@cotal-ai/manager 0.69.0 → 0.70.1

package/dist/manager.js

@@ -1,10 +1,10 @@
-import { execFile } from "node:child_process";
 import { createHash, randomUUID, randomBytes } from "node:crypto";
 import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
-import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, bearerCommandFailure, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import Headless from "@xterm/headless";
+import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
@@ -30,7 +30,7 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 // P2 item 1 (1a-serve): the manager as an ordinary v0.4 `service` endpoint — the §13.1
 // endpoint-serve credential subsystem (gate provisioning, registration barrier, mint fence) plus
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
-import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
+import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, requestGoalCancel, goalAlreadyTerminal, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
 import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
 /** Minimum slot lifetime for rate-flooring (P4c). A slot freed (by despawn OR natural exit/reap)
@@ -147,19 +147,6 @@ async function attemptCleanup(failed, what, step) {
         failed.push(`${what}: ${rejectionText(err)}`);
     }
 }
-/** Run the agent's bearer argv once, pre-launch — the end-to-end auth preflight (state dir, daemon,
- *  ledger row, secret). Its stderr is the provider command's operator-exact sentence; surface it
- *  verbatim as the spawn refusal. */
-function execBearerPreflight(argv) {
-    const timeout = 30_000;
-    return new Promise((res, rej) => {
-        execFile(argv[0], argv.slice(1), { timeout, maxBuffer: 64 * 1024 }, (err, _stdout, stderr) => {
-            if (err)
-                return rej(bearerCommandFailure(err, stderr, timeout));
-            res();
-        });
-    });
-}
 /** Reject `p` with `Error(msg)` if it hasn't settled within `ms`; clears the timer when `p` settles so it
  *  never keeps the loop alive. Used to bound the detached deprovision so its fail-loud log is guaranteed. */
 function withTimeout(p, ms, msg) {
@@ -251,6 +238,20 @@ function foreignEventChannels(channels, owner, actor) {
         return p !== null && !(p.owner === owner && p.actor === actor);
     });
 }
+/** One connector's declared harness binaries resolved on PATH now. The refusal sentence is built only
+ *  here, so the boot row and the check for a connector registered after boot can never word it apart. */
+function resolveHarness(name, requires) {
+    const binaries = {};
+    const missing = [];
+    for (const bin of requires) {
+        const path = resolveOnPath(bin);
+        if (path)
+            binaries[bin] = path;
+        else
+            missing.push(bin);
+    }
+    return missing.length ? { binaries, reason: `${name} harness needs ${missing.join(", ")} on PATH - not found` } : { binaries };
+}
 function injectedManagerStoreIdentity(store) {
     if (store.identity !== undefined)
         return parseSecretStoreIdentity(store.identity);
@@ -380,7 +381,7 @@ export class Manager {
      *  standing connection DISJOINT from the serve credential (Q2), scoped to exactly this endpoint's
      *  goal bind/terminal facts + goal-record writes ({@link goalWriterGrants}). Auth mode mints the
      *  `goal-writer` cred; an open mesh uses a bare connection (no credential system to mint from).
-     *  `gate` (auth mode) is the own-issuance-gate READER for the must-5 (a) currency belt — the
+     *  `gate` (auth mode) is the own-issuance-gate READER for the own-gate currency belt — the
      *  manager reads its OWN `epgate.<e>.<iid>` epoch over this connection before a terminal commit
      *  and skips a superseded commit (the fast-fail belt paired with the (b) barrier-revoke fence). */
     goalWriter;
@@ -388,7 +389,7 @@ export class Manager {
      *  per-run credential and connection. Absent under a remote authority, which mints no driver
      *  credentials, so the `run-*` family refuses there rather than connecting on a weaker identity. */
     runHosting;
-    /** P2 item 2 must-5 (b): the STABLE goal-writer identity (auth mode) — minted once at
+    /** The STABLE goal-writer identity (auth mode) — minted once at
      *  registration alongside the serve identity; a renewal re-mints the SAME nkey with a fresh
      *  bounded exp and re-stages its distinct credId into the §13.1 revocation family. The current
      *  goal-writer credential is minted INSIDE {@link registerManagerService}'s run block (fence
@@ -419,10 +420,10 @@ export class Manager {
     sessionLedgerCreds;
     /** P2 item 2: the acceptance replied for each in-flight goalId this incarnation accepted, so an
      *  idempotent same-goalId retry serves the IDENTICAL acceptance (same allocated name/triple) without
-     *  a second spawn. Durable cross-incarnation reconstruction rides the must-5 goal-index; here the
+     *  a second spawn. Durable cross-incarnation reconstruction rides the goal index; here the
      *  live map covers same-incarnation retries, with the committed result fact as the fallback. */
     goalAcceptances = new Map();
-    /** P2 item 2 must-5 Q-B: the boot reconcile of the durable goal index runs ONCE at start (a
+    /** The boot reconcile of the durable goal index runs ONCE at start (a
      *  fresh incarnation inherits the endpoint's accepted-but-unterminal goals from any predecessor).
