre-split leftover): deleting an
+        // unowned same-name file is the exact successor-clobber this ownership discipline removes.
         const secrets = this.secrets;
-        const files = agentSecretFilePaths(this.workspaceRoot, a.name);
-        await secrets.delete(agentCredsKey(a.name));
-        rmSync(files.creds, { force: true });
+        const files = a.secretPaths ?? agentLifecycleSecretFilePaths(this.workspaceRoot, a.name, a.lifecycleUid);
+        if (files.creds) {
+            await secrets.delete(agentSecretKeyForFile(files.creds));
+            rmSync(files.creds, { force: true });
+        }
         if (a.userOwner) {
             // USER MODE: this teardown IS revocation, not just footprint reduction — the ledger row is
             // the agent's standing mint authority, so delete it (next exchange refused, next connect
             // denied) and shred the secret/sentinel/health files. A copied actor token dies here; a
             // still-LIVE connection ends at its bearer-bound JWT expiry (≤ the agent TTL).
-            await secrets.delete(agentActorTokenKey(a.name));
-            await secrets.delete(agentSentinelCredsKey(a.name));
+            if (files.actorToken)
+                await secrets.delete(agentSecretKeyForFile(files.actorToken));
+            if (files.sentinelCreds)
+                await secrets.delete(agentSecretKeyForFile(files.sentinelCreds));
             for (const f of [files.actorToken, files.sentinelCreds, files.health])
-                rmSync(f, { force: true });
+                if (f)
+                    rmSync(f, { force: true });
             // The ledger row IS the agent's STANDING mint authority (a different store from the auth-plane
             // cred ledger the rail retirement covers): while it lives, a copied actor token can still mint a
             // fresh connect credential. So a FAILED revoke must NOT be swallowed into a clean terminal (INT-2):
@@ -1440,8 +1937,10 @@ export class Manager {
         }
         await this.deprovisionBroker(a);
         // #29 piece 3: after the footprint teardown, ask the AUTH plane to RETIRE the lifecycle over
-        // the auth-admin rail. The rail re-checks the space-manager lease at serve time; the terminal
-        // (or an already-retired answer) clears the name reservation. Failures keep the hold with
+        // the auth endpoint rail. The rail re-checks the SERVE-ISSUANCE GATE at serve time (not the
+        // space-manager lease - that check was replaced in 02794b2f) and refuses unless the registration
+        // this request names belongs to our own principal; the terminal (or an already-retired answer)
+        // clears the name reservation. Failures keep the hold with
         // their operator copy — legible, retryable, never a silent half-state.
         await this.requestRetirement(a);
     }
@@ -1486,12 +1985,44 @@ export class Manager {
         }
         const uncertain = (why) => `the despawn stopped "${a.name}", but the retirement's completion could NOT be confirmed (${why}). The name stays held - not failed, not done - and a same-name spawn re-drives the same teardown; the auth service also finishes any started retirement on its next boot. NEXT: if the auth rail stays unreachable, recover the stack (\`cotal supervise\`), then re-attempt the same-name spawn.`;
         try {
-            const creds = await mintCreds(this.auth, newIdentity(), "retirement-requester", { retirementRequester: { owner: me.owner, actor: me.actor } });
+            // The caller triple and the TARGET are both grant-pinned now (#350): the `handle` target
+            // rides the subject, so this ephemeral credential can ask to retire exactly this
+            // incarnation and nothing else.
+            const caller = { owner: me.owner, actor: me.actor, uid: this.managerLifecycleUid };
+            const creds = await mintCreds(this.auth, newIdentity(), "retirement-requester", {
+                retirementRequester: { ...caller, target: { owner: target.owner, actor: target.actor, lifecycleUid: a.lifecycleUid } },
+            });
             const nc = await connect({ servers: this.servers ?? DEFAULT_SERVER, authenticator: credsAuthenticator(new TextEncoder().encode(creds)), maxReconnectAttempts: 0 });
             try {
-                const subject = controlServiceSubject(this.space, CONTROL_AUTH_ADMIN, me.owner, me.actor);
-                const m = await nc.request(subject, JSON.stringify({ op: "retireLifecycle", args: { owner: target.owner, actor: target.actor, lifecycleUid: a.lifecycleUid, opId: retireOpId(a.lifecycleUid) } }), { timeout: 20_000, noMux: true, reply: `${subject}.reply.${randomUUID()}` });
-                const r = m.json();
+                // §13.2 nonce: >=128 bits of CSPRNG entropy, base64url (the `endpoint-invoke` idiom).
+                const nonce = randomBytes(24).toString("base64url");
+                // The caller-chosen request id the reply MUST echo (the minimal correctness guard from the
+                // not-yet-migrated endpoint envelope - see the residual in the auth listener).
+                const requestId = randomBytes(16).toString("base64url");
+                const subject = epRequestSubject(this.space, {
+                    route: { mode: "one" },
+                    endpoint: AUTH_ENDPOINT,
+                    command: EP_CMD_RETIRE_LIFECYCLE,
+                    // The TARGET rides the subject (authz mode `handle`, arity 3) — broker-enforced, and
+                    // pinned by the grant minted above, so it is not a body claim the caller can vary.
+                    target: { mode: "handle", tOwner: target.owner, tActor: target.actor, tUid: a.lifecycleUid },
+                    caller,
+                    nonce,
+                });
+                // The responder derives its OWN reply subject from this request (caller triple + nonce,
+                // prefixed with the RESPONDER's instance identity), so a caller-supplied `reply` header
+                // would be ignored — that is the confused-deputy boundary being structural. The caller
+                // therefore reads its own reply-plane filter and binds the answer off the reply SUBJECT.
+                const m = await epAwaitReply(nc, this.space, caller, nonce, requestId, subject, 
+                // Declare THIS manager instance's serve identity. Since #350 these SELECT the gate row;
+                // they no longer authorize — the rail refuses unless the row they name belongs to this
+                // caller's own subject-derived principal. A superseded predecessor (same instanceId, OLD
+                // epoch after a restart) is still refused by the epoch comparison.
+                JSON.stringify({ id: requestId, op: "retireLifecycle", args: {
+                        opId: retireOpId(a.lifecycleUid),
+                        serveEndpoint: MANAGER_ENDPOINT, serveInstanceId: this.managerInstanceId, serveEpoch: this.serviceServe?.grant.epoch ?? 0,
+                    } }), 20_000);
+                const r = m;
                 if (r.ok) {
                     // CAS the hold clear (audit #1 ABA): free the alias ONLY if the current hold is still THIS
                     // lifecycle's - a late reply for a retired predecessor must never clear a successor's newer hold.
@@ -1584,11 +2115,37 @@ export class Manager {
             ? undefined
             : `unsafe name ${JSON.stringify(name)} (allowed: letters, digits, _ -)`;
     }
-    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against both live and
-     *  in-flight (reserved) slots. Lets a colliding spawn auto-number instead of being rejected, so
-     *  callers never have to invent a unique name. */
+    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
+     *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
+     *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
+     *  connector session, another manager's agent): allocating their name would mint a sibling the
+     *  broker/auth then refuses to admit, surfacing as a 30s launch-uncertain black hole instead of
+     *  the auto-number the join path gives. Presence is ADVISORY (SPEC §6) — this is an availability
+     *  choice at allocation, never an authority check (the broker still enforces): a stale
+     *  still-live-looking row only costs a numbered suffix, and a missed freshly-joined occupant is
+     *  still refused downstream exactly as before. Offline rows do NOT occupy — a properly retired
+     *  name stays reusable. */
+    /** The roster's LIVE occupant names (status !== offline) — occupants this manager may NOT manage
+     *  (a foreground `cotal spawn`, a connector session, ANOTHER manager's agent). Allocating over any
+     *  of them mints a sibling the broker/auth then refuses to admit, surfacing as the 30s launch-
+     *  uncertain black hole. */
+    liveRosterNames() {
+        const live = new Set();
+        for (const p of this.ep.getRoster())
+            if (p.status !== "offline")
+                live.add(p.card.name);
+        return live;
+    }
+    /** THE single name-liveness predicate both the hard-pinned collision refuse (M6, P2 item 2) and
+     *  uniqueName's numbering consult, so they can never drift: a name is taken if this manager
+     *  reserves/manages/retires it OR a roster-live occupant already holds it. Pass a pre-built
+     *  {@link liveRosterNames} set when checking many names in one allocation. */
+    nameInUse(name, live = this.liveRosterNames()) {
+        return this.agents.has(name) || this.reserved.has(name) || this.retiring.has(name) || live.has(name);
+    }
     uniqueName(base) {
-        return firstFreeName(base, (n) => this.agents.has(n) || this.reserved.has(n) || this.retiring.has(n));
+        const live = this.liveRosterNames();
+        return firstFreeName(base, (n) => this.nameInUse(n, live));
     }
     /** Spawn a teammate by persona ref (`name` loads `.cotal/agents/<name>.md`; the peer presents
      *  under that file's own `name:`), as if a peer asked via the control plane. Used to pre-spawn the
@@ -1611,7 +2168,7 @@ export class Manager {
         return false;
     }
     /** Parse an untyped control-plane `start` request into {@link StartAgentOpts}. */
-    opStart(args, caller) {
+    opStart(args, caller, hooks) {
         // `resume`, when present, must be a non-empty session id. An empty/whitespace value is a
         // malformed request, not an implicit "spawn fresh" (no fallbacks). The CLI surfaces reject it,
         // but a raw control message could otherwise slip an empty value through and silently start fresh.
@@ -1658,7 +2215,7 @@ export class Manager {
             allowSubscribe,
             allowPublish,
             shareTools: args.shareTools !== undefined ? String(args.shareTools) : undefined,
-        }, caller);
+        }, caller, hooks);
     }
     /** Resolve a connector by agent type. Library composition (installedExtensions off) → a registry
      *  hit, exactly as before (the composition root imported what it wants). The published binary gates
@@ -1768,7 +2325,7 @@ export class Manager {
      *  (collision-numbered) name + nkey id creds are filed under, plus the manifest `requested` name,
      *  `runId`, and resolved `hash`. USER mesh: a privileged-tier launch is owner-equality-authorized
      *  (spec owner === caller owner) before any side effect; the admin tier keeps operator behavior. */
-    async opLaunch(args, caller, admin) {
+    async opLaunch(args, caller, admin, hooks) {
         const runId = String(args.runId ?? "").trim();
         const name = String(args.name ?? "").trim();
         if (!runId || !name)
@@ -1820,7 +2377,7 @@ export class Manager {
         catch (e) {
             return { ok: false, error: e.message };
         }
-        const reply = await this.startAgent(launchAgentToStartOpts(la, configPath, spec.owner, runId), caller);
+        const reply = await this.startAgent(launchAgentToStartOpts(la, configPath, spec.owner, runId), caller, hooks);
         if (reply.ok)
             // `data.name` stays the spawned (numbered) identity — what creds are filed under and the ledger
             // keys on; `requested`/`runId`/`hash` give the CLI the manifest name + drift hash for the ledger.
@@ -1833,18 +2390,18 @@ export class Manager {
      *  `spawner` is the authenticated id of the peer that requested the spawn (`req.from.id`),
      *  defaulting to the manager's own id for roster/pre-spawn — recorded for the spawner
      *  ledger (own-children despawn + reap-on-parent-exit). */
-    async startAgent(opts, spawner) {
+    async startAgent(opts, spawner, hooks) {
         const release = this.beginLifecycle();
         if (!release)
             return { ok: false, error: this.maintenanceError() };
         try {
-            return await this.startAgentActive(opts, spawner);
+            return await this.startAgentActive(opts, spawner, hooks);
         }
         finally {
             release();
         }
     }
-    async startAgentActive(opts, spawner) {
+    async startAgentActive(opts, spawner, hooks) {
         // The spawn argument is a persona REF — a filename in `.cotal/agents` (the unique spawn KEY), or
         // a path via `--config`. It is NOT the mesh identity: the identity comes from inside the file
         // (`name:`), so a persona can be filed descriptively (review-critic.md) yet present under a
@@ -1974,7 +2531,7 @@ export class Manager {
         // outstanding. All the teardown ops are idempotent, and the rail request is single-flighted.
         const held = this.retiring.get(identityName);
         if (held !== undefined) {
-            void this.deprovision({ id: held.agentId, name: identityName, lifecycleUid: held.lifecycleUid, userOwner: held.userOwner }).catch(() => { });
+            void this.deprovision({ id: held.agentId, name: identityName, lifecycleUid: held.lifecycleUid, userOwner: held.userOwner, secretPaths: held.secretPaths }).catch(() => { });
             return {
                 ok: false,
                 error: `the name "${identityName}" is reserved pending retirement: its previous agent's despawn started that lifecycle's teardown (footprint + standing-authority revoke + auth-side retirement), and the name frees only when all of it completes${held.lastError !== undefined ? ` (last attempt: ${held.lastError})` : ""}. NEXT: wait a moment and retry this spawn (retrying re-drives the whole teardown), or pick another name.`,
@@ -1982,7 +2539,34 @@ export class Manager {
         }
         if (variant && !connector.supportsModelVariant)
             return { ok: false, error: `${agent} connector does not support model variants (variant)` };
-        const name = this.uniqueName(identityName);
+        // #4 A4 (panel): the roster the allocation consults must reflect the initial presence snapshot,
+        // or a spawn immediately after manager boot races an already-live unmanaged peer and re-opens the
+        // very collision black-hole this closes. Await the snapshot (bounded internally, fail-safe on an
+        // empty mesh) before allocating; the broker/auth remain the authority downstream. Deliberately
+        // unconditional: a half-wired endpoint without the seam must fail loud here, not silently
+        // allocate off a pre-snapshot roster.
+        await this.ep.waitForPresenceSnapshot();
+        // M6 (P2 item 2 spawn-as-action): a HARD-PINNED name — an imperative `--name`/identity override
+        // or a manifest-declared name (opts.resolved) — that collides with a LIVE/provisioning/reserved
+        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `-2`
+        // suffix (so an address-by-triple caller's pinned name can't be re-pointed). A PERSONA-DERIVED
+        // base name (no pin) keeps uniqueName's collision numbering, so multi-peer `spawn reviewer` twice
+        // still yields reviewer + reviewer-2. The retiring-hold refuse (~2472) is orthogonal and already fired.
+        const hardPinned = opts.identity !== undefined || opts.resolved !== undefined;
+        let name;
+        if (hardPinned) {
+            // The collision check consults THE SAME liveness source uniqueName uses ({@link nameInUse}:
+            // this manager's agents/reserved/retiring PLUS the roster-live set) - a hard-pinned name
+            // colliding with ANY live incarnation (managed, unmanaged foreground/connector, or another
+            // manager's agent) refuses cleanly at accept, rather than minting the collision and black-
+            // holing on the broker/auth refusal (item 3: a pinned name live under another manager MUST refuse).
+            if (this.nameInUse(identityName))
+                return { ok: false, error: `the name "${identityName}" is hard-pinned (${opts.resolved ? "manifest-declared" : "--name/identity override"}) but is already held by a live incarnation (managed here, an unmanaged foreground/connector session, or another manager's agent); a pinned same-name collision refuses at accept - pick another name or despawn the existing one` };
+            name = identityName;
+        }
+        else {
+            name = this.uniqueName(identityName);
+        }
         this.reserved.add(name);
         // Transcript mirroring (opt-in: `--transcript` / COTAL_TRANSCRIPT_DEFAULT=1) → grant the agent pub
         // on its OWN transcript channel; auth-mode publish is default-deny, so without the grant the mirror's
@@ -1999,6 +2583,18 @@ export class Manager {
             }
             allowPublish = [...(allowPublish ?? []), connector.transcriptChannel(name)];
         }
+        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
+        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
+        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
+        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
+        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
+        if (this.auth && !this.userMode) {
+            const claims = [opts, (opts.resolved ?? {})];
+            if (claims.some((c) => c.endpointCapabilities !== undefined)) {
+                this.reserved.delete(name);
+                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
+            }
+        }
         // Set once the agent's creds + durables are minted; cleared the moment a live slot takes ownership
         // (`agents.set`, after which freeSlot deprovisions on exit). If it survives to `finally`, the spawn
         // threw AFTER minting (buildLaunch / runtime.spawn) — tear the orphan down so no footprint leaks (#159 B).
