@cotal-ai/manager 0.58.0 → 0.60.0

package/dist/manager.js

@@ -4,14 +4,14 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import { CotalEndpoint, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
-import { makeManagerEndpointEvictionEvidence, makeManagerEndpointEvictor } from "./endpoint-evict.js";
+import { makeManagerEndpointEvictionEvidence, makeManagerEndpointEvictor, makeManagerEndpointHolderEvictor } from "./endpoint-evict.js";
 import { makeManagerHolderLivenessProbe } from "./holder-liveness.js";
 import { GateReconcileRefused, reconcileEndpointGate } from "./reconcile-gate.js";
-import { launchSpecForRun, materializePersona, launchAgentToStartOpts, parseLaunchSpec, persistLaunchSpec } from "./launch.js";
+import { launchSpecForRun, materializePersona, launchAgentToStartOpts, parseLaunchSpec, persistLaunchSpec, readContinuityAssignment, writeContinuityAssignment } from "./launch.js";
 import { authorizeLaunch, authorizeNamedControl } from "./authorize.js";
 import { controlShutdown } from "./control-shutdown.js";
 import { RunHosting } from "./run-hosting.js";
@@ -197,12 +197,6 @@ function parseTurnNote(raw) {
 function turnHoldToken(goalId) {
     return createHash("sha256").update(`${goalId}:turn-deadline`, "utf8").digest("base64url").slice(0, 43);
 }
-/**
- * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
- * It serves control requests on the "manager" service and spawns/kills agents
- * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
- * mesh traffic — terminal I/O streams over its own attach endpoint instead.
- */
 /**
  * Event channels in `channels` that do NOT belong to `{owner, actor}`.
  *
@@ -243,6 +237,12 @@ function isAbsentDeliveryAdmin(msg) {
         return false;
     return /no responders|\b503\b/i.test(msg);
 }
+/**
+ * The agent supervisor: a long-lived mesh node that owns agent process lifecycle.
+ * It serves control requests on the "manager" service and spawns/kills agents
+ * through a pluggable {@link Runtime} (pty by default). It does NOT proxy agent
+ * mesh traffic — terminal I/O streams over its own attach endpoint instead.
+ */
 export class Manager {
     space;
     servers;
@@ -268,8 +268,13 @@ export class Manager {
     endpointServeExecutorExpiresInSeconds;
     agents = new Map();
     /** Names whose spawn is in flight (reserved synchronously before the provision await) — counted
-     *  toward the ceiling so two concurrent same-name spawns can't both pass the gate (P4a). */
+     *  toward the ceiling (once per name, see {@link Manager.occupancy}) so two concurrent same-name
+     *  spawns can't both pass the gate (P4a). */
     reserved = new Set();
+    /** Reserved names whose launch already put its seat in `agents`. The name stays reserved until
+     *  the launch settles, so no other spawn can take it, but the ceiling counts that seat through
+     *  `agents` and, if it frees young, its cooling stamp, never through the reservation (#906). */
+    reservedLive = new Set();
     /** Expiry stamps (`startedAt + MIN_LIFETIME`) for slots that freed while still young — a
      *  count-only, lazily-pruned recycle floor (P4c). Pruned + summed into the ceiling gate. */
     cooling = [];
@@ -321,6 +326,11 @@ export class Manager {
      *  every (re)connect, so a renewal is adopted without re-registration). Absent on open meshes,
      *  in user mode (the named 1a follow-up), and before registration completes. */
     serviceServe;
+    /** #1577: serve connections whose transport is down while the client reconnects them. Such a
+     *  connection is open (`isClosed()` is false under unbounded reconnects) yet the broker holds
+     *  none of its rails, so the liveness responder must not grade it `bound`. Keyed by the
+     *  connection, so a re-dial that swaps in a fresh one starts from its own state. */
+    serveTransportDown = new WeakSet();
     /** P2 item 2 (spawn-as-action): the SELF-MEDIATED goal-writer connection + ActionContext — a
      *  standing connection DISJOINT from the serve credential (Q2), scoped to exactly this endpoint's
      *  goal bind/terminal facts + goal-record writes ({@link goalWriterGrants}). Auth mode mints the
@@ -375,10 +385,11 @@ export class Manager {
     /** P2 item 2 (M4): the live spawn goal ref for each managed agent name, so a despawn MID-GOAL
      *  drives the cancel path (transition -> cancel terminal). Cleared when the goal terminalizes. */
     agentGoals = new Map();
-    /** The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin): a
-     *  same-goalId retry serves the identical acceptance; cross-incarnation retries rebuild from
-     *  the goal-index entry (its acceptance floor + note). */
     /**
+     * The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin): a
+     * same-goalId retry serves the identical acceptance; cross-incarnation retries rebuild from
+     * the goal-index entry (its acceptance floor + note).
+     *
      * One entry per turn this incarnation accepted: the acceptance a duplicate submission is served
      * from, and — once the turn settles — the answer a RETRIED yield is served from.
      *
@@ -656,8 +667,8 @@ export class Manager {
             case "user":
                 return (`\`cotal actor grant <reader> --owner ${owner} --scope '' --allow-subscribe '${channel}' ` +
                     `--allow-publish ''\`, with every field spelled out: \`actor grant\` is an upsert of the ` +
-                    `WHOLE row and an omitted flag means the WIDE default (\`>\` read, \`>\` post, \`spawn,role:default\` ` +
-                    `scope), not "leave it alone".`);
+                    `WHOLE row, and an omitted flag is refused, or with \`--full\` is the WIDE default (\`>\` read, \`>\` post, \`spawn,role:default\` ` +
+                    `scope).`);
             case "static":
                 return (`\`cotal mint <reader> --profile agent --allow-subscribe ${channel} --provision\`, where there ` +
                     `is no actor ledger for \`actor grant\` to write to. The AGENT profile, not the observer ` +
@@ -804,6 +815,10 @@ export class Manager {
         const reportEndpoint = (e) => console.error(`! manager endpoint: ${e.message}`);
         this.ep.on("error", reportEndpoint);
         this.ep.on("warning", reportEndpoint);
+        // Every roster change and every view transition, so a seat that is offline in a fresh snapshot
+        // (recorded with no presence event) is logged the moment the view can support the verdict.
+        this.ep.on("roster", () => this.logSeatMeshTransitions());
+        this.ep.on("presence-view", () => this.logSeatMeshTransitions());
         await this.ep.start();
         await this.ep.setActivity(`supervisor (${this.runtime.kind})`);
         // Per-instance liveness lease (P2 item 3 — the old per-space singleton is DEMOTED per D9). Acquire
@@ -829,6 +844,31 @@ export class Manager {
         }
         this.leaseTimer = setInterval(() => { void this.renewLease(); }, MANAGER_LEASE_RENEW_MS);
         this.leaseTimer.unref?.();
+        // THE PEER-READABLE LIVENESS RESPONDER for the manager plane (#1577). Bound HERE — after the
+        // lease, before registration — precisely so it is up during the window in which the manager is
+        // NOT yet serving. A responder that only appeared once everything worked could never report the
+        // broken state it exists to report, which is the reported defect in a new place.