      *  Spawn-as-action REFUSES to accept until it completes, so the sweep never races a live goal's
      *  acceptance (settling one mid-flight would steal its real terminal). */
@@ -801,7 +802,7 @@ export class Manager {
         // First mint on a fresh root is exclusive create (#1263). Two processes that both observe no
         // file must not keep different in-memory ids: of N concurrent starts exactly one creates the
         // file (`link` / O_EXCL) and the others adopt that identity before taking a lease, or refuse
-        // with manager-instance-identity-create-lost. Atomic rename is not enough, because the loser
+        // with identity-record-create-lost. Atomic rename is not enough, because the loser
         // of a replace would still serve under the id it minted.
         {
             if (this.remoteAuthority) {
@@ -1018,7 +1019,7 @@ export class Manager {
         // rides the serve grant's epoch + the family-staged session-ledger cred), on its own standing
         // connection disjoint from both the serve and goal-writer creds.
         await this.startSessionPlane();
-        // P2 item 2 must-5 Q-B: reconcile any accepted-but-unterminal goals inherited from a predecessor
+        // Reconcile any accepted-but-unterminal goals inherited from a predecessor
         // BEFORE spawn-as-action begins accepting (the goalReconcileDone gate) — a fresh incarnation
         // never drops a goal a dead predecessor accepted. Never fatal; the gate opens either way.
         await this.reconcileGoalIndex();
@@ -1410,7 +1411,7 @@ export class Manager {
                     console.error(`! endpoint-serve renewal: ${e.message} - the manager's service endpoint dies loud at this cred's expiry unless it is re-registered`);
                 }
             }
-            // P2 item 2 must-5 (b): the manager is also the goal-writer's renewal owner — re-mint the SAME
+            // The manager is also the goal-writer's renewal owner — re-mint the SAME
             // goal-writer nkey with a fresh bounded exp AND re-stage its new credId into the §13.1 family,
             // through the scoped executor (never the standing seed). Without this the standing goal-writer
             // connection dies at its TTL and spawn-as-action stops accepting until a restart. The
@@ -2874,6 +2875,9 @@ export class Manager {
             // turns addressed to ITS incarnation and yields them; no reach beyond itself exists here.
             turnPending: (ctx) => this.serveGated(ctx, () => this.turnPendingFor(ctx.subject.caller)),
             turnYield: (ctx) => this.serveGated(ctx, () => this.serveTurnYield(ctx.subject.caller, args(ctx))),
+            // The reserved goal cancel (SPEC 13.6 item 4), served for the relay: the goal ref is the
+            // authenticated caller's own, so a run withdraws only the turns it submitted.
+            cancel: (ctx) => this.serveGated(ctx, () => this.serveTurnCancel(ctx)),
             stopSelf: (ctx) => this.serveGated(ctx, () => unwrap(this.opStopSelf(callerOf(ctx), args(ctx)))),
             definePersona: (ctx) => this.serveGated(ctx, () => unwrap(this.opDefinePersona(args(ctx), callerOf(ctx), false))),
             listPersonas: (ctx) => this.serveGated(ctx, () => unwrap(this.opListPersonas(callerOf(ctx), false))),
@@ -3247,7 +3251,9 @@ export class Manager {
                 "--token-file", tokenPath,
                 "--health-file", healthPath,
             ];
-            await execBearerPreflight(bearerCmd);
+            // One bearer run before the launch is the end-to-end auth preflight (state dir, daemon, ledger
+            // row, secret); its failure sentence is the spawn refusal.
+            await runAgentBearer(bearerCmd);
             return { owner, lifecycleUid: opts.lifecycleUid, files, launch: { owner, actor: name, sentinelCredsPath: sentinelPath, bearerCmd } };
         }
         catch (e) {
@@ -3349,7 +3355,7 @@ export class Manager {
                 "--token-file", files.actorToken,
                 "--health-file", files.health,
             ];
-            await execBearerPreflight(bearerCmd);
+            await runAgentBearer(bearerCmd);
             return {
                 owner: material.owner,
                 lifecycleUid: material.lifecycleUid,
@@ -3365,16 +3371,22 @@ export class Manager {
             // A failed removal joins the refusal instead of throwing, so every removal is attempted and
             // the refusal still reaches the caller.
