@cotal-ai/manager 0.54.0 → 0.56.0

package/dist/manager.js

@@ -4,7 +4,7 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, eventChannelPrincipal, } from "@cotal-ai/core";
+import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, eventChannelPrincipal, } from "@cotal-ai/core";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
@@ -109,7 +109,7 @@ const STARTUP_RECONCILING = "startup static lifecycle reconciliation";
  *  broker/eviction blip; the wider later spacing avoids hammering a persistently unavailable
  *  authority. The finite ~36s window is intentionally not a liveness inference: exhausting it
  *  leaves the durable alias held and requires a later manager start. */
-const STATIC_RECONCILE_RETRY_DELAYS_MS = [1_000, 5_000, 30_000];
+export const STATIC_RECONCILE_RETRY_DELAYS_MS = [1_000, 5_000, 30_000];
 const STATIC_RECONCILE_MAX_ATTEMPTS = STATIC_RECONCILE_RETRY_DELAYS_MS.length + 1;
 /** The STABLE retirement opId for one lifecycle (#29 piece 3): deterministic from the uid, so a
  *  despawn retry, a same-name-spawn nudge, and the auth service's boot resume all drive the SAME
@@ -505,8 +505,20 @@ export class Manager {
     /** A renew is in flight. The tick must not start a second one: both would read the same cached
      *  revision, so whichever lands second CASes against a sequence the first already moved. */
     leaseRenewInFlight = false;
+    /** The promise a currently in-flight `renewLease()` is running, so `stop()` can await it before
+     *  releasing the key instead of racing it: a renew that lands after the cached revision was read
+     *  for release would otherwise move the row out from under a same-cached-revision CAS delete. */
+    leaseRenewTask;
+    /** Set at the top of `stop()`. `renewLease` returns at once once this is set, and its `gone` arm
+     *  does not re-acquire: a manager that is stopping never puts its own key back. */
+    leaseStopping = false;
     /** The class-2 renewal owner's half-TTL schedule (D5 slice 5); armed only on auth meshes. */
     credRenewTimer;
+    /** #2073: the `endpoint-serve` credential's OWN renewal, armed from its `[renewAt, exp)` window
+     *  (`credsRenewalDelayMs`) rather than left to `credRenewTimer`'s boot-phased TTL/4 tick, which can
+     *  miss the window by ordering. Re-armed at registration and after every successful re-mint;
+     *  cleared in `stop()` beside `credRenewTimer`. */
+    endpointServeRenewalTimer;
     /** #1634: does THIS manager own the delivery daemon's credential renewal? True only while the
      *  daemon reloads from this manager's store AND this manager holds the per-space renewal lease.
      *  Starts false: a manager that has not proved both must not remint. */
@@ -632,17 +644,42 @@ export class Manager {
      * write it to. The operator reading the refusal is on the manager's mesh, never on the record's. A
      * boolean parameter is how that happened, so the mode is read from `this` and a third door cannot
      * pass the wrong one.
+     *
+     * The selector below reads the three-valued mesh mode (`open | static | user`), not a boolean
+     * derived from it (#567). `this.userMode` is `false` for BOTH static and open, so a boolean
+     * selector collapses those two and an open mesh was handed the static route (`cotal mint
+     * --provision`), which `mint` refuses outright on an open mesh. A boolean also has no third
+     * state to invert, so a mutation grid over `return this.userMode ? … : …` proves the one arm it
+     * has is load-bearing but is structurally blind to a missing arm: there is no mutant that turns
+     * "two arms" into "three arms". Switching on `meshMode` gives a fourth mesh mode nowhere to fall
+     * silently, since `switch` has no default arm to catch it.
      */
+    get meshMode() {
+        if (this.userMode)
+            return "user";
+        if (this.auth !== undefined)
+            return "static";
+        return "open";
+    }
     readerRemedy(owner, channel) {
-        return this.userMode
-            ? `\`cotal actor grant <reader> --owner ${owner} --scope '' --allow-subscribe '${channel}' ` +
-                `--allow-publish ''\`, with every field spelled out: \`actor grant\` is an upsert of the ` +
-                `WHOLE row and an omitted flag means the WIDE default (\`>\` read, \`>\` post, \`spawn,role:default\` ` +
-                `scope), not "leave it alone".`
-            : `\`cotal mint <reader> --profile agent --allow-subscribe ${channel} --provision\`, where there ` +
-                `is no actor ledger for \`actor grant\` to write to. The AGENT profile, not the observer ` +
-                `one: \`mint\` reads --allow-subscribe only for that profile, so an observer mint is ` +
-                `refused outright and writes no creds file.`;
+        switch (this.meshMode) {
+            case "user":
+                return (`\`cotal actor grant <reader> --owner ${owner} --scope '' --allow-subscribe '${channel}' ` +
+                    `--allow-publish ''\`, with every field spelled out: \`actor grant\` is an upsert of the ` +
+                    `WHOLE row and an omitted flag means the WIDE default (\`>\` read, \`>\` post, \`spawn,role:default\` ` +
+                    `scope), not "leave it alone".`);
+            case "static":
+                return (`\`cotal mint <reader> --profile agent --allow-subscribe ${channel} --provision\`, where there ` +
+                    `is no actor ledger for \`actor grant\` to write to. The AGENT profile, not the observer ` +
+                    `one: \`mint\` reads --allow-subscribe only for that profile, so an observer mint is ` +
+                    `refused outright and writes no creds file.`);
+            case "open":
+                return (`there is nothing to grant on an open mesh: it has no credentials and no ACLs, so any peer ` +
+                    `may read \`${channel}\` by connecting bare and listing that channel (\`cotal join\` or an ` +
+                    `endpoint whose channels include it); this refusal stands because the own-channel rule ` +
+                    `applies to every mesh, and a spawn is not the place to hand out a read on another agent's ` +
+                    `tool inputs and outputs.`);
+        }
     }
     start() {
         if (this.startTask)
@@ -1048,6 +1085,50 @@ export class Manager {
         }
         await this.keepDaemonRenewalLease();
     }
+    /** #2073: arm the `endpoint-serve` credential's own renewal from its `[renewAt, exp)` window
+     *  instead of `credRenewTimer`'s boot-phased TTL/4 tick, which can miss that window depending on
+     *  when the timer happened to start relative to the credential's `iat`. Called after the initial
+     *  mint (`registerManagerService`) and after every successful re-mint in the serve branch below,
+     *  so the schedule always tracks the CURRENT credential. `credsRenewalDelayMs` is the same 75%
+     *  convention the endpoint's delivery renewal and the membership feed use (`@cotal-ai/core`); no
+     *  second copy of that arithmetic lives here. */
+    scheduleServeRenewal(creds) {
+        if (this.endpointServeRenewalTimer)
+            clearTimeout(this.endpointServeRenewalTimer);
+        const delay = Math.max(1_000, credsRenewalDelayMs(creds));
+        const renewAt = new Date(Date.now() + delay).toISOString();
+        this.endpointServeRenewalTimer = setTimeout(() => { void this.renewDaemonCreds(); }, delay);
+        this.endpointServeRenewalTimer.unref?.();
+        console.error(`manager endpoint-serve renewal scheduled at ${renewAt}`);
+    }
+    /** #2073: push a freshly re-minted credential onto its LIVE connection instead of waiting for a
