@cotal-ai/manager 0.67.0 → 0.69.0

package/dist/manager.js

@@ -4,8 +4,8 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
-import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
+import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, bearerCommandFailure, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
 import { DELIVERY_ADMIN_BOOT_WAIT_MS, isUnansweredDeliveryAdmin, makeManagerEndpointEvictionEvidence, makeManagerEndpointHolderEvictor, untilDeliveryAdminAnswers } from "./endpoint-evict.js";
@@ -32,7 +32,7 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
 import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
-import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
+import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
 /** Minimum slot lifetime for rate-flooring (P4c). A slot freed (by despawn OR natural exit/reap)
  *  before living this long leaves a cooling stamp that still counts toward the ceiling until it
  *  expires — so churn (spawn↔despawn or spawn↔fast-exit) can't outrun the concurrency bound. */
@@ -137,14 +137,25 @@ function rejectionText(e) {
         return "an unreadable rejection";
     }
 }
+/** Run one cleanup step, recording its failure in `failed` as `<what>: <reason>`. A step that threw
+ *  would otherwise skip every step after it, and a swallowed one would leave nothing to report. */
+async function attemptCleanup(failed, what, step) {
+    try {
+        await step();
+    }
+    catch (err) {
+        failed.push(`${what}: ${rejectionText(err)}`);
+    }
+}
 /** Run the agent's bearer argv once, pre-launch — the end-to-end auth preflight (state dir, daemon,
  *  ledger row, secret). Its stderr is the provider command's operator-exact sentence; surface it
  *  verbatim as the spawn refusal. */
 function execBearerPreflight(argv) {
+    const timeout = 30_000;
     return new Promise((res, rej) => {
-        execFile(argv[0], argv.slice(1), { timeout: 30_000, maxBuffer: 64 * 1024 }, (err, _stdout, stderr) => {
+        execFile(argv[0], argv.slice(1), { timeout, maxBuffer: 64 * 1024 }, (err, _stdout, stderr) => {
             if (err)
-                return rej(new Error(stderr.trim() || err.message));
+                return rej(bearerCommandFailure(err, stderr, timeout));
             res();
         });
     });
@@ -282,7 +293,8 @@ export class Manager {
     /** The ONE secret store for every kind this manager touches (daemon-cred remint + agent kinds).
      *  See {@link ManagerOptions.secretStore}. */
     secrets;
-    /** Named identity of {@link secrets}: the same coordinate the delivery daemon must reload from. */
+    /** Named identity of {@link secrets}: the same coordinate the delivery daemon must reload from.
+     *  Set at construction for an injected store; the workspace store is named on first challenge. */
     secretStoreIdentity;
     /** See {@link ManagerOptions.installedExtensions}. */
     installedExtensions;
@@ -593,9 +605,8 @@ export class Manager {
         if (opts.remoteAuthority)
             this.managerLifecycleUid = opts.remoteAuthority.lifecycleUid;
         this.secrets = opts.secretStore ?? workspaceSecretStore(this.workspaceRoot);
-        this.secretStoreIdentity = opts.secretStore
-            ? injectedManagerStoreIdentity(opts.secretStore)
-            : { kind: "fs", root: resolve(this.workspaceRoot) };
+        if (opts.secretStore)
+            this.secretStoreIdentity = injectedManagerStoreIdentity(opts.secretStore);
         this.installedExtensions = opts.installedExtensions ?? false;
         this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
         if (opts.pooled && isCustodialRuntime(this.runtime))
@@ -1129,6 +1140,9 @@ export class Manager {
                 `this space's delivery lease (${holder}), so its SecretStore is not the store the daemon ` +
                 `reloads from - nothing reminted`);
         const daemon = answer.identity;
+        // The workspace store records its id the first time it is named, so it is named here, where
+        // only an auth manager reaches, rather than in a constructor every open-mode manager runs.
+        this.secretStoreIdentity ??= parseSecretStoreIdentity(this.secrets.identity);
         if (!sameSecretStoreIdentity(this.secretStoreIdentity, daemon)) {
             console.error(`! ${divergentSecretStoreNotice(this.secretStoreIdentity, daemon)}`);
             return "divergent";
@@ -1676,7 +1690,7 @@ export class Manager {
         // actually saw.
         const backfillFloor = await this.chatFrontierForPreservation();
         const inventory = this.preservationInventory ?? {
-            version: "cotal-manager-resume/v1",
+            version: "cotal-manager-resume/v2",
             space: this.space,
             createdAt: new Date().toISOString(),
             agents: [...this.agents.values()].map((a) => this.resumeEntry(a, backfillFloor)),
@@ -2139,17 +2153,17 @@ export class Manager {
             await step("release renewal lease", () => this.ep.releaseDaemonRenewalLease());
         }
         // Capture BEFORE the serve loop is torn down: `stopServiceServe` clears the state, and what is
-        // being asked here is "did this process register a service instance", which only the state
+        // being asked here is "which registration did this process write", which only the state
         // before teardown can answer. Deregistration runs AFTER the serve loop has drained, so no
         // in-flight command can write a status back onto the record it just removed.
