@cotal-ai/manager 0.48.2 → 0.49.0

package/dist/manager.js

@@ -4,9 +4,9 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, readFileSync, rmSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
-import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintLifecycleUid, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, eventChannelPrincipal, } from "@cotal-ai/core";
-import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, saveManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
-import { createRuntime, requireRuntimeAdopt, } from "./runtime/index.js";
+import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, divergentSecretStoreRefusal, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, eventChannelPrincipal, } from "@cotal-ai/core";
+import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
+import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
 import { makeManagerEndpointEvictionEvidence, makeManagerEndpointEvictor } from "./endpoint-evict.js";
 import { makeManagerHolderLivenessProbe } from "./holder-liveness.js";
@@ -16,7 +16,7 @@ import { authorizeLaunch, authorizeNamedControl } from "./authorize.js";
 import { controlShutdown } from "./control-shutdown.js";
 import { RunHosting } from "./run-hosting.js";
 import { controlSession } from "./control-session.js";
-import { parseResumeCommitArgs, parseResumeControlArgs, parseResumeFinalizeArgs } from "./resume.js";
+import { MAX_AGENTS, parseResumeCommitArgs, parseResumeControlArgs, parseResumeFinalizeArgs } from "./resume.js";
 // Unit B (the static §13.1 lifecycle executor): the shared grammar/stores from core plus the
 // manager-side adapter (transport + slot orchestration + the F1 terminal) — see static-lifecycle.ts.
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
@@ -29,12 +29,9 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 // P2 item 1 (1a-serve): the manager as an ordinary v0.4 `service` endpoint — the §13.1
 // endpoint-serve credential subsystem (gate provisioning, registration barrier, mint fence) plus
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
-import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, registerServiceInstance, deregisterServiceInstance, authorizeServeGrant, writeServiceStatus, SERVICE_READY, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
+import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServiceInstance, deregisterServiceInstance, authorizeServeGrant, writeServiceStatus, SERVICE_READY, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
 import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, observeStaticSlot, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
-/** Concurrency ceiling — the manager refuses to hold more than this many live + in-flight +
- *  cooling slots at once (P4a). Bounds a fork-bomb: spawn is a full agent process per call. */
-const MAX_AGENTS = 50;
 /** Minimum slot lifetime for rate-flooring (P4c). A slot freed (by despawn OR natural exit/reap)
  *  before living this long leaves a cooling stamp that still counts toward the ceiling until it
  *  expires — so churn (spawn↔despawn or spawn↔fast-exit) can't outrun the concurrency bound. */
@@ -106,7 +103,7 @@ const STATIC_RECONCILE_MAX_ATTEMPTS = STATIC_RECONCILE_RETRY_DELAYS_MS.length +
  *  operation (the rail's idempotence table needs exactly one op per retiring incarnation). 26 hex
  *  chars = in the lifecycle-token grammar `[a-z0-9]{26,32}`, collision-resistant. */
 function retireOpId(lifecycleUid) {
-    return createHash("sha256").update(`retire:${lifecycleUid}`).digest("hex").slice(0, 26);
+    return managedRetirementOpId(lifecycleUid);
 }
 /** Sentinel owner-filter value that matches NO agent's `userOwner` (owner tokens never contain a
  *  dash) — what {@link Manager.psOwnerFilter} returns for an unparseable caller so a malformed
@@ -252,6 +249,20 @@ function foreignEventChannels(channels, owner, actor) {
         return p !== null && !(p.owner === owner && p.actor === actor);
     });
 }
+function injectedManagerStoreIdentity(store) {
+    if (store.identity !== undefined)
+        return parseSecretStoreIdentity(store.identity);
+    const coordinate = process.env.COTAL_SECRET_STORE;
+    if (!coordinate)
+        throw new Error("ManagerOptions.secretStore must declare its identity or set COTAL_SECRET_STORE so the manager and delivery daemon can name the same authority (never a silent local-root fallback)");
+    return { kind: "injected", coordinate };
+}
+/** True only when the delivery-admin rail has no bound responder. A timeout is a hung rail, not absence. */
+function isAbsentDeliveryAdmin(msg) {
+    if (/timeout/i.test(msg))
+        return false;
+    return /no responders|\b503\b/i.test(msg);
+}
 export class Manager {
     space;
     servers;
@@ -265,12 +276,15 @@ export class Manager {
     /** The ONE secret store for every kind this manager touches (daemon-cred remint + agent kinds).
      *  See {@link ManagerOptions.secretStore}. */
     secrets;
+    /** Named identity of {@link secrets}: the same coordinate the delivery daemon must reload from. */
+    secretStoreIdentity;
     /** See {@link ManagerOptions.installedExtensions}. */
     installedExtensions;
     runtime;
     /** Internal test seam. Production leaves this undefined and uses the scoped delivery-admin evictor. */
     staticLifecycleEvict;
     preserveStopTimeoutMs;
+    endpointServeExecutorExpiresInSeconds;
     agents = new Map();
     /** Names whose spawn is in flight (reserved synchronously before the provision await) — counted
      *  toward the ceiling so two concurrent same-name spawns can't both pass the gate (P4a). */
@@ -286,6 +300,12 @@ export class Manager {
      *  truth is the auth-side lifecycle head itself (an unretired head refuses issuance — the
      *  named residual this belt narrows, not replaces). */
     retiring = new Map();
+    /** Exact predecessor incarnations whose full hosted retirement reached a terminal answer. Presence
+     *  is advisory and can retain that old lifecycle briefly after its process exits. Resume may ignore
+     *  only this exact (alias, principal, lifecycleUid) row when adopting a different lifecycle; every
+     *  unknown, current, or differently identified live row still refuses. A later retirement of the
+     *  same alias replaces its prior predecessor coordinate. */
+    confirmedRetiredPredecessors = new Map();
     /** SINGLE-FLIGHT guard for {@link requestRetirement} (audit #1): one in-flight rail round-trip per
      *  (name, lifecycleUid). The detached `deprovision` call and every same-name-spawn nudge for THAT
      *  lifecycle JOIN the same promise instead of stacking independent requests that dual-enter the
@@ -502,9 +522,13 @@ export class Manager {
         if (opts.remoteAuthority)
             this.managerLifecycleUid = opts.remoteAuthority.lifecycleUid;
         this.secrets = opts.secretStore ?? workspaceSecretStore(this.workspaceRoot);
+        this.secretStoreIdentity = opts.secretStore
+            ? injectedManagerStoreIdentity(opts.secretStore)
+            : { kind: "fs", root: resolve(this.workspaceRoot) };
         this.installedExtensions = opts.installedExtensions ?? false;
         this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
         this.preserveStopTimeoutMs = opts.preserveStopTimeoutMs ?? PRESERVE_STOP_TIMEOUT_MS;
+        this.endpointServeExecutorExpiresInSeconds = opts.endpointServeExecutorExpiresInSeconds;
         if (opts.resumeAttemptId && !/^[A-Za-z0-9_-]{1,128}$/.test(opts.resumeAttemptId))
             throw new Error("resumeAttemptId must be a safe token (letters, digits, _, -; max 128)");
         if (opts.resumeDurableCommitToken && !/^[a-f0-9]{64}$/.test(opts.resumeDurableCommitToken))
@@ -532,6 +556,10 @@ export class Manager {
     get runtimeKind() {
         return this.runtime.kind;
     }
+    /** Whether a default process stop can drop manager-local custody without taking agents with it. */
+    get canSpareAgents() {
+        return this.runtime.kind !== "pty" || this.runtime.supportsRelease === true;
+    }
     /** Reattach this manager's runtime to a durable handle. Refuses by name when adopt is absent. */
     adoptRuntimeHandle(reference) {
         return requireRuntimeAdopt(this.runtime, reference);
@@ -620,6 +648,12 @@ export class Manager {
         // refused loud (no-fallbacks - a restart never silently becomes a fresh instance). A second
         // manager in a DIFFERENT workspace root is a DIFFERENT logical id by construction (its own state
         // dir) - two managers in ONE space are two workspace roots.
+        //
+        // First mint on a fresh root is exclusive create (#1263). Two processes that both observe no
+        // file must not keep different in-memory ids: of N concurrent starts exactly one creates the
+        // file (`link` / O_EXCL) and the others adopt that identity before taking a lease, or refuse
+        // with manager-instance-identity-create-lost. Atomic rename is not enough, because the loser
+        // of a replace would still serve under the id it minted.
         {
             if (this.remoteAuthority) {
                 this.managerInstanceId = this.remoteAuthority.instanceId;
@@ -632,9 +666,12 @@ export class Manager {
                     this.managerServeIdentity = persisted.serveIdentity;
                 }
                 else {
-                    this.managerInstanceId = mintLifecycleUid();
-                    this.managerServeIdentity = newIdentity();
-                    saveManagerInstanceIdentity(this.workspaceRoot, this.space, { instanceId: this.managerInstanceId, serveIdentity: this.managerServeIdentity });
+                    const claimed = createManagerInstanceIdentity(this.workspaceRoot, this.space, {
+                        instanceId: mintLifecycleUid(),
+                        serveIdentity: newIdentity(),
+                    });
+                    this.managerInstanceId = claimed.instanceId;
+                    this.managerServeIdentity = claimed.serveIdentity;
                 }
             }
         }
@@ -714,9 +751,10 @@ export class Manager {
         this.leaseTimer.unref?.();
         // Unit B (static §13.1): after this instance holds its lease, collect the durable static rows
         // now, but do not let their exact-op terminals make the whole space unreachable. The service
-        // comes up below, then the sweep overlaps the remaining registration work. `reconcilingAliases`
-        // keeps the old no-race property at the actual conflict boundary: a caller cannot spawn or
-        // attach THAT alias until its terminal attempt returns.
+        // comes up below, then the sweep overlaps the remaining registration work. Two-window
+        // heal-then-register is slower than one executor, but the overlap is still the no-outage
+        // property: `reconcilingAliases` refuses spawn or attach of THAT alias until its terminal
+        // attempt returns.
         const startupReconcile = this.auth && !this.userMode ? this.reconcileStaticLifecycles() : undefined;
         if (startupReconcile)
             void startupReconcile.catch((e) => console.error(`! ${STARTUP_RECONCILING}: ${e.message} - no per-alias retry could be planned; a later manager start re-reads unfinished durable terminals`));
@@ -731,6 +769,7 @@ export class Manager {
         // every half-TTL: re-sign the daemon creds files for their EXISTING nkeys, request the explicit
         // `reloadCreds` adoption on the delivery-admin rail, and persist the audit record doctor renders.
         if (this.auth) {
+            await this.assertDaemonSharesSecretStore();
             await this.renewDaemonCreds();
             this.credRenewTimer = setInterval(() => { void this.renewDaemonCreds(); }, credRenewIntervalMs(STANDING_RENEWABLE_TTL_SEC));
             this.credRenewTimer.unref?.();
@@ -785,6 +824,37 @@ export class Manager {
         // manager records each agent's read ACL at spawn (`commitAcl`, in provisionAgent) so the daemon can
         // re-authorize it; that is the only Plane-3 state the manager touches, and it rides minting.
     }
+    /** Proof that this manager remints into the store the delivery daemon reloads from.
