@cotal-ai/manager 0.57.0 → 0.59.0

package/dist/manager.js

@@ -4,11 +4,11 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, epRequestSubject, epCallerReplyFilter, parseEpSubject, controlServiceSubject, eventChannelPrincipal, } from "@cotal-ai/core";
+import { CotalEndpoint, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
-import { makeManagerEndpointEvictionEvidence, makeManagerEndpointEvictor } from "./endpoint-evict.js";
+import { makeManagerEndpointEvictionEvidence, makeManagerEndpointEvictor, makeManagerEndpointHolderEvictor } from "./endpoint-evict.js";
 import { makeManagerHolderLivenessProbe } from "./holder-liveness.js";
 import { GateReconcileRefused, reconcileEndpointGate } from "./reconcile-gate.js";
 import { launchSpecForRun, materializePersona, launchAgentToStartOpts, parseLaunchSpec, persistLaunchSpec } from "./launch.js";
@@ -197,61 +197,6 @@ function parseTurnNote(raw) {
 function turnHoldToken(goalId) {
     return createHash("sha256").update(`${goalId}:turn-deadline`, "utf8").digest("base64url").slice(0, 43);
 }
-/** One ep request/reply round-trip on the caller's OWN reply-plane filter (§13.2). The responder
- *  derives the reply subject from the authenticated request, so there is no caller-selected reply
- *  target to honour; the caller binds the answer off the reply SUBJECT — endpoint and nonce, both
- *  broker-pinned by the responder's serve publish grant. A reply on another nonce belongs to a
- *  different request (the rail is shared) and is ignored rather than allowed to fail this one. */
-export async function epAwaitReply(nc, space, caller, nonce, requestId, requestSubject, body, timeoutMs) {
-    let sub;
-    let timer;
-    try {
-        const got = new Promise((resolve, reject) => {
-            sub = nc.subscribe(epCallerReplyFilter(space, caller), {
-                callback: (err, msg) => {
-                    if (err) {
-                        reject(new Error(`the retirement reply subscription failed: ${err.message}`));
-                        return;
-                    }
-                    const parsed = parseEpSubject(msg.subject);
-                    if (!parsed || parsed.plane !== "reply" || parsed.endpoint !== AUTH_ENDPOINT || parsed.nonce !== nonce)
-                        return;
-                    let body;
-                    try {
-                        body = JSON.parse(new TextDecoder().decode(msg.data));
-                    }
-                    catch {
-                        return;
-                    } // a malformed body on our nonce is not an answer; keep waiting
-                    // REQUIRE THE ID ECHO. Binding on (endpoint, nonce) alone would accept a malformed or
-                    // WRONG-ID `{ok:true}` and clear a retirement hold on it. Ignore rather than fail: the
-                    // rail is shared across concurrent requests and a responder may publish at any nonce, so
-                    // an unmatched reply is someone else's answer, never grounds to fail the honest one.
-                    if (body.id !== requestId)
-                        return;
-                    resolve(body);
-                },
-            });
-            timer = setTimeout(() => reject(new Error("timeout")), timeoutMs);
-            nc.publish(requestSubject, new TextEncoder().encode(body));
-        });
-        return await got;
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-        try {
-            sub?.unsubscribe();
-        }
-        catch { /* connection already down */ }
-    }
-}
-/**
- * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
- * It serves control requests on the "manager" service and spawns/kills agents
- * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
- * mesh traffic — terminal I/O streams over its own attach endpoint instead.
- */
 /**
  * Event channels in `channels` that do NOT belong to `{owner, actor}`.
  *
@@ -292,6 +237,12 @@ function isAbsentDeliveryAdmin(msg) {
         return false;
     return /no responders|\b503\b/i.test(msg);
 }
+/**
+ * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
+ * It serves control requests on the "manager" service and spawns/kills agents
+ * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
+ * mesh traffic — terminal I/O streams over its own attach endpoint instead.
+ */
 export class Manager {
     space;
     servers;
@@ -317,8 +268,13 @@ export class Manager {
     endpointServeExecutorExpiresInSeconds;
     agents = new Map();
     /** Names whose spawn is in flight (reserved synchronously before the provision await) — counted
-     *  toward the ceiling so two concurrent same-name spawns can't both pass the gate (P4a). */
+     *  toward the ceiling (once per name, see {@link Manager.occupancy}) so two concurrent same-name
+     *  spawns can't both pass the gate (P4a). */
     reserved = new Set();
+    /** Reserved names whose launch already put its seat in `agents`. The name stays reserved until
+     *  the launch settles, so no other spawn can take it, but the ceiling counts that seat through
+     *  `agents` and, if it frees young, its cooling stamp, never through the reservation (#906). */
+    reservedLive = new Set();
     /** Expiry stamps (`startedAt + MIN_LIFETIME`) for slots that freed while still young — a
      *  count-only, lazily-pruned recycle floor (P4c). Pruned + summed into the ceiling gate. */
     cooling = [];
@@ -370,6 +326,11 @@ export class Manager {
      *  every (re)connect, so a renewal is adopted without re-registration). Absent on open meshes,
      *  in user mode (the named 1a follow-up), and before registration completes. */
     serviceServe;
+    /** #1577: serve connections whose transport is down while the client reconnects them. Such a
+     *  connection is open (`isClosed()` is false under unbounded reconnects) yet the broker holds
+     *  none of its rails, so the liveness responder must not grade it `bound`. Keyed by the
+     *  connection, so a re-dial that swaps in a fresh one starts from its own state. */
+    serveTransportDown = new WeakSet();
     /** P2 item 2 (spawn-as-action): the SELF-MEDIATED goal-writer connection + ActionContext — a
      *  standing connection DISJOINT from the serve credential (Q2), scoped to exactly this endpoint's
      *  goal bind/terminal facts + goal-record writes ({@link goalWriterGrants}). Auth mode mints the
@@ -424,10 +385,11 @@ export class Manager {
     /** P2 item 2 (M4): the live spawn goal ref for each managed agent name, so a despawn MID-GOAL
      *  drives the cancel path (transition -> cancel terminal). Cleared when the goal terminalizes. */
     agentGoals = new Map();
-    /** The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin): a
-     *  same-goalId retry serves the identical acceptance; cross-incarnation retries rebuild from
-     *  the goal-index entry (its acceptance floor + note). */
     /**
+     * The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin): a
+     * same-goalId retry serves the identical acceptance; cross-incarnation retries rebuild from
+     * the goal-index entry (its acceptance floor + note).
+     *
      * One entry per turn this incarnation accepted: the acceptance a duplicate submission is served
      * from, and — once the turn settles — the answer a RETRIED yield is served from.
      *
@@ -467,6 +429,8 @@ export class Manager {
      *  lifecycle authority: every re-drive re-reads broker KV and re-runs planStaticSlotResume. */
     staticReconcileItems = new Map();
     staticReconcileLastSweep;
+    staticReconcileLastSweepResources;
+    lastDeprovisionResources;
     staticReconcileSweepsInFlight = 0;
     staticReconcileDrainWaiters = [];
     staticReconcileStopping = false;
@@ -549,6 +513,11 @@ export class Manager {
     resumedAgentNames = new Set();
     remoteAuthority;
     remoteExecutorCreds;
+    remoteSupervisorCreds;
+    remoteBundleRenewal;
+    /** A refused or failed standing candidate is cleanup debt, never a silent loss: the last-good
+     * family stays live and this records what the host may have signed but the manager never adopted. */
+    remoteRenewalDebt;
     /** Every broker dial this manager makes, through ONE transport decision.
      *
      *  `this.servers` is whatever the mesh record held (`cotal supervise` reads it from there), so it
@@ -561,6 +530,10 @@ export class Manager {
         return dialerFor(servers)({ ...opts, servers });
     }
     constructor(opts) {
+        if (opts.pooled && (!opts.remoteAuthority || opts.runtime === undefined || opts.runtime === "auto" || opts.runtime === "pty"))
+            throw new Error("pooled control requires signerless remote authority and an explicit non-PTY runtime; local custodial execution is forbidden");
+        if (opts.pooled && !opts.remoteAuthority?.renewStandingBundle)
+            throw new Error("pooled control requires a closed host-issued all-duty renewal callback before construction");
         this.space = opts.space;
         this.servers = opts.servers;
         this.name = opts.name ?? "manager";
@@ -569,6 +542,10 @@ export class Manager {
         this.maxSessions = opts.maxSessions;
         this.remoteAuthority = opts.remoteAuthority;
         this.remoteExecutorCreds = opts.remoteAuthority?.executorCreds;
+        this.remoteSupervisorCreds = opts.remoteAuthority?.supervisorCreds;
+        if (opts.pooled && (!opts.remoteAuthority?.accountPublicKey ||
+            accountFromCreds(opts.remoteAuthority.supervisorCreds) !== opts.remoteAuthority.accountPublicKey))
+            throw new Error("pooled control requires a proved assigned account for its initial supervisor credential");
         if (opts.remoteAuthority)
             this.managerLifecycleUid = opts.remoteAuthority.lifecycleUid;
         this.secrets = opts.secretStore ?? workspaceSecretStore(this.workspaceRoot);
@@ -577,6 +554,8 @@ export class Manager {
             : { kind: "fs", root: resolve(this.workspaceRoot) };
         this.installedExtensions = opts.installedExtensions ?? false;
         this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
+        if (opts.pooled && isCustodialRuntime(this.runtime))
+            throw new Error(`pooled control refuses custodial runtime "${this.runtime.kind}" before starting agents`);
         this.preserveStopTimeoutMs = opts.preserveStopTimeoutMs ?? PRESERVE_STOP_TIMEOUT_MS;
         this.endpointServeExecutorExpiresInSeconds = opts.endpointServeExecutorExpiresInSeconds;
         if (opts.resumeAttemptId && !/^[A-Za-z0-9_-]{1,128}$/.test(opts.resumeAttemptId))
@@ -688,8 +667,8 @@ export class Manager {
             case "user":
                 return (`\`cotal actor grant <reader> --owner ${owner} --scope '' --allow-subscribe '${channel}' ` +
                     `--allow-publish ''\`, with every field spelled out: \`actor grant\` is an upsert of the ` +
-                    `WHOLE row and an omitted flag means the WIDE default (\`>\` read, \`>\` post, \`spawn,role:default\` ` +
-                    `scope), not "leave it alone".`);
+                    `WHOLE row, and an omitted flag is refused, or with \`--full\` is the WIDE default (\`>\` read, \`>\` post, \`spawn,role:default\` ` +
+                    `scope).`);
             case "static":
                 return (`\`cotal mint <reader> --profile agent --allow-subscribe ${channel} --provision\`, where there ` +
                     `is no actor ledger for \`actor grant\` to write to. The AGENT profile, not the observer ` +
@@ -792,7 +771,7 @@ export class Manager {
         if (this.remoteAuthority) {
             const remote = this.remoteAuthority;
             id = remote.identities.supervisor.id;
-            creds = async () => remote.supervisorCreds;
+            creds = async () => this.remoteSupervisorCreds;
         }
         else if (this.auth) {
             const identity = newIdentity();
@@ -836,6 +815,10 @@ export class Manager {
         const reportEndpoint = (e) => console.error(`! manager endpoint: ${e.message}`);
         this.ep.on("error", reportEndpoint);
         this.ep.on("warning", reportEndpoint);
+        // Every roster change and every view transition, so a seat that is offline in a fresh snapshot
+        // (recorded with no presence event) is logged the moment the view can support the verdict.