-        const registered = this.serviceServe !== undefined;
+        const registrationRevision = this.serviceServe?.grant.registrationRevision;
         await step("stop service serve", () => this.stopServiceServe());
         // The drives AFTER the serve loop (no new `run-start` can land) and BEFORE deregistration: a
         // released run's status write is the last thing this incarnation says about it.
         await step("stop run hosting", () => this.runHosting?.stop());
         this.runHosting = undefined;
-        if (registered && !seatFailure)
-            await step("deregister service", () => this.deregisterServiceOnStop());
+        if (registrationRevision !== undefined && !seatFailure)
+            await step("deregister service", () => this.deregisterServiceOnStop(registrationRevision));
         await step("stop goal writer", () => this.stopGoalWriter());
         await step("stop session plane", () => this.stopSessionPlane());
         await step("stop endpoint", () => this.ep.stop());
@@ -2195,8 +2209,8 @@ export class Manager {
      * deadline — on every `cotal ps`, `stop` and `attach` in that space, for good. A manager that is
      * shutting down is the one participant that KNOWS it is going away, so it says so.
      *
-     * The delete is revision-pinned inside {@link deregisterServiceInstance}, so a successor that
-     * persists the SAME instanceId and has already re-registered loses nothing to a slow stop here.
+     * The delete is pinned to the `registrationRevision` this process registered at, so a successor
+     * that persists the SAME instanceId and has already re-registered loses nothing to a slow stop here.
      *
      * Best-effort and LOUD, matching every other teardown step: a broker that is already gone must not
      * turn a stop into a failure, but a registration that survives a stop is the exact defect this
@@ -2204,11 +2218,12 @@ export class Manager {
      * rather than swallowed. It is not fatal because a crash leaves the same state and the operator
      * verb handles both.
      */
-    async deregisterServiceOnStop() {
+    async deregisterServiceOnStop(registrationRevision) {
         const iid = this.managerInstanceId;
         const dereg = ({ recordsKv, authKv }) => deregisterServiceInstance(recordsKv, {
             endpoint: MANAGER_ENDPOINT,
             instanceId: iid,
+            registrationRevision,
             observeGeneration: async () => {
                 const key = epgateKey(MANAGER_ENDPOINT, iid);
                 const entry = await authKv.get(key);
@@ -2224,7 +2239,7 @@ export class Manager {
             if (outcome.removed)
                 console.error(`✓ deregistered manager instance ${iid} from the ${MANAGER_ENDPOINT} service registry (spec revision ${outcome.specRevision})`);
             else if (outcome.reason === "superseded")
-                console.error(`! manager instance ${iid} was not deregistered: its registration moved while this stop ran, so another incarnation owns it now - leaving it alone`);
+                console.error(`! manager instance ${iid} was not deregistered: another incarnation has registered it since this process did - leaving it alone`);
             else if (outcome.reason === "registration-in-flight")
                 console.error(`! manager instance ${iid} was not deregistered: a registration is still in flight (governance slot held at the live gate generation) - leaving it alone`);
             // `absent` is silent: there was nothing registered to remove, which is not news at shutdown.
@@ -3239,15 +3254,14 @@ export class Manager {
             // Roll back everything this attempt materialized — a refused spawn must leave no standing
             // secret, no ledger row, no durable footprint — and AWAIT the broker teardown: the caller
             // may respawn the moment it reads the refusal, and a detached teardown would race (and
-            // delete) that fresh spawn's just-provisioned durables.
-            await provider.revokeAgent({ dir, owner, actor: name }).catch(() => { });
-            await secrets.delete(agentSecretKeyForFile(tokenPath, this.space)).catch(() => { });
-            await secrets.delete(agentSecretKeyForFile(sentinelPath, this.space)).catch(() => { });
-            rmSync(tokenPath, { force: true });
-            rmSync(sentinelPath, { force: true });
-            rmSync(healthPath, { force: true });
-            await this.deprovision({ id: principalKey(owner, name).key, name, lifecycleUid: opts.lifecycleUid, userOwner: owner, secretPaths: files }).catch((err) => console.error(`rollback deprovision ${name}: ${err.message}`));
-            return { error: `agent auth preflight failed for "${name}": ${e.message}` };
+            // delete) that fresh spawn's just-provisioned durables. deprovision shreds the secret family
+            // and revokes the grant, but only logs a failed revoke, so the revoke is attempted here first.
+            // Each failure joins the refusal, so the caller learns what this spawn left behind.
+            const failed = [];
+            await attemptCleanup(failed, "revoke agent grant", () => provider.revokeAgent({ dir, owner, actor: name }));
+            await attemptCleanup(failed, "deprovision", () => this.deprovision({ id: principalKey(owner, name).key, name, lifecycleUid: opts.lifecycleUid, userOwner: owner, secretPaths: files }));
+            const leftover = failed.length ? `; cleanup failed: ${failed.join("; ")}` : "";
+            return { error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}` };
         }
     }
     /**
@@ -3316,7 +3330,7 @@ export class Manager {
             if (files.actorToken !== staged.actorToken) {
                 await secrets.put(agentSecretKeyForFile(files.actorToken, this.space), actorToken);
                 await materializeSecretToFile(secrets, agentSecretKeyForFile(files.actorToken, this.space), files.actorToken);
-                await secrets.delete(agentSecretKeyForFile(staged.actorToken, this.space)).catch(() => { });
+                await secrets.delete(agentSecretKeyForFile(staged.actorToken, this.space));
                 rmSync(staged.actorToken, { force: true });
             }
             await secrets.put(agentSecretKeyForFile(files.sentinelCreds, this.space), material.sentinelCreds);
@@ -3351,19 +3365,11 @@ export class Manager {
             // A failed removal joins the refusal instead of throwing, so every removal is attempted and
             // the refusal still reaches the caller.