+     *  Fingerprint-only `reloadCreds` is safe only after this. Two named, different stores
+     *  refuse the pass. A daemon that is not bound yet is not a named store: start and
+     *  remint still proceed (tests, delayed delivery), writing this manager's store. The
+     *  challenge runs again before every remint, so a later daemon on a foreign store is
+     *  refused then rather than certified by an earlier absence. A request timeout is not
+     *  absence: a hung rail would skip the proof, so it fails closed. */
+    async assertDaemonSharesSecretStore() {
+        let reply;
+        try {
+            reply = await this.ep.requestDeliveryAdmin("reloadStoreIdentity", {}, 5_000);
+        }
+        catch (e) {
+            const msg = e.message;
+            if (isAbsentDeliveryAdmin(msg))
+                return "absent";
+            throw new Error(`could not challenge the delivery daemon's SecretStore: ${msg}`);
+        }
+        if (!reply.ok)
+            throw new Error(reply.error ?? "delivery daemon refused to name the SecretStore it reloads from");
+        let daemon;
+        try {
+            daemon = parseSecretStoreIdentity(reply.data);
+        }
+        catch (e) {
+            throw new Error(`delivery daemon named an unreadable SecretStore: ${e.message}`);
+        }
+        if (!sameSecretStoreIdentity(this.secretStoreIdentity, daemon))
+            throw new Error(divergentSecretStoreRefusal(this.secretStoreIdentity, daemon));
+        return "shared";
+    }
     /** One class-2 renewal pass (D5 slice 5): re-sign `.cotal/delivery.creds` + `.cotal/membership-rw.creds`
      *  for their existing nkeys, then request the delivery daemon's EXPLICIT `reloadCreds` adoption on the
      *  delivery-admin rail and persist the audit record (`.cotal/renewal.json`) that `cotal doctor auth`
@@ -796,6 +866,7 @@ export class Manager {
         if (!release)
             return;
         try {
+            await this.assertDaemonSharesSecretStore();
             // Re-sign through the manager's ONE store — the SAME store the delivery daemon reads
             // (`runDelivery(args, store)`), so a hosted remint writes the store the daemon renews from,
             // never a divergent one. Locally this is the workstation FS store (`.cotal/*.creds`).
@@ -1305,7 +1376,7 @@ export class Manager {
                 ? (() => {
                     if (!files?.creds)
                         throw new Error(`managed agent ${a.name} is static-auth but its credential path was not recorded`);
-                    return { mode: "static", id: principal.actor, lifecycleUid: a.lifecycleUid, credential: { kind: "file", path: files.creds, sha256: this.fileDigestOrEmpty(files.creds) } };
+                    return { mode: "static", id: principal.actor, lifecycleUid: a.lifecycleUid, credential: { kind: "file", path: files.creds, sha256: this.fileDigestOrEmpty(files.creds) }, ...(a.issued ? { issued: a.issued } : {}) };
                 })()
                 : { mode: "open", id: principal.actor, lifecycleUid: a.lifecycleUid };
         const dependencies = [a.launch.source.configPath];
@@ -1339,7 +1410,7 @@ export class Manager {
             startedAt: new Date(a.startedAt).toISOString(),
         };
     }
-    /** Tear down every managed agent's footprint on a graceful {@link stop} (#159 B2). A manager exit is
+    /** Tear down every managed agent's footprint on an explicit destructive {@link stop}. A manager exit is
      *  a mass agent-exit, and without this its agents' footprints (creds files + `dm_`/`dlv_` durables + ACL
      *  rows) would orphan exactly as the per-agent exit path prevents. Hard-stop each child (an exit has no
      *  time for the graceful grace window) and AWAIT its deprovision — bounded per agent (`withTimeout`) and
@@ -1372,6 +1443,29 @@ export class Manager {
         if (failures.length)
             throw new Error(`manager shutdown could not prove every seat exited: ${failures.join("; ")}`);
     }
+    /** Drop only this manager's local custody handles. Validate the complete snapshot before releasing
+     * any handle so a non-detachable runtime cannot leave a partially detached manager behind. */
+    releaseManagedAgents() {
+        const managed = [...this.agents.values()];
+        const blocked = managed.filter((a) => a.handle.kind === "pty" && typeof a.handle.release !== "function");
+        if (blocked.length) {
+            return [
+                `manager shutdown cannot detach ${blocked.map((a) => `${a.name} (${a.handle.kind})`).join(", ")}: runtime handle does not support release`,
+            ];
+        }
+        const failures = [];
+        for (const a of managed) {
+            try {
+                a.handle.release?.();
+                a.suppressCleanup = true;
+                this.agents.delete(a.name);
+            }
+            catch (e) {
+                failures.push(`${a.name}: ${e.message}`);
+            }
+        }
+        return failures;
+    }
     async stopRetainedAgentsOnExit() {
         const managed = [...this.agents.values()];
         for (const a of managed)
@@ -1396,7 +1490,7 @@ export class Manager {
         if (failures.length)
             throw new Error(`manager preservation shutdown incomplete: ${failures.join("; ")}`);
     }
-    async stop() {
+    async stop(options = {}) {
         this.staticReconcileStopping = true;
         const starting = this.startTask;
         for (const item of this.staticReconcileItems.values()) {
@@ -1413,8 +1507,12 @@ export class Manager {
             clearInterval(this.credRenewTimer);
         if (this.sessionKeyRenewTimer)
             clearInterval(this.sessionKeyRenewTimer);
+        let releaseFailures = [];
         if (this.maintenanceState === "active" && !this.resumeRequired) {
-            await this.teardownManagedAgents(); // normal shutdown stays destructive (#159 B2)
+            if (options.withAgents)
+                await this.teardownManagedAgents();
+            else
+                releaseFailures = this.releaseManagedAgents();
         }
         else {
             // A signal after a partial preservation must never fall back into destructive teardown.
@@ -1437,6 +1535,8 @@ export class Manager {
         await this.stopSessionPlane();
         await this.ep.stop();
         await this.attach.stop();
+        if (releaseFailures.length)
+            throw new Error(`manager shutdown could not release every detachable seat: ${releaseFailures.join("; ")}`);
     }
     /**
      * REMOVE THIS INSTANCE'S SERVICE REGISTRATION on a clean stop (§13.5 deregistration).
@@ -1470,7 +1570,9 @@ export class Manager {
             },
         });
         try {
-            const outcome = await (this.auth ? this.withEndpointServeExecutor(dereg) : this.withOpenServeConnection(dereg));
+            const outcome = await ((this.auth || this.remoteAuthority)
+                ? this.withEndpointServeExecutor(dereg)
+                : this.withOpenServeConnection(dereg));
             if (outcome.removed)
                 console.error(`✓ deregistered manager instance ${iid} from the ${MANAGER_ENDPOINT} service registry (spec revision ${outcome.specRevision})`);
             else if (outcome.reason === "superseded")
@@ -1791,23 +1893,25 @@ export class Manager {
      *  only into operator instruments (§13.2: `any` is operator-policy-mintable; the agent/spawn
      *  rollups never carry them), so REACHING the handler is holding the admin tier, exactly as
      *  holding `ctl.<admin>` is today. User mesh: the caller's CURRENT ledger scope must carry
-     *  `admin` — the same fresh-read authority {@link psOwnerFilter} consults, so a revoked scope
-     *  demotes the very next call even on a still-valid bearer. Fail-closed: an unreadable ledger
-     *  authorizes nothing. NAMED RESIDUAL (critic, 1c.2b): the static `true` has no serve-time
+     *  `admin`. A local-host manager reads its own ledger fresh. A remote-authority manager relays the
+     *  subject-parsed caller tuple to its host-owned authorization callback, with no participant-ledger
+     *  fallback. The same fresh authority drives {@link psOwnerFilter}, so a revoked scope demotes the
+     *  very next call even on a still-valid bearer. Local ledger read failures authorize nothing;
+     *  remote host-state faults throw and fail the operation closed. NAMED RESIDUAL (critic,
+     *  1c.2b): the static `true` has no serve-time
      *  re-check — a LEAKED static admin instrument keeps its reach until the credential's bounded
      *  TTL (the one-shot 5-minute profile), the same static-revoke≠reconnect-death class ruled
      *  across this campaign; static revocation is the TTL, not a ledger. */
     async epAdminReach(caller) {
         if (!this.userMode)
             return true;
-        const key = parsePrincipalKey(caller);
-        if (!key)
-            return false;
+        if (this.remoteAuthority)
+            return this.remoteAuthority.authorizeAdmin({ owner: caller.owner, actor: caller.actor, lifecycleUid: caller.uid });
         try {
             const scope = await resolveAuthProvider().actorScope({
                 dir: userAuthStateDir(this.workspaceRoot, this.space),
-                owner: key.owner,
-                actor: key.actor,
+                owner: caller.owner,
+                actor: caller.actor,
             });
             return scope?.includes("admin") === true;
         }
@@ -1823,7 +1927,7 @@ export class Manager {
     async epAnyModeAdmin(ctx) {
         if (ctx.subject.target?.mode !== "any")
             return false;
-        if (!(await this.epAdminReach(principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key)))
+        if (!(await this.epAdminReach(ctx.subject.caller)))
             throw new EpEnvelopeError("permission-denied", `an any-mode ${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`);
         return true;
     }
@@ -1901,7 +2005,7 @@ export class Manager {
         // call instead of riding the bearer's remaining JWT-row lifetime. The resume family keeps its
         // serveGated BYPASS (those ops must run while the maintenance fence holds) but not the gate.
         const adminGated = async (ctx, fn) => {
-            if (!(await this.epAdminReach(callerOf(ctx))))
+            if (!(await this.epAdminReach(ctx.subject.caller)))
                 throw new EpEnvelopeError("permission-denied", `${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`);
             return fn();
         };
@@ -1914,10 +2018,10 @@ export class Manager {
         };
         return managerCommandDefs({
             status: (ctx) => this.serveGated(ctx, () => this.managerStatusData()),
-            ps: (ctx) => this.serveGated(ctx, async () => this.list(await this.psOwnerFilter(callerOf(ctx), false))),
+            ps: (ctx) => this.serveGated(ctx, async () => this.list(await this.psOwnerFilter(ctx.subject.caller, false))),
             inspect: (ctx) => this.serveGated(ctx, async () => {
                 const name = String(args(ctx).name ?? "").trim();
-                const row = this.list(await this.psOwnerFilter(callerOf(ctx), false)).find((x) => x.name === name);
+                const row = this.list(await this.psOwnerFilter(ctx.subject.caller, false)).find((x) => x.name === name);
                 if (!row) {
                     // The live hit above stays entirely local. Only a miss widens into durable static state,
                     // where `not-found` is honest only after the slot read itself succeeds and returns absent.
