@cotal-ai/manager 0.66.1 → 0.68.0

package/dist/manager.js

@@ -2,10 +2,10 @@ import { execFile } from "node:child_process";
 import { createHash, randomUUID, randomBytes } from "node:crypto";
 import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
-import { existsSync, lstatSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
-import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
+import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, bearerCommandFailure, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
 import { DELIVERY_ADMIN_BOOT_WAIT_MS, isUnansweredDeliveryAdmin, makeManagerEndpointEvictionEvidence, makeManagerEndpointHolderEvictor, untilDeliveryAdminAnswers } from "./endpoint-evict.js";
@@ -17,11 +17,12 @@ import { controlShutdown } from "./control-shutdown.js";
 import { RunHosting } from "./run-hosting.js";
 import { controlSession } from "./control-session.js";
 import { MAX_AGENTS, parseResumeCommitArgs, parseResumeControlArgs, parseResumeFinalizeArgs } from "./resume.js";
+import { TranscriptReceiver } from "./transcript-receive.js";
 // Unit B (the static §13.1 lifecycle executor): the shared grammar/stores from core plus the
 // manager-side adapter (transport + slot orchestration + the F1 terminal) — see static-lifecycle.ts.
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { recordsBucket, epAuthBucket, ensureAuthorityStores, ensureContractStore, createEndpointStreams, contractStoreContext, publishContractArtifact, contractArtifactCanonicalBytes, standaloneConnectOpts, STATIC_SLOT_PREFIX, rawDigest, STANDING_RENEWABLE_TTL_SEC as MANAGED_STATIC_TTL_SEC, newArtifactSigner, RotatingSigner, generationAnchor, sessionsBucket, SESSION_GRANT_MAX_TTL_MS, } from "@cotal-ai/core";
+import { recordsBucket, epAuthBucket, ensureAuthorityStores, ensureContractStore, createEndpointStreams, contractStoreContext, publishContractArtifact, contractArtifactCanonicalBytes, standaloneConnectOpts, STATIC_SLOT_PREFIX, rawDigest, STANDING_RENEWABLE_TTL_SEC as MANAGED_STATIC_TTL_SEC, newArtifactSigner, RotatingSigner, generationAnchor, sessionsBucket, SESSION_GRANT_MAX_TTL_MS, REMOTE_MANAGER_IDENTITY_NAMES, } from "@cotal-ai/core";
 // P2 item 6: the manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
 // standup for `attach`, over a dedicated standing session-LEDGER connection (the byte rails ride
 // per-session credentials on their own short-lived connections).
@@ -136,14 +137,25 @@ function rejectionText(e) {
         return "an unreadable rejection";
     }
 }
+/** Run one cleanup step, recording its failure in `failed` as `<what>: <reason>`. A step that threw
+ *  would otherwise skip every step after it, and a swallowed one would leave nothing to report. */
+async function attemptCleanup(failed, what, step) {
+    try {
+        await step();
+    }
+    catch (err) {
+        failed.push(`${what}: ${rejectionText(err)}`);
+    }
+}
 /** Run the agent's bearer argv once, pre-launch — the end-to-end auth preflight (state dir, daemon,
  *  ledger row, secret). Its stderr is the provider command's operator-exact sentence; surface it
  *  verbatim as the spawn refusal. */
 function execBearerPreflight(argv) {
+    const timeout = 30_000;
     return new Promise((res, rej) => {
-        execFile(argv[0], argv.slice(1), { timeout: 30_000, maxBuffer: 64 * 1024 }, (err, _stdout, stderr) => {
+        execFile(argv[0], argv.slice(1), { timeout, maxBuffer: 64 * 1024 }, (err, _stdout, stderr) => {
             if (err)
-                return rej(new Error(stderr.trim() || err.message));
+                return rej(bearerCommandFailure(err, stderr, timeout));
             res();
         });
     });
@@ -172,6 +184,8 @@ const FREE_SLOT_CAUSE_TEXT = {
     "supervise-recovery-failed": "this manager retired it after a supervised restart failed",
     "session-bind-failed": "this manager stopped it: its host session could not be bound at launch",
     "resume-session-rebind-failed": "this manager stopped it: its host session could not be rebound on resume",
+    "carried-fork-refused": "this manager stopped it: it recorded no fork of the carried transcript",
+    "resume-custody-unrecorded": "this manager stopped it: its custody reference could not be recorded on resume",
 };
 /** The stop family's sentences — the same job {@link FREE_SLOT_CAUSE_TEXT} does for the string
  *  causes, beside it so both stay the single place a cause becomes a sentence. A requested stop's
@@ -467,6 +481,8 @@ export class Manager {
     /** The complete boot task. stop() joins it after fencing static reconciliation, so a registration
      * already past an earlier shutdown check cannot finish after stop() returns. */
     startTask;
+    /** This instance's side of a carried resume transcript (#1499); absent where it has no transfer reader. */
+    transcripts;
     /** The one stop this manager runs, with the agent policy it was asked for. A stop takes seats out
      *  of `agents` before they have exited, so a second teardown would find none and report success
      *  while the first still waits on a live seat. */
@@ -877,11 +893,11 @@ export class Manager {
         catch (e) {
             // Our OWN instance id already holds a live key ⇒ refuse. Anything else (e.g. a KV/JS error) is a
             // real failure to surface, not a silent "held" — keep the cause so it isn't misread as a conflict.
