@cotal-ai/manager 0.68.0 → 0.69.0

package/dist/manager.js

@@ -4,8 +4,8 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, bearerCommandFailure, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
-import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
+import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, bearerCommandFailure, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
 import { DELIVERY_ADMIN_BOOT_WAIT_MS, isUnansweredDeliveryAdmin, makeManagerEndpointEvictionEvidence, makeManagerEndpointHolderEvictor, untilDeliveryAdminAnswers } from "./endpoint-evict.js";
@@ -32,7 +32,7 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
 import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
-import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
+import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
 /** Minimum slot lifetime for rate-flooring (P4c). A slot freed (by despawn OR natural exit/reap)
  *  before living this long leaves a cooling stamp that still counts toward the ceiling until it
  *  expires — so churn (spawn↔despawn or spawn↔fast-exit) can't outrun the concurrency bound. */
@@ -293,7 +293,8 @@ export class Manager {
     /** The ONE secret store for every kind this manager touches (daemon-cred remint + agent kinds).
      *  See {@link ManagerOptions.secretStore}. */
     secrets;
-    /** Named identity of {@link secrets}: the same coordinate the delivery daemon must reload from. */
+    /** Named identity of {@link secrets}: the same coordinate the delivery daemon must reload from.
+     *  Set at construction for an injected store; the workspace store is named on first challenge. */
     secretStoreIdentity;
     /** See {@link ManagerOptions.installedExtensions}. */
     installedExtensions;
@@ -604,9 +605,8 @@ export class Manager {
         if (opts.remoteAuthority)
             this.managerLifecycleUid = opts.remoteAuthority.lifecycleUid;
         this.secrets = opts.secretStore ?? workspaceSecretStore(this.workspaceRoot);
-        this.secretStoreIdentity = opts.secretStore
-            ? injectedManagerStoreIdentity(opts.secretStore)
-            : { kind: "fs", root: resolve(this.workspaceRoot) };
+        if (opts.secretStore)
+            this.secretStoreIdentity = injectedManagerStoreIdentity(opts.secretStore);
         this.installedExtensions = opts.installedExtensions ?? false;
         this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
         if (opts.pooled && isCustodialRuntime(this.runtime))
@@ -1140,6 +1140,9 @@ export class Manager {
                 `this space's delivery lease (${holder}), so its SecretStore is not the store the daemon ` +
                 `reloads from - nothing reminted`);
         const daemon = answer.identity;
+        // The workspace store records its id the first time it is named, so it is named here, where
+        // only an auth manager reaches, rather than in a constructor every open-mode manager runs.
+        this.secretStoreIdentity ??= parseSecretStoreIdentity(this.secrets.identity);
         if (!sameSecretStoreIdentity(this.secretStoreIdentity, daemon)) {
             console.error(`! ${divergentSecretStoreNotice(this.secretStoreIdentity, daemon)}`);
             return "divergent";
@@ -1687,7 +1690,7 @@ export class Manager {
         // actually saw.
         const backfillFloor = await this.chatFrontierForPreservation();
         const inventory = this.preservationInventory ?? {
-            version: "cotal-manager-resume/v1",
+            version: "cotal-manager-resume/v2",
             space: this.space,
             createdAt: new Date().toISOString(),
             agents: [...this.agents.values()].map((a) => this.resumeEntry(a, backfillFloor)),
@@ -2150,17 +2153,17 @@ export class Manager {
             await step("release renewal lease", () => this.ep.releaseDaemonRenewalLease());
         }
         // Capture BEFORE the serve loop is torn down: `stopServiceServe` clears the state, and what is
-        // being asked here is "did this process register a service instance", which only the state
+        // being asked here is "which registration did this process write", which only the state
         // before teardown can answer. Deregistration runs AFTER the serve loop has drained, so no
         // in-flight command can write a status back onto the record it just removed.