+        this.ep.on("roster", () => this.logSeatMeshTransitions());
+        this.ep.on("presence-view", () => this.logSeatMeshTransitions());
         await this.ep.start();
         await this.ep.setActivity(`supervisor (${this.runtime.kind})`);
         // Per-instance liveness lease (P2 item 3 — the old per-space singleton is DEMOTED per D9). Acquire
@@ -861,6 +844,31 @@ export class Manager {
         }
         this.leaseTimer = setInterval(() => { void this.renewLease(); }, MANAGER_LEASE_RENEW_MS);
         this.leaseTimer.unref?.();
+        // THE PEER-READABLE LIVENESS RESPONDER for the manager plane (#1577). Bound HERE — after the
+        // lease, before registration — precisely so it is up during the window in which the manager is
+        // NOT yet serving. A responder that only appeared once everything worked could never report the
+        // broken state it exists to report, which is the reported defect in a new place.
+        //
+        // WHAT IT GRADES is `serviceServe`, the v0.4 service endpoint's serve handle, which is assigned
+        // only after `serveEndpoint` has bound this instance's rails, AND that handle's connection. A
+        // closed serve connection holds no subscriptions, while `onServeConnectionClosed` keeps the
+        // handle through its re-dial waits, so the handle alone would answer `bound` with every rail
+        // gone. The re-dial swaps in the fresh connection and handle together, so `bound` returns only
+        // once the rails are served again. A DISCONNECTED serve connection is the same fault without the
+        // close: it reconnects without limit, so it stays open while the broker holds none of its rails,
+        // and this probe arrives on the separate supervisor connection that is still up. So the grade
+        // also requires the serve transport to be connected. That is a RESPONDER fact. It is
+        // deliberately NOT "this process is alive": this process is trivially alive whenever it answers
+        // at all, so grading on that would make the surface a `pgrep` that also lies in both directions
+        // — the exact instrument the reporter's evidence table indicts. Between lease acquisition and a
+        // successful registration the honest answer is `unbound`, and that is what a peer is told.
+        //
+        // The lease row is never consulted and never sent: presence is the whole ask, and the row
+        // carries the operator's workspace root and pid.
+        this.ep.serveLiveness("manager", () => {
+            const s = this.serviceServe;
+            return s?.handle && !s.nc.isClosed() && !this.serveTransportDown.has(s.nc) ? "bound" : "unbound";
+        });
         // Unit B (static §13.1): after this instance holds its lease, collect the durable static rows
         // now, but do not let their exact-op terminals make the whole space unreachable. The service
         // comes up below, then the sweep overlaps the remaining registration work. Two-window
@@ -895,8 +903,38 @@ export class Manager {
             this.credRenewTimer.unref?.();
         }
         else if (this.remoteAuthority) {
-            await this.renewRemoteExecutor();
-            this.credRenewTimer = setInterval(() => { void this.renewRemoteExecutor(); }, credRenewIntervalMs(5 * 60));
+            if (this.remoteAuthority.renewStandingBundle)
+                await this.renewRemoteStandingBundle();
+            else
+                await this.renewRemoteExecutor();
+            let standingTtl = STANDING_RENEWABLE_TTL_SEC;
+            if (this.remoteSupervisorCreds) {
+                try {
+                    const claims = credsClaims(this.remoteSupervisorCreds);
+                    if (typeof claims.exp === "number" && typeof claims.iat === "number" && claims.exp > claims.iat) {
+                        standingTtl = claims.exp - claims.iat;
+                    }
+                }
+                catch { }
+            }
+            const intervalMs = Math.min(credRenewIntervalMs(5 * 60), credRenewIntervalMs(standingTtl));
+            this.credRenewTimer = setInterval(async () => {
+                try {
+                    if (this.remoteAuthority?.renewStandingBundle)
+                        await this.renewRemoteStandingBundle();
+                    else
+                        await this.renewRemoteExecutor();
+                }
+                catch (e) {
+                    console.error(`! remote manager renewal pass failed: ${e.message}`);
+                }
+                try {
+                    await this.runHosting?.renew();
+                }
+                catch (e) {
+                    console.error(`! remote run-hosting renewal pass failed: ${e.message}`);
+                }
+            }, intervalMs);
             this.credRenewTimer.unref?.();
         }
         // stop() fences before it waits for an accepted startup reconciliation terminal. Once that
@@ -929,9 +967,26 @@ export class Manager {
         // incarnation takes back every run a dead predecessor was driving before it accepts new ones.
         // The serve surface is already live by here, so the family itself holds the gate: `runHost()`
         // refuses `run-start`/`run-resume` as `unavailable` until the host exists and `RunHosting`
-        // refuses them until its reconcile has returned. A user-auth mesh stands no host up at all
-        // (`runHost()` names why); a remote-authority manager holds no signer to mint with.
-        if (!this.remoteAuthority && !this.userMode) {
+        // refuses them until its reconcile has returned. A remote user-auth manager uses its four
+        // registered issuer callbacks instead of holding a signer; a local user mesh stands none up.
+        const remoteRuns = this.remoteAuthority?.runHosting;
+        if (this.remoteAuthority && remoteRuns) {
+            this.runHosting = new RunHosting({
+                space: this.space,
+                servers: this.servers,
+                endpoint: MANAGER_ENDPOINT,
+                instanceId: this.managerInstanceId,
+                holder: { id: this.remoteAuthority.identities.supervisor.id, lifecycleUid: this.managerLifecycleUid },
+                auth: undefined,
+                log: (line) => console.error(line),
+                admitRun: remoteRuns.admitRun,
+                issueAttempt: remoteRuns.issueAttempt,
+                issueOperator: remoteRuns.issueOperator,
+                renewRun: remoteRuns.renewRun,
+            });
+            await this.runHosting.reconcile();
+        }
+        else if (!this.remoteAuthority && !this.userMode) {
             this.runHosting = new RunHosting({
                 space: this.space,
                 servers: this.servers,
@@ -1339,6 +1394,94 @@ export class Manager {
                 throw e;
         }
     }
+    /** An active signerless manager renews its standing duties together. The issuer stages the closed
+     * credential family first; broker preflight proves every JWT and existing caller-held nkey
+     * before any mutable holder changes. A failed candidate leaves all current creds intact. */
+    async renewRemoteStandingBundle(force = false) {
+        if (this.remoteBundleRenewal)
+            return this.remoteBundleRenewal;
+        const renewal = this.renewRemoteStandingBundleOnce(force);
+        this.remoteBundleRenewal = renewal;
+        try {
+            await renewal;
+        }
+        finally {
+            if (this.remoteBundleRenewal === renewal)
+                this.remoteBundleRenewal = undefined;
+        }
+    }
+    /** A signerless manager's closed standing connection re-dials through the all-duty family only.
+     *  A healthy holder re-dials as is. An unhealthy one waits for the closed renewal and adoption,
+     *  and a refusal fails this attempt with last-good and debt kept. Nothing is minted locally. */
+    async renewRemoteBeforeRedial(label, read) {
+        if (inspectCredHealth(read() ?? "").state === "healthy")
+            return;
+        await this.renewRemoteStandingBundle(true);
+        if (inspectCredHealth(read() ?? "").state !== "healthy")
+            throw new Error(`the ${label} credential is not healthy after all-duty renewal; last-good is kept and nothing is minted locally`);
+    }
+    async renewRemoteStandingBundleOnce(force) {
+        const remote = this.remoteAuthority;
+        if (!remote?.renewStandingBundle || !this.serviceServe)
+            return;
+        const current = [this.remoteSupervisorCreds, this.remoteExecutorCreds, this.serviceServe.creds,
+            this.goalWriterCreds, this.sessionLedgerCreds];
+        if (!force && current.every((cred) => cred && inspectCredHealth(cred).state === "healthy"))
+            return;
+        const processEpoch = this.serviceServe.grant.epoch;
+        let candidate;
+        try {
+            candidate = await remote.renewStandingBundle(processEpoch);
+            const names = ["supervisor", "executor", "serve", "goalWriter", "sessionLedger"];
+            if (Object.keys(candidate).sort().join(",") !== [...names].sort().join(","))
+                throw new Error("host returned an incomplete or widened standing credential family");
+            for (const name of names) {
+                if (typeof candidate[name] !== "string" || inspectCredHealth(candidate[name]).state === "unreadable")
+                    throw new Error(`host returned an unreadable ${name} credential`);
+                if (!remote.accountPublicKey || accountFromCreds(candidate[name]) !== remote.accountPublicKey)
+                    throw new Error(`host returned a ${name} credential for another account`);
+                if (credsClaims(candidate[name]).sub !== remote.identities[name].id)
+                    throw new Error(`host returned a ${name} credential for a different nkey than the held identity`);
+                const staged = candidate[name];
+                const nc = await this.dial({ authenticator: (nonce) => credsAuthenticator(new TextEncoder().encode(staged))(nonce), maxReconnectAttempts: 0 });
+                await nc.close();
+            }
+            if (this.leaseStopping || !this.serviceServe || this.serviceServe.grant.epoch !== processEpoch)
+                throw new Error("manager changed its active serve epoch while standing renewal was in flight");
+            this.remoteSupervisorCreds = candidate.supervisor;
+            this.remoteExecutorCreds = candidate.executor;
+            this.serviceServe.creds = candidate.serve;
+            this.goalWriterCreds = candidate.goalWriter;
+            this.sessionLedgerCreds = candidate.sessionLedger;
+            if (this.goalWriter)
+                this.goalWriter.creds = candidate.goalWriter;
+            if (this.sessionLedgerConn)
+                this.sessionLedgerConn.creds = candidate.sessionLedger;
+            // Adoption is committed above; a connection that cannot come back yet is a push failure the
+            // endpoint's own reconnect loop retries with the adopted credential, not unadopted debt.
+            this.remoteRenewalDebt = undefined;
+            await Promise.all([
+                this.ep.reconnect().catch((e) => console.error(`! remote manager supervisor reconnect after renewal: ${e.message}`)),
+                this.pushRenewedCreds(this.serviceServe.nc),
+                ...(this.goalWriter ? [this.pushRenewedCreds(this.goalWriter.nc)] : []),
+                ...(this.sessionLedgerConn ? [this.pushRenewedCreds(this.sessionLedgerConn.nc)] : []),
+            ]);
+        }
+        catch (e) {
+            const unadoptedSubjects = candidate && typeof candidate === "object"
+                ? Object.values(candidate).flatMap((cred) => { try {
+                    return typeof cred === "string" && credsClaims(cred).sub ? [credsClaims(cred).sub] : [];
+                }
+                catch {
+                    return [];
+                } })
+                : [];
+            this.remoteRenewalDebt = { at: Date.now(), processEpoch, reason: e.message, unadoptedSubjects };
+            console.error(`! remote manager all-duty renewal: ${e.message} - no unsigned or local replacement is available`);
+            if (force)
+                throw e;
+        }
+    }
     /** Warn, on every renewal pass, when a $SYS credential is at or past its renewal point.