             const unshredded = [];
-            const shred = async (what, remove) => {
-                try {
-                    await remove();
-                }
-                catch (err) {
-                    unshredded.push(`${what}: ${rejectionText(err)}`);
-                }
-            };
             for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files]) {
                 for (const path of [family.actorToken, family.sentinelCreds])
-                    await shred(`secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
+                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
                 for (const path of [family.actorToken, family.sentinelCreds, family.health])
-                    await shred(`file ${path}`, () => rmSync(path, { force: true }));
+                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
             }
             const leftover = unshredded.length ? `; cleanup failed: ${unshredded.join("; ")}` : "";
             return { error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}` };
@@ -3616,22 +3622,25 @@ export class Manager {
         // unowned same-name file is the exact successor-clobber this ownership discipline removes.
         const secrets = this.secrets;
         const files = a.secretPaths ?? agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, a.name, a.lifecycleUid);
+        // Every removal is attempted, and a failed one is thrown only after the broker teardown below,
+        // so a file fault cannot strand the agent's durables and ACL row on the broker.
+        const unshredded = [];
         if (files.creds) {
-            await secrets.delete(agentSecretKeyForFile(files.creds, this.space));
-            rmSync(files.creds, { force: true });
+            const creds = files.creds;
+            await attemptCleanup(unshredded, `secret ${creds}`, () => secrets.delete(agentSecretKeyForFile(creds, this.space)));
+            await attemptCleanup(unshredded, `file ${creds}`, () => rmSync(creds, { force: true }));
         }
         if (a.userOwner) {
             // USER MODE: this teardown IS revocation, not just footprint reduction — the ledger row is
             // the agent's standing mint authority, so delete it (next exchange refused, next connect
             // denied) and shred the secret/sentinel/health files. A copied actor token dies here; a
             // still-LIVE connection ends at its bearer-bound JWT expiry (≤ the agent TTL).
-            if (files.actorToken)
-                await secrets.delete(agentSecretKeyForFile(files.actorToken, this.space));
-            if (files.sentinelCreds)
-                await secrets.delete(agentSecretKeyForFile(files.sentinelCreds, this.space));
-            for (const f of [files.actorToken, files.sentinelCreds, files.health])
-                if (f)
-                    rmSync(f, { force: true });
+            for (const path of [files.actorToken, files.sentinelCreds])
+                if (path)
+                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
+            for (const path of [files.actorToken, files.sentinelCreds, files.health])
+                if (path)
+                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
             // The ledger row IS the agent's STANDING mint authority (a different store from the auth-plane
             // cred ledger the rail retirement covers): while it lives, a copied actor token can still mint a
             // fresh connect credential. So a FAILED revoke must NOT be swallowed into a clean terminal (INT-2):
@@ -3659,6 +3668,7 @@ export class Manager {
                 console.error(`revoke agent grant ${a.name}: ${e.message}`);
             }
         }
+        const shredFailure = unshredded.length ? `could not shred "${a.name}": ${unshredded.join("; ")}` : undefined;
         try {
             const res = await this.deprovisionBroker(a);
             const h = this.retiring.get(a.name);
@@ -3672,8 +3682,12 @@ export class Manager {
                 if (e instanceof DeprovisionError)
                     h.lastResources = e.accounting;
             }
+            if (shredFailure)
+                throw new Error(`${rejectionText(e)}; ${shredFailure}`, { cause: e });
             throw e;
         }
+        if (shredFailure)
+            throw new Error(shredFailure);
         // #29 piece 3: after the footprint teardown, ask the AUTH plane to RETIRE the lifecycle over
         // the auth endpoint rail. The rail re-checks the SERVE-ISSUANCE GATE at serve time (not the
         // space-manager lease - that check was replaced in 02794b2f) and refuses unless the registration
@@ -4265,7 +4279,7 @@ export class Manager {
     nameInUse(name, live = this.liveRosterNames()) {
         return this.agents.has(name) || this.reserved.has(name) || this.retiring.has(name) || live.has(name);
     }
-    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
+    /** First free name in the series `base`, `base_2`, `base_3`, … — checked against live slots,
      *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
      *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
      *  connector session, another manager's agent): allocating their name would mint a sibling the
@@ -4346,11 +4360,12 @@ export class Manager {
                 throw new Error(`${flag}: expected an array of strings`);
             return v;
         };
-        let subscribe, allowSubscribe, allowPublish;
+        let subscribe, allowSubscribe, allowPublish, shareTools;
         try {
             subscribe = strList(args.subscribe, "subscribe");
             allowSubscribe = strList(args.allowSubscribe, "allowSubscribe");
             allowPublish = strList(args.allowPublish, "allowPublish");
+            shareTools = strList(args.shareTools, "shareTools");
         }
         catch (e) {
             return Promise.resolve({ ok: false, error: e.message });