-            const held = await this.ep.readManagerLease().catch(() => undefined);
+            const held = (await this.ep.readOwnManagerLease(this.managerInstanceId).catch(() => undefined))?.info;
             await this.ep.stop();
             await this.attach.stop();
             throw new Error(held
-                ? `manager instance ${this.managerInstanceId} already serves space "${this.space}" from this workspace root (${held.runtime}, pid ${held.pid}, root ${held.root}) - stop it first before restarting the same instance`
+                ? `manager instance ${this.managerInstanceId} already serves space "${this.space}" from ${held.root === this.leaseInfo.root ? "this" : "another"} workspace root (${held.runtime}, pid ${held.pid}, root ${held.root}) - stop it first before restarting the same instance`
                 : `could not acquire the manager lease for space "${this.space}": ${e.message}`);
         }
         this.leaseTimer = setInterval(() => { void this.renewLease(); }, MANAGER_LEASE_RENEW_MS);
@@ -1042,6 +1058,18 @@ export class Manager {
             });
             await this.runHosting.reconcile();
         }
+        // A carried resume (#1499) needs this instance's transfer reader: minted from the space's signing
+        // seed, issued by the host to a remote manager, or none on an open mesh.
+        if (!this.remoteAuthority || this.remoteAuthority.mintTransferReader) {
+            this.transcripts = new TranscriptReceiver({
+                space: this.space,
+                instanceId: this.managerInstanceId,
+                workspaceRoot: this.workspaceRoot,
+                withReader: (fn) => this.withTransferReader(fn),
+                log: (line) => console.error(line),
+            });
+            await this.transcripts.start();
+        }
         // Plane-3 (durable backstop) is NOT the manager's job — the manager only manages agent lifecycle.
         // The server-side delivery daemon hosts the fan-out writer + trusted reader, owns the durable
         // membership registry, and serves the runtime durable join/leave/list ops (on `ctl.delivery`). The
@@ -1483,10 +1511,9 @@ export class Manager {
         let candidate;
         try {
             candidate = await remote.renewStandingBundle(processEpoch);
-            const names = ["supervisor", "executor", "serve", "goalWriter", "sessionLedger"];
-            if (Object.keys(candidate).sort().join(",") !== [...names].sort().join(","))
+            if (Object.keys(candidate).sort().join(",") !== [...REMOTE_MANAGER_IDENTITY_NAMES].sort().join(","))
                 throw new Error("host returned an incomplete or widened standing credential family");
-            for (const name of names) {
+            for (const name of REMOTE_MANAGER_IDENTITY_NAMES) {
                 if (typeof candidate[name] !== "string" || inspectCredHealth(candidate[name]).state === "unreadable")
                     throw new Error(`host returned an unreadable ${name} credential`);
                 if (!remote.accountPublicKey || accountFromCreds(candidate[name]) !== remote.accountPublicKey)
@@ -1676,10 +1703,14 @@ export class Manager {
                 });
         }
         // A later manager does not resume a delegated seat, and its close runs only inside its
-        // retirement, so a cut that holds one is refused before any child stops.
-        for (const a of this.agents.values())
+        // retirement, so a cut that holds one is refused before any child stops. A carried resume seat's
+        // private home is removed when its slot is freed, so a later manager would find nothing to fork.
+        for (const a of this.agents.values()) {
             if (a.handedOff)
                 failures.push({ name: a.name, id: a.id, error: "a delegated seat is not resumed by a later manager; stop it before preserving" });
+            if (a.seatHome)
+                failures.push({ name: a.name, id: a.id, error: "a carried resume seat's private home is not kept for a later manager; stop it before preserving" });
+        }
         const unverifiedStops = this.unverifiedStops.filter((stopped) => {
             try {
                 if (!stopped.authoritative && stopped.handle.status() === "exited")
@@ -2049,6 +2080,7 @@ export class Manager {
     }
     async stopOnce(withAgents) {
         this.leaseStopping = true;
+        this.transcripts?.stop();
         this.staticReconcileStopping = true;
         const starting = this.startTask;
         for (const item of this.staticReconcileItems.values()) {
@@ -2554,8 +2586,13 @@ export class Manager {
     async epAdminReach(caller) {
         if (!this.userMode)
             return true;
-        if (this.remoteAuthority)
-            return this.remoteAuthority.authorizeAdmin({ owner: caller.owner, actor: caller.actor, lifecycleUid: caller.uid });
+        if (this.remoteAuthority) {
+            // A hosted run's own caller is derived from its id and holds no ledger row: it acts for the
+            // caller its run was admitted for, so that caller's current grant decides, and a revoked
+            // login demotes the run's next spawn.
+            const asked = this.runHosting?.admittedCaller(caller) ?? caller;
+            return this.remoteAuthority.authorizeAdmin({ owner: asked.owner, actor: asked.actor, lifecycleUid: asked.uid });
+        }
         try {
             const scope = await resolveAuthProvider().actorScope({
                 dir: userAuthStateDir(this.workspaceRoot, this.space),
@@ -2878,6 +2915,11 @@ export class Manager {
             preparePreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("preparePreservation", args(ctx)))),
             commitPreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("commitPreservation", args(ctx)))),
             abortPreservation: (ctx) => adminGated(ctx, async () => unwrap(await this.opPreservationCtl("abortPreservation", args(ctx)))),
+            transcriptReceive: (ctx) => this.serveGated(ctx, () => adminGated(ctx, () => {
+                if (!this.transcripts)
+                    throw new EpEnvelopeError("failed-precondition", "transcript-receive: this manager does not receive carried transcripts (its remote authority issues no transfer reader)");
+                return this.transcripts.receive(args(ctx));
+            })),
         });
     }
     async commitResumeActivation(attemptId) {
@@ -3208,15 +3250,14 @@ export class Manager {
             // Roll back everything this attempt materialized — a refused spawn must leave no standing
             // secret, no ledger row, no durable footprint — and AWAIT the broker teardown: the caller
             // may respawn the moment it reads the refusal, and a detached teardown would race (and
-            // delete) that fresh spawn's just-provisioned durables.