@@ -2016,6 +2612,19 @@ export class Manager {
             // broker resource (dm_/dlv_/chathist_ durables, ACL row, memberships) and the teardown
             // credential carry it, so a same-name successor's footprint is name-disjoint by construction.
             const lifecycleUid = mintLifecycleUid();
+            // ACCEPT SEAM (P2 item 2 spawn-as-action): the incarnation identity is minted and NOTHING has
+            // been provisioned yet — the action serve path binds the goal + replies the acceptance HERE. A
+            // throw (bind conflict / duplicate goalId) aborts the spawn before provisioning: the catch below
+            // returns the failure and the finally releases the reserve, so a refused accept leaves zero
+            // footprint (pin 1). Blocking callers (roster boot) pass no hooks and this is a no-op.
+            // The ALLOCATED agent's addressing triple (the acceptance floor names what was actually
+            // allocated, never the requested-but-unallocated name). Static/open key on DEV_OWNER + the
+            // freshly-minted nkey; user mode keys on the derived owner (opts.owner, else a u_-owner spawner)
+            // + the alias — derived HERE where the mode and owner source are in scope.
+            const agentTriple = this.userMode
+                ? { owner: opts.owner ?? (spawner && parsePrincipalKey(spawner)?.owner.startsWith("u_") ? parsePrincipalKey(spawner).owner : DEV_OWNER), actor: name, uid: lifecycleUid }
+                : { owner: DEV_OWNER, actor: identity.id, uid: lifecycleUid };
+            await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple });
             // In auth mode, mint the agent's creds from the space signing key and write them where the
             // spawned session reads them (COTAL_CREDS path). Open mesh → no creds. Scope = the resolved
             // subscribe/allowSubscribe (read) + allowPublish (post, default-deny).
@@ -2040,13 +2649,25 @@ export class Manager {
                 }
                 userLaunch = prep.launch;
                 userOwner = prep.owner;
-                provisioned = { id: principalKey(prep.owner, name).key, name, lifecycleUid, userOwner: prep.owner };
+                provisioned = { id: principalKey(prep.owner, name).key, name, lifecycleUid, userOwner: prep.owner, secretPaths: prep.files };
             }
             else if (this.auth) {
+                // Unit B (§13.1): reserve + activate this incarnation's DURABLE identity BEFORE any
+                // broker footprint — the F3 outer spawn intent first (slot row, phase `provisioning`),
+                // then the SHARED core activation saga (reserve uid -> gate frozen -> head CAS -> reopen
+                // LAST) over the key-pinned executor. The wire AUTHORITY principal is the incarnation-
+                // unique nkey (F5-bind); the alias is protected by the name-keyed slot + freeSlot hold.
+                await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: identity.id, lifecycleUid, alias: name }, (t) => activateStaticLifecycle(t, { owner: DEV_OWNER, alias: name, actor: identity.id, lifecycleUid, managerInstance: this.managerLifecycleUid, ownerInstanceId: this.managerInstanceId }));
+                // From here the DURABLE registration exists: arm the rollback BEFORE minting, so a throw
+                // between activation and provisioning still drives the exact-op static terminal (the
+                // finally's deprovision tolerates absent files; the broker teardown is idempotent).
+                provisioned = { id: identity.id, name, lifecycleUid };
                 // Pre-create the agent's bind-only chat (+ DM + role TASK) durables and mint its scoped creds
                 // — the shared onboarding step (provisionAgent). It runs on a short-lived PROVISIONER connection
                 // (NOT the supervisor's long-lived endpoint), so the DM/DLV consumer-create surface exists only
                 // for the provisioning window, never as a standing grant on the always-on daemon (residual 2).
+                // F5(b): the credential is BOUNDED (`expiresAt`) — the manager push-renews it ahead of expiry.
+                const exp = Math.floor(Date.now() / 1000) + MANAGED_STATIC_TTL_SEC;
                 const creds = await this.withProvisioner((prov) => provisionAgent(prov, this.auth, identity, {
                     subscribe,
                     allowSubscribe,
@@ -2054,15 +2675,26 @@ export class Manager {
                     role,
                     capabilities,
                     lifecycleUid,
+                    expiresAt: exp,
                 }));
+                // Ledger BEFORE materialization (§13.1): record the credentialId on the slot, append the
+                // `cred.<uid>.<credId>` row, and only then write the credential where anything can read
+                // it — a credential is never materialized before its ledger row exists.
+                const credentialId = rawDigest(creds).replace("sha256:", "sha256-");
+                await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: identity.id, lifecycleUid, alias: name }, async (t) => {
+                    await recordSlotCredential(t, DEV_OWNER, name, lifecycleUid, credentialId);
+                    await appendStaticCredentialRow(t, { lifecycleUid, credentialId, holderPrincipal: principalKey(DEV_OWNER, identity.id).key, exp });
+                });
                 // Store first (the source of truth), then materialize: `buildLaunch` hands the CHILD this
                 // file path, so the cred must exist as a file regardless of the store behind the seam. The
                 // manager's ONE store (injected for hosted, workstation FS locally).
                 const secrets = this.secrets;
-                credsPath = agentSecretFilePaths(this.workspaceRoot, name).creds;
-                await secrets.put(agentCredsKey(name), creds);
-                await materializeSecretToFile(secrets, agentCredsKey(name), credsPath);
-                provisioned = { id: identity.id, name, lifecycleUid }; // footprint now exists — the finally rolls it back if the spawn throws
+                // LIFECYCLE-KEYED (SPEC 13.1 on the FS): the incarnation's cred file embeds its uid, so a
+                // replayed/stale teardown can never address a same-name successor's credential.
+                credsPath = agentLifecycleSecretFilePaths(this.workspaceRoot, name, lifecycleUid).creds;
+                await secrets.put(agentSecretKeyForFile(credsPath), creds);
+                await materializeSecretToFile(secrets, agentSecretKeyForFile(credsPath), credsPath);
+                provisioned = { id: identity.id, name, lifecycleUid, secretPaths: { creds: credsPath } }; // footprint now exists — the finally rolls it back if the spawn throws
             }
             // Personal MCP servers the operator opted to share with manager-spawned agents of this type
             // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
@@ -2116,12 +2748,16 @@ export class Manager {
                 workspaceRoot: this.workspaceRoot,
             });
             const handle = this.runtime.spawn(name, spec, cwd);
+            hooks?.onLaunched?.(); // P2 item 2: the "launched" progress edge (process spawned, pre-presence)
             const managed = {
                 name,
                 role,
                 agent,
                 id: userLaunch ? principalKey(userLaunch.owner, name).key : identity.id,
                 lifecycleUid,
+                // The lifecycle-keyed family this spawn just materialized (absent on an open mesh) — the
+                // recorded truth teardown/preservation/health consume, never re-derived by name.
+                secretPaths: provisioned?.secretPaths,
                 ...(userLaunch ? { userOwner } : { seed: identity.seed }),
                 spawner: spawner ?? this.ep.ref().id,
                 authorityParent: userLaunch && spawner && parsePrincipalKey(spawner) ? spawner : undefined,
@@ -2157,6 +2793,18 @@ export class Manager {
                         : undefined,
                 },
             };
+            // Unit B: the DURABLE slot takes the `active` phase before the in-memory row takes the
+            // name — a crash between the two leaves an active-but-unadopted slot the boot sweep
+            // terminalizes (never an untracked orphan). Static auth only; a failed CAS fails the spawn
+            // (the finally's rollback then drives the exact-op terminal).
+            if (this.auth && !this.userMode) {
+                await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: managed.id, lifecycleUid, alias: name }, async (t) => {
+                    const slot = await readStaticSlot(t, DEV_OWNER, name);
+                    if (slot === undefined || slot.row.lifecycleUid !== lifecycleUid || slot.row.phase !== "provisioning")
+                        throw new Error(`the static slot for "${name}" is ${slot === undefined ? "absent" : `${slot.row.phase} at uid ${slot.row.lifecycleUid}`}, not this spawn's provisioning intent; refusing to take the slot`);
+                    await casStaticSlot(t, { ...slot.row, phase: "active" }, slot.revision);
+                });
+            }
             this.agents.set(name, managed);
             // The live slot now owns teardown — freeSlot deprovisions this identity on exit — so the
             // orphan-rollback in `finally` no longer applies to it.
@@ -2166,17 +2814,36 @@ export class Manager {
             // neither in time → uncertain. `✓ started` therefore means "it joined", never just "a process
             // launched".
             const readiness = await this.awaitReadiness(managed);
-            if (!readiness.ok && !readiness.uncertain)
-                return { ok: false, error: readiness.detail }; // failed → already reaped
+            // Deliberately stopped mid-launch: reaped by onExit, and the despawn/stop path owns the
+            // goal terminal. Return BEFORE the failed/uncertain arms so this emits no competing
+            // outcome and does not re-arm an exit watcher on an agent already gone.
+            if (!readiness.ok && readiness.deliberate) {
+                hooks?.onTerminalDeferred?.();
+                return { ok: false, error: readiness.detail };
+            }
+            if (!readiness.ok && !readiness.uncertain) {
+                await hooks?.onOutcome?.({ kind: "failed", data: { error: readiness.detail } });
+                return { ok: false, error: readiness.detail };
+            } // failed → already reaped
             // Started OR uncertain: the agent stays managed, so wire the ongoing exit reaper (it reaps a later
             // death — including one that follows an `uncertain` verdict, which deliberately does NOT deprovision).
             this.watchExit(managed);
-            if (!readiness.ok)
-                return { ok: false, error: readiness.detail }; // uncertain — non-success, but kept
+            if (!readiness.ok) {
+                await hooks?.onOutcome?.({ kind: "uncertain" });
+                return { ok: false, error: readiness.detail };
+            } // uncertain — non-success, but kept
             // Reply with the id the slot actually carries (user-mode: the owner.actor principal —
             // presence, ps, and the manifest ownership ledger all key on it; the throwaway static nkey
             // would never match and down -f would treat the agent as foreign).
-            return { ok: true, data: { name, role, agent, id: managed.id, mode: handle.kind } };
+            // `lifecycleUid` rides the reply so callers that record this spawn (the manifest ledger) can
+            // later address the incarnation's lifecycle-keyed artifacts without re-deriving by name.
+            // OMIT an absent role: the goal terminal commits this data through the strict
+            // canonicalJson (undefined never coerces to null, SPEC 13.6), so a role-less spawn would
+            // otherwise fail its succeeded terminal. The CLI/connector already render an absent role as
+            // "no role", so dropping the key preserves the reply (P2 item 2, surfaced by readiness:live).
+            const okData = { name, agent, id: managed.id, mode: handle.kind, lifecycleUid, ...(role !== undefined ? { role } : {}) };
+            await hooks?.onOutcome?.({ kind: "succeeded", data: okData });
+            return { ok: true, data: okData };
         }
         catch (e) {
             // Failure after reserve (provision / launch threw): the slot was never live, so no cold-start
@@ -2287,9 +2954,16 @@ export class Manager {
         if (entry.identity.mode === "static") {
             if (!this.auth || this.userMode)
                 throw new Error(`retained agent ${entry.name} is static-auth but the current manager is not`);
-            const expected = resolve(agentSecretFilePaths(this.workspaceRoot, entry.name).creds);
-            if (resolve(entry.identity.credential.path) !== expected)
-                throw new Error(`retained credential reference for ${entry.name} is not the manager-owned path ${expected}`);
+            // CLOSED candidate set, not an open path: the lifecycle-keyed derivation (this generation's
+            // layout) or the name-keyed one (a pre-split inventory being carried across the upgrade).
+            // Anything else is a foreign path and refused exactly as before.
+            const candidates = [
+                resolve(agentLifecycleSecretFilePaths(this.workspaceRoot, entry.name, entry.identity.lifecycleUid).creds),
+                resolve(agentSecretFilePaths(this.workspaceRoot, entry.name).creds),
+            ];
+            const expected = resolve(entry.identity.credential.path);
+            if (!candidates.includes(expected))
+                throw new Error(`retained credential reference for ${entry.name} is not a manager-owned path (expected ${candidates.join(" or ")})`);
             let credentialText;
             try {
                 // The lstat guards the FS MATERIALIZATION the child will read at launch; the identity check
@@ -2298,7 +2972,7 @@ export class Manager {
                 const st = lstatSync(expected);
                 if (!st.isFile() || st.isSymbolicLink())
                     throw new Error("not a regular non-symlink file");
-                const stored = await this.secrets.get(agentCredsKey(entry.name));
+                const stored = await this.secrets.get(agentSecretKeyForFile(expected));
                 if (stored === undefined)
                     throw new Error("the credential is not in the secret store");
                 credentialText = stored;
@@ -2318,16 +2992,26 @@ export class Manager {
             throw new Error(`retained agent ${entry.name} is user-auth but the current manager is not`);
         try {
             const provider = resolveAuthProvider();
-            // Mirror the static branch's expected-path equality: the store reads below are keyed by
-            // NAME, so a retained record aimed at a foreign path would otherwise pass its digest checks
-            // there while a different secret gets validated here. Canonical paths only.
-            const files = agentSecretFilePaths(this.workspaceRoot, entry.name);
-            if (resolve(entry.identity.actorToken.path) !== resolve(files.actorToken) ||
-                resolve(entry.identity.sentinelCredential.path) !== resolve(files.sentinelCreds))
-                throw new Error(`retained identity references are not the manager-owned paths under ${agentCredsDir(this.workspaceRoot)}`);
+            // Mirror the static branch's expected-path discipline, but pin the WHOLE secret FAMILY as ONE
+            // unit: all three of {actorToken, sentinelCreds, health} must equal the lifecycle-keyed triple
+            // (this generation) OR the name-keyed triple (a pre-split inventory carried across the upgrade).
+            // A per-file OR-pin let a corrupt inventory MIX families (lifecycle token + legacy sentinel)
+            // and, worse, left `health` UNPINNED entirely — an arbitrary recorded health path flowed into
+            // the bearer argv and was `rmSync`'d at terminal teardown (inventory-as-delete-gadget). Pinning
+            // the atomic family closes both: `health` is pinned by PATH EQUALITY (never by file existence,
+            // so a transiently-absent health file still validates), and the store reads below key off the
+            // RECORDED path, so a foreign path can neither pass the pin nor address a different row.
+            const lifecycleFiles = agentLifecycleSecretFilePaths(this.workspaceRoot, entry.name, entry.identity.lifecycleUid);
+            const legacyFiles = agentSecretFilePaths(this.workspaceRoot, entry.name);
+            const recordedToken = resolve(entry.identity.actorToken.path);
+            const recordedSentinel = resolve(entry.identity.sentinelCredential.path);
+            const recordedHealth = resolve(entry.identity.health.path);
+            const matchesFamily = (f) => recordedToken === resolve(f.actorToken) && recordedSentinel === resolve(f.sentinelCreds) && recordedHealth === resolve(f.health);
+            if (!matchesFamily(lifecycleFiles) && !matchesFamily(legacyFiles))
+                throw new Error(`retained identity references for ${entry.name} are not one manager-owned secret family: all of actor-token, sentinel, and health must be the lifecycle-<uid> triple or the legacy name-keyed triple under ${agentCredsDir(this.workspaceRoot)} (no mixed families, no foreign health path)`);
             const secrets = this.secrets;
-            const actorToken = await secrets.get(agentActorTokenKey(entry.name));
-            const sentinelCreds = await secrets.get(agentSentinelCredsKey(entry.name));
+            const actorToken = await secrets.get(agentSecretKeyForFile(recordedToken));
+            const sentinelCreds = await secrets.get(agentSecretKeyForFile(recordedSentinel));
             if (actorToken === undefined || sentinelCreds === undefined)
                 throw new Error("the retained actor token / sentinel credential is not in the secret store");
             const adopted = await provider.validateRetainedAgent({
@@ -2414,7 +3098,14 @@ export class Manager {
             }
             let connector;
             try {
-                connector = registry.resolve("connector", entry.launch.connector);
+                // The SAME resolver the spawn path uses. A bare `registry.resolve` here made preserve→resume
+                // fail for EVERY retained agent on the published binary: the resuming manager is a fresh
+                // process whose registry is empty (its supervise child runs with the connector seed
+                // skipped), so nothing is registered until something materializes it from the ext manifest.