-        const registered = this.serviceServe !== undefined;
+        const registrationRevision = this.serviceServe?.grant.registrationRevision;
         await step("stop service serve", () => this.stopServiceServe());
         // The drives AFTER the serve loop (no new `run-start` can land) and BEFORE deregistration: a
         // released run's status write is the last thing this incarnation says about it.
         await step("stop run hosting", () => this.runHosting?.stop());
         this.runHosting = undefined;
-        if (registered && !seatFailure)
-            await step("deregister service", () => this.deregisterServiceOnStop());
+        if (registrationRevision !== undefined && !seatFailure)
+            await step("deregister service", () => this.deregisterServiceOnStop(registrationRevision));
         await step("stop goal writer", () => this.stopGoalWriter());
         await step("stop session plane", () => this.stopSessionPlane());
         await step("stop endpoint", () => this.ep.stop());
@@ -2206,8 +2209,8 @@ export class Manager {
      * deadline — on every `cotal ps`, `stop` and `attach` in that space, for good. A manager that is
      * shutting down is the one participant that KNOWS it is going away, so it says so.
      *
-     * The delete is revision-pinned inside {@link deregisterServiceInstance}, so a successor that
-     * persists the SAME instanceId and has already re-registered loses nothing to a slow stop here.
+     * The delete is pinned to the `registrationRevision` this process registered at, so a successor
+     * that persists the SAME instanceId and has already re-registered loses nothing to a slow stop here.
      *
      * Best-effort and LOUD, matching every other teardown step: a broker that is already gone must not
      * turn a stop into a failure, but a registration that survives a stop is the exact defect this
@@ -2215,11 +2218,12 @@ export class Manager {
      * rather than swallowed. It is not fatal because a crash leaves the same state and the operator
      * verb handles both.
      */
-    async deregisterServiceOnStop() {
+    async deregisterServiceOnStop(registrationRevision) {
         const iid = this.managerInstanceId;
         const dereg = ({ recordsKv, authKv }) => deregisterServiceInstance(recordsKv, {
             endpoint: MANAGER_ENDPOINT,
             instanceId: iid,
+            registrationRevision,
             observeGeneration: async () => {
                 const key = epgateKey(MANAGER_ENDPOINT, iid);
                 const entry = await authKv.get(key);
@@ -2235,7 +2239,7 @@ export class Manager {
             if (outcome.removed)
                 console.error(`✓ deregistered manager instance ${iid} from the ${MANAGER_ENDPOINT} service registry (spec revision ${outcome.specRevision})`);
             else if (outcome.reason === "superseded")
-                console.error(`! manager instance ${iid} was not deregistered: its registration moved while this stop ran, so another incarnation owns it now - leaving it alone`);
+                console.error(`! manager instance ${iid} was not deregistered: another incarnation has registered it since this process did - leaving it alone`);
             else if (outcome.reason === "registration-in-flight")
                 console.error(`! manager instance ${iid} was not deregistered: a registration is still in flight (governance slot held at the live gate generation) - leaving it alone`);
             // `absent` is silent: there was nothing registered to remove, which is not news at shutdown.
@@ -4275,7 +4279,7 @@ export class Manager {
     nameInUse(name, live = this.liveRosterNames()) {
         return this.agents.has(name) || this.reserved.has(name) || this.retiring.has(name) || live.has(name);
     }
-    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
+    /** First free name in the series `base`, `base_2`, `base_3`, … — checked against live slots,
      *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
      *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
      *  connector session, another manager's agent): allocating their name would mint a sibling the
@@ -4356,11 +4360,12 @@ export class Manager {
                 throw new Error(`${flag}: expected an array of strings`);
             return v;
         };
-        let subscribe, allowSubscribe, allowPublish;
+        let subscribe, allowSubscribe, allowPublish, shareTools;
         try {
             subscribe = strList(args.subscribe, "subscribe");
             allowSubscribe = strList(args.allowSubscribe, "allowSubscribe");
             allowPublish = strList(args.allowPublish, "allowPublish");
+            shareTools = strList(args.shareTools, "shareTools");
         }
         catch (e) {
             return Promise.resolve({ ok: false, error: e.message });
@@ -4410,7 +4415,7 @@ export class Manager {
             subscribe,
             allowSubscribe,
             allowPublish,
-            shareTools: args.shareTools !== undefined ? String(args.shareTools) : undefined,
+            shareTools,
             ...(supervise !== undefined ? { supervise } : {}),
             route,
         }, caller, hooks);
@@ -4722,6 +4727,9 @@ export class Manager {
         }
     }
     async startAgentActive(opts, spawner, hooks) {
+        // The caller keeps its array, so the selection is copied before the first await: a later write
+        // to it cannot change what this launch shares or what preservation retains.
