@cotal-ai/manager 0.68.0 → 0.70.0

package/dist/manager.js

@@ -4,8 +4,9 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, parseShareSelection, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, bearerCommandFailure, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
-import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DEFAULT_CONNECTOR, defaultAgentType, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
+import Headless from "@xterm/headless";
+import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, bearerCommandFailure, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
 import { DELIVERY_ADMIN_BOOT_WAIT_MS, isUnansweredDeliveryAdmin, makeManagerEndpointEvictionEvidence, makeManagerEndpointHolderEvictor, untilDeliveryAdminAnswers } from "./endpoint-evict.js";
@@ -32,7 +33,7 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
 import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
-import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
+import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
 /** Minimum slot lifetime for rate-flooring (P4c). A slot freed (by despawn OR natural exit/reap)
  *  before living this long leaves a cooling stamp that still counts toward the ceiling until it
  *  expires — so churn (spawn↔despawn or spawn↔fast-exit) can't outrun the concurrency bound. */
@@ -293,7 +294,8 @@ export class Manager {
     /** The ONE secret store for every kind this manager touches (daemon-cred remint + agent kinds).
      *  See {@link ManagerOptions.secretStore}. */
     secrets;
-    /** Named identity of {@link secrets}: the same coordinate the delivery daemon must reload from. */
+    /** Named identity of {@link secrets}: the same coordinate the delivery daemon must reload from.
+     *  Set at construction for an injected store; the workspace store is named on first challenge. */
     secretStoreIdentity;
     /** See {@link ManagerOptions.installedExtensions}. */
     installedExtensions;
@@ -379,7 +381,7 @@ export class Manager {
      *  standing connection DISJOINT from the serve credential (Q2), scoped to exactly this endpoint's
      *  goal bind/terminal facts + goal-record writes ({@link goalWriterGrants}). Auth mode mints the
      *  `goal-writer` cred; an open mesh uses a bare connection (no credential system to mint from).
-     *  `gate` (auth mode) is the own-issuance-gate READER for the must-5 (a) currency belt — the
+     *  `gate` (auth mode) is the own-issuance-gate READER for the own-gate currency belt — the
      *  manager reads its OWN `epgate.<e>.<iid>` epoch over this connection before a terminal commit
      *  and skips a superseded commit (the fast-fail belt paired with the (b) barrier-revoke fence). */
     goalWriter;
@@ -387,7 +389,7 @@ export class Manager {
      *  per-run credential and connection. Absent under a remote authority, which mints no driver
      *  credentials, so the `run-*` family refuses there rather than connecting on a weaker identity. */
     runHosting;
-    /** P2 item 2 must-5 (b): the STABLE goal-writer identity (auth mode) — minted once at
+    /** The STABLE goal-writer identity (auth mode) — minted once at
      *  registration alongside the serve identity; a renewal re-mints the SAME nkey with a fresh
      *  bounded exp and re-stages its distinct credId into the §13.1 revocation family. The current
      *  goal-writer credential is minted INSIDE {@link registerManagerService}'s run block (fence
@@ -418,10 +420,10 @@ export class Manager {
     sessionLedgerCreds;
     /** P2 item 2: the acceptance replied for each in-flight goalId this incarnation accepted, so an
      *  idempotent same-goalId retry serves the IDENTICAL acceptance (same allocated name/triple) without
-     *  a second spawn. Durable cross-incarnation reconstruction rides the must-5 goal-index; here the
+     *  a second spawn. Durable cross-incarnation reconstruction rides the goal index; here the
      *  live map covers same-incarnation retries, with the committed result fact as the fallback. */
     goalAcceptances = new Map();
-    /** P2 item 2 must-5 Q-B: the boot reconcile of the durable goal index runs ONCE at start (a
+    /** The boot reconcile of the durable goal index runs ONCE at start (a
      *  fresh incarnation inherits the endpoint's accepted-but-unterminal goals from any predecessor).
      *  Spawn-as-action REFUSES to accept until it completes, so the sweep never races a live goal's
      *  acceptance (settling one mid-flight would steal its real terminal). */
@@ -604,9 +606,8 @@ export class Manager {
         if (opts.remoteAuthority)
             this.managerLifecycleUid = opts.remoteAuthority.lifecycleUid;
         this.secrets = opts.secretStore ?? workspaceSecretStore(this.workspaceRoot);
-        this.secretStoreIdentity = opts.secretStore
-            ? injectedManagerStoreIdentity(opts.secretStore)
-            : { kind: "fs", root: resolve(this.workspaceRoot) };
+        if (opts.secretStore)
+            this.secretStoreIdentity = injectedManagerStoreIdentity(opts.secretStore);
         this.installedExtensions = opts.installedExtensions ?? false;
         this.runtime = createRuntime(opts.runtime ?? "auto", `cotal-${this.space}`);
         if (opts.pooled && isCustodialRuntime(this.runtime))
@@ -801,7 +802,7 @@ export class Manager {
         // First mint on a fresh root is exclusive create (#1263). Two processes that both observe no
         // file must not keep different in-memory ids: of N concurrent starts exactly one creates the
         // file (`link` / O_EXCL) and the others adopt that identity before taking a lease, or refuse
-        // with manager-instance-identity-create-lost. Atomic rename is not enough, because the loser
+        // with identity-record-create-lost. Atomic rename is not enough, because the loser
         // of a replace would still serve under the id it minted.
         {
             if (this.remoteAuthority) {
@@ -1018,7 +1019,7 @@ export class Manager {
         // rides the serve grant's epoch + the family-staged session-ledger cred), on its own standing
         // connection disjoint from both the serve and goal-writer creds.
         await this.startSessionPlane();
-        // P2 item 2 must-5 Q-B: reconcile any accepted-but-unterminal goals inherited from a predecessor
+        // Reconcile any accepted-but-unterminal goals inherited from a predecessor
         // BEFORE spawn-as-action begins accepting (the goalReconcileDone gate) — a fresh incarnation
         // never drops a goal a dead predecessor accepted. Never fatal; the gate opens either way.
         await this.reconcileGoalIndex();
@@ -1140,6 +1141,9 @@ export class Manager {
                 `this space's delivery lease (${holder}), so its SecretStore is not the store the daemon ` +
                 `reloads from - nothing reminted`);
         const daemon = answer.identity;
+        // The workspace store records its id the first time it is named, so it is named here, where
+        // only an auth manager reaches, rather than in a constructor every open-mode manager runs.