+                // That is precisely what `resolveConnector` does and what every spawn path already calls.
+                // Resolving bare meant a preserved mesh could never come back — first-party connectors
+                // included, since the asymmetry is about materialization, not about which connector it is.
+                connector = await this.resolveConnector(entry.launch.connector);
             }
             catch (e) {
                 return { ok: false, error: e.message };
@@ -2505,14 +3196,33 @@ export class Manager {
         if (!batchReserved)
             this.reserved.add(entry.name);
         try {
+            // Unit B F5(b): recover the STATIC identity's nkey seed from the adopted credential (the
+            // creds file embeds it) so the manager stays this incarnation's RENEWAL OWNER across a
+            // preserve/resume — without it the adopted cred would die loud at its TTL with no remint.
+            let adoptedSeed;
+            if (entry.identity.mode === "static") {
+                const stored = await this.secrets.get(agentSecretKeyForFile(resolve(entry.identity.credential.path)));
+                adoptedSeed = stored === undefined ? undefined : /-----BEGIN USER NKEY SEED-----\s*([A-Z0-9]+)\s*-----END USER NKEY SEED-----/.exec(stored)?.[1];
+                if (adoptedSeed === undefined)
+                    console.error(`! resume ${entry.name}: the adopted credential carries no readable nkey seed - the manager cannot renew it (it dies loud at its exp)`);
+            }
             const handle = this.runtime.spawn(entry.name, prepared.spec, entry.launch.cwd);
             const managed = {
                 name: entry.name,
                 role: entry.role,
                 agent: entry.launch.connector,
                 id: entry.identity.mode === "user" ? principalKey(entry.identity.owner, entry.identity.actor).key : entry.identity.id,
+                seed: adoptedSeed,
                 // Recover the ORIGINAL incarnation uid the durables are keyed by (never a fresh mint on resume).
                 lifecycleUid: entry.identity.lifecycleUid,
+                // Adopt the INVENTORY's recorded family (possibly a pre-split name-keyed layout) — the
+                // validated paths above, so this incarnation's later teardown addresses exactly what its
+                // spawn materialized, never a re-derivation.
+                secretPaths: entry.identity.mode === "user"
+                    ? { actorToken: entry.identity.actorToken.path, sentinelCreds: entry.identity.sentinelCredential.path, health: entry.identity.health.path }
+                    : entry.identity.mode === "static"
+                        ? { creds: entry.identity.credential.path }
+                        : undefined,
                 userOwner: entry.identity.mode === "user" ? entry.identity.owner : undefined,
                 spawner: entry.spawner,
                 authorityParent: entry.authorityParent,
@@ -2645,9 +3355,46 @@ export class Manager {
                 if (done || !s)
                     return;
                 clearTimeout(timer);
+                // ┌─ DO NOT MOVE THIS READ. Its POSITION is the fix; its value is not. ──────────────────┐
+                // MOVING IT BELOW `onAgentExit` MAKES READINESS STOP REPORTING GENUINE LAUNCH FAILURES.
+                // That is what breaks — not a style regression, a silent loss of every `failed` terminal
+                // for an agent that really did die on launch. `onAgentExit` reaches `freeSlot`, which sets
+                // this SAME latch on its way through (see its "also covers exit/reap paths" comment), so a
+                // read taken after that call is true for EVERY exit, deliberate or not.
+                //
+                // Read HERE — first statement, before the await and before `onAgentExit` — a set latch can
+                // only have been set by someone else, and the only other setter on this path is
+                // `stopHandle`, which latches SYNCHRONOUSLY and then kills with no suspension between. So a
+                // despawn-caused exit is guaranteed observed with the latch UP and a natural exit with it
+                // DOWN: the distinction holds by program order, never by winning a race.
+                //
+                // The same latch, read one function call apart, answers two different questions.
+                //
+                // TO RE-VERIFY (this is the mutation that proves it, and it is the exact regression a tidy
+                // refactor produces): move this capture below `onAgentExit` and run
+                // `pnpm smoke:manager-spawn-action`. M3 `process exit -> failed` must FAIL. Note that M4 —
+                // the case this fix exists for — still PASSES under that mutation, so the suite this fix
+                // was written against cannot catch its own regression. M3 catches it only because it
+                // happens to share a file.
+                // └──────────────────────────────────────────────────────────────────────────────────────┘
+                const deliberate = a.terminalizing === true;
                 void (async () => {
                     const tail = this.tail(await s.backlog());
                     this.onAgentExit(a);
+                    // A DELIBERATE STOP IS NOT A LAUNCH FAILURE. The despawn path owns this goal's terminal
+                    // and commits `cancel`; reporting `failed` here races it and, when it wins, tells the
+                    // caller the agent died on launch when in fact an operator cancelled it. The process
+                    // teardown above still runs — only the goal's OUTCOME is left to the path that caused it.
+                    // A deliberate stop still has to SETTLE this promise. `clearTimeout` above already
+                    // removed the only other resolver, so returning here leaves it pending forever and the
+                    // spawn's lifecycle ticket is never released — which permanently wedges every drain
+                    // (preparePreservation, and through it a preserving `down`). Settle it as its own
+                    // variant: not `failed` and not `uncertain`, so the caller emits NO terminal and the
+                    // despawn path keeps sole ownership of this goal's `cancel`.
+                    if (deliberate) {
+                        finish({ ok: false, deliberate: true, detail: `${a.name} was stopped before it reported ready` });
+                        return;
+                    }
                     finish({ ok: false, detail: `${a.name} exited on launch${tail ? ` - last output: ${tail}` : ""}` });
                 })();
             };
@@ -2712,19 +3459,1221 @@ export class Manager {
         const a = this.agents.get(name);
         if (!a)
             return { ok: false, error: `no agent "${name}"` };
+        return this.despawnCore(a, caller, admin, args.graceful !== false);
+    }
+    /** The ONE named-terminal core both doors share (P2 item 1, checklist 8): the ctl named `stop`
+     *  and the v0.4 targeted `despawn` are the same terminal — authorize by the shared policy
+     *  ({@link authorizeNamed}: own-child / owner-domain on privileged, any on admin), stop, track.
+     *  The ep door runs the SAME two pieces separately so a policy denial surfaces as the §13.3
+     *  `permission-denied` (never a generic failure). */
+    async despawnCore(a, caller, admin, graceful) {
         const denied = await this.authorizeNamed(a, caller, admin);
         if (denied)
             return { ok: false, error: denied };
-        const graceful = args.graceful !== false;
+        return this.despawnAuthorized(a, graceful, !admin);
+    }
+    /** The post-authorization terminal effect (both doors). `trackNonAdmin` mirrors the ctl door's
+     *  `trackStoppedHandle(a, !admin)` disposition. */
+    despawnAuthorized(a, graceful, trackNonAdmin) {
         this.stopHandle(a, graceful);
-        this.trackStoppedHandle(a, !admin);
-        return { ok: true, data: { name, stopped: true, graceful } };
+        this.trackStoppedHandle(a, trackNonAdmin);
+        void this.cancelAgentGoal(a.name, graceful ? "graceful" : "terminate"); // M4: cancel a live spawn goal
+        return { ok: true, data: { name: a.name, stopped: true, graceful } };
+    }
+    /** Resolve a v0.4 TARGET triple (owner, actor, lifecycleUid — broker-validated subject/body
+     *  agreement, currency re-checked by the serve boundary's resolver) to the live managed agent it
+     *  names. Static agents key `(DEV_OWNER, nkey)`; user-mode agents store the principal dot-form
+     *  in `id`. A uid mismatch is a superseded incarnation — never resolved to its successor. */
+    findManagedByTarget(t) {
+        for (const a of this.agents.values()) {
+            const matches = a.userOwner ? a.id === principalKey(t.owner, t.actor).key : t.owner === DEV_OWNER && a.id === t.actor;
+            if (matches && a.lifecycleUid === t.lifecycleUid)
+                return a;
+        }
+        return undefined;
     }
     /** Open a short-lived PROVISIONER connection, run the onboarding ops on it, and drain it (closure (ii),
      *  residual 2). The DM/DLV consumer-create surface — the irreducible onboarding power — lives only for
      *  this window, never as a standing grant on the long-lived supervisor. A provision-only endpoint
      *  (no presence/consume/channel-watch) connected with memory-only `provisioner` creds; it sets its own
      *  `inboxPrefix` so JS-API replies land on the `_INBOX_<id>.>` the provisioner cred subscribes. */
+    /** Run one static §13.1 lifecycle OPERATION over an ephemeral, key-pinned `lifecycle-executor`
+     *  connection (Unit B): the credential's grants name exactly ONE incarnation's head/uid/gate/
+     *  cred-family/slot keys, so the write authority exists only for this operation's window and
+     *  can move nothing else. The transport is the direct-KV binding the shared core saga drives. */
+    async withLifecycleExecutor(pin, fn) {
+        if (!this.auth)
+            throw new Error("withLifecycleExecutor: no space auth (an open mesh has no lifecycle registry)");
+        const identity = newIdentity();
+        const creds = await mintCreds(this.auth, identity, "lifecycle-executor", {
+            lifecycleExecutor: { owner: pin.owner, actor: pin.actor, lifecycleUid: pin.lifecycleUid, alias: pin.alias },
+        });
+        const nc = await connect({ servers: this.servers ?? DEFAULT_SERVER, ...standaloneConnectOpts({ creds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
+        try {
+            const kvm = new Kvm(nc);
+            const recordsKv = await kvm.open(recordsBucket(this.space));
+            const authKv = await kvm.open(epAuthBucket(this.space));
+            return await fn(staticLifecycleTransport(recordsKv, authKv));
+        }
+        finally {
+            await nc.drain().catch(() => nc.close());
+        }
+    }
+    /** Run one §13.1 ENDPOINT-SERVE credential operation (P2 item 1, 1a-serve) over an ephemeral,
+     *  key-pinned `endpoint-serve-executor` connection: the credential's grants name exactly the
+     *  manager instance's `epgate`/`epcred` keys plus its registration's two records keys, so the
+     *  gate CAS, the mint fence, and the spec/governance writes ride a one-shot scoped authority —
+     *  NEVER the manager's standing seed/supervisor connection (the panel's "no seed shortcut"). */
+    async withEndpointServeExecutor(fn) {
+        if (!this.auth)
+            throw new Error("withEndpointServeExecutor: no space auth (an open mesh has no service registry)");
+        const identity = newIdentity();
+        const creds = await mintCreds(this.auth, identity, "endpoint-serve-executor", {
+            endpointServeExecutor: { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId },
+        });
+        const nc = await connect({ servers: this.servers ?? DEFAULT_SERVER, ...standaloneConnectOpts({ creds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
+        try {
+            const kvm = new Kvm(nc);
+            return await fn({ recordsKv: await kvm.open(recordsBucket(this.space)), authKv: await kvm.open(epAuthBucket(this.space)), nc });
+        }
+        finally {
+            await nc.drain().catch(() => nc.close());
+        }
+    }
+    /** 1d open-mesh counterpart of {@link withEndpointServeExecutor}: an OPEN mesh has no
+     *  credential system, so there is no scoped executor to mint - the same §13.1 gate/records
+     *  writes ride a bare one-shot connection (the broker enforces nothing on an open mesh; the
+     *  ceremony still produces the real gate, epoch, and registration the serve rails run on). */
+    async withOpenServeConnection(fn) {
+        if (this.auth)
+            throw new Error("withOpenServeConnection: an auth mesh must use the scoped endpoint-serve executor");
+        const nc = await connect({ servers: this.servers ?? DEFAULT_SERVER, maxReconnectAttempts: 0 });
+        try {
+            const kvm = new Kvm(nc);
+            // An open mesh may be a RAW broker (no `cotal up` provisioning ran), and `Kvm.open` binds
+            // lazily without checking the stream exists — create-or-verify the §13.12 authority stores
+            // first (the same mode-neutral treatment {@link registerManagerService} gives the contract
+            // store), or the first gate write dies "stream not found".
+            await ensureAuthorityStores(await jetstreamManager(nc), kvm, this.space);
+            return await fn({ recordsKv: await kvm.open(recordsBucket(this.space)), authKv: await kvm.open(epAuthBucket(this.space)), nc });
+        }
+        finally {
+            await nc.drain().catch(() => nc.close());
+        }
+    }
+    /** The served manager-level health summary (1a's one read-only command). */
+    managerStatusData() {
+        return {
+            instanceId: this.managerInstanceId,
+            runtime: this.runtime.kind,
+            agentCount: this.agents.size,
+            uptimeMs: Date.now() - this.startedAtMs,
+        };
+    }
+    /** P2 item 1: register the manager as an ordinary v0.4 `service` endpoint and serve its typed
+     *  command surface on the ep rails - since 1d the manager's ONLY control door. On an AUTH mesh
+     *  the whole credential path is the SAME one an ordinary endpoint traverses (the enforcement
+     *  test that keeps "ordinary" honest): provision the §13.1 issuance gate, drive the
+     *  registration BARRIER's gate CAS, then release the serve credential only on the mint FENCE's
+     *  revision-pinned CAS win — all over the scoped one-shot executor ({@link
+     *  withEndpointServeExecutor}), never a seed-signed shortcut. Holding the signing seed only
+     *  AUTHORIZES the reserved single-label name (`manager`, operator name authority, DEV_OWNER).
+     *  On an OPEN mesh the same gate/registration/serve-grant ceremony runs over bare one-shot
+     *  connections and NO credential is ever minted: there is no credential system to issue from,
+     *  so the gate legitimately keeps an empty `epcred` family (the §13.1 fence is issuance-only)
+     *  and the serve connection is bare — the broker enforces nothing on an open mesh, exactly the
+     *  old open-mesh ctl trust ("open = single-trusted-host"). */
+    async registerManagerService() {
+        const auth = this.auth;
+        // The §13.7 contract store is REGISTRATION's dependency, ensured here MODE-NEUTRALLY (1c.2c):
+        // it used to ride the static-only lifecycle reconcile, so a USER-mode manager registered
+        // against an absent stream and its artifact publish died no-responders (live-repro'd). A
+        // provisioner one-shot creates-or-verifies it (config-B immutability incl. the shadowed-legacy
+        // refuse) before the executor publishes a single artifact.
+        {
+            // Open mesh: the bare connection holds the rights (there is no credential system to mint from).
+            const provCreds = auth ? await mintCreds(auth, newIdentity(), "provisioner") : undefined;
+            const provNc = await connect({ servers: this.servers ?? DEFAULT_SERVER, ...standaloneConnectOpts({ creds: provCreds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
+            try {
+                // P2 item 2: the manager now WRITES goal facts (EPF) + progress events (EPE), so the §13.12
+                // endpoint streams must exist. Nothing provisioned them before spawn-as-action (no endpoint
+                // wrote to EPF/EPE), so the manager ensures the full set here over the provisioner (whose
+                // STREAM.CREATE now covers them), idempotently - createEndpointStreams is a superset of
+                // ensureContractStore + ensureAuthorityStores, fail-loud on drift. Auth + open both run this.