+        //
+        // WHAT IT GRADES is `serviceServe`, the v0.4 service endpoint's serve handle, which is assigned
+        // only after `serveEndpoint` has bound this instance's rails, AND that handle's connection. A
+        // closed serve connection holds no subscriptions, while `onServeConnectionClosed` keeps the
+        // handle through its re-dial waits, so the handle alone would answer `bound` with every rail
+        // gone. The re-dial swaps in the fresh connection and handle together, so `bound` returns only
+        // once the rails are served again. A DISCONNECTED serve connection is the same fault without the
+        // close: it reconnects without limit, so it stays open while the broker holds none of its rails,
+        // and this probe arrives on the separate supervisor connection that is still up. So the grade
+        // also requires the serve transport to be connected. That is a RESPONDER fact. It is
+        // deliberately NOT "this process is alive": this process is trivially alive whenever it answers
+        // at all, so grading on that would make the surface a `pgrep` that also lies in both directions
+        // — the exact instrument the reporter's evidence table indicts. Between lease acquisition and a
+        // successful registration the honest answer is `unbound`, and that is what a peer is told.
+        //
+        // The lease row is never consulted and never sent: presence is the whole ask, and the row
+        // carries the operator's workspace root and pid.
+        this.ep.serveLiveness("manager", () => {
+            const s = this.serviceServe;
+            return s?.handle && !s.nc.isClosed() && !this.serveTransportDown.has(s.nc) ? "bound" : "unbound";
+        });
         // Unit B (static §13.1): after this instance holds its lease, collect the durable static rows
         // now, but do not let their exact-op terminals make the whole space unreachable. The service
         // comes up below, then the sweep overlaps the remaining registration work. Two-window
@@ -1817,6 +1857,8 @@ export class Manager {
                     return { mode: "static", id: principal.actor, lifecycleUid: a.lifecycleUid, credential: { kind: "file", path: files.creds, sha256: this.fileDigestOrEmpty(files.creds) }, ...(a.issued ? { issued: a.issued } : {}) };
                 })()
                 : { mode: "open", id: principal.actor, lifecycleUid: a.lifecycleUid };
+        // A preservation cut is a stop boundary too, so a manifest launch after it reopens what a resume would.
+        this.recordContinuityAtStop(a, "preservation");
         const dependencies = [a.launch.source.configPath];
         if (a.launch.source.kind === "manifest" && a.launch.source.runId)
             dependencies.unshift(join(this.workspaceRoot, ".cotal", "run", `${a.launch.source.runId}.json`));
@@ -1839,6 +1881,7 @@ export class Manager {
                 events: a.launch.events,
                 shareTools: a.launch.shareTools,
                 forkSource: a.launch.forkSource,
+                ...(this.forkProvenance(a) ? { resumed: this.forkProvenance(a) } : {}),
                 sessionId: a.restart?.armed ? this.readManagedSession(a) : a.launch.sessionId,
                 // Additive and only when the connector supplied one. A seat with no pointer records no
                 // field, which is what keeps an older inventory and a fresh one the same document shape.
@@ -1865,6 +1908,7 @@ export class Manager {
         for (const a of managed) {
             // Free the slot + hard-stop each; `stopHandle` is best-effort (never throws — see it), so one bad
             // stop can't strand the rest, and every snapshot entry is deprovisioned below regardless.
+            this.recordContinuityAtStop(a, "shutdown");
             this.agents.delete(a.name);
             this.stopHandle(a, false);
         }
@@ -1964,38 +2008,64 @@ export class Manager {
         // revision it has since moved is a CAS the broker correctly refuses, silently, forever.
         await this.leaseRenewTask?.catch(() => { });
         let releaseFailures = [];
-        if (this.maintenanceState === "active" && !this.resumeRequired) {
-            if (options.withAgents)
-                await this.teardownManagedAgents();
-            else
-                releaseFailures = this.releaseManagedAgents();
+        let seatFailure;
+        try {
+            if (this.maintenanceState === "active" && !this.resumeRequired) {
+                if (options.withAgents)
+                    await this.teardownManagedAgents();
+                else
+                    releaseFailures = this.releaseManagedAgents();
+            }
+            else {
+                // A signal after a partial preservation must never fall back into destructive teardown.
+                await this.stopRetainedAgentsOnExit();
+            }
         }
-        else {
-            // A signal after a partial preservation must never fall back into destructive teardown.
-            await this.stopRetainedAgentsOnExit();
+        catch (e) {
+            seatFailure = e;
+        }
+        // Every step below runs even when an earlier one fails, so a failed stop still closes this
+        // process's connections and listener (#2290). Failures are collected and thrown at the end.
+        const failures = [];
+        const step = async (name, run) => {
+            try {
+                await run();
+            }
+            catch (e) {
+                failures.push(`${name}: ${e.message}`);
+            }
+        };
+        // A seat that may still be alive keeps this instance's leases and registration (see
+        // teardownManagedAgents): they lapse on their TTL instead of being handed to a successor.
+        if (!seatFailure) {
+            await step("release manager lease", () => this.releaseOwnManagerLease());
+            // #1634: hand the renewal lease back on a clean stop so a sibling picks it up on its next pass
+            // rather than waiting out the bucket TTL. A non-owner holds no revision and this is a no-op.
+            await step("release renewal lease", () => this.ep.releaseDaemonRenewalLease());
         }
-        await this.releaseOwnManagerLease();
-        // #1634: hand the renewal lease back on a clean stop so a sibling picks it up on its next pass
-        // rather than waiting out the bucket TTL. A non-owner holds no revision and this is a no-op.
-        await this.ep.releaseDaemonRenewalLease();
         // Capture BEFORE the serve loop is torn down: `stopServiceServe` clears the state, and what is
         // being asked here is "did this process register a service instance", which only the state
         // before teardown can answer. Deregistration runs AFTER the serve loop has drained, so no
         // in-flight command can write a status back onto the record it just removed.
         const registered = this.serviceServe !== undefined;
-        await this.stopServiceServe();
+        await step("stop service serve", () => this.stopServiceServe());
         // The drives AFTER the serve loop (no new `run-start` can land) and BEFORE deregistration: a
         // released run's status write is the last thing this incarnation says about it.
-        await this.runHosting?.stop();
+        await step("stop run hosting", () => this.runHosting?.stop());
         this.runHosting = undefined;
-        if (registered)
-            await this.deregisterServiceOnStop();
-        await this.stopGoalWriter();
-        await this.stopSessionPlane();
-        await this.ep.stop();
-        await this.attach.stop();
+        if (registered && !seatFailure)
+            await step("deregister service", () => this.deregisterServiceOnStop());
+        await step("stop goal writer", () => this.stopGoalWriter());
+        await step("stop session plane", () => this.stopSessionPlane());
+        await step("stop endpoint", () => this.ep.stop());
+        await step("stop attach endpoint", () => this.attach.stop());
+        const also = failures.length ? `; teardown also failed: ${failures.join("; ")}` : "";
+        if (seatFailure)
+            throw new Error(`${seatFailure.message}${also}`);
         if (releaseFailures.length)
-            throw new Error(`manager shutdown could not release every detachable seat: ${releaseFailures.join("; ")}`);
+            throw new Error(`manager shutdown could not release every detachable seat: ${releaseFailures.join("; ")}${also}`);
+        if (failures.length)
+            throw new Error(`manager shutdown incomplete: ${failures.join("; ")}`);
     }
     /** Release this instance's liveness lease key on a clean stop, at the broker's own revision
      *  rather than a cached one that a renew still in flight moments ago may have already moved past.