+     *  reconnect the expiry itself would force two dials too late. `nc.reconnect()` re-evaluates the
+     *  authenticator, which reads the mutable `creds` holder on every attempt, so the new CONNECT
+     *  presents the fresh credential without re-registration. In-flight requests on the connection
+     *  fail once, on the reconnect. Best-effort, matching `CotalEndpoint.swapConnectionOntoFreshCreds`:
+     *  a connection that is already closed (e.g. mid re-dial after a fault) cannot reconnect, and that
+     *  failure is not this call's to report. */
+    async pushRenewedCreds(nc) {
+        await nc.reconnect().catch(() => { });
+    }
+    /** #2073: the shared bounded-retry shape for a closed standing connection: wait out each of
+     *  {@link STATIC_RECONCILE_RETRY_DELAYS_MS}, trying `attempt` after each. A stop landing while
+     *  this loop waits is not a fault this loop reports (the caller re-checks `leaseStopping`). */
+    async boundedReconnect(label, attempt) {
+        for (const delayMs of STATIC_RECONCILE_RETRY_DELAYS_MS) {
+            await new Promise((r) => setTimeout(r, delayMs));
+            if (this.leaseStopping)
+                return true;
+            try {
+                if (await attempt())
+                    return true;
+            }
+            catch (e) {
+                console.error(`! manager ${label} re-dial attempt failed: ${e.message}`);
+            }
+        }
+        return false;
+    }
     /** One class-2 renewal pass (D5 slice 5): re-sign `.cotal/delivery.creds` + `.cotal/membership-rw.creds`
      *  for their existing nkeys, then request the delivery daemon's EXPLICIT `reloadCreds` adoption on the
      *  delivery-admin rail and persist the audit record (`.cotal/renewal.<spaceKey>.json`) that `cotal doctor auth`
@@ -1158,6 +1239,12 @@ export class Manager {
                             serveIssuance: serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId }),
                             endpointServe: s.grant,
                         }));
+                        // #2073: a superseded instance's re-mint fails the gate CAS above and lands in the
+                        // catch below, not here — this re-mint already re-checks the issuance gate through
+                        // the SAME executor a fresh registration would use, so there is no second epoch read
+                        // to add before re-binding after a re-dial.
+                        await this.pushRenewedCreds(s.nc);
+                        this.scheduleServeRenewal(s.creds);
                     }
                 }
                 catch (e) {
@@ -1176,6 +1263,7 @@ export class Manager {
                         const fresh = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageGoalWriter(authKv));
                         this.goalWriterCreds = fresh;
                         gw.creds = fresh;
+                        await this.pushRenewedCreds(gw.nc);
                     }
                 }
                 catch (e) {
@@ -1197,6 +1285,7 @@ export class Manager {
                         const fresh = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageSessionLedger(authKv));
                         this.sessionLedgerCreds = fresh;
                         sw.creds = fresh;
+                        await this.pushRenewedCreds(sw.nc);
                     }
                 }
                 catch (e) {
@@ -1717,6 +1806,7 @@ export class Manager {
             throw new Error(`manager preservation shutdown incomplete: ${failures.join("; ")}`);
     }
     async stop(options = {}) {
+        this.leaseStopping = true;
         this.staticReconcileStopping = true;
         const starting = this.startTask;
         for (const item of this.staticReconcileItems.values()) {
@@ -1731,10 +1821,16 @@ export class Manager {
             clearInterval(this.leaseTimer);
         if (this.credRenewTimer)
             clearInterval(this.credRenewTimer);
+        if (this.endpointServeRenewalTimer)
+            clearTimeout(this.endpointServeRenewalTimer);
         if (this.daemonRenewalLeaseTimer)
             clearInterval(this.daemonRenewalLeaseTimer);
         if (this.sessionKeyRenewTimer)
             clearInterval(this.sessionKeyRenewTimer);
+        // A renew already in flight when the timer was cleared above must be awaited, not raced: it can
+        // still move the key's revision after we clear the timer, and releasing against a cached
+        // revision it has since moved is a CAS the broker correctly refuses, silently, forever.
+        await this.leaseRenewTask?.catch(() => { });
         let releaseFailures = [];
         if (this.maintenanceState === "active" && !this.resumeRequired) {
             if (options.withAgents)
@@ -1746,7 +1842,7 @@ export class Manager {
             // A signal after a partial preservation must never fall back into destructive teardown.
             await this.stopRetainedAgentsOnExit();
         }
-        await this.ep.releaseManagerLease(this.managerInstanceId, this.leaseRevision);
+        await this.releaseOwnManagerLease();
         // #1634: hand the renewal lease back on a clean stop so a sibling picks it up on its next pass
         // rather than waiting out the bucket TTL. A non-owner holds no revision and this is a no-op.
         await this.ep.releaseDaemonRenewalLease();
@@ -1769,6 +1865,30 @@ export class Manager {
         if (releaseFailures.length)
             throw new Error(`manager shutdown could not release every detachable seat: ${releaseFailures.join("; ")}`);
     }
+    /** Release this instance's liveness lease key on a clean stop, at the broker's own revision
+     *  rather than a cached one that a renew still in flight moments ago may have already moved past.
+     *  Re-reads the row and releases only what is PROVABLY this process's (absent, or another pid's,
+     *  is left alone — the same test {@link reconcileLease} uses). Nothing here throws: a stop must
+     *  complete either way, and a row that could not be released is left for the bucket TTL, with one
+     *  line of warning so the cost (a same-root restart waiting out the TTL) is not silent. */
+    async releaseOwnManagerLease() {
+        try {
+            const own = await this.ep.readOwnManagerLease(this.managerInstanceId);
+            if (own !== undefined && own.info.pid === process.pid)
+                await this.ep.releaseManagerLease(this.managerInstanceId, own.revision);
+        }
+        catch {
+            // Best-effort, like the release it wraps: a broker failure here is recovered by the bucket TTL.
+        }
+        try {
+            const stillOurs = await this.ep.readOwnManagerLease(this.managerInstanceId);
+            if (stillOurs !== undefined && stillOurs.info.pid === process.pid)
+                console.error(`! manager instance ${this.managerInstanceId} could not release its liveness lease (space "${this.space}"); a same-root restart inside the bucket TTL will be refused`);
+        }
+        catch {
+            // Could not confirm either way; the warning is best-effort, not a verdict.
+        }
+    }
     /**
      * REMOVE THIS INSTANCE'S SERVICE REGISTRATION on a clean stop (§13.5 deregistration).
      *
@@ -1860,12 +1980,25 @@ export class Manager {
      *  on a live mesh turned a ten-second broker or KV outage into a manager outage that lasted until an
      *  operator noticed. */
     async renewLease() {
+        // A manager that is stopping never puts its own key back: a stop already fenced this loop, and
+        // any tick or explicit call landing after that must be a no-op, not a fresh acquire attempt.