@@ -1957,14 +2061,14 @@ export class Manager {
             spawn: (ctx) => this.serveGated(ctx, () => this.serveSpawnGoal(ctx, (h) => this.opStart(args(ctx), callerOf(ctx), h))),
             despawn: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
-                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx));
+                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
                     throw new EpEnvelopeError("permission-denied", denied);
                 return unwrap(this.despawnAuthorized(a, args(ctx).graceful !== false, true));
             }),
             attach: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
-                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx));
+                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
                     throw new EpEnvelopeError("permission-denied", denied);
                 return unwrap(await this.attachAuthorized(a, ctx.subject.caller));
@@ -1974,7 +2078,7 @@ export class Manager {
             // place for one of them to quietly acquire a condition the other does not have.
             input: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
-                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx));
+                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
                     throw new EpEnvelopeError("permission-denied", denied);
                 return this.inputAuthorized(a, args(ctx));
@@ -1984,7 +2088,7 @@ export class Manager {
             // reason `input` is (a shared policy, not a shared body).
             turn: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
-                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx));
+                const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
                 if (denied)
                     throw new EpEnvelopeError("permission-denied", denied);
                 return this.serveTurnGoal(ctx, a);
@@ -2025,7 +2129,7 @@ export class Manager {
             finalizeResume: (ctx) => adminGated(ctx, async () => unwrap(await this.opFinalizeResume(args(ctx)))),
             // The workflow-run family (SPEC 14.3): the manager hosts the driver. Reach is the broker's
             // (`run` capability / privileged instrument rows); the serve gate is the maintenance fence.
-            runStart: (ctx) => this.serveGated(ctx, () => this.runHost().start(args(ctx))),
+            runStart: (ctx) => this.serveGated(ctx, () => this.runHost().start(ctx, args(ctx))),
             runResume: (ctx) => this.serveGated(ctx, () => this.runHost().resume(args(ctx))),
             runAnswer: (ctx) => this.serveGated(ctx, () => this.runHost().answer(args(ctx), this.runAnswerer(ctx))),
             runStatus: (ctx) => this.serveGated(ctx, () => this.runHost().status(args(ctx))),
@@ -2075,11 +2179,27 @@ export class Manager {
      *  instruments). With admin=true (any-mode) any named target is allowed (operator). Otherwise
      *  a named target is allowed if it's the caller's OWN child (`spawner == caller`) — and, on a
      *  user mesh, if it runs under the CALLER'S OWNER (owner-domain) or the caller's ledger row
-     *  holds `admin`, read fresh. The policy is the pure
-     *  {@link authorizeNamedControl}; this wrapper only binds the manager's state (the mode flag +
-     *  the provider-backed ledger read — a build with no provider authorizes nothing extra,
-     *  fail-closed via the policy's catch). Error string when denied, `undefined` when allowed. */
-    authorizeNamed(target, caller, admin) {
+     *  holds `admin`, read fresh. Local managers run the pure {@link authorizeNamedControl} policy
+     *  against their provider-backed ledger. Remote managers preserve own-child and owner-domain
+     *  decisions locally, then send only the residual cross-owner admin question through the registered
+     *  host callback with the full endpoint caller tuple. Error string when denied, `undefined` when
+     *  allowed; remote host-state faults throw rather than being collapsed into a denial. */
+    async authorizeNamed(target, caller, admin, epCaller) {
+        if (this.remoteAuthority && epCaller && !admin) {
+            if (target.spawner === caller)
+                return undefined;
+            const principal = parsePrincipalKey(caller);
+            if (principal && target.userOwner === principal.owner)
+                return undefined;
+            // Unlike the local pure-policy adapter below, host authority faults are not collapsed into an
+            // ordinary denial. The registered remote manager must fail the operation closed and surface
+            // unavailable/corrupt authoritative state rather than implying a healthy `authorized:false`.
+            if (await this.epAdminReach(epCaller))
+                return undefined;
+            return (`not authorized: ${target.name} runs under another owner - your grant covers agents under your own owner; ` +
+                `cross-owner stop/attach/input needs scope "admin" on your actor. Re-grant with "admin" ADDED to your current ` +
+                `scope (the upsert replaces the list; see \`cotal actor list\`)`);
+        }
         return authorizeNamedControl({
             target: { name: target.name, spawner: target.spawner, userOwner: target.userOwner },
             caller,
@@ -2407,14 +2527,17 @@ export class Manager {
             // static retirement the detached deprovision below drives) — the alias frees only when the
             // gate+head terminal completes, exactly the user-mode discipline. The wire principal is the
             // incarnation-unique nkey (F5-bind); owner is the dev owner.
-            this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: DEV_OWNER, actor: a.id, agentId: a.id, secretPaths: a.secretPaths, startedAt: Date.now() });
+            this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: DEV_OWNER, actor: a.id, agentId: a.id, secretPaths: a.secretPaths, runtime: a.handle?.reference, startedAt: Date.now() });
         }
         // Auth mode: tear down the departed agent's minted broker footprint + creds file (#159 B2). The
         // process is already gone, so this must never block the slot free or throw into the caller — it runs
         // detached, and a failure is logged loudly (never swallowed), not retried. The `agents` guard above
         // makes this fire exactly once per agent across every free path (despawn / self-stop / reap / exit).
+        // The departed agent's own custody reference rides the teardown: the exit that freed this slot
+        // is usually the seat ending, but a stop that could not prove the process gone leaves one the
+        // terminal must still address before it frees the alias.
         if (!a.suppressCleanup && (this.maintenanceState === "active" || acceptedBeforeFence))
-            this.trackDeprovision(a);
+            this.trackDeprovision({ ...a, runtime: a.handle?.reference });
     }
     /** Tear down a departed agent's minted footprint (#159 B2, auth mode): its local-principal durables
      *  (`dm_local-<id>`, `dlv_local-<id>`), its read-ACL row, and its creds file — everything the spawn's
@@ -2429,7 +2552,7 @@ export class Manager {
      *  is the separate per-user-auth work, not this. Tearing down the durables + ACL row still shrinks the
      *  delivery surface a stale copy could use. */
     async deprovision(a) {
-        if (!this.auth)
+        if (!this.auth && !this.remoteAuthority)
             return; // open mesh mints no creds/durables — nothing to tear down
         // SINGLE-FLIGHT per (name, lifecycleUid) (INT-2/C): join an in-flight teardown for this exact
         // lifecycle rather than launching a second concurrent one whose delayed name-keyed revoke could
@@ -2447,6 +2570,20 @@ export class Manager {
     }
     /** The actual footprint teardown (wrapped by {@link deprovision}'s single-flight). */
     async driveDeprovision(a) {
+        if (this.remoteAuthority) {
+            // A hosted composition owns grant revocation and resumable footprint release. It calls this
+            // prerequisite before the terminal rail. The callback must preserve this UID and its pending
+            // state until the host decides terminal retirement, never map deprovisioning to suspension.
+            const target = parsePrincipalKey(a.id);
+            if (!target)
+                throw new Error(`hosted retirement cannot derive the managed principal ${a.id}`);
+            await this.remoteAuthority.prepareAgentRetirement({
+                target: { owner: target.owner, actor: target.actor, lifecycleUid: a.lifecycleUid },
+                opId: retireOpId(a.lifecycleUid),
+            });
+            await this.requestRetirement(a);
+            return;
+        }
         if (!this.auth)
             return; // guaranteed by deprovision; re-checked for the deprovisionBroker narrowing
         if (!this.userMode && !a.userOwner) {
@@ -2552,8 +2689,8 @@ export class Manager {
     }
     /** The rail round-trip for one retirement (wrapped by {@link requestRetirement}'s single-flight). */
     async driveRetirement(a) {
-        if (!this.auth)
-            return; // guaranteed by requestRetirement; re-checked for the type narrowing below
+        if (!this.auth && !this.remoteAuthority)
+            return;
         const held = this.retiring.get(a.name);
         const target = parsePrincipalKey(a.id);
         if (!target) {
@@ -2594,10 +2731,18 @@ export class Manager {
             // mismatch in the owner half the moment a manager ran under a user-shaped identity. This is
             // also the more honest attribution: the authority being exercised is "I am the registered
             // serving instance", which is exactly what the gate records.
-            const caller = { owner: DEV_OWNER, actor: serveIdentity.id, uid: this.managerLifecycleUid };
-            const creds = await mintCreds(this.auth, newIdentity(), "retirement-requester", {
-                retirementRequester: { ...caller, target: { owner: target.owner, actor: target.actor, lifecycleUid: a.lifecycleUid } },
-            });
+            const caller = this.remoteAuthority
+                ? { owner: this.remoteAuthority.owner, actor: this.remoteAuthority.actors.serve, uid: this.managerLifecycleUid }
+                : { owner: DEV_OWNER, actor: serveIdentity.id, uid: this.managerLifecycleUid };
+            const requestIdentity = newIdentity();
+            const retirementTarget = { owner: target.owner, actor: target.actor, lifecycleUid: a.lifecycleUid };
+            const opId = retireOpId(a.lifecycleUid);
+            const serveEpoch = this.serviceServe?.grant.epoch ?? 0;
+            const creds = this.remoteAuthority
+                ? await this.remoteAuthority.mintRetirementRequester({ identity: requestIdentity, target: retirementTarget, opId, serveEpoch })
+                : await mintCreds(this.auth, requestIdentity, "retirement-requester", {
+                    retirementRequester: { ...caller, target: retirementTarget },
+                });
             const nc = await this.dial({ authenticator: credsAuthenticator(new TextEncoder().encode(creds)), maxReconnectAttempts: 0 });
             try {
                 // §13.2 nonce: >=128 bits of CSPRNG entropy, base64url (the `endpoint-invoke` idiom).
@@ -2625,30 +2770,12 @@ export class Manager {
                 // caller's own subject-derived principal. A superseded predecessor (same instanceId, OLD
                 // epoch after a restart) is still refused by the epoch comparison.
                 JSON.stringify({ id: requestId, op: "retireLifecycle", args: {
-                        opId: retireOpId(a.lifecycleUid),
-                        serveEndpoint: MANAGER_ENDPOINT, serveInstanceId: this.managerInstanceId, serveEpoch: this.serviceServe?.grant.epoch ?? 0,
+                        opId,
+                        serveEndpoint: MANAGER_ENDPOINT, serveInstanceId: this.managerInstanceId, serveEpoch,
                     } }), 20_000);
                 const r = m;
                 if (r.ok) {
-                    // CAS the hold clear (audit #1 ABA): free the alias ONLY if the current hold is still THIS
-                    // lifecycle's - a late reply for a retired predecessor must never clear a successor's newer hold.
-                    const cur = this.retiring.get(a.name);
-                    if (cur && cur.lifecycleUid === a.lifecycleUid) {
-                        if (cur.standingAuthorityLive) {
-                            // INT-2: the auth-plane lifecycle retired, but the manager-side STANDING mint authority is
-                            // not yet revoked (a failed revoke). Freeing the name here would be a false terminal (a
-                            // copied token could still mint), so keep the hold with its revoke-failure copy; a retry
-                            // re-drives the full teardown (revoke included).