+        const shareTools = opts.shareTools && [...opts.shareTools];
         if (opts.delegatedIntent) {
             if (!this.remoteAuthority?.executeDelegatedUserIntent)
                 return { ok: false, error: `"${opts.name}" names a delegated user intent, and this manager has no host execution for one` };
@@ -4778,10 +4786,7 @@ export class Manager {
                 return { ok: false, error: e.message };
             }
         }
-        // Harness precedence (#869): --agent flag > persona file `agent:` > detached caller default >
-        // this manager's COTAL_DEFAULT_AGENT > DEFAULT_CONNECTOR. Both environment values are defaults,
-        // never overrides: neither may beat a deliberate per-persona pin.
-        const agent = opts.agent ?? def?.agent ?? opts.defaultAgent ?? defaultAgentType(DEFAULT_CONNECTOR);
+        const agent = resolveAgentType({ flag: opts.agent, pin: def?.agent, callerDefault: opts.defaultAgent });
         // Materialize the requested connector up front — the ONE async step in the spawn path (a lazy
         // `cotal ext` manifest import on the published binary). It runs BEFORE the capacity/reserve span
         // below so that span stays fully SYNCHRONOUS and atomic. On the manifest binary this also honors a
@@ -4862,7 +4867,7 @@ export class Manager {
                 return { ok: false, error: `${delegatedBy}, so it cannot reopen a session held on this host (continuity: exact)` };
             if (typeof opts.cwd === "string" && opts.cwd !== "")
                 return { ok: false, error: `${delegatedBy}, so it cannot run in a directory on this host's filesystem (cwd); the seat runs in its runtime resource's own directory` };
-            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, parseShareSelection(opts.shareTools)));
+            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, shareTools));
             if (shared.length)
                 return { ok: false, error: `${delegatedBy}, so it cannot share MCP servers that run on this host (${shared.join(", ")}); pass --share-tools none` };
         }
@@ -4883,7 +4888,7 @@ export class Manager {
         // Resolve the launch profile: IDENTITY (free-form `name:`) + role + read/post ACL + capabilities
         // + model/variant. Either from a fully-resolved manifest launch object (`opts.resolved`, whose `config`
         // is a materialized transient persona — the file is NOT the access authority), or from the
-        // persona file. The number rides the IDENTITY (socrates → socrates-2), not the file ref — a
+        // persona file. The number rides the IDENTITY (socrates → socrates_2), not the file ref — a
         // redelivered identical spawn yields a fresh numbered agent (MAX_AGENTS bounds the blast radius).
         let identityName;
         let role;
@@ -4898,13 +4903,13 @@ export class Manager {
         if (opts.resolved) {
             // A manifest launch is the access + identity authority: imperative overrides arriving
             // alongside `resolved` are a caller contract error, not something to merge (no fallbacks).
-            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || opts.shareTools || opts.identity)
+            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || shareTools || opts.identity)
                 return { ok: false, error: "a manifest launch (resolved) rejects imperative overrides (identity/subscribe/allow*/prompt/shareTools)" };
             const r = opts.resolved;
             identityName = r.name;
             role = opts.role ?? r.role;
             subscribe = r.subscribe;
-            allowSubscribe = r.allowSubscribe?.length ? r.allowSubscribe : r.subscribe;
+            allowSubscribe = r.allowSubscribe;
             allowPublish = r.allowPublish;
             capabilities = r.capabilities;
             model = opts.model ?? r.model;
@@ -4926,9 +4931,7 @@ export class Manager {
             // paths of the merged grammar can't diverge. One source feeds BOTH the minted creds and the
             // connector env below.
             subscribe = opts.subscribe ?? def.subscribe;
-            // Defaulted the same way the loader/provisioner do — minted into the creds (the broker
-            // boundary); runtime durable joins are re-authorized against the committed ACL by the daemon.