-            await provider.revokeAgent({ dir, owner, actor: name }).catch(() => { });
-            await secrets.delete(agentSecretKeyForFile(tokenPath, this.space)).catch(() => { });
-            await secrets.delete(agentSecretKeyForFile(sentinelPath, this.space)).catch(() => { });
-            rmSync(tokenPath, { force: true });
-            rmSync(sentinelPath, { force: true });
-            rmSync(healthPath, { force: true });
-            await this.deprovision({ id: principalKey(owner, name).key, name, lifecycleUid: opts.lifecycleUid, userOwner: owner, secretPaths: files }).catch((err) => console.error(`rollback deprovision ${name}: ${err.message}`));
-            return { error: `agent auth preflight failed for "${name}": ${e.message}` };
+            // delete) that fresh spawn's just-provisioned durables. deprovision shreds the secret family
+            // and revokes the grant, but only logs a failed revoke, so the revoke is attempted here first.
+            // Each failure joins the refusal, so the caller learns what this spawn left behind.
+            const failed = [];
+            await attemptCleanup(failed, "revoke agent grant", () => provider.revokeAgent({ dir, owner, actor: name }));
+            await attemptCleanup(failed, "deprovision", () => this.deprovision({ id: principalKey(owner, name).key, name, lifecycleUid: opts.lifecycleUid, userOwner: owner, secretPaths: files }));
+            const leftover = failed.length ? `; cleanup failed: ${failed.join("; ")}` : "";
+            return { error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}` };
         }
     }
     /**
@@ -3285,7 +3326,7 @@ export class Manager {
             if (files.actorToken !== staged.actorToken) {
                 await secrets.put(agentSecretKeyForFile(files.actorToken, this.space), actorToken);
                 await materializeSecretToFile(secrets, agentSecretKeyForFile(files.actorToken, this.space), files.actorToken);
-                await secrets.delete(agentSecretKeyForFile(staged.actorToken, this.space)).catch(() => { });
+                await secrets.delete(agentSecretKeyForFile(staged.actorToken, this.space));
                 rmSync(staged.actorToken, { force: true });
             }
             await secrets.put(agentSecretKeyForFile(files.sentinelCreds, this.space), material.sentinelCreds);
@@ -3320,19 +3361,11 @@ export class Manager {
             // A failed removal joins the refusal instead of throwing, so every removal is attempted and
             // the refusal still reaches the caller.
             const unshredded = [];
-            const shred = async (what, remove) => {
-                try {
-                    await remove();
-                }
-                catch (err) {
-                    unshredded.push(`${what}: ${rejectionText(err)}`);
-                }
-            };
             for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files]) {
                 for (const path of [family.actorToken, family.sentinelCreds])
-                    await shred(`secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
+                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
                 for (const path of [family.actorToken, family.sentinelCreds, family.health])
-                    await shred(`file ${path}`, () => rmSync(path, { force: true }));
+                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
             }
             const leftover = unshredded.length ? `; cleanup failed: ${unshredded.join("; ")}` : "";
             return { error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}` };
@@ -3459,6 +3492,8 @@ export class Manager {
         this.recordContinuityAtStop(a, "stop");
         if (a.restart?.sessionStatePath)
             rmSync(a.restart.sessionStatePath, { force: true });
+        if (a.seatHome)
+            rmSync(a.seatHome, { recursive: true, force: true });
         // P2 item 6 (pin 4): end any live §13.6 attach session bound to THIS incarnation with the honest
         // `target-despawn` reason. Fires once per agent on every free path (despawn / self-stop / reap /
         // exit) via the `agents` guard above; a no-op when no plane or no live session for the target.
@@ -3583,22 +3618,25 @@ export class Manager {
         // unowned same-name file is the exact successor-clobber this ownership discipline removes.
         const secrets = this.secrets;
         const files = a.secretPaths ?? agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, a.name, a.lifecycleUid);
+        // Every removal is attempted, and a failed one is thrown only after the broker teardown below,
+        // so a file fault cannot strand the agent's durables and ACL row on the broker.
+        const unshredded = [];
         if (files.creds) {
-            await secrets.delete(agentSecretKeyForFile(files.creds, this.space));
-            rmSync(files.creds, { force: true });
+            const creds = files.creds;
+            await attemptCleanup(unshredded, `secret ${creds}`, () => secrets.delete(agentSecretKeyForFile(creds, this.space)));
+            await attemptCleanup(unshredded, `file ${creds}`, () => rmSync(creds, { force: true }));
         }
         if (a.userOwner) {
             // USER MODE: this teardown IS revocation, not just footprint reduction — the ledger row is
             // the agent's standing mint authority, so delete it (next exchange refused, next connect
             // denied) and shred the secret/sentinel/health files. A copied actor token dies here; a
             // still-LIVE connection ends at its bearer-bound JWT expiry (≤ the agent TTL).