@@ -4400,7 +4415,7 @@ export class Manager {
             subscribe,
             allowSubscribe,
             allowPublish,
-            shareTools: args.shareTools !== undefined ? String(args.shareTools) : undefined,
+            shareTools,
             ...(supervise !== undefined ? { supervise } : {}),
             route,
         }, caller, hooks);
@@ -4522,6 +4537,31 @@ export class Manager {
             return reason;
         return `${reason}. This manager cannot launch that harness. The space may have other managers; pin one with --on <instance> (the whole id, as ps prints it)`;
     }
+    /** The harness binaries a managed launch runs, as boot resolved them, or the refusal naming what is
+     *  missing. Spawn and resume both take it, so a seat launches from the same files whichever path
+     *  starts it. A connector registered after boot has no inventory row and is checked on PATH now. */
+    launchHarness(connector) {
+        const row = this.connectorStatuses.find((status) => status.agent === connector.name);
+        if (row?.state === "unavailable")
+            return { refusal: row.reason ?? `${connector.name} harness is unavailable` };
+        if (row)
+            return { binaries: row.binaries };
+        const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
+        if (missing.length)
+            return { refusal: `${connector.name} harness needs ${missing.join(", ")} on PATH - not found` };
+        return {};
+    }
+    /** The refusal for a launch choice the connector cannot honour. Spawn and resume both ask before
+     *  any reserve or mint, so a rule changed here holds on both paths. */
+    capabilityRefusal(connector, launch) {
+        if (launch.variant && !connector.supportsModelVariant)
+            return `${connector.name} connector does not support model variants (variant)`;
+        if (launch.prompt !== undefined && !connector.supportsPrompt)
+            return `${connector.name} connector does not support an initial prompt (prompt)`;
+        if (launch.exact && (!connector.supportsSessionReopen || !connector.supportsSessionContinuation))
+            return `${connector.name} connector does not support exact session continuity (continuity: exact)`;
+        return undefined;
+    }
     /** Return connector-provided model catalogs for selector UIs. Optional by connector: a host with no
      *  local model-list API reports `supported:false` rather than blocking the manager. A connector that
      *  fails to import shows an `error:` row (from manifest enumeration) and never blocks the others. */
@@ -4687,6 +4727,9 @@ export class Manager {
         }
     }
     async startAgentActive(opts, spawner, hooks) {
+        // The caller keeps its array, so the selection is copied before the first await: a later write
+        // to it cannot change what this launch shares or what preservation retains.
+        const shareTools = opts.shareTools && [...opts.shareTools];
         if (opts.delegatedIntent) {
             if (!this.remoteAuthority?.executeDelegatedUserIntent)
                 return { ok: false, error: `"${opts.name}" names a delegated user intent, and this manager has no host execution for one` };
@@ -4743,10 +4786,7 @@ export class Manager {
                 return { ok: false, error: e.message };
             }
         }
-        // Harness precedence (#869): --agent flag > persona file `agent:` > detached caller default >
-        // this manager's COTAL_DEFAULT_AGENT > DEFAULT_CONNECTOR. Both environment values are defaults,
-        // never overrides: neither may beat a deliberate per-persona pin.
-        const agent = opts.agent ?? def?.agent ?? opts.defaultAgent ?? defaultAgentType(DEFAULT_CONNECTOR);
+        const agent = resolveAgentType({ flag: opts.agent, pin: def?.agent, callerDefault: opts.defaultAgent });
         // Materialize the requested connector up front — the ONE async step in the spawn path (a lazy
         // `cotal ext` manifest import on the published binary). It runs BEFORE the capacity/reserve span
         // below so that span stays fully SYNCHRONOUS and atomic. On the manifest binary this also honors a
@@ -4772,17 +4812,9 @@ export class Manager {
         // Harness preflight before reserving a slot or minting — a missing `claude`/`opencode` binary
         // fails here with a clear name, not obscurely at process spawn. No fallback. All synchronous, so
         // the reserve gate stays atomic. (The connector itself was resolved up top, before the capacity gate.)
-        const bootStatus = this.connectorStatuses.find((row) => row.agent === agent);
-        const route = opts.route ?? "inst";
-        if (bootStatus?.state === "unavailable")
-            return { ok: false, error: this.harnessUnavailableError(bootStatus.reason ?? `${agent} harness is unavailable`, route) };
-        // A connector registered after boot has no inventory row. Keep the existing pre-mint backstop
-        // for that dynamic library-composition case; ordinary installed connectors were checked at boot.
-        if (!bootStatus) {
-            const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
-            if (missing.length)
-                return { ok: false, error: this.harnessUnavailableError(`${agent} harness needs ${missing.join(", ")} on PATH - not found`, route) };
-        }
+        const harness = this.launchHarness(connector);
+        if ("refusal" in harness)
+            return { ok: false, error: this.harnessUnavailableError(harness.refusal, opts.route ?? "inst") };
         // Resume is a connector capability: reject an unsupported resume HERE, before the reserve/mint, so
         // it can never provision creds + durables and then throw at buildLaunch (mint-then-orphan). Same
         // reject-before-side-effects window as the harness preflight above; buildLaunch stays the backstop.