+        if (this.leaseStopping)
+            return;
         // A renew that runs long must not be overlapped by the next tick: both would CAS against the same
         // cached revision, so whichever lands second is refused over a sequence the first legitimately
         // moved, a conflict this instance manufactured itself.
         if (this.leaseRenewInFlight)
             return;
         this.leaseRenewInFlight = true;
+        const task = this.renewLeaseAttempt();
+        this.leaseRenewTask = task;
+        return task;
+    }
+    /** The renew attempt itself, split out from {@link renewLease} only so `stop()` can hold the
+     *  promise a renew already in flight is running ({@link leaseRenewTask}) and await it before
+     *  releasing the key: releasing against a cached revision a live renew has since moved is a CAS
+     *  the broker correctly refuses, silently, forever. */
+    async renewLeaseAttempt() {
         try {
             if (!this.leaseInfo || this.leaseRevision === undefined)
                 return;
@@ -1885,6 +2018,11 @@ export class Manager {
                         this.noteLease("held-unrenewed", `could not renew its liveness lease (${why}) but the key is still its own at revision ${verdict.revision}; serving, retrying`);
                         return;
                     case "gone": {
+                        // A stop that began while this renew was already in flight fences it here too: the
+                        // await above can cross the point where `stop()` set the flag, and a re-acquire past
+                        // that point would put a stopping process's key straight back.
+                        if (this.leaseStopping)
+                            return;
                         // The key being gone is a fact before the re-acquire is attempted, so a successful
                         // re-acquire is a change of state (gone to held) and prints, every time it happens.
                         const before = this.leaseState;
@@ -2328,7 +2466,12 @@ export class Manager {
             resolveCwd: (ctx) => this.serveGated(ctx, () => this.resolveSpawnCwd(args(ctx).cwd)),
             // P2 item 2: `spawn` is an ACTION - accept a goal + reply the acceptance floor payload, drive
             // progress + terminal off-handler (no ~30s block). The blocking reply path is gone (pin 8).
-            spawn: (ctx) => this.serveGated(ctx, () => this.serveSpawnGoal(ctx, (h) => this.opStart(args(ctx), callerOf(ctx), h, ctx.subject.route))),
+            // #373: arming the event plane (events: true, or the omission that arms it by default)
+            // is operator reach on a user mesh — the spawn handler resolves the caller's admin tier
+            // ONCE here (opLaunch takes the same signal as a parameter) and opStart's admission gate
+            // decides on it BEFORE connector resolution or any grant mutation. Static meshes resolve
+            // true and nothing changes.
+            spawn: (ctx) => this.serveGated(ctx, async () => this.serveSpawnGoal(ctx, async (h) => this.opStart(args(ctx), callerOf(ctx), await this.epAdminReach(ctx.subject.caller), h, ctx.subject.route))),
             despawn: (ctx) => this.serveGated(ctx, async () => {
                 const a = targetAgent(ctx);
                 const denied = await this.authorizeNamed(a, callerOf(ctx), await this.epAnyModeAdmin(ctx), ctx.subject.caller);
@@ -2635,6 +2778,8 @@ export class Manager {
      *  dead auth plane. Every failure is returned as the refusal sentence, with the grant + files
      *  rolled back. */
     async provisionUserAgent(name, opts) {
+        if (this.remoteAuthority?.enrollManagedAgent)
+            return this.enrollUserAgent(name, opts, this.remoteAuthority.enrollManagedAgent);
         const spawnerPr = opts.spawner ? parsePrincipalKey(opts.spawner) : null;
         const owner = opts.specOwner ?? (spawnerPr && spawnerPr.owner.startsWith("u_") ? spawnerPr.owner : undefined);
         if (!owner)
@@ -2713,7 +2858,7 @@ export class Manager {
                 "--health-file", healthPath,
             ];
             await execBearerPreflight(bearerCmd);
-            return { owner, files, launch: { owner, actor: name, sentinelCredsPath: sentinelPath, bearerCmd } };
+            return { owner, lifecycleUid: opts.lifecycleUid, files, launch: { owner, actor: name, sentinelCredsPath: sentinelPath, bearerCmd } };
         }
         catch (e) {
             // Roll back everything this attempt materialized — a refused spawn must leave no standing
@@ -2730,6 +2875,111 @@ export class Manager {
             return { error: `agent auth preflight failed for "${name}": ${e.message}` };
         }
     }
+    /**
+     * HOSTED user-mode spawn provisioning (#1972): the participant arm of host-owned enrollment.
+     *
+     * A registered participant holds no ledger writer, no JetStream provisioner, and no signing seed,
+     * so every step the local arm above performs itself is the HOST's here. What stays local is the
+     * one thing that must: the standing `actorToken`. This method generates it, writes it at 0600
+     * BEFORE the request, and sends only its SHA-256 digest — so the plaintext never crosses the
+     * network and a host compromise cannot replay an agent's exchange secret.
+     *
+     * The HOST picks the lifecycle UID. It alone can see the retirement tombstones that make a UID
+     * permanently unusable (a retired uid is refused forever by the retirement frontier), so a
+     * participant-chosen uid could aim a fresh grant at a dead incarnation. The uid the host returns
+     * is the one the spawn records and the one the child's durables are keyed by.
+     *
+     * The bearer argv selects `--exchange-url`: the local `--dir` arm reads a state directory this
+     * machine does not have, and a signerless participant must never appear to hold one.
+     */
+    async enrollUserAgent(name, opts, enroll) {
+        let provider;
+        try {
+            provider = resolveAuthProvider();
+        }
+        catch (e) {
+            return { error: e.message };
+        }
+        const secrets = this.secrets;
+        // The token the agent will present to `POST /exchange` for the rest of its life. Generated
+        // here, hashed here, and never sent: the request carries `tokenHash` alone.
+        const actorToken = randomBytes(32).toString("base64url");
+        const tokenHash = createHash("sha256").update(actorToken, "utf8").digest("hex");
+        // Provisional paths under the participant's OWN uid: the token has to be on disk before the
+        // request (a host that granted against a digest whose plaintext was lost would leave an agent
+        // that can never exchange), and the host's uid is not known until the request answers. The
+        // family is re-keyed to the host's uid below.
+        const staged = agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, name, opts.lifecycleUid);
+        let files = staged;
+        let material;
+        try {
+            await secrets.put(agentSecretKeyForFile(staged.actorToken, this.space), actorToken);
+            await materializeSecretToFile(secrets, agentSecretKeyForFile(staged.actorToken, this.space), staged.actorToken);
+            material = await enroll({
+                target: {
+                    actor: name,
+                    tokenHash,
+                    ...(opts.role !== undefined ? { role: opts.role } : {}),
+                    label: opts.label,
+                    ...(opts.capabilities !== undefined ? { capabilities: opts.capabilities } : {}),
+                    ...(opts.subscribe !== undefined ? { subscribe: opts.subscribe } : {}),
+                    allowSubscribe: opts.allowSubscribe,
+                    ...(opts.allowPublish !== undefined ? { allowPublish: opts.allowPublish } : {}),
+                },
+            });
+            if (material.actor !== name)
+                throw new Error(`the host enrolled actor "${material.actor}", not the requested "${name}"`);
+            const specOwner = opts.specOwner ?? (opts.spawner ? parsePrincipalKey(opts.spawner)?.owner : undefined);
+            if (specOwner !== undefined && specOwner.startsWith("u_") && material.owner !== specOwner)
+                throw new Error(`the host enrolled the agent under owner ${material.owner}, not the spawning owner ${specOwner}`);
+            assertLifecycleToken(material.lifecycleUid, "host-enrolled managed agent lifecycleUid");
+            // Re-key the family onto the HOST's uid (SPEC 13.1 name-disjointness on the FS): the child's
+            // credential paths must embed the uid its broker footprint carries, never the provisional one.