-            if (files.actorToken)
-                await secrets.delete(agentSecretKeyForFile(files.actorToken, this.space));
-            if (files.sentinelCreds)
-                await secrets.delete(agentSecretKeyForFile(files.sentinelCreds, this.space));
-            for (const f of [files.actorToken, files.sentinelCreds, files.health])
-                if (f)
-                    rmSync(f, { force: true });
+            for (const path of [files.actorToken, files.sentinelCreds])
+                if (path)
+                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
+            for (const path of [files.actorToken, files.sentinelCreds, files.health])
+                if (path)
+                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
             // The ledger row IS the agent's STANDING mint authority (a different store from the auth-plane
             // cred ledger the rail retirement covers): while it lives, a copied actor token can still mint a
             // fresh connect credential. So a FAILED revoke must NOT be swallowed into a clean terminal (INT-2):
@@ -3626,6 +3664,7 @@ export class Manager {
                 console.error(`revoke agent grant ${a.name}: ${e.message}`);
             }
         }
+        const shredFailure = unshredded.length ? `could not shred "${a.name}": ${unshredded.join("; ")}` : undefined;
         try {
             const res = await this.deprovisionBroker(a);
             const h = this.retiring.get(a.name);
@@ -3639,8 +3678,12 @@ export class Manager {
                 if (e instanceof DeprovisionError)
                     h.lastResources = e.accounting;
             }
+            if (shredFailure)
+                throw new Error(`${rejectionText(e)}; ${shredFailure}`, { cause: e });
             throw e;
         }
+        if (shredFailure)
+            throw new Error(shredFailure);
         // #29 piece 3: after the footprint teardown, ask the AUTH plane to RETIRE the lifecycle over
         // the auth endpoint rail. The rail re-checks the SERVE-ISSUANCE GATE at serve time (not the
         // space-manager lease - that check was replaced in 02794b2f) and refuses unless the registration
@@ -3929,8 +3972,15 @@ export class Manager {
      *  record cannot be read or does not name this seat's source, it is absent: `ps` then shows the
      *  source id alone rather than failing the listing for every other seat. */
     forkProvenance(a) {
-        if (a.launch.resumed || !a.launch.resumeRecordPath || !a.launch.forkSource)
+        // A carried seat's provenance is set only by refuseCarriedFork, once its record names the claim.
+        if (a.launch.resumed || a.launch.carried)
             return a.launch.resumed;
+        a.launch.resumed = this.readForkRecord(a);
+        return a.launch.resumed;
+    }
+    readForkRecord(a) {
+        if (!a.launch.resumeRecordPath || !a.launch.forkSource)
+            return undefined;
         let record;
         try {
             record = JSON.parse(readFileSync(a.launch.resumeRecordPath, "utf8"));
@@ -3942,8 +3992,43 @@ export class Manager {
         if (r.source !== a.launch.forkSource || typeof r.transcriptSha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.transcriptSha256) ||
             !(r.title === undefined || r.title === null || (typeof r.title === "string" && r.title.length <= 1024)))
             return undefined;
-        a.launch.resumed = { source: r.source, ...(typeof r.title === "string" && r.title ? { title: r.title } : {}), transcriptSha256: r.transcriptSha256 };
-        return a.launch.resumed;
+        return { source: r.source, ...(typeof r.title === "string" && r.title ? { title: r.title } : {}), transcriptSha256: r.transcriptSha256 };
+    }
+    /** Design section 9: a carried seat must fork the bytes the operator carried. Wait for its fork
+     *  record and hold it to the claim; on a match it becomes the seat's provenance, otherwise the
+     *  refusal is returned. A seat that writes no record cannot be shown to have forked the claim. */
+    async refuseCarriedFork(a, timeoutMs) {
+        const claim = a.launch.carried;
+        const deadline = Date.now() + timeoutMs;
+        let record;
+        while (!(record = this.readForkRecord(a))) {
+            if (a.terminalizing || a.handle.status() === "exited")
+                return `${a.name} stopped before it wrote a fork record`;
+            if (Date.now() >= deadline)
+                return `${a.name} wrote no fork record within ${timeoutMs} ms, so it cannot be shown to have forked the carried transcript`;
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        }
+        if (record.transcriptSha256 !== claim.transcriptSha256)
+            return `${a.name} forked a transcript with sha256:${record.transcriptSha256}, not the carried sha256:${claim.transcriptSha256}`;
+        a.launch.resumed = { ...record, host: claim.host, transferredAt: claim.transferredAt };
+        return undefined;
+    }
+    /** A carried seat whose launch was uncertain is held to the claim once it joins, as a started one
+     *  is; the wait ends when the seat stops or exits, which its exit watcher reaps. */
+    async refuseLateCarriedFork(a, timeoutMs) {
+        for (;;) {
+            const late = await this.awaitReadiness(a, timeoutMs, { reapOnExit: false });
+            if (late.ok)
+                break;
+            if (!late.uncertain || a.terminalizing)
+                return;
+        }
+        const refused = await this.refuseCarriedFork(a, timeoutMs);
+        if (refused === undefined || a.terminalizing || a.handle.status() === "exited")
+            return;
+        console.error(`! ${refused}; stopping it`);
+        this.stopHandle(a, false);
+        this.freeSlot(a, true, "carried-fork-refused");
     }
     readManagedSession(a) {
         return this.readManagedSessionState(a).sessionId;
@@ -4096,10 +4181,10 @@ export class Manager {
                 }
                 a.handle = handle;
                 a.control = spec.control;
+                await this.recordSlotRuntime(a);
                 replacement = undefined;
                 restart.opts = opts;
                 restart.recovering = false;
-                await this.recordSlotRuntime(a);
                 if (continueSession !== undefined)
                     console.error(`! ${a.name}: recovered Pi session ${continueSession} after crash (${restart.crashes.length}/${limit})`);
                 else
@@ -4316,6 +4401,8 @@ export class Manager {
             variant: args.variant ? String(args.variant) : undefined,
             launchOptions: args.launchOptions,
             resume: args.resume ? String(args.resume) : undefined,
+            resumeClaim: args.resumeClaim !== undefined ? String(args.resumeClaim) : undefined,
+            resumeAgent: args.resumeAgent !== undefined ? String(args.resumeAgent) : undefined,
             events,
             eventsNotice,
             cwd: args.cwd ? String(args.cwd) : undefined,
@@ -4445,6 +4532,31 @@ export class Manager {
             return reason;
         return `${reason}. This manager cannot launch that harness. The space may have other managers; pin one with --on <instance> (the whole id, as ps prints it)`;
     }
+    /** The harness binaries a managed launch runs, as boot resolved them, or the refusal naming what is
+     *  missing. Spawn and resume both take it, so a seat launches from the same files whichever path