+        this.secretStoreIdentity ??= parseSecretStoreIdentity(this.secrets.identity);
         if (!sameSecretStoreIdentity(this.secretStoreIdentity, daemon)) {
             console.error(`! ${divergentSecretStoreNotice(this.secretStoreIdentity, daemon)}`);
             return "divergent";
@@ -1407,7 +1411,7 @@ export class Manager {
                     console.error(`! endpoint-serve renewal: ${e.message} - the manager's service endpoint dies loud at this cred's expiry unless it is re-registered`);
                 }
             }
-            // P2 item 2 must-5 (b): the manager is also the goal-writer's renewal owner — re-mint the SAME
+            // The manager is also the goal-writer's renewal owner — re-mint the SAME
             // goal-writer nkey with a fresh bounded exp AND re-stage its new credId into the §13.1 family,
             // through the scoped executor (never the standing seed). Without this the standing goal-writer
             // connection dies at its TTL and spawn-as-action stops accepting until a restart. The
@@ -1687,7 +1691,7 @@ export class Manager {
         // actually saw.
         const backfillFloor = await this.chatFrontierForPreservation();
         const inventory = this.preservationInventory ?? {
-            version: "cotal-manager-resume/v1",
+            version: "cotal-manager-resume/v2",
             space: this.space,
             createdAt: new Date().toISOString(),
             agents: [...this.agents.values()].map((a) => this.resumeEntry(a, backfillFloor)),
@@ -2150,17 +2154,17 @@ export class Manager {
             await step("release renewal lease", () => this.ep.releaseDaemonRenewalLease());
         }
         // Capture BEFORE the serve loop is torn down: `stopServiceServe` clears the state, and what is
-        // being asked here is "did this process register a service instance", which only the state
+        // being asked here is "which registration did this process write", which only the state
         // before teardown can answer. Deregistration runs AFTER the serve loop has drained, so no
         // in-flight command can write a status back onto the record it just removed.
-        const registered = this.serviceServe !== undefined;
+        const registrationRevision = this.serviceServe?.grant.registrationRevision;
         await step("stop service serve", () => this.stopServiceServe());
         // The drives AFTER the serve loop (no new `run-start` can land) and BEFORE deregistration: a
         // released run's status write is the last thing this incarnation says about it.
         await step("stop run hosting", () => this.runHosting?.stop());
         this.runHosting = undefined;
-        if (registered && !seatFailure)
-            await step("deregister service", () => this.deregisterServiceOnStop());
+        if (registrationRevision !== undefined && !seatFailure)
+            await step("deregister service", () => this.deregisterServiceOnStop(registrationRevision));
         await step("stop goal writer", () => this.stopGoalWriter());
         await step("stop session plane", () => this.stopSessionPlane());
         await step("stop endpoint", () => this.ep.stop());
@@ -2206,8 +2210,8 @@ export class Manager {
      * deadline — on every `cotal ps`, `stop` and `attach` in that space, for good. A manager that is
      * shutting down is the one participant that KNOWS it is going away, so it says so.
      *
-     * The delete is revision-pinned inside {@link deregisterServiceInstance}, so a successor that
-     * persists the SAME instanceId and has already re-registered loses nothing to a slow stop here.
+     * The delete is pinned to the `registrationRevision` this process registered at, so a successor
+     * that persists the SAME instanceId and has already re-registered loses nothing to a slow stop here.
      *
      * Best-effort and LOUD, matching every other teardown step: a broker that is already gone must not
      * turn a stop into a failure, but a registration that survives a stop is the exact defect this
@@ -2215,11 +2219,12 @@ export class Manager {
      * rather than swallowed. It is not fatal because a crash leaves the same state and the operator
      * verb handles both.
      */
-    async deregisterServiceOnStop() {
+    async deregisterServiceOnStop(registrationRevision) {
         const iid = this.managerInstanceId;
         const dereg = ({ recordsKv, authKv }) => deregisterServiceInstance(recordsKv, {
             endpoint: MANAGER_ENDPOINT,
             instanceId: iid,
+            registrationRevision,
             observeGeneration: async () => {
                 const key = epgateKey(MANAGER_ENDPOINT, iid);
                 const entry = await authKv.get(key);
@@ -2235,7 +2240,7 @@ export class Manager {
             if (outcome.removed)
                 console.error(`✓ deregistered manager instance ${iid} from the ${MANAGER_ENDPOINT} service registry (spec revision ${outcome.specRevision})`);
             else if (outcome.reason === "superseded")
-                console.error(`! manager instance ${iid} was not deregistered: its registration moved while this stop ran, so another incarnation owns it now - leaving it alone`);
+                console.error(`! manager instance ${iid} was not deregistered: another incarnation has registered it since this process did - leaving it alone`);
             else if (outcome.reason === "registration-in-flight")
                 console.error(`! manager instance ${iid} was not deregistered: a registration is still in flight (governance slot held at the live gate generation) - leaving it alone`);
             // `absent` is silent: there was nothing registered to remove, which is not news at shutdown.
@@ -3361,16 +3366,22 @@ export class Manager {
             // A failed removal joins the refusal instead of throwing, so every removal is attempted and
             // the refusal still reaches the caller.
             const unshredded = [];
-            for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files]) {
-                for (const path of [family.actorToken, family.sentinelCreds])
-                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
-                for (const path of [family.actorToken, family.sentinelCreds, family.health])
-                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
-            }
+            for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files])
+                await this.shredUserSecrets(unshredded, family);
             const leftover = unshredded.length ? `; cleanup failed: ${unshredded.join("; ")}` : "";
             return { error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}` };
         }
     }
+    /** Shred a user agent's secret family from the store and from disk. Every removal is attempted,
+     *  and each failure joins `unshredded`, so one fault cannot leave the rest of the family behind. */
+    async shredUserSecrets(unshredded, family) {
+        for (const path of [family.actorToken, family.sentinelCreds])
+            if (path)
+                await attemptCleanup(unshredded, `secret ${path}`, () => this.secrets.delete(agentSecretKeyForFile(path, this.space)));
+        for (const path of [family.actorToken, family.sentinelCreds, family.health])
+            if (path)
+                await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
+    }
     /** This manager's registry record for its space, which pins the broker and IdP a delegated seat's
      *  handoff carries. It must pin the exchange the host enrolls against, or the child would register
      *  a mesh whose bearers come from somewhere else. */
@@ -3631,12 +3642,7 @@ export class Manager {
             // the agent's standing mint authority, so delete it (next exchange refused, next connect
             // denied) and shred the secret/sentinel/health files. A copied actor token dies here; a
             // still-LIVE connection ends at its bearer-bound JWT expiry (≤ the agent TTL).