-                            console.error(`despawn ${a.name}: the auth-plane lifecycle retired, but the standing mint authority is not yet revoked; the name stays held. ${cur.lastError ?? ""}`);
-                        }
-                        else {
-                            this.retiring.delete(a.name);
-                            console.error(`despawn ${a.name}: the agent's retirement completed; the name is free for reuse`);
-                        }
-                    }
-                    else {
-                        console.error(`despawn ${a.name}: retirement confirmed for a prior lifecycle of "${a.name}"; the current hold is left intact`);
-                    }
+                    this.confirmRetirement(a);
                 }
                 else {
                     // The rail's refusal is already the operator copy (lease-loss/stale/foreign-op faces,
@@ -2669,6 +2796,30 @@ export class Manager {
             console.error(`despawn ${a.name}: ${copy}`);
         }
     }
+    /** Apply one terminal retirement answer. The predecessor coordinate is recorded only when the
+     *  answer clears this exact lifecycle's hold, never for an ABA-late answer or an incomplete hosted
+     *  teardown whose standing authority still lives. */
+    confirmRetirement(a) {
+        // CAS the hold clear (audit #1 ABA): free the alias ONLY if the current hold is still THIS
+        // lifecycle's. A late reply for a retired predecessor must never clear a successor's newer hold.
+        const cur = this.retiring.get(a.name);
+        if (cur && cur.lifecycleUid === a.lifecycleUid) {
+            if (cur.standingAuthorityLive) {
+                // INT-2: the auth-plane lifecycle retired, but the manager-side STANDING mint authority is
+                // not yet revoked. A copied token could still mint, so neither free the alias nor classify
+                // its presence as a completed predecessor.
+                console.error(`despawn ${a.name}: the auth-plane lifecycle retired, but the standing mint authority is not yet revoked; the name stays held. ${cur.lastError ?? ""}`);
+            }
+            else {
+                this.confirmedRetiredPredecessors.set(a.name, { principal: a.id, lifecycleUid: a.lifecycleUid });
+                this.retiring.delete(a.name);
+                console.error(`despawn ${a.name}: the agent's retirement completed; the name is free for reuse`);
+            }
+        }
+        else {
+            console.error(`despawn ${a.name}: retirement confirmed for a prior lifecycle of "${a.name}"; the current hold is left intact`);
+        }
+    }
     /** The teardown's ASYNC BROKER PHASE: mint the ephemeral target-pinned deprovisioner cred and
      *  delete the agent's broker footprint (dm_/dlv_ durables + read-ACL row). Split from
      *  {@link deprovision} because it runs LAST in the ordered teardown chain — after the creds/secret
@@ -2831,7 +2982,12 @@ export class Manager {
                 const joinedAfter = this.ep.getRoster()
                     .filter((p) => p.card.id === wanted && p.lifecycleUid === a.lifecycleUid)
                     .reduce((max, p) => Math.max(max, p.ts), 0) + 1;
-                const handle = this.runtime.spawn(a.name, spec, a.launch.cwd);
+                // Same ordering as the spawn path: the replacement seat's reference is recorded on the
+                // still-active slot before its processes exist, so a crash here never strands it.
+                const custody = this.reserveCustody();
+                if (custody)
+                    await this.recordSlotCustody(a, custody);
+                const handle = await this.spawnCustodied(a.name, spec, a.launch.cwd, custody);
                 replacement = handle;
                 restart.sessionStatePath = spec.sessionStatePath ?? restart.sessionStatePath;
                 if (continueSession !== undefined)
@@ -2867,6 +3023,7 @@ export class Manager {
                 replacement = undefined;
                 restart.opts = opts;
                 restart.recovering = false;
+                await this.recordSlotRuntime(a);
                 if (continueSession !== undefined)
                     console.error(`! ${a.name}: recovered Pi session ${continueSession} after crash (${restart.crashes.length}/${limit})`);
                 else
@@ -3177,14 +3334,13 @@ export class Manager {
     async psOwnerFilter(caller, admin) {
         if (!this.userMode || admin)
             return undefined;
-        const key = parsePrincipalKey(caller);
-        if (!key)
-            return NO_OWNER_MATCHES;
+        if (this.remoteAuthority)
+            return (await this.epAdminReach(caller)) ? undefined : caller.owner;
         try {
             const scope = await resolveAuthProvider().actorScope({
                 dir: userAuthStateDir(this.workspaceRoot, this.space),
-                owner: key.owner,
-                actor: key.actor,
+                owner: caller.owner,
+                actor: caller.actor,
             });
             if (scope?.includes("admin"))
                 return undefined;
@@ -3192,7 +3348,7 @@ export class Manager {
         catch {
             /* unreadable ledger authorizes nothing extra: fall through to the own-owner bound */
         }
-        return key.owner;
+        return caller.owner;
     }
     /** Boot one resolved agent from a mesh-manifest launch spec, for `cotal spawn -f` onto a RUNNING
      *  manager. The request carries `{ runId, name }` — plus, for a deploy from another checkout or
@@ -3554,6 +3710,11 @@ export class Manager {
         // AFTER provisioning (buildLaunch / runtime.spawn) — the orphan-rollback tears it down. Carries
         // `userOwner` for a user-mode spawn so that rollback runs the revoke+shred branch, not just the
         // static durable teardown (the freelance found this window leaking the managed grant + files).
+        // The RESERVED custody reference rides the rollback object: a spawn that launched the seat and
+        // then threw (the activation CAS refuses a slot that is not this spawn's intent) reaches the
+        // `finally` with the handle only in a local, so without this the terminal has nothing to reap
+        // and retires over a live process. The slot row holds the same reference; this is the copy the
+        // in-process rollback can actually read.
         let provisioned;
         try {
             // A stable nkey identity assigned at spawn: the public key is the agent's card.id (threaded via
@@ -3563,6 +3724,11 @@ export class Manager {
             // broker resource (dm_/dlv_/chathist_ durables, ACL row, memberships) and the teardown
             // credential carry it, so a same-name successor's footprint is name-disjoint by construction.
             const lifecycleUid = mintLifecycleUid();
+            // Reserve the seat's custody reference NOW, before any durable row and long before the
+            // launch. Minting it inside `runtime.spawn` (as it used to be) put the processes on disk
+            // before anything recorded how to address them, so a crash in that window left a live seat
+            // outside every manager and the successor retired the slot over it.
+            const custody = this.reserveCustody();
             // ACCEPT SEAM (P2 item 2 spawn-as-action): the incarnation identity is minted and NOTHING has
             // been provisioned yet — the action serve path binds the goal + replies the acceptance HERE. A
             // throw (bind conflict / duplicate goalId) aborts the spawn before provisioning: the catch below
@@ -3625,6 +3791,7 @@ export class Manager {
             // spawned session reads them (COTAL_CREDS path). Open mesh → no creds. Scope = the resolved
             // subscribe/allowSubscribe (read) + allowPublish (post, default-deny).
             let credsPath;
+            let issued;
             let userLaunch;
             let userOwner;
             if (this.userMode) {
@@ -3645,7 +3812,7 @@ export class Manager {
                 }
                 userLaunch = prep.launch;
                 userOwner = prep.owner;
-                provisioned = { id: principalKey(prep.owner, name).key, name, lifecycleUid, userOwner: prep.owner, secretPaths: prep.files };
+                provisioned = { id: principalKey(prep.owner, name).key, name, lifecycleUid, userOwner: prep.owner, secretPaths: prep.files, ...(custody ? { runtime: custody } : {}) };
             }
             else if (this.auth) {
                 // Unit B (§13.1): reserve + activate this incarnation's DURABLE identity BEFORE any
@@ -3653,18 +3820,25 @@ export class Manager {
                 // then the SHARED core activation saga (reserve uid -> gate frozen -> head CAS -> reopen
                 // LAST) over the key-pinned executor. The wire AUTHORITY principal is the incarnation-
                 // unique nkey (F5-bind); the alias is protected by the name-keyed slot + freeSlot hold.
-                await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: identity.id, lifecycleUid, alias: name }, (t) => activateStaticLifecycle(t, { owner: DEV_OWNER, alias: name, actor: identity.id, lifecycleUid, managerInstance: this.managerLifecycleUid, ownerInstanceId: this.managerInstanceId }));
+                await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: identity.id, lifecycleUid, alias: name }, (t) => activateStaticLifecycle(t, { owner: DEV_OWNER, alias: name, actor: identity.id, lifecycleUid, managerInstance: this.managerLifecycleUid, ownerInstanceId: this.managerInstanceId, runtime: custody }));
                 // From here the DURABLE registration exists: arm the rollback BEFORE minting, so a throw
                 // between activation and provisioning still drives the exact-op static terminal (the
                 // finally's deprovision tolerates absent files; the broker teardown is idempotent).
-                provisioned = { id: identity.id, name, lifecycleUid };
+                provisioned = { id: identity.id, name, lifecycleUid, ...(custody ? { runtime: custody } : {}) };
                 // Pre-create the agent's bind-only chat (+ DM + role TASK) durables and mint its scoped creds
                 // — the shared onboarding step (provisionAgent). It runs on a short-lived PROVISIONER connection
                 // (NOT the supervisor's long-lived endpoint), so the DM/DLV consumer-create surface exists only
                 // for the provisioning window, never as a standing grant on the always-on daemon (residual 2).
                 // F5(b): the credential is BOUNDED (`expiresAt`) — the manager push-renews it ahead of expiry.
                 const exp = Math.floor(Date.now() / 1000) + MANAGED_STATIC_TTL_SEC;
-                const creds = await this.withProvisioner((prov) => provisionAgent(prov, this.auth, identity, {
+                // The credential is an ISSUANCE (SPEC 13.15): its caller rails carry a fresh generation
+                // and its ceiling is recorded as evidence bound to this incarnation's ledger family. The
+                // §13.1 ledger append (ledger BEFORE materialization) is the release's finalizer, so the
+                // evidence activates only once the row exists, and the row exists only after the evidence
+                // was staged. The agent learns the generation by reading the accepted row under its token.
+                issued = { generation: mintGeneration(), acceptedToken: mintAcceptedToken() };
+                const issuedAgent = { name, id: identity.id, lifecycleUid };
+                const creds = await this.withIssuer((i) => this.withProvisioner((prov) => provisionAgent(prov, this.auth, identity, {
                     subscribe,
                     allowSubscribe,
                     allowPublish,
@@ -3672,15 +3846,9 @@ export class Manager {
                     capabilities,
                     lifecycleUid,
                     expiresAt: exp,
-                }));
-                // Ledger BEFORE materialization (§13.1): record the credentialId on the slot, append the
-                // `cred.<uid>.<credId>` row, and only then write the credential where anything can read
-                // it — a credential is never materialized before its ledger row exists.
-                const credentialId = rawDigest(creds).replace("sha256:", "sha256-");
-                await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: identity.id, lifecycleUid, alias: name }, async (t) => {
-                    await recordSlotCredential(t, DEV_OWNER, name, lifecycleUid, credentialId);
-                    await appendStaticCredentialRow(t, { lifecycleUid, credentialId, holderPrincipal: principalKey(DEV_OWNER, identity.id).key, exp });
-                });
+                    issued,
+                    issuance: this.issuanceSeam(i, "issue", issuedAgent, exp),
+                })));
                 // Store first (the source of truth), then materialize: `buildLaunch` hands the CHILD this
                 // file path, so the cred must exist as a file regardless of the store behind the seam. The
                 // manager's ONE store (injected for hosted, workstation FS locally).
