@cotal-ai/manager 0.161.1 → 0.163.0

package/dist/manager.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-import { drainAndClose } from "@cotal-ai/core";
+import { drainAndClose, requestSafeReconnect } from "@cotal-ai/core";
 import { hostname, homedir } from "node:os";
 import { listDirectory } from "./list-dir.js";
 import { credsAuthenticator, RequestError } from "@nats-io/transport-node";
@@ -177,6 +177,7 @@ const STARTUP_RECONCILING = "startup static lifecycle reconciliation";
  *  authority. The finite ~36s window is intentionally not a liveness inference: exhausting it
  *  leaves the durable alias held and requires a later manager start. */
 export const STATIC_RECONCILE_RETRY_DELAYS_MS = [1_000, 5_000, 30_000];
+const REMOTE_STANDING_BUDGET_MS = 10_000;
 const STATIC_RECONCILE_MAX_ATTEMPTS = STATIC_RECONCILE_RETRY_DELAYS_MS.length + 1;
 /** The owner a retained seat resumes under: its inventory identity's, which is the same value the
  *  adopted seat records as `userOwner`, so a resumed seat is counted against the owner that held
@@ -245,6 +246,13 @@ function withTimeout(p, ms, msg) {
     });
     return Promise.race([p.finally(() => clearTimeout(timer)), timeout]);
 }
+/** One absolute budget across authority, preflight and adoption waits, or one closed-serve attempt. */
+function remoteStandingTimeLeft(deadline) {
+    const left = deadline - performance.now();
+    if (left <= 0)
+        throw new Error("remote manager standing operation exceeded its 10000ms aggregate budget");
+    return Math.ceil(left);
+}
 function sameStrings(a, b) {
     return JSON.stringify([...(a ?? [])].sort()) === JSON.stringify([...(b ?? [])].sort());
 }
@@ -886,6 +894,8 @@ export class Manager {
     remoteExecutorCreds;
     remoteSupervisorCreds;
     remoteBundleRenewal;
+    remoteBundleAdoption;
+    finishRemoteBundleAdoption;
     /** A refused or failed standing candidate is cleanup debt, never a silent loss: the last-good
      * family stays live and this records what the host may have signed but the manager never adopted. */
     remoteRenewalDebt;
@@ -900,6 +910,25 @@ export class Manager {
         const servers = this.servers ?? DEFAULT_SERVER;
         return dialerFor(servers)({ ...opts, servers });
     }
+    /** Initial NATS timeout is per dial, not per server list. Keep the aggregate deadline too, and
+     * close a late result rather than letting an abandoned preflight or recovery install a transport. */
+    async dialRemoteStanding(opts, deadline) {
+        const ms = remoteStandingTimeLeft(deadline);
+        const pending = this.dial({ ...opts, timeout: ms });
+        try {
+            const nc = await withTimeout(pending, ms, "remote manager standing dial exceeded its 10000ms aggregate budget");
+            remoteStandingTimeLeft(deadline);
+            if (this.leaseStopping)
+                throw new Error("manager stopped while a remote standing dial was in flight");
+            return nc;
+        }
+        catch (e) {
+            // Timing out our wait does not cancel connect(). It still owns its socket until it rejects
+            // or returns a connection, which must close without serving or changing a current holder.
+            void pending.then((nc) => nc.close(), () => { }).catch((error) => console.error(`! remote manager abandoned standing dial cleanup: ${rejectionText(error)}`));
+            throw e;
+        }
+    }
     constructor(opts) {
         if (opts.expectedConnectorGeneration !== undefined && opts.expectedConnectorGeneration !== MANAGER_VERSION)
             throw new Error(`expected connector generation ${opts.expectedConnectorGeneration} differs from this Manager's loaded generation ${MANAGER_VERSION}; restart from the installed CLI`);
@@ -1105,8 +1134,8 @@ export class Manager {
      * reads `--allow-subscribe` only for the agent profile while the observer arm of `permissionsFor`
      * hardcodes `chat.>`: an operator narrowing a reader to one event plane was handed a reader of every
      * channel in the space. The user half named a bare `cotal actor grant`, and an omitted flag there is
-     * not "leave it alone" but the WIDE default (`>` read, `>` post, `spawn,role:default` scope), so the same
-     * sentence handed out a full-mesh reader-writer with spawn. The static half was found by RUNNING
+     * not "leave it alone" but the WIDE default (`>` read, `>` post, `spawn,run,role:default` scope), so the same
+     * sentence handed out a full-mesh reader-writer with spawn and workflow scope. The static half was found by RUNNING
      * the printed command and decoding what it produced; the user half was found by READING it against
      * `runActor`'s defaults. Neither is the only way in, and a remedy string is not proved by either
      * one alone.