-            for (const path of [files.actorToken, files.sentinelCreds])
-                if (path)
-                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
-            for (const path of [files.actorToken, files.sentinelCreds, files.health])
-                if (path)
-                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
+            await this.shredUserSecrets(unshredded, files);
             // The ledger row IS the agent's STANDING mint authority (a different store from the auth-plane
             // cred ledger the rail retirement covers): while it lives, a copied actor token can still mint a
             // fresh connect credential. So a FAILED revoke must NOT be swallowed into a clean terminal (INT-2):
@@ -4196,7 +4202,7 @@ export class Manager {
                 restart.armed = false;
                 let tail = "";
                 try {
-                    tail = this.tail(await (replacement ?? a.handle).attach().backlog());
+                    tail = await this.tail((replacement ?? a.handle).attach());
                 }
                 catch { /* runtime has no readable tail */ }
                 console.error(`! ${a.name}: ${supervised ? "supervised restart" : "Pi session recovery"} failed: ${error.message}${tail ? ` - last output: ${tail}` : ""} - retiring the managed seat`);
@@ -4275,7 +4281,7 @@ export class Manager {
     nameInUse(name, live = this.liveRosterNames()) {
         return this.agents.has(name) || this.reserved.has(name) || this.retiring.has(name) || live.has(name);
     }
-    /** First free name in the series `base`, `base-2`, `base-3`, … — checked against live slots,
+    /** First free name in the series `base`, `base_2`, `base_3`, … — checked against live slots,
      *  in-flight (reserved) slots, names held pending retirement, AND the live mesh roster. The
      *  roster check covers occupants this manager does not manage (a foreground `cotal spawn`, a
      *  connector session, another manager's agent): allocating their name would mint a sibling the
@@ -4356,11 +4362,12 @@ export class Manager {
                 throw new Error(`${flag}: expected an array of strings`);
             return v;
         };
-        let subscribe, allowSubscribe, allowPublish;
+        let subscribe, allowSubscribe, allowPublish, shareTools;
         try {
             subscribe = strList(args.subscribe, "subscribe");
             allowSubscribe = strList(args.allowSubscribe, "allowSubscribe");
             allowPublish = strList(args.allowPublish, "allowPublish");
+            shareTools = strList(args.shareTools, "shareTools");
         }
         catch (e) {
             return Promise.resolve({ ok: false, error: e.message });
@@ -4410,7 +4417,7 @@ export class Manager {
             subscribe,
             allowSubscribe,
             allowPublish,
-            shareTools: args.shareTools !== undefined ? String(args.shareTools) : undefined,
+            shareTools,
             ...(supervise !== undefined ? { supervise } : {}),
             route,
         }, caller, hooks);
@@ -4722,6 +4729,9 @@ export class Manager {
         }
     }
     async startAgentActive(opts, spawner, hooks) {
+        // The caller keeps its array, so the selection is copied before the first await: a later write
+        // to it cannot change what this launch shares or what preservation retains.
+        const shareTools = opts.shareTools && [...opts.shareTools];
         if (opts.delegatedIntent) {
             if (!this.remoteAuthority?.executeDelegatedUserIntent)
                 return { ok: false, error: `"${opts.name}" names a delegated user intent, and this manager has no host execution for one` };
@@ -4778,10 +4788,7 @@ export class Manager {
                 return { ok: false, error: e.message };
             }
         }
-        // Harness precedence (#869): --agent flag > persona file `agent:` > detached caller default >
-        // this manager's COTAL_DEFAULT_AGENT > DEFAULT_CONNECTOR. Both environment values are defaults,
-        // never overrides: neither may beat a deliberate per-persona pin.
-        const agent = opts.agent ?? def?.agent ?? opts.defaultAgent ?? defaultAgentType(DEFAULT_CONNECTOR);
+        const agent = resolveAgentType({ flag: opts.agent, pin: def?.agent, callerDefault: opts.defaultAgent });
         // Materialize the requested connector up front — the ONE async step in the spawn path (a lazy
         // `cotal ext` manifest import on the published binary). It runs BEFORE the capacity/reserve span
         // below so that span stays fully SYNCHRONOUS and atomic. On the manifest binary this also honors a
@@ -4862,7 +4869,7 @@ export class Manager {
                 return { ok: false, error: `${delegatedBy}, so it cannot reopen a session held on this host (continuity: exact)` };
             if (typeof opts.cwd === "string" && opts.cwd !== "")
                 return { ok: false, error: `${delegatedBy}, so it cannot run in a directory on this host's filesystem (cwd); the seat runs in its runtime resource's own directory` };
-            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, parseShareSelection(opts.shareTools)));
+            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, shareTools));
             if (shared.length)
                 return { ok: false, error: `${delegatedBy}, so it cannot share MCP servers that run on this host (${shared.join(", ")}); pass --share-tools none` };
         }
@@ -4883,7 +4890,7 @@ export class Manager {
         // Resolve the launch profile: IDENTITY (free-form `name:`) + role + read/post ACL + capabilities
         // + model/variant. Either from a fully-resolved manifest launch object (`opts.resolved`, whose `config`
         // is a materialized transient persona — the file is NOT the access authority), or from the
-        // persona file. The number rides the IDENTITY (socrates → socrates-2), not the file ref — a
+        // persona file. The number rides the IDENTITY (socrates → socrates_2), not the file ref — a
         // redelivered identical spawn yields a fresh numbered agent (MAX_AGENTS bounds the blast radius).
         let identityName;
         let role;
@@ -4898,13 +4905,13 @@ export class Manager {
         if (opts.resolved) {
             // A manifest launch is the access + identity authority: imperative overrides arriving
             // alongside `resolved` are a caller contract error, not something to merge (no fallbacks).
