@cotal-ai/manager 0.70.1 → 0.72.0

package/dist/manager.js

@@ -4,7 +4,7 @@ import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
 import Headless from "@xterm/headless";
-import { CotalEndpoint, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
+import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
 import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
@@ -22,7 +22,7 @@ import { TranscriptReceiver } from "./transcript-receive.js";
 // manager-side adapter (transport + slot orchestration + the F1 terminal) — see static-lifecycle.ts.
 import { jetstream, jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { recordsBucket, epAuthBucket, ensureAuthorityStores, ensureContractStore, createEndpointStreams, contractStoreContext, publishContractArtifact, contractArtifactCanonicalBytes, standaloneConnectOpts, STATIC_SLOT_PREFIX, rawDigest, STANDING_RENEWABLE_TTL_SEC as MANAGED_STATIC_TTL_SEC, newArtifactSigner, RotatingSigner, generationAnchor, sessionsBucket, SESSION_GRANT_MAX_TTL_MS, REMOTE_MANAGER_IDENTITY_NAMES, } from "@cotal-ai/core";
+import { recordsBucket, epAuthBucket, ensureAuthorityStores, ensureContractStore, createEndpointStreams, contractStoreContext, publishContractArtifact, contractArtifactCanonicalBytes, standaloneConnectOpts, rawDigest, STANDING_RENEWABLE_TTL_SEC as MANAGED_STATIC_TTL_SEC, newArtifactSigner, RotatingSigner, generationAnchor, sessionsBucket, SESSION_GRANT_MAX_TTL_MS, REMOTE_MANAGER_IDENTITY_NAMES, } from "@cotal-ai/core";
 // P2 item 6: the manager's ONE §13.6 session plane — offer mint + one-use redeem + PTY-bridge
 // standup for `attach`, over a dedicated standing session-LEDGER connection (the byte rails ride
 // per-session credentials on their own short-lived connections).
@@ -32,7 +32,7 @@ import { ManagerSessionPlane, openSessionLedgerKv } from "./session/index.js";
 // the register/authorize/serve seams, all driven over a scoped one-shot executor connection.
 import { provisionEndpointGateOpen, endpointRegistrationBarrier, serveIssuanceGateKv, commitSiblingIssuance, markLedgerRowRevoked, epcredRowKey, epgateKey, parseEndpointGate, readEndpointGateGeneration, registerServingInstance, deregisterServiceInstance, serveEndpoint, bindGoal, createGoal, transitionGoal, commitGoalResult, requestGoalCancel, goalAlreadyTerminal, settleGoalUncertain, readGoalResult, readGoalStatus, readGoalSpec, recordGoalIndex, readGoalIndex, clearGoalIndex, listGoalIndex, mintCheckpoint, resumeCheckpoint, readCheckpointSettle, readCheckpointSpec, expireCheckpoint, GOAL_TERMINAL_STATES, goalRefOf, goalProgressTopic, epeSubject, submissionFingerprint, EpEnvelopeError, lifecycleBlocked, lifecycleBlockedFrom, renderLifecycleBlocked, } from "@cotal-ai/core";
 import { MANAGER_ENDPOINT, managerClusterArtifacts, managerCommandDefs, managerContractArtifactValues } from "./manager-service-contract.js";
-import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
+import { staticLifecycleTransport, activateStaticLifecycle, runStaticTerminal, readStaticSlot, casStaticSlot, recordSlotCredential, appendStaticCredentialRow, planStaticSlotResume, ownedBySibling, observeStaticSlot, listStaticSlotObservations, walkStaticSlots, renderStaticSlotObservation, StaticSlotReadError, STATIC_SLOT_READ_FAILED_DETAIL, } from "./static-lifecycle.js";
 /** Minimum slot lifetime for rate-flooring (P4c). A slot freed (by despawn OR natural exit/reap)
  *  before living this long leaves a cooling stamp that still counts toward the ceiling until it
  *  expires — so churn (spawn↔despawn or spawn↔fast-exit) can't outrun the concurrency bound. */
@@ -126,9 +126,11 @@ function retireOpId(lifecycleUid) {
  *  dash) — what {@link Manager.psOwnerFilter} returns for an unparseable caller so a malformed
  *  principal fail-closes to an empty `ps` instead of an unbounded one. */
 const NO_OWNER_MATCHES = "-no-owner-";
-/** A caught value's text for a refusal. A host-supplied store or callback may reject with any value,
- *  including one whose `message` is a Symbol or whose `message` getter or `toString` throws, and the
- *  refusal must still be returned, so the coercion to text runs inside the guard. */
+/** A caught value's text for a refusal or a log line. A host-supplied store, runtime or callback may
+ *  reject with any value, including `null` or one whose `message` is a Symbol or whose `message`
+ *  getter or `toString` throws. A handler that throws while building its text skips the work after
+ *  it, and on a detached chain ends the manager with an unhandled rejection, so the coercion to text
+ *  runs inside the guard. */
 function rejectionText(e) {
     try {
         return String(e?.message ?? e);
@@ -137,6 +139,34 @@ function rejectionText(e) {
         return "an unreadable rejection";
     }
 }
+/** A caught value as a lifecycle envelope, or undefined when it is not one. A thrown Proxy can throw
+ *  from `instanceof` itself, so the test runs inside the guard. */
+function caughtEnvelope(e) {
+    try {
+        return e instanceof EpEnvelopeError ? e : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The failed terminal a post-accept fallback commits for `error` and `source`'s optional details.