      *
      *  The manager is the renewal owner for every credential it CAN re-sign, and these two are the ones
@@ -1736,6 +1879,7 @@ export class Manager {
                 events: a.launch.events,
                 shareTools: a.launch.shareTools,
                 forkSource: a.launch.forkSource,
+                ...(this.forkProvenance(a) ? { resumed: this.forkProvenance(a) } : {}),
                 sessionId: a.restart?.armed ? this.readManagedSession(a) : a.launch.sessionId,
                 // Additive and only when the connector supplied one. A seat with no pointer records no
                 // field, which is what keeps an older inventory and a fresh one the same document shape.
@@ -1861,38 +2005,64 @@ export class Manager {
         // revision it has since moved is a CAS the broker correctly refuses, silently, forever.
         await this.leaseRenewTask?.catch(() => { });
         let releaseFailures = [];
-        if (this.maintenanceState === "active" && !this.resumeRequired) {
-            if (options.withAgents)
-                await this.teardownManagedAgents();
-            else
-                releaseFailures = this.releaseManagedAgents();
+        let seatFailure;
+        try {
+            if (this.maintenanceState === "active" && !this.resumeRequired) {
+                if (options.withAgents)
+                    await this.teardownManagedAgents();
+                else
+                    releaseFailures = this.releaseManagedAgents();
+            }
+            else {
+                // A signal after a partial preservation must never fall back into destructive teardown.
+                await this.stopRetainedAgentsOnExit();
+            }
         }
-        else {
-            // A signal after a partial preservation must never fall back into destructive teardown.
-            await this.stopRetainedAgentsOnExit();
+        catch (e) {
+            seatFailure = e;
+        }
+        // Every step below runs even when an earlier one fails, so a failed stop still closes this
+        // process's connections and listener (#2290). Failures are collected and thrown at the end.
+        const failures = [];
+        const step = async (name, run) => {
+            try {
+                await run();
+            }
+            catch (e) {
+                failures.push(`${name}: ${e.message}`);
+            }
+        };
+        // A seat that may still be alive keeps this instance's leases and registration (see
+        // teardownManagedAgents): they lapse on their TTL instead of being handed to a successor.
+        if (!seatFailure) {
+            await step("release manager lease", () => this.releaseOwnManagerLease());
+            // #1634: hand the renewal lease back on a clean stop so a sibling picks it up on its next pass
+            // rather than waiting out the bucket TTL. A non-owner holds no revision and this is a no-op.
+            await step("release renewal lease", () => this.ep.releaseDaemonRenewalLease());
         }
-        await this.releaseOwnManagerLease();
-        // #1634: hand the renewal lease back on a clean stop so a sibling picks it up on its next pass
-        // rather than waiting out the bucket TTL. A non-owner holds no revision and this is a no-op.
-        await this.ep.releaseDaemonRenewalLease();
         // Capture BEFORE the serve loop is torn down: `stopServiceServe` clears the state, and what is
         // being asked here is "did this process register a service instance", which only the state
         // before teardown can answer. Deregistration runs AFTER the serve loop has drained, so no
         // in-flight command can write a status back onto the record it just removed.
         const registered = this.serviceServe !== undefined;
-        await this.stopServiceServe();
+        await step("stop service serve", () => this.stopServiceServe());
         // The drives AFTER the serve loop (no new `run-start` can land) and BEFORE deregistration: a
         // released run's status write is the last thing this incarnation says about it.
-        await this.runHosting?.stop();
+        await step("stop run hosting", () => this.runHosting?.stop());
         this.runHosting = undefined;
-        if (registered)
-            await this.deregisterServiceOnStop();
-        await this.stopGoalWriter();
-        await this.stopSessionPlane();
-        await this.ep.stop();
-        await this.attach.stop();
+        if (registered && !seatFailure)
+            await step("deregister service", () => this.deregisterServiceOnStop());
+        await step("stop goal writer", () => this.stopGoalWriter());
+        await step("stop session plane", () => this.stopSessionPlane());
+        await step("stop endpoint", () => this.ep.stop());
+        await step("stop attach endpoint", () => this.attach.stop());
+        const also = failures.length ? `; teardown also failed: ${failures.join("; ")}` : "";
+        if (seatFailure)
+            throw new Error(`${seatFailure.message}${also}`);
         if (releaseFailures.length)
-            throw new Error(`manager shutdown could not release every detachable seat: ${releaseFailures.join("; ")}`);
+            throw new Error(`manager shutdown could not release every detachable seat: ${releaseFailures.join("; ")}${also}`);
+        if (failures.length)
+            throw new Error(`manager shutdown incomplete: ${failures.join("; ")}`);
     }
     /** Release this instance's liveness lease key on a clean stop, at the broker's own revision
      *  rather than a cached one that a renew still in flight moments ago may have already moved past.
@@ -2329,37 +2499,9 @@ export class Manager {
             throw new EpEnvelopeError("permission-denied", `an any-mode ${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`);
         return true;
     }
-    /** The v0.4 typed command table (P2 item 1, slice 1b): every ordinary handler runs the SHARED
-     *  admission chokepoint ({@link serveGated}) and then delegates to the SAME op core the ctl
-     *  door dispatches (checklist 8: one core, two thin doors). The resume/preservation family
-     *  deliberately BYPASSES serveGated — exactly as it sits before {@link admitControl} on the ctl
-     *  door (those ops must run while `resumeRequired` fences ordinary work) — riding its own state
-     *  fences; its ep gate is the admin-grade `manager.admin` capability grant (the 1b rule: static
-     *  admin-class commands are capability-gated + untargeted, never a fabricated ledger mode).
-     *
-     *  TIER SEMANTICS on the ep door (the 1c grant-migration table): the tier lives in the CALLER'S
-     *  GRANT, refined per-op exactly as the ctl doors refine their subject tier. Owner-mode
-     *  `despawn`/`attach` keep the privileged semantics (`admin=false`, own-domain via
-     *  {@link authorizeNamed}) — every spawn-capable agent holds those rows. ANY-mode requests are
-     *  the operator instrument's cross-agent reach (rev 3): the any-mode subject row is mintable
-     *  only under operator policy (§13.2), so on a static mesh holding it IS the admin tier, and in
-     *  user mode the caller's CURRENT ledger scope must still carry `admin`
-     *  ({@link epAdminReach}, the same fresh-read authority `psOwnerFilter` consults). The
-     *  `manager.admin` family (purge + the resume/preservation ops) is capability-gated at mint AND
-     *  re-checked at serve time via {@link epAdminReach} (the `adminGated` wrapper) so a user's
-     *  revoked scope demotes the next call. `launch` is OWNER-EQUALITY on this door for everyone
-     *  (freelance HIGH #2): the deploy path is its only consumer and stamps the caller's own owner,
-     *  so cross-owner launch was a ctl-tier incidental never exercised, and keying it on the actor's
-     *  ledger scope broke the deployer-view attenuation - uniform owner-equality is the safe tier.
-     *  TWO DELIBERATE NARROWINGS vs the ctl doors (NOT bit-exact parity, panel-accepted): (1)
-     *  `define-persona` is `admin=false` for everyone (own-persona discipline; no ep consumer needs
-     *  cross-owner persona writes - an operator redefines via config, not the wire), where the ctl
-     *  admin tier allowed operator cross-owner redefine; (2) launch is owner-equality-only, above.
-     *  Both are least-privilege reductions, never widenings. */
     /** The run host, or one of three refusals. A remote-authority manager holds no space signer, so
-     *  it cannot mint the per-run driver credential SPEC 14.6 requires, and hosting on any other
-     *  identity would be the fallback this tree does not take: `unimplemented`, for good. A
-     *  user-auth mesh is `unimplemented` too, for a different reason it names: a hosted run's seats
+     *  it cannot mint the per-run driver credential SPEC 14.6 requires without all four closed
+     *  host callbacks. A local user-auth mesh is `unimplemented`: a hosted run's seats
      *  are spawned, turned and despawned by a caller derived from the run id under the static
      *  owner, which the user-mode spawn door refuses (no `u_` owner), so a program would fail at
      *  its first seat; no path to `--local` is offered there since a user bearer holds no run rows
@@ -2369,9 +2511,9 @@ export class Manager {
     runHost() {
         if (this.runHosting)
             return this.runHosting;
-        if (this.remoteAuthority)
-            throw new EpEnvelopeError("unimplemented", "this manager does not host workflow runs: a remote-authority manager mints no run-driver credentials (SPEC 14.6); drive the run from a terminal with `cotal run start --local --file <program>`");
-        if (this.userMode)
+        if (this.remoteAuthority && !this.remoteAuthority.runHosting)
+            throw new EpEnvelopeError("unimplemented", "this manager does not host workflow runs: its issuing host supplied no closed run callbacks, and a remote-authority manager mints no run-driver credentials (SPEC 14.6); drive the run from a terminal with `cotal run start --local --file <program>`");
+        if (this.userMode && !this.remoteAuthority?.runHosting)
             throw new EpEnvelopeError("unimplemented", `user-auth space "${this.space}" hosts no workflow runs yet: a hosted run's seats would be spawned under the static owner, which a user mesh refuses; run programs on a static-auth mesh`);
         throw new EpEnvelopeError("unavailable", "the manager is still booting its workflow-run host; retry shortly (SPEC 14.3)");
     }
@@ -2413,6 +2555,44 @@ export class Manager {
         if (p.run !== args.runId || p.step !== args.stepKey || addressedToken !== open.token)
             throw new EpEnvelopeError("permission-denied", `run-answer is allowed to ${agent.name} only for the open pause named by its pending ask or escalation relay; ${args.runId} ${args.stepKey} is not that pause`);
     }
+    /** A baseline seat may amend only an answer recorded under its own name: it changes its own
+     *  position, never another answerer's. Explicit `run` holders and unmanaged operator instruments
+     *  keep the reach they have to answer, as {@link authorizeRunAnswer} does. */
+    authorizeRunAmend(ctx, accepted) {
+        const caller = principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
+        const agent = [...this.agents.values()].find((a) => this.managedPrincipal(a) === caller && a.lifecycleUid === ctx.subject.caller.uid);
+        if (agent === undefined || agent.launch.capabilities?.includes("run"))
+            return;
+        if (accepted.by !== agent.name)
+            throw new EpEnvelopeError("permission-denied", `run-answer amend is allowed to ${agent.name} only for an answer recorded under its own name; this step's accepted answer is ${JSON.stringify(accepted.by)}'s`);
+    }
+    /** The v0.4 typed command table (P2 item 1, slice 1b): every ordinary handler runs the SHARED
+     *  admission chokepoint ({@link serveGated}) and then delegates to the SAME op core the ctl
+     *  door dispatches (checklist 8: one core, two thin doors). The resume/preservation family
+     *  deliberately BYPASSES serveGated — exactly as it sits before {@link admitControl} on the ctl
+     *  door (those ops must run while `resumeRequired` fences ordinary work) — riding its own state
+     *  fences; its ep gate is the admin-grade `manager.admin` capability grant (the 1b rule: static
+     *  admin-class commands are capability-gated + untargeted, never a fabricated ledger mode).