+            files = agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, name, material.lifecycleUid);
+            if (files.actorToken !== staged.actorToken) {
+                await secrets.put(agentSecretKeyForFile(files.actorToken, this.space), actorToken);
+                await materializeSecretToFile(secrets, agentSecretKeyForFile(files.actorToken, this.space), files.actorToken);
+                await secrets.delete(agentSecretKeyForFile(staged.actorToken, this.space)).catch(() => { });
+                rmSync(staged.actorToken, { force: true });
+            }
+            await secrets.put(agentSecretKeyForFile(files.sentinelCreds, this.space), material.sentinelCreds);
+            await materializeSecretToFile(secrets, agentSecretKeyForFile(files.sentinelCreds, this.space), files.sentinelCreds);
+            rmSync(files.health, { force: true }); // a fresh start opens a fresh health window
+            const bearerCmd = [
+                process.execPath,
+                ...process.execArgv,
+                process.argv[1],
+                provider.agentBearerCommand,
+                // The signerless arm: the pinned public exchange, never a local state dir.
+                "--exchange-url", material.agentBearerExchangeUrl,
+                "--space", this.space,
+                "--owner", material.owner,
+                "--actor", name,
+                "--token-file", files.actorToken,
+                "--health-file", files.health,
+            ];
+            await execBearerPreflight(bearerCmd);
+            return {
+                owner: material.owner,
+                lifecycleUid: material.lifecycleUid,
+                files,
+                launch: { owner: material.owner, actor: name, sentinelCredsPath: files.sentinelCreds, bearerCmd },
+            };
+        }
+        catch (e) {
+            // Shred every local secret this attempt materialized. The HOST's rows are the host's to
+            // reconcile: a participant holds no writer, so it must not pretend to roll back a grant or a
+            // durable it never authored. A retry with the same requestId re-enters the same enrollment.
+            for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files]) {
+                await secrets.delete(agentSecretKeyForFile(family.actorToken, this.space)).catch(() => { });
+                await secrets.delete(agentSecretKeyForFile(family.sentinelCreds, this.space)).catch(() => { });
+                rmSync(family.actorToken, { force: true });
+                rmSync(family.sentinelCreds, { force: true });
+                rmSync(family.health, { force: true });
+            }
+            return { error: `agent auth preflight failed for "${name}": ${e.message}` };
+        }
+    }
     /** Drop a live agent's slot. When `floor` is set and the agent died young (lived less than
      *  MIN_LIFETIME), push a cooling stamp so the freed slot still counts toward the ceiling until it
      *  expires — flooring the RECYCLE, not the call, so both free paths (despawn + exit/reap) are
@@ -3374,9 +3624,14 @@ export class Manager {
      *  uncertain black hole. */
     liveRosterNames() {
         const live = new Set();
-        for (const p of this.ep.getRoster())
-            if (p.status !== "offline")
-                live.add(p.card.name);
+        for (const p of this.ep.getRoster()) {
+            if (p.status === "offline")
+                continue;
+            const predecessor = this.confirmedRetiredPredecessors.get(p.card.name);
+            if (predecessor !== undefined && predecessor.principal === p.card.id && predecessor.lifecycleUid === p.lifecycleUid)
+                continue;
+            live.add(p.card.name);
+        }
         return live;
     }
     /** THE single name-liveness predicate both the hard-pinned collision refuse (M6, P2 item 2) and
@@ -3395,7 +3650,9 @@ export class Manager {
      *  choice at allocation, never an authority check (the broker still enforces): a stale
      *  still-live-looking row only costs a numbered suffix, and a missed freshly-joined occupant is
      *  still refused downstream exactly as before. Offline rows do NOT occupy — a properly retired
-     *  name stays reusable. */
+     *  name stays reusable. A row this manager itself confirmed retired (its alias, principal, and
+     *  lifecycleUid all matching a {@link confirmedRetiredPredecessors} entry) does not occupy
+     *  either, even while its advisory presence record ages out. */
     uniqueName(base) {
         const live = this.liveRosterNames();
         return firstFreeName(base, (n) => this.nameInUse(n, live));
@@ -3421,7 +3678,7 @@ export class Manager {
         return false;
     }
     /** Parse an untyped control-plane `start` request into {@link StartAgentOpts}. */
-    opStart(args, caller, hooks, route = "inst") {
+    opStart(args, caller, admin, hooks, route = "inst") {
         // `resume`, when present, must be a non-empty session id. An empty/whitespace value is a
         // malformed request, not an implicit "spawn fresh" (no fallbacks). The CLI surfaces reject it,
         // but a raw control message could otherwise slip an empty value through and silently start fresh.
@@ -3468,6 +3725,31 @@ export class Manager {
         catch (e) {
             return Promise.resolve({ ok: false, error: e.message });
         }
+        // #373: the event-plane admission gate. `startAgent` resolves `eventsRequired || opts.events
+        // !== false`, so omission ARMS the plane — a gate on the explicit bit alone is bypassed by
+        // omitting it. The gate is on the DECISION, and it runs before connector resolution and
+        // before `startAgent` (which mints credentials), so a refusal provisions nothing.
+        const requestedEvents = typeof args.events === "boolean" ? args.events : undefined;
+        let eventsNotice;
+        let events = requestedEvents;
+        if (!admin) {
+            if (requestedEvents === true)
+                return Promise.resolve({
+                    ok: false,
+                    error: `spawn is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2): events: arming the event plane needs the admin tier`,
+                });
+            if (this.eventsRequired)
+                return Promise.resolve({
+                    ok: false,
+                    error: `spawn is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2): space "${this.space}" requires the event plane by registration policy, which cannot be met without the admin tier`,
+                });
+            // Omission arms by default in startAgent; serve it DISARMED and say so (never a silent
+            // downgrade). An explicit `false` is already the opt-out — served as-is, no notice.