@@ -1167,7 +1196,7 @@ export class Manager {
             case "user":
                 return (`\`cotal actor grant <reader> --owner ${owner} --scope '' --allow-subscribe '${channel}' ` +
                     `--allow-publish ''\`, with every field spelled out: \`actor grant\` is an upsert of the ` +
-                    `WHOLE row, and an omitted flag is refused, or with \`--full\` is the WIDE default (\`>\` read, \`>\` post, \`spawn,role:default\` ` +
+                    `WHOLE row, and an omitted flag is refused, or with \`--full\` is the WIDE default (\`>\` read, \`>\` post, \`spawn,run,role:default\` ` +
                     `scope).`);
             case "static":
                 return (`\`cotal mint <reader> --profile agent --allow-subscribe ${channel} --provision\`, where there ` +
@@ -1797,15 +1826,65 @@ export class Manager {
         this.endpointServeRenewalTimer.unref?.();
         console.error(`manager endpoint-serve renewal scheduled at ${renewAt}`);
     }
-    /** #2073: push a freshly re-minted credential onto its LIVE connection instead of waiting for a
-     *  reconnect the expiry itself would force two dials too late. `nc.reconnect()` re-evaluates the
-     *  authenticator, which reads the mutable `creds` holder on every attempt, so the new CONNECT
-     *  presents the fresh credential without re-registration. In-flight requests on the connection
-     *  fail once, on the reconnect. Best-effort, matching `CotalEndpoint.swapConnectionOntoFreshCreds`:
-     *  a connection that is already closed (e.g. mid re-dial after a fault) cannot reconnect, and that
-     *  failure is not this call's to report. */
-    async pushRenewedCreds(nc) {
-        await nc.reconnect().catch(() => { });
+    credentialPushRetry;
+    credentialPushes = new Map();
+    supervisorCredentialPush;
+    pendingCredentialPushes = new Set();
+    supervisorCredentialPushPending = false;
+    scheduleCredentialPushRetry() {
+        if (this.credentialPushRetry || this.leaseStopping)
+            return;
+        this.credentialPushRetry = setTimeout(() => {
+            this.credentialPushRetry = undefined;
+            if (this.leaseStopping)
+                return;
+            void Promise.all([
+                ...[...this.pendingCredentialPushes].map((nc) => this.pushRenewedCreds(nc)),
+                ...(this.supervisorCredentialPushPending ? [this.pushSupervisorCreds()] : []),
+            ]);
+        }, 1_000);
+        this.credentialPushRetry.unref();
+    }
+    /** Retain a busy transport and retry its adopted credential without replaying requests. */
+    pushRenewedCreds(nc) {
+        const active = this.credentialPushes.get(nc);
+        if (active)
+            return active;
+        const push = this.pushRenewedCredsOnce(nc).finally(() => { this.credentialPushes.delete(nc); });
+        this.credentialPushes.set(nc, push);
+        return push;
+    }
+    async pushRenewedCredsOnce(nc) {
+        this.pendingCredentialPushes.add(nc);
+        try {
+            await requestSafeReconnect(nc);
+            this.pendingCredentialPushes.delete(nc);
+        }
+        catch (e) {
+            if (nc.isClosed())
+                this.pendingCredentialPushes.delete(nc);
+            console.error(`! manager credential push deferred: ${rejectionText(e)}`);
+            if (!nc.isClosed())
+                this.scheduleCredentialPushRetry();
+        }
+    }
+    pushSupervisorCreds() {
+        if (this.supervisorCredentialPush)
+            return this.supervisorCredentialPush;