+     *
+     *  TIER SEMANTICS on the ep door (the 1c grant-migration table): the tier lives in the CALLER'S
+     *  GRANT, refined per-op exactly as the ctl doors refine their subject tier. Owner-mode
+     *  `despawn`/`attach` keep the privileged semantics (`admin=false`, own-domain via
+     *  {@link authorizeNamed}) — every spawn-capable agent holds those rows. ANY-mode requests are
+     *  the operator instrument's cross-agent reach (rev 3): the any-mode subject row is mintable
+     *  only under operator policy (§13.2), so on a static mesh holding it IS the admin tier, and in
+     *  user mode the caller's CURRENT ledger scope must still carry `admin`
+     *  ({@link epAdminReach}, the same fresh-read authority `psOwnerFilter` consults). The
+     *  `manager.admin` family (purge + the resume/preservation ops) is capability-gated at mint AND
+     *  re-checked at serve time via {@link epAdminReach} (the `adminGated` wrapper) so a user's
+     *  revoked scope demotes the next call. `launch` is OWNER-EQUALITY on this door for everyone
+     *  (freelance HIGH #2): the deploy path is its only consumer and stamps the caller's own owner,
+     *  so cross-owner launch was a ctl-tier incidental never exercised, and keying it on the actor's
+     *  ledger scope broke the deployer-view attenuation - uniform owner-equality is the safe tier.
+     *  TWO DELIBERATE NARROWINGS vs the ctl doors (NOT bit-exact parity, panel-accepted): (1)
+     *  `define-persona` is `admin=false` for everyone (own-persona discipline; no ep consumer needs
+     *  cross-owner persona writes - an operator redefines via config, not the wire), where the ctl
+     *  admin tier allowed operator cross-owner redefine; (2) launch is owner-equality-only, above.
+     *  Both are least-privilege reductions, never widenings. */
     managerServiceDefs() {
         const args = (ctx) => (ctx.request.args ?? {});
         const callerOf = (ctx) => principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
@@ -2601,6 +2781,8 @@ export class Manager {
             runResume: (ctx) => this.serveGated(ctx, () => this.runHost().resume(args(ctx))),
             runAnswer: (ctx) => this.serveGated(ctx, () => {
                 const input = args(ctx);
+                if (input.amend === true)
+                    return this.runHost().amend(input, this.runAnswerer(ctx), (accepted) => this.authorizeRunAmend(ctx, accepted));
                 return this.runHost().answer(input, this.runAnswerer(ctx), (open) => this.authorizeRunAnswer(ctx, input, open));
             }),
             runStatus: (ctx) => this.serveGated(ctx, () => this.runHost().status(args(ctx))),
@@ -3035,11 +3217,6 @@ export class Manager {
             return { error: `agent auth preflight failed for "${name}": ${e.message}` };
         }
     }
-    /** Drop a live agent's slot. When `floor` is set and the agent died young (lived less than
-     *  MIN_LIFETIME), push a cooling stamp so the freed slot still counts toward the ceiling until it
-     *  expires — flooring the RECYCLE, not the call, so both free paths (despawn + exit/reap) are
-     *  covered (P4c). Floor self + own-child despawn and natural exit; NEVER admin despawn (operator
-     *  emergency-kill stays unthrottled) and NEVER the reserved-rollback path (no cold-start paid). */
     /**
      * WHY A SEAT LEFT — one line, at the one place every free path passes through.
      *
@@ -3062,7 +3239,7 @@ export class Manager {
             const info = a.handle.exitInfo?.();
             detail = info === undefined
                 ? `exit detail unavailable from runtime "${a.handle.kind}"`
-                : `exit code ${info.code ?? "unknown"}${info.signal === undefined ? "" : `, signal ${info.signal}`}`;
+                : `exit code ${info.code ?? "unknown"}${info.signal === undefined ? "" : `, signal ${info.signal}`}${info.diagnostic ? `; last connector diagnostic: ${info.diagnostic}` : ""}`;
         }
         catch (e) {
             // A runtime that throws while being asked has told us something real; it must not take the
@@ -3071,6 +3248,49 @@ export class Manager {
         }
         console.error(`seat reaped: ${a.name} (${a.id}, uid ${a.lifecycleUid}${a.handle.pid !== undefined ? `, pid ${a.handle.pid}` : ""}) - ${causeText}; ${detail}`);
     }
+    /**
+     * A SEAT THAT LEAVES THE MESH WHILE ITS SLOT IS HELD GETS A LINE, AND SO DOES ITS RETURN.
+     *
+     * Seats once read `running · mesh offline` for many hours with no manager log line, so a watchdog
+     * keyed on process liveness saw nothing wrong and nobody could say when each seat dropped (#1208).
+     * The line follows the same state `ps` reads, checked on every roster change and view transition,
+     * because not every offline record arrives as a presence event: after a reconnect the fresh snapshot
+     * records an already-offline seat quietly. Only a current view is a verdict, so a stale or
+     * unpopulated one logs nothing. The match is {@link isOwnPresence}. A seat being stopped is left to
+     * the reap line. The heartbeat is the seat's own record and nothing validated it, so an unreadable
+     * one prints as unknown instead of throwing inside the watch.
+     */
+    logSeatMeshTransitions() {
+        if (typeof this.ep.presenceView === "function" && this.ep.presenceView().state !== "current")
+            return;
+        const roster = new Map(this.ep.getRoster().map((p) => [p.card.id, p]));
+        for (const a of this.agents.values()) {
+            const seen = roster.get(this.managedPrincipal(a));
+            if (a.terminalizing || !this.isOwnPresence(a, seen))
+                continue;
+            const who = `${a.name} (${a.id}, uid ${a.lifecycleUid}${a.handle.pid !== undefined ? `, pid ${a.handle.pid}` : ""})`;
+            if (seen.status === "offline" && !a.offMesh) {
+                a.offMesh = true;
+                const ts = seen.ts;
+                const last = typeof ts === "number" && !Number.isNaN(new Date(ts).getTime()) ? new Date(ts).toISOString() : "unknown";
+                console.error(`seat offline on the mesh: ${who} - last heartbeat ${last}; process ${a.handle.status()}`);
+            }
+            else if (seen.status !== "offline" && a.offMesh) {
+                a.offMesh = false;
+                console.error(`seat back on the mesh: ${who}`);
+            }
+        }
+    }
+    /** Whether a roster record is this seat's own: the readiness fence's exact principal and
+     *  incarnation, so a same-named foreign peer or an older incarnation never speaks for it (#1208). */
+    isOwnPresence(a, p) {
+        return p !== undefined && p.card.id === this.managedPrincipal(a) && p.lifecycleUid === a.lifecycleUid;
+    }
+    /** Drop a live agent's slot. When `floor` is set and the agent died young (lived less than
+     *  MIN_LIFETIME), push a cooling stamp so the freed slot still counts toward the ceiling until it
+     *  expires — flooring the RECYCLE, not the call, so both free paths (despawn + exit/reap) are
+     *  covered (P4c). Floor self + own-child despawn and natural exit; NEVER admin despawn (operator
+     *  emergency-kill stays unthrottled) and NEVER the reserved-rollback path (no cold-start paid). */
     freeSlot(a, floor, cause, acceptedBeforeFence = false) {
         if (this.agents.get(a.name) !== a)
             return; // already freed (exit raced despawn, etc.)
@@ -3101,14 +3321,14 @@ export class Manager {
         if (this.userMode) {
             const p = parsePrincipalKey(a.id);
             if (p)
-                this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: p.owner, actor: p.actor, agentId: a.id, userOwner: a.userOwner, secretPaths: a.secretPaths, startedAt: Date.now() });
+                this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: p.owner, actor: p.actor, agentId: a.id, userOwner: a.userOwner, secretPaths: a.secretPaths, launch: { allowSubscribe: a.launch.allowSubscribe }, startedAt: Date.now() });
         }
         else if (this.auth) {
             // Unit B: a STATIC lifecycle now also holds its name pending its own terminal (the F1
             // static retirement the detached deprovision below drives) — the alias frees only when the
             // gate+head terminal completes, exactly the user-mode discipline. The wire principal is the
             // incarnation-unique nkey (F5-bind); owner is the dev owner.
-            this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: DEV_OWNER, actor: a.id, agentId: a.id, secretPaths: a.secretPaths, runtime: a.handle?.reference, startedAt: Date.now() });
+            this.retiring.set(a.name, { opId: retireOpId(a.lifecycleUid), lifecycleUid: a.lifecycleUid, owner: DEV_OWNER, actor: a.id, agentId: a.id, secretPaths: a.secretPaths, launch: { allowSubscribe: a.launch.allowSubscribe }, runtime: a.handle?.reference, startedAt: Date.now() });
         }
         // Auth mode: tear down the departed agent's minted broker footprint + creds file (#159 B2). The
         // process is already gone, so this must never block the slot free or throw into the caller — it runs
@@ -3232,7 +3452,21 @@ export class Manager {
                 console.error(`revoke agent grant ${a.name}: ${e.message}`);
             }
         }
-        await this.deprovisionBroker(a);
+        try {
+            const res = await this.deprovisionBroker(a);
+            const h = this.retiring.get(a.name);
+            if (h && h.lifecycleUid === a.lifecycleUid)
+                h.lastResources = res;
+        }
+        catch (e) {
+            const h = this.retiring.get(a.name);
+            if (h && h.lifecycleUid === a.lifecycleUid) {
+                h.lastError = e.message;
+                if (e instanceof DeprovisionError)
+                    h.lastResources = e.accounting;
+            }
+            throw e;
+        }
         // #29 piece 3: after the footprint teardown, ask the AUTH plane to RETIRE the lifecycle over
         // the auth endpoint rail. The rail re-checks the SERVE-ISSUANCE GATE at serve time (not the
         // space-manager lease - that check was replaced in 02794b2f) and refuses unless the registration
@@ -3324,46 +3558,44 @@ export class Manager {
                 : await mintCreds(this.auth, requestIdentity, "retirement-requester", {
                     retirementRequester: { ...caller, target: retirementTarget },
                 });
-            const nc = await this.dial({ authenticator: credsAuthenticator(new TextEncoder().encode(creds)), maxReconnectAttempts: 0 });
+            // The requester grant subscribes `_INBOX_<id>.>` only (provision.ts): the endpoint path's
+            // JetStream API requests (the contract-store read inside resolveService) must reply under it, not under the client default `_INBOX.`.
