@cotal-ai/manager 0.18.0 → 0.19.0

package/dist/console/session-bundle.js

@@ -9304,16 +9304,23 @@ ${stack}`;
     "internal"
   ]);
   var EpEnvelopeError = class extends Error {
-    constructor(code, message, details) {
+    constructor(code, message, details, outcome) {
       super(message);
       __publicField(this, "code");
       __publicField(this, "details");
+      __publicField(this, "outcome");
       this.code = code;
       this.details = details;
+      this.outcome = outcome;
       this.name = "EpEnvelopeError";
     }
     toEpError() {
-      return { code: this.code, message: this.message, ...this.details ? { details: this.details } : {} };
+      return {
+        code: this.code,
+        message: this.message,
+        ...this.details ? { details: this.details } : {},
+        ...this.outcome ? { outcome: this.outcome } : {}
+      };
     }
   };
 

package/dist/manager.d.ts

@@ -236,12 +236,6 @@ export interface StartAgentOpts {
         hash: string;
     };
 }
-/**
- * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
- * It serves control requests on the "manager" service and spawns/kills agents
- * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
- * mesh traffic — terminal I/O streams over its own attach endpoint instead.
- */
 /** Runtime hooks the spawn-as-action serve path (P2 item 2) injects into {@link Manager.startAgent}.
  *  Roster boot and the blocking callers pass none (unchanged behavior). */
 export interface SpawnHooks {
@@ -306,6 +300,12 @@ export declare function epAwaitReply(nc: NatsConnection, space: string, caller:
     data?: unknown;
     error?: string;
 }>;
+/**
+ * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
+ * It serves control requests on the "manager" service and spawns/kills agents
+ * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
+ * mesh traffic — terminal I/O streams over its own attach endpoint instead.
+ */
 export declare class Manager {
     private readonly space;
     private readonly servers;
@@ -444,6 +444,22 @@ export declare class Manager {
     private leaseInfo?;
     private leaseRevision?;
     private leaseTimer?;
+    /** When this instance last knew the key's TTL had been REFRESHED: a successful acquire or renew, or
+     *  a re-read showing the revision moved past the one we held (our write landed, only its ack was
+     *  lost). The gap since then is the only thing bounding how long we may keep serving with no answer
+     *  at all, so it must track the last TTL-refreshing WRITE and not the last successful observation.
+     *  A re-read at the same revision is deliberately NOT a refresh: it proves the key exists at that
+     *  instant, while the key still expires when the last landed write said it would.
+     *
+     *  MONOTONIC (`performance.now`), not wall clock, because it is only ever read as an ELAPSED time.
+     *  `Date.now` steps on an NTP correction or a suspend/resume, and a backward step would shorten the
+     *  measured gap and let this instance serve past the TTL with no proof it still holds the key. The
+     *  initial value is `-Infinity` so "never refreshed" reads as an infinite gap and fails closed,
+     *  rather than as a small one at process start when a monotonic clock is still near zero. */
+    private leaseConfirmedAt;
+    /** A renew is in flight. The tick must not start a second one: both would read the same cached
+     *  revision, so whichever lands second CASes against a sequence the first already moved. */
+    private leaseRenewInFlight;
     /** The class-2 renewal owner's half-TTL schedule (D5 slice 5); armed only on auth meshes. */
     private credRenewTimer?;
     private maintenanceState;
@@ -540,14 +556,38 @@ export declare class Manager {
      *  and drop its dedicated connection. Best-effort by design — both exit paths (graceful stop,
      *  lease-loss fail-close) must complete their remaining teardown even if the broker is gone. */
     private stopServiceServe;
-    /** Refresh THIS instance's liveness lease before the bucket TTL expires it. On loss (missed the TTL —
-     *  this instance stalled past the renew window) FAIL CLOSED for THIS INSTANCE ONLY: stop serving +
-     *  tear down OUR managed agents + exit, so a stalled instance can't keep double-processing under a key
-     *  a same-id restart may re-acquire. Keyed per instance, so this NEVER frees or touches a sibling
-     *  manager's key and NEVER freezes the space (security pin 6) — the sibling keeps serving. We do NOT
-     *  re-acquire (a same-id restart may already be live) and do NOT release the key (it may be the
-     *  restart's). A DIFFERENT instance losing ITS key is a separate, independent event. */
+    /** Refresh THIS instance's liveness lease before the bucket TTL expires it.
+     *
+     *  A FAILED RENEW IS NOT A LOST LEASE, and the difference is the whole shape of this method. The CAS
+     *  renew throws for reasons that prove entirely different things, and one of them proves nothing at
+     *  all: a request that gets NO ANSWER within its deadline does not establish that the write failed,
+     *  that the key expired, or that anyone else took it. It may even have LANDED, with only the
+     *  acknowledgement lost. Terminating on it kills a healthy manager and takes its agents with it.
+     *
+     *  So the renew failing is a question, not a verdict, and the verdict comes from RE-READING the key
+     *  ({@link CotalEndpoint.readOwnManagerLease}, which separates "it is gone" from "I could not find
+     *  out"). We fail closed on PROOF — the key is absent, or it is present and holds someone else — and
+     *  otherwise keep serving, adopting whatever revision the broker actually has.
+     *
+     *  WHEN NO ANSWER IS AVAILABLE AT ALL, the bound is time, not attempts: past one whole TTL with no
+     *  renew that LANDED, the key may have expired and been re-acquired, so this instance can no longer
+     *  claim to hold it and fails closed on that ground, said plainly. A re-read answering "still yours,
+     *  same revision" IS an answer and we keep serving on it, but it did not touch the key, so it buys
+     *  no time — reading a key is not refreshing it. Inside the TTL the budget affords another
+     *  renew-and-re-read pair ({@link MANAGER_LEASE_RENEW_MS}), which is what makes waiting safe.