+            if (requestedEvents === undefined) {
+                events = false;
+                eventsNotice = `event plane not armed: arming it on spawn needs the admin tier; the spawn was served with events: false`;
+            }
+        }
         return this.startAgent({
             name: String(args.name ?? "").trim(),
             agent: args.agent ? String(args.agent) : undefined,
@@ -3479,7 +3761,8 @@ export class Manager {
             variant: args.variant ? String(args.variant) : undefined,
             launchOptions: args.launchOptions,
             resume: args.resume ? String(args.resume) : undefined,
-            events: typeof args.events === "boolean" ? args.events : undefined,
+            events,
+            eventsNotice,
             cwd: args.cwd ? String(args.cwd) : undefined,
             prompt: args.prompt ? String(args.prompt) : undefined,
             subscribe,
@@ -3490,33 +3773,40 @@ export class Manager {
             route,
         }, caller, hooks);
     }
-    /** Resolve a placed spawn directory on this manager's host. The manager serves any existing
-     * absolute directory it can resolve. It creates nothing and never substitutes the workspace root. */
-    resolveSpawnCwd(value) {
-        const asked = typeof value === "string" ? value : String(value ?? "");
-        const refuse = (reason) => {
-            throw new EpEnvelopeError("failed-precondition", `cwd does not resolve on this host: ${JSON.stringify(asked)} (${reason})`);
-        };
-        if (!isAbsolute(asked))
-            refuse("expected an absolute path");
-        let cwd = asked;
+    /** The realpath + directory checks a placed spawn directory must pass on this manager's host,
+     * shared by the served `resolve-cwd` command and the `spawn` admission check (#385 item 2): one
+     * function, so the two doors never drift. Creates nothing and never substitutes the workspace root. */
+    checkSpawnCwd(resolved) {
+        let cwd = resolved;
         try {
-            cwd = realpathSync(asked);
+            cwd = realpathSync(resolved);
         }
         catch (error) {
-            refuse(`path cannot be resolved: ${error.message}`);
+            return { refusal: `path cannot be resolved: ${error.message}` };
         }
         try {
             if (!statSync(cwd).isDirectory())
-                refuse("path is not a directory");
+                return { refusal: "path is not a directory" };
         }
         catch (error) {
-            if (error instanceof EpEnvelopeError)
-                throw error;
-            refuse(error.message);
+            return { refusal: error.message };
         }
         return { cwd, host: hostname() };
     }
+    /** Resolve a placed spawn directory on this manager's host. The manager serves any existing
+     * absolute directory it can resolve. It creates nothing and never substitutes the workspace root. */
+    resolveSpawnCwd(value) {
+        const asked = typeof value === "string" ? value : String(value ?? "");
+        const refuse = (reason) => {
+            throw new EpEnvelopeError("failed-precondition", `cwd does not resolve on this host: ${JSON.stringify(asked)} (${reason})`);
+        };
+        if (!isAbsolute(asked))
+            refuse("expected an absolute path");
+        const result = this.checkSpawnCwd(asked);
+        if ("refusal" in result)
+            return refuse(result.refusal);
+        return result;
+    }
     /** Resolve a connector by agent type. Library composition (installedExtensions off) → a registry
      *  hit, exactly as before (the composition root imported what it wants). The published binary gates
      *  on MANIFEST membership FIRST — so a live `cotal ext remove` is honored even though the registry
@@ -3868,6 +4158,20 @@ export class Manager {
             if (this.userMode)
                 return { ok: false, error: "supervise is a restart policy this host cannot enforce: a user-mode seat has no static slot to keep the incarnation owned across a process death" };
         }
+        // A placed spawn's cwd is checked on this host BEFORE anything is minted or reserved: an absolute
+        // path this manager cannot realpath, or one that is not a directory, is refused here with the
+        // asked path, the reason and this host, so a misplaced spawn in a multi-manager space is
+        // diagnosable at the moment it happens (#385 item 2) instead of failing inside the pty launch.
+        // The resolved realpath is threaded to the launch cwd below (`resolvedCwd`) so it is computed once.
+        let resolvedCwd;
+        if (typeof opts.cwd === "string" && opts.cwd !== "") {
+            const asked = opts.cwd;
+            const target = resolve(this.workspaceRoot, asked);
+            const checked = this.checkSpawnCwd(target);
+            if ("refusal" in checked)
+                return { ok: false, error: `spawn: cwd does not resolve on this host (${hostname()}): ${JSON.stringify(asked)} (${checked.refusal}); the seat was not launched` };
+            resolvedCwd = checked.cwd;
+        }
         // Resolve the launch profile: IDENTITY (free-form `name:`) + role + read/post ACL + capabilities
         // + model/variant. Either from a fully-resolved manifest launch object (`opts.resolved`, whose `config`
         // is a materialized transient persona — the file is NOT the access authority), or from the
@@ -3975,6 +4279,8 @@ export class Manager {
         }
         if (variant && !connector.supportsModelVariant)
             return { ok: false, error: `${agent} connector does not support model variants (variant)` };
+        if (prompt !== undefined && !connector.supportsPrompt)
+            return { ok: false, error: `${agent} connector does not support an initial prompt (prompt)` };
         // #4 A4 (panel): the roster the allocation consults must reflect the initial presence snapshot,
         // or a spawn immediately after manager boot races an already-live unmanaged peer and re-opens the
         // very collision black-hole this closes. Await the snapshot (bounded internally, fail-safe on an
@@ -4057,7 +4363,12 @@ export class Manager {
             // The incarnation's lifecycle UID (SPEC 13.1), minted ONCE per spawn: every lifecycle-keyed
             // broker resource (dm_/dlv_/chathist_ durables, ACL row, memberships) and the teardown
             // credential carry it, so a same-name successor's footprint is name-disjoint by construction.
-            const lifecycleUid = mintLifecycleUid();
+            //
+            // On the HOSTED enrollment arm (#1972) this value is PROVISIONAL. The host selects the
+            // authoritative uid, because it alone reads the retirement tombstones that make a uid
+            // permanently unusable, and the enrollment below rebinds this binding to what the host
+            // returned before anything durable is keyed by it.
+            let lifecycleUid = mintLifecycleUid();
             // Reserve the seat's custody reference NOW, before any durable row and long before the
             // launch. Minting it inside `runtime.spawn` (as it used to be) put the processes on disk
             // before anything recorded how to address them, so a crash in that window left a live seat
@@ -4144,6 +4455,12 @@ export class Manager {
                     this.reserved.delete(name);
                     return { ok: false, error: prep.error };
                 }
+                // THE HOST'S UID WINS (#1972). On the local arm this is the value passed in, unchanged. On
+                // the hosted enrollment arm the host selected it, and from here every lifecycle-keyed thing
+                // this spawn records — the slot, the launch, the managed row, the teardown credential — must
+                // carry that value and not the provisional one, or the manager would address a footprint the
+                // host never created.
+                lifecycleUid = prep.lifecycleUid;
                 userLaunch = prep.launch;
                 userOwner = prep.owner;
                 provisioned = { id: principalKey(prep.owner, name).key, name, lifecycleUid, userOwner: prep.owner, secretPaths: prep.files, ...(custody ? { runtime: custody } : {}) };
@@ -4206,7 +4523,9 @@ export class Manager {
             // Per-agent cwd overrides the manager's shared workspace root, so agents can be rooted at
             // arbitrary folders/repos. A relative path resolves against the workspace root; omitted → the
             // agent shares the workspace root (the prior, unchanged behavior).
-            const cwd = opts.cwd ? resolve(this.workspaceRoot, opts.cwd) : this.workspaceRoot;
+            // The realpath the admission check above already resolved (#385 item 2) — never re-resolved here,
+            // so the admission refusal and the launch cwd can never disagree on the same request.