+            const nc = await this.dial({ authenticator: credsAuthenticator(new TextEncoder().encode(creds)), inboxPrefix: `_INBOX_${requestIdentity.id}`, maxReconnectAttempts: 0 });
             try {
-                // §13.2 nonce: >=128 bits of CSPRNG entropy, base64url (the `endpoint-invoke` idiom).
-                const nonce = randomBytes(24).toString("base64url");
-                // The caller-chosen request id the reply MUST echo (the minimal correctness guard from the
-                // not-yet-migrated endpoint envelope - see the residual in the auth listener).
-                const requestId = randomBytes(16).toString("base64url");
-                const subject = epRequestSubject(this.space, {
-                    route: { mode: "one" },
-                    endpoint: AUTH_ENDPOINT,
-                    command: EP_CMD_RETIRE_LIFECYCLE,
-                    // The TARGET rides the subject (authz mode `handle`, arity 3) — broker-enforced, and
-                    // pinned by the grant minted above, so it is not a body claim the caller can vary.
-                    target: { mode: "handle", tOwner: target.owner, tActor: target.actor, tUid: a.lifecycleUid },
-                    caller,
-                    nonce,
+                // The service resolves FRESH on every attempt (never cached on `this`): a plane restart
+                // mid-despawn then lands on the new epoch through an ordinary resolve, rather than a
+                // caller pinned to a now-superseded incarnation.
+                const service = await resolveService(nc, this.space, AUTH_ENDPOINT, caller, { deadlineMs: 10_000 });
+                // The TARGET rides the invoke's own target (authz mode `exact`, arity 3) — broker-enforced,
+                // and pinned by the grant minted above, so it is not a body claim the caller can vary.
+                const attributed = await invokeCommand(nc, this.space, service, EP_CMD_RETIRE_LIFECYCLE, {
+                    opId,
+                    serveEndpoint: MANAGER_ENDPOINT, serveInstanceId: this.managerInstanceId, serveEpoch,
+                }, {
+                    target: { mode: "exact", owner: target.owner, actor: target.actor, lifecycleUid: a.lifecycleUid },
+                    deadlineMs: 20_000,
                 });
-                // The responder derives its OWN reply subject from this request (caller triple + nonce,
-                // prefixed with the RESPONDER's instance identity), so a caller-supplied `reply` header
-                // would be ignored — that is the confused-deputy boundary being structural. The caller
-                // therefore reads its own reply-plane filter and binds the answer off the reply SUBJECT.
-                const m = await epAwaitReply(nc, this.space, caller, nonce, requestId, subject, 
-                // Declare THIS manager instance's serve identity. Since #350 these SELECT the gate row;
-                // they no longer authorize — the rail refuses unless the row they name belongs to this
-                // caller's own subject-derived principal. A superseded predecessor (same instanceId, OLD
-                // epoch after a restart) is still refused by the epoch comparison.
-                JSON.stringify({ id: requestId, op: "retireLifecycle", args: {
-                        opId,
-                        serveEndpoint: MANAGER_ENDPOINT, serveInstanceId: this.managerInstanceId, serveEpoch,
-                    } }), 20_000);
-                const r = m;
+                const r = attributed.reply;
                 if (r.ok) {
                     this.confirmRetirement(a);
                 }
+                else if (r.error?.code === "expired") {
+                    // A stale-epoch refusal: the responder answered, but at another epoch than this resolve
+                    // bound (a plane restart mid-despawn landed on the new epoch) - the retry copy, never a
+                    // hard despawn failure line, since a same-name spawn (or the auth service's own boot
+                    // resume) re-drives the same teardown.
+                    const copy = uncertain(r.error.message);
+                    if (held)
+                        held.lastError = copy;
+                    console.error(`despawn ${a.name}: ${copy}`);
+                }
                 else {
                     // The rail's refusal is already the operator copy (lease-loss/stale/foreign-op faces,
                     // full-no-op statements included) - surface it INTACT, never flattened.
+                    const message = r.error?.message ?? "the auth service refused the retirement without a reason";
                     if (held)
-                        held.lastError = r.error ?? "the auth service refused the retirement without a reason";
-                    console.error(`despawn ${a.name}: ${r.error ?? "the auth service refused the retirement without a reason"}`);
+                        held.lastError = message;
+                    console.error(`despawn ${a.name}: ${message}`);
                 }
             }
             finally {
@@ -3414,13 +3646,59 @@ export class Manager {
         // LIFECYCLE-PINNED (SPEC 13.1): both the credential's exact-name grants and the delete names
         // carry a.lifecycleUid, so a stale/replayed teardown for this retired incarnation is broker-denied
         // against a same-name successor's footprint (its names embed a different uid).
+        // Durable membership rows are lifecycle-keyed per concrete channel. Start with the launch's
+        // concrete read channels, then include wildcard-covered and unnamed channels from the inventory.
+        const memberChannels = new Set((a.launch?.allowSubscribe ?? []).filter(isConcreteChannel));
+        // Complete the set from the delivery daemon's lifecycle-exact inventory, which covers rows on
+        // wildcard-granted channels and teardowns that carry no launch spec. An inventory that cannot be
+        // read leaves those rows RETAINED and says so; it never widens the delete beyond exact keys.
+        const inventory = await this.lifecycleMembershipInventory(a);
+        for (const ch of inventory.channels)
+            memberChannels.add(ch);
+        if (!inventory.complete)
+            console.error(`deprovision ${a.name} (${a.id}): membership inventory incomplete (${inventory.reason}); rows on channels outside its launch policy stay RETAINED for uid ${a.lifecycleUid}`);
         const creds = await mintCreds(this.auth, newIdentity(), "deprovisioner", {
-            deprovisionTarget: { principal: a.id, lifecycleUid: a.lifecycleUid },
+            deprovisionTarget: { principal: a.id, lifecycleUid: a.lifecycleUid, memberChannels: [...memberChannels] },
         });
         // Bound the detached broker teardown so a wedged broker can't leave the deprovision promise pending
         // forever with no log — the timeout rejects into freeSlot's fail-loud `.catch` (paired with the
         // helper's own fail-fast connect). The durables/ACL row still fall to space teardown as a backstop.
-        await withTimeout(deprovisionAgent({ servers: this.servers ?? DEFAULT_SERVER, space: this.space, targetId: a.id, lifecycleUid: a.lifecycleUid, creds }), DEPROVISION_TIMEOUT_MS, `deprovision ${a.name} (${a.id}): broker teardown timed out`);
+        let accounting;
+        try {
+            accounting = await withTimeout(deprovisionAgent({
+                servers: this.servers ?? DEFAULT_SERVER,
+                space: this.space,
+                targetId: a.id,
+                lifecycleUid: a.lifecycleUid,
+                memberChannels: [...memberChannels],
+                creds,
+            }), DEPROVISION_TIMEOUT_MS, `deprovision ${a.name} (${a.id}): broker teardown timed out`);
+            this.lastDeprovisionResources = accounting;
+        }
+        catch (e) {
+            if (e instanceof DeprovisionError) {
+                this.lastDeprovisionResources = e.accounting;
+            }
+            throw e;
+        }
+        if (!inventory.complete)
+            throw new Error(`membership inventory incomplete (${inventory.reason}); rows on channels outside its launch policy stay RETAINED for uid ${a.lifecycleUid}`);
+        return accounting;
+    }
+    /** The retiring lifecycle's durable membership channels, read from the delivery daemon's
+     *  `lifecycleMemberships` admin verb (read-only, lifecycle-exact). Incomplete on any refusal. */
+    async lifecycleMembershipInventory(a) {
+        const t = deprovisionTargetPrincipal({ principal: a.id, lifecycleUid: a.lifecycleUid });
+        try {
+            const r = await this.ep.requestDeliveryAdmin("lifecycleMemberships", { principal: principalKey(t.owner, t.actor).key, lifecycleUid: t.lifecycleUid }, 5_000);
+            const data = r.data;
+            if (!r.ok || data?.complete !== true || !Array.isArray(data.channels) || !data.channels.every((c) => typeof c === "string" && isConcreteChannel(c)))
+                return { complete: false, channels: [], reason: r.ok ? "malformed inventory reply" : (r.error ?? "refused") };
+            return { complete: true, channels: data.channels };
+        }
+        catch (e) {
+            return { complete: false, channels: [], reason: e.message };
+        }
     }
     /** Reap a parent's children on its exit (P4b). Every descendant remains managed until the runtime's
      * authoritative wait proves exit; the wait participates in the lifecycle drain, so preservation can
@@ -3471,6 +3749,28 @@ export class Manager {
                 `(${error.message}). Reload the live Pi seat before the preservation cut; refusing to resume fresh and lose its context.`);
         }
     }
+    /** A resumed seat's fork provenance (#1500). The seat forks after it launches, so this reads the
+     *  record its connector named once the seat has written it, and keeps it on the launch so the
+     *  resume document carries it across a manager restart. Until the seat has written it, or when the
+     *  record cannot be read or does not name this seat's source, it is absent: `ps` then shows the
+     *  source id alone rather than failing the listing for every other seat. */
+    forkProvenance(a) {
+        if (a.launch.resumed || !a.launch.resumeRecordPath || !a.launch.forkSource)
+            return a.launch.resumed;
+        let record;
+        try {
+            record = JSON.parse(readFileSync(a.launch.resumeRecordPath, "utf8"));
+        }
+        catch {
+            return undefined;
+        }
+        const r = (typeof record === "object" && record !== null ? record : {});
+        if (r.source !== a.launch.forkSource || typeof r.transcriptSha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.transcriptSha256) ||
+            !(r.title === undefined || r.title === null || (typeof r.title === "string" && r.title.length <= 1024)))
+            return undefined;
+        a.launch.resumed = { source: r.source, ...(typeof r.title === "string" && r.title ? { title: r.title } : {}), transcriptSha256: r.transcriptSha256 };
+        return a.launch.resumed;
+    }
     readManagedSession(a) {
         return this.readManagedSessionState(a).sessionId;
     }
@@ -4181,9 +4481,9 @@ export class Manager {
         // SYNCHRONOUS (existsSync / registry / accessSync / readFileSync — no await), so the gate stays
         // atomic: the capacity snapshot and the reserve land in one tick (P4a/P4c), and two concurrent
         // spawns can't overshoot the ceiling or pick the same name.
-        const cooling = this.coolingCount(); // prune expired stamps, then count live cooling slots
-        if (this.agents.size + this.reserved.size + cooling >= MAX_AGENTS)
-            return { ok: false, error: `at capacity (${MAX_AGENTS} agents incl. in-flight + cooling); despawn one or wait` };
+        const occupancy = this.occupancy(); // prunes expired cooling stamps; counts each name once
+        if (occupancy.used >= MAX_AGENTS)
+            return { ok: false, error: this.capacityRefusal(occupancy) };
         // Harness preflight before reserving a slot or minting — a missing `claude`/`opencode` binary
         // fails here with a clear name, not obscurely at process spawn. No fallback. All synchronous, so
         // the reserve gate stays atomic. (The connector itself was resolved up top, before the capacity gate.)