+     *
+     *  FAILING CLOSED IS FOR THIS INSTANCE ONLY: stop serving + tear down OUR managed agents + exit, so a
+     *  stalled instance can't keep double-processing under a key a same-id restart may re-acquire. Keyed
+     *  per instance, so it NEVER frees or touches a sibling manager's key and NEVER freezes the space
+     *  (security pin 6) — the sibling keeps serving. We do NOT re-acquire (a same-id restart may already
+     *  be live) and do NOT release the key (it may be the restart's). */
     private renewLease;
+    /** What the broker actually says about THIS instance's lease key, right now. `unknown` is a first-class
+     *  answer and never collapses into `gone`: not being able to look is not the same fact as looking and
+     *  finding nothing, and only the latter may end a manager. */
+    private reconcileLease;
+    /** Stop serving and end this process, naming what was PROVED rather than what merely failed. */
+    private failClosedOnLeaseLoss;
     private opFinalizeResume;
     private opCommitResume;
     private opResumePreserved;
@@ -717,16 +757,6 @@ export declare class Manager {
     /** Agent names become `.cotal/agents/<name>.md` paths and mesh identities, so they must be bare
      *  tokens, never a path — blocks traversal / arbitrary writes from a model-supplied name. */
     private nameError;
-    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
-     *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
-     *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
-     *  connector session, another manager's agent): allocating their name would mint a sibling the
-     *  broker/auth then refuses to admit, surfacing as a 30s launch-uncertain black hole instead of
-     *  the auto-number the join path gives. Presence is ADVISORY (SPEC §6) — this is an availability
-     *  choice at allocation, never an authority check (the broker still enforces): a stale
-     *  still-live-looking row only costs a numbered suffix, and a missed freshly-joined occupant is
-     *  still refused downstream exactly as before. Offline rows do NOT occupy — a properly retired
-     *  name stays reusable. */
     /** The roster's LIVE occupant names (status !== offline) — occupants this manager may NOT manage
      *  (a foreground `cotal spawn`, a connector session, ANOTHER manager's agent). Allocating over any
      *  of them mints a sibling the broker/auth then refuses to admit, surfacing as the 30s launch-
@@ -737,6 +767,16 @@ export declare class Manager {
      *  reserves/manages/retires it OR a roster-live occupant already holds it. Pass a pre-built
      *  {@link liveRosterNames} set when checking many names in one allocation. */
     private nameInUse;
+    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
+     *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
+     *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
+     *  connector session, another manager's agent): allocating their name would mint a sibling the
+     *  broker/auth then refuses to admit, surfacing as a 30s launch-uncertain black hole instead of
+     *  the auto-number the join path gives. Presence is ADVISORY (SPEC §6) — this is an availability
+     *  choice at allocation, never an authority check (the broker still enforces): a stale
+     *  still-live-looking row only costs a numbered suffix, and a missed freshly-joined occupant is
+     *  still refused downstream exactly as before. Offline rows do NOT occupy — a properly retired
+     *  name stays reusable. */
     private uniqueName;
     /** Spawn a teammate by persona ref (`name` loads `.cotal/agents/<name>.md`; the peer presents
      *  under that file's own `name:`), as if a peer asked via the control plane. Used to pre-spawn the
@@ -851,11 +891,6 @@ export declare class Manager {
      *  names. Static agents key `(DEV_OWNER, nkey)`; user-mode agents store the principal dot-form
      *  in `id`. A uid mismatch is a superseded incarnation — never resolved to its successor. */
     private findManagedByTarget;
-    /** Open a short-lived PROVISIONER connection, run the onboarding ops on it, and drain it (closure (ii),
-     *  residual 2). The DM/DLV consumer-create surface — the irreducible onboarding power — lives only for
-     *  this window, never as a standing grant on the long-lived supervisor. A provision-only endpoint
-     *  (no presence/consume/channel-watch) connected with memory-only `provisioner` creds; it sets its own
-     *  `inboxPrefix` so JS-API replies land on the `_INBOX_<id>.>` the provisioner cred subscribes. */
     /** Run one static §13.1 lifecycle OPERATION over an ephemeral, key-pinned `lifecycle-executor`
      *  connection (Unit B): the credential's grants name exactly ONE incarnation's head/uid/gate/
      *  cred-family/slot keys, so the write authority exists only for this operation's window and
@@ -1068,6 +1103,11 @@ export declare class Manager {
      *  is non-forgeable); any OTHER principal is not a managed lifecycle (an operator instrument:
      *  the credential tier governs, exactly as before). Never name alone, never a payload field. */
     private lifecycleMembershipRefusal;
+    /** Open a short-lived PROVISIONER connection, run the onboarding ops on it, and drain it (closure (ii),
+     *  residual 2). The DM/DLV consumer-create surface — the irreducible onboarding power — lives only for
+     *  this window, never as a standing grant on the long-lived supervisor. A provision-only endpoint
+     *  (no presence/consume/channel-watch) connected with memory-only `provisioner` creds; it sets its own
+     *  `inboxPrefix` so JS-API replies land on the `_INBOX_<id>.>` the provisioner cred subscribes. */
     private withProvisioner;
     /** Purge the space's retained message backlog (chat, optionally DMs). Privileged — the manager mints a
      *  short-lived "purger" cred (same destructive grant as `cotal history clear`, isolated off the