+                await createEndpointStreams(await jetstreamManager(provNc), new Kvm(provNc), this.space);
+            }
+            finally {
+                await provNc.drain().catch(() => provNc.close());
+            }
+        }
+        const iid = this.managerInstanceId;
+        const artifacts = managerClusterArtifacts();
+        // In-memory §13.7 content store: the manager is this document's AUTHOR, so registration and
+        // serve authorization verify against the exact artifacts it publishes from memory. The DURABLE
+        // `epc` contract-store publication (for third-party digest fetches) runs below inside the same
+        // executor, BEFORE the registration that advertises the digests.
+        const store = new Map([
+            [artifacts.rootDigest, artifacts.document],
+            [artifacts.closureDigest, artifacts.manifest],
+        ]);
+        const readClusterArtifact = (digest) => store.get(digest);
+        // §13.9 name authority, static mode: `manager` is a core single-label name requiring OPERATOR
+        // authority — the manager holds the space signing seed, so it self-authorizes exactly its own
+        // name for exactly DEV_OWNER (never a general authority; any other (name, owner) refuses).
+        const authority = {
+            authorize: (name, owner) => ({ authorized: name === MANAGER_ENDPOINT && owner === DEV_OWNER, revision: 0 }),
+        };
+        // The STABLE serve identity (P2 item 3): the PERSISTED serve nkey, reused across restart so the
+        // gate binds the SAME principal (§13.1 serving-principal binding) - provisionEndpointGateOpen
+        // stays idempotent and verified eviction has a stable target. Renewals re-mint the same nkey
+        // with a fresh bounded exp; a restart re-provisions the same (idempotent) gate + re-registers.
+        const serveIdentity = this.managerServeIdentity;
+        const servePrincipal = principalKey(DEV_OWNER, serveIdentity.id).key;
+        // must-5 (b): the STABLE goal-writer identity — a SIBLING credential in the same §13.1 family
+        // (not the gate's bound serving principal), minted here so the run block can family-stage it.
+        this.goalWriterIdentity = newIdentity();
+        // P2 item 6: the STABLE session-LEDGER identity — another SIBLING in the SAME §13.1 family, so
+        // the takeover barrier revokes a deposed manager's ledger cred alongside its goal-writer. The
+        // per-session serving creds join the same family, each with its own fresh identity.
+        this.sessionLedgerIdentity = newIdentity();
+        const run = async ({ recordsKv, authKv, nc: execNc }) => {
+            // §13.7 contract-artifact publication (1c): every schema root + its closure manifest, plus
+            // the cluster document + ITS manifest, land in the EPC store BEFORE the registration that
+            // advertises their digests — so a caller can always fetch-verify-compile a registered
+            // digest (the item-5 generic-invoke read path). Create-only + content-addressed: a retry
+            // or a same-artifact republish is an idempotent lost-CAS. The registration itself still
+            // verifies against the in-memory copies (the manager is the author).
+            const storeCtx = await contractStoreContext(execNc, this.space);
+            for (const value of [...managerContractArtifactValues(), artifacts.document, artifacts.manifest])
+                await publishContractArtifact(storeCtx, contractArtifactCanonicalBytes(value));
+            // §13.1 pre-registration (checklist 1): the issuance gate, born open@gen0 bound to the serve
+            // principal — provisioned ONCE, on the FIRST registration. On a RESTART (P2 item 3) the gate
+            // already EXISTS (advanced past gen0 by the prior registration), so re-provisioning the gen0
+            // row would conflict "foreign content"; the persisted instanceId makes this a TAKEOVER, and
+            // registerServiceInstance below freezes + re-registers the EXISTING gate (advancing the epoch
+            // after it verify-evicts the superseded family). The serve principal is the SAME persisted one,
+            // so the gate's principal binding is unchanged either way.
+            if ((await serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: iid }).observe()) === null)
+                await provisionEndpointGateOpen(authKv, { endpoint: MANAGER_ENDPOINT, instanceId: iid, principal: servePrincipal });
+            // P2 item 3 (slice 3a): on an AUTH mesh a RE-registration (restart of the persisted instanceId)
+            // must VERIFY-EVICT the superseded serve family BEFORE the epoch advances (§13.1 "old authority
+            // dies before new authority is visible"). Inject the SCOPED delivery-admin evictor; the OPEN
+            // mesh mints no serve family, so no evictor (the empty-family path never consults it and a
+            // restart there works evictor-free). NO-ORACLE = LOUD: with no reachable delivery daemon the
+            // evictor THROWS naming the cure, so PHASE 2 fails closed with the delivery-daemon fix in the
+            // error text — a crash-restart never silently skips eviction (no-fallbacks).
+            const barrier = endpointRegistrationBarrier(authKv, this.space, {
+                endpoint: MANAGER_ENDPOINT, instanceId: iid, opId: mintLifecycleUid(),
+                ...(auth ? { evict: makeManagerEndpointEvictor({ space: this.space, servers: this.servers ?? DEFAULT_SERVER, auth, log: (line) => console.error(line) }) } : {}),
+            });
+            const spec = { endpoint: MANAGER_ENDPOINT, owner: DEV_OWNER, clusterDigests: [artifacts.closureDigest], protocol: { v: 1 } };
+            const { registrationRevision } = await registerServiceInstance(recordsKv, {
+                space: this.space, spec, instanceId: iid, registrant: { owner: DEV_OWNER }, authority, barrier, readClusterArtifact,
+            });
+            // processEpoch comes from the GATE (checklist 4: never derived from the uid string); the
+            // fence below is also the mint's §13.1 release CAS.
+            const fence = serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: iid });
+            const observed = await fence.observe();
+            if (observed === null)
+                throw new Error(`the issuance gate for ${MANAGER_ENDPOINT}/${iid} vanished after registration`);
+            const grant = await authorizeServeGrant(recordsKv, {
+                space: this.space, endpoint: MANAGER_ENDPOINT, instanceId: iid, epoch: observed.processEpoch,
+                holder: { owner: DEV_OWNER }, authority, readClusterArtifact,
+                readProcessEpoch: async () => {
+                    const g = await fence.observe();
+                    if (g === null)
+                        throw new Error(`no issuance gate for ${MANAGER_ENDPOINT}/${iid}`);
+                    return g.processEpoch;
+                },
+            });
+            // P2 item 3 (class scatter): write this instance's CONVERGED svc status so it is a §13.5
+            // scatter member — `freezeExpectedSet` skips any instance whose status is absent or lags the
+            // current registration. Instance-side `ready` at the just-registered spec revision, epoch-fenced
+            // to the gate's processEpoch (the same leader-served reader `authorizeServeGrant` used); on a
+            // restart it CAS-updates the predecessor's status forward (the advanced epoch supersedes the old
+            // one). Key-pinned to this instance's own status key on the SAME executor.
+            await writeServiceStatus(recordsKv, {
+                endpoint: MANAGER_ENDPOINT, instanceId: iid, epoch: observed.processEpoch,
+                status: { state: SERVICE_READY, epoch: observed.processEpoch, observedSpecRevision: registrationRevision },
+                readProcessEpoch: async () => {
+                    const g = await fence.observe();
+                    if (g === null)
+                        throw new Error(`no issuance gate for ${MANAGER_ENDPOINT}/${iid}`);
+                    return g.processEpoch;
+                },
+            });
+            // Open mesh: NO mint - the §13.1 fence is issuance-only and nothing is ever issued, so the
+            // gate keeps an empty `epcred` family; the serve connection below stays bare.
+            const creds = auth ? await mintCreds(auth, serveIdentity, "endpoint-serve", { serveIssuance: fence, endpointServe: grant }) : undefined;
+            // must-5 (b): mint + family-stage the goal-writer credential HERE, over this executor's
+            // authKv (the fence is live), so its credId lands in `epcred.<e>.<iid>` and the takeover
+            // barrier revokes it. Open mesh: no mint (no credential system; the goal-writer conn is bare).
+            const goalWriterCreds = auth ? await this.mintAndStageGoalWriter(authKv) : undefined;
+            // P2 item 6: mint + family-stage the session-LEDGER credential HERE too (same executor, same
+            // fence, same §13.1 family), so takeover revokes a deposed manager's ledger connection. The
+            // per-session SERVING credentials are minted later, one per redemption, into the SAME family.
+            // Open mesh: no mint (no credential system; the ledger connection stays bare).
+            const sessionLedgerCreds = auth ? await this.mintAndStageSessionLedger(authKv) : undefined;
+            return { grant, creds, goalWriterCreds, sessionLedgerCreds };
+        };
+        const { grant, creds, goalWriterCreds, sessionLedgerCreds } = await (auth ? this.withEndpointServeExecutor(run) : this.withOpenServeConnection(run));
+        this.goalWriterCreds = goalWriterCreds;
+        this.sessionLedgerCreds = sessionLedgerCreds;
+        // The serve connection presents the CURRENT credential on every (re)connect (the state object
+        // is captured by the authenticator), so a fence-traversing renewal is adopted by reconnect
+        // without re-registration. Reconnects stay unbounded: the serve rails are this instance's
+        // registered surface for its whole incarnation.
+        const state = { handle: undefined, nc: undefined, identity: serveIdentity, grant, creds };
+        const enc = new TextEncoder();
+        const nc = await connect({
+            servers: this.servers ?? DEFAULT_SERVER,
+            // Open mesh: a bare serve connection (no credential exists; the broker enforces nothing).
+            ...(creds !== undefined ? { authenticator: (nonce) => credsAuthenticator(enc.encode(state.creds))(nonce) } : {}),
+            inboxPrefix: `_INBOX_${serveIdentity.id}`,
+            maxReconnectAttempts: -1,
+        });
+        nc.closed().then((err) => { if (err)
+            console.error(`! manager service endpoint connection closed: ${err.message}`); });
+        try {
+            // The 1b typed surface + the derived `describe`. The descriptor stays PUBLIC in static
+            // mode: the broker grant (who holds each command's request-publish row) is the
+            // load-bearing authority tier, and a static single-operator mesh leaks nothing by listing
+            // command names; the trusted per-caller `view(caller)` scoping joins the user-mode
+            // registration follow-up (where actorScope is the trusted source). Every ordinary handler
+            // runs the SHARED admission chokepoint ({@link serveGated}).
+            state.handle = serveEndpoint(nc, this.space, grant, this.managerServiceDefs(), { public: true }, {
+                // The FRESH target resolver (§13.3) for the targeted commands (`despawn`/`attach`): the
+                // manager's live managed set IS the current-mapping authority for its own agents (the
+                // durable slot rows mirror it). Static mode carries no mapping-revision dimension, so
+                // the revision is the constant 0 — a caller that pins a revision pins 0.
+                resolveTarget: (t) => {
+                    if (t.owner === DEV_OWNER) {
+                        for (const a of this.agents.values())
+                            if (!a.userOwner && a.id === t.actor)
+                                return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
+                        return undefined;
+                    }
+                    const key = principalKey(t.owner, t.actor).key;
+                    for (const a of this.agents.values())
+                        if (a.userOwner && a.id === key)
+                            return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
+                    return undefined;
+                },
+            });
+        }
+        catch (e) {
+            await nc.drain().catch(() => nc.close());
+            throw e;
+        }
+        state.nc = nc;
+        this.serviceServe = state;
+        console.error(`manager service endpoint registered: ${MANAGER_ENDPOINT}/${iid} (epoch ${grant.epoch}, registrationRevision ${grant.registrationRevision})`);
+    }
+    /** P2 item 2 must-5 (b): mint the standing `goal-writer` credential and STAGE it into this
+     *  instance's §13.1 revocation family (`epcred.<e>.<iid>`), over the passed executor's `authKv`
+     *  (the scoped `endpoint-serve-executor`, which holds the epcred write grant). The GRANT profile
+     *  stays goal-writer-only (Q2 — disjoint from the serve credential); only the FAMILY membership
+     *  is shared, so the registration barrier's existing enumerate+revoke+evict catches the
+     *  goal-writer on takeover/retire with NO barrier code change. Used both at registration (the run
+     *  block's `authKv`) and at renewal (a fresh executor's), re-minting the SAME stable nkey with a
+     *  fresh bounded exp — each issuance writes a DISTINCT ledger row (per-JWT credentialId digest). */
+    async mintAndStageGoalWriter(authKv) {
+        const auth = this.auth;
+        const identity = this.goalWriterIdentity;
+        // The issuance gate + §13.1 revocation family are keyed by the REGISTRATION instanceId
+        // (the persisted logical id, item 3's split), NOT the per-process lifecycleUid — the barrier
+        // enumerates `epcred.<e>.<managerInstanceId>`, so the goal-writer must stage into that family.
+        const iid = this.managerInstanceId;
+        const creds = await mintCreds(auth, identity, "goal-writer", { goalWriter: { endpoint: MANAGER_ENDPOINT } });
+        const exp = inspectCredHealth(creds).exp;
+        if (exp === undefined)
+            throw new Error(`the goal-writer credential for ${MANAGER_ENDPOINT}/${iid} is unbounded; the §13.1 ledger row requires an expiry`);
+        const fence = serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: iid });
+        const observed = await fence.observe();
+        if (observed === null)
+            throw new Error(`the issuance gate for ${MANAGER_ENDPOINT}/${iid} vanished; the goal-writer cannot join its §13.1 revocation family`);
+        // The §13.1 open-and-commit fence, the SAME one the serve credential's own mint runs: a frozen
+        // gate refuses, and a gate that moved under us loses the CAS and revokes the staged row. Without
+        // it a barrier mid-takeover (already past its enumeration) would let this credential land
+        // ACTIVE in a family nothing revokes again.
+        await commitSiblingIssuance(fence, observed, {
+            credentialId: rawDigest(creds).replace("sha256:", "sha256-"),
+            credentialKey: identity.id,
+            holderPrincipal: principalKey(DEV_OWNER, identity.id).key,
+            endpoint: MANAGER_ENDPOINT, lifecycleUid: iid, sourceChain: ["root"], state: "active", exp,
+            generation: observed.generation, processEpoch: observed.processEpoch,
+            registrationRevision: observed.registrationRevision, nameAuthorityRevision: observed.nameAuthorityRevision,
+        });
+        return creds;
+    }
+    /** P2 item 2 (spawn-as-action): stand up the standing self-mediated goal-writer connection +
+     *  ActionContext. Mode-dual, mirroring {@link registerManagerService}: an AUTH mesh uses the
+     *  scoped `goal-writer` credential already minted + family-STAGED inside registration's run block
+     *  ({@link mintAndStageGoalWriter} — DISJOINT grant from the serve cred, SHARED §13.1 revocation
+     *  family); an OPEN mesh uses a bare connection (no credential system to mint from - the broker
+     *  enforces nothing). The connection presents the CURRENT credential on every (re)connect (a
+     *  renewal is adopted without reconnecting the whole endpoint); the ActionContext bonds its
+     *  KV + JS + JSM to this one connection and space (SPEC 13.4), so a composition mixup cannot splice
+     *  goal state across brokers. */
+    async startGoalWriter() {
+        const identity = this.auth ? this.goalWriterIdentity : newIdentity();
+        const enc = new TextEncoder();
+        // The mutable holder captured by the authenticator (mirrors the serve connection): a half-TTL
+        // renewal updates `gw.creds` and the next (re)connect presents the refreshed credential.
+        const gw = { nc: undefined, ctx: undefined, creds: this.auth ? this.goalWriterCreds : undefined, identity };
+        const nc = await connect({
+            servers: this.servers ?? DEFAULT_SERVER,
+            ...(this.auth ? { authenticator: (nonce) => credsAuthenticator(enc.encode(gw.creds))(nonce) } : {}),
+            inboxPrefix: `_INBOX_${identity.id}`,
+            maxReconnectAttempts: -1,
+        });
+        nc.closed().then((err) => { if (err)
+            console.error(`! manager goal-writer connection closed: ${err.message}`); });
+        gw.nc = nc;
+        // The (i) fence resolver (SPEC 13.6 P2 item 3): resolve an executing instance's CURRENT gate
+        // epoch. This manager reconciles only ITS OWN goals (security pin 4), so it resolves its own
+        // registration instanceId to this incarnation's serve-grant epoch; a foreign/retired instance
+        // is `null` (no current terminal to surface). A successor incarnation carries an ADVANCED epoch
+        // here, so its reads pick the current-epoch subject and the predecessor's terminal is fenced out.