@@ -2432,33 +2502,6 @@ export class Manager {
             throw new EpEnvelopeError("permission-denied", `an any-mode ${ctx.subject.command} is operator reach; the caller's current ledger grant does not carry "admin" (SPEC 13.2)`);
         return true;
     }
-    /** The v0.4 typed command table (P2 item 1, slice 1b): every ordinary handler runs the SHARED
-     *  admission chokepoint ({@link serveGated}) and then delegates to the SAME op core the ctl
-     *  door dispatches (checklist 8: one core, two thin doors). The resume/preservation family
-     *  deliberately BYPASSES serveGated — exactly as it sits before {@link admitControl} on the ctl
-     *  door (those ops must run while `resumeRequired` fences ordinary work) — riding its own state
-     *  fences; its ep gate is the admin-grade `manager.admin` capability grant (the 1b rule: static
-     *  admin-class commands are capability-gated + untargeted, never a fabricated ledger mode).
-     *
-     *  TIER SEMANTICS on the ep door (the 1c grant-migration table): the tier lives in the CALLER'S
-     *  GRANT, refined per-op exactly as the ctl doors refine their subject tier. Owner-mode
-     *  `despawn`/`attach` keep the privileged semantics (`admin=false`, own-domain via
-     *  {@link authorizeNamed}) — every spawn-capable agent holds those rows. ANY-mode requests are
-     *  the operator instrument's cross-agent reach (rev 3): the any-mode subject row is mintable
-     *  only under operator policy (§13.2), so on a static mesh holding it IS the admin tier, and in
-     *  user mode the caller's CURRENT ledger scope must still carry `admin`
-     *  ({@link epAdminReach}, the same fresh-read authority `psOwnerFilter` consults). The
-     *  `manager.admin` family (purge + the resume/preservation ops) is capability-gated at mint AND
-     *  re-checked at serve time via {@link epAdminReach} (the `adminGated` wrapper) so a user's
-     *  revoked scope demotes the next call. `launch` is OWNER-EQUALITY on this door for everyone
-     *  (freelance HIGH #2): the deploy path is its only consumer and stamps the caller's own owner,
-     *  so cross-owner launch was a ctl-tier incidental never exercised, and keying it on the actor's
-     *  ledger scope broke the deployer-view attenuation - uniform owner-equality is the safe tier.
-     *  TWO DELIBERATE NARROWINGS vs the ctl doors (NOT bit-exact parity, panel-accepted): (1)
-     *  `define-persona` is `admin=false` for everyone (own-persona discipline; no ep consumer needs
-     *  cross-owner persona writes - an operator redefines via config, not the wire), where the ctl
-     *  admin tier allowed operator cross-owner redefine; (2) launch is owner-equality-only, above.
-     *  Both are least-privilege reductions, never widenings. */
     /** The run host, or one of three refusals. A remote-authority manager holds no space signer, so
      *  it cannot mint the per-run driver credential SPEC 14.6 requires without all four closed
      *  host callbacks. A local user-auth mesh is `unimplemented`: a hosted run's seats
@@ -2515,6 +2558,44 @@ export class Manager {
         if (p.run !== args.runId || p.step !== args.stepKey || addressedToken !== open.token)
             throw new EpEnvelopeError("permission-denied", `run-answer is allowed to ${agent.name} only for the open pause named by its pending ask or escalation relay; ${args.runId} ${args.stepKey} is not that pause`);
     }
+    /** A baseline seat may amend only an answer recorded under its own name: it changes its own
+     *  position, never another answerer's. Explicit `run` holders and unmanaged operator instruments
+     *  keep the reach they have to answer, as {@link authorizeRunAnswer} does. */
+    authorizeRunAmend(ctx, accepted) {
+        const caller = principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
+        const agent = [...this.agents.values()].find((a) => this.managedPrincipal(a) === caller && a.lifecycleUid === ctx.subject.caller.uid);
+        if (agent === undefined || agent.launch.capabilities?.includes("run"))
+            return;
+        if (accepted.by !== agent.name)
+            throw new EpEnvelopeError("permission-denied", `run-answer amend is allowed to ${agent.name} only for an answer recorded under its own name; this step's accepted answer is ${JSON.stringify(accepted.by)}'s`);
+    }
+    /** The v0.4 typed command table (P2 item 1, slice 1b): every ordinary handler runs the SHARED
+     *  admission chokepoint ({@link serveGated}) and then delegates to the SAME op core the ctl
+     *  door dispatches (checklist 8: one core, two thin doors). The resume/preservation family
+     *  deliberately BYPASSES serveGated — exactly as it sits before {@link admitControl} on the ctl
+     *  door (those ops must run while `resumeRequired` fences ordinary work) — riding its own state
+     *  fences; its ep gate is the admin-grade `manager.admin` capability grant (the 1b rule: static
+     *  admin-class commands are capability-gated + untargeted, never a fabricated ledger mode).
+     *
+     *  TIER SEMANTICS on the ep door (the 1c grant-migration table): the tier lives in the CALLER'S
+     *  GRANT, refined per-op exactly as the ctl doors refine their subject tier. Owner-mode
+     *  `despawn`/`attach` keep the privileged semantics (`admin=false`, own-domain via
+     *  {@link authorizeNamed}) — every spawn-capable agent holds those rows. ANY-mode requests are
+     *  the operator instrument's cross-agent reach (rev 3): the any-mode subject row is mintable
+     *  only under operator policy (§13.2), so on a static mesh holding it IS the admin tier, and in
+     *  user mode the caller's CURRENT ledger scope must still carry `admin`
+     *  ({@link epAdminReach}, the same fresh-read authority `psOwnerFilter` consults). The
+     *  `manager.admin` family (purge + the resume/preservation ops) is capability-gated at mint AND
+     *  re-checked at serve time via {@link epAdminReach} (the `adminGated` wrapper) so a user's
+     *  revoked scope demotes the next call. `launch` is OWNER-EQUALITY on this door for everyone
+     *  (freelance HIGH #2): the deploy path is its only consumer and stamps the caller's own owner,
+     *  so cross-owner launch was a ctl-tier incidental never exercised, and keying it on the actor's
+     *  ledger scope broke the deployer-view attenuation - uniform owner-equality is the safe tier.
+     *  TWO DELIBERATE NARROWINGS vs the ctl doors (NOT bit-exact parity, panel-accepted): (1)
+     *  `define-persona` is `admin=false` for everyone (own-persona discipline; no ep consumer needs
+     *  cross-owner persona writes - an operator redefines via config, not the wire), where the ctl
+     *  admin tier allowed operator cross-owner redefine; (2) launch is owner-equality-only, above.
+     *  Both are least-privilege reductions, never widenings. */
     managerServiceDefs() {
         const args = (ctx) => (ctx.request.args ?? {});
         const callerOf = (ctx) => principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
@@ -2703,6 +2784,8 @@ export class Manager {
             runResume: (ctx) => this.serveGated(ctx, () => this.runHost().resume(args(ctx))),
             runAnswer: (ctx) => this.serveGated(ctx, () => {
                 const input = args(ctx);
+                if (input.amend === true)
+                    return this.runHost().amend(input, this.runAnswerer(ctx), (accepted) => this.authorizeRunAmend(ctx, accepted));
                 return this.runHost().answer(input, this.runAnswerer(ctx), (open) => this.authorizeRunAnswer(ctx, input, open));
             }),
             runStatus: (ctx) => this.serveGated(ctx, () => this.runHost().status(args(ctx))),
@@ -3137,11 +3220,6 @@ export class Manager {
             return { error: `agent auth preflight failed for "${name}": ${e.message}` };
         }
     }
-    /** Drop a live agent's slot. When `floor` is set and the agent died young (lived less than
-     *  MIN_LIFETIME), push a cooling stamp so the freed slot still counts toward the ceiling until it
-     *  expires — flooring the RECYCLE, not the call, so both free paths (despawn + exit/reap) are
-     *  covered (P4c). Floor self + own-child despawn and natural exit; NEVER admin despawn (operator
-     *  emergency-kill stays unthrottled) and NEVER the reserved-rollback path (no cold-start paid). */
     /**
      * WHY A SEAT LEFT — one line, at the one place every free path passes through.