@@ -3690,7 +3858,7 @@ export class Manager {
                 credsPath = agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, name, lifecycleUid).creds;
                 await secrets.put(agentSecretKeyForFile(credsPath, this.space), creds);
                 await materializeSecretToFile(secrets, agentSecretKeyForFile(credsPath, this.space), credsPath);
-                provisioned = { id: identity.id, name, lifecycleUid, secretPaths: { creds: credsPath } }; // footprint now exists — the finally rolls it back if the spawn throws
+                provisioned = { id: identity.id, name, lifecycleUid, secretPaths: { creds: credsPath }, ...(custody ? { runtime: custody } : {}) }; // footprint now exists — the finally rolls it back if the spawn throws
             }
             // Personal MCP servers the operator opted to share with manager-spawned agents of this type
             // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
@@ -3723,6 +3891,7 @@ export class Manager {
                 // chathist durables by this exact value (its creds pin the same names, so a mismatch fails
                 // at the broker, never silently).
                 lifecycleUid,
+                acceptedToken: issued?.acceptedToken,
                 servers: this.servers,
                 configPath,
                 model,
@@ -3751,7 +3920,7 @@ export class Manager {
                 workspaceRoot: this.workspaceRoot,
             };
             const spec = connector.buildLaunch(launchOpts);
-            const handle = this.runtime.spawn(name, spec, cwd);
+            const handle = await this.spawnCustodied(name, spec, cwd, custody);
             hooks?.onLaunched?.(); // P2 item 2: the "launched" progress edge (process spawned, pre-presence)
             const managed = {
                 name,
@@ -3763,6 +3932,7 @@ export class Manager {
                 // recorded truth teardown/preservation/health consume, never re-derived by name.
                 secretPaths: provisioned?.secretPaths,
                 ...(userLaunch ? { userOwner } : { seed: identity.seed }),
+                ...(issued ? { issued } : {}),
                 spawner: spawner ?? this.ep.ref().id,
                 authorityParent: userLaunch && spawner && parsePrincipalKey(spawner) ? spawner : undefined,
                 startedAt: Date.now(),
@@ -3818,7 +3988,9 @@ export class Manager {
                     const slot = await readStaticSlot(t, DEV_OWNER, name);
                     if (slot === undefined || slot.row.lifecycleUid !== lifecycleUid || slot.row.phase !== "provisioning")
                         throw new Error(`the static slot for "${name}" is ${slot === undefined ? "absent" : `${slot.row.phase} at uid ${slot.row.lifecycleUid}`}, not this spawn's provisioning intent; refusing to take the slot`);
-                    await casStaticSlot(t, { ...slot.row, phase: "active" }, slot.revision);
+                    // The custody reference rides the SAME CAS as activation: a crash after this write leaves
+                    // an active slot a successor can reap by reference, never a live seat nobody addresses.
+                    await casStaticSlot(t, { ...slot.row, phase: "active", ...(handle.reference ? { runtime: handle.reference } : {}) }, slot.revision);
                 });
             }
             this.agents.set(name, managed);
@@ -3915,15 +4087,33 @@ export class Manager {
             const seen = new Set();
             const principals = new Set();
             await this.ep.waitForPresenceSnapshot();
-            const livePrincipals = new Set(this.ep.getRoster()
-                .filter((presence) => presence.status !== "offline")
-                .map((presence) => presence.card.id));
+            const liveRoster = this.ep.getRoster().filter((presence) => presence.status !== "offline");
             if (this.agents.size + this.reserved.size + this.coolingCount() + inventory.agents.length > MAX_AGENTS)
                 return { ok: false, agents: [], error: `resume inventory would exceed manager capacity (${MAX_AGENTS})` };
             for (const entry of inventory.agents) {
                 if (seen.has(entry.name))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate agent name "${entry.name}"` };
                 seen.add(entry.name);
+                // A manager-local retirement hold is stronger and more precise than presence. The stopped
+                // predecessor can remain roster-live until its TTL/offline update lands, but that stale row
+                // must not hide the durable teardown state the manager already owns. Refuse and re-drive the
+                // exact held lifecycle before consulting generic principal liveness. A confirmed terminal has
+                // already removed the hold, so fresh-lifecycle resume still reaches the fail-closed roster gate.
+                const held = this.retiring.get(entry.name);
+                if (held) {
+                    void this.deprovision({
+                        id: held.agentId,
+                        name: entry.name,
+                        lifecycleUid: held.lifecycleUid,
+                        userOwner: held.userOwner,
+                        secretPaths: held.secretPaths,
+                    }).catch(() => { });
+                    return {
+                        ok: false,
+                        agents: [],
+                        error: `retained agent "${entry.name}" is reserved pending retirement: its previous lifecycle ${held.lifecycleUid} still owns the alias${held.lastError ? ` (last attempt: ${held.lastError})` : ""}; retrying re-drives that exact teardown`,
+                    };
+                }
                 let principal;
                 try {
                     principal = entry.identity.mode === "user"
@@ -3936,7 +4126,17 @@ export class Manager {
                 if (principals.has(principal))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate principal "${principal}"` };
                 principals.add(principal);
-                if (livePrincipals.has(principal))
+                const confirmedPredecessor = this.confirmedRetiredPredecessors.get(entry.name);
+                const principalIsLive = liveRoster.some((presence) => {
+                    if (presence.card.id !== principal)
+                        return false;
+                    return confirmedPredecessor === undefined ||
+                        confirmedPredecessor.principal !== principal ||
+                        confirmedPredecessor.lifecycleUid !== presence.lifecycleUid ||
+                        presence.card.name !== entry.name ||
+                        entry.identity.lifecycleUid === confirmedPredecessor.lifecycleUid;
+                });
+                if (principalIsLive)
                     return { ok: false, agents: [], error: `retained principal "${principal}" is already live and this runtime cannot authoritatively adopt it` };
                 if (this.agents.has(entry.name) || this.reserved.has(entry.name))
                     return { ok: false, agents: [], error: `retained agent "${entry.name}" is already managed or reserved` };
@@ -4088,15 +4288,23 @@ export class Manager {
             const sentinelCreds = await secrets.get(agentSecretKeyForFile(recordedSentinel, this.space));
             if (actorToken === undefined || sentinelCreds === undefined)
                 throw new Error("the retained actor token / sentinel credential is not in the secret store");
-            const adopted = await provider.validateRetainedAgent({
-                store: secrets,
-                dir: userAuthStateDir(this.workspaceRoot, this.space),
-                space: this.space,
-                owner: entry.identity.owner,
-                actor: entry.identity.actor,
-                actorToken,
-                sentinelCreds,
-            });
+            const adopted = this.remoteAuthority
+                ? await this.remoteAuthority.validateRetainedAgent({
+                    owner: entry.identity.owner,
+                    actor: entry.identity.actor,
+                    lifecycleUid: entry.identity.lifecycleUid,
+                    actorToken,
+                    sentinelCreds,
+                })
+                : await provider.validateRetainedAgent({
+                    store: secrets,
+                    dir: userAuthStateDir(this.workspaceRoot, this.space),
+                    space: this.space,
+                    owner: entry.identity.owner,
+                    actor: entry.identity.actor,
+                    actorToken,
+                    sentinelCreds,
+                });
             if (adopted.owner !== entry.identity.owner || adopted.actor !== entry.identity.actor)
                 throw new Error(`auth provider returned a replacement principal; expected ${entry.identity.owner}.${entry.identity.actor}`);
             // Bind the inventory's uid to the CURRENT authority row BEFORE any spawn: a corrupt or
@@ -4119,7 +4327,9 @@ export class Manager {
                         ...process.execArgv,
                         process.argv[1],
                         provider.agentBearerCommand,
-                        "--dir", userAuthStateDir(this.workspaceRoot, this.space),
+                        ...(this.remoteAuthority
+                            ? ["--exchange-url", this.remoteAuthority.agentBearerExchangeUrl]
+                            : ["--dir", userAuthStateDir(this.workspaceRoot, this.space)]),
                         "--space", this.space,
                         "--owner", entry.identity.owner,
                         "--actor", entry.identity.actor,
@@ -4251,6 +4461,7 @@ export class Manager {
                     // with no COTAL_LIFECYCLE_UID: static/user fail the connector auth gate and open self-mints a
                     // fresh uid that orphans the preserved durables and never matches the readiness fence.
                     lifecycleUid: entry.identity.lifecycleUid,
+                    acceptedToken: entry.identity.mode === "static" ? entry.identity.issued?.acceptedToken : undefined,
                     servers: this.servers,
                     configPath: entry.launch.source.configPath,
                     model: entry.launch.model,
@@ -4300,13 +4511,18 @@ export class Manager {
             const readinessTimeoutMs = connector.readinessTimeoutMs ?? this.readinessTimeoutMs;
             if (!Number.isSafeInteger(readinessTimeoutMs) || readinessTimeoutMs <= 0)
                 return { ok: false, error: `connector ${connector.name} declares invalid readinessTimeoutMs ${JSON.stringify(connector.readinessTimeoutMs)}; expected a positive safe integer` };
-            const handle = this.runtime.spawn(entry.name, prepared.spec, entry.launch.cwd);
+            const resumeId = entry.identity.mode === "user" ? principalKey(entry.identity.owner, entry.identity.actor).key : entry.identity.id;
+            const custody = this.reserveCustody();
+            if (custody)
+                await this.recordSlotCustody({ name: entry.name, id: resumeId, lifecycleUid: entry.identity.lifecycleUid }, custody);
+            const handle = await this.spawnCustodied(entry.name, prepared.spec, entry.launch.cwd, custody);
             const managed = {
                 name: entry.name,
                 role: entry.role,
                 agent: entry.launch.connector,
-                id: entry.identity.mode === "user" ? principalKey(entry.identity.owner, entry.identity.actor).key : entry.identity.id,
+                id: resumeId,
                 seed: adoptedSeed,
+                ...(entry.identity.mode === "static" && entry.identity.issued ? { issued: entry.identity.issued } : {}),
                 // Recover the ORIGINAL incarnation uid the durables are keyed by (never a fresh mint on resume).