@@ -4835,7 +4867,7 @@ export class Manager {
                 return { ok: false, error: `${delegatedBy}, so it cannot reopen a session held on this host (continuity: exact)` };
             if (typeof opts.cwd === "string" && opts.cwd !== "")
                 return { ok: false, error: `${delegatedBy}, so it cannot run in a directory on this host's filesystem (cwd); the seat runs in its runtime resource's own directory` };
-            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, parseShareSelection(opts.shareTools)));
+            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, shareTools));
             if (shared.length)
                 return { ok: false, error: `${delegatedBy}, so it cannot share MCP servers that run on this host (${shared.join(", ")}); pass --share-tools none` };
         }
@@ -4856,7 +4888,7 @@ export class Manager {
         // Resolve the launch profile: IDENTITY (free-form `name:`) + role + read/post ACL + capabilities
         // + model/variant. Either from a fully-resolved manifest launch object (`opts.resolved`, whose `config`
         // is a materialized transient persona — the file is NOT the access authority), or from the
-        // persona file. The number rides the IDENTITY (socrates → socrates-2), not the file ref — a
+        // persona file. The number rides the IDENTITY (socrates → socrates_2), not the file ref — a
         // redelivered identical spawn yields a fresh numbered agent (MAX_AGENTS bounds the blast radius).
         let identityName;
         let role;
@@ -4871,13 +4903,13 @@ export class Manager {
         if (opts.resolved) {
             // A manifest launch is the access + identity authority: imperative overrides arriving
             // alongside `resolved` are a caller contract error, not something to merge (no fallbacks).
-            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || opts.shareTools || opts.identity)
+            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || shareTools || opts.identity)
                 return { ok: false, error: "a manifest launch (resolved) rejects imperative overrides (identity/subscribe/allow*/prompt/shareTools)" };
             const r = opts.resolved;
             identityName = r.name;
             role = opts.role ?? r.role;
             subscribe = r.subscribe;
-            allowSubscribe = r.allowSubscribe?.length ? r.allowSubscribe : r.subscribe;
+            allowSubscribe = r.allowSubscribe;
             allowPublish = r.allowPublish;
             capabilities = r.capabilities;
             model = opts.model ?? r.model;
@@ -4899,9 +4931,7 @@ export class Manager {
             // paths of the merged grammar can't diverge. One source feeds BOTH the minted creds and the
             // connector env below.
             subscribe = opts.subscribe ?? def.subscribe;
-            // Defaulted the same way the loader/provisioner do — minted into the creds (the broker
-            // boundary); runtime durable joins are re-authorized against the committed ACL by the daemon.
-            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? subscribe ?? [];
+            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? [];
             allowPublish = opts.allowPublish ?? def.allowPublish;
             capabilities = def.capabilities;
             // #651: fold the persona's model into the launch record, mirroring the variant line below
@@ -4912,6 +4942,14 @@ export class Manager {
             variant = opts.variant ?? def.variant;
             launchOptions = mergeLaunchOptions(def.launchOptions, opts.launchOptions);
         }
+        // Resolved once for both branches, because this one list is granted, minted, recorded on the
+        // launch and forwarded to the session, and each of those must read the list the provisioner does.
+        try {
+            allowSubscribe = resolveReadAcl(subscribe ?? [], allowSubscribe);
+        }
+        catch (e) {
+            return { ok: false, error: opts.resolved ? `launch agent: ${e.message}` : `persona ${configPath}: ${e.message}` };
+        }
         // #651: an empty or whitespace-only model string is not a pin. Coerce it to undefined here, at
         // the single point every path (persona, manifest, imperative) has resolved `model`, so it
         // serializes ABSENT rather than present-but-empty (`"model": ""`), which a key-presence consumer
@@ -4979,18 +5017,15 @@ export class Manager {
             const err = lifecycleBlocked("failed-precondition", `the name "${identityName}" is reserved pending retirement: its previous agent's despawn started that lifecycle's teardown (footprint + standing-authority revoke + auth-side retirement), and the name frees only when all of it completes${held.lastError !== undefined ? ` (last attempt: ${held.lastError})` : ""}. NEXT: wait a moment and retry this spawn (retrying re-drives the whole teardown), or pick another name.`, { blockedOp: "retirement", opId: held.opId, remedy: "retry" });
             return { ok: false, error: renderLifecycleBlocked(err.message, err), details: err.details };
         }
-        if (variant && !connector.supportsModelVariant)
-            return { ok: false, error: `${agent} connector does not support model variants (variant)` };
-        if (prompt !== undefined && !connector.supportsPrompt)
-            return { ok: false, error: `${agent} connector does not support an initial prompt (prompt)` };
         // A manifest `continuity: exact` agent reopens the session this manager last bound to its
         // declared name. Refused before any reserve or mint when the connector cannot reopen an exact
         // session or the recorded assignment does not match this declaration.
         const exact = opts.resolved?.continuity === "exact";
+        const unsupported = this.capabilityRefusal(connector, { variant, prompt, exact });
+        if (unsupported)
+            return { ok: false, error: unsupported };
         let reopenSession;
         if (exact) {
-            if (!connector.supportsSessionReopen || !connector.supportsSessionContinuation)
-                return { ok: false, error: `${agent} connector does not support exact session continuity (continuity: exact)` };
             try {
                 reopenSession = readContinuityAssignment(this.workspaceRoot, { space: this.space, name: identityName, connector: agent, cwd: resolvedCwd ?? this.workspaceRoot });
             }
@@ -5002,6 +5037,30 @@ export class Manager {
         const unportable = this.runtime.spawnDelegated ? Object.keys(launchOptions ?? {}).filter((k) => typeof launchOptions[k] !== "string") : [];
         if (unportable.length)
             return { ok: false, error: `runtime "${this.runtime.kind}" starts seats outside this host, so it cannot pass non-string launch options (${unportable.join(", ")})` };
+        // The AG-UI event plane is on unless the launch explicitly opted out. Refused HERE, before
+        // anything is minted: a connector that cannot
+        // emit must fail before provisioning rather than after, exactly as an unsupported `resume` does.