      *
@@ -3164,7 +3242,7 @@ export class Manager {
             const info = a.handle.exitInfo?.();
             detail = info === undefined
                 ? `exit detail unavailable from runtime "${a.handle.kind}"`
-                : `exit code ${info.code ?? "unknown"}${info.signal === undefined ? "" : `, signal ${info.signal}`}`;
+                : `exit code ${info.code ?? "unknown"}${info.signal === undefined ? "" : `, signal ${info.signal}`}${info.diagnostic ? `; last connector diagnostic: ${info.diagnostic}` : ""}`;
         }
         catch (e) {
             // A runtime that throws while being asked has told us something real; it must not take the
@@ -3173,6 +3251,49 @@ export class Manager {
         }
         console.error(`seat reaped: ${a.name} (${a.id}, uid ${a.lifecycleUid}${a.handle.pid !== undefined ? `, pid ${a.handle.pid}` : ""}) - ${causeText}; ${detail}`);
     }
+    /**
+     * A SEAT THAT LEAVES THE MESH WHILE ITS SLOT IS HELD GETS A LINE, AND SO DOES ITS RETURN.
+     *
+     * Seats once read `running · mesh offline` for many hours with no manager log line, so a watchdog
+     * keyed on process liveness saw nothing wrong and nobody could say when each seat dropped (#1208).
+     * The line follows the same state `ps` reads, checked on every roster change and view transition,
+     * because not every offline record arrives as a presence event: after a reconnect the fresh snapshot
+     * records an already-offline seat quietly. Only a current view is a verdict, so a stale or
+     * unpopulated one logs nothing. The match is {@link isOwnPresence}. A seat being stopped is left to
+     * the reap line. The heartbeat is the seat's own record and nothing validated it, so an unreadable
+     * one prints as unknown instead of throwing inside the watch.
+     */
+    logSeatMeshTransitions() {
+        if (typeof this.ep.presenceView === "function" && this.ep.presenceView().state !== "current")
+            return;
+        const roster = new Map(this.ep.getRoster().map((p) => [p.card.id, p]));
+        for (const a of this.agents.values()) {
+            const seen = roster.get(this.managedPrincipal(a));
+            if (a.terminalizing || !this.isOwnPresence(a, seen))
+                continue;
+            const who = `${a.name} (${a.id}, uid ${a.lifecycleUid}${a.handle.pid !== undefined ? `, pid ${a.handle.pid}` : ""})`;
+            if (seen.status === "offline" && !a.offMesh) {
+                a.offMesh = true;
+                const ts = seen.ts;
+                const last = typeof ts === "number" && !Number.isNaN(new Date(ts).getTime()) ? new Date(ts).toISOString() : "unknown";
+                console.error(`seat offline on the mesh: ${who} - last heartbeat ${last}; process ${a.handle.status()}`);
+            }
+            else if (seen.status !== "offline" && a.offMesh) {
+                a.offMesh = false;
+                console.error(`seat back on the mesh: ${who}`);
+            }
+        }
+    }
+    /** Whether a roster record is this seat's own: the readiness fence's exact principal and
+     *  incarnation, so a same-named foreign peer or an older incarnation never speaks for it (#1208). */
+    isOwnPresence(a, p) {
+        return p !== undefined && p.card.id === this.managedPrincipal(a) && p.lifecycleUid === a.lifecycleUid;
+    }
+    /** Drop a live agent's slot. When `floor` is set and the agent died young (lived less than
+     *  MIN_LIFETIME), push a cooling stamp so the freed slot still counts toward the ceiling until it
+     *  expires — flooring the RECYCLE, not the call, so both free paths (despawn + exit/reap) are
+     *  covered (P4c). Floor self + own-child despawn and natural exit; NEVER admin despawn (operator
+     *  emergency-kill stays unthrottled) and NEVER the reserved-rollback path (no cold-start paid). */
     freeSlot(a, floor, cause, acceptedBeforeFence = false) {
         if (this.agents.get(a.name) !== a)
             return; // already freed (exit raced despawn, etc.)
@@ -3180,6 +3301,7 @@ export class Manager {
         this.logSeatReaped(a, cause);
         a.terminalizing = true;
         this.agents.delete(a.name);
+        this.recordContinuityAtStop(a, "stop");
         if (a.restart?.sessionStatePath)
             rmSync(a.restart.sessionStatePath, { force: true });
         // P2 item 6 (pin 4): end any live §13.6 attach session bound to THIS incarnation with the honest
@@ -3631,9 +3753,49 @@ export class Manager {
                 `(${error.message}). Reload the live Pi seat before the preservation cut; refusing to resume fresh and lose its context.`);
         }
     }
+    /** A resumed seat's fork provenance (#1500). The seat forks after it launches, so this reads the
+     *  record its connector named once the seat has written it, and keeps it on the launch so the
+     *  resume document carries it across a manager restart. Until the seat has written it, or when the
+     *  record cannot be read or does not name this seat's source, it is absent: `ps` then shows the
+     *  source id alone rather than failing the listing for every other seat. */
+    forkProvenance(a) {
+        if (a.launch.resumed || !a.launch.resumeRecordPath || !a.launch.forkSource)
+            return a.launch.resumed;
+        let record;
+        try {
+            record = JSON.parse(readFileSync(a.launch.resumeRecordPath, "utf8"));
+        }
+        catch {
+            return undefined;
+        }
+        const r = (typeof record === "object" && record !== null ? record : {});
+        if (r.source !== a.launch.forkSource || typeof r.transcriptSha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.transcriptSha256) ||
+            !(r.title === undefined || r.title === null || (typeof r.title === "string" && r.title.length <= 1024)))
+            return undefined;
+        a.launch.resumed = { source: r.source, ...(typeof r.title === "string" && r.title ? { title: r.title } : {}), transcriptSha256: r.transcriptSha256 };
+        return a.launch.resumed;
+    }
     readManagedSession(a) {
         return this.readManagedSessionState(a).sessionId;
     }
+    /** Re-record an exact seat's assignment at a proven session, so crash recovery, a preserved resume
+     *  and the next manifest launch never pick different sessions. */
+    recordContinuity(a, sessionId) {
+        if (a.continuity)
+            writeContinuityAssignment(this.workspaceRoot, { ...a.continuity, sessionId });
+    }
+    /** At a stop boundary the connector's session record is the last proof of the session an exact
+     *  seat ran, including one it switched to itself. A failed write is logged; the stop goes on. */
+    recordContinuityAtStop(a, boundary) {
+        if (!a.continuity || !a.restart?.armed)
+            return;
+        try {
+            this.recordContinuity(a, this.readManagedSession(a));
+        }
+        catch (error) {
+            console.error(`! ${a.name}: continuity: exact assignment not updated at ${boundary}: ${error.message}`);
+        }
+    }
     async awaitManagedSessionState(a) {
         const deadline = Date.now() + 15_000;
         let last = "session state not written yet";
@@ -3716,8 +3878,8 @@ export class Manager {
                 const connector = await this.resolveConnector(a.agent);
                 const continueSession = connector.supportsSessionContinuation ? this.readManagedSession(a) : undefined;
                 const opts = continueSession !== undefined
-                    ? { ...restart.opts, resume: undefined, prompt: undefined, continueSession }
-                    : { ...restart.opts, resume: undefined, prompt: undefined };
+                    ? { ...restart.opts, resume: undefined, reopenSession: undefined, prompt: undefined, continueSession }
+                    : { ...restart.opts, resume: undefined, reopenSession: undefined, prompt: undefined };
                 const spec = connector.buildLaunch(opts);
                 spec.env = { ...spec.env, COTAL_MANAGER_INSTANCE: this.managerInstanceId };
                 const wanted = this.managedPrincipal(a);
@@ -3732,8 +3894,10 @@ export class Manager {
                 const handle = await this.spawnCustodied(a.name, spec, a.launch.cwd, custody);
                 replacement = handle;
                 restart.sessionStatePath = spec.sessionStatePath ?? restart.sessionStatePath;
-                if (continueSession !== undefined)
+                if (continueSession !== undefined) {
                     await this.awaitRecoveredSession(a, continueSession, handle, spec.control);
+                    this.recordContinuity(a, continueSession);
+                }
                 else {
                     const previousHandle = a.handle;
                     const previousControl = a.control;
@@ -4341,9 +4505,9 @@ export class Manager {
         // SYNCHRONOUS (existsSync / registry / accessSync / readFileSync — no await), so the gate stays
         // atomic: the capacity snapshot and the reserve land in one tick (P4a/P4c), and two concurrent
         // spawns can't overshoot the ceiling or pick the same name.