+        gw.ctx = await actionContext(nc, this.space);
+        // The own-issuance-gate READER for the currency belt, on BOTH mesh modes. Reads
+        // `epgate.<e>.<iid>` over this connection; observe-only (stage/commit/revoke are never called
+        // through it — the goal-writer holds no gate/epcred WRITE grant, so a mis-call would
+        // broker-deny anyway).
+        //
+        // OPEN MESH IS NOT EXEMPT, and this is load-bearing. An open-mesh registration mints no
+        // credentials, so the §13.1 takeover barrier's revoke-and-evict loop enumerates an EMPTY family
+        // and is VACUOUS — yet it still advances processEpoch. The gate row itself DOES exist there
+        // (`provisionEndpointGateOpen`, over the authority stores the open serve path ensures), and a
+        // bare connection CAN read it (executed probe). So this belt is the ONLY thing standing between
+        // a deposed open-mesh incarnation and a wrong terminal on the one create-only result subject.
+        //
+        // NAME IT HONESTLY: on an open mesh this is a COOPERATIVE fence. The broker enforces nothing, so
+        // a hostile or non-conformant process can simply not run the check — the same guarantee class as
+        // every other open-mesh property. It is also a read-then-CAS, so it NARROWS the commit window
+        // rather than closing it. An AUTH mesh gets durable closure from the §13.1 barrier (revoke +
+        // cluster-verified eviction BEFORE the epoch advance); an open mesh gets none.
+        gw.gate = serveIssuanceGateKv(await new Kvm(nc).open(epAuthBucket(this.space)), this.space, { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId });
+        this.goalWriter = gw;
+        console.error(`manager goal-writer standing (endpoint ${MANAGER_ENDPOINT}, ${this.auth ? "scoped cred, §13.1 family-staged" : "open/bare"})`);
+    }
+    /** Drain the goal-writer connection (best-effort, both exit paths). */
+    async stopGoalWriter() {
+        const gw = this.goalWriter;
+        if (!gw)
+            return;
+        this.goalWriter = undefined;
+        try {
+            await gw.nc.drain();
+        }
+        catch {
+            try {
+                gw.nc.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    /** P2 item 6: mint the standing `session-ledger` credential and STAGE it into this instance's
+     *  §13.1 revocation family (`epcred.<e>.<iid>`), over the passed executor's `authKv` — EXACTLY the
+     *  {@link mintAndStageGoalWriter} pattern, under the same open-and-commit fence.
+     *
+     *  This credential carries the DEDICATED sessions-bucket ledger rows and no session rail at all.
+     *  It therefore takes no epoch pin: §13.6 makes it the durable revocation authority that must
+     *  outlive the serving endpoint, so scoping it to one serving epoch would defeat its purpose. The
+     *  epoch lives where it belongs, on the per-session serving credentials, which are minted per
+     *  redemption into this same family. Re-minting the SAME nkey on renewal writes a DISTINCT ledger
+     *  row (per-JWT credentialId digest). */
+    async mintAndStageSessionLedger(authKv) {
+        const auth = this.auth;
+        const identity = this.sessionLedgerIdentity;
+        // Registration instanceId (item 3's persisted logical id), not the per-process lifecycleUid:
+        // the barrier enumerates `epcred.<e>.<managerInstanceId>`, so the ledger cred joins that family.
+        const iid = this.managerInstanceId;
+        const fence = serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: iid });
+        const observed = await fence.observe();
+        if (observed === null)
+            throw new Error(`the issuance gate for ${MANAGER_ENDPOINT}/${iid} vanished; the session-ledger cred cannot join its §13.1 revocation family`);
+        const creds = await mintCreds(auth, identity, "session-ledger");
+        const exp = inspectCredHealth(creds).exp;
+        if (exp === undefined)
+            throw new Error(`the session-ledger credential for ${MANAGER_ENDPOINT}/${iid} is unbounded; the §13.1 ledger row requires an expiry`);
+        // The §13.1 open-and-commit fence (see {@link mintAndStageGoalWriter}): stage + revision-pinned
+        // commit against the gate this mint's grant was scoped from, releasing only on the win.
+        await commitSiblingIssuance(fence, observed, {
+            credentialId: rawDigest(creds).replace("sha256:", "sha256-"),
+            credentialKey: identity.id,
+            holderPrincipal: principalKey(DEV_OWNER, identity.id).key,
+            endpoint: MANAGER_ENDPOINT, lifecycleUid: iid, sourceChain: ["root"], state: "active", exp,
+            generation: observed.generation, processEpoch: observed.processEpoch,
+            registrationRevision: observed.registrationRevision, nameAuthorityRevision: observed.nameAuthorityRevision,
+        });
+        return creds;
+    }
+    /** P2 item 6: stand up the ONE §13.6 session plane on its own standing connection. Mode-dual,
+     *  mirroring {@link startGoalWriter}: an AUTH mesh presents the scoped `session-ledger` cred
+     *  already minted + family-staged inside registration's run block ({@link mintAndStageSessionLedger});
+     *  an OPEN mesh uses a bare connection (no credential system to mint from). The connection presents
+     *  the CURRENT credential on every (re)connect, so a half-TTL renewal is adopted without reconnecting.
+     *
+     *  The offer SIGNER is a per-incarnation in-memory keypair: the static collapsed path mints AND
+     *  redeems the offer in one call ({@link ManagerSessionPlane.establishAttach}), so the manager
+     *  self-signs and self-verifies its own §13.6 grants and the keypair never leaves the process — a
+     *  holder never verifies the signature (it presents the grant back over the rail; the broker's
+     *  per-session caller cred is the holder's real fence). The plane's ledger lives in the DEDICATED
+     *  sessions bucket (createEndpointStreams provisioned it at registration). */
+    async startSessionPlane() {
+        const identity = this.auth ? this.sessionLedgerIdentity : newIdentity();
+        const enc = new TextEncoder();
+        // The mutable holder captured by the authenticator (mirrors the goal-writer): a half-TTL renewal
+        // updates `sw.creds` and the next (re)connect presents the refreshed credential.
+        const sw = { nc: undefined, creds: this.auth ? this.sessionLedgerCreds : undefined };
+        const nc = await connect({
+            servers: this.servers ?? DEFAULT_SERVER,
+            ...(this.auth ? { authenticator: (nonce) => credsAuthenticator(enc.encode(sw.creds))(nonce) } : {}),
+            inboxPrefix: `_INBOX_${identity.id}`,
+            maxReconnectAttempts: -1,
+        });
+        nc.closed().then((err) => { if (err)
+            console.error(`! manager session-ledger connection closed: ${err.message}`); });
+        sw.nc = nc;
+        const serveEpoch = this.serviceServe?.grant.epoch;
+        if (serveEpoch === undefined)
+            throw new Error("the manager session plane needs the serve grant epoch; registerManagerService must run first");
+        const ledgerKv = await openSessionLedgerKv(nc, sessionsBucket(this.space));
+        const signer = newArtifactSigner();
+        const keyId = `mgr-sessions-${identity.id.slice(0, 12)}`;
+        const anchor = {
+            keyId, publicKey: signer.publicKey, owner: MANAGER_ENDPOINT, roles: ["sessions"],
+            scope: { sessions: [MANAGER_ENDPOINT] }, validFrom: Date.now() - 60_000, validTo: Date.now() + SESSION_GRANT_MAX_TTL_MS,
+        };
+        this.sessionPlane = new ManagerSessionPlane({
+            space: this.space,
+            // The session's serving identity is the persisted REGISTRATION instanceId (item 3), not the
+            // per-process lifecycleUid: a restarted manager re-registers the SAME logical instanceId with
+            // an ADVANCED epoch, so a client re-attaches by the same instance while the epoch fences the
+            // old incarnation's sessions (item 6's restart-refusal composed with item 3's addressing).
+            serving: { instanceId: this.managerInstanceId, epoch: serveEpoch },
+            signer: { keyId, keyPair: signer }, resolveAnchor: (id) => (id === keyId ? anchor : undefined),
+            ledgerKv, ttlMs: SESSION_GRANT_MAX_TTL_MS,
+            servingCredential: this.sessionServingCredentials(),
+            ...(this.maxSessions !== undefined ? { maxSessions: this.maxSessions } : {}),
+        });
+        this.sessionLedgerConn = sw;
+        console.error(`manager session plane standing (endpoint ${MANAGER_ENDPOINT}, epoch ${serveEpoch}, ${this.auth ? "scoped session-ledger cred, §13.1 family-staged" : "open/bare"})`);
+    }
+    /**
+     * The per-session SERVING credential seam (P2 item 6, SPEC 13.6): the manager mints, gate-stages,
+     * connects and revokes ONE credential per live session, replacing a standing credential that held
+     * `eps.manager.*.<epoch>.{in,out}` and so reached every live session's bytes at its epoch.
+     *
+     * Each session gets its OWN nkey identity, so the §13.1 barrier's evict-by-holderPrincipal reaches
+     * it individually, and each is staged into `epcred.manager.<instanceId>` — the SAME family the
+     * ledger and goal-writer creds join. That is how manager takeover still kills a deposed manager's
+     * sessions: the barrier enumerates the family, revokes every row, and evicts every holder, so the
+     * per-session creds die with the incarnation exactly as the standing one did, with the blast
+     * radius of a leaked credential cut from "every session at this epoch" to "one dead session".
+     *
+     * OPEN MESH: no credential system exists to mint from, so the seam mints nothing and opens a bare
+     * connection. That is not a degraded auth path — an open mesh has no broker enforcement at all —
+     * and it is still per-session: the connection and the ledger row are still one-per-session, so
+     * teardown behaves identically in both modes.
+     */
+    sessionServingCredentials() {
+        const iid = this.managerInstanceId;
+        const gate = async (fn) => this.withEndpointServeExecutor(({ authKv }) => fn(authKv));
+        return {
+            mint: async (grant) => {
+                // Open mesh: no auth to mint from. The id still names the session so the ledger row and the
+                // teardown path are identical in both modes.
+                if (!this.auth)
+                    return { id: `${grant.sessionId}.s`, creds: "", exp: grant.exp };
+                const identity = newIdentity();
+                const creds = await mintCreds(this.auth, identity, "session-serving", {
+                    sessionServing: { endpoint: grant.endpoint, sessionId: grant.sessionId, epoch: grant.serving.epoch },
+                    expiresAt: Math.floor(grant.exp / 1000), // grant.exp is ms; the JWT exp is seconds
+                });
+                const health = inspectCredHealth(creds);
+                if (health.exp === undefined)
+                    throw new Error(`the session-serving credential for ${grant.sessionId} is unbounded; a per-session credential never outlives its session (SPEC 13.6)`);
+                this.sessionServingKeys.set(rawDigest(creds).replace("sha256:", "sha256-"), identity.id);
+                return { id: rawDigest(creds).replace("sha256:", "sha256-"), creds, exp: grant.exp };
+            },
+            observeGate: async (_endpoint, instanceId) => {
+                // Open mesh: nothing is minted and nothing is staged, so there is no gate to pin (see
+                // ServingGatePin.gate — the stage refuses loudly if this is ever missing on an auth mesh).
+                if (!this.auth)
+                    return { key: epgateKey(MANAGER_ENDPOINT, instanceId), revision: 0 };
+                return gate(async (authKv) => {
+                    const observed = await serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId }).observe();
+                    if (observed === null)
+                        throw new Error(`the issuance gate for ${MANAGER_ENDPOINT}/${instanceId} vanished; a session credential never stages against a missing gate (SPEC 13.1)`);
+                    // The WHOLE observation rides the pin: the stage's fence compares every field of it, which
+                    // is what lets a lost CAS be classified rather than blanket-refused.
+                    return { key: epgateKey(MANAGER_ENDPOINT, instanceId), revision: observed.revision, gate: observed };
+                });
+            },
+            stage: async (grant, cred, pin) => {
+                if (!this.auth)
+                    return; // open mesh: nothing minted, so nothing to make revocable
+                const key = this.sessionServingKeys.get(cred.id);
+                if (key === undefined)
+                    throw new Error(`no minted identity for session credential ${cred.id}; the stage cannot record a holder it did not mint (SPEC 13.1)`);
+                // THE REDEMPTION'S OWN PIN IS THE FENCE, and it is never re-read into something newer here:
+                // `commitSiblingIssuance` CASes on this observation's revision and, on a loss, refuses unless
+                // the gate is still identical to it in every field but the revision. A barrier
+                // (freeze, or reopen at a successor coordinate) is therefore always a refusal, while another
+                // session's identical-bytes commit touch is not — per-session credentials all serialize on
+                // this one gate key, so refusing on that would fail live sessions for contention rather than
+                // for a barrier. A read is never a fence (SPEC 13.1); the pinned CAS is.
+                const observed = pin.gate;
+                if (observed === undefined)
+                    throw new Error(`the redemption of session ${grant.sessionId} carries no gate observation for ${MANAGER_ENDPOINT}/${iid}; a session credential never stages unfenced (SPEC 13.1)`);
+                await gate(async (authKv) => {
+                    const fence = serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: iid });
+                    await commitSiblingIssuance(fence, observed, {
+                        credentialId: cred.id,
+                        credentialKey: key,
+                        holderPrincipal: principalKey(DEV_OWNER, key).key,
+                        endpoint: MANAGER_ENDPOINT, lifecycleUid: iid,
+                        // The lineage records that this credential exists because a session was redeemed, so a
+                        // ledger reader can tell a per-session row from a standing one (SPEC 13.6 sourceChain).
+                        sourceChain: [`session.${grant.sessionId}`], state: "active",
+                        exp: Math.floor(cred.exp / 1000),
+                        generation: observed.generation, processEpoch: observed.processEpoch,
+                        registrationRevision: observed.registrationRevision, nameAuthorityRevision: observed.nameAuthorityRevision,
+                    });
+                });
+            },
+            open: async (cred) => {
+                // FAIL LOUD: there is deliberately no shared connection to fall back to. Serving a session
+                // without its own credential is exactly the standing-writer shape this design removes.
+                const opts = this.auth ? standaloneConnectOpts({ creds: cred.creds, /* not yet wired to a recorded transport */ tls: false }) : {};
+                return connect({ servers: this.servers ?? DEFAULT_SERVER, ...opts, maxReconnectAttempts: -1 });
+            },
+            revoke: async (credentialId) => {
+                if (!this.auth)
+                    return; // open mesh: nothing was minted
+                await gate(async (authKv) => {
+                    await markLedgerRowRevoked(authKv, epcredRowKey(MANAGER_ENDPOINT, iid, credentialId));
+                });
+                this.sessionServingKeys.delete(credentialId);
+            },
+        };
+    }
+    /** Tear the session plane down (best-effort, both exit paths): end every live bridge with the
+     *  honest `manager-restart` reason (this incarnation is going away; any successor takes a new epoch
+     *  and refuses these grants), then drain each session's own connection and the ledger connection. */
+    async stopSessionPlane() {
+        const plane = this.sessionPlane;
+        const sw = this.sessionLedgerConn;
+        this.sessionPlane = undefined;
+        this.sessionLedgerConn = undefined;
+        // `drain` awaits each session's teardown (connection close, terminal row, credential revoke);
+        // `endAll` alone would let the process exit with per-session connections still open.