                 lifecycleUid: entry.identity.lifecycleUid,
                 // Adopt the INVENTORY's recorded family (possibly a pre-split name-keyed layout) — the
@@ -4345,6 +4561,7 @@ export class Manager {
             this.agents.set(entry.name, managed);
             if (this.resumeAttemptId)
                 this.resumedAgentNames.add(entry.name);
+            await this.recordSlotRuntime(managed);
             const readiness = await this.awaitReadiness(managed, readinessTimeoutMs);
             if (!readiness.ok && !readiness.uncertain)
                 return { ok: false, error: readiness.detail };
@@ -4643,16 +4860,56 @@ export class Manager {
             await nc.drain().catch(() => nc.close());
         }
     }
-    /** Run one §13.1 ENDPOINT-SERVE credential operation (P2 item 1, 1a-serve) over an ephemeral,
+    /** Run one SPEC 13.15 issuance operation over an ephemeral `issuer` connection: the evidence
+     *  stage/release of one mint, or the retirement walk of one lifecycle's issuances. The store
+     *  handle and the accepted-row KV live only for this window; the standing supervisor holds no
+     *  grant on either bucket. */
+    async withIssuer(fn) {
+        if (!this.auth)
+            throw new Error("withIssuer: no space auth (an open mesh issues nothing)");
+        const creds = await mintCreds(this.auth, newIdentity(), "issuer");
+        const nc = await this.dial({ ...standaloneConnectOpts({ creds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
+        try {
+            const kvm = new Kvm(nc);
+            const store = openIssuedStore(await kvm.open(issuedBucket(this.space)), await jetstreamManager(nc), this.space);
+            return await fn({ store, accepted: await kvm.open(acceptedBucket(this.space)) });
+        }
+        finally {
+            await nc.drain().catch(() => nc.close());
+        }
+    }
+    /** The issuance seam of ONE static credential mint (SPEC 13.15): the evidence is bound to the
+     *  incarnation's own `cred.<uid>` ledger family, so the family's revocation (the static
+     *  terminal) retires every issuance that named it. The finalizer is the §13.1 ledger append
+     *  (slot credentialId + `cred.<uid>.<credId>` row); release runs it, then activates. */
+    issuanceSeam(i, mode, a, exp) {
+        return {
+            mode,
+            store: i.store,
+            accepted: i.accepted,
+            sources: mode === "issue" ? [{ space: this.space, bucket: epAuthBucket(this.space), key: `cred.${a.lifecycleUid}` }] : [],
+            finalize: async (credentialId) => {
+                await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: a.id, lifecycleUid: a.lifecycleUid, alias: a.name }, async (t) => {
+                    await recordSlotCredential(t, DEV_OWNER, a.name, a.lifecycleUid, credentialId);
+                    await appendStaticCredentialRow(t, { lifecycleUid: a.lifecycleUid, credentialId, holderPrincipal: principalKey(DEV_OWNER, a.id).key, exp });
+                });
+            },
+        };
+    }
+    /** Run one §13.1 endpoint-instance maintenance operation over an ephemeral,
      *  key-pinned `endpoint-serve-executor` connection: the credential's grants name exactly the
      *  manager instance's `epgate`/`epcred` keys plus its registration's two records keys, so the
-     *  gate CAS, the mint fence, and the spec/governance writes ride a one-shot scoped authority —
-     *  NEVER the manager's standing seed/supervisor connection (the panel's "no seed shortcut"). */
+     *  gate CAS, mint fence, spec/governance writes, and clean deregistration ride a one-shot scoped
+     *  authority. The remote boot goal-index sweep instead uses the authenticated host-owned scan.
+     *  This is NEVER the manager's standing seed/supervisor connection. */
     async withEndpointServeExecutor(fn) {
         const identity = this.remoteAuthority?.identities.executor ?? newIdentity();
         const creds = this.remoteAuthority?.executorCreds ?? (this.auth
             ? await mintCreds(this.auth, identity, "endpoint-serve-executor", {
                 endpointServeExecutor: { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId },
+                ...(this.endpointServeExecutorExpiresInSeconds !== undefined
+                    ? { expiresInSeconds: this.endpointServeExecutorExpiresInSeconds }
+                    : {}),
             })
             : undefined);
         if (!creds)
@@ -4671,8 +4928,8 @@ export class Manager {
      *  writes ride a bare one-shot connection (the broker enforces nothing on an open mesh; the
      *  ceremony still produces the real gate, epoch, and registration the serve rails run on). */
     async withOpenServeConnection(fn) {
-        if (this.auth)
-            throw new Error("withOpenServeConnection: an auth mesh must use the scoped endpoint-serve executor");
+        if (this.auth || this.remoteAuthority)
+            throw new Error("withOpenServeConnection: an authenticated mesh must use the scoped endpoint-serve executor");
         const nc = await this.dial({ maxReconnectAttempts: 0 });
         try {
             const kvm = new Kvm(nc);
@@ -4867,7 +5124,23 @@ export class Manager {
         // the takeover barrier revokes a deposed manager's ledger cred alongside its goal-writer. The
         // per-session serving creds join the same family, each with its own fresh identity.
         this.sessionLedgerIdentity = newIdentity();
-        const run = async ({ recordsKv, authKv, nc: execNc }) => {
+        // One registration operation for this boot. Fresh executors may replace a dead connection, but
+        // they must resume THIS freeze rather than minting a new op that discards Phase-2 progress.
+        const registrationOpId = mintLifecycleUid();
+        const executorExpired = (e) => /closed connection/i.test(e?.message ?? String(e));
+        const retryExpiredExecutor = async (label, fn) => {
+            for (;;) {
+                try {
+                    return await fn();
+                }
+                catch (e) {
+                    if (!executorExpired(e))
+                        throw e;
+                    console.error(`manager ${label} executor expired; retrying${label === "registration" ? ` operation ${registrationOpId}` : ""} with fresh scoped authority`);
+                }
+            }
+        };
+        const publishAndProvision = async ({ authKv, nc: execNc }) => {
             // §13.7 contract-artifact publication (1c): every schema root + its closure manifest, plus
             // the cluster document + ITS manifest, land in the EPC store BEFORE the registration that
             // advertises their digests — so a caller can always fetch-verify-compile a registered
@@ -4886,14 +5159,9 @@ export class Manager {
             // so the gate's principal binding is unchanged either way.
             if ((await serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: iid }).observe()) === null)
                 await provisionEndpointGateOpen(authKv, { endpoint: MANAGER_ENDPOINT, instanceId: iid, principal: servePrincipal });
-            // #783/#871: a predecessor that died mid-barrier leaves this gate frozen under a
-            // registration op. registerServiceInstance will then refuse SPEC 13.8 forever, even
-            // when the freeze-holder is gone. Complete that SAME op (abort-reopen) on independent
-            // holder-gone evidence BEFORE this incarnation freezes a new one. Auth only: the
-            // CONNZ oracle rides delivery-admin, which an open mesh does not have.
-            if (auth) {
-                await this.healFrozenRegistrationGate(authKv, iid, auth, recordsKv);
-            }
+        };
+        const completeRegistration = async ({ recordsKv, authKv, nc: execNc }) => {
+            await publishAndProvision({ recordsKv, authKv, nc: execNc });
             // P2 item 3 (slice 3a): on an AUTH mesh a RE-registration (restart of the persisted instanceId)
             // must VERIFY-EVICT the superseded serve family BEFORE the epoch advances (§13.1 "old authority
             // dies before new authority is visible"). Inject the SCOPED delivery-admin evictor; the OPEN
@@ -4902,12 +5170,18 @@ export class Manager {
             // evictor THROWS naming the cure, so PHASE 2 fails closed with the delivery-daemon fix in the
             // error text — a crash-restart never silently skips eviction (no-fallbacks).
             const barrier = endpointRegistrationBarrier(authKv, this.space, {
-                endpoint: MANAGER_ENDPOINT, instanceId: iid, opId: mintLifecycleUid(),
+                endpoint: MANAGER_ENDPOINT, instanceId: iid, opId: registrationOpId,
                 ...(auth ? { evict: makeManagerEndpointEvictor({ space: this.space, servers: this.servers ?? DEFAULT_SERVER, auth, log: (line) => console.error(line) }) } : {}),
             });
             const spec = { endpoint: MANAGER_ENDPOINT, owner: DEV_OWNER, clusterDigests: [artifacts.closureDigest], protocol: { v: 1 } };
             const { registrationRevision } = await registerServiceInstance(recordsKv, {
                 space: this.space, spec, instanceId: iid, registrant: { owner: DEV_OWNER }, authority, barrier, readClusterArtifact,
+                // #1393: when a FOREIGN instance holds the endpoint governance slot, let core tell an
+                // in-flight registration from one abandoned by a predecessor that died between its
+                // slot-take and its spec publish. The read rides THIS executor's existing auth-bucket read
+                // grant (no new grant, no new writer); core refuses on anything but a gate provably
+                // reopened past the slot's stamp.
+                observeHolderGeneration: (holderInstanceId) => readEndpointGateGeneration(authKv, { endpoint: MANAGER_ENDPOINT, instanceId: holderInstanceId }),
             });
             // processEpoch comes from the GATE (checklist 4: never derived from the uid string); the
             // fence below is also the mint's §13.1 release CAS.
@@ -4960,7 +5234,32 @@ export class Manager {
             const sessionLedgerCreds = auth ? await this.mintAndStageSessionLedger(authKv) : undefined;
             return { grant, creds, goalWriterCreds, sessionLedgerCreds };
         };
-        const { grant, creds, goalWriterCreds, sessionLedgerCreds } = await (auth ? this.withEndpointServeExecutor(run) : this.withOpenServeConnection(run));
+        let registration;
+        if (auth) {
+            // Boot heal may consume an arbitrarily large prior family. End that executor window here and
+            // mint fresh scoped authority for the new registration, rather than forcing heal + takeover
+            // through one fixed-lifetime connection. A closed connection during heal retries the SAME
+            // frozen predecessor op via reconcile's durable cursor; a closed connection during
+            // registration retries THIS boot's operationId without heal, so Phase-2 progress stays bound.
+            // #783/#871: a predecessor that died mid-barrier leaves this gate frozen under a
+            // registration op. registerServiceInstance will then refuse SPEC 13.8 forever, even
+            // when the freeze-holder is gone. Complete that SAME op (abort-reopen) on independent
+            // holder-gone evidence BEFORE this incarnation freezes a new one. Auth only: the
+            // CONNZ oracle rides delivery-admin, which an open mesh does not have.
+            await retryExpiredExecutor("boot-heal", () => this.withEndpointServeExecutor(async ({ recordsKv, authKv, nc: execNc }) => {
+                await publishAndProvision({ recordsKv, authKv, nc: execNc });
+                if (auth) {
+                    await this.healFrozenRegistrationGate(authKv, iid, auth, recordsKv);
+                }
+            }));
+            registration = await retryExpiredExecutor("registration", () => this.withEndpointServeExecutor(completeRegistration));
+        }
+        else {
+            registration = await this.withOpenServeConnection(completeRegistration);
+        }
+        if (!registration)
+            throw new Error("manager registration produced no serve authority");
+        const { grant, creds, goalWriterCreds, sessionLedgerCreds } = registration;
         this.goalWriterCreds = goalWriterCreds;
         this.sessionLedgerCreds = sessionLedgerCreds;
         // The serve connection presents the CURRENT credential on every (re)connect (the state object
@@ -5380,10 +5679,11 @@ export class Manager {
     }
     /** P2 item 2 must-5 Q-B — the boot reconcile: a fresh incarnation (a manager restart takes a NEW
      *  instanceId, so the in-memory acceptance map starts empty) inherits the endpoint's accepted-but-
-     *  unterminal goals from any predecessor. Enumerate the durable index over a scoped PROVISIONER
-     *  (records CONSUMER.CREATE; the goal-writer holds NO enumeration grant, exactly the ruling) and
-     *  settle each orphan so an accepted goal is NEVER dropped across a restart. Open mesh: a bare
-     *  connection (the broker enforces nothing). Runs ONCE at start, BEFORE spawn-as-action begins
+     *  unterminal goals from any predecessor. The local signer enumerates with an ephemeral PROVISIONER.