+        // The GRANT itself cannot be derived yet. It is keyed on the agent's PRINCIPAL, and in user mode
+        // the principal's owner is resolved further down, so deriving it from anything in scope here
+        // would mean guessing at the identity the child will actually connect as. It is added at the
+        // accept seam below, where the allocated triple exists.
+        if (this.eventsRequired && opts.events === false)
+            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
+        const events = this.eventsRequired || opts.events !== false;
+        if (events && !connector.eventChannel)
+            return { ok: false, error: this.eventsRequired
+                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
+                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
+        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
+        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
+        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
+        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
+        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
+        if (this.auth && !this.userMode) {
+            const claims = [opts, (opts.resolved ?? {})];
+            if (claims.some((c) => c.endpointCapabilities !== undefined))
+                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
+        }
         // #4 A4 (panel): the roster the allocation consults must reflect the initial presence snapshot,
         // or a spawn immediately after manager boot races an already-live unmanaged peer and re-opens the
         // very collision black-hole this closes. Await the snapshot (bounded internally, fail-safe on an
@@ -5011,10 +5070,10 @@ export class Manager {
         await this.ep.waitForPresenceSnapshot();
         // M6 (P2 item 2 spawn-as-action): a HARD-PINNED name — an imperative `--name`/identity override
         // or a manifest-declared name (opts.resolved) — that collides with a LIVE/provisioning/reserved
-        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `-2`
+        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `_2`
         // suffix (so an address-by-triple caller's pinned name can't be re-pointed). A PERSONA-DERIVED
         // base name (no pin) keeps uniqueName's collision numbering, so multi-peer `spawn reviewer` twice
-        // still yields reviewer + reviewer-2. The retiring-hold refuse (~2472) is orthogonal and already fired.
+        // still yields reviewer + reviewer_2. The retiring-hold refuse (~2472) is orthogonal and already fired.
         const hardPinned = opts.identity !== undefined || opts.resolved !== undefined;
         let name;
         if (hardPinned) {
@@ -5030,42 +5089,6 @@ export class Manager {
         else {
             name = this.uniqueName(identityName);
         }
-        this.reserved.add(name);
-        // The AG-UI event plane is on unless the launch explicitly opted out. Refused HERE, before
-        // anything is minted: a connector that cannot
-        // emit must fail before provisioning rather than after, exactly as an unsupported `resume` does.
-        // The GRANT itself cannot be derived yet. It is keyed on the agent's PRINCIPAL, and in user mode
-        // the principal's owner is resolved further down, so deriving it from anything in scope here
-        // would mean guessing at the identity the child will actually connect as. It is added at the
-        // accept seam below, where the allocated triple exists.
-        if (this.eventsRequired && opts.events === false) {
-            this.reserved.delete(name);
-            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
-        }
-        const events = this.eventsRequired || opts.events !== false;
-        if (events && !connector.eventChannel) {
-            // Release the just-reserved name on this fail-fast path. A leaked reserve is silent: it costs
-            // the next spawn of this persona its un-suffixed name and nothing reports why.
-            this.reserved.delete(name);
-            return { ok: false, error: this.eventsRequired
-                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
-                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
-        }
-        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
-        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
-        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
-        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
-        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
-        if (this.auth && !this.userMode) {
-            const claims = [opts, (opts.resolved ?? {})];
-            if (claims.some((c) => c.endpointCapabilities !== undefined)) {
-                this.reserved.delete(name);
-                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
-            }
-        }
-        // Set once the agent's creds + durables are minted; cleared the moment a live slot takes ownership
-        // (`agents.set`, after which freeSlot deprovisions on exit). If it survives to `finally`, the spawn
-        // threw AFTER minting (buildLaunch / runtime.spawn) — tear the orphan down so no footprint leaks (#159 B).
         // Set once the agent's footprint (durables + creds, or the user-mode grant + secret files)
         // exists; cleared when a live slot takes ownership. If it survives to `finally`, the spawn threw
         // AFTER provisioning (buildLaunch / runtime.spawn) — the orphan-rollback tears it down. Carries
@@ -5079,6 +5102,9 @@ export class Manager {
         let provisioned;
         // A carried resume's seat-private home, removed by the finally unless a live seat took it.
         let seatHome;
+        // Taken right before the try so its finally is the only release; a refusal belongs above the
+        // allocation, where there is no name to give back.
+        this.reserved.add(name);
         try {
             // A stable nkey identity assigned at spawn: the public key is the agent's card.id (threaded via
             // COTAL_ID); the seed is retained to mint matching creds later.