+            const cwd = resolvedCwd ?? this.workspaceRoot;
             const configSha256 = this.fileDigest(configPath);
             const manifestPath = opts.launchRef
                 ? join(this.workspaceRoot, ".cotal", "run", `${opts.launchRef.runId}.json`)
@@ -4289,6 +4608,9 @@ export class Manager {
                     cwd,
                     model,
                     variant,
+                    // The kickoff prompt is part of the launch form: a stale-restart re-submits it, so the
+                    // recorded launch must carry it for the restart gate (and preserve) to see it.
+                    prompt,
                     subscribe,
                     allowSubscribe,
                     allowPublish,
@@ -4384,7 +4706,7 @@ export class Manager {
             // canonicalJson (undefined never coerces to null, SPEC 13.6), so a role-less spawn would
             // otherwise fail its succeeded terminal. The CLI/connector already render an absent role as
             // "no role", so dropping the key preserves the reply (P2 item 2, surfaced by readiness:live).
-            const okData = { name, agent, id: managed.id, mode: handle.kind, lifecycleUid, ...(role !== undefined ? { role } : {}) };
+            const okData = { name, agent, id: managed.id, mode: handle.kind, lifecycleUid, ...(role !== undefined ? { role } : {}), ...(opts.eventsNotice !== undefined ? { eventsNotice: opts.eventsNotice } : {}) };
             await hooks?.onOutcome?.({ kind: "succeeded", data: okData });
             return { ok: true, data: okData };
         }
@@ -4735,6 +5057,8 @@ export class Manager {
                 return { ok: false, error: `${connector.name} harness needs ${missing.join(", ")} on PATH - not found` };
             if (entry.launch.variant && !connector.supportsModelVariant)
                 return { ok: false, error: `${connector.name} connector does not support model variants (variant)` };
+            if (entry.launch.prompt !== undefined && !connector.supportsPrompt)
+                return { ok: false, error: `${connector.name} connector does not support an initial prompt (prompt)` };
             let retainedSession;
             try {
                 retainedSession = this.retainedSessionId(entry, connector);
@@ -5361,6 +5685,104 @@ export class Manager {
         }
         console.error(`✓ boot self-heal: ${MANAGER_ENDPOINT}/${instanceId} registration gate reopened at generation ${report.reopenedAtGeneration} (processEpoch ${report.after.processEpoch}, registrationRevision ${report.after.registrationRevision}; freeze-holder gone, sweepComplete=true). Continuing the normal takeover.`);
     }
+    /** #2073: dial the manager's ONE control-plane connection and serve its typed command surface on
+     *  it, exactly the shape `registerManagerService` used inline before this lane. Shared by the
+     *  initial registration AND the closed-connection recovery path ({@link onServeConnectionClosed}),
+     *  so there is one place that dials and serves this endpoint. Attaches {@link
+     *  onServeConnectionClosed} as the close handler in both cases: a closed serve connection is
+     *  always a fault this manager acts on, never a bare log line. */
+    async dialServeConnection(state) {
+        const enc = new TextEncoder();
+        const nc = await this.dial({
+            // Open mesh: a bare serve connection (no credential exists; the broker enforces nothing).
+            ...(state.creds !== undefined ? { authenticator: (nonce) => credsAuthenticator(enc.encode(state.creds))(nonce) } : {}),
+            inboxPrefix: `_INBOX_${state.identity.id}`,
+            maxReconnectAttempts: -1,
+        });
+        nc.closed().then((err) => { void this.onServeConnectionClosed(err ?? undefined); });
+        let handle;
+        try {
+            // The 1b typed surface + the derived `describe`. The descriptor stays PUBLIC in static
+            // mode: the broker grant (who holds each command's request-publish row) is the
+            // load-bearing authority tier, and a static single-operator mesh leaks nothing by listing
+            // command names; the trusted per-caller `view(caller)` scoping joins the user-mode
+            // registration follow-up (where actorScope is the trusted source). Every ordinary handler
+            // runs the SHARED admission chokepoint ({@link serveGated}).
+            handle = serveEndpoint(nc, this.space, state.grant, this.managerServiceDefs(), { public: true }, {
+                // The FRESH target resolver (§13.3) for the targeted commands (`despawn`/`attach`): the
+                // manager's live managed set IS the current-mapping authority for its own agents (the
+                // durable slot rows mirror it). Static mode carries no mapping-revision dimension, so
+                // the revision is the constant 0 — a caller that pins a revision pins 0.
+                resolveTarget: (t) => {
+                    if (t.owner === DEV_OWNER) {
+                        for (const a of this.agents.values())
+                            if (!a.userOwner && a.id === t.actor)
+                                return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
+                        return undefined;
+                    }
+                    const key = principalKey(t.owner, t.actor).key;
+                    for (const a of this.agents.values())
+                        if (a.userOwner && a.id === key)
+                            return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
+                    return undefined;
+                },
+                ...(this.omitClassCommands() ? { omitClassCommands: this.omitClassCommands() } : {}),
+            });
+        }
+        catch (e) {
+            await nc.drain().catch(() => nc.close());
+            throw e;
+        }
+        return { nc, handle };
+    }
+    /** #2073: re-mint the SAME `endpoint-serve` identity through the SAME scoped one-shot executor and
+     *  §13.1 mint fence `renewDaemonCreds`'s serve branch uses — never a second copy of that mint. Used
+     *  by both the periodic renewal pass and the closed-connection recovery path below, so a
+     *  superseded instance's re-mint fails the SAME gate CAS in both places and lands in the exit
+     *  path rather than needing a second epoch check. */
+    async remintServeCreds(s) {
+        const authRef = this.auth;
+        return this.withEndpointServeExecutor(({ authKv }) => mintCreds(authRef, s.identity, "endpoint-serve", {
+            serveIssuance: serveIssuanceGateKv(authKv, this.space, { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId }),
+            endpointServe: s.grant,
+        }));
+    }
+    /** #2073: a closed serve connection is a FAULT the manager acts on, not a log line: this is the
+     *  control plane a report showed staying dead for hours while the process kept its liveness
+     *  lease and answered nothing (#2073). `stop()` sets `leaseStopping` BEFORE it tears down this
+     *  connection, so a close landing from OUR OWN graceful teardown returns here at once. Any other
+     *  close re-dials with the current credential (a transport blip needs nothing new), re-mints
+     *  through the existing serve branch when the credential itself has expired, and re-serves on the
+     *  new connection — bounded by {@link STATIC_RECONCILE_RETRY_DELAYS_MS}. Exhausting every attempt
+     *  releases this process's lease and exits loud (without `withAgents`, so seats stay up, the path
+     *  `supervise`'s signal handler already uses) so a restart can serve: a manager that holds the
+     *  lease and answers nothing is the worst of the three states this issue named, and holding the
+     *  connection open under unbounded reconnects (the transport-drop case) never reaches this method
+     *  at all — `nc.closed()` does not resolve until the client itself gives up. */
+    async onServeConnectionClosed(err) {
+        if (this.leaseStopping)
+            return;
+        const s = this.serviceServe;
+        console.error(`! manager service endpoint connection closed: ${err?.message ?? "unknown reason"}`);
+        const recovered = await this.boundedReconnect("service endpoint", async () => {
+            if (!s)
+                return false;
+            if (inspectCredHealth(s.creds ?? "").state !== "healthy" && s.creds !== undefined) {
+                s.creds = await this.remintServeCreds(s);
+                this.scheduleServeRenewal(s.creds);
+            }
+            const { nc, handle } = await this.dialServeConnection(s);
+            s.nc = nc;
+            s.handle = handle;
+            console.error(`manager service endpoint re-dialed: ${MANAGER_ENDPOINT}/${this.managerInstanceId} (epoch ${s.grant.epoch})`);
+            return true;
+        });
+        if (this.leaseStopping || recovered)
+            return;
+        console.error(`! manager service endpoint could not be restored for ${this.space}/${MANAGER_ENDPOINT}/${this.managerInstanceId}: releasing the lease and exiting`);
+        await this.stop();
+        process.exit(1);
+    }
     /** P2 item 1: register the manager as an ordinary v0.4 `service` endpoint and serve its typed
      *  command surface on the ep rails - since 1d the manager's ONLY control door. On an AUTH mesh
      *  the whole credential path is the SAME one an ordinary endpoint traverses (the enforcement
@@ -5610,50 +6032,16 @@ export class Manager {
         // without re-registration. Reconnects stay unbounded: the serve rails are this instance's
         // registered surface for its whole incarnation.