+        const push = this.pushSupervisorCredsOnce().finally(() => { this.supervisorCredentialPush = undefined; });
+        this.supervisorCredentialPush = push;
+        return push;
+    }
+    async pushSupervisorCredsOnce() {
+        this.supervisorCredentialPushPending = true;
+        try {
+            await this.ep.refreshCredsRequestSafe();
+            this.supervisorCredentialPushPending = false;
+        }
+        catch (e) {
+            console.error(`! remote manager supervisor credential push deferred: ${rejectionText(e)}`);
+            this.scheduleCredentialPushRetry();
+        }
     }
     /** #2073: the shared bounded-retry shape for a closed standing connection: wait out each of
      *  {@link STATIC_RECONCILE_RETRY_DELAYS_MS}, trying `attempt` after each. A stop landing while
@@ -2022,14 +2101,19 @@ export class Manager {
             return this.remoteBundleRenewal;
         if (this.leaseStopping)
             return;
-        const renewal = this.renewRemoteStandingBundleOnce(force);
+        this.remoteBundleAdoption = new Promise((resolve) => { this.finishRemoteBundleAdoption = resolve; });
+        const renewal = this.renewRemoteStandingBundleOnce(force, performance.now() + REMOTE_STANDING_BUDGET_MS);
         this.remoteBundleRenewal = renewal;
         try {
             await renewal;
         }
         finally {
-            if (this.remoteBundleRenewal === renewal)
+            this.finishRemoteBundleAdoption?.();
+            if (this.remoteBundleRenewal === renewal) {
                 this.remoteBundleRenewal = undefined;
+                this.remoteBundleAdoption = undefined;
+                this.finishRemoteBundleAdoption = undefined;
+            }
         }
     }
     /** A signerless manager's closed standing connection re-dials through the all-duty family only.
@@ -2042,18 +2126,29 @@ export class Manager {
         if (inspectCredHealth(read() ?? "").state !== "healthy")
             throw new Error(`the ${label} credential is not healthy after all-duty renewal; last-good is kept and nothing is minted locally`);
     }
-    async renewRemoteStandingBundleOnce(force) {
+    async renewRemoteStandingBundleOnce(force, deadline) {
         const remote = this.remoteAuthority;
         if (!remote?.renewStandingBundle || !this.serviceServe)
             return;
         const current = [this.remoteSupervisorCreds, this.remoteExecutorCreds, this.serviceServe.creds,
             this.goalWriterCreds, this.sessionLedgerCreds];
-        if (!force && current.every((cred) => cred && inspectCredHealth(cred).state === "healthy"))
+        if (!force && current.every((cred) => cred && inspectCredHealth(cred).state === "healthy")) {
+            await Promise.all([
+                ...[...this.pendingCredentialPushes].map((nc) => this.pushRenewedCreds(nc)),
+                ...(this.supervisorCredentialPushPending ? [this.pushSupervisorCreds()] : []),
+            ]);
             return;
+        }
         const processEpoch = this.serviceServe.grant.epoch;
         let candidate;
+        const serving = this.serviceServe;
+        const previous = { nc: serving.nc, handle: serving.handle };
+        let replacement;
+        let adopted = false;
         try {
-            candidate = await remote.renewStandingBundle(processEpoch);
+            // Only this continuation can adopt. A host operation may still issue after this wait times
+            // out, but its late result cannot re-enter preflight or change any Manager holder.