             const unshredded = [];
-            for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files]) {
-                for (const path of [family.actorToken, family.sentinelCreds])
-                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
-                for (const path of [family.actorToken, family.sentinelCreds, family.health])
-                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
-            }
+            for (const family of files.actorToken === staged.actorToken ? [staged] : [staged, files])
+                await this.shredUserSecrets(unshredded, family);
             const leftover = unshredded.length ? `; cleanup failed: ${unshredded.join("; ")}` : "";
             return { error: `agent auth preflight failed for "${name}": ${rejectionText(e)}${leftover}` };
         }
     }
+    /** Shred a user agent's secret family from the store and from disk. Every removal is attempted,
+     *  and each failure joins `unshredded`, so one fault cannot leave the rest of the family behind. */
+    async shredUserSecrets(unshredded, family) {
+        for (const path of [family.actorToken, family.sentinelCreds])
+            if (path)
+                await attemptCleanup(unshredded, `secret ${path}`, () => this.secrets.delete(agentSecretKeyForFile(path, this.space)));
+        for (const path of [family.actorToken, family.sentinelCreds, family.health])
+            if (path)
+                await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
+    }
     /** This manager's registry record for its space, which pins the broker and IdP a delegated seat's
      *  handoff carries. It must pin the exchange the host enrolls against, or the child would register
      *  a mesh whose bearers come from somewhere else. */
@@ -3635,12 +3647,7 @@ export class Manager {
             // the agent's standing mint authority, so delete it (next exchange refused, next connect
             // denied) and shred the secret/sentinel/health files. A copied actor token dies here; a
             // still-LIVE connection ends at its bearer-bound JWT expiry (≤ the agent TTL).
-            for (const path of [files.actorToken, files.sentinelCreds])
-                if (path)
-                    await attemptCleanup(unshredded, `secret ${path}`, () => secrets.delete(agentSecretKeyForFile(path, this.space)));
-            for (const path of [files.actorToken, files.sentinelCreds, files.health])
-                if (path)
-                    await attemptCleanup(unshredded, `file ${path}`, () => rmSync(path, { force: true }));
+            await this.shredUserSecrets(unshredded, files);
             // The ledger row IS the agent's STANDING mint authority (a different store from the auth-plane
             // cred ledger the rail retirement covers): while it lives, a copied actor token can still mint a
             // fresh connect credential. So a FAILED revoke must NOT be swallowed into a clean terminal (INT-2):
@@ -4200,7 +4207,7 @@ export class Manager {
                 restart.armed = false;
                 let tail = "";
                 try {
-                    tail = this.tail(await (replacement ?? a.handle).attach().backlog());
+                    tail = await this.tail((replacement ?? a.handle).attach());
                 }
                 catch { /* runtime has no readable tail */ }
                 console.error(`! ${a.name}: ${supervised ? "supervised restart" : "Pi session recovery"} failed: ${error.message}${tail ? ` - last output: ${tail}` : ""} - retiring the managed seat`);
@@ -4494,19 +4501,9 @@ export class Manager {
         else {
             declared = registry.all("connector").map((connector) => ({ name: connector.name, requires: connector.requires ?? [] }));
         }
-        for (const connector of declared) {
-            const name = connector.name;
-            const binaries = {};
-            const missing = [];
-            for (const bin of connector.requires) {
-                const path = resolveOnPath(bin);
-                if (path)
-                    binaries[bin] = path;
-                else
-                    missing.push(bin);
-            }
-            if (missing.length) {
-                const reason = `${name} harness needs ${missing.join(", ")} on PATH - not found`;
+        for (const { name, requires } of declared) {
+            const { binaries, reason } = resolveHarness(name, requires);
+            if (reason) {
                 rows.push({ agent: name, state: "unavailable", binaries, reason });
                 console.error(`! manager boot: connector ${name} unavailable - ${reason}`);
             }
@@ -4538,18 +4535,17 @@ export class Manager {
         return `${reason}. This manager cannot launch that harness. The space may have other managers; pin one with --on <instance> (the whole id, as ps prints it)`;
     }
     /** The harness binaries a managed launch runs, as boot resolved them, or the refusal naming what is
-     *  missing. Spawn and resume both take it, so a seat launches from the same files whichever path
-     *  starts it. A connector registered after boot has no inventory row and is checked on PATH now. */
+     *  missing. Spawn, resume and the model catalog all take it, so a seat launches from the same files
+     *  whichever path starts it and the catalog never disagrees with a launch about whether the harness
+     *  is there. A connector registered after boot has no inventory row and is checked on PATH now. */
     launchHarness(connector) {
         const row = this.connectorStatuses.find((status) => status.agent === connector.name);
         if (row?.state === "unavailable")
             return { refusal: row.reason ?? `${connector.name} harness is unavailable` };