@@ -5184,10 +5210,8 @@ export class Manager {
                         }
                         : undefined,
                 });
-                if ("error" in prep) {
-                    this.reserved.delete(name);
+                if ("error" in prep)
                     return { ok: false, error: prep.error };
-                }
                 // THE HOST'S UID WINS (#1972). On the local arm this is the value passed in, unchanged. On
                 // the hosted enrollment arm the host selected it, and from here every lifecycle-keyed thing
                 // this spawn records — the slot, the launch, the managed row, the teardown credential — must
@@ -5249,7 +5273,7 @@ export class Manager {
             // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
             // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
             const cotalConfig = loadCotalConfig(this.workspaceRoot);
-            const mcpServers = connectorServers(cotalConfig, agent, parseShareSelection(opts.shareTools));
+            const mcpServers = connectorServers(cotalConfig, agent, shareTools);
             // The operator's spawn-env policy travels the same route: absent means no extras (the OS
             // allow-list + operator knobs + connector-declared inputs), present means those names too.
             // A connector never reads the config itself.
@@ -5304,10 +5328,11 @@ export class Manager {
                 eventsRequired: this.eventsRequired,
                 mcpServers,
                 envAllow,
-                resolvedBinaries: bootStatus?.binaries,
+                resolvedBinaries: harness.binaries,
                 // So a connector that keeps per-agent local state can root it at the workspace, not the
-                // (possibly per-agent) launch cwd below. The cwd itself rides runtime.spawn, not the launch.
+                // (possibly per-agent) launch cwd.
                 workspaceRoot: this.workspaceRoot,
+                cwd,
             };
             // A delegated seat gets no local launch at all: no launch-material file, control token or
             // manager path is produced for it, only the handoff its runtime writes into the child.
@@ -5375,7 +5400,7 @@ export class Manager {
                     allowPublish,
                     capabilities,
                     events,
-                    shareTools: opts.shareTools,
+                    shareTools,
                     forkSource: opts.resume,
                     ...(opts.resume !== undefined && spec?.resumeRecordPath ? { resumeRecordPath: spec.resumeRecordPath } : {}),
                     ...(carried ? { carried: { transcriptSha256: carried.sha256, host: carried.sourceHost, transferredAt: carried.stagedAt } } : {}),
@@ -5508,10 +5533,17 @@ export class Manager {
             // Failure after reserve (provision / launch threw): the slot was never live, so no cold-start
             // was paid — the reserved rollback (finally) is enough, no cooling stamp.
             // A lifecycle-blocked envelope already named the barrier; keep its details on the ControlReply
-            // so follow/CLI/cotal_spawn do not collapse it to a generic string (#873).
-            if (e instanceof EpEnvelopeError)
-                return { ok: false, error: renderLifecycleBlocked(e.message, e), ...(e.details ? { details: e.details } : {}) };
-            return { ok: false, error: e.message };
+            // so follow/CLI/cotal_spawn do not collapse it to a generic string (#873). An extension can throw
+            // any value, and an envelope's `message` is only typed as a string, so the refusal text always
+            // comes from rejectionText; telling an envelope apart is guarded because a thrown Proxy can
+            // throw from `instanceof` or from its own fields.
+            const error = rejectionText(e);
+            try {
+                if (e instanceof EpEnvelopeError)
+                    return { ok: false, error: renderLifecycleBlocked(error, e), ...(e.details ? { details: e.details } : {}) };
+            }
+            catch { /* not a readable envelope */ }
+            return { ok: false, error };
         }
         finally {
             this.reserved.delete(name);
@@ -5541,19 +5573,22 @@ export class Manager {
         const batchReservations = [];
         const prepared = new Map();
         try {
-            if (inventory.version !== "cotal-manager-resume/v1")
+            if (inventory.version !== "cotal-manager-resume/v2")
                 return { ok: false, agents: [], error: `unsupported manager resume inventory version ${String(inventory.version)}` };
             if (inventory.space !== this.space)
                 return { ok: false, agents: [], error: `resume inventory belongs to space "${inventory.space}", not "${this.space}"` };
+            // The caller keeps its inventory, so each selection is copied before the first await: a later
+            // write to it cannot change what a resumed seat shares or what the next preservation retains.