         const state = { handle: undefined, nc: undefined, identity: serveIdentity, grant, creds };
-        const enc = new TextEncoder();
-        const nc = await this.dial({
-            // Open mesh: a bare serve connection (no credential exists; the broker enforces nothing).
-            ...(creds !== undefined ? { authenticator: (nonce) => credsAuthenticator(enc.encode(state.creds))(nonce) } : {}),
-            inboxPrefix: `_INBOX_${serveIdentity.id}`,
-            maxReconnectAttempts: -1,
-        });
-        nc.closed().then((err) => { if (err)
-            console.error(`! manager service endpoint connection closed: ${err.message}`); });
-        try {
-            // The 1b typed surface + the derived `describe`. The descriptor stays PUBLIC in static
-            // mode: the broker grant (who holds each command's request-publish row) is the
-            // load-bearing authority tier, and a static single-operator mesh leaks nothing by listing
-            // command names; the trusted per-caller `view(caller)` scoping joins the user-mode
-            // registration follow-up (where actorScope is the trusted source). Every ordinary handler
-            // runs the SHARED admission chokepoint ({@link serveGated}).
-            state.handle = serveEndpoint(nc, this.space, grant, this.managerServiceDefs(), { public: true }, {
-                // The FRESH target resolver (§13.3) for the targeted commands (`despawn`/`attach`): the
-                // manager's live managed set IS the current-mapping authority for its own agents (the
-                // durable slot rows mirror it). Static mode carries no mapping-revision dimension, so
-                // the revision is the constant 0 — a caller that pins a revision pins 0.
-                resolveTarget: (t) => {
-                    if (t.owner === DEV_OWNER) {
-                        for (const a of this.agents.values())
-                            if (!a.userOwner && a.id === t.actor)
-                                return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
-                        return undefined;
-                    }
-                    const key = principalKey(t.owner, t.actor).key;
-                    for (const a of this.agents.values())
-                        if (a.userOwner && a.id === key)
-                            return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
-                    return undefined;
-                },
-                ...(this.omitClassCommands() ? { omitClassCommands: this.omitClassCommands() } : {}),
-            });
-        }
-        catch (e) {
-            await nc.drain().catch(() => nc.close());
-            throw e;
-        }
+        const { nc, handle } = await this.dialServeConnection(state);
         state.nc = nc;
+        state.handle = handle;
         this.serviceServe = state;
         console.error(`manager service endpoint registered: ${MANAGER_ENDPOINT}/${iid} (epoch ${grant.epoch}, registrationRevision ${grant.registrationRevision})`);
+        // #2073: arm the serve credential's own renewal now, from ITS window, instead of leaving it to
+        // `credRenewTimer`'s boot-phased TTL/4 tick. Open mesh mints no credential (`creds` is
+        // undefined) and has nothing to schedule.
+        if (state.creds !== undefined)
+            this.scheduleServeRenewal(state.creds);
     }
     /** P2 item 2 must-5 (b): mint the standing `goal-writer` credential and STAGE it into this
      *  instance's §13.1 revocation family (`epcred.<e>.<iid>`), over the passed executor's `authKv`
@@ -5701,19 +6089,18 @@ export class Manager {
      *  renewal is adopted without reconnecting the whole endpoint); the ActionContext bonds its
      *  KV + JS + JSM to this one connection and space (SPEC 13.4), so a composition mixup cannot splice
      *  goal state across brokers. */
-    async startGoalWriter() {
-        const identity = (this.auth || this.remoteAuthority) ? this.goalWriterIdentity : newIdentity();
+    /** #2073: dial the goal-writer's ONE standing connection and rebuild everything derived from it
+     *  (the fence-resolving action context, the issuance-gate reader) — shared by the initial start
+     *  and the closed-connection recovery ({@link onGoalWriterConnectionClosed}), so a redial never
+     *  leaves the context bound to a dead socket. */
+    async dialGoalWriter(gw) {
         const enc = new TextEncoder();
-        // The mutable holder captured by the authenticator (mirrors the serve connection): a half-TTL
-        // renewal updates `gw.creds` and the next (re)connect presents the refreshed credential.
-        const gw = { nc: undefined, ctx: undefined, creds: (this.auth || this.remoteAuthority) ? this.goalWriterCreds : undefined, identity };
         const nc = await this.dial({
             ...((this.auth || this.remoteAuthority) ? { authenticator: (nonce) => credsAuthenticator(enc.encode(gw.creds))(nonce) } : {}),
-            inboxPrefix: `_INBOX_${identity.id}`,
+            inboxPrefix: `_INBOX_${gw.identity.id}`,
             maxReconnectAttempts: -1,
         });
-        nc.closed().then((err) => { if (err)
-            console.error(`! manager goal-writer connection closed: ${err.message}`); });
+        nc.closed().then((err) => { void this.onGoalWriterConnectionClosed(err ?? undefined); });
         gw.nc = nc;
         // The (i) fence resolver (SPEC 13.6 P2 item 3): resolve an executing instance's CURRENT gate
         // epoch. This manager reconciles only ITS OWN goals (security pin 4), so it resolves its own
@@ -5739,6 +6126,40 @@ export class Manager {
         // rather than closing it. An AUTH mesh gets durable closure from the §13.1 barrier (revoke +
         // cluster-verified eviction BEFORE the epoch advance); an open mesh gets none.
         gw.gate = serveIssuanceGateKv(await new Kvm(nc).open(epAuthBucket(this.space)), this.space, { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId });
+    }
+    /** #2073: the goal-writer rail's closed-connection fault, the same bounded shape the serve rail
+     *  uses ({@link onServeConnectionClosed}) through the same {@link boundedReconnect} helper:
+     *  re-dial with the current credential (a transport blip needs nothing new), re-mint through the
+     *  existing goal-writer renewal branch when the credential itself has expired, then re-attach.