+     *  starts it. A connector registered after boot has no inventory row and is checked on PATH now. */
+    launchHarness(connector) {
+        const row = this.connectorStatuses.find((status) => status.agent === connector.name);
+        if (row?.state === "unavailable")
+            return { refusal: row.reason ?? `${connector.name} harness is unavailable` };
+        if (row)
+            return { binaries: row.binaries };
+        const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
+        if (missing.length)
+            return { refusal: `${connector.name} harness needs ${missing.join(", ")} on PATH - not found` };
+        return {};
+    }
+    /** The refusal for a launch choice the connector cannot honour. Spawn and resume both ask before
+     *  any reserve or mint, so a rule changed here holds on both paths. */
+    capabilityRefusal(connector, launch) {
+        if (launch.variant && !connector.supportsModelVariant)
+            return `${connector.name} connector does not support model variants (variant)`;
+        if (launch.prompt !== undefined && !connector.supportsPrompt)
+            return `${connector.name} connector does not support an initial prompt (prompt)`;
+        if (launch.exact && (!connector.supportsSessionReopen || !connector.supportsSessionContinuation))
+            return `${connector.name} connector does not support exact session continuity (continuity: exact)`;
+        return undefined;
+    }
     /** Return connector-provided model catalogs for selector UIs. Optional by connector: a host with no
      *  local model-list API reports `supported:false` rather than blocking the manager. A connector that
      *  fails to import shows an `error:` row (from manifest enumeration) and never blocks the others. */
@@ -4695,22 +4807,33 @@ export class Manager {
         // Harness preflight before reserving a slot or minting — a missing `claude`/`opencode` binary
         // fails here with a clear name, not obscurely at process spawn. No fallback. All synchronous, so
         // the reserve gate stays atomic. (The connector itself was resolved up top, before the capacity gate.)
-        const bootStatus = this.connectorStatuses.find((row) => row.agent === agent);
-        const route = opts.route ?? "inst";
-        if (bootStatus?.state === "unavailable")
-            return { ok: false, error: this.harnessUnavailableError(bootStatus.reason ?? `${agent} harness is unavailable`, route) };
-        // A connector registered after boot has no inventory row. Keep the existing pre-mint backstop
-        // for that dynamic library-composition case; ordinary installed connectors were checked at boot.
-        if (!bootStatus) {
-            const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
-            if (missing.length)
-                return { ok: false, error: this.harnessUnavailableError(`${agent} harness needs ${missing.join(", ")} on PATH - not found`, route) };
-        }
+        const harness = this.launchHarness(connector);
+        if ("refusal" in harness)
+            return { ok: false, error: this.harnessUnavailableError(harness.refusal, opts.route ?? "inst") };
         // Resume is a connector capability: reject an unsupported resume HERE, before the reserve/mint, so
         // it can never provision creds + durables and then throw at buildLaunch (mint-then-orphan). Same
         // reject-before-side-effects window as the harness preflight above; buildLaunch stays the backstop.
         if (opts.resume && !connector.supportsResume)
             return { ok: false, error: `${agent} connector does not support resuming an existing session (resume)` };
+        // A carried resume (#1499) is checked here too, before anything is minted. The claim is only
+        // looked at: the connector may still refuse the launch, and a refused launch leaves it unspent.
+        let carried;
+        if (opts.resumeClaim !== undefined) {
+            if (opts.resume === undefined)
+                return { ok: false, error: "resumeClaim: names carried bytes of a resume; the launch carries no resume" };
+            if (!connector.resumeTranscript)
+                return { ok: false, error: `${agent} connector does not take a carried transcript (resumeClaim)` };
+            if (opts.resumeAgent !== agent)
+                return { ok: false, error: `resumeClaim: the session was carried for agent "${opts.resumeAgent ?? "<none>"}", and this launch resolves agent "${agent}"` };
+            if (!this.transcripts)
+                return { ok: false, error: "resumeClaim: this manager does not receive carried transcripts" };
+            try {
+                carried = this.transcripts.peek(opts.resumeClaim, opts.resume);
+            }
+            catch (e) {
+                return { ok: false, error: e.message };
+            }
+        }
         // A restart policy this host cannot honour is refused at accept, never accepted and ignored.
         // External runtimes (tmux/cmux/orca/herdr) attach to a process they do not own and stream no
         // exit, so a name cannot be respawned in place. User-mode seats have no static slot that
@@ -4883,18 +5006,15 @@ export class Manager {
             const err = lifecycleBlocked("failed-precondition", `the name "${identityName}" is reserved pending retirement: its previous agent's despawn started that lifecycle's teardown (footprint + standing-authority revoke + auth-side retirement), and the name frees only when all of it completes${held.lastError !== undefined ? ` (last attempt: ${held.lastError})` : ""}. NEXT: wait a moment and retry this spawn (retrying re-drives the whole teardown), or pick another name.`, { blockedOp: "retirement", opId: held.opId, remedy: "retry" });
             return { ok: false, error: renderLifecycleBlocked(err.message, err), details: err.details };
         }
-        if (variant && !connector.supportsModelVariant)
-            return { ok: false, error: `${agent} connector does not support model variants (variant)` };
-        if (prompt !== undefined && !connector.supportsPrompt)
-            return { ok: false, error: `${agent} connector does not support an initial prompt (prompt)` };
         // A manifest `continuity: exact` agent reopens the session this manager last bound to its
         // declared name. Refused before any reserve or mint when the connector cannot reopen an exact
         // session or the recorded assignment does not match this declaration.
         const exact = opts.resolved?.continuity === "exact";
+        const unsupported = this.capabilityRefusal(connector, { variant, prompt, exact });
+        if (unsupported)
+            return { ok: false, error: unsupported };
         let reopenSession;
         if (exact) {
-            if (!connector.supportsSessionReopen || !connector.supportsSessionContinuation)
-                return { ok: false, error: `${agent} connector does not support exact session continuity (continuity: exact)` };
             try {
                 reopenSession = readContinuityAssignment(this.workspaceRoot, { space: this.space, name: identityName, connector: agent, cwd: resolvedCwd ?? this.workspaceRoot });
             }
@@ -4981,6 +5101,8 @@ export class Manager {
         // and retires over a live process. The slot row holds the same reference; this is the copy the
         // in-process rollback can actually read.
         let provisioned;
+        // A carried resume's seat-private home, removed by the finally unless a live seat took it.