+     *  A remote manager calls the authenticated host-owned scan, which keeps the sealed consumer and its
+     *  lifecycle authority on the host; the instance executor, goal-writer, and supervisor hold NO records
+     *  consumer grant. Settle each orphan so an accepted goal is NEVER dropped across a restart. Open mesh:
+     *  a bare connection (the broker enforces nothing). Runs ONCE at start, BEFORE spawn-as-action begins
      *  accepting (the `goalReconcileDone` gate), so it never races a live goal's acceptance. Never
      *  fatal — a reconcile failure is logged and the gate opens either way. */
     async reconcileGoalIndex() {
@@ -5394,16 +5694,26 @@ export class Manager {
         }
         try {
             let entries = [];
-            const nc = this.auth
-                ? await this.dial({ ...standaloneConnectOpts({ creds: await mintCreds(this.auth, newIdentity(), "provisioner"), /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 })
-                : await this.dial({ maxReconnectAttempts: 0 });
-            try {
-                const kvm = new Kvm(nc);
-                await ensureAuthorityStores(await jetstreamManager(nc), kvm, this.space);
-                entries = await listGoalIndex(await kvm.open(recordsBucket(this.space)), MANAGER_ENDPOINT);
+            if (this.remoteAuthority) {
+                entries = (await this.remoteAuthority.scanGoalIndex()).map((entry) => ({
+                    ref: { endpoint: entry.endpoint, caller: { owner: entry.owner, actor: entry.actor, uid: entry.uid }, goalId: entry.goalId },
+                    iid: entry.iid,
+                    ...(entry.allocated !== undefined ? { allocated: entry.allocated } : {}),
+                    ...(entry.note !== undefined ? { note: entry.note } : {}),
+                }));
             }
-            finally {
-                await nc.drain().catch(() => nc.close());
+            else {
+                const nc = this.auth
+                    ? await this.dial({ ...standaloneConnectOpts({ creds: await mintCreds(this.auth, newIdentity(), "provisioner"), /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 })
+                    : await this.dial({ maxReconnectAttempts: 0 });
+                try {
+                    const kvm = new Kvm(nc);
+                    await ensureAuthorityStores(await jetstreamManager(nc), kvm, this.space);
+                    entries = await listGoalIndex(await kvm.open(recordsBucket(this.space)), MANAGER_ENDPOINT);
+                }
+                finally {
+                    await nc.drain().catch(() => nc.close());
+                }
             }
             // Single-manager item 2: EVERY inherited entry belongs to a DEAD predecessor (only one manager
             // at a time), so all are reconciled. The `iid` field is the hook item-3's multi-instance sweep
@@ -6241,6 +6551,97 @@ export class Manager {
             // the goal already terminalized (the readiness outcome won the settle race) - nothing to cancel.
         }
     }
+    /** Re-record the custody reference of a managed agent's CURRENT handle on its active slot: a
+     *  same-lifecycle restart or a resume binds a new custody under the old uid, and the successor's
+     *  reap must address the live one. Static auth only; a runtime without durable custody records
+     *  nothing (there is nothing to reap by reference). Loud on failure, never fatal to the bind: the
+     *  handle is already live and a stale reference is refused by identity at reap time. */
+    async recordSlotRuntime(a) {
+        if (a.handle.reference === undefined)
+            return;
+        await this.recordSlotCustody(a, a.handle.reference);
+    }
+    /** Record one custody reference on an agent's ACTIVE slot. Split from {@link recordSlotRuntime}
+     *  so a restart or a resume can record the reference it RESERVED before spawning, while no
+     *  handle exists yet. Static auth only; a runtime without durable custody reserves nothing. */
+    async recordSlotCustody(a, runtime) {
+        if (!this.auth || this.userMode)
+            return;
+        try {
+            await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: a.id, lifecycleUid: a.lifecycleUid, alias: a.name }, async (t) => {
+                const slot = await readStaticSlot(t, DEV_OWNER, a.name);
+                if (slot === undefined || slot.row.lifecycleUid !== a.lifecycleUid || slot.row.phase !== "active")
+                    return;
+                if (slot.row.runtime?.kind === runtime.kind && slot.row.runtime.id === runtime.id)
+                    return;
+                await casStaticSlot(t, { ...slot.row, runtime }, slot.revision);
+            });
+        }
+        catch (e) {
+            console.error(`! ${a.name}: could not record the custody reference ${runtime.kind}:${runtime.id} on its static slot: ${e.message} - a successor reaps this seat only by an up-to-date reference`);
+        }
+    }
+    /** Mint the custody reference for a seat this manager is about to spawn, BEFORE the processes
+     *  exist. Absent for a runtime with no durable custody (there is nothing a successor could reap
+     *  by reference), which is the only case that still spawns unreserved. */
+    reserveCustody() {
+        return isCustodialRuntime(this.runtime) ? this.runtime.reserve() : undefined;
+    }
+    /** Spawn under a reserved reference and prove the runtime honoured it. A runtime that minted its
+     *  own id instead would leave every durable record addressing a seat that does not exist, so the
+     *  mismatch tears the new seat down and throws rather than returning an unaddressable handle. */
+    async spawnCustodied(name, spec, cwd, reserved) {
+        const handle = this.runtime.spawn(name, spec, cwd, reserved);
+        if (reserved === undefined)
+            return handle;
+        const got = handle.reference;
+        if (got?.kind === reserved.kind && got.id === reserved.id)
+            return handle;
+        // A live seat now exists under a reference no durable row names, and the rollback will reap the
+        // RESERVED one, which addresses nothing. `handle.stop` cannot close this: it is fire-and-forget
+        // over the seat socket and swallows its own errors, so it proves nothing about the process. Reap
+        // the reference the runtime ACTUALLY used — that path verifies identity and proves the exit —
+        // and carry what the proof said into the throw, so a mismatch never reports a disposal it did
+        // not make.
+        let disposal;
+        if (got === undefined) {
+            try {
+                handle.stop({ graceful: false });
+            }
+            catch { /* reported below */ }
+            disposal = "the handle carries no reference, so nothing could reap it by identity and only a best-effort stop was issued";
+        }
+        else {
+            try {
+                const evidence = await requireRuntimeReap(this.runtime, got);
+                disposal = `the spawned seat was reaped (${evidence.outcome === "absent" ? "already forgotten by the runtime" : evidence.detail})`;
+            }
+            catch (e) {
+                disposal = `the spawned seat could NOT be reaped: ${e.message}`;
+            }
+        }
+        throw new Error(`runtime "${this.runtime.kind}" reserved custody ${reserved.kind}:${reserved.id} for "${name}" but spawned ` +
+            `${got ? `${got.kind}:${got.id}` : "a handle with no reference"}; the recorded reference would address no seat, so ${disposal}`);
+    }
+    /** The terminal's process step: an orphan (no live handle in THIS process) is reaped by the custody
+     *  reference the slot recorded, before its footprint goes. A successor must never retire a
+     *  lifecycle and free its alias while the predecessor's seat process is still running outside
+     *  every manager. The runtime verifies the process identity against its own record and proves the
+     *  exit; a runtime that cannot reap refuses by name and the lifecycle stays terminalizing. A row
+     *  with no recorded reference has nothing this manager can address. */
+    async reapOrphanSeat(a) {
+        if (a.runtime === undefined) {
+            // No reference reached this terminal. Under a custodying runtime that is either a row written
+            // before the reservation existed, or a caller that dropped the reference on the way here.
+            // Do not name the slot row: the row may well hold a reference this caller never read, and
+            // a diagnostic that guesses which is which sends the reader the wrong way.
+            if (isCustodialRuntime(this.runtime))
+                console.error(`static retirement ${a.name}: no custody reference reached this terminal, though runtime "${this.runtime.kind}" custodies its seats; any seat it launched is not addressable from here`);
+            return;
+        }
+        const evidence = await requireRuntimeReap(this.runtime, a.runtime);
+        console.error(`static retirement ${a.name}: orphan seat process ${evidence.outcome === "absent" ? `already forgotten by runtime "${a.runtime.kind}" (${a.runtime.id})` : evidence.detail}`);
+    }
     /** The static F1 terminal for one departed incarnation (Unit B): delegates the gate/head CAS
      *  sequence to the shared core saga over the executor transport; the footprint teardown (creds
      *  file + broker durables/ACL) runs INSIDE the barrier as its cleanup step. On completion the
@@ -6263,6 +6664,13 @@ export class Manager {
             log: (line) => console.error(`static retirement ${a.name}: ${line}`),
         });
         const cleanup = async () => {
+            // SPEC 13.15: every issuance bound to this incarnation's ledger family is retired here,
+            // inside the barrier and after the ledger rows were revoked (the source is frozen first,
+            // then the index is walked). A retirement that lost is surfaced, never skipped: an active
+            // attempt row on a retired lifecycle would authorize a run the credential no longer can.
+            const retired = await this.withIssuer((i) => i.store.retireSource({ space: this.space, bucket: epAuthBucket(this.space), key: `cred.${a.lifecycleUid}` }));
+            if (retired > 0)
+                console.error(`static retirement ${a.name}: retired ${retired} issuance(s) bound to uid ${a.lifecycleUid}`);
             const secrets = this.secrets;
             const files = a.secretPaths ?? agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, a.name, a.lifecycleUid);
             if (files.creds) {
@@ -6271,19 +6679,24 @@ export class Manager {
             }
             await this.deprovisionBroker(a);
         };
+        // The process goes before its footprint: reap the orphan seat by reference, then tear down.
+        const reapThenCleanup = async () => {
+            await this.reapOrphanSeat(a);
+            await cleanup();
+        };
         try {
             await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: a.id, lifecycleUid: a.lifecycleUid, alias: a.name }, async (t) => {
                 const slot = await readStaticSlot(t, DEV_OWNER, a.name);
                 if (slot === undefined || slot.row.lifecycleUid !== a.lifecycleUid) {
                     // No durable registration for THIS incarnation: a pre-Unit-B spawn (or a slot already
                     // replaced by a successor — then this stale teardown must not touch the registry at all).
-                    await cleanup();
+                    await reapThenCleanup();
                     return;
                 }
                 await runStaticTerminal(t, {
                     owner: DEV_OWNER, alias: a.name, actor: a.id, lifecycleUid: a.lifecycleUid, opId,
                     managerInstance: this.managerInstanceId, managerProcessUid: this.managerLifecycleUid,
-                }, { cleanup, evict, log: (line) => console.error(`static retirement ${a.name}: ${line}`) });
+                }, { cleanup: reapThenCleanup, evict, log: (line) => console.error(`static retirement ${a.name}: ${line}`) });
             });
             this.retiredPrincipals.add(principalKey(DEV_OWNER, a.id).key);
             const cur = this.retiring.get(a.name);
@@ -6327,19 +6740,22 @@ export class Manager {
         // The SAME permission scope the spawn minted (recorded on the managed row): allowSubscribe/
         // allowPublish/role/capabilities are the JWT-shaping inputs; `subscribe` (the active read
         // set) shapes durable membership only and is not a mint input.