-            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || opts.shareTools || opts.identity)
+            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || shareTools || opts.identity)
                 return { ok: false, error: "a manifest launch (resolved) rejects imperative overrides (identity/subscribe/allow*/prompt/shareTools)" };
             const r = opts.resolved;
             identityName = r.name;
             role = opts.role ?? r.role;
             subscribe = r.subscribe;
-            allowSubscribe = r.allowSubscribe?.length ? r.allowSubscribe : r.subscribe;
+            allowSubscribe = r.allowSubscribe;
             allowPublish = r.allowPublish;
             capabilities = r.capabilities;
             model = opts.model ?? r.model;
@@ -4926,9 +4933,7 @@ export class Manager {
             // paths of the merged grammar can't diverge. One source feeds BOTH the minted creds and the
             // connector env below.
             subscribe = opts.subscribe ?? def.subscribe;
-            // Defaulted the same way the loader/provisioner do — minted into the creds (the broker
-            // boundary); runtime durable joins are re-authorized against the committed ACL by the daemon.
-            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? subscribe ?? [];
+            allowSubscribe = opts.allowSubscribe ?? def.allowSubscribe ?? [];
             allowPublish = opts.allowPublish ?? def.allowPublish;
             capabilities = def.capabilities;
             // #651: fold the persona's model into the launch record, mirroring the variant line below
@@ -4939,6 +4944,14 @@ export class Manager {
             variant = opts.variant ?? def.variant;
             launchOptions = mergeLaunchOptions(def.launchOptions, opts.launchOptions);
         }
+        // Resolved once for both branches, because this one list is granted, minted, recorded on the
+        // launch and forwarded to the session, and each of those must read the list the provisioner does.
+        try {
+            allowSubscribe = resolveReadAcl(subscribe ?? [], allowSubscribe);
+        }
+        catch (e) {
+            return { ok: false, error: opts.resolved ? `launch agent: ${e.message}` : `persona ${configPath}: ${e.message}` };
+        }
         // #651: an empty or whitespace-only model string is not a pin. Coerce it to undefined here, at
         // the single point every path (persona, manifest, imperative) has resolved `model`, so it
         // serializes ABSENT rather than present-but-empty (`"model": ""`), which a key-presence consumer
@@ -5026,6 +5039,30 @@ export class Manager {
         const unportable = this.runtime.spawnDelegated ? Object.keys(launchOptions ?? {}).filter((k) => typeof launchOptions[k] !== "string") : [];
         if (unportable.length)
             return { ok: false, error: `runtime "${this.runtime.kind}" starts seats outside this host, so it cannot pass non-string launch options (${unportable.join(", ")})` };
+        // The AG-UI event plane is on unless the launch explicitly opted out. Refused HERE, before
+        // anything is minted: a connector that cannot
+        // emit must fail before provisioning rather than after, exactly as an unsupported `resume` does.
+        // The GRANT itself cannot be derived yet. It is keyed on the agent's PRINCIPAL, and in user mode
+        // the principal's owner is resolved further down, so deriving it from anything in scope here
+        // would mean guessing at the identity the child will actually connect as. It is added at the
+        // accept seam below, where the allocated triple exists.
+        if (this.eventsRequired && opts.events === false)
+            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
+        const events = this.eventsRequired || opts.events !== false;
+        if (events && !connector.eventChannel)
+            return { ok: false, error: this.eventsRequired
+                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
+                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
+        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
+        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
+        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
+        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
+        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
+        if (this.auth && !this.userMode) {
+            const claims = [opts, (opts.resolved ?? {})];
+            if (claims.some((c) => c.endpointCapabilities !== undefined))
+                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
+        }
         // #4 A4 (panel): the roster the allocation consults must reflect the initial presence snapshot,
         // or a spawn immediately after manager boot races an already-live unmanaged peer and re-opens the
         // very collision black-hole this closes. Await the snapshot (bounded internally, fail-safe on an
@@ -5035,10 +5072,10 @@ export class Manager {
         await this.ep.waitForPresenceSnapshot();
         // M6 (P2 item 2 spawn-as-action): a HARD-PINNED name — an imperative `--name`/identity override
         // or a manifest-declared name (opts.resolved) — that collides with a LIVE/provisioning/reserved
-        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `-2`
+        // incarnation REFUSES loud at accept, BEFORE any reserve/mint/bind (pin 1), never a silent `_2`
         // suffix (so an address-by-triple caller's pinned name can't be re-pointed). A PERSONA-DERIVED
         // base name (no pin) keeps uniqueName's collision numbering, so multi-peer `spawn reviewer` twice
-        // still yields reviewer + reviewer-2. The retiring-hold refuse (~2472) is orthogonal and already fired.
+        // still yields reviewer + reviewer_2. The retiring-hold refuse (~2472) is orthogonal and already fired.
         const hardPinned = opts.identity !== undefined || opts.resolved !== undefined;
         let name;
         if (hardPinned) {
@@ -5054,42 +5091,6 @@ export class Manager {
         else {
             name = this.uniqueName(identityName);
         }
-        this.reserved.add(name);
-        // The AG-UI event plane is on unless the launch explicitly opted out. Refused HERE, before
-        // anything is minted: a connector that cannot
-        // emit must fail before provisioning rather than after, exactly as an unsupported `resume` does.
-        // The GRANT itself cannot be derived yet. It is keyed on the agent's PRINCIPAL, and in user mode
-        // the principal's owner is resolved further down, so deriving it from anything in scope here
-        // would mean guessing at the identity the child will actually connect as. It is added at the
-        // accept seam below, where the allocated triple exists.
-        if (this.eventsRequired && opts.events === false) {
-            this.reserved.delete(name);
-            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
-        }
-        const events = this.eventsRequired || opts.events !== false;
-        if (events && !connector.eventChannel) {
-            // Release the just-reserved name on this fail-fast path. A leaked reserve is silent: it costs
-            // the next spawn of this persona its un-suffixed name and nothing reports why.