         if (row)
             return { binaries: row.binaries };
-        const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
-        if (missing.length)
-            return { refusal: `${connector.name} harness needs ${missing.join(", ")} on PATH - not found` };
-        return {};
+        const { reason } = resolveHarness(connector.name, connector.requires ?? []);
+        return reason ? { refusal: reason } : {};
     }
     /** The refusal for a launch choice the connector cannot honour. Spawn and resume both ask before
      *  any reserve or mint, so a rule changed here holds on both paths. */
@@ -4571,14 +4567,9 @@ export class Manager {
         const one = async (connector) => {
             if (!connector.listModels)
                 return { agent: connector.name, supported: false, models: [] };
-            const missing = (connector.requires ?? []).filter((bin) => !resolveOnPath(bin));
-            if (missing.length)
-                return {
-                    agent: connector.name,
-                    supported: true,
-                    models: [],
-                    error: `${connector.name} harness needs ${missing.join(", ")} on PATH - not found`,
-                };
+            const harness = this.launchHarness(connector);
+            if ("refusal" in harness)
+                return { agent: connector.name, supported: true, models: [], error: harness.refusal };
             try {
                 const catalog = await connector.listModels({ refresh });
                 return { agent: connector.name, supported: true, ...catalog };
@@ -5127,7 +5118,8 @@ export class Manager {
             // been provisioned yet — the action serve path binds the goal + replies the acceptance HERE. A
             // throw (bind conflict / duplicate goalId) aborts the spawn before provisioning: the catch below
             // returns the failure and the finally releases the reserve, so a refused accept leaves zero
-            // footprint (pin 1). Blocking callers (roster boot) pass no hooks and this is a no-op.
+            // footprint (pin 1). The hosted enrollment arm is the exception, below. Blocking callers
+            // (roster boot) pass no hooks and this is a no-op.
             // The ALLOCATED agent's addressing triple (the acceptance floor names what was actually
             // allocated, never the requested-but-unallocated name). Static/open key on DEV_OWNER + the
             // freshly-minted nkey; user mode keys on the derived owner (opts.owner, else a u_-owner spawner)
@@ -5180,7 +5172,11 @@ export class Manager {
             if (events)
                 allowPublish = [...(allowPublish ?? []), connector.eventChannel({ owner: agentTriple.owner, actor: agentTriple.actor })];
             await hooks?.onReadinessWindow?.(readinessTimeoutMs);
-            await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple });
+            // The hosted enrollment arm accepts only once the host has answered: the floor names the uid
+            // the agent runs at, and before the host picks it there is no such uid to name.
+            const hostedEnrollment = this.userMode && (opts.delegatedIntent !== undefined || this.remoteAuthority?.enrollManagedAgent !== undefined);
+            if (!hostedEnrollment)
+                await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple });
             // In auth mode, mint the agent's creds from the space signing key and write them where the
             // spawned session reads them (COTAL_CREDS path). Open mesh → no creds. Scope = the resolved
             // subscribe/allowSubscribe (read) + allowPublish (post, default-deny).
@@ -5222,6 +5218,20 @@ export class Manager {
                 userOwner = prep.owner;
                 enrolled = prep.enrolled;
                 provisioned = { id: principalKey(prep.owner, name).key, name, lifecycleUid, userOwner: prep.owner, ...(opts.delegatedIntent ? { delegated: true } : {}), secretPaths: prep.files, ...(custody ? { runtime: custody } : {}) };
+                if (hostedEnrollment) {
+                    try {
+                        await hooks?.onAccepted?.({ name, identity, lifecycleUid, agentTriple: { owner: prep.owner, actor: name, uid: lifecycleUid } });
+                    }
+                    catch (e) {
+                        // A refused accept rolls the enrollment back: the host's grant through `provisioned`, and
+                        // this participant's secret family here, because the hosted retirement leaves it on disk.
+                        const unshredded = [];
+                        await this.shredUserSecrets(unshredded, prep.files);
+                        if (unshredded.length)
+                            throw new Error(`${rejectionText(e)}; cleanup failed: ${unshredded.join("; ")}`, { cause: e });
+                        throw e;
+                    }
+                }
             }
             else if (this.auth) {
                 // Unit B (§13.1): reserve + activate this incarnation's DURABLE identity BEFORE any
@@ -6144,19 +6154,7 @@ export class Manager {
                 await this.recordSlotRuntime(managed);
             }
             catch (error) {
-                const detail = `${managed.name} resumed, but ${error.message}`;
-                this.stopHandle(managed, false);
-                try {
-                    await this.awaitHandleExit(managed.handle);
-                }
-                catch (exit) {
-                    // A resumed seat keeps its retained credentials, so freeing it runs no deprovision and
-                    // nothing would reap it: it stays managed until it exits or the manager stops it.