+            const entries = inventory.agents.map((entry) => ({ ...entry, launch: { ...entry.launch, shareTools: entry.launch.shareTools && [...entry.launch.shareTools] } }));
             const seen = new Set();
             const principals = new Set();
             const orphans = [];
             await this.ep.waitForPresenceSnapshot();
             const liveRoster = this.ep.getRoster().filter((presence) => presence.status !== "offline");
             const occupancy = this.occupancy();
-            if (occupancy.used + inventory.agents.length > MAX_AGENTS)
-                return { ok: false, agents: [], error: `resume inventory of ${inventory.agents.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
-            for (const entry of inventory.agents) {
+            if (occupancy.used + entries.length > MAX_AGENTS)
+                return { ok: false, agents: [], error: `resume inventory of ${entries.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
+            for (const entry of entries) {
                 if (seen.has(entry.name))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate agent name "${entry.name}"` };
                 seen.add(entry.name);
@@ -5610,12 +5645,12 @@ export class Manager {
                 if (this.agents.has(entry.name) || this.reserved.has(entry.name))
                     return { ok: false, agents: [], error: `retained agent "${entry.name}" is already managed or reserved` };
             }
-            for (const entry of inventory.agents) {
+            for (const entry of entries) {
                 this.reserved.add(entry.name);
                 batchReservations.push(entry.name);
             }
             const preflight = [];
-            for (const entry of inventory.agents) {
+            for (const entry of entries) {
                 const reply = await this.resumePreservedAgent(entry, true, true, prepared);
                 preflight.push({ name: entry.name, reply });
             }
@@ -5634,12 +5669,12 @@ export class Manager {
                     return { ok: false, agents: [], error: refusal };
             }
             const agents = [];
-            for (let i = 0; i < inventory.agents.length; i++) {
-                const entry = inventory.agents[i];
+            for (let i = 0; i < entries.length; i++) {
+                const entry = entries[i];
                 const reply = await this.resumePreservedAgent(entry, false, true, prepared);
                 agents.push({ name: entry.name, reply });
                 if (!reply.ok) {
-                    for (const skipped of inventory.agents.slice(i + 1))
+                    for (const skipped of entries.slice(i + 1))
                         agents.push({ name: skipped.name, reply: { ok: false, error: `not launched because ${entry.name} failed` } });
                     return { ok: false, agents, error: reply.error };
                 }
@@ -5849,7 +5884,7 @@ export class Manager {
         const slot = await this.readStaticReconcileSlot(entry.name);
         if (slot?.phase !== "active" || slot.actor !== entry.identity.id || slot.lifecycleUid !== entry.identity.lifecycleUid)
             return undefined;
-        if (slot.ownerInstanceId !== undefined && slot.ownerInstanceId !== this.managerInstanceId)
+        if (ownedBySibling(slot, this.managerInstanceId))
             return undefined;
         return slot.runtime?.kind === this.runtime.kind ? slot.runtime : undefined;
     }
@@ -5924,13 +5959,9 @@ export class Manager {
             catch (e) {
                 return { ok: false, error: e.message };
             }
-            const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
-            if (missing.length)
-                return { ok: false, error: `${connector.name} harness needs ${missing.join(", ")} on PATH - not found` };
-            if (entry.launch.variant && !connector.supportsModelVariant)
-                return { ok: false, error: `${connector.name} connector does not support model variants (variant)` };
-            if (entry.launch.prompt !== undefined && !connector.supportsPrompt)
-                return { ok: false, error: `${connector.name} connector does not support an initial prompt (prompt)` };
+            const harness = this.launchHarness(connector);
+            if ("refusal" in harness)
+                return { ok: false, error: harness.refusal };
             let retainedSession;
             try {
                 retainedSession = this.retainedSessionId(entry, connector);
@@ -5962,10 +5993,6 @@ export class Manager {
                     return { ok: false, error: `retained manifest agent ${launchSource.requested} is missing or its hash changed; refusing same-principal resume` };
                 launchOptions = spec.launchOptions;
                 exact = spec.continuity === "exact";
-                // An exact seat reopens its retained session or fails, like its manifest launch, so the
-                // connector must honor reopenSession before the batch starts any child.
-                if (exact && (!connector.supportsSessionReopen || !connector.supportsSessionContinuation))
-                    return { ok: false, error: `${connector.name} connector does not support exact session continuity (continuity: exact)` };
             }
             else {
                 try {
@@ -5975,6 +6002,11 @@ export class Manager {
                     return { ok: false, error: e.message };
                 }
             }
+            // Asked once `exact` is known: an exact seat reopens its retained session or fails, like its
+            // manifest launch, so the connector must honor reopenSession before the batch starts any child.
+            const unsupported = this.capabilityRefusal(connector, { variant: entry.launch.variant, prompt: entry.launch.prompt, exact });
+            if (unsupported)
+                return { ok: false, error: unsupported };
             let authority;
             try {
                 authority = await this.validateRetainedAuthority(entry);
@@ -5984,7 +6016,7 @@ export class Manager {
             }
             try {
                 const resumeConfig = loadCotalConfig(this.workspaceRoot);
-                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, parseShareSelection(entry.launch.shareTools));
+                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, entry.launch.shareTools);
                 const envAllow = spawnEnvAllow(resumeConfig);
                 const launchOpts = {
                     space: this.space,
@@ -6016,7 +6048,9 @@ export class Manager {
                     events: entry.launch.events,
                     mcpServers,
                     envAllow,
+                    resolvedBinaries: harness.binaries,
                     workspaceRoot: this.workspaceRoot,
+                    cwd: entry.launch.cwd,
                 };
                 const spec = connector.buildLaunch(launchOpts);
                 spec.env = { ...spec.env, COTAL_MANAGER_INSTANCE: this.managerInstanceId };
@@ -8674,7 +8708,7 @@ export class Manager {
             console.error(`✓ static reconcile recovered alias=${item.alias} phase=retired uid=${item.lifecycleUid} attempts=${item.attempts}/${item.maxAttempts}`);
             return;
         }
-        if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId) {
+        if (ownedBySibling(row, this.managerInstanceId)) {
             item.disposition = "refused";
             item.remedy = "the owning manager must reconcile or an operator must perform an explicit CAS takeover";
             item.lastError = `the durable slot belongs to manager instance ${row.ownerInstanceId}, not ${this.managerInstanceId}`;
@@ -8867,7 +8901,7 @@ export class Manager {
                 // hazard, now cross-instance). A legacy row (pre-3b-2, no owner recorded) predates multi-manager,
                 // so this manager is its legitimate single-manager-past successor and reconciles it. An orphaned
                 // sibling row is reclaimed only by an explicit operator CAS takeover (ruling 1), never here.
-                if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId) {
+                if (ownedBySibling(row, this.managerInstanceId)) {
                     preservedForeign++;
                     continue;
                 }