-            this.reserved.delete(name);
-            return { ok: false, error: this.eventsRequired
-                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
-                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
-        }
-        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
-        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
-        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
-        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
-        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
-        if (this.auth && !this.userMode) {
-            const claims = [opts, (opts.resolved ?? {})];
-            if (claims.some((c) => c.endpointCapabilities !== undefined)) {
-                this.reserved.delete(name);
-                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
-            }
-        }
-        // Set once the agent's creds + durables are minted; cleared the moment a live slot takes ownership
-        // (`agents.set`, after which freeSlot deprovisions on exit). If it survives to `finally`, the spawn
-        // threw AFTER minting (buildLaunch / runtime.spawn) — tear the orphan down so no footprint leaks (#159 B).
         // Set once the agent's footprint (durables + creds, or the user-mode grant + secret files)
         // exists; cleared when a live slot takes ownership. If it survives to `finally`, the spawn threw
         // AFTER provisioning (buildLaunch / runtime.spawn) — the orphan-rollback tears it down. Carries
@@ -5103,6 +5104,9 @@ export class Manager {
         let provisioned;
         // A carried resume's seat-private home, removed by the finally unless a live seat took it.
         let seatHome;
+        // Taken right before the try so its finally is the only release; a refusal belongs above the
+        // allocation, where there is no name to give back.
+        this.reserved.add(name);
         try {
             // A stable nkey identity assigned at spawn: the public key is the agent's card.id (threaded via
             // COTAL_ID); the seed is retained to mint matching creds later.
@@ -5125,7 +5129,8 @@ export class Manager {
             // been provisioned yet — the action serve path binds the goal + replies the acceptance HERE. A
             // throw (bind conflict / duplicate goalId) aborts the spawn before provisioning: the catch below
             // returns the failure and the finally releases the reserve, so a refused accept leaves zero
-            // footprint (pin 1). Blocking callers (roster boot) pass no hooks and this is a no-op.
+            // footprint (pin 1). The hosted enrollment arm is the exception, below. Blocking callers
+            // (roster boot) pass no hooks and this is a no-op.
             // The ALLOCATED agent's addressing triple (the acceptance floor names what was actually
             // allocated, never the requested-but-unallocated name). Static/open key on DEV_OWNER + the
             // freshly-minted nkey; user mode keys on the derived owner (opts.owner, else a u_-owner spawner)
@@ -5178,7 +5183,11 @@ export class Manager {
             if (events)
                 allowPublish = [...(allowPublish ?? []), connector.eventChannel({ owner: agentTriple.owner, actor: agentTriple.actor })];
             await hooks?.onReadinessWindow?.(readinessTimeoutMs);
-            await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple });
+            // The hosted enrollment arm accepts only once the host has answered: the floor names the uid
+            // the agent runs at, and before the host picks it there is no such uid to name.
+            const hostedEnrollment = this.userMode && (opts.delegatedIntent !== undefined || this.remoteAuthority?.enrollManagedAgent !== undefined);
+            if (!hostedEnrollment)
+                await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple });
             // In auth mode, mint the agent's creds from the space signing key and write them where the
             // spawned session reads them (COTAL_CREDS path). Open mesh → no creds. Scope = the resolved
             // subscribe/allowSubscribe (read) + allowPublish (post, default-deny).
@@ -5208,10 +5217,8 @@ export class Manager {
                         }
                         : undefined,
                 });
-                if ("error" in prep) {
-                    this.reserved.delete(name);
+                if ("error" in prep)
                     return { ok: false, error: prep.error };
-                }
                 // THE HOST'S UID WINS (#1972). On the local arm this is the value passed in, unchanged. On
                 // the hosted enrollment arm the host selected it, and from here every lifecycle-keyed thing
                 // this spawn records — the slot, the launch, the managed row, the teardown credential — must
@@ -5222,6 +5229,20 @@ export class Manager {
                 userOwner = prep.owner;
                 enrolled = prep.enrolled;
                 provisioned = { id: principalKey(prep.owner, name).key, name, lifecycleUid, userOwner: prep.owner, ...(opts.delegatedIntent ? { delegated: true } : {}), secretPaths: prep.files, ...(custody ? { runtime: custody } : {}) };
+                if (hostedEnrollment) {
+                    try {
+                        await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple: { owner: prep.owner, actor: name, uid: lifecycleUid } });
+                    }
+                    catch (e) {
+                        // A refused accept rolls the enrollment back: the host's grant through `provisioned`, and
+                        // this participant's secret family here, because the hosted retirement leaves it on disk.
+                        const unshredded = [];
+                        await this.shredUserSecrets(unshredded, prep.files);
+                        if (unshredded.length)
+                            throw new Error(`${rejectionText(e)}; cleanup failed: ${unshredded.join("; ")}`, { cause: e });
+                        throw e;
+                    }
+                }
             }
             else if (this.auth) {
                 // Unit B (§13.1): reserve + activate this incarnation's DURABLE identity BEFORE any
@@ -5273,7 +5294,7 @@ export class Manager {
             // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
             // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
             const cotalConfig = loadCotalConfig(this.workspaceRoot);
-            const mcpServers = connectorServers(cotalConfig, agent, parseShareSelection(opts.shareTools));
+            const mcpServers = connectorServers(cotalConfig, agent, shareTools);
             // The operator's spawn-env policy travels the same route: absent means no extras (the OS
             // allow-list + operator knobs + connector-declared inputs), present means those names too.
             // A connector never reads the config itself.
@@ -5400,7 +5421,7 @@ export class Manager {
                     allowPublish,
                     capabilities,
                     events,
-                    shareTools: opts.shareTools,
+                    shareTools,
                     forkSource: opts.resume,
                     ...(opts.resume !== undefined && spec?.resumeRecordPath ? { resumeRecordPath: spec.resumeRecordPath } : {}),
                     ...(carried ? { carried: { transcriptSha256: carried.sha256, host: carried.sourceHost, transferredAt: carried.stagedAt } } : {}),
@@ -5573,19 +5594,22 @@ export class Manager {
         const batchReservations = [];
         const prepared = new Map();
         try {
-            if (inventory.version !== "cotal-manager-resume/v1")
+            if (inventory.version !== "cotal-manager-resume/v2")
                 return { ok: false, agents: [], error: `unsupported manager resume inventory version ${String(inventory.version)}` };
             if (inventory.space !== this.space)
                 return { ok: false, agents: [], error: `resume inventory belongs to space "${inventory.space}", not "${this.space}"` };
+            // The caller keeps its inventory, so each selection is copied before the first await: a later
+            // write to it cannot change what a resumed seat shares or what the next preservation retains.