package/dist/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAA4E,YAAY,EAA4C,eAAe,EAAY,WAAW,EAAa,MAAM,gBAAgB,CAAC;AAC1N,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAsC5B,OAAO,EAsCL,KAAK,QAAQ,EAEd,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,yBAAyB,CAAC;AAoB5E;;;;;;;sDAOsD;AACtD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAsD3C,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;iGAE6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;4GAIwG;IACxG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;4GAEwG;IACxG,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;6FAMyF;IACzF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;+FAK2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAI7B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChH;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,kBAAkB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,qBAAqB,CAAC;IAChC,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EACF;YAAE,IAAI,EAAE,SAAS,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,GAC1E;YAAE,IAAI,EAAE,UAAU,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7I,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gGAAgG;QAChG,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,qGAAqG;QACrG,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;KACvC,CAAC;IACF,gGAAgG;IAChG,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,yBAAyB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAClD,SAAS,EAAE,sBAAsB,CAAC;IAClC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG,WAAW,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;IAClC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,gBAAgB,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;0GAC0G;AAC1G,MAAM,WAAW,cAAc;IAC7B;;0GAEsG;IACtG,IAAI,EAAE,MAAM,CAAC;IACb,8GAA8G;IAC9G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;gEAC4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;mFAE+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;yGACqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;mEAE+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;4GAEwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;wCACoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;iGAC6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;sDAGkD;IAClD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;iGAE6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AA0ED;;;;;GAKG;AAEH;2EAC2E;AAC3E,MAAM,WAAW,UAAU;IACzB;;;yGAGqG;IACrG,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzK,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB;;;mFAG+E;IAC/E,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9G;;;;iFAI6E;IAC7E,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;sGAGsG;AACtG,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED;;;;kGAIkG;AAClG,wBAAsB,YAAY,CAChC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACrD,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1D;AAED,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C;sFACkF;IAClF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC;kDAC8C;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D;gGAC4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C;gGAC4F;IAC5F,OAAO,CAAC,OAAO,CAAgB;IAC/B;;;;;;2DAMuD;IACvD,OAAO,CAAC,QAAQ,CAAmP;IACnQ;;;;;kGAK8F;IAC9F,OAAO,CAAC,cAAc,CAAoC;IAC1D;;;;sGAIkG;IAClG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IACvD;;sDAEkD;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D;;;;;4GAKwG;IACxG,OAAO,CAAC,iBAAiB,CAAU;IACnC;;yGAEqG;IACrG,OAAO,CAAC,oBAAoB,CAAY;IACxC;;;;oFAIgF;IAChF,OAAO,CAAC,YAAY,CAAC,CAAyG;IAC9H;;;;;;uGAMmG;IACnG,OAAO,CAAC,UAAU,CAAC,CAAwG;IAC3H;;;;oGAIgG;IAChG,OAAO,CAAC,kBAAkB,CAAC,CAAW;IACtC,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC;;mGAE+F;IAC/F,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C;;0FAEsF;IACtF,OAAO,CAAC,iBAAiB,CAAC,CAAyC;IACnE;;;sFAGkF;IAClF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE;;;mGAG+F;IAC/F,OAAO,CAAC,qBAAqB,CAAC,CAAW;IACzC,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC;;;oGAGgG;IAChG,OAAO,CAAC,eAAe,CAAsC;IAC7D;;;8EAG0E;IAC1E,OAAO,CAAC,iBAAiB,CAAS;IAClC;sGACkG;IAClG,OAAO,CAAC,UAAU,CAA8B;IAChD,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C;;;;;;qGAMiG;IACjG,OAAO,CAAC,oBAAoB,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,EAAE,CAAiB;IAC3B;+FAC2F;IAC3F,OAAO,CAAC,IAAI,CAAC,CAAY;IACzB;;gDAE4C;IAC5C,OAAO,CAAC,kBAAkB,CAAwB;IAClD;4GACwG;IACxG,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAC,CAAkC;IACpD,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAiC;IACpD,6FAA6F;IAC7F,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,gBAAgB,CAAqC;IAC7D,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,gBAAgB,CAAC,CAAiC;IAC1D,OAAO,CAAC,eAAe,CAAC,CAAmC;IAC3D,OAAO,CAAC,sBAAsB,CAAK;IACnC,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,mBAAmB,CAAS;IACpC,OAAO,CAAC,oBAAoB,CAAgC;IAC5D,OAAO,CAAC,eAAe,CAAyG;IAChI,OAAO,CAAC,qBAAqB,CAAC,CAAyB;IACvD,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,eAAe,CAAC,CAAyB;IACjD,OAAO,CAAC,UAAU,CAAC,CAA+B;IAClD,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,gBAAgB,CAAC,CAAwB;IACjD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,wBAAwB,CAAC,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;gBAE3C,IAAI,EAAE,cAAc;IAsChC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,uDAAuD;IACvD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA4J5B;;;;;mGAK+F;YACjF,gBAAgB;IAqI9B;;;;;;;;;;;;uGAYmG;IACnG,OAAO,CAAC,sBAAsB;IAsB9B;kGAC8F;IAC9F,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,gBAAgB;IAQxB;wEACoE;IACpE,OAAO,CAAC,gBAAgB;YAOV,mBAAmB;IAKjC,OAAO,CAAC,gBAAgB;IAKxB;qFACiF;IACjF,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA4BxE,OAAO,CAAC,4BAA4B;YAKtB,cAAc;IAkD5B;iEAC6D;IAC7D,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuBrE;yFACqF;IACrF,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAyB1C;uFACmF;IAC7E,aAAa,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAQnE,eAAe;YA+Bf,eAAe;IAa7B,OAAO,CAAC,uBAAuB;IAsD/B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,WAAW;IA6DnB;;;;;;;;kEAQ8D;YAChD,qBAAqB;YAgBrB,wBAAwB;IAqBhC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B;;oGAEgG;YAClF,gBAAgB;IAQ9B;;;;;;4FAMwF;YAC1E,UAAU;YAsBV,gBAAgB;YA+ChB,cAAc;YA8Bd,iBAAiB;YAkCjB,iBAAiB;IAwB/B;;;;;;;kGAO8F;IAC9F,OAAO,CAAC,YAAY;IAapB;;;wFAGoF;YACtE,UAAU;IAYxB;;;;;;;;;;4EAUwE;YAC1D,YAAY;IAgB1B;;;;iFAI6E;YAC/D,cAAc;IAO5B;;;;;;;;;;;;;;;;;;;;;;;;;;gEA0B4D;IAC5D,OAAO,CAAC,kBAAkB;YAgFZ,sBAAsB;IAkCpC;;;;;;;;mGAQ+F;IAC/F,OAAO,CAAC,cAAc;IAWtB;;;yFAGqF;IACrF,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,oBAAoB;IAiD5B;;;;6DAIyD;IACzD,OAAO,CAAC,UAAU;IAclB;;;;;;;;;;;gHAW4G;IAC5G,OAAO,CAAC,UAAU;IAYlB;;;;;;;;kGAQ8F;IAC9F,OAAO,CAAC,kBAAkB;IAiC1B;;;;;;;uBAOmB;YACL,kBAAkB;IAkHhC;;;;uGAImG;IACnG,OAAO,CAAC,QAAQ;IAmChB;;;;;;;;;;;mDAW+C;YACjC,WAAW;IAezB,sFAAsF;YACxE,gBAAgB;IAsE9B;;;gEAG4D;YAC9C,iBAAiB;IAqB/B,qGAAqG;YACvF,eAAe;IAsF7B;;;;;;;;qFAQiF;YACnE,iBAAiB;IAiB/B;;;6BAGyB;IACzB,OAAO,CAAC,cAAc;IAStB;;oGAEgG;IAChG,OAAO,CAAC,WAAW;IAQnB;iGAC6F;IAC7F,OAAO,CAAC,SAAS;IAMjB;;;;;;;;;+BAS2B;IAC3B;;;gCAG4B;IAC5B,OAAO,CAAC,eAAe;IAMvB;;;kFAG8E;IAC9E,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;IAKlB;;8DAE0D;IACpD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAItD;;;;0EAIsE;IAChE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IASzE,kFAAkF;IAClF,OAAO,CAAC,OAAO;IAoDf;;;;;uDAKmD;YACrC,gBAAgB;IAO9B;gGAC4F;IAC5F,OAAO,CAAC,cAAc;IAItB;;yGAEqG;YACvF,QAAQ;IAiDtB;;;;;;0GAMsG;YACxF,aAAa;IAiB3B;;;;;;;;;;wGAUoG;YACtF,QAAQ;IAqDtB;;;;;+DAK2D;IACrD,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;YAUrF,gBAAgB;IAuc9B;;kFAE8E;IACxE,eAAe,CACnB,SAAS,EAAE,sBAAsB,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAyE/B;oGACgG;YAClF,yBAAyB;IAoHvC;4EACwE;YAC1D,oBAAoB;YAqIpB,oBAAoB;IA+ElC,OAAO,CAAC,qBAAqB;IAI7B;;6GAEyG;IACzG,OAAO,CAAC,mBAAmB;IAe3B;;;;;;;;;;;;qGAYiG;YACnF,cAAc;IAyG5B;;sBAEkB;IAClB,OAAO,CAAC,IAAI;IAaZ;;;;;kGAK8F;IAC9F,OAAO,CAAC,SAAS;IAcjB;0GACsG;IACtG,OAAO,CAAC,YAAY;YAMN,MAAM;IAOpB;;;;yDAIqD;YACvC,WAAW;IAMzB;uDACmD;IACnD,OAAO,CAAC,iBAAiB;IAOzB;;;iGAG6F;IAC7F,OAAO,CAAC,mBAAmB;IAQ3B;;;;uGAImG;IACnG;;;qGAGiG;YACnF,qBAAqB;IAoBnC;;;;oGAIgG;YAClF,yBAAyB;IAevC;;;kGAG8F;YAChF,uBAAuB;IAgBrC,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;kEAY8D;YAChD,sBAAsB;IAiLpC;;;;;;;wGAOoG;YACtF,sBAAsB;IA8BpC;;;;;;;;qCAQiC;YACnB,eAAe;IA2C7B,uEAAuE;YACzD,cAAc;IAO5B;;;;;;;;;6CASyC;YAC3B,yBAAyB;IA2BvC;;;;;;;;;;;kFAW8E;YAChE,iBAAiB;IAyC/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,yBAAyB;IAgFjC;;yGAEqG;YACvF,gBAAgB;IAW9B;;;;;;;+EAO2E;YAC7D,kBAAkB;IA+BhC;;;;;;;iDAO6C;YAC/B,gBAAgB;IA+B9B;;;;uEAImE;IACnE,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;;;;;;;;;;;;;;oFAyBgF;YAClE,4BAA4B;IAU1C;;;;;0EAKsE;YACxD,cAAc;IAkL5B;;iGAE6F;IAC7F,OAAO,CAAC,mBAAmB;IAM3B;;;;;;;;;;iDAU6C;YAC/B,qBAAqB;IAYnC;;;;;sGAKkG;YACpF,eAAe;IAiB7B;;;;;;wDAMoD;YACtC,qBAAqB;IAqCnC;;;;;8EAK0E;YAC5D,sBAAsB;IAoDpC;;;;;;;;yEAQqE;YACvD,yBAAyB;IAsDvC;;;;;oGAKgG;IAChG,OAAO,CAAC,0BAA0B;YAiBpB,eAAe;IAuB7B;;;gCAG4B;YACd,OAAO;IAgBrB;;;;;;;;4GAQwG;IACxG,OAAO,CAAC,eAAe;IAqCvB;;;;uGAImG;YACrF,gBAAgB;IAkC9B;;;;;;2GAMuG;YACzF,uBAAuB;IAmCrC,wFAAwF;IACxF;gGAC4F;IAC5F,OAAO,CAAC,IAAI;CA8Bb"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAA4E,YAAY,EAA4C,eAAe,EAAY,WAAW,EAAa,MAAM,gBAAgB,CAAC;AAC1N,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAsC5B,OAAO,EAsCL,KAAK,QAAQ,EAEd,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,yBAAyB,CAAC;AAoB5E;;;;;;;sDAOsD;AACtD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAsD3C,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;iGAE6F;IAC7F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;4GAIwG;IACxG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;4GAEwG;IACxG,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;6FAMyF;IACzF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;+FAK2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,uBAAuB,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC;AAE5E,MAAM,MAAM,qBAAqB,GAI7B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChH;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,kBAAkB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,qBAAqB,CAAC;IAChC,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EACF;YAAE,IAAI,EAAE,SAAS,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,GAC1E;YAAE,IAAI,EAAE,UAAU,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7I,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gGAAgG;QAChG,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,qGAAqG;QACrG,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;KACvC,CAAC;IACF,gGAAgG;IAChG,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,yBAAyB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;IAClD,SAAS,EAAE,sBAAsB,CAAC;IAClC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG,WAAW,CAAC;IAChC,SAAS,EAAE,sBAAsB,CAAC;IAClC,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,gBAAgB,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;0GAC0G;AAC1G,MAAM,WAAW,cAAc;IAC7B;;0GAEsG;IACtG,IAAI,EAAE,MAAM,CAAC;IACb,8GAA8G;IAC9G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;gEAC4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;mFAE+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;yGACqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;mEAE+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;4GAEwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;wCACoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;iGAC6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;sDAGkD;IAClD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;iGAE6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAChE;AA2ED;2EAC2E;AAC3E,MAAM,WAAW,UAAU;IACzB;;;yGAGqG;IACrG,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzK,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB;;;mFAG+E;IAC/E,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9G;;;;iFAI6E;IAC7E,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED;;;sGAGsG;AACtG,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED;;;;kGAIkG;AAClG,wBAAsB,YAAY,CAChC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACrD,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B1D;AAED;;;;;GAKG;AACH,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C;sFACkF;IAClF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,wGAAwG;IACxG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC;kDAC8C;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D;gGAC4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C;gGAC4F;IAC5F,OAAO,CAAC,OAAO,CAAgB;IAC/B;;;;;;2DAMuD;IACvD,OAAO,CAAC,QAAQ,CAAmP;IACnQ;;;;;kGAK8F;IAC9F,OAAO,CAAC,cAAc,CAAoC;IAC1D;;;;sGAIkG;IAClG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IACvD;;sDAEkD;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D;;;;;4GAKwG;IACxG,OAAO,CAAC,iBAAiB,CAAU;IACnC;;yGAEqG;IACrG,OAAO,CAAC,oBAAoB,CAAY;IACxC;;;;oFAIgF;IAChF,OAAO,CAAC,YAAY,CAAC,CAAyG;IAC9H;;;;;;uGAMmG;IACnG,OAAO,CAAC,UAAU,CAAC,CAAwG;IAC3H;;;;oGAIgG;IAChG,OAAO,CAAC,kBAAkB,CAAC,CAAW;IACtC,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC;;mGAE+F;IAC/F,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C;;0FAEsF;IACtF,OAAO,CAAC,iBAAiB,CAAC,CAAyC;IACnE;;;sFAGkF;IAClF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;IAChE;;;mGAG+F;IAC/F,OAAO,CAAC,qBAAqB,CAAC,CAAW;IACzC,OAAO,CAAC,kBAAkB,CAAC,CAAS;IACpC;;;oGAGgG;IAChG,OAAO,CAAC,eAAe,CAAsC;IAC7D;;;8EAG0E;IAC1E,OAAO,CAAC,iBAAiB,CAAS;IAClC;sGACkG;IAClG,OAAO,CAAC,UAAU,CAA8B;IAChD,qDAAqD;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C;;;;;;qGAMiG;IACjG,OAAO,CAAC,oBAAoB,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,EAAE,CAAiB;IAC3B;+FAC2F;IAC3F,OAAO,CAAC,IAAI,CAAC,CAAY;IACzB;;gDAE4C;IAC5C,OAAO,CAAC,kBAAkB,CAAwB;IAClD;4GACwG;IACxG,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAC,CAAkC;IACpD,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAiC;IACpD;;;;;;;;;;;iGAW6F;IAC7F,OAAO,CAAC,gBAAgB,CAA4B;IACpD;gGAC4F;IAC5F,OAAO,CAAC,kBAAkB,CAAS;IACnC,6FAA6F;IAC7F,OAAO,CAAC,cAAc,CAAC,CAAiC;IACxD,OAAO,CAAC,gBAAgB,CAAqC;IAC7D,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,gBAAgB,CAAC,CAAiC;IAC1D,OAAO,CAAC,eAAe,CAAC,CAAmC;IAC3D,OAAO,CAAC,sBAAsB,CAAK;IACnC,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,mBAAmB,CAAS;IACpC,OAAO,CAAC,oBAAoB,CAAgC;IAC5D,OAAO,CAAC,eAAe,CAAyG;IAChI,OAAO,CAAC,qBAAqB,CAAC,CAAyB;IACvD,OAAO,CAAC,eAAe,CAAC,CAAS;IACjC,OAAO,CAAC,qBAAqB,CAAC,CAAS;IACvC,OAAO,CAAC,eAAe,CAAC,CAAyB;IACjD,OAAO,CAAC,UAAU,CAAC,CAA+B;IAClD,OAAO,CAAC,YAAY,CAAC,CAAsB;IAC3C,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,gBAAgB,CAAC,CAAwB;IACjD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,wBAAwB,CAAC,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;gBAE3C,IAAI,EAAE,cAAc;IAsChC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,uDAAuD;IACvD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA6J5B;;;;;mGAK+F;YACjF,gBAAgB;IAqI9B;;;;;;;;;;;;uGAYmG;IACnG,OAAO,CAAC,sBAAsB;IAsB9B;kGAC8F;IAC9F,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,gBAAgB;IAQxB;wEACoE;IACpE,OAAO,CAAC,gBAAgB;YAOV,mBAAmB;IAKjC,OAAO,CAAC,gBAAgB;IAKxB;qFACiF;IACjF,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA4BxE,OAAO,CAAC,4BAA4B;YAKtB,cAAc;IAkD5B;iEAC6D;IAC7D,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuBrE;yFACqF;IACrF,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAyB1C;uFACmF;IAC7E,aAAa,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAQnE,eAAe;YA+Bf,eAAe;IAa7B,OAAO,CAAC,uBAAuB;IAsD/B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,WAAW;IA6DnB;;;;;;;;kEAQ8D;YAChD,qBAAqB;YAgBrB,wBAAwB;IAqBhC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B;;oGAEgG;YAClF,gBAAgB;IAQ9B;;;;;;;;;;;;;;;;;;;;;;;;yEAwBqE;YACvD,UAAU;IAmDxB;;kEAE8D;YAChD,cAAc;IAmB5B,gGAAgG;YAClF,qBAAqB;YAiBrB,gBAAgB;YA+ChB,cAAc;YA8Bd,iBAAiB;YAkCjB,iBAAiB;IAwB/B;;;;;;;kGAO8F;IAC9F,OAAO,CAAC,YAAY;IAapB;;;wFAGoF;YACtE,UAAU;IAYxB;;;;;;;;;;4EAUwE;YAC1D,YAAY;IAgB1B;;;;iFAI6E;YAC/D,cAAc;IAO5B;;;;;;;;;;;;;;;;;;;;;;;;;;gEA0B4D;IAC5D,OAAO,CAAC,kBAAkB;YAgFZ,sBAAsB;IAkCpC;;;;;;;;mGAQ+F;IAC/F,OAAO,CAAC,cAAc;IAWtB;;;yFAGqF;IACrF,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,oBAAoB;IAiD5B;;;;6DAIyD;IACzD,OAAO,CAAC,UAAU;IAclB;;;;;;;;;;;gHAW4G;IAC5G,OAAO,CAAC,UAAU;IAYlB;;;;;;;;kGAQ8F;IAC9F,OAAO,CAAC,kBAAkB;IAiC1B;;;;;;;uBAOmB;YACL,kBAAkB;IAkHhC;;;;uGAImG;IACnG,OAAO,CAAC,QAAQ;IAmChB;;;;;;;;;;;mDAW+C;YACjC,WAAW;IAezB,sFAAsF;YACxE,gBAAgB;IAsE9B;;;gEAG4D;YAC9C,iBAAiB;IAqB/B,qGAAqG;YACvF,eAAe;IAsF7B;;;;;;;;qFAQiF;YACnE,iBAAiB;IAiB/B;;;6BAGyB;IACzB,OAAO,CAAC,cAAc;IAStB;;oGAEgG;IAChG,OAAO,CAAC,WAAW;IAQnB;iGAC6F;IAC7F,OAAO,CAAC,SAAS;IAMjB;;;gCAG4B;IAC5B,OAAO,CAAC,eAAe;IAMvB;;;kFAG8E;IAC9E,OAAO,CAAC,SAAS;IAIjB;;;;;;;;;+BAS2B;IAC3B,OAAO,CAAC,UAAU;IAKlB;;8DAE0D;IACpD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAItD;;;;0EAIsE;IAChE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IASzE,kFAAkF;IAClF,OAAO,CAAC,OAAO;IAoDf;;;;;uDAKmD;YACrC,gBAAgB;IAO9B;gGAC4F;IAC5F,OAAO,CAAC,cAAc;IAItB;;yGAEqG;YACvF,QAAQ;IAiDtB;;;;;;0GAMsG;YACxF,aAAa;IAiB3B;;;;;;;;;;wGAUoG;YACtF,QAAQ;IAqDtB;;;;;+DAK2D;IACrD,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;YAUrF,gBAAgB;IAuc9B;;kFAE8E;IACxE,eAAe,CACnB,SAAS,EAAE,sBAAsB,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAyE/B;oGACgG;YAClF,yBAAyB;IAoHvC;4EACwE;YAC1D,oBAAoB;YAqIpB,oBAAoB;IA+ElC,OAAO,CAAC,qBAAqB;IAI7B;;6GAEyG;IACzG,OAAO,CAAC,mBAAmB;IAe3B;;;;;;;;;;;;qGAYiG;YACnF,cAAc;IAyG5B;;sBAEkB;IAClB,OAAO,CAAC,IAAI;IAaZ;;;;;kGAK8F;IAC9F,OAAO,CAAC,SAAS;IAcjB;0GACsG;IACtG,OAAO,CAAC,YAAY;YAMN,MAAM;IAOpB;;;;yDAIqD;YACvC,WAAW;IAMzB;uDACmD;IACnD,OAAO,CAAC,iBAAiB;IAOzB;;;iGAG6F;IAC7F,OAAO,CAAC,mBAAmB;IAQ3B;;;qGAGiG;YACnF,qBAAqB;IAoBnC;;;;oGAIgG;YAClF,yBAAyB;IAevC;;;kGAG8F;YAChF,uBAAuB;IAgBrC,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;;;;;;kEAY8D;YAChD,sBAAsB;IAiLpC;;;;;;;wGAOoG;YACtF,sBAAsB;IA8BpC;;;;;;;;qCAQiC;YACnB,eAAe;IA2C7B,uEAAuE;YACzD,cAAc;IAO5B;;;;;;;;;6CASyC;YAC3B,yBAAyB;IA2BvC;;;;;;;;;;;kFAW8E;YAChE,iBAAiB;IAyC/B;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,yBAAyB;IAgFjC;;yGAEqG;YACvF,gBAAgB;IAW9B;;;;;;;+EAO2E;YAC7D,kBAAkB;IA+BhC;;;;;;;iDAO6C;YAC/B,gBAAgB;IA+B9B;;;;uEAImE;IACnE,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;;;;;;;;;;;;;;oFAyBgF;YAClE,4BAA4B;IAU1C;;;;;0EAKsE;YACxD,cAAc;IAkL5B;;iGAE6F;IAC7F,OAAO,CAAC,mBAAmB;IAM3B;;;;;;;;;;iDAU6C;YAC/B,qBAAqB;IAYnC;;;;;sGAKkG;YACpF,eAAe;IAiB7B;;;;;;wDAMoD;YACtC,qBAAqB;IAqCnC;;;;;8EAK0E;YAC5D,sBAAsB;IAoDpC;;;;;;;;yEAQqE;YACvD,yBAAyB;IAsDvC;;;;;oGAKgG;IAChG,OAAO,CAAC,0BAA0B;IAiBlC;;;;uGAImG;YACrF,eAAe;IAuB7B;;;gCAG4B;YACd,OAAO;IAgBrB;;;;;;;;4GAQwG;IACxG,OAAO,CAAC,eAAe;IAqCvB;;;;uGAImG;YACrF,gBAAgB;IAkC9B;;;;;;2GAMuG;YACzF,uBAAuB;IAmCrC,wFAAwF;IACxF;gGAC4F;IAC5F,OAAO,CAAC,IAAI;CA8Bb"}

package/dist/manager.js