+            candidate = await withTimeout(remote.renewStandingBundle(processEpoch), remoteStandingTimeLeft(deadline), "remote manager standing authority exceeded its 10000ms aggregate budget; issuance outcome is unknown");
             if (Object.keys(candidate).sort().join(",") !== [...REMOTE_MANAGER_IDENTITY_NAMES].sort().join(","))
                 throw new Error("host returned an incomplete or widened standing credential family");
             for (const name of REMOTE_MANAGER_IDENTITY_NAMES) {
@@ -2064,14 +2159,26 @@ export class Manager {
                 if (credsClaims(candidate[name]).sub !== remote.identities[name].id)
                     throw new Error(`host returned a ${name} credential for a different nkey than the held identity`);
                 const staged = candidate[name];
-                const nc = await this.dial({ authenticator: (nonce) => credsAuthenticator(new TextEncoder().encode(staged))(nonce), maxReconnectAttempts: 0 });
+                const nc = await this.dialRemoteStanding({ authenticator: (nonce) => credsAuthenticator(new TextEncoder().encode(staged))(nonce), maxReconnectAttempts: 0 }, deadline);
                 await nc.close();
             }
-            if (this.leaseStopping || !this.serviceServe || this.serviceServe.grant.epoch !== processEpoch)
-                throw new Error("manager changed its active serve epoch while standing renewal was in flight");
+            remoteStandingTimeLeft(deadline);
+            if (this.leaseStopping || this.serviceServe !== serving || serving.nc !== previous.nc || serving.grant.epoch !== processEpoch)
+                throw new Error("manager changed its active serve epoch or connection while standing renewal was in flight");
+            const stagedServeCreds = candidate.serve;
+            replacement = await this.dialServeConnection({ ...serving, creds: stagedServeCreds }, () => adopted ? serving.creds : stagedServeCreds, deadline);
+            remoteStandingTimeLeft(deadline);
+            if (this.leaseStopping || this.serviceServe !== serving || serving.nc !== previous.nc || serving.grant.epoch !== processEpoch)
+                throw new Error("manager changed its active serve epoch or connection while standing renewal was in flight");
+            if (REMOTE_MANAGER_IDENTITY_NAMES.some((name) => inspectCredHealth(candidate[name]).state !== "healthy"))
+                throw new Error("standing candidate is no longer healthy after broker preflight");
+            serving.nc = replacement.nc;
+            serving.handle = replacement.handle;
+            replacement = undefined;
             this.remoteSupervisorCreds = candidate.supervisor;
             this.remoteExecutorCreds = candidate.executor;
             this.serviceServe.creds = candidate.serve;
+            adopted = true;
             this.goalWriterCreds = candidate.goalWriter;
             this.sessionLedgerCreds = candidate.sessionLedger;
             if (this.goalWriter)
@@ -2081,14 +2188,35 @@ export class Manager {
             // Adoption is committed above; a connection that cannot come back yet is a push failure the
             // endpoint's own reconnect loop retries with the adopted credential, not unadopted debt.
             this.remoteRenewalDebt = undefined;
-            await Promise.all([
-                this.ep.reconnect().catch((e) => console.error(`! remote manager supervisor reconnect after renewal: ${rejectionText(e)}`)),
-                this.pushRenewedCreds(this.serviceServe.nc),
+            // Maintenance needed by admitted handlers must not wait for those same handlers to drain.
+            this.finishRemoteBundleAdoption?.();
+            await withTimeout(Promise.all([
+                this.pushSupervisorCreds(),
+                (async () => {
+                    try {
+                        // A handler or a lost broker PONG can keep stop/flush pending forever. Only the
+                        // retired transport is expendable: never retry its requests or close the replacement.
+                        await withTimeout((async () => {
+                            await previous.handle.stop();
+                            await previous.nc.flush();
+                        })(), 5_000, "old serve drain unfinished after 5000ms; closing retired transport, in-flight request outcomes are unknown and must not be retried");
+                    }
+                    finally {
+                        await previous.nc.close();
+                    }
+                })().catch((e) => console.error(`! remote manager retired serve drainage after renewal: ${rejectionText(e)}`)),
                 ...(this.goalWriter ? [this.pushRenewedCreds(this.goalWriter.nc)] : []),
                 ...(this.sessionLedgerConn ? [this.pushRenewedCreds(this.sessionLedgerConn.nc)] : []),
-            ]);
+            ]), remoteStandingTimeLeft(deadline), "remote manager standing reconnect exceeded its 10000ms aggregate budget; adopted transports keep their native reconnect ownership");
         }
         catch (e) {
+            if (replacement) {
+                await this.discardServeCandidate(replacement.nc, replacement.handle);
+            }
+            if (adopted) {
+                console.error(`! remote manager adopted standing family: ${rejectionText(e)}`);
+                return;
+            }
             const unadoptedSubjects = candidate && typeof candidate === "object"
                 ? Object.values(candidate).flatMap((cred) => { try {
                     return typeof cred === "string" && credsClaims(cred).sub ? [credsClaims(cred).sub] : [];
@@ -2096,7 +2224,7 @@ export class Manager {
                 catch {
                     return [];
                 } })
-                : [];
+                : REMOTE_MANAGER_IDENTITY_NAMES.map((name) => remote.identities[name].id);
             this.remoteRenewalDebt = { at: Date.now(), processEpoch, reason: rejectionText(e), unadoptedSubjects };
             console.error(`! remote manager all-duty renewal: ${this.remoteRenewalDebt.reason} - no unsigned or local replacement is available`);
             if (force)
@@ -2695,19 +2823,13 @@ export class Manager {
             handle = runtime.adopt(reference);
         }
         catch (e) {
-            const reap = runtime.reap;
-            if (typeof reap !== "function")
-                return;
-            let outcome;
             try {
-                outcome = (await reap.call(runtime, reference)).outcome;
+                await requireRuntimeReap(runtime, reference);
             }
             catch {
                 // The runtime could not prove the seat gone. Leave the record for a later start.