@@ -4328,7 +4628,7 @@ export class Manager {
             return { ok: false, error: `the name "${identityName}" is still reconciling at manager startup; its prior lifecycle terminal owns this alias until it completes. Retry shortly.` };
         const held = this.retiring.get(identityName);
         if (held !== undefined) {
-            void this.deprovision({ id: held.agentId, name: identityName, lifecycleUid: held.lifecycleUid, userOwner: held.userOwner, secretPaths: held.secretPaths }).catch(() => { });
+            void this.deprovision({ id: held.agentId, name: identityName, lifecycleUid: held.lifecycleUid, userOwner: held.userOwner, secretPaths: held.secretPaths, launch: held.launch }).catch(() => { });
             const err = lifecycleBlocked("failed-precondition", `the name "${identityName}" is reserved pending retirement: its previous agent's despawn started that lifecycle's teardown (footprint + standing-authority revoke + auth-side retirement), and the name frees only when all of it completes${held.lastError !== undefined ? ` (last attempt: ${held.lastError})` : ""}. NEXT: wait a moment and retry this spawn (retrying re-drives the whole teardown), or pick another name.`, { blockedOp: "retirement", headState: "retiring", opId: held.opId, remedy: "retry" });
             return { ok: false, error: renderLifecycleBlocked(err.message, err), details: err.details };
         }
@@ -4673,6 +4973,7 @@ export class Manager {
                     events,
                     shareTools: opts.shareTools,
                     forkSource: opts.resume,
+                    ...(opts.resume !== undefined && spec.resumeRecordPath ? { resumeRecordPath: spec.resumeRecordPath } : {}),
                     // Opaque values may contain secrets. Preserve only their keys and require the referenced
                     // persona/manifest to resolve the values again; imperative overrides have no safe payload.
                     unresolvedLaunchOptionKeys: opts.launchOptions && Object.keys(opts.launchOptions).length
@@ -4707,6 +5008,7 @@ export class Manager {
                 });
             }
             this.agents.set(name, managed);
+            this.reservedLive.add(name);
             // The live slot now owns teardown — freeSlot deprovisions this identity on exit — so the
             // orphan-rollback in `finally` no longer applies to it.
             provisioned = undefined;
@@ -4776,6 +5078,7 @@ export class Manager {
         }
         finally {
             this.reserved.delete(name);
+            this.reservedLive.delete(name);
             // Minted but never handed to a live slot (buildLaunch / runtime.spawn threw after mint) → tear the
             // orphan down (detached, fail-loud) so a failed spawn leaves no creds/durables behind (#159 B).
             if (provisioned) {
@@ -4792,6 +5095,7 @@ export class Manager {
         if (!release)
             return { ok: false, agents: [], error: this.maintenanceError() };
         const batchReservations = [];
+        const prepared = new Map();
         try {
             if (inventory.version !== "cotal-manager-resume/v1")
                 return { ok: false, agents: [], error: `unsupported manager resume inventory version ${String(inventory.version)}` };
@@ -4801,8 +5105,9 @@ export class Manager {
             const principals = new Set();
             await this.ep.waitForPresenceSnapshot();
             const liveRoster = this.ep.getRoster().filter((presence) => presence.status !== "offline");
-            if (this.agents.size + this.reserved.size + this.coolingCount() + inventory.agents.length > MAX_AGENTS)
-                return { ok: false, agents: [], error: `resume inventory would exceed manager capacity (${MAX_AGENTS})` };
+            const occupancy = this.occupancy();
+            if (occupancy.used + inventory.agents.length > MAX_AGENTS)
+                return { ok: false, agents: [], error: `resume inventory of ${inventory.agents.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
             for (const entry of inventory.agents) {
                 if (seen.has(entry.name))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate agent name "${entry.name}"` };
@@ -4858,7 +5163,6 @@ export class Manager {
                 this.reserved.add(entry.name);
                 batchReservations.push(entry.name);
             }
-            const prepared = new Map();
             const preflight = [];
             for (const entry of inventory.agents) {
                 const reply = await this.resumePreservedAgent(entry, true, true, prepared);
@@ -4887,8 +5191,22 @@ export class Manager {
             return { ok: true, agents };
         }
         finally {
-            for (const name of batchReservations)
+            for (const name of batchReservations) {
                 this.reserved.delete(name);
+                this.reservedLive.delete(name);
+            }
+            // Preflight builds every launch before any child starts, so a refused batch, a failed launch,
+            // or the agents skipped after it leave built specs no runtime ever received.
+            for (const { spec, spawned } of prepared.values()) {
+                if (spawned)
+                    continue;
+                try {
+                    discardLaunchArtifacts(spec.artifacts);
+                }
+                catch (e) {
+                    console.error(`! resume: ${e.message}`);
+                }
+            }
             release();
         }
     }
@@ -5072,8 +5390,9 @@ export class Manager {
                 return { ok: false, error: nameErr };
             if (this.agents.has(entry.name) || (!batchReserved && this.reserved.has(entry.name)))
                 return { ok: false, error: `retained agent "${entry.name}" is already managed or reserved; same-principal resume never auto-numbers` };
-            if (!batchReserved && this.agents.size + this.reserved.size + this.coolingCount() >= MAX_AGENTS)
-                return { ok: false, error: `at capacity (${MAX_AGENTS} agents incl. in-flight + cooling); same-principal resume refused` };
+            const occupancy = batchReserved ? undefined : this.occupancy();
+            if (occupancy && occupancy.used >= MAX_AGENTS)
+                return { ok: false, error: `${this.capacityRefusal(occupancy)}; same-principal resume refused` };
             const cached = prepared?.get(entry.name);
             if (!preflightOnly && cached) {
                 try {
@@ -5232,6 +5551,7 @@ export class Manager {
             const custody = this.reserveCustody();
             if (custody)
                 await this.recordSlotCustody({ name: entry.name, id: resumeId, lifecycleUid: entry.identity.lifecycleUid }, custody);
+            prepared.spawned = true;
             const handle = await this.spawnCustodied(entry.name, prepared.spec, entry.launch.cwd, custody);
             const managed = {
                 name: entry.name,
@@ -5268,6 +5588,8 @@ export class Manager {
                     events: entry.launch.events,
                     shareTools: entry.launch.shareTools,
                     forkSource: entry.launch.forkSource,
+                    ...(entry.launch.resumed ? { resumed: entry.launch.resumed } : {}),
+                    ...(prepared.launchOpts.resume !== undefined && prepared.spec.resumeRecordPath ? { resumeRecordPath: prepared.spec.resumeRecordPath } : {}),
                     sessionId: entry.launch.sessionId,
                 },
                 ...(prepared.spec.sessionStatePath
@@ -5276,6 +5598,7 @@ export class Manager {
                 suppressCleanup: true,
             };
             this.agents.set(entry.name, managed);
+            this.reservedLive.add(entry.name);
             if (this.resumeAttemptId)
                 this.resumedAgentNames.add(entry.name);
             await this.recordSlotRuntime(managed);
@@ -5312,8 +5635,10 @@ export class Manager {
             return { ok: false, error: e.message };
         }
         finally {
-            if (!batchReserved)
+            if (!batchReserved) {
                 this.reserved.delete(entry.name);
+                this.reservedLive.delete(entry.name);
+            }
         }
     }
     probeStaticCredential(creds) {
@@ -5517,6 +5842,48 @@ export class Manager {
         this.cooling = this.cooling.filter((stamp) => stamp > now);
         return this.cooling.length;
     }
+    /** What holds the ceiling's slots, one count per seat (#906). A launching seat sits in `reserved`
+     *  from accept until its launch settles, in `agents` once its process exists, and in `cooling`
+     *  if it then frees young, so a reservation stops counting once it reaches `agents`. `managed` is
+     *  what this manager's `ps` lists, `reserved` is the accepted launches that have no process yet,
+     *  and `launching` is every unsettled launch that still holds a slot through `reserved` or
+     *  `agents`. A launch whose seat already freed holds no slot but its cooling stamp, so its
+     *  failure can free nothing. */
+    occupancy() {
+        const cooling = this.coolingCount();
+        let reserved = 0;
+        let launching = 0;
+        for (const name of this.reserved) {
+            const placed = this.reservedLive.has(name);
+            if (!placed)
+                reserved++;
+            if (!placed || this.agents.has(name))
+                launching++;
+        }
+        const managed = this.agents.size;
+        return {
+            managed,
+            reserved,
+            cooling,
+            launching,
+            used: managed + reserved + cooling,
+            nextCoolingMs: cooling ? Math.min(...this.cooling) - Date.now() : undefined,
+        };
+    }
+    occupancyText(o) {
+        return `${o.used} of ${MAX_AGENTS} slots: ${o.managed} managed, ${o.reserved} reserved, ${o.cooling} cooling`;
+    }
+    /** The capacity refusal states the split it enforces and whether waiting can free a slot: a
+     *  cooling slot frees at a known time, an unsettled launch frees one only if it fails, and a
+     *  managed seat frees one only when it is stopped. */
+    capacityRefusal(o) {
+        const remedy = o.nextCoolingMs !== undefined
+            ? `waiting frees a cooling slot in ${Math.ceil(o.nextCoolingMs / 1000)}s, or despawn one`
+            : o.launching
+                ? `waiting frees a slot only if an unsettled launch fails (${o.launching} pending); otherwise despawn one`
+                : "waiting frees no slot; despawn one";
+        return `at capacity (${this.occupancyText(o)}); ${remedy}`;
+    }
     async opStop(args, caller, admin) {
         const name = String(args.name ?? "").trim();
         const a = this.agents.get(name);
@@ -5623,8 +5990,14 @@ export class Manager {
      *  This is NEVER the manager's standing seed/supervisor connection. */
     async withEndpointServeExecutor(fn) {
         const identity = this.remoteAuthority?.identities.executor ?? newIdentity();
-        if (this.remoteAuthority && (!this.remoteExecutorCreds || inspectCredHealth(this.remoteExecutorCreds).state !== "healthy"))
-            await this.renewRemoteExecutor(true);
+        if (this.remoteAuthority && (!this.remoteExecutorCreds || inspectCredHealth(this.remoteExecutorCreds).state !== "healthy")) {
+            // Shutdown has drained and discarded the standing serve context. Renew only its scoped
+            // maintenance executor through the existing host operation; never resurrect standing duties.