+        let seatHome;
         try {
             // A stable nkey identity assigned at spawn: the public key is the agent's card.id (threaded via
             // COTAL_ID); the seed is retained to mint matching creds later.
@@ -5206,10 +5328,11 @@ export class Manager {
                 eventsRequired: this.eventsRequired,
                 mcpServers,
                 envAllow,
-                resolvedBinaries: bootStatus?.binaries,
+                resolvedBinaries: harness.binaries,
                 // So a connector that keeps per-agent local state can root it at the workspace, not the
-                // (possibly per-agent) launch cwd below. The cwd itself rides runtime.spawn, not the launch.
+                // (possibly per-agent) launch cwd.
                 workspaceRoot: this.workspaceRoot,
+                cwd,
             };
             // A delegated seat gets no local launch at all: no launch-material file, control token or
             // manager path is produced for it, only the handoff its runtime writes into the child.
@@ -5223,7 +5346,14 @@ export class Manager {
                 handle = this.runtime.spawnDelegated({ agent, persona: readFileSync(configPath, "utf8"), role, model, variant, prompt, launchOptions: launchOptions, events }, handoff);
             }
             else {
+                if (carried) {
+                    seatHome = join(this.workspaceRoot, ".cotal", "seat-homes", lifecycleUid);
+                    mkdirSync(seatHome, { recursive: true, mode: 0o700 });
+                    launchOpts.carried = { home: seatHome, transcript: carried.path, cwd };
+                }
                 spec = connector.buildLaunch(launchOpts);
+                if (carried)
+                    this.transcripts.consume(opts.resumeClaim, opts.resume);
                 spec.env = { ...spec.env, COTAL_MANAGER_INSTANCE: this.managerInstanceId };
                 handle = await this.spawnCustodied(name, spec, cwd, custody);
             }
@@ -5232,6 +5362,7 @@ export class Manager {
                 name,
                 role,
                 agent,
+                ...(seatHome ? { seatHome } : {}),
                 id: userLaunch ? principalKey(userLaunch.owner, name).key : identity.id,
                 lifecycleUid,
                 // The lifecycle-keyed family this spawn just materialized (absent on an open mesh) — the
@@ -5272,6 +5403,7 @@ export class Manager {
                     shareTools: opts.shareTools,
                     forkSource: opts.resume,
                     ...(opts.resume !== undefined && spec?.resumeRecordPath ? { resumeRecordPath: spec.resumeRecordPath } : {}),
+                    ...(carried ? { carried: { transcriptSha256: carried.sha256, host: carried.sourceHost, transferredAt: carried.stagedAt } } : {}),
                     // Opaque values may contain secrets. Preserve only their keys and require the referenced
                     // persona/manifest to resolve the values again; imperative overrides have no safe payload.
                     unresolvedLaunchOptionKeys: opts.launchOptions && Object.keys(opts.launchOptions).length
@@ -5311,6 +5443,7 @@ export class Manager {
             // The live slot now owns teardown — freeSlot deprovisions this identity on exit — so the
             // orphan-rollback in `finally` no longer applies to it.
             provisioned = undefined;
+            seatHome = undefined;
             // #159 B1: reply on a REAL outcome, not a timer. Wait for the agent to actually join the mesh
             // (presence) → started, the child to exit → failed (with its last output; already reaped), or
             // neither in time → uncertain. `✓ started` therefore means "it joined", never just "a process
@@ -5336,9 +5469,24 @@ export class Manager {
             // death — including one that follows an `uncertain` verdict, which deliberately does NOT deprovision).
             if (!readiness.ok) {
                 this.watchExit(managed);
+                if (managed.launch.carried)
+                    void this.refuseLateCarriedFork(managed, readinessTimeoutMs);
                 await hooks?.onOutcome?.({ kind: "uncertain", data: { reason: readiness.detail } });
                 return { ok: false, error: readiness.detail };
             }
+            if (managed.launch.carried) {
+                const refused = await this.refuseCarriedFork(managed, readinessTimeoutMs);
+                if (refused !== undefined && managed.terminalizing) {
+                    hooks?.onTerminalDeferred?.();
+                    return { ok: false, error: refused };
+                }
+                if (refused !== undefined) {
+                    this.stopHandle(managed, false);
+                    this.freeSlot(managed, true, "carried-fork-refused");
+                    await hooks?.onOutcome?.({ kind: "failed", data: { error: refused } });
+                    return { ok: false, error: refused };
+                }
+            }
             if (managed.restart) {
                 if (connector.supportsSessionContinuation) {
                     try {
@@ -5385,14 +5533,23 @@ export class Manager {
             // Failure after reserve (provision / launch threw): the slot was never live, so no cold-start
             // was paid — the reserved rollback (finally) is enough, no cooling stamp.
             // A lifecycle-blocked envelope already named the barrier; keep its details on the ControlReply
-            // so follow/CLI/cotal_spawn do not collapse it to a generic string (#873).
-            if (e instanceof EpEnvelopeError)
-                return { ok: false, error: renderLifecycleBlocked(e.message, e), ...(e.details ? { details: e.details } : {}) };
-            return { ok: false, error: e.message };
+            // so follow/CLI/cotal_spawn do not collapse it to a generic string (#873). An extension can throw
+            // any value, and an envelope's `message` is only typed as a string, so the refusal text always
+            // comes from rejectionText; telling an envelope apart is guarded because a thrown Proxy can
+            // throw from `instanceof` or from its own fields.