+     *  Unlike the serve rail this never exits the process on exhaustion (brief step 4: only the serve
+     *  rail is the control plane the report lost) — it logs and leaves the credential to the next
+     *  scheduled renewal pass. */
+    async onGoalWriterConnectionClosed(err) {
+        if (this.leaseStopping)
+            return;
+        console.error(`! manager goal-writer connection closed: ${err?.message ?? "unknown reason"}`);
+        const gw = this.goalWriter;
+        const recovered = await this.boundedReconnect("goal-writer", async () => {
+            if (!gw)
+                return false;
+            if (gw.creds !== undefined && inspectCredHealth(gw.creds).state !== "healthy") {
+                gw.creds = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageGoalWriter(authKv));
+                this.goalWriterCreds = gw.creds;
+            }
+            await this.dialGoalWriter(gw);
+            console.error("manager goal-writer re-dialed");
+            return true;
+        });
+        if (this.leaseStopping || recovered)
+            return;
+        console.error("! manager goal-writer could not be re-dialed; leaving the credential to the next renewal pass");
+    }
+    async startGoalWriter() {
+        const identity = (this.auth || this.remoteAuthority) ? this.goalWriterIdentity : newIdentity();
+        // The mutable holder captured by the authenticator (mirrors the serve connection): a half-TTL
+        // renewal updates `gw.creds` and the next (re)connect presents the refreshed credential.
+        const gw = { nc: undefined, ctx: undefined, creds: (this.auth || this.remoteAuthority) ? this.goalWriterCreds : undefined, identity };
+        await this.dialGoalWriter(gw);
         this.goalWriter = gw;
         console.error(`manager goal-writer standing (endpoint ${MANAGER_ENDPOINT}, ${(this.auth || this.remoteAuthority) ? "scoped cred, §13.1 family-staged" : "open/bare"})`);
     }
@@ -5806,20 +6227,55 @@ export class Manager {
      *  holder never verifies the signature (it presents the grant back over the rail; the broker's
      *  per-session caller cred is the holder's real fence). The plane's ledger lives in the DEDICATED
      *  sessions bucket (createEndpointStreams provisioned it at registration). */
-    async startSessionPlane() {
-        const identity = (this.auth || this.remoteAuthority) ? this.sessionLedgerIdentity : newIdentity();
+    /** #2073: dial the session-ledger's ONE standing connection — shared by the initial start and the
+     *  closed-connection recovery ({@link onSessionLedgerConnectionClosed}), the same shape {@link
+     *  dialGoalWriter} uses for its rail. The KV/JetStream clients the session plane opened from the
+     *  connection at start stay bound to it for this incarnation's life; a redial refreshes the
+     *  standing authenticator connection the credential renewal presents onto (mirroring `sw.creds`),
+     *  which is what a closed-connection fault on this rail needs restored. */
+    async dialSessionLedgerConnection(sw, identity) {
         const enc = new TextEncoder();
-        // The mutable holder captured by the authenticator (mirrors the goal-writer): a half-TTL renewal
-        // updates `sw.creds` and the next (re)connect presents the refreshed credential.
-        const sw = { nc: undefined, creds: (this.auth || this.remoteAuthority) ? this.sessionLedgerCreds : undefined };
         const nc = await this.dial({
             ...((this.auth || this.remoteAuthority) ? { authenticator: (nonce) => credsAuthenticator(enc.encode(sw.creds))(nonce) } : {}),
             inboxPrefix: `_INBOX_${identity.id}`,
             maxReconnectAttempts: -1,
         });
-        nc.closed().then((err) => { if (err)
-            console.error(`! manager session-ledger connection closed: ${err.message}`); });
+        nc.closed().then((err) => { void this.onSessionLedgerConnectionClosed(err ?? undefined); });
         sw.nc = nc;
+    }
+    /** #2073: the session-ledger rail's closed-connection fault, the same bounded shape {@link
+     *  onGoalWriterConnectionClosed} uses: re-dial with the current credential, re-mint through the
+     *  existing session-ledger renewal branch when the credential itself has expired, then re-attach.
+     *  Exhaustion logs and leaves the credential to the next renewal pass; it never exits the process
+     *  (brief step 4: only the serve rail is the control plane the report lost). */
+    async onSessionLedgerConnectionClosed(err) {
+        if (this.leaseStopping)
+            return;
+        console.error(`! manager session-ledger connection closed: ${err?.message ?? "unknown reason"}`);
+        const sw = this.sessionLedgerConn;
+        const identity = this.sessionLedgerIdentity;
+        const recovered = await this.boundedReconnect("session-ledger", async () => {
+            if (!sw || !identity)
+                return false;
+            if (sw.creds !== undefined && inspectCredHealth(sw.creds).state !== "healthy") {
+                sw.creds = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageSessionLedger(authKv));
+                this.sessionLedgerCreds = sw.creds;
+            }
+            await this.dialSessionLedgerConnection(sw, identity);
+            console.error("manager session-ledger re-dialed");
+            return true;
+        });
+        if (this.leaseStopping || recovered)
+            return;
+        console.error("! manager session-ledger could not be re-dialed; leaving the credential to the next renewal pass");
+    }
+    async startSessionPlane() {
+        const identity = (this.auth || this.remoteAuthority) ? this.sessionLedgerIdentity : newIdentity();
+        // The mutable holder captured by the authenticator (mirrors the goal-writer): a half-TTL renewal
+        // updates `sw.creds` and the next (re)connect presents the refreshed credential.
+        const sw = { nc: undefined, creds: (this.auth || this.remoteAuthority) ? this.sessionLedgerCreds : undefined };
+        await this.dialSessionLedgerConnection(sw, identity);
+        const nc = sw.nc;
         const serveEpoch = this.serviceServe?.grant.epoch;
         if (serveEpoch === undefined)
             throw new Error("the manager session plane needs the serve grant epoch; registerManagerService must run first");
@@ -7052,10 +7508,13 @@ export class Manager {
                     managerInstance: this.managerInstanceId, managerProcessUid: this.managerLifecycleUid,
                 }, { cleanup: reapThenCleanup, evict, log: (line) => console.error(`static retirement ${a.name}: ${line}`) });
             });
-            this.retiredPrincipals.add(principalKey(DEV_OWNER, a.id).key);
+            const principal = principalKey(DEV_OWNER, a.id).key;
+            this.retiredPrincipals.add(principal);
             const cur = this.retiring.get(a.name);
-            if (cur && cur.lifecycleUid === a.lifecycleUid)
+            if (cur && cur.lifecycleUid === a.lifecycleUid) {
                 this.retiring.delete(a.name); // ABA-guarded hold clear
+                this.confirmedRetiredPredecessors.set(a.name, { principal, lifecycleUid: a.lifecycleUid });
+            }
         }
         catch (e) {
             const h = this.retiring.get(a.name);