-            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? subscribe ?? [];
+            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? [];
             allowPublish = opts.allowPublish ?? def.allowPublish;
             capabilities = def.capabilities;
             // #651: fold the persona's model into the launch record, mirroring the variant line below
@@ -4939,6 +4942,14 @@ export class Manager {
             variant = opts.variant ?? def.variant;
             launchOptions = mergeLaunchOptions(def.launchOptions, opts.launchOptions);
         }
+        // Resolved once for both branches, because this one list is granted, minted, recorded on the
+        // launch and forwarded to the session, and each of those must read the list the provisioner does.
+        try {
+            allowSubscribe = resolveReadAcl(subscribe ?? [], allowSubscribe);
+        }
+        catch (e) {
+            return { ok: false, error: opts.resolved ? `launch agent: ${e.message}` : `persona ${configPath}: ${e.message}` };
+        }
         // #651: an empty or whitespace-only model string is not a pin. Coerce it to undefined here, at
         // the single point every path (persona, manifest, imperative) has resolved `model`, so it
         // serializes ABSENT rather than present-but-empty (`"model": ""`), which a key-presence consumer
@@ -5026,6 +5037,30 @@ export class Manager {
         const unportable = this.runtime.spawnDelegated ? Object.keys(launchOptions ?? {}).filter((k) => typeof launchOptions[k] !== "string") : [];
         if (unportable.length)
             return { ok: false, error: `runtime "${this.runtime.kind}" starts seats outside this host, so it cannot pass non-string launch options (${unportable.join(", ")})` };
+        // The AG-UI event plane is on unless the launch explicitly opted out. Refused HERE, before
+        // anything is minted: a connector that cannot
+        // emit must fail before provisioning rather than after, exactly as an unsupported `resume` does.
+        // The GRANT itself cannot be derived yet. It is keyed on the agent's PRINCIPAL, and in user mode
+        // the principal's owner is resolved further down, so deriving it from anything in scope here
+        // would mean guessing at the identity the child will actually connect as. It is added at the
+        // accept seam below, where the allocated triple exists.
+        if (this.eventsRequired && opts.events === false)
+            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
+        const events = this.eventsRequired || opts.events !== false;
+        if (events && !connector.eventChannel)
+            return { ok: false, error: this.eventsRequired
+                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
+                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
+        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
+        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
+        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
+        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
+        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
+        if (this.auth && !this.userMode) {
+            const claims = [opts, (opts.resolved ?? {})];
+            if (claims.some((c) => c.endpointCapabilities !== undefined))
+                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
+        }
         // #4 A4 (panel): the roster the allocation consults must reflect the initial presence snapshot,
         // or a spawn immediately after manager boot races an already-live unmanaged peer and re-opens the
         // very collision black-hole this closes. Await the snapshot (bounded internally, fail-safe on an
@@ -5035,10 +5070,10 @@ export class Manager {
         await this.ep.waitForPresenceSnapshot();
         // M6 (P2 item 2 spawn-as-action): a HARD-PINNED name — an imperative `--name`/identity override
         // or a manifest-declared name (opts.resolved) — that collides with a LIVE/provisioning/reserved
-        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `-2`
+        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `_2`
         // suffix (so an address-by-triple caller's pinned name can't be re-pointed). A PERSONA-DERIVED
         // base name (no pin) keeps uniqueName's collision numbering, so multi-peer `spawn reviewer` twice
-        // still yields reviewer + reviewer-2. The retiring-hold refuse (~2472) is orthogonal and already fired.
+        // still yields reviewer + reviewer_2. The retiring-hold refuse (~2472) is orthogonal and already fired.
         const hardPinned = opts.identity !== undefined || opts.resolved !== undefined;
         let name;
         if (hardPinned) {
@@ -5054,42 +5089,6 @@ export class Manager {
         else {
             name = this.uniqueName(identityName);
         }
-        this.reserved.add(name);
-        // The AG-UI event plane is on unless the launch explicitly opted out. Refused HERE, before
-        // anything is minted: a connector that cannot
-        // emit must fail before provisioning rather than after, exactly as an unsupported `resume` does.
-        // The GRANT itself cannot be derived yet. It is keyed on the agent's PRINCIPAL, and in user mode
-        // the principal's owner is resolved further down, so deriving it from anything in scope here
-        // would mean guessing at the identity the child will actually connect as. It is added at the
-        // accept seam below, where the allocated triple exists.