-                    this.watchExit(managed);
-                    return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${exit.message}` };
-                }
-                this.freeSlot(managed, true, "resume-custody-unrecorded", true);
-                return { ok: false, error: detail };
+                return await this.stopFailedResume(managed, "resume-custody-unrecorded", `${managed.name} resumed, but ${error.message}`);
             }
             const readiness = await this.awaitReadiness(managed, readinessTimeoutMs);
             if (!readiness.ok && !readiness.uncertain)
@@ -6183,9 +6181,7 @@ export class Manager {
                     }
                 }
                 catch (error) {
-                    this.stopHandle(managed, false);
-                    this.freeSlot(managed, true, "resume-session-rebind-failed", true);
-                    return { ok: false, error: `${managed.name} resumed, but its exact host session could not be rebound: ${error.message}` };
+                    return await this.stopFailedResume(managed, "resume-session-rebind-failed", `${managed.name} resumed, but its exact host session could not be rebound: ${error.message}`);
                 }
             }
             if (!this.resumeAttemptId)
@@ -6208,6 +6204,21 @@ export class Manager {
             }
         }
     }
+    /** A resumed seat keeps its retained credentials, so freeing it runs no deprovision and nothing
+     *  would reap it: it is freed only once its exit is proved, and otherwise stays managed until it
+     *  exits or the manager stops it. */
+    async stopFailedResume(managed, cause, detail) {
+        this.stopHandle(managed, false);
+        try {
+            await this.awaitHandleExit(managed.handle);
+        }
+        catch (exit) {
+            this.watchExit(managed);
+            return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${exit.message}` };
+        }
+        this.freeSlot(managed, true, cause, true);
+        return { ok: false, error: detail };
+    }
     probeStaticCredential(creds) {
         return probeConnect(this.servers ?? DEFAULT_SERVER, { creds, timeoutMs: 5_000 });
     }
@@ -6331,7 +6342,7 @@ export class Manager {
                     // waitForExit may close the attach stream before this snapshot
                     let tail = "";
                     try {
-                        tail = this.tail(await s.backlog());
+                        tail = await this.tail(s);
                     }
                     catch { }
                     if (opts.reapOnExit !== false)
@@ -6367,19 +6378,34 @@ export class Manager {
                 onPresence();
         });
     }
-    /** Last non-empty line of terminal output as a single trimmed, control-char-stripped snippet
-     *  (≤160 chars) — a readable one-line cause for an early-exit diagnostic, never the raw ANSI
-     *  scrollback. */
-    tail(buf) {
-        const text = buf
-            .toString("utf8")
-            .replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "") // strip CSI escape sequences
-            .replace(/[^\x20-\x7e\n]/g, "") // drop other control / non-printable bytes
-            .split("\n")
-            .map((l) => l.trim())
-            .filter(Boolean)
-            .pop() ?? "";
-        return text.length > 160 ? `…${text.slice(-160)}` : text;
+    /** Last non-empty line of the session's rendered backlog as a single trimmed snippet (≤160 chars)
+     *  — a readable one-line cause for an early-exit diagnostic. The backlog repaints cells a TUI
+     *  skipped with cursor moves, so it is rendered and the line is read off the terminal; stripping
+     *  its escapes would glue the words those moves separate. */
+    async tail(session) {
+        const backlog = await session.backlog();
+        // Sized after the snapshot: a custodial seat's snapshot carries the geometry it was taken at.
+        // The headless build exposes `buffer` only as proposed API.
+        const term = new Headless.Terminal({ cols: session.cols, rows: session.rows, allowProposedApi: true });
+        await new Promise((done) => term.write(backlog, done));
+        const screen = term.buffer.active;
+        let text = "";
+        for (let y = screen.length - 1; y >= 0; y--) {
+            const row = screen.getLine(y);
+            // A line wider than the screen continues across wrapped rows, so it is read whole.
+            text = row.translateToString(text === "") + text;
+            if (row.isWrapped)
+                continue;
+            // Blanks a program painted survive the right trim, so a line of only blanks is skipped.
+            if (text.trim())
+                break;
+            text = "";
+        }
+        term.dispose();
+        text = text.trim();
+        // Cut on code points: half a surrogate pair is not I-JSON, and a launch terminal carrying it is refused.