@@ -3,7 +3,7 @@ import { createHash, randomUUID, randomBytes } from "node:crypto";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, readFileSync, rmSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
-import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_TTL_MS, STANDING_RENEWABLE_TTL_SEC, agentFilePath, clearSpaceHistory, connectorServers, deprovisionAgent, firstFreeName, idFromCreds, inspectCredHealth, loadAgentFile, loadCotalConfig, mintCreds, mintLifecycleUid, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, } from "@cotal-ai/core";
+import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_TTL_MS, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, agentFilePath, clearSpaceHistory, connectorServers, deprovisionAgent, firstFreeName, idFromCreds, inspectCredHealth, loadAgentFile, loadCotalConfig, mintCreds, mintLifecycleUid, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, } from "@cotal-ai/core";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KEY, findCotalRoot, getSpaceAuth, hasUserAuthState, loadManagerInstanceIdentity, loadMeshes, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KEY, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, saveManagerInstanceIdentity, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
@@ -140,6 +140,12 @@ export async function epAwaitReply(nc, space, caller, nonce, requestId, requestS
         catch { /* connection already down */ }
     }
 }
+/**
+ * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
+ * It serves control requests on the "manager" service and spawns/kills agents
+ * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
+ * mesh traffic — terminal I/O streams over its own attach endpoint instead.
+ */
 export class Manager {
     space;
     servers;
@@ -278,6 +284,22 @@ export class Manager {
     leaseInfo;
     leaseRevision;
     leaseTimer;
+    /** When this instance last knew the key's TTL had been REFRESHED: a successful acquire or renew, or
+     *  a re-read showing the revision moved past the one we held (our write landed, only its ack was
+     *  lost). The gap since then is the only thing bounding how long we may keep serving with no answer
+     *  at all, so it must track the last TTL-refreshing WRITE and not the last successful observation.
+     *  A re-read at the same revision is deliberately NOT a refresh: it proves the key exists at that
+     *  instant, while the key still expires when the last landed write said it would.
+     *
+     *  MONOTONIC (`performance.now`), not wall clock, because it is only ever read as an ELAPSED time.
+     *  `Date.now` steps on an NTP correction or a suspend/resume, and a backward step would shorten the
+     *  measured gap and let this instance serve past the TTL with no proof it still holds the key. The
+     *  initial value is `-Infinity` so "never refreshed" reads as an infinite gap and fails closed,
+     *  rather than as a small one at process start when a monotonic clock is still near zero. */
+    leaseConfirmedAt = Number.NEGATIVE_INFINITY;
+    /** A renew is in flight. The tick must not start a second one: both would read the same cached
+     *  revision, so whichever lands second CASes against a sequence the first already moved. */
+    leaseRenewInFlight = false;
     /** The class-2 renewal owner's half-TTL schedule (D5 slice 5); armed only on auth meshes. */
     credRenewTimer;
     maintenanceState = "active";
@@ -435,6 +457,7 @@ export class Manager {
         this.leaseInfo = { holder: this.ep.ref().id, instanceId: this.managerInstanceId, runtime: this.runtime.kind, root: resolve(this.workspaceRoot), pid: process.pid };
         try {
             this.leaseRevision = await this.ep.acquireManagerLease(this.leaseInfo);
+            this.leaseConfirmedAt = performance.now();
         }
         catch (e) {
             // Our OWN instance id already holds a live key ⇒ refuse. Anything else (e.g. a KV/JS error) is a
@@ -446,7 +469,7 @@ export class Manager {
                 ? `manager instance ${this.managerInstanceId} already serves space "${this.space}" from this workspace root (${held.runtime}, pid ${held.pid}, root ${held.root}) - stop it first before restarting the same instance`
                 : `could not acquire the manager lease for space "${this.space}": ${e.message}`);
         }
-        this.leaseTimer = setInterval(() => { void this.renewLease(); }, MANAGER_LEASE_TTL_MS / 2);
+        this.leaseTimer = setInterval(() => { void this.renewLease(); }, MANAGER_LEASE_RENEW_MS);
         this.leaseTimer.unref?.();
         // Unit B (static §13.1): ensure the two authority stores exist with their normative shape,
         // then sweep the durable slot rows and reconcile — re-drive any crashed activation/terminal
@@ -1124,45 +1147,131 @@ export class Manager {
             catch { /* best effort */ }
         }
     }
-    /** Refresh THIS instance's liveness lease before the bucket TTL expires it. On loss (missed the TTL —
-     *  this instance stalled past the renew window) FAIL CLOSED for THIS INSTANCE ONLY: stop serving +
-     *  tear down OUR managed agents + exit, so a stalled instance can't keep double-processing under a key
-     *  a same-id restart may re-acquire. Keyed per instance, so this NEVER frees or touches a sibling
-     *  manager's key and NEVER freezes the space (security pin 6) — the sibling keeps serving. We do NOT
-     *  re-acquire (a same-id restart may already be live) and do NOT release the key (it may be the
-     *  restart's). A DIFFERENT instance losing ITS key is a separate, independent event. */
+    /** Refresh THIS instance's liveness lease before the bucket TTL expires it.
+     *
+     *  A FAILED RENEW IS NOT A LOST LEASE, and the difference is the whole shape of this method. The CAS
+     *  renew throws for reasons that prove entirely different things, and one of them proves nothing at
+     *  all: a request that gets NO ANSWER within its deadline does not establish that the write failed,
+     *  that the key expired, or that anyone else took it. It may even have LANDED, with only the
+     *  acknowledgement lost. Terminating on it kills a healthy manager and takes its agents with it.