-        if (this.eventsRequired && opts.events === false) {
-            this.reserved.delete(name);
-            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
-        }
-        const events = this.eventsRequired || opts.events !== false;
-        if (events && !connector.eventChannel) {
-            // Release the just-reserved name on this fail-fast path. A leaked reserve is silent: it costs
-            // the next spawn of this persona its un-suffixed name and nothing reports why.
-            this.reserved.delete(name);
-            return { ok: false, error: this.eventsRequired
-                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
-                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
-        }
-        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
-        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
-        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
-        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
-        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
-        if (this.auth && !this.userMode) {
-            const claims = [opts, (opts.resolved ?? {})];
-            if (claims.some((c) => c.endpointCapabilities !== undefined)) {
-                this.reserved.delete(name);
-                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
-            }
-        }
-        // Set once the agent's creds + durables are minted; cleared the moment a live slot takes ownership
-        // (`agents.set`, after which freeSlot deprovisions on exit). If it survives to `finally`, the spawn
-        // threw AFTER minting (buildLaunch / runtime.spawn) — tear the orphan down so no footprint leaks (#159 B).
         // Set once the agent's footprint (durables + creds, or the user-mode grant + secret files)
         // exists; cleared when a live slot takes ownership. If it survives to `finally`, the spawn threw
         // AFTER provisioning (buildLaunch / runtime.spawn) — the orphan-rollback tears it down. Carries
@@ -5103,6 +5102,9 @@ export class Manager {
         let provisioned;
         // A carried resume's seat-private home, removed by the finally unless a live seat took it.
         let seatHome;
+        // Taken right before the try so its finally is the only release; a refusal belongs above the
+        // allocation, where there is no name to give back.
+        this.reserved.add(name);
         try {
             // A stable nkey identity assigned at spawn: the public key is the agent's card.id (threaded via
             // COTAL_ID); the seed is retained to mint matching creds later.
@@ -5208,10 +5210,8 @@ export class Manager {
                         }
                         : undefined,
                 });
-                if ("error" in prep) {
-                    this.reserved.delete(name);
+                if ("error" in prep)
                     return { ok: false, error: prep.error };
-                }
                 // THE HOST'S UID WINS (#1972). On the local arm this is the value passed in, unchanged. On
                 // the hosted enrollment arm the host selected it, and from here every lifecycle-keyed thing
                 // this spawn records — the slot, the launch, the managed row, the teardown credential — must
@@ -5273,7 +5273,7 @@ export class Manager {
             // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
             // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
             const cotalConfig = loadCotalConfig(this.workspaceRoot);
-            const mcpServers = connectorServers(cotalConfig, agent, parseShareSelection(opts.shareTools));
+            const mcpServers = connectorServers(cotalConfig, agent, shareTools);
             // The operator's spawn-env policy travels the same route: absent means no extras (the OS
             // allow-list + operator knobs + connector-declared inputs), present means those names too.
             // A connector never reads the config itself.
@@ -5400,7 +5400,7 @@ export class Manager {
                     allowPublish,
                     capabilities,
                     events,
-                    shareTools: opts.shareTools,
+                    shareTools,
                     forkSource: opts.resume,
                     ...(opts.resume !== undefined && spec?.resumeRecordPath ? { resumeRecordPath: spec.resumeRecordPath } : {}),
                     ...(carried ? { carried: { transcriptSha256: carried.sha256, host: carried.sourceHost, transferredAt: carried.stagedAt } } : {}),
@@ -5573,19 +5573,22 @@ export class Manager {
         const batchReservations = [];
         const prepared = new Map();
         try {
-            if (inventory.version !== "cotal-manager-resume/v1")
+            if (inventory.version !== "cotal-manager-resume/v2")
                 return { ok: false, agents: [], error: `unsupported manager resume inventory version ${String(inventory.version)}` };
             if (inventory.space !== this.space)
                 return { ok: false, agents: [], error: `resume inventory belongs to space "${inventory.space}", not "${this.space}"` };
+            // The caller keeps its inventory, so each selection is copied before the first await: a later
+            // write to it cannot change what a resumed seat shares or what the next preservation retains.