+            const entries = inventory.agents.map((entry) => ({ ...entry, launch: { ...entry.launch, shareTools: entry.launch.shareTools && [...entry.launch.shareTools] } }));
             const seen = new Set();
             const principals = new Set();
             const orphans = [];
             await this.ep.waitForPresenceSnapshot();
             const liveRoster = this.ep.getRoster().filter((presence) => presence.status !== "offline");
             const occupancy = this.occupancy();
-            if (occupancy.used + inventory.agents.length > MAX_AGENTS)
-                return { ok: false, agents: [], error: `resume inventory of ${inventory.agents.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
-            for (const entry of inventory.agents) {
+            if (occupancy.used + entries.length > MAX_AGENTS)
+                return { ok: false, agents: [], error: `resume inventory of ${entries.length} would exceed manager capacity (${this.occupancyText(occupancy)})` };
+            for (const entry of entries) {
                 if (seen.has(entry.name))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate agent name "${entry.name}"` };
                 seen.add(entry.name);
@@ -5642,12 +5666,12 @@ export class Manager {
                 if (this.agents.has(entry.name) || this.reserved.has(entry.name))
                     return { ok: false, agents: [], error: `retained agent "${entry.name}" is already managed or reserved` };
             }
-            for (const entry of inventory.agents) {
+            for (const entry of entries) {
                 this.reserved.add(entry.name);
                 batchReservations.push(entry.name);
             }
             const preflight = [];
-            for (const entry of inventory.agents) {
+            for (const entry of entries) {
                 const reply = await this.resumePreservedAgent(entry, true, true, prepared);
                 preflight.push({ name: entry.name, reply });
             }
@@ -5666,12 +5690,12 @@ export class Manager {
                     return { ok: false, agents: [], error: refusal };
             }
             const agents = [];
-            for (let i = 0; i < inventory.agents.length; i++) {
-                const entry = inventory.agents[i];
+            for (let i = 0; i < entries.length; i++) {
+                const entry = entries[i];
                 const reply = await this.resumePreservedAgent(entry, false, true, prepared);
                 agents.push({ name: entry.name, reply });
                 if (!reply.ok) {
-                    for (const skipped of inventory.agents.slice(i + 1))
+                    for (const skipped of entries.slice(i + 1))
                         agents.push({ name: skipped.name, reply: { ok: false, error: `not launched because ${entry.name} failed` } });
                     return { ok: false, agents, error: reply.error };
                 }
@@ -5881,7 +5905,7 @@ export class Manager {
         const slot = await this.readStaticReconcileSlot(entry.name);
         if (slot?.phase !== "active" || slot.actor !== entry.identity.id || slot.lifecycleUid !== entry.identity.lifecycleUid)
             return undefined;
-        if (slot.ownerInstanceId !== undefined && slot.ownerInstanceId !== this.managerInstanceId)
+        if (ownedBySibling(slot, this.managerInstanceId))
             return undefined;
         return slot.runtime?.kind === this.runtime.kind ? slot.runtime : undefined;
     }
@@ -6013,7 +6037,7 @@ export class Manager {
             }
             try {
                 const resumeConfig = loadCotalConfig(this.workspaceRoot);
-                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, parseShareSelection(entry.launch.shareTools));
+                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, entry.launch.shareTools);
                 const envAllow = spawnEnvAllow(resumeConfig);
                 const launchOpts = {
                     space: this.space,
@@ -6141,19 +6165,7 @@ export class Manager {
                 await this.recordSlotRuntime(managed);
             }
             catch (error) {
-                const detail = `${managed.name} resumed, but ${error.message}`;
-                this.stopHandle(managed, false);
-                try {
-                    await this.awaitHandleExit(managed.handle);
-                }
-                catch (exit) {
-                    // A resumed seat keeps its retained credentials, so freeing it runs no deprovision and
-                    // nothing would reap it: it stays managed until it exits or the manager stops it.
-                    this.watchExit(managed);
-                    return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${exit.message}` };
-                }
-                this.freeSlot(managed, true, "resume-custody-unrecorded", true);
-                return { ok: false, error: detail };
+                return await this.stopFailedResume(managed, "resume-custody-unrecorded", `${managed.name} resumed, but ${error.message}`);
             }
             const readiness = await this.awaitReadiness(managed, readinessTimeoutMs);
             if (!readiness.ok && !readiness.uncertain)
@@ -6180,9 +6192,7 @@ export class Manager {
                     }
                 }
                 catch (error) {
-                    this.stopHandle(managed, false);
-                    this.freeSlot(managed, true, "resume-session-rebind-failed", true);
-                    return { ok: false, error: `${managed.name} resumed, but its exact host session could not be rebound: ${error.message}` };
+                    return await this.stopFailedResume(managed, "resume-session-rebind-failed", `${managed.name} resumed, but its exact host session could not be rebound: ${error.message}`);
                 }
             }
             if (!this.resumeAttemptId)
@@ -6205,6 +6215,21 @@ export class Manager {
             }
         }
     }
+    /** A resumed seat keeps its retained credentials, so freeing it runs no deprovision and nothing
+     *  would reap it: it is freed only once its exit is proved, and otherwise stays managed until it
+     *  exits or the manager stops it. */
+    async stopFailedResume(managed, cause, detail) {
+        this.stopHandle(managed, false);
+        try {
+            await this.awaitHandleExit(managed.handle);
+        }
+        catch (exit) {
+            this.watchExit(managed);
+            return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${exit.message}` };
+        }
+        this.freeSlot(managed, true, cause, true);
+        return { ok: false, error: detail };
+    }
     probeStaticCredential(creds) {
         return probeConnect(this.servers ?? DEFAULT_SERVER, { creds, timeoutMs: 5_000 });
     }
@@ -6328,7 +6353,7 @@ export class Manager {
                     // waitForExit may close the attach stream before this snapshot
                     let tail = "";
                     try {
-                        tail = this.tail(await s.backlog());
+                        tail = await this.tail(s);
                     }
                     catch { }
                     if (opts.reapOnExit !== false)
@@ -6364,19 +6389,34 @@ export class Manager {
                 onPresence();
         });
     }
-    /** Last non-empty line of terminal output as a single trimmed, control-char-stripped snippet
-     *  (≤160 chars) — a readable one-line cause for an early-exit diagnostic, never the raw ANSI
-     *  scrollback. */
-    tail(buf) {
-        const text = buf
-            .toString("utf8")
-            .replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "") // strip CSI escape sequences
-            .replace(/[^\x20-\x7e\n]/g, "") // drop other control / non-printable bytes
-            .split("\n")
-            .map((l) => l.trim())
-            .filter(Boolean)
-            .pop() ?? "";
-        return text.length > 160 ? `…${text.slice(-160)}` : text;
+    /** Last non-empty line of the session's rendered backlog as a single trimmed snippet (≤160 chars)
+     *  — a readable one-line cause for an early-exit diagnostic. The backlog repaints cells a TUI
+     *  skipped with cursor moves, so it is rendered and the line is read off the terminal; stripping
+     *  its escapes would glue the words those moves separate. */
+    async tail(session) {
+        const backlog = await session.backlog();
+        // Sized after the snapshot: a custodial seat's snapshot carries the geometry it was taken at.