-        const cooling = this.coolingCount(); // prune expired stamps, then count live cooling slots
-        if (this.agents.size + this.reserved.size + cooling >= MAX_AGENTS)
-            return { ok: false, error: `at capacity (${MAX_AGENTS} agents incl. in-flight + cooling); despawn one or wait` };
+        const occupancy = this.occupancy(); // prunes expired cooling stamps; counts each name once
+        if (occupancy.used >= MAX_AGENTS)
+            return { ok: false, error: this.capacityRefusal(occupancy) };
         // Harness preflight before reserving a slot or minting — a missing `claude`/`opencode` binary
         // fails here with a clear name, not obscurely at process spawn. No fallback. All synchronous, so
         // the reserve gate stays atomic. (The connector itself was resolved up top, before the capacity gate.)
@@ -4496,6 +4660,21 @@ export class Manager {
             return { ok: false, error: `${agent} connector does not support model variants (variant)` };
         if (prompt !== undefined && !connector.supportsPrompt)
             return { ok: false, error: `${agent} connector does not support an initial prompt (prompt)` };
+        // A manifest `continuity: exact` agent reopens the session this manager last bound to its
+        // declared name. Refused before any reserve or mint when the connector cannot reopen an exact
+        // session or the recorded assignment does not match this declaration.
+        const exact = opts.resolved?.continuity === "exact";
+        let reopenSession;
+        if (exact) {
+            if (!connector.supportsSessionReopen || !connector.supportsSessionContinuation)
+                return { ok: false, error: `${agent} connector does not support exact session continuity (continuity: exact)` };
+            try {
+                reopenSession = readContinuityAssignment(this.workspaceRoot, { space: this.space, name: identityName, connector: agent, cwd: resolvedCwd ?? this.workspaceRoot });
+            }
+            catch (e) {
+                return { ok: false, error: e.message };
+            }
+        }
         // #4 A4 (panel): the roster the allocation consults must reflect the initial presence snapshot,
         // or a spawn immediately after manager boot races an already-live unmanaged peer and re-opens the
         // very collision black-hole this closes. Await the snapshot (bounded internally, fail-safe on an
@@ -4769,8 +4948,10 @@ export class Manager {
                 // control arg), never from `opts.resolved` — so the manifest launch path carries no resume by
                 // construction. An unsupported connector throws here before any process is spawned.
                 resume: opts.resume,
+                reopenSession,
                 // Initial prompt: the `--prompt` flag, or the manifest entry's `prompt:` on a resolved launch.
-                prompt,
+                // A reopened session already had its kickoff turn, so it is not submitted again.
+                prompt: reopenSession === undefined ? prompt : undefined,
                 // The SAME access set the creds were minted from (above) — forwarded so the session's
                 // runtime read/post set matches its credentials. Without this a manifest-spawned agent
                 // (materialized persona has no access frontmatter) has no channel set to read and joins
@@ -4833,6 +5014,7 @@ export class Manager {
                     events,
                     shareTools: opts.shareTools,
                     forkSource: opts.resume,
+                    ...(opts.resume !== undefined && spec.resumeRecordPath ? { resumeRecordPath: spec.resumeRecordPath } : {}),
                     // Opaque values may contain secrets. Preserve only their keys and require the referenced
                     // persona/manifest to resolve the values again; imperative overrides have no safe payload.
                     unresolvedLaunchOptionKeys: opts.launchOptions && Object.keys(opts.launchOptions).length
@@ -4867,6 +5049,7 @@ export class Manager {
                 });
             }
             this.agents.set(name, managed);
+            this.reservedLive.add(name);
             // The live slot now owns teardown — freeSlot deprovisions this identity on exit — so the
             // orphan-rollback in `finally` no longer applies to it.
             provisioned = undefined;
@@ -4882,10 +5065,15 @@ export class Manager {
                 hooks?.onTerminalDeferred?.();
                 return { ok: false, error: readiness.detail };
             }
-            if (!readiness.ok && !readiness.uncertain) {
-                await hooks?.onOutcome?.({ kind: "failed", data: { error: readiness.detail } });
-                return { ok: false, error: readiness.detail };
-            } // failed → already reaped
+            if (!readiness.ok && !readiness.uncertain) { // failed → already reaped
+                // A reopen fails before readiness when the host no longer has the recorded session, which
+                // is refused rather than replaced by an empty one; name the record that pins it.
+                const error = reopenSession === undefined ? readiness.detail
+                    : `${readiness.detail} (continuity: exact was reopening recorded session ${reopenSession}; if the harness no longer has it, ` +
+                        `remove ${join(this.workspaceRoot, ".cotal", "continuity", `${name}.json`)} to start a new session)`;
+                await hooks?.onOutcome?.({ kind: "failed", data: { error } });
+                return { ok: false, error };
+            }
             // Started OR uncertain: the agent stays managed, so wire the ongoing exit reaper (it reaps a later
             // death — including one that follows an `uncertain` verdict, which deliberately does NOT deprovision).
             if (!readiness.ok) {
@@ -4897,7 +5085,17 @@ export class Manager {
                 if (connector.supportsSessionContinuation) {
                     try {
                         await this.armSessionRecovery(managed);
+                        // The capability flags are only a claim. An exact seat is recorded once the connector
+                        // has proved its session over its authenticated control endpoint, never before.