+        const chars = [...text];
+        return chars.length > 160 ? `…${chars.slice(-160).join("")}` : text;
     }
     /** Subscribe to a managed agent's process-exit so a self-driven exit frees its slot and reaps
      *  its children (P4b/P4c). Only pty streams exit (via the attach session's `onExit`); external runtimes'
@@ -6930,7 +6956,7 @@ export class Manager {
         const servePrincipal = principalKey(DEV_OWNER, serveIdentity.id).key;
         // An open mesh mints no credentials, so it has no family for a fresh pair to grow.
         const siblings = auth ? claimManagerSiblingIdentities(this.workspaceRoot, this.space) : { goalWriter: newIdentity(), sessionLedger: newIdentity() };
-        // must-5 (b): the STABLE goal-writer identity — a SIBLING credential in the same §13.1 family
+        // The STABLE goal-writer identity — a SIBLING credential in the same §13.1 family
         // (not the gate's bound serving principal), so the run block can family-stage it.
         this.goalWriterIdentity = siblings.goalWriter;
         // P2 item 6: the STABLE session-LEDGER identity — another SIBLING in the SAME §13.1 family, so
@@ -7001,7 +7027,7 @@ export class Manager {
             // Open mesh: NO mint - the §13.1 fence is issuance-only and nothing is ever issued, so the
             // gate keeps an empty `epcred` family; the serve connection below stays bare.
             const creds = auth ? await mintCreds(auth, serveIdentity, "endpoint-serve", { serveIssuance: fence, endpointServe: grant }) : undefined;
-            // must-5 (b): mint + family-stage the goal-writer credential HERE, over this executor's
+            // Mint + family-stage the goal-writer credential HERE, over this executor's
             // authKv (the fence is live), so its credId lands in `epcred.<e>.<iid>` and the takeover
             // barrier revokes it. Open mesh: no mint (no credential system; the goal-writer conn is bare).
             const goalWriterCreds = auth ? await this.mintAndStageGoalWriter(authKv) : undefined;
@@ -7056,7 +7082,7 @@ export class Manager {
         if (state.creds !== undefined)
             this.scheduleServeRenewal(state.creds);
     }
-    /** P2 item 2 must-5 (b): mint the standing `goal-writer` credential and STAGE it into this
+    /** Mint the standing `goal-writer` credential and STAGE it into this
      *  instance's §13.1 revocation family (`epcred.<e>.<iid>`), over the passed executor's `authKv`
      *  (the scoped `endpoint-serve-executor`, which holds the epcred write grant). The GRANT profile
      *  stays goal-writer-only (Q2 — disjoint from the serve credential); only the FAMILY membership
@@ -7494,7 +7520,7 @@ export class Manager {
             }
         }
     }
-    /** P2 item 2 must-5 Q-B — the boot reconcile: a fresh incarnation (a manager restart takes a NEW
+    /** The boot reconcile: a fresh incarnation (a manager restart takes a NEW
      *  instanceId, so the in-memory acceptance map starts empty) inherits the endpoint's accepted-but-
      *  unterminal goals from any predecessor. The local signer enumerates with an ephemeral PROVISIONER.
      *  A remote manager calls the authenticated host-owned scan, which keeps the sealed consumer and its
@@ -7655,19 +7681,20 @@ export class Manager {
         if (observed === null)
             throw new EpEnvelopeError("expired", `the manager's issuance gate for ${MANAGER_ENDPOINT}/${this.managerInstanceId} is gone; a retired incarnation never commits a goal terminal (SPEC 13.1/13.6)`);
         if (observed.processEpoch !== epoch)
-            throw new EpEnvelopeError("expired", `the manager's issuance gate epoch is ${observed.processEpoch} but this goal was accepted under epoch ${epoch}; a superseded incarnation never commits a goal terminal (must-5 (a) own-gate belt, SPEC 13.6)`);
+            throw new EpEnvelopeError("expired", `the manager's issuance gate epoch is ${observed.processEpoch} but this goal was accepted under epoch ${epoch}; a superseded incarnation never commits a goal terminal (SPEC 13.6)`);
     }
     /** Serve `spawn`/`launch` as an ACTION (P2 item 2). Authz already ran in {@link serveGated}. The
      *  accept path runs INLINE on the handler ({@link startAgent} with hooks): the goal binds + the
-     *  acceptance replies the moment the identity is minted, BEFORE any provision (pin 1); progress and
-     *  the terminal are driven OFF-handler, so the ~30s readiness wait no longer blocks the reply.
+     *  acceptance replies the moment the identity is minted, BEFORE any provision (pin 1), or on the
+     *  hosted enrollment arm once the host has enrolled the agent; progress and the terminal are driven
+     *  OFF-handler, so the ~30s readiness wait no longer blocks the reply.