                 return;
             }
-            if (outcome !== "reaped")
-                return;
             console.error(`! ${name}: the released seat is gone (${rejectionText(e)}); retiring its lifecycle`);
             handle = {
                 name,
@@ -2849,6 +2971,8 @@ export class Manager {
     }
     async stopOnce(withAgents) {
         this.leaseStopping = true;
+        clearTimeout(this.credentialPushRetry);
+        this.credentialPushRetry = undefined;
         this.transcripts?.stop();
         this.staticReconcileStopping = true;
         this.chatExpiry.stop();
@@ -2875,8 +2999,8 @@ export class Manager {
         // still move the key's revision after we clear the timer, and releasing against a cached
         // revision it has since moved is a CAS the broker correctly refuses, silently, forever.
         await this.leaseRenewTask?.catch(() => { });
-        // An already accepted host issuance must finish before standing transports close. The
-        // epoch/stop fence refuses adoption, but does not cancel the issuer's in-flight request.
+        // Join the bounded Manager renewal. Its stop/deadline fence refuses late adoption, but the
+        // host still owns any submitted issuance and its outcome can remain unknown after timeout.
         await this.remoteBundleRenewal?.catch(() => { });
         // A spawn admitted before the fence closed may still be launching. Its seat must be in the
         // snapshot below, or it would outlive a stop that reported success.
@@ -3061,6 +3185,14 @@ export class Manager {
         }
         catch { /* best effort */ }
     }
+    /** A failed candidate must not extend preparation by draining subscriptions on a stalled socket.
+     * Close only that candidate first. Native stop still owns any already-dispatched handlers, whose
+     * outcomes remain unknown to callers and must not be replayed; they do not hold family adoption. */
+    async discardServeCandidate(nc, handle) {
+        await nc.close();
+        if (handle)
+            void handle.stop().catch((e) => console.error(`! remote manager discarded serve candidate cleanup: ${rejectionText(e)}`));
+    }
     /** Track a dedicated connection's transport into {@link transportDown} from the first moment:
      *  nats.js reports `disconnect` when the socket drops and `reconnect` only after it has re-sent the
      *  connection's subscriptions. If the status stream itself fails, the transport can no longer be
@@ -8541,8 +8673,19 @@ export class Manager {
             // maintenance executor through the existing host operation; never resurrect standing duties.
             if (this.leaseStopping)
                 await this.renewRemoteExecutor(true);
+            else if (this.remoteAuthority.renewStandingBundle) {
+                // The renewal drains old handlers after adopting. A handler waiting here must be
+                // released at adoption, not after its own completion is required by that drain.
+                const renewal = this.renewRemoteStandingBundle(true);
+                void renewal.catch((error) => console.error(`! remote manager standing renewal completion: ${rejectionText(error)}`));
+                await this.remoteBundleAdoption;
+                if (!this.remoteExecutorCreds || inspectCredHealth(this.remoteExecutorCreds).state !== "healthy") {
+                    await renewal;
+                    throw new Error("standing renewal did not adopt a healthy scoped executor");
+                }
+            }
             else
-                await (this.remoteAuthority.renewStandingBundle ? this.renewRemoteStandingBundle(true) : this.renewRemoteExecutor(true));
+                await this.renewRemoteExecutor(true);
         }
         const creds = this.remoteExecutorCreds ?? (this.auth
             ? await mintCreds(this.auth, identity, "endpoint-serve-executor", {
@@ -8714,13 +8857,14 @@ export class Manager {
      *  so there is one place that dials and serves this endpoint. Attaches {@link
      *  onServeConnectionClosed} as the close handler in both cases: a closed serve connection is
      *  always a fault this manager acts on, never a bare log line. */
-    async dialServeConnection(state) {
-        const nc = await this.dial({
+    async dialServeConnection(state, readCreds = () => state.creds, deadline) {
+        const opts = {
             // Open mesh: a bare serve connection (no credential exists; the broker enforces nothing).