+                        if (exact && !managed.restart.armed)
+                            throw new Error("continuity: exact needs the connector to prove its session over an authenticated control endpoint, and it supplied none");
                         managed.launch.sessionId = this.readManagedSession(managed);
+                        if (reopenSession !== undefined && managed.launch.sessionId !== reopenSession)
+                            throw new Error(`continuity: exact asked for session ${reopenSession}, the connector bound ${managed.launch.sessionId}`);
+                        if (exact) {
+                            managed.continuity = { space: this.space, name, connector: agent, cwd };
+                            this.recordContinuity(managed, managed.launch.sessionId);
+                        }
                     }
                     catch (error) {
                         const detail = `${managed.name} joined, but its exact host session could not be bound for supervised recovery: ${error.message}`;
@@ -4936,6 +5134,7 @@ export class Manager {
         }
         finally {
             this.reserved.delete(name);
+            this.reservedLive.delete(name);
             // Minted but never handed to a live slot (buildLaunch / runtime.spawn threw after mint) → tear the
             // orphan down (detached, fail-loud) so a failed spawn leaves no creds/durables behind (#159 B).
             if (provisioned) {
@@ -4952,6 +5151,7 @@ export class Manager {
         if (!release)
             return { ok: false, agents: [], error: this.maintenanceError() };
         const batchReservations = [];
+        const prepared = new Map();
         try {
             if (inventory.version !== "cotal-manager-resume/v1")
                 return { ok: false, agents: [], error: `unsupported manager resume inventory version ${String(inventory.version)}` };
@@ -4961,8 +5161,9 @@ export class Manager {
             const principals = new Set();
             await this.ep.waitForPresenceSnapshot();
             const liveRoster = this.ep.getRoster().filter((presence) => presence.status !== "offline");
-            if (this.agents.size + this.reserved.size + this.coolingCount() + inventory.agents.length > MAX_AGENTS)
-                return { ok: false, agents: [], error: `resume inventory would exceed manager capacity (${MAX_AGENTS})` };
+            const occupancy = this.occupancy();
+            if (occupancy.used + inventory.agents.length > MAX_AGENTS)
+                return { ok: false, agents: [], error: `resume inventory of ${inventory.agents.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
             for (const entry of inventory.agents) {
                 if (seen.has(entry.name))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate agent name "${entry.name}"` };
@@ -5018,7 +5219,6 @@ export class Manager {
                 this.reserved.add(entry.name);
                 batchReservations.push(entry.name);
             }
-            const prepared = new Map();
             const preflight = [];
             for (const entry of inventory.agents) {
                 const reply = await this.resumePreservedAgent(entry, true, true, prepared);
@@ -5047,8 +5247,22 @@ export class Manager {
             return { ok: true, agents };
         }
         finally {
-            for (const name of batchReservations)
+            for (const name of batchReservations) {
                 this.reserved.delete(name);
+                this.reservedLive.delete(name);
+            }
+            // Preflight builds every launch before any child starts, so a refused batch, a failed launch,
+            // or the agents skipped after it leave built specs no runtime ever received.
+            for (const { spec, spawned } of prepared.values()) {
+                if (spawned)
+                    continue;
+                try {
+                    discardLaunchArtifacts(spec.artifacts);
+                }
+                catch (e) {
+                    console.error(`! resume: ${e.message}`);
+                }
+            }
             release();
         }
     }
@@ -5232,8 +5446,9 @@ export class Manager {
                 return { ok: false, error: nameErr };
             if (this.agents.has(entry.name) || (!batchReserved && this.reserved.has(entry.name)))
                 return { ok: false, error: `retained agent "${entry.name}" is already managed or reserved; same-principal resume never auto-numbers` };
-            if (!batchReserved && this.agents.size + this.reserved.size + this.coolingCount() >= MAX_AGENTS)
-                return { ok: false, error: `at capacity (${MAX_AGENTS} agents incl. in-flight + cooling); same-principal resume refused` };
+            const occupancy = batchReserved ? undefined : this.occupancy();
+            if (occupancy && occupancy.used >= MAX_AGENTS)
+                return { ok: false, error: `${this.capacityRefusal(occupancy)}; same-principal resume refused` };
             const cached = prepared?.get(entry.name);
             if (!preflightOnly && cached) {
                 try {
@@ -5286,6 +5501,7 @@ export class Manager {
             if (retainedSession && !connector.supportsSessionContinuation)
                 return { ok: false, error: `${connector.name} connector does not support exact-session continuation` };
             let launchOptions;
+            let exact = false;
             if (entry.launch.source.kind === "manifest") {
                 const launchSource = entry.launch.source;
                 if (!launchSource.runId)
@@ -5303,6 +5519,11 @@ export class Manager {
                 if (!spec || spec.hash !== launchSource.hash)
                     return { ok: false, error: `retained manifest agent ${launchSource.requested} is missing or its hash changed; refusing same-principal resume` };
                 launchOptions = spec.launchOptions;
+                exact = spec.continuity === "exact";
+                // An exact seat reopens its retained session or fails, like its manifest launch, so the
+                // connector must honor reopenSession before the batch starts any child.
+                if (exact && (!connector.supportsSessionReopen || !connector.supportsSessionContinuation))
+                    return { ok: false, error: `${connector.name} connector does not support exact session continuity (continuity: exact)` };
             }
             else {
                 try {
@@ -5344,7 +5565,8 @@ export class Manager {
                     variant: entry.launch.variant,
                     launchOptions,
                     resume: retainedSession ? undefined : entry.launch.forkSource,
-                    continueSession: retainedSession,
+                    continueSession: exact ? undefined : retainedSession,
+                    reopenSession: exact ? retainedSession : undefined,
                     subscribe: entry.launch.subscribe,
                     allowSubscribe: entry.launch.allowSubscribe,
                     allowPublish: entry.launch.allowPublish,
@@ -5356,7 +5578,7 @@ export class Manager {
                 };
                 const spec = connector.buildLaunch(launchOpts);
                 spec.env = { ...spec.env, COTAL_MANAGER_INSTANCE: this.managerInstanceId };
-                const value = { spec, launchOpts, ...authority };
+                const value = { spec, launchOpts, ...authority, exact };
                 prepared?.set(entry.name, value);
                 if (preflightOnly)
                     return { ok: true, data: { name: entry.name, preflight: true } };
@@ -5392,6 +5614,7 @@ export class Manager {
             const custody = this.reserveCustody();
             if (custody)
                 await this.recordSlotCustody({ name: entry.name, id: resumeId, lifecycleUid: entry.identity.lifecycleUid }, custody);
+            prepared.spawned = true;
             const handle = await this.spawnCustodied(entry.name, prepared.spec, entry.launch.cwd, custody);
             const managed = {
                 name: entry.name,
@@ -5428,6 +5651,8 @@ export class Manager {
                     events: entry.launch.events,
                     shareTools: entry.launch.shareTools,
                     forkSource: entry.launch.forkSource,
+                    ...(entry.launch.resumed ? { resumed: entry.launch.resumed } : {}),
+                    ...(prepared.launchOpts.resume !== undefined && prepared.spec.resumeRecordPath ? { resumeRecordPath: prepared.spec.resumeRecordPath } : {}),
                     sessionId: entry.launch.sessionId,
                 },
                 ...(prepared.spec.sessionStatePath
@@ -5436,6 +5661,7 @@ export class Manager {
                 suppressCleanup: true,
             };
             this.agents.set(entry.name, managed);
+            this.reservedLive.add(entry.name);
             if (this.resumeAttemptId)
                 this.resumedAgentNames.add(entry.name);
             await this.recordSlotRuntime(managed);
@@ -5447,10 +5673,21 @@ export class Manager {
                 this.watchResumeAdoption(managed);
                 return { ok: false, error: readiness.detail };
             }
-            if (managed.restart) {
+            if (managed.restart || prepared.exact) {
                 try {
                     await this.armSessionRecovery(managed);
+                    // As on a manifest launch, an exact seat is recorded only at the session it asked for,
+                    // proved over the connector's authenticated control endpoint.