+            const error = rejectionText(e);
+            try {
+                if (e instanceof EpEnvelopeError)
+                    return { ok: false, error: renderLifecycleBlocked(error, e), ...(e.details ? { details: e.details } : {}) };
+            }
+            catch { /* not a readable envelope */ }
+            return { ok: false, error };
         }
         finally {
             this.reserved.delete(name);
             this.reservedLive.delete(name);
+            if (seatHome)
+                rmSync(seatHome, { recursive: true, force: true });
             // Minted but never handed to a live slot (buildLaunch / runtime.spawn threw after mint) → tear the
             // orphan down (detached, fail-loud) so a failed spawn leaves no creds/durables behind (#159 B).
             if (provisioned) {
@@ -5799,13 +5956,9 @@ export class Manager {
             catch (e) {
                 return { ok: false, error: e.message };
             }
-            const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
-            if (missing.length)
-                return { ok: false, error: `${connector.name} harness needs ${missing.join(", ")} on PATH - not found` };
-            if (entry.launch.variant && !connector.supportsModelVariant)
-                return { ok: false, error: `${connector.name} connector does not support model variants (variant)` };
-            if (entry.launch.prompt !== undefined && !connector.supportsPrompt)
-                return { ok: false, error: `${connector.name} connector does not support an initial prompt (prompt)` };
+            const harness = this.launchHarness(connector);
+            if ("refusal" in harness)
+                return { ok: false, error: harness.refusal };
             let retainedSession;
             try {
                 retainedSession = this.retainedSessionId(entry, connector);
@@ -5837,10 +5990,6 @@ export class Manager {
                     return { ok: false, error: `retained manifest agent ${launchSource.requested} is missing or its hash changed; refusing same-principal resume` };
                 launchOptions = spec.launchOptions;
                 exact = spec.continuity === "exact";
-                // An exact seat reopens its retained session or fails, like its manifest launch, so the
-                // connector must honor reopenSession before the batch starts any child.
-                if (exact && (!connector.supportsSessionReopen || !connector.supportsSessionContinuation))
-                    return { ok: false, error: `${connector.name} connector does not support exact session continuity (continuity: exact)` };
             }
             else {
                 try {
@@ -5850,6 +5999,11 @@ export class Manager {
                     return { ok: false, error: e.message };
                 }
             }
+            // Asked once `exact` is known: an exact seat reopens its retained session or fails, like its
+            // manifest launch, so the connector must honor reopenSession before the batch starts any child.
+            const unsupported = this.capabilityRefusal(connector, { variant: entry.launch.variant, prompt: entry.launch.prompt, exact });
+            if (unsupported)
+                return { ok: false, error: unsupported };
             let authority;
             try {
                 authority = await this.validateRetainedAuthority(entry);
@@ -5891,7 +6045,9 @@ export class Manager {
                     events: entry.launch.events,
                     mcpServers,
                     envAllow,
+                    resolvedBinaries: harness.binaries,
                     workspaceRoot: this.workspaceRoot,
+                    cwd: entry.launch.cwd,
                 };
                 const spec = connector.buildLaunch(launchOpts);
                 spec.env = { ...spec.env, COTAL_MANAGER_INSTANCE: this.managerInstanceId };
@@ -5981,7 +6137,24 @@ export class Manager {
             this.reservedLive.add(entry.name);
             if (this.resumeAttemptId)
                 this.resumedAgentNames.add(entry.name);
-            await this.recordSlotRuntime(managed);
+            try {
+                await this.recordSlotRuntime(managed);
+            }
+            catch (error) {
+                const detail = `${managed.name} resumed, but ${error.message}`;
+                this.stopHandle(managed, false);
+                try {
+                    await this.awaitHandleExit(managed.handle);
+                }
+                catch (exit) {
+                    // A resumed seat keeps its retained credentials, so freeing it runs no deprovision and
+                    // nothing would reap it: it stays managed until it exits or the manager stops it.
+                    this.watchExit(managed);
+                    return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${exit.message}` };
+                }
+                this.freeSlot(managed, true, "resume-custody-unrecorded", true);
+                return { ok: false, error: detail };
+            }
             const readiness = await this.awaitReadiness(managed, readinessTimeoutMs);
             if (!readiness.ok && !readiness.uncertain)
                 return { ok: false, error: readiness.detail };
@@ -6752,13 +6925,15 @@ export class Manager {
         // with a fresh bounded exp; a restart re-provisions the same (idempotent) gate + re-registers.
         const serveIdentity = this.managerServeIdentity;
         const servePrincipal = principalKey(DEV_OWNER, serveIdentity.id).key;
+        // An open mesh mints no credentials, so it has no family for a fresh pair to grow.
+        const siblings = auth ? claimManagerSiblingIdentities(this.workspaceRoot, this.space) : { goalWriter: newIdentity(), sessionLedger: newIdentity() };
         // must-5 (b): the STABLE goal-writer identity — a SIBLING credential in the same §13.1 family
-        // (not the gate's bound serving principal), minted here so the run block can family-stage it.
-        this.goalWriterIdentity = newIdentity();
+        // (not the gate's bound serving principal), so the run block can family-stage it.
+        this.goalWriterIdentity = siblings.goalWriter;
         // P2 item 6: the STABLE session-LEDGER identity — another SIBLING in the SAME §13.1 family, so
         // the takeover barrier revokes a deposed manager's ledger cred alongside its goal-writer. The
         // per-session serving creds join the same family, each with its own fresh identity.