-            ...(state.creds !== undefined ? standaloneConnectOpts({ creds: () => state.creds, tls: false }) : {}),
+            ...(state.creds !== undefined ? standaloneConnectOpts({ creds: readCreds, tls: false }) : {}),
             inboxPrefix: `_INBOX_${state.identity.id}`,
             maxReconnectAttempts: -1,
-        });
+        };
+        const nc = await (deadline === undefined ? this.dial(opts) : this.dialRemoteStanding(opts, deadline));
         this.trackTransport(nc);
         let handle;
         try {
@@ -8758,14 +8902,22 @@ export class Manager {
                 },
                 ...(this.omitClassCommands() ? { omitClassCommands: this.omitClassCommands() } : {}),
             });
+            // A subscribed replacement must be visible to the broker before the old rails retire.
+            if (deadline === undefined)
+                await nc.flush();
+            else
+                await withTimeout(nc.flush(), remoteStandingTimeLeft(deadline), "remote manager standing serve flush exceeded its 10000ms aggregate budget");
         }
         catch (e) {
-            await drainAndClose(nc);
+            await this.discardServeCandidate(nc, handle);
             throw e;
         }
-        // Wired only once the connection serves: a connection this method drains itself after a
+        // Wired only once the connection serves: a candidate this method closes after a
         // refused serve is not a fault to recover, and the caller already sees the refusal.
-        nc.closed().then((err) => { void this.onServeConnectionClosed(err ?? undefined); });
+        nc.closed().then((err) => {
+            if (this.serviceServe?.nc === nc)
+                void this.onServeConnectionClosed(err ?? undefined, nc);
+        });
         return { nc, handle };
     }
     /** #2073: re-mint the SAME `endpoint-serve` identity through the SAME scoped one-shot executor and
@@ -8792,7 +8944,7 @@ export class Manager {
      *  lease and answers nothing is the worst of the three states this issue named, and holding the
      *  connection open under unbounded reconnects (the transport-drop case) never reaches this method
      *  at all — `nc.closed()` does not resolve until the client itself gives up. */
-    async onServeConnectionClosed(err) {
+    async onServeConnectionClosed(err, closed) {
         if (this.leaseStopping)
             return;
         const s = this.serviceServe;
@@ -8800,13 +8952,32 @@ export class Manager {
         const recovered = await this.boundedReconnect("service endpoint", async () => {
             if (!s)
                 return false;
-            if (this.remoteAuthority)
-                await this.renewRemoteBeforeRedial("serve", () => s.creds);
+            const deadline = this.remoteAuthority ? performance.now() + REMOTE_STANDING_BUDGET_MS : undefined;
+            // Let an admitted renewal finish owning its candidate before recovery opens another.
+            if (deadline === undefined)
+                await this.remoteBundleRenewal;
+            else
+                await withTimeout(Promise.resolve(this.remoteBundleRenewal), remoteStandingTimeLeft(deadline), "remote manager closed-serve renewal wait exceeded its 10000ms aggregate budget");
+            if (this.leaseStopping || this.serviceServe !== s || s.nc !== closed)
+                return true;
+            if (deadline !== undefined)
+                await withTimeout(this.renewRemoteBeforeRedial("serve", () => s.creds), remoteStandingTimeLeft(deadline), "remote manager closed-serve renewal wait exceeded its 10000ms aggregate budget");
             else if (inspectCredHealth(s.creds ?? "").state !== "healthy" && s.creds !== undefined) {
                 s.creds = await this.remintServeCreds(s);
                 this.scheduleServeRenewal(s.creds);
             }
-            const { nc, handle } = await this.dialServeConnection(s);
+            if (this.leaseStopping || this.serviceServe !== s || s.nc !== closed)
+                return true;
+            const { nc, handle } = await this.dialServeConnection(s, undefined, deadline);
+            if (this.leaseStopping || this.serviceServe !== s || s.nc !== closed) {
+                try {
+                    await handle.stop();
+                }
+                finally {
+                    await nc.close();
+                }
+                return true;
+            }
             s.nc = nc;
             s.handle = handle;
             console.error(`manager service endpoint re-dialed: ${MANAGER_ENDPOINT}/${this.managerInstanceId} (epoch ${s.grant.epoch})`);