+                    if (prepared.exact && !managed.restart?.armed)
+                        throw new Error("continuity: exact needs the connector to prove its session over an authenticated control endpoint, and it supplied none");
                     managed.launch.sessionId = this.readManagedSession(managed);
+                    const asked = prepared.launchOpts.reopenSession;
+                    if (asked !== undefined && managed.launch.sessionId !== asked)
+                        throw new Error(`continuity: exact asked for session ${asked}, the connector bound ${managed.launch.sessionId}`);
+                    if (prepared.exact) {
+                        managed.continuity = { space: this.space, name: managed.name, connector: managed.agent, cwd: managed.launch.cwd };
+                        this.recordContinuity(managed, managed.launch.sessionId);
+                    }
                 }
                 catch (error) {
                     this.stopHandle(managed, false);
@@ -5472,8 +5709,10 @@ export class Manager {
             return { ok: false, error: e.message };
         }
         finally {
-            if (!batchReserved)
+            if (!batchReserved) {
                 this.reserved.delete(entry.name);
+                this.reservedLive.delete(entry.name);
+            }
         }
     }
     probeStaticCredential(creds) {
@@ -5677,6 +5916,48 @@ export class Manager {
         this.cooling = this.cooling.filter((stamp) => stamp > now);
         return this.cooling.length;
     }
+    /** What holds the ceiling's slots, one count per seat (#906). A launching seat sits in `reserved`
+     *  from accept until its launch settles, in `agents` once its process exists, and in `cooling`
+     *  if it then frees young, so a reservation stops counting once it reaches `agents`. `managed` is
+     *  what this manager's `ps` lists, `reserved` is the accepted launches that have no process yet,
+     *  and `launching` is every unsettled launch that still holds a slot through `reserved` or
+     *  `agents`. A launch whose seat already freed holds no slot but its cooling stamp, so its
+     *  failure can free nothing. */
+    occupancy() {
+        const cooling = this.coolingCount();
+        let reserved = 0;
+        let launching = 0;
+        for (const name of this.reserved) {
+            const placed = this.reservedLive.has(name);
+            if (!placed)
+                reserved++;
+            if (!placed || this.agents.has(name))
+                launching++;
+        }
+        const managed = this.agents.size;
+        return {
+            managed,
+            reserved,
+            cooling,
+            launching,
+            used: managed + reserved + cooling,
+            nextCoolingMs: cooling ? Math.min(...this.cooling) - Date.now() : undefined,
+        };
+    }
+    occupancyText(o) {
+        return `${o.used} of ${MAX_AGENTS} slots: ${o.managed} managed, ${o.reserved} reserved, ${o.cooling} cooling`;
+    }
+    /** The capacity refusal states the split it enforces and whether waiting can free a slot: a
+     *  cooling slot frees at a known time, an unsettled launch frees one only if it fails, and a
+     *  managed seat frees one only when it is stopped. */
+    capacityRefusal(o) {
+        const remedy = o.nextCoolingMs !== undefined
+            ? `waiting frees a cooling slot in ${Math.ceil(o.nextCoolingMs / 1000)}s, or despawn one`
+            : o.launching
+                ? `waiting frees a slot only if an unsettled launch fails (${o.launching} pending); otherwise despawn one`
+                : "waiting frees no slot; despawn one";
+        return `at capacity (${this.occupancyText(o)}); ${remedy}`;
+    }
     async opStop(args, caller, admin) {
         const name = String(args.name ?? "").trim();
         const a = this.agents.get(name);
@@ -5836,7 +6117,7 @@ export class Manager {
         return {
             instanceId: this.managerInstanceId,
             runtime: this.runtime.kind,
-            custody: process.platform === "linux" && this.runtime.kind === "pty" ? "custodied" : "legacy",
+            custody: this.runtime.kind === "pty" && this.runtime.supportsRelease === true ? "custodied" : "legacy",
             agentCount: this.agents.size,
             uptimeMs: Date.now() - this.startedAtMs,
             connectors: this.connectorStatuses.map((row) => ({ ...row, binaries: { ...row.binaries } })),
@@ -5887,7 +6168,7 @@ export class Manager {
             report = await reconcileEndpointGate({
                 kv: authKv, space: this.space, endpoint: MANAGER_ENDPOINT, instanceId,
                 probeHolder: makeManagerHolderLivenessProbe({ space: this.space, servers, auth, log }),
-                evict: makeManagerEndpointEvictor({ space: this.space, servers, auth, log }),
+                evictHolders: makeManagerEndpointHolderEvictor({ space: this.space, servers, auth, log }),
                 log,
                 recordsKv,
             });
@@ -5921,6 +6202,17 @@ export class Manager {
             inboxPrefix: `_INBOX_${state.identity.id}`,
             maxReconnectAttempts: -1,
         });
+        // Track the transport from the first moment: nats.js reports `disconnect` when the socket
+        // drops and `reconnect` only after it has re-sent this connection's subscriptions. If the
+        // status stream itself fails, the transport can no longer be observed, so it counts as down.
+        void (async () => {
+            for await (const st of nc.status()) {
+                if (st.type === "disconnect")
+                    this.serveTransportDown.add(nc);
+                else if (st.type === "reconnect")
+                    this.serveTransportDown.delete(nc);
+            }
+        })().catch(() => this.serveTransportDown.add(nc));
         let handle;
         try {
             // The 1b typed surface + the derived `describe`. The descriptor stays PUBLIC in static
@@ -6294,15 +6586,6 @@ export class Manager {
         });
         return creds;
     }
-    /** P2 item 2 (spawn-as-action): stand up the standing self-mediated goal-writer connection +
-     *  ActionContext. Mode-dual, mirroring {@link registerManagerService}: an AUTH mesh uses the
-     *  scoped `goal-writer` credential already minted + family-STAGED inside registration's run block
-     *  ({@link mintAndStageGoalWriter} — DISJOINT grant from the serve cred, SHARED §13.1 revocation
-     *  family); an OPEN mesh uses a bare connection (no credential system to mint from - the broker
-     *  enforces nothing). The connection presents the CURRENT credential on every (re)connect (a
-     *  renewal is adopted without reconnecting the whole endpoint); the ActionContext bonds its
-     *  KV + JS + JSM to this one connection and space (SPEC 13.4), so a composition mixup cannot splice
-     *  goal state across brokers. */
     /** #2073: dial the goal-writer's ONE standing connection and rebuild everything derived from it
      *  (the fence-resolving action context, the issuance-gate reader) — shared by the initial start
      *  and the closed-connection recovery ({@link onGoalWriterConnectionClosed}), so a redial never
@@ -6370,6 +6653,15 @@ export class Manager {
             return;
         console.error("! manager goal-writer could not be re-dialed; leaving the credential to the next renewal pass");
     }
+    /** P2 item 2 (spawn-as-action): stand up the standing self-mediated goal-writer connection +
+     *  ActionContext. Mode-dual, mirroring {@link registerManagerService}: an AUTH mesh uses the
+     *  scoped `goal-writer` credential already minted + family-STAGED inside registration's run block
+     *  ({@link mintAndStageGoalWriter} — DISJOINT grant from the serve cred, SHARED §13.1 revocation
+     *  family); an OPEN mesh uses a bare connection (no credential system to mint from - the broker
+     *  enforces nothing). The connection presents the CURRENT credential on every (re)connect (a
+     *  renewal is adopted without reconnecting the whole endpoint); the ActionContext bonds its
+     *  KV + JS + JSM to this one connection and space (SPEC 13.4), so a composition mixup cannot splice
+     *  goal state across brokers. */
     async startGoalWriter() {
         const identity = (this.auth || this.remoteAuthority) ? this.goalWriterIdentity : newIdentity();
         // The mutable holder captured by the authenticator (mirrors the serve connection): a half-TTL
@@ -6431,18 +6723,6 @@ export class Manager {
         });
         return creds;
     }
-    /** P2 item 6: stand up the ONE §13.6 session plane on its own standing connection. Mode-dual,
-     *  mirroring {@link startGoalWriter}: an AUTH mesh presents the scoped `session-ledger` cred
-     *  already minted + family-staged inside registration's run block ({@link mintAndStageSessionLedger});
-     *  an OPEN mesh uses a bare connection (no credential system to mint from). The connection presents
-     *  the CURRENT credential on every (re)connect, so a half-TTL renewal is adopted without reconnecting.