+        // The headless build exposes `buffer` only as proposed API.
+        const term = new Headless.Terminal({ cols: session.cols, rows: session.rows, allowProposedApi: true });
+        await new Promise((done) => term.write(backlog, done));
+        const screen = term.buffer.active;
+        let text = "";
+        for (let y = screen.length - 1; y >= 0; y--) {
+            const row = screen.getLine(y);
+            // A line wider than the screen continues across wrapped rows, so it is read whole.
+            text = row.translateToString(text === "") + text;
+            if (row.isWrapped)
+                continue;
+            // Blanks a program painted survive the right trim, so a line of only blanks is skipped.
+            if (text.trim())
+                break;
+            text = "";
+        }
+        term.dispose();
+        text = text.trim();
+        // Cut on code points: half a surrogate pair is not I-JSON, and a launch terminal carrying it is refused.
+        const chars = [...text];
+        return chars.length > 160 ? `…${chars.slice(-160).join("")}` : text;
     }
     /** Subscribe to a managed agent's process-exit so a self-driven exit frees its slot and reaps
      *  its children (P4b/P4c). Only pty streams exit (via the attach session's `onExit`); external runtimes'
@@ -6927,7 +6967,7 @@ export class Manager {
         const servePrincipal = principalKey(DEV_OWNER, serveIdentity.id).key;
         // An open mesh mints no credentials, so it has no family for a fresh pair to grow.
         const siblings = auth ? claimManagerSiblingIdentities(this.workspaceRoot, this.space) : { goalWriter: newIdentity(), sessionLedger: newIdentity() };
-        // must-5 (b): the STABLE goal-writer identity — a SIBLING credential in the same §13.1 family
+        // The STABLE goal-writer identity — a SIBLING credential in the same §13.1 family
         // (not the gate's bound serving principal), so the run block can family-stage it.
         this.goalWriterIdentity = siblings.goalWriter;
         // P2 item 6: the STABLE session-LEDGER identity — another SIBLING in the SAME §13.1 family, so
@@ -6998,7 +7038,7 @@ export class Manager {
             // Open mesh: NO mint - the §13.1 fence is issuance-only and nothing is ever issued, so the
             // gate keeps an empty `epcred` family; the serve connection below stays bare.
             const creds = auth ? await mintCreds(auth, serveIdentity, "endpoint-serve", { serveIssuance: fence, endpointServe: grant }) : undefined;
-            // must-5 (b): mint + family-stage the goal-writer credential HERE, over this executor's
+            // Mint + family-stage the goal-writer credential HERE, over this executor's
             // authKv (the fence is live), so its credId lands in `epcred.<e>.<iid>` and the takeover
             // barrier revokes it. Open mesh: no mint (no credential system; the goal-writer conn is bare).
             const goalWriterCreds = auth ? await this.mintAndStageGoalWriter(authKv) : undefined;
@@ -7053,7 +7093,7 @@ export class Manager {
         if (state.creds !== undefined)
             this.scheduleServeRenewal(state.creds);
     }
-    /** P2 item 2 must-5 (b): mint the standing `goal-writer` credential and STAGE it into this
+    /** Mint the standing `goal-writer` credential and STAGE it into this
      *  instance's §13.1 revocation family (`epcred.<e>.<iid>`), over the passed executor's `authKv`
      *  (the scoped `endpoint-serve-executor`, which holds the epcred write grant). The GRANT profile
      *  stays goal-writer-only (Q2 — disjoint from the serve credential); only the FAMILY membership
@@ -7491,7 +7531,7 @@ export class Manager {
             }
         }
     }
-    /** P2 item 2 must-5 Q-B — the boot reconcile: a fresh incarnation (a manager restart takes a NEW
+    /** The boot reconcile: a fresh incarnation (a manager restart takes a NEW
      *  instanceId, so the in-memory acceptance map starts empty) inherits the endpoint's accepted-but-
      *  unterminal goals from any predecessor. The local signer enumerates with an ephemeral PROVISIONER.
      *  A remote manager calls the authenticated host-owned scan, which keeps the sealed consumer and its
@@ -7652,19 +7692,20 @@ export class Manager {
         if (observed === null)
             throw new EpEnvelopeError("expired", `the manager's issuance gate for ${MANAGER_ENDPOINT}/${this.managerInstanceId} is gone; a retired incarnation never commits a goal terminal (SPEC 13.1/13.6)`);
         if (observed.processEpoch !== epoch)
-            throw new EpEnvelopeError("expired", `the manager's issuance gate epoch is ${observed.processEpoch} but this goal was accepted under epoch ${epoch}; a superseded incarnation never commits a goal terminal (must-5 (a) own-gate belt, SPEC 13.6)`);
+            throw new EpEnvelopeError("expired", `the manager's issuance gate epoch is ${observed.processEpoch} but this goal was accepted under epoch ${epoch}; a superseded incarnation never commits a goal terminal (SPEC 13.6)`);
     }
     /** Serve `spawn`/`launch` as an ACTION (P2 item 2). Authz already ran in {@link serveGated}. The
      *  accept path runs INLINE on the handler ({@link startAgent} with hooks): the goal binds + the
-     *  acceptance replies the moment the identity is minted, BEFORE any provision (pin 1); progress and
-     *  the terminal are driven OFF-handler, so the ~30s readiness wait no longer blocks the reply.