+            const entries = inventory.agents.map((entry) => ({ ...entry, launch: { ...entry.launch, shareTools: entry.launch.shareTools && [...entry.launch.shareTools] } }));
             const seen = new Set();
             const principals = new Set();
             const orphans = [];
             await this.ep.waitForPresenceSnapshot();
             const liveRoster = this.ep.getRoster().filter((presence) => presence.status !== "offline");
             const occupancy = this.occupancy();
-            if (occupancy.used + inventory.agents.length > MAX_AGENTS)
-                return { ok: false, agents: [], error: `resume inventory of ${inventory.agents.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
-            for (const entry of inventory.agents) {
+            if (occupancy.used + entries.length > MAX_AGENTS)
+                return { ok: false, agents: [], error: `resume inventory of ${entries.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
+            for (const entry of entries) {
                 if (seen.has(entry.name))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate agent name "${entry.name}"` };
                 seen.add(entry.name);
@@ -5642,12 +5645,12 @@ export class Manager {
                 if (this.agents.has(entry.name) || this.reserved.has(entry.name))
                     return { ok: false, agents: [], error: `retained agent "${entry.name}" is already managed or reserved` };
             }
-            for (const entry of inventory.agents) {
+            for (const entry of entries) {
                 this.reserved.add(entry.name);
                 batchReservations.push(entry.name);
             }
             const preflight = [];
-            for (const entry of inventory.agents) {
+            for (const entry of entries) {
                 const reply = await this.resumePreservedAgent(entry, true, true, prepared);
                 preflight.push({ name: entry.name, reply });
             }
@@ -5666,12 +5669,12 @@ export class Manager {
                     return { ok: false, agents: [], error: refusal };
             }
             const agents = [];
-            for (let i = 0; i < inventory.agents.length; i++) {
-                const entry = inventory.agents[i];
+            for (let i = 0; i < entries.length; i++) {
+                const entry = entries[i];
                 const reply = await this.resumePreservedAgent(entry, false, true, prepared);
                 agents.push({ name: entry.name, reply });
                 if (!reply.ok) {
-                    for (const skipped of inventory.agents.slice(i + 1))
+                    for (const skipped of entries.slice(i + 1))
                         agents.push({ name: skipped.name, reply: { ok: false, error: `not launched because ${entry.name} failed` } });
                     return { ok: false, agents, error: reply.error };
                 }
@@ -5881,7 +5884,7 @@ export class Manager {
         const slot = await this.readStaticReconcileSlot(entry.name);
         if (slot?.phase !== "active" || slot.actor !== entry.identity.id || slot.lifecycleUid !== entry.identity.lifecycleUid)
             return undefined;
-        if (slot.ownerInstanceId !== undefined && slot.ownerInstanceId !== this.managerInstanceId)
+        if (ownedBySibling(slot, this.managerInstanceId))
             return undefined;
         return slot.runtime?.kind === this.runtime.kind ? slot.runtime : undefined;
     }
@@ -6013,7 +6016,7 @@ export class Manager {
             }
             try {
                 const resumeConfig = loadCotalConfig(this.workspaceRoot);
-                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, parseShareSelection(entry.launch.shareTools));
+                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, entry.launch.shareTools);
                 const envAllow = spawnEnvAllow(resumeConfig);
                 const launchOpts = {
                     space: this.space,
@@ -8705,7 +8708,7 @@ export class Manager {
             console.error(`✓ static reconcile recovered alias=${item.alias} phase=retired uid=${item.lifecycleUid} attempts=${item.attempts}/${item.maxAttempts}`);
             return;
         }
-        if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId) {
+        if (ownedBySibling(row, this.managerInstanceId)) {
             item.disposition = "refused";
             item.remedy = "the owning manager must reconcile or an operator must perform an explicit CAS takeover";
             item.lastError = `the durable slot belongs to manager instance ${row.ownerInstanceId}, not ${this.managerInstanceId}`;
@@ -8898,7 +8901,7 @@ export class Manager {
                 // hazard, now cross-instance). A legacy row (pre-3b-2, no owner recorded) predates multi-manager,
                 // so this manager is its legitimate single-manager-past successor and reconciles it. An orphaned
                 // sibling row is reclaimed only by an explicit operator CAS takeover (ruling 1), never here.
-                if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId) {
+                if (ownedBySibling(row, this.managerInstanceId)) {
                     preservedForeign++;
                     continue;
                 }