-        this.sessionLedgerIdentity = newIdentity();
+        this.sessionLedgerIdentity = siblings.sessionLedger;
         // One registration operation for this boot. Fresh executors may replace a dead connection, but
         // they must resume THIS freeze rather than minting a new op that discards Phase-2 progress.
         const registrationOpId = mintLifecycleUid();
@@ -7468,9 +7643,7 @@ export class Manager {
      *   3. OPEN MESH. No credential family exists, so the revoke/evict loop is vacuous and this belt
      *      is COOPERATIVE only: a non-conformant process simply does not run it.
      *  The named follow-up that would close 2 and 3 is the gate-linearized commit (routing the
-     *  terminal through the issuance gate's own CAS), deliberately deferred as substrate territory.
-     *  An earlier revision of this comment claimed the residual was "closed by item-3 slice 3.0,
-     *  never a permanent residual". That asserted a closure that does not exist. */
+     *  terminal through the issuance gate's own CAS), deliberately deferred as substrate territory. */
     async assertGoalWriterEpochCurrent(epoch) {
         const gate = this.goalWriter?.gate;
         if (!gate)
@@ -8193,8 +8366,7 @@ export class Manager {
     /** Re-record the custody reference of a managed agent's CURRENT handle on its active slot: a
      *  same-lifecycle restart or a resume binds a new custody under the old uid, and the successor's
      *  reap must address the live one. Static auth only; a runtime without durable custody records
-     *  nothing (there is nothing to reap by reference). Loud on failure, never fatal to the bind: the
-     *  handle is already live and a stale reference is refused by identity at reap time. */
+     *  nothing (there is nothing to reap by reference). */
     async recordSlotRuntime(a) {
         if (a.handle.reference === undefined)
             return;
@@ -8202,7 +8374,9 @@ export class Manager {
     }
     /** Record one custody reference on an agent's ACTIVE slot. Split from {@link recordSlotRuntime}
      *  so a restart or a resume can record the reference it RESERVED before spawning, while no
-     *  handle exists yet. Static auth only; a runtime without durable custody reserves nothing. */
+     *  handle exists yet. Static auth only; a runtime without durable custody reserves nothing.
+     *  Throws when the slot does not take the reference: a slot left on the previous one reaps that
+     *  seat, already gone, so a successor would retire the lifecycle over the new one. */
     async recordSlotCustody(a, runtime) {
         if (!this.auth || this.userMode)
             return;
@@ -8210,14 +8384,14 @@ export class Manager {
             await this.withLifecycleExecutor({ owner: DEV_OWNER, actor: a.id, lifecycleUid: a.lifecycleUid, alias: a.name }, async (t) => {
                 const slot = await readStaticSlot(t, DEV_OWNER, a.name);
                 if (slot === undefined || slot.row.lifecycleUid !== a.lifecycleUid || slot.row.phase !== "active")
-                    return;
+                    throw new Error(`the slot is ${slot === undefined ? "absent" : `${slot.row.phase} at uid ${slot.row.lifecycleUid}`}`);
                 if (slot.row.runtime?.kind === runtime.kind && slot.row.runtime.id === runtime.id)
                     return;
                 await casStaticSlot(t, { ...slot.row, runtime }, slot.revision);
             });
         }
         catch (e) {
-            console.error(`! ${a.name}: could not record the custody reference ${runtime.kind}:${runtime.id} on its static slot: ${e.message} - a successor reaps this seat only by an up-to-date reference`);
+            throw new Error(`could not record the custody reference ${runtime.kind}:${runtime.id} on the static slot of "${a.name}": ${e.message}`);
         }
     }
     /** Mint the custody reference for a seat this manager is about to spawn, BEFORE the processes
@@ -8905,6 +9079,28 @@ export class Manager {
             await prov.stop();
         }
     }
+    /** A connection holding this instance's transfer reader grants (docs/design/resume-transfer.md
+     *  section 6) for this one receive or sweep: minted from the space's signing seed, or issued by the
+     *  host to a remote manager. An open mesh enforces no grants, so a bare one-shot connection is that
+     *  reader there. */
+    async withTransferReader(fn) {
+        const issue = this.remoteAuthority?.mintTransferReader;
+        if (this.remoteAuthority && !issue)
+            throw new Error("withTransferReader: this manager's remote authority issues no transfer reader");
+        const identity = newIdentity();
+        const creds = issue
+            ? await issue(identity)
+            : this.auth && await mintCreds(this.auth, identity, "transfer-reader", { transferReader: { instanceId: this.managerInstanceId } });
+        const nc = await this.dial(creds
+            ? { ...standaloneConnectOpts({ creds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 }
+            : { maxReconnectAttempts: 0 });
+        try {
+            return await fn(nc);
+        }
+        finally {
+            await nc.drain().catch(() => nc.close());
+        }
+    }
     /** Purge the space's retained message backlog (chat, optionally DMs). Privileged — the manager mints a
      *  short-lived "purger" cred (same destructive grant as `cotal history clear`, isolated off the
      *  supervisor); regular agents are denied STREAM.PURGE under auth. Cleanup only: leaves live agents and
@@ -9200,7 +9396,8 @@ export class Manager {
         }
         // establishAttach releases the claim it was handed on every exit; nothing to unwind here.
         const { grant } = await this.sessionPlane.establishAttach(caller, { name: a.name, lifecycleUid: a.lifecycleUid }, session, slot);
-        return { ok: true, data: { grant } };
+        const carried = a.launch.resumed?.host;
+        return { ok: true, data: { grant, ...(carried ? { resumedFrom: { host: carried, source: a.launch.resumed.source } } : {}) } };
     }
     /** P2 item 6: the console's mesh §13.6 session establisher (backing `POST /session/<name>` on the
      *  loopback face). Drives THE ONE plane — same establishAttach as the ep `attach` command — with