+            if (this.leaseStopping)
+                await this.renewRemoteExecutor(true);
+            else
+                await (this.remoteAuthority.renewStandingBundle ? this.renewRemoteStandingBundle(true) : this.renewRemoteExecutor(true));
+        }
         const creds = this.remoteExecutorCreds ?? (this.auth
             ? await mintCreds(this.auth, identity, "endpoint-serve-executor", {
                 endpointServeExecutor: { endpoint: MANAGER_ENDPOINT, instanceId: this.managerInstanceId },
@@ -5670,7 +6043,7 @@ export class Manager {
         return {
             instanceId: this.managerInstanceId,
             runtime: this.runtime.kind,
-            custody: process.platform === "linux" && this.runtime.kind === "pty" ? "custodied" : "legacy",
+            custody: this.runtime.kind === "pty" && this.runtime.supportsRelease === true ? "custodied" : "legacy",
             agentCount: this.agents.size,
             uptimeMs: Date.now() - this.startedAtMs,
             connectors: this.connectorStatuses.map((row) => ({ ...row, binaries: { ...row.binaries } })),
@@ -5721,7 +6094,7 @@ export class Manager {
             report = await reconcileEndpointGate({
                 kv: authKv, space: this.space, endpoint: MANAGER_ENDPOINT, instanceId,
                 probeHolder: makeManagerHolderLivenessProbe({ space: this.space, servers, auth, log }),
-                evict: makeManagerEndpointEvictor({ space: this.space, servers, auth, log }),
+                evictHolders: makeManagerEndpointHolderEvictor({ space: this.space, servers, auth, log }),
                 log,
                 recordsKv,
             });
@@ -5755,7 +6128,17 @@ export class Manager {
             inboxPrefix: `_INBOX_${state.identity.id}`,
             maxReconnectAttempts: -1,
         });
-        nc.closed().then((err) => { void this.onServeConnectionClosed(err ?? undefined); });
+        // Track the transport from the first moment: nats.js reports `disconnect` when the socket
+        // drops and `reconnect` only after it has re-sent this connection's subscriptions. If the
+        // status stream itself fails, the transport can no longer be observed, so it counts as down.
+        void (async () => {
+            for await (const st of nc.status()) {
+                if (st.type === "disconnect")
+                    this.serveTransportDown.add(nc);
+                else if (st.type === "reconnect")
+                    this.serveTransportDown.delete(nc);
+            }
+        })().catch(() => this.serveTransportDown.add(nc));
         let handle;
         try {
             // The 1b typed surface + the derived `describe`. The descriptor stays PUBLIC in static
@@ -5770,6 +6153,13 @@ export class Manager {
                 // durable slot rows mirror it). Static mode carries no mapping-revision dimension, so
                 // the revision is the constant 0 — a caller that pins a revision pins 0.
                 resolveTarget: (t) => {
+                    if (this.remoteAuthority) {
+                        const key = principalKey(t.owner, t.actor).key;
+                        for (const a of this.agents.values())
+                            if (a.id === key)
+                                return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
+                        return undefined;
+                    }
                     if (t.owner === DEV_OWNER) {
                         for (const a of this.agents.values())
                             if (!a.userOwner && a.id === t.actor)
@@ -5789,6 +6179,9 @@ export class Manager {
             await nc.drain().catch(() => nc.close());
             throw e;
         }
+        // Wired only once the connection serves: a connection this method drains itself after a
+        // refused serve is not a fault to recover, and the caller already sees the refusal.
+        nc.closed().then((err) => { void this.onServeConnectionClosed(err ?? undefined); });
         return { nc, handle };
     }
     /** #2073: re-mint the SAME `endpoint-serve` identity through the SAME scoped one-shot executor and
@@ -5823,7 +6216,9 @@ export class Manager {
         const recovered = await this.boundedReconnect("service endpoint", async () => {
             if (!s)
                 return false;
-            if (inspectCredHealth(s.creds ?? "").state !== "healthy" && s.creds !== undefined) {
+            if (this.remoteAuthority)
+                await this.renewRemoteBeforeRedial("serve", () => s.creds);
+            else if (inspectCredHealth(s.creds ?? "").state !== "healthy" && s.creds !== undefined) {
                 s.creds = await this.remintServeCreds(s);
                 this.scheduleServeRenewal(s.creds);
             }
@@ -5867,28 +6262,9 @@ export class Manager {
                 grant: remote.serveGrant,
                 creds: remote.serveCreds,
             };
-            const enc = new TextEncoder();
-            const nc = await this.dial({
-                authenticator: (nonce) => credsAuthenticator(enc.encode(state.creds))(nonce),
-                inboxPrefix: `_INBOX_${state.identity.id}`,
-                maxReconnectAttempts: -1,
-            });
-            try {
-                state.handle = serveEndpoint(nc, this.space, state.grant, this.managerServiceDefs(), { public: true }, {
-                    resolveTarget: (t) => {
-                        const key = principalKey(t.owner, t.actor).key;
-                        for (const a of this.agents.values())
-                            if (a.id === key)
-                                return { lifecycleUid: a.lifecycleUid, mappingRevision: 0 };
-                        return undefined;
-                    },
-                    ...(this.omitClassCommands() ? { omitClassCommands: this.omitClassCommands() } : {}),
-                });
-            }
-            catch (e) {
-                await nc.drain().catch(() => nc.close());
-                throw e;
-            }
+            // The shared dialer wires the closed-connection handler, which re-dials through the all-duty family.
+            const { nc, handle } = await this.dialServeConnection(state);
+            state.handle = handle;
             state.nc = nc;
             this.serviceServe = state;
             console.error(`remote manager service endpoint activated: ${MANAGER_ENDPOINT}/${this.managerInstanceId} (epoch ${state.grant.epoch})`);
@@ -6136,15 +6512,6 @@ export class Manager {
         });
         return creds;
     }
-    /** P2 item 2 (spawn-as-action): stand up the standing self-mediated goal-writer connection +
-     *  ActionContext. Mode-dual, mirroring {@link registerManagerService}: an AUTH mesh uses the
-     *  scoped `goal-writer` credential already minted + family-STAGED inside registration's run block
-     *  ({@link mintAndStageGoalWriter} — DISJOINT grant from the serve cred, SHARED §13.1 revocation
-     *  family); an OPEN mesh uses a bare connection (no credential system to mint from - the broker
-     *  enforces nothing). The connection presents the CURRENT credential on every (re)connect (a
-     *  renewal is adopted without reconnecting the whole endpoint); the ActionContext bonds its
-     *  KV + JS + JSM to this one connection and space (SPEC 13.4), so a composition mixup cannot splice
-     *  goal state across brokers. */
     /** #2073: dial the goal-writer's ONE standing connection and rebuild everything derived from it
      *  (the fence-resolving action context, the issuance-gate reader) — shared by the initial start
      *  and the closed-connection recovery ({@link onGoalWriterConnectionClosed}), so a redial never
@@ -6198,7 +6565,9 @@ export class Manager {
         const recovered = await this.boundedReconnect("goal-writer", async () => {
             if (!gw)
                 return false;
-            if (gw.creds !== undefined && inspectCredHealth(gw.creds).state !== "healthy") {
+            if (this.remoteAuthority)
+                await this.renewRemoteBeforeRedial("goal-writer", () => gw.creds);
+            else if (gw.creds !== undefined && inspectCredHealth(gw.creds).state !== "healthy") {
                 gw.creds = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageGoalWriter(authKv));
                 this.goalWriterCreds = gw.creds;
             }
@@ -6210,6 +6579,15 @@ export class Manager {
             return;
         console.error("! manager goal-writer could not be re-dialed; leaving the credential to the next renewal pass");
     }
+    /** P2 item 2 (spawn-as-action): stand up the standing self-mediated goal-writer connection +
+     *  ActionContext. Mode-dual, mirroring {@link registerManagerService}: an AUTH mesh uses the
+     *  scoped `goal-writer` credential already minted + family-STAGED inside registration's run block
+     *  ({@link mintAndStageGoalWriter} — DISJOINT grant from the serve cred, SHARED §13.1 revocation
+     *  family); an OPEN mesh uses a bare connection (no credential system to mint from - the broker
+     *  enforces nothing). The connection presents the CURRENT credential on every (re)connect (a
+     *  renewal is adopted without reconnecting the whole endpoint); the ActionContext bonds its
+     *  KV + JS + JSM to this one connection and space (SPEC 13.4), so a composition mixup cannot splice
+     *  goal state across brokers. */
     async startGoalWriter() {
         const identity = (this.auth || this.remoteAuthority) ? this.goalWriterIdentity : newIdentity();
         // The mutable holder captured by the authenticator (mirrors the serve connection): a half-TTL
@@ -6271,18 +6649,6 @@ export class Manager {
         });
         return creds;
     }
-    /** P2 item 6: stand up the ONE §13.6 session plane on its own standing connection. Mode-dual,
-     *  mirroring {@link startGoalWriter}: an AUTH mesh presents the scoped `session-ledger` cred
-     *  already minted + family-staged inside registration's run block ({@link mintAndStageSessionLedger});
-     *  an OPEN mesh uses a bare connection (no credential system to mint from). The connection presents
-     *  the CURRENT credential on every (re)connect, so a half-TTL renewal is adopted without reconnecting.
-     *
-     *  The offer SIGNER is a per-incarnation in-memory keypair: the static collapsed path mints AND
-     *  redeems the offer in one call ({@link ManagerSessionPlane.establishAttach}), so the manager
-     *  self-signs and self-verifies its own §13.6 grants and the keypair never leaves the process — a
-     *  holder never verifies the signature (it presents the grant back over the rail; the broker's
-     *  per-session caller cred is the holder's real fence). The plane's ledger lives in the DEDICATED
-     *  sessions bucket (createEndpointStreams provisioned it at registration). */
     /** #2073: dial the session-ledger's ONE standing connection — shared by the initial start and the
      *  closed-connection recovery ({@link onSessionLedgerConnectionClosed}), the same shape {@link
      *  dialGoalWriter} uses for its rail. The KV/JetStream clients the session plane opened from the
@@ -6313,7 +6679,9 @@ export class Manager {
         const recovered = await this.boundedReconnect("session-ledger", async () => {
             if (!sw || !identity)
                 return false;
-            if (sw.creds !== undefined && inspectCredHealth(sw.creds).state !== "healthy") {
+            if (this.remoteAuthority)
+                await this.renewRemoteBeforeRedial("session-ledger", () => sw.creds);
+            else if (sw.creds !== undefined && inspectCredHealth(sw.creds).state !== "healthy") {
                 sw.creds = await this.withEndpointServeExecutor(({ authKv }) => this.mintAndStageSessionLedger(authKv));
                 this.sessionLedgerCreds = sw.creds;
             }
@@ -6325,6 +6693,18 @@ export class Manager {
             return;
         console.error("! manager session-ledger could not be re-dialed; leaving the credential to the next renewal pass");
     }
+    /** P2 item 6: stand up the ONE §13.6 session plane on its own standing connection. Mode-dual,
+     *  mirroring {@link startGoalWriter}: an AUTH mesh presents the scoped `session-ledger` cred
+     *  already minted + family-staged inside registration's run block ({@link mintAndStageSessionLedger});
+     *  an OPEN mesh uses a bare connection (no credential system to mint from). The connection presents
+     *  the CURRENT credential on every (re)connect, so a half-TTL renewal is adopted without reconnecting.