+     *  acceptance replies the moment the identity is minted, BEFORE any provision (pin 1), or on the
+     *  hosted enrollment arm once the host has enrolled the agent; progress and the terminal are driven
+     *  OFF-handler, so the ~30s readiness wait no longer blocks the reply.
      *  Returns the acceptance floor payload {name, owner, actor, uid, goalId, fingerprint, executor}
      *  (the ALLOCATED identity). goalId = the request id (env.id, Q3). */
     async serveSpawnGoal(ctx, run) {
         const gw = this.goalWriter;
         if (!gw)
             throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing; spawn-as-action cannot accept (SPEC 13.6)");
-        // must-5 Q-B: refuse to accept until the boot reconcile of inherited goals completes, so a fresh
+        // Refuse to accept until the boot reconcile of inherited goals completes, so a fresh
         // acceptance never races the sweep (settling a live goal mid-flight would steal its real terminal).
         if (!this.goalReconcileDone)
             throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; retry shortly (SPEC 13.6)");
@@ -7709,7 +7750,7 @@ export class Manager {
         // message as the caller-visible outcome.
         let ownsGoal = false;
         // The terminal commits OFF-handler on the goal-writer connection (manager-only authority; a
-        // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): must-5 (a) reads THIS
+        // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): (a) reads THIS
         // incarnation's OWN gate epoch and REFUSES a superseded commit (the currency belt), and (b)
         // barrier-revoke evicts this connection on takeover. The terminal lands on the ONE subject
         // SPEC §13.2 (reserved subjects) reserves; first-terminal-fact-wins is global, so a committed outcome is visible
@@ -7727,7 +7768,7 @@ export class Manager {
                 return;
             terminalEntered = true; // entered, not succeeded — see the catch below
             try {
-                await this.assertGoalWriterEpochCurrent(epoch); // must-5 (a): a superseded corpse never commits
+                await this.assertGoalWriterEpochCurrent(epoch); // a superseded corpse never commits
                 let fact;
                 if (o.kind === "succeeded") {
                     this.emitGoalProgress(ref, epoch, { phase: "presence" });
@@ -7743,7 +7784,7 @@ export class Manager {
                     ({ fact } = await settleGoalUncertain(gw.ctx, { ref, now: Date.now(), committer: { instanceId: this.managerInstanceId, epoch }, ...(typeof why === "string" && why.length > 0 ? { reason: why } : {}) }));
                 }
                 this.emitGoalProgress(ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
-                await clearGoalIndex(gw.ctx, ref); // must-5 Q-B: terminal reached - the successor never reconciles it
+                await clearGoalIndex(gw.ctx, ref); // terminal reached - the successor never reconciles it
                 if (acceptance)
                     this.agentGoals.delete(acceptance.name); // goal terminal - no cancel path left
             }
@@ -7760,7 +7801,7 @@ export class Manager {
         };
         const bg = run({
             onAccepted: async ({ name, agentTriple }) => {
-                // must-5 Q-B: record the goal in the reconcile index BEFORE the bind (index-CAS-before-bind),
+                // Record the goal in the reconcile index BEFORE the bind (index-CAS-before-bind),
                 // so a successor incarnation finds + settles this goal if we crash before its terminal. A
                 // crash between this write and the bind leaves an index entry whose goal status is absent —
                 // the sweep clears it as a no-goal; a crash before it leaves no entry (never durable). A
@@ -8353,11 +8394,11 @@ export class Manager {
         this.agentGoals.delete(name);
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         try {
-            await this.assertGoalWriterEpochCurrent(epoch); // must-5 (a): a superseded corpse never commits a cancel terminal either
+            await this.assertGoalWriterEpochCurrent(epoch); // a superseded corpse never commits a cancel terminal either
             await transitionGoal(gw.ctx, ref, "cancelling", { fields: { cancelMode: mode } });
             const r = await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "cancel", data: { cancelledBy: "despawn" }, committer: { instanceId: this.managerInstanceId, epoch } });
             this.emitGoalProgress(ref, epoch, { phase: "terminal", state: r.fact.state, ...(r.fact.data !== undefined ? { data: r.fact.data } : {}) });
-            await clearGoalIndex(gw.ctx, ref); // must-5 Q-B: terminal reached - the successor never reconciles it
+            await clearGoalIndex(gw.ctx, ref); // terminal reached - the successor never reconciles it
         }
         catch {
             // the goal already terminalized (the readiness outcome won the settle race) - nothing to cancel.
@@ -8705,7 +8746,7 @@ export class Manager {
             console.error(`✓ static reconcile recovered alias=${item.alias} phase=retired uid=${item.lifecycleUid} attempts=${item.attempts}/${item.maxAttempts}`);
             return;
         }
-        if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId) {
+        if (ownedBySibling(row, this.managerInstanceId)) {
             item.disposition = "refused";
             item.remedy = "the owning manager must reconcile or an operator must perform an explicit CAS takeover";
             item.lastError = `the durable slot belongs to manager instance ${row.ownerInstanceId}, not ${this.managerInstanceId}`;
@@ -8898,7 +8939,7 @@ export class Manager {
                 // hazard, now cross-instance). A legacy row (pre-3b-2, no owner recorded) predates multi-manager,
                 // so this manager is its legitimate single-manager-past successor and reconciles it. An orphaned
                 // sibling row is reclaimed only by an explicit operator CAS takeover (ruling 1), never here.
-                if (row.ownerInstanceId !== undefined && row.ownerInstanceId !== this.managerInstanceId) {
+                if (ownedBySibling(row, this.managerInstanceId)) {
                     preservedForeign++;
                     continue;
                 }