      *  Returns the acceptance floor payload {name, owner, actor, uid, goalId, fingerprint, executor}
      *  (the ALLOCATED identity). goalId = the request id (env.id, Q3). */
     async serveSpawnGoal(ctx, run) {
         const gw = this.goalWriter;
         if (!gw)
             throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing; spawn-as-action cannot accept (SPEC 13.6)");
-        // must-5 Q-B: refuse to accept until the boot reconcile of inherited goals completes, so a fresh
+        // Refuse to accept until the boot reconcile of inherited goals completes, so a fresh
         // acceptance never races the sweep (settling a live goal mid-flight would steal its real terminal).
         if (!this.goalReconcileDone)
             throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; retry shortly (SPEC 13.6)");
@@ -7712,7 +7739,7 @@ export class Manager {
         // message as the caller-visible outcome.
         let ownsGoal = false;
         // The terminal commits OFF-handler on the goal-writer connection (manager-only authority; a
-        // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): must-5 (a) reads THIS
+        // caller cannot publish it). TWO COMPOSED FENCES (defense in depth): (a) reads THIS
         // incarnation's OWN gate epoch and REFUSES a superseded commit (the currency belt), and (b)
         // barrier-revoke evicts this connection on takeover. The terminal lands on the ONE subject
         // SPEC §13.2 (reserved subjects) reserves; first-terminal-fact-wins is global, so a committed outcome is visible
@@ -7730,7 +7757,7 @@ export class Manager {
                 return;
             terminalEntered = true; // entered, not succeeded — see the catch below
             try {
-                await this.assertGoalWriterEpochCurrent(epoch); // must-5 (a): a superseded corpse never commits
+                await this.assertGoalWriterEpochCurrent(epoch); // a superseded corpse never commits
                 let fact;
                 if (o.kind === "succeeded") {
                     this.emitGoalProgress(ref, epoch, { phase: "presence" });
@@ -7746,7 +7773,7 @@ export class Manager {
                     ({ fact } = await settleGoalUncertain(gw.ctx, { ref, now: Date.now(), committer: { instanceId: this.managerInstanceId, epoch }, ...(typeof why === "string" && why.length > 0 ? { reason: why } : {}) }));
                 }
                 this.emitGoalProgress(ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
-                await clearGoalIndex(gw.ctx, ref); // must-5 Q-B: terminal reached - the successor never reconciles it
+                await clearGoalIndex(gw.ctx, ref); // terminal reached - the successor never reconciles it
                 if (acceptance)
                     this.agentGoals.delete(acceptance.name); // goal terminal - no cancel path left
             }
@@ -7763,7 +7790,7 @@ export class Manager {
         };
         const bg = run({
             onAccepted: async ({ name, agentTriple }) => {
-                // must-5 Q-B: record the goal in the reconcile index BEFORE the bind (index-CAS-before-bind),
+                // Record the goal in the reconcile index BEFORE the bind (index-CAS-before-bind),
                 // so a successor incarnation finds + settles this goal if we crash before its terminal. A
                 // crash between this write and the bind leaves an index entry whose goal status is absent —
                 // the sweep clears it as a no-goal; a crash before it leaves no entry (never durable). A
@@ -8138,6 +8165,58 @@ export class Manager {
         this.maybeStopTurnSweep();
         return { goalId, state: fact.state };
     }
+    /** The caller withdraws a turn it submitted (the reserved `cancel`, SPEC 13.6 item 4), so the
+     *  seat is not shown it again and a late yield is answered from the cancelled terminal. Only a
+     *  relay this incarnation holds is moved to `cancelling`, because only its holder can commit the
+     *  terminal; an ended goal is refused with its cached outcome, which keeps a repeated cancel
+     *  idempotent. The pending entry is the latch the yield and the deadline sweep race on, taken
+     *  before the first await so a concurrent cancel finds nothing to take. A failed cancel puts it
+     *  back so the relay still ends at its deadline, unless something ended the relay while it was
+     *  held: a yield that read the entry first, or this commit with only its reply lost. An entry
+     *  whose outcome cannot be read back stays out and converges through the goal index at the
+     *  next boot, as a failed deadline commit does. */
+    async serveTurnCancel(ctx) {
+        if (!this.goalReconcileDone)
+            throw new EpEnvelopeError("unavailable", "the manager is still reconciling accepted goals at boot; the pending-turn index is not rebuilt yet, retry (SPEC 13.6)");
+        const gw = this.goalWriter;
+        if (!gw)
+            throw new EpEnvelopeError("unavailable", "the manager goal-writer connection is not standing (SPEC 13.6)");
+        const raw = (ctx.request.args ?? {});
+        const goalId = String(raw.goalId);
+        const ref = goalRefOf(ctx.subject, goalId);
+        const p = this.pendingTurns.get(goalId);
+        const c = p?.ref.caller;
+        if (p === undefined || c?.owner !== ref.caller.owner || c.actor !== ref.caller.actor || c.uid !== ref.caller.uid) {
+            const ended = await readGoalResult(gw.ctx, ref);
+            if (ended !== undefined)
+                throw goalAlreadyTerminal(goalId, ended);
+            throw new EpEnvelopeError("failed-precondition", `no turn "${goalId}" of this caller is pending on this manager; cancel withdraws a relayed turn (SPEC 13.6)`);
+        }
+        this.pendingTurns.delete(goalId);
+        const epoch = this.serviceServe?.grant.epoch ?? 0;
+        let fact;
+        try {
+            await requestGoalCancel(gw.ctx, { request: ctx.subject, goalId, mode: (raw.mode ?? "graceful") });
+            await this.assertGoalWriterEpochCurrent(epoch);
+            ({ fact } = await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "cancel", data: { cancelledBy: "caller" }, committer: { instanceId: this.managerInstanceId, epoch } }));
+        }
+        catch (e) {
+            // The remembered answer is read after the durable one, with no await before the put back:
+            // a yield that has dropped the entry remembered its answer, and one still committing drops
+            // the entry it finds. An ended relay is stamped so its acceptance still ages off.