+     *
+     *  The offer SIGNER is a per-incarnation in-memory keypair: the static collapsed path mints AND
+     *  redeems the offer in one call ({@link ManagerSessionPlane.establishAttach}), so the manager
+     *  self-signs and self-verifies its own §13.6 grants and the keypair never leaves the process — a
+     *  holder never verifies the signature (it presents the grant back over the rail; the broker's
+     *  per-session caller cred is the holder's real fence). The plane's ledger lives in the DEDICATED
+     *  sessions bucket (createEndpointStreams provisioned it at registration). */
     async startSessionPlane() {
         const identity = (this.auth || this.remoteAuthority) ? this.sessionLedgerIdentity : newIdentity();
         // The mutable holder captured by the authenticator (mirrors the goal-writer): a half-TTL renewal
@@ -7921,6 +8301,10 @@ export class Manager {
             finally {
                 await nc.drain().catch(() => nc.close());
             }
+            let retiredSlots = 0;
+            let preservedForeign = 0;
+            let preservedAdopted = 0;
+            let deferredSlots = 0;
             const terminalRows = [];
             for (const row of slotRows) {
                 if (row.phase === "retired") {
@@ -7928,6 +8312,7 @@ export class Manager {
                     // regardless of which instance owned it, so a sibling-retired incarnation's copied credential
                     // is refused at this control surface too. Ownership gates only the DESTRUCTIVE sweep below.
                     this.retiredPrincipals.add(principalKey(row.owner, row.actor).key);
+                    retiredSlots++;
                     continue;
                 }
                 // 3b-2 RECONCILE OWNERSHIP (multi-manager-per-space): a manager adjudicates ONLY the non-retired
@@ -7936,19 +8321,26 @@ export class Manager {
                 // hazard, now cross-instance). A legacy row (pre-3b-2, no owner recorded) predates multi-manager,
                 // so this manager is its legitimate single-manager-past successor and reconciles it. An orphaned
                 // sibling row is reclaimed only by an explicit operator CAS takeover (ruling 1), never here.
-                if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId)
+                if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId) {
+                    preservedForeign++;
                     continue;
+                }
                 // ADOPTION is genuine membership: a slot backed by a live managed agent THIS process owns
                 // at the SAME uid is never an orphan (empty at boot; exactly the adopted set at the
                 // post-adoption sweep — the fix for the F3 resume hole).
                 const live = this.agents.get(row.alias);
                 const adopted = live !== undefined && live.lifecycleUid === row.lifecycleUid;
+                if (adopted) {
+                    preservedAdopted++;
+                }
                 // Boot sweep with a resume PENDING: an active slot may yet be adopted (the resume path runs
                 // AFTER this boot sweep), so DEFER it — the post-adoption sweep terminalizes any the resume
                 // did not claim. provisioning/terminalizing NEVER defer (they are crashed operations, never
                 // an agent to adopt). At `postAdoption` (or a non-resume boot) nothing defers.
-                if (!postAdoption && row.phase === "active" && !adopted && this.resumeRequired)
+                if (!postAdoption && row.phase === "active" && !adopted && this.resumeRequired) {
+                    deferredSlots++;
                     continue;
+                }
                 if (planStaticSlotResume(row, adopted) !== "none")
                     terminalRows.push(row);
             }
@@ -7957,6 +8349,17 @@ export class Manager {
                 // alias, but the initial serial sweep must close every discovery-to-await gap up front.
                 for (const row of terminalRows)
                     this.reconcilingAliases.add(row.alias);
+                const sweepDeprovision = {
+                    examined: 0,
+                    deleted: 0,
+                    absent: 0,
+                    refused: 0,
+                    acknowledged: 0,
+                    disappeared: 0,
+                    consumers: { examined: 0, deleted: 0, absent: 0, refused: 0, acknowledged: 0, disappeared: 0 },
+                    acls: { examined: 0, deleted: 0, absent: 0, refused: 0, disappeared: 0 },
+                    members: { examined: 0, deleted: 0, absent: 0, refused: 0, disappeared: 0 },
+                };
                 for (const row of terminalRows) {
                     if (this.staticReconcileStopping)
                         break;
@@ -7976,7 +8379,33 @@ export class Manager {
                         };
                         this.staticReconcileItems.set(key, item);
                     }
+                    this.lastDeprovisionResources = undefined;
                     const succeeded = await this.attemptStaticReconcile(key, item, row);
+                    const acc = this.lastDeprovisionResources;
+                    if (acc) {
+                        sweepDeprovision.examined += acc.examined;
+                        sweepDeprovision.deleted = sweepDeprovision.deleted === null || acc.deleted === null ? null : sweepDeprovision.deleted + acc.deleted;
+                        sweepDeprovision.absent += acc.absent;
+                        sweepDeprovision.refused += acc.refused;
+                        sweepDeprovision.acknowledged += acc.acknowledged;
+                        sweepDeprovision.disappeared += acc.disappeared;
+                        sweepDeprovision.consumers.examined += acc.consumers.examined;
+                        sweepDeprovision.consumers.deleted = sweepDeprovision.consumers.deleted === null || acc.consumers.deleted === null ? null : sweepDeprovision.consumers.deleted + acc.consumers.deleted;
+                        sweepDeprovision.consumers.absent += acc.consumers.absent;
+                        sweepDeprovision.consumers.refused += acc.consumers.refused;
+                        sweepDeprovision.consumers.acknowledged += acc.consumers.acknowledged;
+                        sweepDeprovision.consumers.disappeared += acc.consumers.disappeared;
+                        sweepDeprovision.acls.examined += acc.acls.examined;
+                        sweepDeprovision.acls.deleted += acc.acls.deleted;
+                        sweepDeprovision.acls.absent += acc.acls.absent;
+                        sweepDeprovision.acls.refused += acc.acls.refused;
+                        sweepDeprovision.acls.disappeared += acc.acls.disappeared;
+                        sweepDeprovision.members.examined += acc.members.examined;
+                        sweepDeprovision.members.deleted += acc.members.deleted;
+                        sweepDeprovision.members.absent += acc.members.absent;
+                        sweepDeprovision.members.refused += acc.members.refused;
+                        sweepDeprovision.members.disappeared += acc.members.disappeared;
+                    }
                     if (succeeded)
                         sweep.succeeded++;
                     else
@@ -7984,6 +8413,18 @@ export class Manager {
                     this.reconcilingAliases.delete(row.alias);
                 }
                 sweep.completedAt = new Date().toISOString();
+                this.staticReconcileLastSweepResources = {
+                    slots: {
+                        examined: slotRows.length,
+                        retired: retiredSlots,
+                        preservedForeign,
+                        preservedAdopted,
+                        deferred: deferredSlots,
+                        terminalized: sweep.succeeded,
+                        failed: sweep.failed,
+                    },
+                    deprovision: sweepDeprovision,
+                };
                 for (const row of terminalRows) {
                     const key = this.staticReconcileKey(row);
                     const item = this.staticReconcileItems.get(key);
@@ -8404,8 +8845,9 @@ export class Manager {
             throw e;
         }
     }
-    /** Managed agents cross-referenced with live presence (the manager sees the roster). */
-    /** `ownerFilter`: restrict to agents whose spawn-time stored `userOwner` equals it (the ps/status
+    /** Managed agents cross-referenced with live presence (the manager sees the roster).
+     *
+     *  `ownerFilter`: restrict to agents whose spawn-time stored `userOwner` equals it (the ps/status
      *  owner-domain bound); undefined = unbounded. {@link NO_OWNER_MATCHES} matches nothing. */
     list(ownerFilter) {
         const roster = new Map(this.ep.getRoster().map((p) => [p.card.name, p]));
@@ -8427,8 +8869,33 @@ export class Manager {
                 : undefined;
             // The connector-reported provider from presence (#785): the live roster card's `meta.provider`,
             // when it is a non-empty string. Absent when the connector reported none — never fabricated.
-            const providerMeta = roster.get(a.name)?.card.meta?.provider;
+            const seen = roster.get(a.name);
+            const providerMeta = seen?.card.meta?.provider;
             const provider = typeof providerMeta === "string" && providerMeta ? providerMeta : undefined;
+            // The harness-reported condition beside the mesh status (#618): a turn that died upstream reads
+            // `waiting` with `rate_limit` here, not a bare `waiting`. Absent when the connector reported none.
+            // Projected field by field like `provider`: a malformed peer row must not fail this reply's schema.
+            const reported = roster.get(a.name)?.condition;
+            const condition = reported && typeof reported.code === "string" && reported.code
+                ? {
+                    code: reported.code,
+                    ...(typeof reported.source === "string" ? { source: reported.source } : {}),
+                    ...(typeof reported.message === "string" ? { message: reported.message } : {}),
+                    ...(typeof reported.since === "number" && Number.isFinite(reported.since) ? { since: reported.since } : {}),
+                }
+                : undefined;
+            // The seat's last harness-reported work progress (#618). `ts` is only its heartbeat, so a turn
+            // that stopped advancing reads as an old `activeAt` beside a live process. Absent when none was reported.
+            const activeAtReported = roster.get(a.name)?.activeAt;
+            const activeAt = typeof activeAtReported === "number" && Number.isFinite(activeAtReported) ? activeAtReported : undefined;
+            // How long an offline verdict has stood (#1208): the seat's last heartbeat before it went
+            // offline. Only beside a verdict, since a stale or unpopulated view dates nothing, only from the
+            // seat's own record, since `seen` is matched by name and a same-named foreign peer or an older
+            // incarnation must not date this seat, and only when the seat's unvalidated `ts` fits the row
+            // schema, so one odd record cannot fail the reply.
+            const offlineSince = view.state === "current" && this.isOwnPresence(a, seen) && seen.status === "offline" && Number.isSafeInteger(seen.ts) && seen.ts >= 0
+                ? seen.ts
+                : undefined;
             return {
                 name: a.name,
                 // The spawned agent's id (nkey, or the user-mode principal) — lets an operator tool (e.g.
@@ -8441,10 +8908,13 @@ export class Manager {
                 mode: a.handle.kind,
                 status: a.handle.status(),
                 uptimeMs: Date.now() - a.startedAt,
-                mesh: roster.get(a.name)?.status ?? "absent",
+                mesh: seen?.status ?? "absent",
+                ...(condition ? { condition } : {}),
+                ...(activeAt !== undefined ? { activeAt } : {}),
                 // `current` is the only state in which `mesh` is a verdict; the other two are the
                 // observer's own condition and travel on the row (older CLIs ignore the field).
                 meshView: view.state,
+                ...(offlineSince !== undefined ? { offlineSince } : {}),
                 // The incarnation coordinate (SPEC 13.1) — with `id`, exactly what a v0.4 caller needs to
                 // build a targeted (`despawn`/`attach`) request against THIS incarnation.
                 lifecycleUid: a.lifecycleUid,
@@ -8460,6 +8930,9 @@ export class Manager {
                 spawner: a.spawner,
                 instanceId: this.managerInstanceId,
                 host: hostname(),
+                // #1500: the session a `--resume` seat forked, with its title and transcript hash once the
+                // seat has recorded them.
+                ...(a.launch.forkSource ? { resume: this.forkProvenance(a) ?? { source: a.launch.forkSource } } : {}),
                 ...(health && health.state !== "ok" ? { authHealth: health.state, authReason: health.reason } : {}),
             };
         });