+        try {
+            await plane?.drain("manager-restart");
+        }
+        catch { /* best effort */ }
+        if (sw) {
+            try {
+                await sw.nc.drain();
+            }
+            catch {
+                try {
+                    sw.nc.close();
+                }
+                catch { /* best effort */ }
+            }
+        }
+    }
+    /** P2 item 2 must-5 Q-B — the boot reconcile: a fresh incarnation (a manager restart takes a NEW
+     *  instanceId, so the in-memory acceptance map starts empty) inherits the endpoint's accepted-but-
+     *  unterminal goals from any predecessor. Enumerate the durable index over a scoped PROVISIONER
+     *  (records CONSUMER.CREATE; the goal-writer holds NO enumeration grant, exactly the ruling) and
+     *  settle each orphan so an accepted goal is NEVER dropped across a restart. Open mesh: a bare
+     *  connection (the broker enforces nothing). Runs ONCE at start, BEFORE spawn-as-action begins
+     *  accepting (the `goalReconcileDone` gate), so it never races a live goal's acceptance. Never
+     *  fatal — a reconcile failure is logged and the gate opens either way. */
+    async reconcileGoalIndex() {
+        const gw = this.goalWriter;
+        if (!gw) {
+            this.goalReconcileDone = true;
+            return;
+        }
+        try {
+            let entries = [];
+            const nc = this.auth
+                ? await connect({ servers: this.servers ?? DEFAULT_SERVER, ...standaloneConnectOpts({ creds: await mintCreds(this.auth, newIdentity(), "provisioner"), /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 })
+                : await connect({ servers: this.servers ?? DEFAULT_SERVER, maxReconnectAttempts: 0 });
+            try {
+                const kvm = new Kvm(nc);
+                await ensureAuthorityStores(await jetstreamManager(nc), kvm, this.space);
+                entries = await listGoalIndex(await kvm.open(recordsBucket(this.space)), MANAGER_ENDPOINT);
+            }
+            finally {
+                await nc.drain().catch(() => nc.close());
+            }
+            // Single-manager item 2: EVERY inherited entry belongs to a DEAD predecessor (only one manager
+            // at a time), so all are reconciled. The `iid` field is the hook item-3's multi-instance sweep
+            // filters on (skip a goal whose accepting `iid` is a still-LIVE sibling — never settle its goal).
+            for (const { ref, iid } of entries) {
+                if (this.goalAcceptances.has(ref.goalId))
+                    continue; // never settle a goal THIS incarnation drives
+                try {
+                    await this.reconcileOneGoal(ref, iid);
+                }
+                catch (e) {
+                    console.error(`! goal reconcile for ${ref.goalId}: ${e.message}`);
+                }
+            }
+            if (entries.length)
+                console.error(`goal-index boot reconcile: swept ${entries.length} inherited goal(s)`);
+        }
+        catch (e) {
+            console.error(`! goal-index boot reconcile failed: ${e.message} - accepted goals from a predecessor may stay unsettled until the next restart`);
+        }
+        finally {
+            this.goalReconcileDone = true;
+        }
+    }
+    /** Settle ONE inherited goal by evidence: no goal record (a crash between the index write and the
+     *  goal-record create) leaves the pointer untouched (never settle a goal that was never accepted,
+     *  and clearing it would race a live goal mid-creation); a TERMINAL goal clears the index
+     *  (converged — the predecessor committed but died before clearing); a NON-TERMINAL goal settles
+     *  `uncertain` (the accepting incarnation is gone, so the success signal will never reach us — the
+     *  bounded readiness outcome the plan maps the window to). Within the readiness window it arms a
+     *  bounded, unref'd timer to settle at the deadline (an early uncertain would steal a still-possible
+     *  success the substrate guards against). */
+    async reconcileOneGoal(ref, acceptedByIid) {
+        const gw = this.goalWriter;
+        if (!gw)
+            return;
+        const status = await readGoalStatus(gw.ctx, ref);
+        if (status === undefined)
+            return; // index points at no goal record: a dead pointer, left for honesty
+        if (GOAL_TERMINAL_STATES.includes(status.value.state)) {
+            await clearGoalIndex(gw.ctx, ref);
+            return;
+        }
+        const spec = await readGoalSpec(gw.ctx, ref);
+        if (spec === undefined)
+            return; // a status without its spec is garbled — leave for the next boot
+        // NEVER A CROSS-INSTANCE SETTLE. The accepting incarnation is recorded on the INDEX ENTRY
+        // itself (`iid`, written at accept), which is the honest coordinate: a same-instanceId restart
+        // inherits its predecessor's orphans, and a goal accepted by a DIFFERENT (possibly still-live)
+        // sibling is left for its owner. This replaces the goal spec's `executor` pin, which existed
+        // only to epoch-scope the terminal subject and is gone with it (SPEC:1394).
+        if (acceptedByIid !== this.managerInstanceId) {
+            console.error(`goal reconcile ${ref.goalId}: accepted by instance "${acceptedByIid}", not this incarnation "${this.managerInstanceId}"; left for its owner (never a cross-instance settle)`);
+            return;
+        }
+        const settle = async () => {
+            // A SUCCESSOR settling work it inherited: the committer is THIS incarnation at its CURRENT
+            // serve epoch, which is strictly greater than the goal's acceptedEpoch — the `committed >
+            // accepted` arm of the attribution rule, and the reason that arm has to exist.
+            await settleGoalUncertain(gw.ctx, { ref, now: Date.now(), committer: { instanceId: this.managerInstanceId, epoch: this.serviceServe?.grant.epoch ?? 0 } }); // first-terminal-wins: a racing terminal returns the winner, no throw
+            await clearGoalIndex(gw.ctx, ref);
+        };
+        const remaining = spec.value.acceptedAt + (spec.value.readinessDeadlineMs ?? this.readinessTimeoutMs) - Date.now();
+        if (remaining <= 0) {
+            await settle();
+            return;
+        }
+        console.error(`goal reconcile ${ref.goalId}: within the readiness window (${remaining}ms) - arming a bounded settle`);
+        const t = setTimeout(() => { settle().catch((e) => console.error(`! goal reconcile settle ${ref.goalId}: ${e.message}`)); }, remaining + 100);
+        t.unref?.();
+    }
+    /** P2 item 2: publish a goal PROGRESS event on the caller-scoped epe subtree, over the SERVE
+     *  connection (which holds the `epe.<e>.<iid>.<epoch>.>` egress grant; the goal-writer deliberately
+     *  does not). The terminal rides a final event `phase:"terminal"` (Q1 — the caller follows epe to
+     *  the terminal; the durable result fact + inspect/ps are the reconcile authority). A dropped event
+     *  is non-fatal (the terminal is authoritative in the journal). */
+    emitGoalProgress(ref, epoch, event) {
+        const nc = this.serviceServe?.nc;
+        if (!nc)
+            return;
+        try {
+            nc.publish(epeSubject(this.space, MANAGER_ENDPOINT, this.managerInstanceId, epoch, goalProgressTopic(ref)), new TextEncoder().encode(JSON.stringify({ v: 1, goalId: ref.goalId, ...event })));
+        }
+        catch (e) {
+            console.error(`! goal progress emit for ${ref.goalId} failed: ${e.message}`);
+        }
+    }
+    /** The own-gate currency belt: before the goal-writer commits a terminal fact, the manager reads
+     *  its OWN issuance gate epoch and REFUSES the commit if superseded. This NARROWS the window; it
+     *  is not the fence. Layer 1 below is closed by the sibling-mint fence; layers 2 and 3 are not
+     *  closed by any planned slice and must not be described as temporary.
+     *
+     *  THE RESIDUAL, STACKED:
+     *   1. SIBLING-MINT INJECTION. A §13.1 barrier's revoke/evict loop closes only over the family
+     *      SNAPSHOT IT ENUMERATED, so a sibling mint that observes the gate and stages a ledger row
+     *      WITHOUT the observe/open/commit fence can be staged and released AFTER that enumerate and
+     *      never be revoked. This layer is closed exactly where BOTH sibling mint sites
+     *      ({@link mintAndStageGoalWriter}, {@link mintAndStageSessionLedger}) route their stage
+     *      through `commitSiblingIssuance` (the revision-pinned CAS that makes a losing mint release
+     *      nothing), and open exactly where they do not — state the mechanism, never the branch.
+     *   2. THE BARRIER WINDOW. A gate FREEZE neither kills this connection nor advances the epoch,
+     *      and this belt compares `processEpoch` alone, so it still PASSES from barrier start until
+     *      the reopen. A ledger revoke marks a row; it does not re-check a live JWT mid-publish. The
+     *      durable kill is the CLUSTER-VERIFIED EVICTION, so a deposed manager can INITIATE new
+     *      terminal publishes from barrier start until eviction is verified — not merely finish bytes
+     *      already on the wire. Successor EXISTENCE and corpse DEATH are different phases, so the
+     *      barrier's ordering licenses no conclusion about when the corpse stops being able to write.
+     *   3. OPEN MESH. No credential family exists, so the revoke/evict loop is vacuous and this belt
+     *      is COOPERATIVE only: a non-conformant process simply does not run it.
+     *  The named follow-up that would close 2 and 3 is the gate-linearized commit (routing the
+     *  terminal through the issuance gate's own CAS), deliberately deferred as substrate territory.
+     *  An earlier revision of this comment claimed the residual was "closed by item-3 slice 3.0,
+     *  never a permanent residual". That asserted a closure that does not exist. */
+    async assertGoalWriterEpochCurrent(epoch) {
+        const gate = this.goalWriter?.gate;
+        if (!gate)
+            return; // no goal-writer standing yet
+        const observed = await gate.observe();
+        if (observed === null)
+            throw new EpEnvelopeError("expired", `the manager's issuance gate for ${MANAGER_ENDPOINT}/${this.managerInstanceId} is gone; a retired incarnation never commits a goal terminal (SPEC 13.1/13.6)`);
+        if (observed.processEpoch !== epoch)
+            throw new EpEnvelopeError("expired", `the manager's issuance gate epoch is ${observed.processEpoch} but this goal was accepted under epoch ${epoch}; a superseded incarnation never commits a goal terminal (must-5 (a) own-gate belt, SPEC 13.6)`);
+    }
+    /** Serve `spawn`/`launch` as an ACTION (P2 item 2). Authz already ran in {@link serveGated}. The
+     *  accept path runs INLINE on the handler ({@link startAgent} with hooks): the goal binds + the
+     *  acceptance replies the moment the identity is minted, BEFORE any provision (pin 1); progress and
+     *  the terminal are driven OFF-handler, so the ~30s readiness wait no longer blocks the reply.
+     *  Returns the acceptance floor payload {name, owner, actor, uid, goalId, fingerprint, executor}
+     *  (the ALLOCATED identity). goalId = the request id (env.id, Q3). */
+    async serveSpawnGoal(ctx, run) {
+        const gw = this.goalWriter;
+        if (!gw)
+            throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing; spawn-as-action cannot accept (SPEC 13.6)");
+        // must-5 Q-B: refuse to accept until the boot reconcile of inherited goals completes, so a fresh
+        // acceptance never races the sweep (settling a live goal mid-flight would steal its real terminal).
+        if (!this.goalReconcileDone)
+            throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; retry shortly (SPEC 13.6)");
+        const goalId = ctx.request.id;
+        const { fingerprint } = submissionFingerprint(ctx.request, ctx.subject);
+        const ref = goalRefOf(ctx.subject, goalId);
+        const executor = { lifecycleUid: this.managerInstanceId, epoch: this.serviceServe?.grant.epoch ?? 0 };
+        const epoch = executor.epoch;
+        const acceptedAt = Date.now();
+        // Idempotent same-goalId retry (a client re-send): serve the IDENTICAL acceptance without
+        // re-running the accept path — so a HARD-PINNED retry does not trip the M6 same-name refuse and no
+        // name is re-allocated. Same-incarnation rides the live map; the create-only bindGoal in onAccepted
+        // still fences a CONCURRENT same-goalId race (the loser aborts and serves the winner's acceptance).
+        const prior = this.goalAcceptances.get(goalId);
+        if (prior !== undefined) {
+            if (prior.fingerprint !== fingerprint)
+                throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted under a different submission; one goalId never carries two specs (SPEC 13.6)`);
+            return prior;
+        }
+        let resolveAccept;
+        let rejectAccept;
+        const acceptP = new Promise((res, rej) => { resolveAccept = res; rejectAccept = rej; });
+        let acceptance;
+        // H1: set the instant the terminal path is ENTERED, not when it succeeds — the post-accept
+        // fallback below must fire only when `onOutcome` never ran at all, never as a second attempt
+        // behind a commit that threw.
+        let terminalEntered = false;
+        // TWO DIFFERENT QUESTIONS, DELIBERATELY NOT ONE FLAG.
+        //
+        //   `terminalEntered`  HAS this goal already been settled (or claimed) by someone?
+        //   `ownsGoal`         MAY THIS ATTEMPT settle it at all?
+        //
+        // The second is the authority, and it is default-CLOSED: an attempt earns it by WINNING the
+        // create-only `bindGoal` CAS below, and nothing else grants it. That matters because the
+        // post-accept fallback exists to settle a goal nobody answered, so every new way of leaving
+        // this function is opted INTO committing a terminal unless something stops it. Deriving the
+        // right from the claim instead of from a running record means a losing attempt CANNOT commit
+        // down any unwind path, including ones added later that never thought about this. Collapsing
+        // the two into one boolean is what let a duplicate-goal loser steal the winner's terminal
+        // (#357): it had entered no terminal, so the fallback wrote one for it, using its own abort
+        // message as the caller-visible outcome.
+        let ownsGoal = false;
+        // The terminal commits OFF-handler on the goal-writer connection (manager-only authority; a
+        // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): must-5 (a) reads THIS
+        // incarnation's OWN gate epoch and REFUSES a superseded commit (the currency belt), and (b)
+        // barrier-revoke evicts this connection on takeover. The terminal lands on the ONE subject
+        // SPEC:1394 reserves; first-terminal-fact-wins is global, so a committed outcome is visible
+        // to every reader in every incarnation. On success the reconcile-index entry is cleared.
+        //
+        // Named rather than inlined into the hooks below so the H1 post-accept fallback drives THIS
+        // path — one commit site, so the progress event, the index clear and the `agentGoals` cleanup
+        // cannot drift between a normal outcome and a recovered one.
+        const onOutcome = async (o) => {
+            // THE AUTHORITY CHECK, and the only one. An attempt that never won the bind provisioned
+            // nothing and has no outcome to report: the goal belongs to whoever won it, in this
+            // incarnation or a sibling. Refusing here rather than at each unwind site is the point --
+            // there is exactly one commit path, so this fences every route into it, present and future.
+            if (!ownsGoal)
+                return;
+            terminalEntered = true; // entered, not succeeded — see the catch below
+            try {
+                await this.assertGoalWriterEpochCurrent(epoch); // must-5 (a): a superseded corpse never commits
+                let fact;
+                if (o.kind === "succeeded") {
+                    this.emitGoalProgress(ref, epoch, { phase: "presence" });
+                    ({ fact } = await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "complete", state: "succeeded", data: o.data, committer: { instanceId: this.managerInstanceId, epoch } }));
+                }
+                else if (o.kind === "failed") {
+                    ({ fact } = await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "complete", state: "failed", data: o.data, committer: { instanceId: this.managerInstanceId, epoch } }));
+                }
+                else {
+                    ({ fact } = await settleGoalUncertain(gw.ctx, { ref, now: Date.now(), committer: { instanceId: this.managerInstanceId, epoch } }));
+                }
+                this.emitGoalProgress(ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
+                await clearGoalIndex(gw.ctx, ref); // must-5 Q-B: terminal reached - the successor never reconciles it
+                if (acceptance)
+                    this.agentGoals.delete(acceptance.name); // goal terminal - no cancel path left
+            }
+            catch (e) {
+                // THE NARROWER LEG, LEFT OPEN DELIBERATELY. If the COMMIT ITSELF throws (the currency belt
+                // refused a superseded commit, or the broker failed) there is genuinely no terminal, and the
+                // H1 fallback must NOT retry it: a retry either loses the same way or overwrites a real
+                // supersession refusal with a manufactured outcome. That is why `terminalEntered` is set on
+                // ENTRY. This leg is infrastructure-class and converges through the reconcile index at the
+                // next boot, which is why the index is NOT cleared above on this path. Do not "close" it
+                // here with a retry loop.