+            if ((await readGoalResult(gw.ctx, ref)) !== undefined)
+                this.markTurnLatchDropped(goalId);
+            else if (this.turnAcceptances.get(goalId)?.settled === undefined)
+                this.pendingTurns.set(goalId, p);
+            throw e;
+        }
+        this.emitGoalProgress(ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
+        this.markTurnLatchDropped(goalId);
+        this.rememberSettledTurn(goalId, fact.state, Date.now());
+        await clearGoalIndex(gw.ctx, ref);
+        this.maybeStopTurnSweep();
+        return { goalId, state: fact.state };
+    }
     /** Commit the deadline terminal for one pending turn whose hold settled EXPIRED: the deny's
      *  predicate is that recorded settle, verified by core against the spec's goal binding. The map
      *  delete is the idempotency latch (yield-loss and sweep race here); a commit failure after it
@@ -8356,11 +8435,11 @@ export class Manager {
         this.agentGoals.delete(name);
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         try {
-            await this.assertGoalWriterEpochCurrent(epoch); // must-5 (a): a superseded corpse never commits a cancel terminal either
+            await this.assertGoalWriterEpochCurrent(epoch); // a superseded corpse never commits a cancel terminal either
             await transitionGoal(gw.ctx, ref, "cancelling", { fields: { cancelMode: mode } });
             const r = await commitGoalResult(gw.ctx, { ref, now: Date.now(), cause: "cancel", data: { cancelledBy: "despawn" }, committer: { instanceId: this.managerInstanceId, epoch } });
             this.emitGoalProgress(ref, epoch, { phase: "terminal", state: r.fact.state, ...(r.fact.data !== undefined ? { data: r.fact.data } : {}) });
-            await clearGoalIndex(gw.ctx, ref); // must-5 Q-B: terminal reached - the successor never reconciles it
+            await clearGoalIndex(gw.ctx, ref); // terminal reached - the successor never reconciles it
         }
         catch {
             // the goal already terminalized (the readiness outcome won the settle race) - nothing to cancel.
@@ -8499,11 +8578,17 @@ export class Manager {
                 console.error(`static retirement ${a.name}: retired ${retired} issuance(s) bound to uid ${a.lifecycleUid}`);
             const secrets = this.secrets;
             const files = a.secretPaths ?? agentLifecycleSecretFilePaths(this.workspaceRoot, this.space, a.name, a.lifecycleUid);
+            // The broker teardown mints its own credential, so a creds file that cannot be removed must not
+            // skip it. The failures are thrown together, so the terminal still stops at an incomplete cleanup.
+            const failed = [];
             if (files.creds) {
-                await secrets.delete(agentSecretKeyForFile(files.creds, this.space));
-                rmSync(files.creds, { force: true });
+                const creds = files.creds;
+                await attemptCleanup(failed, `secret ${creds}`, () => secrets.delete(agentSecretKeyForFile(creds, this.space)));
+                await attemptCleanup(failed, `file ${creds}`, () => rmSync(creds, { force: true }));
             }
-            await this.deprovisionBroker(a);
+            await attemptCleanup(failed, "broker teardown", () => this.deprovisionBroker(a));
+            if (failed.length)
+                throw new Error(`cleanup failed: ${failed.join("; ")}`);
         };
         // The process goes before its footprint: reap the orphan seat by reference, then tear down.
         const reapThenCleanup = async () => {