+     *
+     *  So the renew failing is a question, not a verdict, and the verdict comes from RE-READING the key
+     *  ({@link CotalEndpoint.readOwnManagerLease}, which separates "it is gone" from "I could not find
+     *  out"). We fail closed on PROOF — the key is absent, or it is present and holds someone else — and
+     *  otherwise keep serving, adopting whatever revision the broker actually has.
+     *
+     *  WHEN NO ANSWER IS AVAILABLE AT ALL, the bound is time, not attempts: past one whole TTL with no
+     *  renew that LANDED, the key may have expired and been re-acquired, so this instance can no longer
+     *  claim to hold it and fails closed on that ground, said plainly. A re-read answering "still yours,
+     *  same revision" IS an answer and we keep serving on it, but it did not touch the key, so it buys
+     *  no time — reading a key is not refreshing it. Inside the TTL the budget affords another
+     *  renew-and-re-read pair ({@link MANAGER_LEASE_RENEW_MS}), which is what makes waiting safe.
+     *
+     *  FAILING CLOSED IS FOR THIS INSTANCE ONLY: stop serving + tear down OUR managed agents + exit, so a
+     *  stalled instance can't keep double-processing under a key a same-id restart may re-acquire. Keyed
+     *  per instance, so it NEVER frees or touches a sibling manager's key and NEVER freezes the space
+     *  (security pin 6) — the sibling keeps serving. We do NOT re-acquire (a same-id restart may already
+     *  be live) and do NOT release the key (it may be the restart's). */
     async renewLease() {
+        // A renew that runs long must not be overlapped by the next tick: both would CAS against the same
+        // cached revision, so whichever lands second is refused over a sequence the first legitimately
+        // moved — a conflict this instance manufactured itself.
+        if (this.leaseRenewInFlight)
+            return;
+        this.leaseRenewInFlight = true;
         try {
             if (!this.leaseInfo || this.leaseRevision === undefined)
                 return;
-            this.leaseRevision = await this.ep.renewManagerLease(this.leaseInfo, this.leaseRevision);
-        }
-        catch (e) {
-            console.error(`! manager instance ${this.managerInstanceId} lost its liveness lease for space "${this.space}" (${e.message}) - shutting down THIS instance (its serving only; siblings keep the space)`);
-            if (this.leaseTimer)
-                clearInterval(this.leaseTimer);
-            // Tear down our managed agents' footprints too (#159 B2) — this exit path leaks them otherwise. Do
-            // NOT release the lease key (it may belong to the replacement holder). Best-effort, like ep/attach.
             try {
-                if (this.maintenanceState === "active" && !this.resumeRequired)
-                    await this.teardownManagedAgents();
-                else
-                    await this.stopRetainedAgentsOnExit();
-            }
-            catch { /* best effort */ }
-            await this.stopServiceServe();
-            await this.stopGoalWriter();
-            await this.stopSessionPlane();
-            try {
-                await this.ep.stop();
+                this.leaseRevision = await this.ep.renewManagerLease(this.leaseInfo, this.leaseRevision);
+                this.leaseConfirmedAt = performance.now();
+                return;
             }
-            catch { /* best effort */ }
-            try {
-                await this.attach.stop();
+            catch (renewError) {
+                const why = renewError.message;
+                const verdict = await this.reconcileLease();
+                if (verdict.kind === "held") {
+                    // WHETHER THIS REFILLS THE BUDGET TURNS ON ONE THING: did our write land? It did, with only
+                    // its acknowledgement lost, exactly when the stored revision has moved past the one we hold.
+                    // That write is what restarted the key's TTL, so only it may reset the clock below.
+                    //
+                    // A re-read at the SAME revision proves the key exists AT THAT INSTANT and nothing more. Our
+                    // write did not land, the TTL was not restarted, and the key still expires when the last
+                    // landed write said it would. Resetting the clock here would measure the budget from the last
+                    // OBSERVATION rather than from the last TTL-refreshing write, and the budget would then
+                    // outlive the key: a streak of same-revision re-reads keeps refilling it, and if reads then
+                    // stop answering too, this instance goes on serving for a further whole TTL after the key has
+                    // actually expired and a same-id restart has taken it. Serving on a key we can still SEE is
+                    // right; buying more time to serve on a key we cannot see is not.
+                    const landed = verdict.revision > this.leaseRevision;
+                    this.leaseRevision = verdict.revision;
+                    if (landed)
+                        this.leaseConfirmedAt = performance.now();
+                    console.error(`! manager instance ${this.managerInstanceId} could not renew its liveness lease for space "${this.space}" (${why}) - the key is still ours at revision ${verdict.revision}${landed ? ", and that renew had in fact landed" : ", though this renew did not land, so the key's TTL was not restarted"}, so this instance keeps serving`);
+                    return;
+                }
+                if (verdict.kind === "unknown") {
+                    const since = performance.now() - this.leaseConfirmedAt;
+                    if (since < MANAGER_LEASE_TTL_MS) {
+                        console.error(`! manager instance ${this.managerInstanceId} could not renew its liveness lease for space "${this.space}" (${why}) and could not re-read it either (${verdict.why}) - that proves nothing about the key, and its lease was last refreshed ${Math.round(since)}ms ago, so this instance keeps serving and will retry`);
+                        return;
+                    }
+                    return await this.failClosedOnLeaseLoss(`its lease key ${Number.isFinite(since) ? `has not been refreshed for ${Math.round(since)}ms, longer than the ${MANAGER_LEASE_TTL_MS}ms lease TTL` : "was never refreshed"}, so this instance can no longer prove it holds it (renew: ${why}; re-read: ${verdict.why})`);
+                }
+                return await this.failClosedOnLeaseLoss(verdict.kind === "gone"
+                    ? `its lease key is GONE from the bucket - expired or released (renew: ${why})`
+                    : `its lease key is now held by ${verdict.by} and not by this process (renew: ${why})`);
             }
-            catch { /* best effort */ }
-            process.exit(1);
         }
+        finally {
+            this.leaseRenewInFlight = false;
+        }
+    }
+    /** What the broker actually says about THIS instance's lease key, right now. `unknown` is a first-class
+     *  answer and never collapses into `gone`: not being able to look is not the same fact as looking and
+     *  finding nothing, and only the latter may end a manager. */
+    async reconcileLease() {
+        let current;
+        try {
+            current = await this.ep.readOwnManagerLease(this.managerInstanceId);
+        }
+        catch (e) {
+            return { kind: "unknown", why: e.message };
+        }
+        if (current === undefined)
+            return { kind: "gone" };
+        // The pid is what distinguishes US from a same-id restart: the logical instance id and the serve
+        // identity both PERSIST across restart by design, so neither can tell the two processes apart.