+                console.error(`! goal terminal commit for ${goalId} failed: ${e.message}`);
+            }
+        };
+        const bg = run({
+            onAccepted: async ({ name, agentTriple }) => {
+                // must-5 Q-B: record the goal in the reconcile index BEFORE the bind (index-CAS-before-bind),
+                // so a successor incarnation finds + settles this goal if we crash before its terminal. A
+                // crash between this write and the bind leaves an index entry whose goal status is absent —
+                // the sweep clears it as a no-goal; a crash before it leaves no entry (never durable). A
+                // Carry THIS incarnation's instanceId (the executor coord) so a multi-instance sweep can skip a live sibling's goal.
+                //
+                // H2, THE ACCEPTANCE FLOOR: the allocated identity is written HERE, before the bind and so
+                // before the acceptance is acked, because this entry is the only durable record of it that
+                // exists that early — the goal spec does not carry it and the terminal does not exist yet.
+                // A same-goalId attempt that loses the bind while the winner is still in flight can then
+                // serve what the winner actually allocated instead of inventing an empty identity.
+                const idx = await recordGoalIndex(gw.ctx, ref, executor.lifecycleUid, { name, actor: agentTriple.actor, uid: agentTriple.uid });
+                // A create loss is an idempotent retry ONLY for the same incarnation. A FOREIGN iid means a
+                // sibling instance accepted this goalId (the live vector is a client retry over ANYCAST, not
+                // a journal consumer): this attempt provisions nothing and answers with the winner's floor,
+                // or refuses if that instance never persisted one.
+                if (!idx.recorded && idx.existing.iid !== executor.lifecycleUid) {
+                    acceptance = this.acceptanceFromIndex(idx.existing, goalId, fingerprint, executor);
+                    resolveAccept(acceptance);
+                    // No claim needed here: `ownsGoal` is still false, so the commit path refuses this attempt.
+                    throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted by instance "${idx.existing.iid}"; that instance's acceptance is served and this attempt provisions nothing (SPEC 13.6)`);
+                }
+                // Bind AFTER the accept-path checks (M6/capacity/persona) + identity mint, BEFORE any provision:
+                // a create-only CAS per goalId (pin 1 — a refused accept above left zero bind, zero reserve).
+                const b = await bindGoal(gw.ctx, ref, fingerprint);
+                if (!b.bound) {
+                    if (b.existing.fingerprint !== fingerprint)
+                        throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" is already bound to a different submission; one goalId never carries two specs (SPEC 13.6)`);
+                    // Lost a concurrent same-goalId race: serve the winner's acceptance and abort THIS provision
+                    // (no second spawn). The throw unwinds to the finally, which releases this attempt's reserve.
+                    acceptance = this.goalAcceptances.get(goalId) ?? await this.cachedSpawnAcceptance(ref, goalId, fingerprint, executor);
+                    resolveAccept(acceptance);
+                    // No claim needed here either. This attempt lost the CAS, so `ownsGoal` is still false and
+                    // the single check in `onOutcome` refuses it. Before that check existed this site had to
+                    // remember to claim the terminal by hand, and the one place that forgot is how a loser
+                    // came to commit `failed` on the winner's goal, using its own abort text as the outcome.
+                    // Unwind the provision (the acceptance is already served); the code is discarded by the
+                    // caller (acceptance !== undefined), so it just aborts this attempt's side-effects.
+                    throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" is already accepted; the cached acceptance is served`);
+                }
+                // WON the claim: this attempt, and only this attempt, may settle this goal.
+                ownsGoal = true;
+                await createGoal(gw.ctx, ref, {
+                    fingerprint,
+                    command: ctx.subject.command,
+                    caller: { id: `${ctx.subject.caller.owner}.${ctx.subject.caller.actor}`, lifecycleUid: ctx.subject.caller.uid },
+                    // The ACCEPTING incarnation's epoch: half of the terminal's attribution pair (§13.6).
+                    acceptedEpoch: epoch,
+                    requestId: goalId,
+                    sourceSeq: 0,
+                    acceptedAt,
+                    readinessDeadlineMs: this.readinessTimeoutMs,
+                });
+                acceptance = { name, owner: agentTriple.owner, actor: agentTriple.actor, uid: agentTriple.uid, goalId, fingerprint, executor };
+                this.goalAcceptances.set(goalId, acceptance);
+                this.agentGoals.set(name, ref); // M4: a despawn of this name mid-goal drives the cancel path
+                resolveAccept(acceptance);
+                this.emitGoalProgress(ref, epoch, { phase: "handoff" });
+            },
+            onLaunched: () => this.emitGoalProgress(ref, epoch, { phase: "launched" }),
+            onOutcome,
+            // Claim the terminal WITHOUT committing one: the despawn/stop that ended this launch owns
+            // it and commits `cancel`. This only stops the non-ok reply below from manufacturing a
+            // `failed` that would race that `cancel` (first-terminal-fact-wins).
+            onTerminalDeferred: () => { terminalEntered = true; },
+        });
+        bg.then((reply) => {
+            // Refused BEFORE onAccepted (M6 hard-pin collision, capacity, persona-not-found) — no goal bound.
+            if (acceptance === undefined) {
+                rejectAccept(new EpEnvelopeError("failed-precondition", reply.error ?? "spawn refused at accept"));
+                return;
+            }
+            // H1: `run` CATCHES its own body (a throw in buildLaunch/runtime.spawn) and RESOLVES `{ok:false}`
+            // rather than rejecting, so a post-accept failure arrives here, not in the catch below, and
+            // reaches none of the onOutcome sites. Without this the goal stays accepted-but-unanswered:
+            // the caller follows epe to a terminal that never comes, and the reconcile index that would
+            // settle it is only swept at BOOT, so a manager that stays up never converges it.
+            if (reply.ok === false && !terminalEntered)
+                return onOutcome({ kind: "failed", data: { error: reply.error ?? "spawn failed after accept" } });
+        }).catch((e) => {
+            if (acceptance === undefined) {
+                rejectAccept(e);
+                return;
+            }
+            // Same obligation for a genuine rejection (one that escaped `run`'s own catch).
+            if (!terminalEntered)
+                return onOutcome({ kind: "failed", data: { error: e?.message ?? String(e) } });
+            console.error(`! spawn-as-action async body for ${goalId}: ${e?.message ?? String(e)}`);
+        }).catch((e) => console.error(`! goal terminal fallback for ${goalId}: ${e?.message ?? String(e)}`));
+        return acceptP;
+    }
+    /** H2: an acceptance served from a WINNER'S durable acceptance floor (the goal-index entry it
+     *  wrote before its own ack). Refuses `unavailable` rather than inventing one — see
+     *  {@link cachedSpawnAcceptance} for why an empty identity is never an acceptable answer. */
+    acceptanceFromIndex(entry, goalId, fingerprint, executor) {
+        if (entry.allocated === undefined)
+            throw new EpEnvelopeError("unavailable", `goal "${goalId}" was accepted by instance "${entry.iid}", which persisted no acceptance floor; its allocated identity is not readable from here (SPEC 13.6)`);
+        return { name: entry.allocated.name, owner: DEV_OWNER, actor: entry.allocated.actor, uid: entry.allocated.uid, goalId, fingerprint, executor };
+    }
+    /** Reconstruct a cached acceptance for a same-goalId retry NOT in the live map (a prior incarnation
+     *  accepted it, or a concurrent winner whose map write this reader has not yet observed).
+     *
+     *  H2 — WHY THIS PREFERS THE INDEX OVER THE TERMINAL. It used to read only the committed terminal
+     *  and fall back to `{name:"", actor:"", uid:""}` when there was none. That is the common case,
+     *  not a corner: a client retry over ANYCAST reaches a sibling while the winner is still
+     *  provisioning, so no terminal exists yet, and the caller was handed an ACCEPTED reply naming an
+     *  empty agent it can never address. The acceptance floor in the goal index exists from the moment
+     *  of acceptance, so it answers precisely the window the terminal cannot. Where neither is
+     *  readable the honest answer is a REFUSAL: an accepted goal whose identity nobody can name is
+     *  `unavailable`, never a hollow success. */
+    async cachedSpawnAcceptance(ref, goalId, fingerprint, executor) {
+        const entry = await readGoalIndex(this.goalWriter.ctx, ref);
+        if (entry?.allocated !== undefined)
+            return this.acceptanceFromIndex(entry, goalId, fingerprint, executor);
+        // The index is CLEARED at terminal, so a settled goal legitimately has no entry: fall back to
+        // the terminal's data, which carries the same identity for exactly that case.
+        const result = await readGoalResult(this.goalWriter.ctx, ref);
+        const d = (result?.data ?? {});
+        if (typeof d.name === "string" && d.name.length > 0 && typeof d.id === "string" && d.id.length > 0 && typeof d.lifecycleUid === "string" && d.lifecycleUid.length > 0)
+            return { name: d.name, owner: DEV_OWNER, actor: d.id, uid: d.lifecycleUid, goalId, fingerprint, executor };
+        throw new EpEnvelopeError("unavailable", `goal "${goalId}" is already accepted but its allocated identity is not readable (no acceptance floor, and no terminal carrying one); retry (SPEC 13.6)`);
+    }
+    /** M4 (settle race): a despawn MID-GOAL drives the goal's cancel terminal - transition to
+     *  `cancelling`, then commit the `cancel` cause on the goal-writer connection. First-terminal-fact
+     *  wins: if the readiness outcome already committed (succeeded/failed/uncertain) the transition or
+     *  the create-only commit loses gracefully and the readiness terminal stands. Fire-and-forget from
+     *  despawn (the process teardown is authoritative for the agent; this settles the GOAL honestly).
+     *  Cancel rides the despawn's own authorizeNamed reach (pin 5) - there is no cancel-by-goalId. */
+    async cancelAgentGoal(name, mode) {
+        const gw = this.goalWriter;
+        const ref = this.agentGoals.get(name);
+        if (!gw || !ref)
+            return;
+        this.agentGoals.delete(name);
+        const epoch = this.serviceServe?.grant.epoch ?? 0;
+        try {
+            await this.assertGoalWriterEpochCurrent(epoch); // must-5 (a): a superseded corpse never commits a cancel terminal either
+            await transitionGoal(gw.ctx, ref, "cancelling", { fields: { cancelMode: mode } });
+            const r = await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "cancel", data: { cancelledBy: "despawn" }, committer: { instanceId: this.managerInstanceId, epoch } });
+            this.emitGoalProgress(ref, epoch, { phase: "terminal", state: r.fact.state, ...(r.fact.data !== undefined ? { data: r.fact.data } : {}) });
+            await clearGoalIndex(gw.ctx, ref); // must-5 Q-B: terminal reached - the successor never reconciles it
+        }
+        catch {
+            // the goal already terminalized (the readiness outcome won the settle race) - nothing to cancel.
+        }
+    }
+    /** The static F1 terminal for one departed incarnation (Unit B): delegates the gate/head CAS
+     *  sequence to the shared core saga over the executor transport; the footprint teardown (creds
+     *  file + broker durables/ACL) runs INSIDE the barrier as its cleanup step. On completion the
+     *  wire principal joins {@link retiredPrincipals} (the F5 refusal index) and the name hold
+     *  clears (ABA-guarded by uid). A PRE-UNIT-B lifecycle (no slot row — spawned before the
+     *  durable registry existed) has nothing to terminalize: its footprint teardown runs directly
+     *  and the hold clears, the honest upgrade path. */
+    async driveStaticRetirement(a) {
+        const opId = retireOpId(a.lifecycleUid);
+        const cleanup = async () => {
+            const secrets = this.secrets;
+            const files = a.secretPaths ?? agentLifecycleSecretFilePaths(this.workspaceRoot, a.name, a.lifecycleUid);
+            if (files.creds) {
+                await secrets.delete(agentSecretKeyForFile(files.creds));
+                rmSync(files.creds, { force: true });
+            }
+            await this.deprovisionBroker(a);
+        };
+        try {
+            await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: a.id, lifecycleUid: a.lifecycleUid, alias: a.name }, async (t) => {
+                const slot = await readStaticSlot(t, DEV_OWNER, a.name);
+                if (slot === undefined || slot.row.lifecycleUid !== a.lifecycleUid) {
+                    // No durable registration for THIS incarnation: a pre-Unit-B spawn (or a slot already
+                    // replaced by a successor — then this stale teardown must not touch the registry at all).
+                    await cleanup();
+                    return;
+                }
+                await runStaticTerminal(t, { owner: DEV_OWNER, alias: a.name, actor: a.id, lifecycleUid: a.lifecycleUid, opId }, { cleanup, log: (line) => console.error(`static retirement ${a.name}: ${line}`) });
+            });
+            this.retiredPrincipals.add(principalKey(DEV_OWNER, a.id).key);
+            const cur = this.retiring.get(a.name);
+            if (cur && cur.lifecycleUid === a.lifecycleUid)
+                this.retiring.delete(a.name); // ABA-guarded hold clear
+        }
+        catch (e) {
+            const h = this.retiring.get(a.name);
+            if (h && h.lifecycleUid === a.lifecycleUid)
+                h.lastError = `the static retirement did not complete (${e.message}); the name stays held - a same-name spawn retries the same terminal (op ${opId})`;
+            console.error(`static retirement ${a.name} (${a.id}): ${e.message}`);
+        }
+    }
+    /** F5(b) push renewal of ONE live managed-static credential (Unit B): re-mint the SAME nkey
+     *  identity with the SAME scope (recorded on the managed row at spawn) and a fresh bounded
+     *  exp, ledger the new credentialId (slot record first, then the row, then the file — a
+     *  credential is never materialized before its ledger row exists), and re-sign the SAME
+     *  lifecycle-keyed file the agent endpoint's source seam re-reads. Never advances the epoch,
+     *  never routes through any barrier (renewal is the THIRD transition). */
+    async renewManagedStaticCred(a) {
+        if (!this.auth || !a.seed || !a.secretPaths?.creds)
+            throw new Error("renewManagedStaticCred: not a renewable managed-static agent");
+        // THIS CHECK IS THE AUTHORITATIVE ONE. The renewal sweep's own `a.terminalizing` filter is an
+        // optimisation that has already-awaited by the time it matters; removing or weakening this line
+        // promotes that filter into the whole guard, with nothing failing at the moment of the change.
+        //
+        // CONFIRMED, OPEN, AND UNGATED. This check runs at ENTRY and there are FOUR awaits before the
+        // two writes below (`secrets.put` and `materializeSecretToFile`). A despawn landing in that
+        // window latches `terminalizing` and the retirement cleanup deletes exactly those two things —
+        // same secret key, same path — so an in-flight renewal RE-CREATES a valid bounded credential
+        // after teardown removed it, and `appendStaticCredentialRow` lands in the window too, which is
+        // the worse half: a stale file is recoverable by re-running cleanup, a durable credential row
+        // is the journal asserting the credential is legitimate.
+        //
+        // Reproduced by `smoke:renewal-terminal-race` (`renewal-terminal-race.smoke.ts`), which asserts
+        // the DURABLE ROW rather than the file — the file is timing-dependent, the row is a KV read.
+        // That suite is deliberately NOT in `smoke:ci`: it is expected RED until this is fixed, and
+        // gating a known red trains readers to treat the gate as noisy. So the absence of a red here
+        // is not evidence this is closed; run that suite.
+        //
+        // Reproduced on the FIRST attempt that reached the race, and that suite cannot produce a second:
+        // the alias frees only when teardown completes, and the defect is that teardown does not, so
+        // every later attempt is refused at spawn. That is a limit of the probe, NOT of the world — a
+        // FRESH ALIAS PER ATTEMPT makes a rate measurable. Do not read hits-over-attempts off that file
+        // as written; it is a number that is not a count.
+        //
+        // The fix is to make the WRITES conditional on the same latch the teardown orders against,
+        // never to retry: the correct outcome is "no credential", never "a credential minted later".