-        const creds = await mintCreds(this.auth, { id: a.id, seed: a.seed }, "agent", {
+        if (!a.issued)
+            throw new Error(`renewManagedStaticCred: ${a.name} carries no issuance; a static credential minted before SPEC 13.15 is not renewed under an unbound generation - respawn the agent`);
+        // A RENEWAL keeps the generation (SPEC 13.15): the same JWT-shaping inputs produce the same
+        // ceiling, which `confirm` verifies against the recorded evidence before the ledger append. A
+        // changed ceiling is refused there: that is a fresh issuance on a new connection, never a renewal.
+        const issued = a.issued;
+        const creds = await this.withIssuer((i) => mintCreds(this.auth, { id: a.id, seed: a.seed }, "agent", {
             allowSubscribe: a.launch.allowSubscribe,
             allowPublish: a.launch.allowPublish,
             role: a.role,
             capabilities: a.launch.capabilities,
             lifecycleUid: a.lifecycleUid,
             expiresAt: exp,
-        });
-        const credentialId = rawDigest(creds).replace("sha256:", "sha256-");
-        await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: a.id, lifecycleUid: a.lifecycleUid, alias: a.name }, async (t) => {
-            await recordSlotCredential(t, DEV_OWNER, a.name, a.lifecycleUid, credentialId);
-            await appendStaticCredentialRow(t, { lifecycleUid: a.lifecycleUid, credentialId, holderPrincipal: principalKey(DEV_OWNER, a.id).key, exp });
-        });
+            issued,
+            issuance: this.issuanceSeam(i, "renew", a, exp),
+        }));
         const secrets = this.secrets;
         const credsPath = a.secretPaths.creds;
         await secrets.put(agentSecretKeyForFile(credsPath, this.space), creds);
@@ -6505,7 +6921,7 @@ export class Manager {
             this.reconcilingAliases.add(row.alias);
             console.error(`static reconcile terminal alias=${row.alias} phase=${row.phase} uid=${row.lifecycleUid} attempt=${item.attempts}/${item.maxAttempts}`);
             try {
-                await this.driveStaticRetirement({ id: row.actor, name: row.alias, lifecycleUid: row.lifecycleUid }, true);
+                await this.driveStaticRetirement({ id: row.actor, name: row.alias, lifecycleUid: row.lifecycleUid, runtime: row.runtime }, true);
                 if (item.attempts === 1) {
                     this.staticReconcileItems.delete(key);
                 }
@@ -6799,12 +7215,14 @@ export class Manager {
     /** Persist a peer-defined persona as config. After this, `start name` auto-discovers
      *  .cotal/agents/<name>.md and the connector applies its persona/model at spawn.
      *
-     *  CONTENT vs POLICY (P6): the write path accepts ONLY content from args — {name, model,
-     *  persona}. role/publish/capabilities/owner are POLICY and have no slot here, so a peer can
-     *  never grant itself a capability or claim ownership by redefining. A fresh name is created with
-     *  owner = caller (the creator). Redefining an EXISTING file overwrites ONLY model + persona and
-     *  preserves everything else — and is allowed on the privileged tier only if `file.owner == caller`,
-     *  else admin is required. Fail-closed: an ownerless file (legacy / operator-written) is admin-only. */
+     *  CONTENT vs POLICY (P6): `capabilities` and `owner` still have no slot, so a peer cannot
+     *  self-grant spawn or claim ownership. Channel grants, role, and agent are content: they may
+     *  arrive as explicit arguments or as a leading frontmatter block inside `persona`. A prompt
+     *  that starts with `---` is parsed and merged (explicit args win) so the written file has one
+     *  frontmatter block; a malformed block is refused by name rather than wrapped. A fresh name is
+     *  created with owner = caller. Redefining an EXISTING file is allowed on the privileged tier
+     *  only if `file.owner == caller`, else admin is required. Fail-closed: an ownerless file
+     *  (legacy / operator-written) is admin-only. */
     opDefinePersona(args, caller, admin) {
         const name = String(args.name ?? "").trim();
         if (!name)
@@ -6815,55 +7233,42 @@ export class Manager {
         const persona = String(args.persona ?? "").trim();
         if (!persona)
             return { ok: false, error: "persona required" };
-        const model = args.model ? String(args.model) : undefined;
+        const model = args.model !== undefined && args.model !== null && String(args.model) !== "" ? String(args.model) : undefined;
         const path = agentFilePath(this.workspaceRoot, name);
-        let def;
+        let existing;
         if (existsSync(path)) {
-            // Redefine: load, authorize by ownership, then overwrite ONLY content; preserve all policy.
             try {
-                def = loadAgentFile(path);
+                existing = loadAgentFile(path);
             }
             catch (e) {
                 return { ok: false, error: e.message };
             }
-            if (!admin && def.owner !== caller) {
-                const owner = def.owner ? `owned by ${def.owner}` : "operator-owned (legacy file - no agent owner)";
+            if (!admin && existing.owner !== caller) {
+                const owner = existing.owner ? `owned by ${existing.owner}` : "operator-owned (legacy file - no agent owner)";
                 return { ok: false, error: `not authorized to redefine ${name}: ${owner}; only its owner or an operator can` };
             }
-            // PATCH content: overwrite model only when provided, so a persona-only redefine can't wipe an existing model.
-            if (model !== undefined)
-                def.model = model;
-            def.persona = persona;
-            // A redefine cannot change scope, so a file that still has no channels keeps its marker. But
-            // if an operator has since given it a real read set, the marker is a stale claim about a state
-            // that no longer holds, and a marker that outlives its condition is worse than none: it tells
-            // a census the scope was never chosen when someone chose it.
-            //
-            // The condition is the READ SET specifically, not any channel field. `allowSubscribe` alone is
-            // a ceiling on what the agent may read, not the set it reads, so a persona given only that
-            // still reads nothing and the marker still describes it correctly.
-            if (def.meta?.scope_source === "wire-default" && def.subscribe?.length) {
-                const { scope_source: _dropped, ...rest } = def.meta;
-                def.meta = Object.keys(rest).length ? rest : undefined;
-            }
         }
-        else {
-            // Fresh name: create with content + owner = caller. The privileged tier suffices (creating a
-            // brand-new persona isn't admin-only); the creator becomes its owner.
-            //
-            // The read set is EMPTY, and that is a policy decision made here rather than a field left
-            // blank. A peer cannot name its own channels through this path by design (see CONTENT vs
-            // POLICY above): letting it would make defining a persona a way to grant reads. So the only
-            // safe scope for a peer-created persona is none, and an operator widens it afterwards. It is
-            // written explicitly so the file states it, instead of being an omission a later default
-            // could reinterpret.
-            //
-            // `scope_source` records WHY it is empty. Everywhere else an empty read set means the author
-            // chose none; here the author was never offered the choice, and the two are indistinguishable
-            // in the file without this. A reader counting deliberate empties would otherwise credit this
-            // path with an intent nobody expressed. An operator setting a real read set should drop the
-            // marker, and `cotal personas edit` re-validates on save.
-            def = { name, model, persona, owner: caller, subscribe: [], meta: { scope_source: "wire-default" } };
+        const strList = (v) => {
+            if (v === undefined || v === null)
+                return undefined;
+            return (Array.isArray(v) ? v : [v]).map((x) => String(x));
+        };
+        let def;
+        try {
+            def = composeWirePersona({
+                name,
+                owner: caller,
+                prompt: persona,
+                model,
+                role: args.role !== undefined && args.role !== null && String(args.role) !== "" ? String(args.role) : undefined,
+                agent: args.agent !== undefined && args.agent !== null && String(args.agent) !== "" ? String(args.agent) : undefined,
+                subscribe: strList(args.subscribe),
+                allowSubscribe: strList(args.allowSubscribe),
+                allowPublish: strList(args.allowPublish),
+            }, existing);
+        }
+        catch (e) {
+            return { ok: false, error: e.message };
         }
         try {
             saveAgentFile(path, def);
@@ -6968,7 +7373,7 @@ export class Manager {
      *
      *  `enter` defaults to true: a harness command typed but not submitted has not been delivered.
      *  Nothing is echoed back; the caller reads the resulting turns from the event plane. */
-    inputAuthorized(a, args) {
+    async inputAuthorized(a, args) {
         if (this.agents.get(a.name) !== a)
             throw new EpEnvelopeError("failed-precondition", `agent "${a.name}" was replaced during authorization - retry`);
         if (a.handle.status() !== "running")
@@ -6980,8 +7385,17 @@ export class Manager {
         // the only decision left is the carriage return. `!== false` and not `?? true`: an ABSENT enter
         // and an explicit `true` must behave identically, and only `false` may suppress the return.
         const data = `${String(args.text)}${args.enter !== false ? "\r" : ""}`;
-        write(data);
-        return { name: a.name, bytes: Buffer.byteLength(data, "utf8") };
+        const intendedBytes = Buffer.byteLength(data, "utf8");
+        let bytes;
+        try {
+            bytes = await write(data);
+        }
+        catch (error) {
+            throw new EpEnvelopeError("unavailable", `input for seat "${a.name}" failed: ${error.message}`);
+        }
+        if (!Number.isSafeInteger(bytes) || bytes !== intendedBytes)
+            throw new EpEnvelopeError("unavailable", `input for seat "${a.name}" failed: runtime accepted ${String(bytes)} of ${intendedBytes} bytes`);
+        return { name: a.name, bytes };
     }
     /** The post-authorization attach effect (P2 item 6): mint the holder-bound §13.6 offer, redeem it
      *  through the ONE session plane (one-use CAS + presenter-equality), and stand up the PTY bridge —
@@ -7075,6 +7489,14 @@ export class Manager {
      *  owner-domain bound); undefined = unbounded. {@link NO_OWNER_MATCHES} matches nothing. */
     list(ownerFilter) {
         const roster = new Map(this.ep.getRoster().map((p) => [p.card.name, p]));
+        // The roster is only evidence while THIS observer's presence watch is fresh. A stale view
+        // (whole-bucket silence past TTL) or an unpopulated one (snapshot not yet replayed) cannot
+        // support "offline" or "absent" for anyone: netcup 2026-09-09 rendered every live seat as
+        // one of those for hours after the presence stream was recreated under a still-open watch.
+        // Carry the view state on the row so the renderer can say "unknown" instead of a verdict.
+        // An endpoint that reports no view (test doubles built on `getRoster` alone) is read as
+        // `current`: that is exactly what every row meant before the field existed.
+        const view = typeof this.ep.presenceView === "function" ? this.ep.presenceView() : { state: "current" };
         return [...this.agents.values()].filter((a) => ownerFilter === undefined || a.userOwner === ownerFilter).map((a) => {
             // USER MODE: a detached agent's bearer-refresh death is silent everywhere except here — its
             // bearer command writes each attempt's outcome to the health file, and `ps` renders it
@@ -7096,6 +7518,9 @@ export class Manager {
                 status: a.handle.status(),
                 uptimeMs: Date.now() - a.startedAt,
                 mesh: roster.get(a.name)?.status ?? "absent",
+                // `current` is the only state in which `mesh` is a verdict; the other two are the
+                // observer's own condition and travel on the row (older CLIs ignore the field).
+                meshView: view.state,
                 // The incarnation coordinate (SPEC 13.1) — with `id`, exactly what a v0.4 caller needs to
                 // build a targeted (`despawn`/`attach`) request against THIS incarnation.
                 lifecycleUid: a.lifecycleUid,