-     *
-     *  The offer SIGNER is a per-incarnation in-memory keypair: the static collapsed path mints AND
-     *  redeems the offer in one call ({@link ManagerSessionPlane.establishAttach}), so the manager
-     *  self-signs and self-verifies its own §13.6 grants and the keypair never leaves the process — a
-     *  holder never verifies the signature (it presents the grant back over the rail; the broker's
-     *  per-session caller cred is the holder's real fence). The plane's ledger lives in the DEDICATED
-     *  sessions bucket (createEndpointStreams provisioned it at registration). */
     /** #2073: dial the session-ledger's ONE standing connection — shared by the initial start and the
      *  closed-connection recovery ({@link onSessionLedgerConnectionClosed}), the same shape {@link
      *  dialGoalWriter} uses for its rail. The KV/JetStream clients the session plane opened from the
@@ -6487,6 +6767,18 @@ export class Manager {
             return;
         console.error("! manager session-ledger could not be re-dialed; leaving the credential to the next renewal pass");
     }
+    /** P2 item 6: stand up the ONE §13.6 session plane on its own standing connection. Mode-dual,
+     *  mirroring {@link startGoalWriter}: an AUTH mesh presents the scoped `session-ledger` cred
+     *  already minted + family-staged inside registration's run block ({@link mintAndStageSessionLedger});
+     *  an OPEN mesh uses a bare connection (no credential system to mint from). The connection presents
+     *  the CURRENT credential on every (re)connect, so a half-TTL renewal is adopted without reconnecting.
+     *
+     *  The offer SIGNER is a per-incarnation in-memory keypair: the static collapsed path mints AND
+     *  redeems the offer in one call ({@link ManagerSessionPlane.establishAttach}), so the manager
+     *  self-signs and self-verifies its own §13.6 grants and the keypair never leaves the process — a
+     *  holder never verifies the signature (it presents the grant back over the rail; the broker's
+     *  per-session caller cred is the holder's real fence). The plane's ledger lives in the DEDICATED
+     *  sessions bucket (createEndpointStreams provisioned it at registration). */
     async startSessionPlane() {
         const identity = (this.auth || this.remoteAuthority) ? this.sessionLedgerIdentity : newIdentity();
         // The mutable holder captured by the authenticator (mirrors the goal-writer): a half-TTL renewal
@@ -8627,8 +8919,9 @@ export class Manager {
             throw e;
         }
     }
-    /** Managed agents cross-referenced with live presence (the manager sees the roster). */
-    /** `ownerFilter`: restrict to agents whose spawn-time stored `userOwner` equals it (the ps/status
+    /** Managed agents cross-referenced with live presence (the manager sees the roster).
+     *
+     *  `ownerFilter`: restrict to agents whose spawn-time stored `userOwner` equals it (the ps/status
      *  owner-domain bound); undefined = unbounded. {@link NO_OWNER_MATCHES} matches nothing. */
     list(ownerFilter) {
         const roster = new Map(this.ep.getRoster().map((p) => [p.card.name, p]));
@@ -8650,8 +8943,33 @@ export class Manager {
                 : undefined;
             // The connector-reported provider from presence (#785): the live roster card's `meta.provider`,
             // when it is a non-empty string. Absent when the connector reported none — never fabricated.
-            const providerMeta = roster.get(a.name)?.card.meta?.provider;
+            const seen = roster.get(a.name);
+            const providerMeta = seen?.card.meta?.provider;
             const provider = typeof providerMeta === "string" && providerMeta ? providerMeta : undefined;
+            // The harness-reported condition beside the mesh status (#618): a turn that died upstream reads
+            // `waiting` with `rate_limit` here, not a bare `waiting`. Absent when the connector reported none.
+            // Projected field by field like `provider`: a malformed peer row must not fail this reply's schema.
+            const reported = roster.get(a.name)?.condition;
+            const condition = reported && typeof reported.code === "string" && reported.code
+                ? {
+                    code: reported.code,
+                    ...(typeof reported.source === "string" ? { source: reported.source } : {}),
+                    ...(typeof reported.message === "string" ? { message: reported.message } : {}),
+                    ...(typeof reported.since === "number" && Number.isFinite(reported.since) ? { since: reported.since } : {}),
+                }
+                : undefined;
+            // The seat's last harness-reported work progress (#618). `ts` is only its heartbeat, so a turn
+            // that stopped advancing reads as an old `activeAt` beside a live process. Absent when none was reported.
+            const activeAtReported = roster.get(a.name)?.activeAt;
+            const activeAt = typeof activeAtReported === "number" && Number.isFinite(activeAtReported) ? activeAtReported : undefined;
+            // How long an offline verdict has stood (#1208): the seat's last heartbeat before it went
+            // offline. Only beside a verdict, since a stale or unpopulated view dates nothing, only from the
+            // seat's own record, since `seen` is matched by name and a same-named foreign peer or an older
+            // incarnation must not date this seat, and only when the seat's unvalidated `ts` fits the row
+            // schema, so one odd record cannot fail the reply.
+            const offlineSince = view.state === "current" && this.isOwnPresence(a, seen) && seen.status === "offline" && Number.isSafeInteger(seen.ts) && seen.ts >= 0
+                ? seen.ts
+                : undefined;
             return {
                 name: a.name,
                 // The spawned agent's id (nkey, or the user-mode principal) — lets an operator tool (e.g.
@@ -8664,10 +8982,13 @@ export class Manager {
                 mode: a.handle.kind,
                 status: a.handle.status(),
                 uptimeMs: Date.now() - a.startedAt,
-                mesh: roster.get(a.name)?.status ?? "absent",
+                mesh: seen?.status ?? "absent",
+                ...(condition ? { condition } : {}),
+                ...(activeAt !== undefined ? { activeAt } : {}),
                 // `current` is the only state in which `mesh` is a verdict; the other two are the
                 // observer's own condition and travel on the row (older CLIs ignore the field).
                 meshView: view.state,
+                ...(offlineSince !== undefined ? { offlineSince } : {}),
                 // The incarnation coordinate (SPEC 13.1) — with `id`, exactly what a v0.4 caller needs to
                 // build a targeted (`despawn`/`attach`) request against THIS incarnation.
                 lifecycleUid: a.lifecycleUid,
@@ -8683,6 +9004,9 @@ export class Manager {
                 spawner: a.spawner,
                 instanceId: this.managerInstanceId,
                 host: hostname(),
+                // #1500: the session a `--resume` seat forked, with its title and transcript hash once the
+                // seat has recorded them.
+                ...(a.launch.forkSource ? { resume: this.forkProvenance(a) ?? { source: a.launch.forkSource } } : {}),
                 ...(health && health.state !== "ok" ? { authHealth: health.state, authReason: health.reason } : {}),
             };
         });