+        if (a.terminalizing)
+            throw new Error("renewManagedStaticCred: the lifecycle is terminalizing; no credential is minted after the terminal begins");
+        const exp = Math.floor(Date.now() / 1000) + MANAGED_STATIC_TTL_SEC;
+        // The SAME permission scope the spawn minted (recorded on the managed row): allowSubscribe/
+        // allowPublish/role/capabilities are the JWT-shaping inputs; `subscribe` (the active read
+        // set) shapes durable membership only and is not a mint input.
+        const creds = await mintCreds(this.auth, { id: a.id, seed: a.seed }, "agent", {
+            allowSubscribe: a.launch.allowSubscribe,
+            allowPublish: a.launch.allowPublish,
+            role: a.role,
+            capabilities: a.launch.capabilities,
+            lifecycleUid: a.lifecycleUid,
+            expiresAt: exp,
+        });
+        const credentialId = rawDigest(creds).replace("sha256:", "sha256-");
+        await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: a.id, lifecycleUid: a.lifecycleUid, alias: a.name }, async (t) => {
+            await recordSlotCredential(t, DEV_OWNER, a.name, a.lifecycleUid, credentialId);
+            await appendStaticCredentialRow(t, { lifecycleUid: a.lifecycleUid, credentialId, holderPrincipal: principalKey(DEV_OWNER, a.id).key, exp });
+        });
+        const secrets = this.secrets;
+        await secrets.put(agentSecretKeyForFile(a.secretPaths.creds), creds);
+        await materializeSecretToFile(secrets, agentSecretKeyForFile(a.secretPaths.creds), a.secretPaths.creds);
+        console.error(`managed cred renewal ${a.name}: re-signed for the same identity (exp +${MANAGED_STATIC_TTL_SEC}s); the agent endpoint's source re-read adopts it`);
+    }
+    /** The Unit B reconciliation (F3 "no active orphan"): ensure the authority stores, then sweep
+     *  every durable slot row and act by the TOTAL resume table — `provisioning`/`terminalizing`
+     *  re-drive the exact-op terminal; an `active` row survives ONLY when a LIVE managed agent this
+     *  process owns backs it at the same uid (`adopted`), else its process is gone and it
+     *  terminalizes; `retired` rows seed the F5 refusal index. Two call sites: the BOOT sweep
+     *  (`postAdoption=false`, under the lease before control serving) DEFERS active-non-adopted
+     *  slots while a resume is still pending (adoption runs after it); the POST-ADOPTION sweep
+     *  (`postAdoption=true`, inside finalizeResume while `resumeRequired` still fences ordinary
+     *  spawns) terminalizes any active slot the resume did not claim. */
+    async reconcileStaticLifecycles(postAdoption = false) {
+        if (!this.auth)
+            return;
+        const identity = newIdentity();
+        const creds = await mintCreds(this.auth, identity, "provisioner");
+        const nc = await connect({ servers: this.servers ?? DEFAULT_SERVER, ...standaloneConnectOpts({ creds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
+        const slotRows = [];
+        try {
+            const jsm = await jetstreamManager(nc);
+            const kvm = new Kvm(nc);
+            await ensureAuthorityStores(jsm, kvm, this.space);
+            const recordsKv = await kvm.open(recordsBucket(this.space));
+            const t = staticLifecycleTransport(recordsKv, recordsKv /* auth reads unused in the sweep */);
+            const keys = await recordsKv.keys(`${STATIC_SLOT_PREFIX}.${DEV_OWNER}.>`);
+            const aliases = [];
+            for await (const k of keys)
+                aliases.push(k.split(".").slice(2).join("."));
+            for (const alias of aliases) {
+                const slot = await readStaticSlot(t, DEV_OWNER, alias);
+                if (slot !== undefined)
+                    slotRows.push(slot.row);
+            }
+        }
+        finally {
+            await nc.drain().catch(() => nc.close());
+        }
+        for (const row of slotRows) {
+            if (row.phase === "retired") {
+                // A retirement is a GLOBAL refusal fact — seed the F5 index for EVERY retired incarnation
+                // regardless of which instance owned it, so a sibling-retired incarnation's copied credential
+                // is refused at this control surface too. Ownership gates only the DESTRUCTIVE sweep below.
+                this.retiredPrincipals.add(principalKey(row.owner, row.actor).key);
+                continue;
+            }
+            // 3b-2 RECONCILE OWNERSHIP (multi-manager-per-space): a manager adjudicates ONLY the non-retired
+            // rows THIS logical instance owns. A SIBLING manager's active/provisioning row is LEFT UNTOUCHED —
+            // sweep-terminalizing it would destroy the sibling's live agent (the historical all-agents-kill
+            // hazard, now cross-instance). A legacy row (pre-3b-2, no owner recorded) predates multi-manager,
+            // so this manager is its legitimate single-manager-past successor and reconciles it. An orphaned
+            // sibling row is reclaimed only by an explicit operator CAS takeover (ruling 1), never here.
+            if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId)
+                continue;
+            // ADOPTION is genuine membership: a slot backed by a live managed agent THIS process owns
+            // at the SAME uid is never an orphan (empty at boot; exactly the adopted set at the
+            // post-adoption sweep — the fix for the F3 resume hole).
+            const live = this.agents.get(row.alias);
+            const adopted = live !== undefined && live.lifecycleUid === row.lifecycleUid;
+            // Boot sweep with a resume PENDING: an active slot may yet be adopted (the resume path runs
+            // AFTER this boot sweep), so DEFER it — the post-adoption sweep terminalizes any the resume
+            // did not claim. provisioning/terminalizing NEVER defer (they are crashed operations, never
+            // an agent to adopt). At `postAdoption` (or a non-resume boot) nothing defers.
+            if (!postAdoption && row.phase === "active" && !adopted && this.resumeRequired)
+                continue;
+            const action = planStaticSlotResume(row, adopted);
+            if (action === "none")
+                continue;
+            console.error(`static reconcile ${row.alias}: slot is ${row.phase} with no live managed owner${postAdoption ? " after resume adoption" : ""} - driving its exact-op terminal (uid ${row.lifecycleUid})`);
+            await this.driveStaticRetirement({ id: row.actor, name: row.alias, lifecycleUid: row.lifecycleUid });
+        }
+    }
+    /** The F5(a) membership gate (Unit B, the F5-bind design): decide a control caller by its
+     *  AUTHENTICATED wire principal. A LIVE managed slot passes (unless terminalizing); a RETIRING
+     *  hold or a RETIRED static incarnation refuses even with a tier-valid JWT (the
+     *  copied-credential vector — its subject can never collide with a successor's, so this match
+     *  is non-forgeable); any OTHER principal is not a managed lifecycle (an operator instrument:
+     *  the credential tier governs, exactly as before). Never name alone, never a payload field. */
+    lifecycleMembershipRefusal(caller) {
+        for (const a of this.agents.values()) {
+            if (this.managedPrincipal(a) === caller)
+                return a.terminalizing
+                    ? `the caller's lifecycle ${a.lifecycleUid} is terminalizing; control is refused from the first terminal step (F5)`
+                    : undefined;
+        }
+        for (const [name, hold] of this.retiring) {
+            const held = hold.userOwner ? hold.agentId : principalKey(DEV_OWNER, hold.agentId).key;
+            if (held === caller)
+                return `the caller's lifecycle ${hold.lifecycleUid} (name "${name}") is retiring; a retiring incarnation's credential holds no control authority (F5)`;
+        }
+        if (this.retiredPrincipals.has(caller))
+            return "the caller's lifecycle is retired; a retired incarnation's credential holds no control authority (F5)";
+        return undefined;
+    }
     async withProvisioner(fn) {
         if (!this.auth)
             throw new Error("withProvisioner: no space auth (an open mesh has no scoped creds)");
@@ -2821,33 +4770,92 @@ export class Manager {
         }
         return { ok: true, data: { name, path } };
     }
-    async opAttach(args, caller, admin) {
-        const name = String(args.name ?? "").trim();
-        const a = this.agents.get(name);
-        if (!a)
-            return { ok: false, error: `no agent "${name}"` };
-        // attach grants terminal read+write — same scoping as despawn: own child (and, on a user
-        // mesh, the caller's owner-domain) on the privileged tier, any agent on admin.
-        const denied = await this.authorizeNamed(a, caller, admin);
-        if (denied)
-            return { ok: false, error: denied };
+    /** The post-authorization attach effect (P2 item 6): mint the holder-bound §13.6 offer, redeem it
+     *  through the ONE session plane (one-use CAS + presenter-equality), and stand up the PTY bridge —
+     *  atomically. The reply is the SIGNED grant (no ws:// URL, non-bearer, never logged); the caller
+     *  redeems it over the mesh with a per-session rails-only cred it mints itself. Only streamable
+     *  backends (pty/host) attach; an external runtime's attach() throws with per-runtime guidance. */
+    async attachAuthorized(a, caller) {
+        if (!this.sessionPlane)
+            return { ok: false, error: "the manager session plane is not available (the manager is not fully started)" };
         // A name is a reusable slot and the authorization above can await (user mode reads the ledger).
-        // If the slot was stopped and refilled while we waited, everything below would act on a
-        // successor this caller was never authorized for — so re-assert the incarnation, then keep
-        // working from the handle we authorized rather than re-resolving the name.
-        if (this.agents.get(name) !== a)
-            return { ok: false, error: `agent "${name}" was replaced during authorization - retry` };
-        // Only pty streams over the WS attach endpoint. External runtimes are watched natively,
-        // and each handle's attach() throws with the right per-runtime guidance.
-        if (a.handle.kind !== "pty") {
-            try {
-                a.handle.attach();
-            }
-            catch (e) {
-                return { ok: false, error: e.message };
-            }
+        // The ep target is incarnation-pinned, so `a` cannot BE a successor — but the slot it names can
+        // have been stopped and refilled while we waited, and everything below must act on the
+        // incarnation this caller was actually authorized for, never on whoever holds the name now.
+        if (this.agents.get(a.name) !== a)
+            return { ok: false, error: `agent "${a.name}" was replaced during authorization - retry` };
+        // Never establish a session over a dead agent — a doomed session (the caller would get an
+        // immediate process-exit at best, a confusing empty terminal at worst). Refuse honestly.
+        if (a.handle.status() !== "running")
+            return { ok: false, error: `agent "${a.name}" is not running (${a.handle.status()}); nothing to attach` };
+        // CLAIM the session slot BEFORE attaching the target's PTY, matching the console door: this door
+        // used to attach first and check capacity inside establishAttach, so a `resource-exhausted`
+        // refusal landed AFTER the attach. The claim is carried INTO establishAttach, so one reservation
+        // spans the attach and the establishment, and it is released on every refusal below.
+        //
+        // RESIDUAL, NAMED: no shipped runtime acquires anything at attach time — pty's `attach()` returns
+        // a pure view (it registers a data subscriber only when `onData` is called) and tmux/cmux/orca
+        // throw — so an attach nobody bridges is a garbage-collectible object, not a held resource, and
+        // ordering alone suffices. A future runtime that DOES acquire something in `attach()` reopens
+        // this: it would need a release on the failure paths, and `AttachSession` has no close today.
+        const slot = this.sessionPlane.claimSlot();
+        let session;
+        try {
+            session = a.handle.attach();
+        }
+        catch (e) {
+            slot.release();
+            return { ok: false, error: e.message };
+        }
+        // establishAttach releases the claim it was handed on every exit; nothing to unwind here.
+        const { grant } = await this.sessionPlane.establishAttach(caller, { name: a.name, lifecycleUid: a.lifecycleUid }, session, slot);
+        return { ok: true, data: { grant } };
+    }
+    /** P2 item 6: the console's mesh §13.6 session establisher (backing `POST /session/<name>` on the
+     *  loopback face). Drives THE ONE plane — same establishAttach as the ep `attach` command — with
+     *  the loopback OPERATOR as holder (same-host trust boundary), then hands the browser everything it
+     *  needs to open the caller rail over the broker ws listener: the holder-bound grant, a per-session
+     *  RAILS-ONLY caller cred (static mints from the seed, TTL-bound to the session; an open mesh has no
+     *  credential system so the browser connects bare), and the ws URL. NO 127.0.0.1 terminal transport
+     *  — the terminal rides the mesh session. Injected only when a wsPort exists (see the constructor). */
+    async establishConsoleSession(name) {
+        if (!this.sessionPlane)
+            throw new Error("the manager session plane is not available (the manager is not fully started)");
+        if (this.wsPort === undefined)
+            throw new Error("the broker websocket port is not configured; the console cannot open a mesh session");
+        // CLAIM the session slot here, before the PTY attach and before this establisher goes on to
+        // mint a seed-signed `session-caller` credential: a capacity refusal must land before anything
+        // with a side effect or a cost. The claim is carried INTO establishAttach, so the reservation
+        // spans the whole establishment rather than being a check that a concurrent caller can race.
+        // (See attachAuthorized for why the attach itself needs no unwind on any shipped runtime.)
+        const slot = this.sessionPlane.claimSlot();
+        try {
+            const a = this.agents.get(name);
+            if (!a)
+                throw new Error(`no managed agent "${name}"`);
+            if (a.handle.status() !== "running")
+                throw new Error(`agent "${name}" is not running (${a.handle.status()}); nothing to attach`);
+            const session = a.handle.attach(); // throws for non-streamable runtimes — surfaced to the browser as a 500
+            // The loopback operator is the console's holder (same-host trust boundary).
+            const caller = { owner: DEV_OWNER, actor: "console", uid: this.managerLifecycleUid };
+            const { grant } = await this.sessionPlane.establishAttach(caller, { name: a.name, lifecycleUid: a.lifecycleUid }, session, slot);
+            // The caller credential is minted ONLY after a session is really live, so a refused or failed
+            // establishment never yields a seed-signed JWT. (A failure HERE would leave a live session the
+            // browser never reaches, holding its slot until the grant expires — unreachable in practice,
+            // because the SERVING mint above signs from this same `this.auth` first and would have failed
+            // before any session existed.)
+            const creds = this.auth
+                ? await mintCreds(this.auth, newIdentity(), "session-caller", {
+                    sessionCaller: { endpoint: MANAGER_ENDPOINT, sessionId: grant.sessionId, epoch: grant.serving.epoch },
+                    expiresAt: Math.floor(grant.exp / 1000), // grant.exp is ms (now+ttlMs); the JWT exp is seconds
+                })
+                : "";
+            return { grant, wsUrl: `ws://127.0.0.1:${this.wsPort}`, creds };
+        }
+        catch (e) {
+            slot.release(); // idempotent with establishAttach's own release
+            throw e;
         }
-        return { ok: true, data: { ws: this.attach.url(name, a.handle) } };
     }
     /** Managed agents cross-referenced with live presence (the manager sees the roster). */
     /** `ownerFilter`: restrict to agents whose spawn-time stored `userOwner` equals it (the ps/status
@@ -2860,7 +4868,7 @@ export class Manager {
             // FAIL-CLOSED: a failed record is the failure + repair sentence; a missing/malformed or
             // stale record on a live agent is auth-unknown/auth-stale, NEVER silently healthy.
             const health = a.userOwner
-                ? agentAuthState(agentSecretFilePaths(this.workspaceRoot, a.name).health)
+                ? agentAuthState(a.secretPaths?.health ?? agentLifecycleSecretFilePaths(this.workspaceRoot, a.name, a.lifecycleUid).health)
                 : undefined;
             return {
                 name: a.name,
@@ -2875,6 +4883,9 @@ export class Manager {
                 status: a.handle.status(),
                 uptimeMs: Date.now() - a.startedAt,
                 mesh: roster.get(a.name)?.status ?? "absent",
+                // The incarnation coordinate (SPEC 13.1) — with `id`, exactly what a v0.4 caller needs to
+                // build a targeted (`despawn`/`attach`) request against THIS incarnation.
+                lifecycleUid: a.lifecycleUid,
                 ...(health && health.state !== "ok" ? { authHealth: health.state, authReason: health.reason } : {}),
             };
         });