+        if (current.info.pid !== process.pid)
+            return { kind: "taken", by: `pid ${current.info.pid} (${current.info.runtime}, root ${current.info.root})` };
+        return { kind: "held", revision: current.revision };
+    }
+    /** Stop serving and end this process, naming what was PROVED rather than what merely failed. */
+    async failClosedOnLeaseLoss(proof) {
+        console.error(`! manager instance ${this.managerInstanceId} lost its liveness lease for space "${this.space}": ${proof} - shutting down THIS instance (its serving only; siblings keep the space)`);
+        if (this.leaseTimer)
+            clearInterval(this.leaseTimer);
+        // Tear down our managed agents' footprints too (#159 B2) — this exit path leaks them otherwise. Do
+        // NOT release the lease key (it may belong to the replacement holder). Best-effort, like ep/attach.
+        try {
+            if (this.maintenanceState === "active" && !this.resumeRequired)
+                await this.teardownManagedAgents();
+            else
+                await this.stopRetainedAgentsOnExit();
+        }
+        catch { /* best effort */ }
+        await this.stopServiceServe();
+        await this.stopGoalWriter();
+        await this.stopSessionPlane();
+        try {
+            await this.ep.stop();
+        }
+        catch { /* best effort */ }
+        try {
+            await this.attach.stop();
+        }
+        catch { /* best effort */ }
+        process.exit(1);
     }
     async opFinalizeResume(rawArgs) {
         {
@@ -2115,16 +2224,6 @@ export class Manager {
             ? undefined
             : `unsafe name ${JSON.stringify(name)} (allowed: letters, digits, _ -)`;
     }
-    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
-     *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
-     *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
-     *  connector session, another manager's agent): allocating their name would mint a sibling the
-     *  broker/auth then refuses to admit, surfacing as a 30s launch-uncertain black hole instead of
-     *  the auto-number the join path gives. Presence is ADVISORY (SPEC §6) — this is an availability
-     *  choice at allocation, never an authority check (the broker still enforces): a stale
-     *  still-live-looking row only costs a numbered suffix, and a missed freshly-joined occupant is
-     *  still refused downstream exactly as before. Offline rows do NOT occupy — a properly retired
-     *  name stays reusable. */
     /** The roster's LIVE occupant names (status !== offline) — occupants this manager may NOT manage
      *  (a foreground `cotal spawn`, a connector session, ANOTHER manager's agent). Allocating over any
      *  of them mints a sibling the broker/auth then refuses to admit, surfacing as the 30s launch-
@@ -2143,6 +2242,16 @@ export class Manager {
     nameInUse(name, live = this.liveRosterNames()) {
         return this.agents.has(name) || this.reserved.has(name) || this.retiring.has(name) || live.has(name);
     }
+    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
+     *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
+     *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
+     *  connector session, another manager's agent): allocating their name would mint a sibling the
+     *  broker/auth then refuses to admit, surfacing as a 30s launch-uncertain black hole instead of
+     *  the auto-number the join path gives. Presence is ADVISORY (SPEC §6) — this is an availability
+     *  choice at allocation, never an authority check (the broker still enforces): a stale
+     *  still-live-looking row only costs a numbered suffix, and a missed freshly-joined occupant is
+     *  still refused downstream exactly as before. Offline rows do NOT occupy — a properly retired
+     *  name stays reusable. */
     uniqueName(base) {
         const live = this.liveRosterNames();
         return firstFreeName(base, (n) => this.nameInUse(n, live));
@@ -3322,7 +3431,7 @@ export class Manager {
         // resolve "uncertain"; caught by the lifecycle e2e).
         const wanted = this.managedPrincipal(a);
         // READINESS LIFECYCLE FENCE (SPEC 13.1): match the exact principal AND the exact lifecycle uid
-        // the manager minted for THIS spawn (presence carries it, §6/:315). The endpoint's own
+        // the manager minted for THIS spawn (presence carries it, §6). The endpoint's own
         // register-only broker proof is gated on the CLIENT-authored `card.kind`, which a managed child
         // holding a valid agent credential could set to "endpoint" to skip - so it is defense-in-depth,
         // NOT the authority boundary. This equality is: the manager (not the child) owns the expected
@@ -3492,11 +3601,6 @@ export class Manager {
         }
         return undefined;
     }
-    /** Open a short-lived PROVISIONER connection, run the onboarding ops on it, and drain it (closure (ii),
-     *  residual 2). The DM/DLV consumer-create surface — the irreducible onboarding power — lives only for
-     *  this window, never as a standing grant on the long-lived supervisor. A provision-only endpoint
-     *  (no presence/consume/channel-watch) connected with memory-only `provisioner` creds; it sets its own
-     *  `inboxPrefix` so JS-API replies land on the `_INBOX_<id>.>` the provisioner cred subscribes. */
     /** Run one static §13.1 lifecycle OPERATION over an ephemeral, key-pinned `lifecycle-executor`
      *  connection (Unit B): the credential's grants name exactly ONE incarnation's head/uid/gate/
      *  cred-family/slot keys, so the write authority exists only for this operation's window and
@@ -4162,7 +4266,7 @@ export class Manager {
         // itself (`iid`, written at accept), which is the honest coordinate: a same-instanceId restart
         // inherits its predecessor's orphans, and a goal accepted by a DIFFERENT (possibly still-live)
         // sibling is left for its owner. This replaces the goal spec's `executor` pin, which existed
-        // only to epoch-scope the terminal subject and is gone with it (SPEC:1394).
+        // only to epoch-scope the terminal subject and is gone with it (§13.2 reserved subjects).
         if (acceptedByIid !== this.managerInstanceId) {
             console.error(`goal reconcile ${ref.goalId}: accepted by instance "${acceptedByIid}", not this incarnation "${this.managerInstanceId}"; left for its owner (never a cross-instance settle)`);
             return;
@@ -4292,7 +4396,7 @@ export class Manager {
         // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): must-5 (a) reads THIS
         // incarnation's OWN gate epoch and REFUSES a superseded commit (the currency belt), and (b)
         // barrier-revoke evicts this connection on takeover. The terminal lands on the ONE subject
-        // SPEC:1394 reserves; first-terminal-fact-wins is global, so a committed outcome is visible
+        // SPEC §13.2 (reserved subjects) reserves; first-terminal-fact-wins is global, so a committed outcome is visible
         // to every reader in every incarnation. On success the reconcile-index entry is cleared.
         //
         // Named rather than inlined into the hooks below so the H1 post-accept fallback drives THIS
@@ -4674,6 +4778,11 @@ export class Manager {
             return "the caller's lifecycle is retired; a retired incarnation's credential holds no control authority (F5)";
         return undefined;
     }
+    /** Open a short-lived PROVISIONER connection, run the onboarding ops on it, and drain it (closure (ii),
+     *  residual 2). The DM/DLV consumer-create surface — the irreducible onboarding power — lives only for
+     *  this window, never as a standing grant on the long-lived supervisor. A provision-only endpoint
+     *  (no presence/consume/channel-watch) connected with memory-only `provisioner` creds; it sets its own
+     *  `inboxPrefix` so JS-API replies land on the `_INBOX_<id>.>` the provisioner cred subscribes. */
     async withProvisioner(fn) {
         if (!this.auth)
             throw new Error("withProvisioner: no space auth (an open mesh has no scoped creds)");