+ *  `commitGoalResult` refuses a payload that is not interchangeable JSON, and this terminal must commit
+ *  whatever failed, so a lone surrogate in the text becomes U+FFFD and details it cannot read or carry
+ *  (a Proxy's throwing getter, an accessor, a cycle) are dropped. A Proxy can answer the check and the
+ *  serializer differently, so the detached copy is checked again before it commits. */
+function failedTerminal(error, source) {
+    const text = error.replace(/\p{Cs}/gu, "\uFFFD");
+    try {
+        const details = source?.details;
+        if (details) {
+            const copy = JSON.parse(canonicalJson(details));
+            canonicalJson(copy);
+            return { error: text, details: copy };
+        }
+    }
+    catch { /* unreadable or not interchangeable */ }
+    return { error: text };
+}
 /** Run one cleanup step, recording its failure in `failed` as `<what>: <reason>`. A step that threw
  *  would otherwise skip every step after it, and a swallowed one would leave nothing to report. */
 async function attemptCleanup(failed, what, step) {
@@ -159,6 +189,18 @@ function withTimeout(p, ms, msg) {
 function sameStrings(a, b) {
     return JSON.stringify([...(a ?? [])].sort()) === JSON.stringify([...(b ?? [])].sort());
 }
+/** The caller keeps the arrays it passed, so a launch form is admitted with its own copies: a later
+ *  write to the caller's array cannot change what the manager grants, shares or preserves. */
+function ownLists(form) {
+    return {
+        ...form,
+        ...(form.subscribe && { subscribe: [...form.subscribe] }),
+        ...(form.allowSubscribe && { allowSubscribe: [...form.allowSubscribe] }),
+        ...(form.allowPublish && { allowPublish: [...form.allowPublish] }),
+        ...(form.capabilities && { capabilities: [...form.capabilities] }),
+        ...(form.shareTools && { shareTools: [...form.shareTools] }),
+    };
+}
 /** Operator-facing phrasing per cause. Kept beside the union so adding a member without a sentence
  *  is a type error rather than a blank in the log. The stop family's sentences carry the principal
  *  from the cause, so they render through {@link STOP_CAUSE_TEXT} under the same exhaustive-Record
@@ -899,7 +941,7 @@ export class Manager {
             await this.attach.stop();
             throw new Error(held
                 ? `manager instance ${this.managerInstanceId} already serves space "${this.space}" from ${held.root === this.leaseInfo.root ? "this" : "another"} workspace root (${held.runtime}, pid ${held.pid}, root ${held.root}) - stop it first before restarting the same instance`
-                : `could not acquire the manager lease for space "${this.space}": ${e.message}`);
+                : `could not acquire the manager lease for space "${this.space}": ${rejectionText(e)}`);
         }
         this.leaseTimer = setInterval(() => { void this.renewLease(); }, MANAGER_LEASE_RENEW_MS);
         this.leaseTimer.unref?.();
@@ -936,7 +978,7 @@ export class Manager {
         // attempt returns.
         const startupReconcile = this.auth && !this.userMode ? this.reconcileStaticLifecycles() : undefined;
         if (startupReconcile)
-            void startupReconcile.catch((e) => console.error(`! ${STARTUP_RECONCILING}: ${e.message} - no per-alias retry could be planned; a later manager start re-reads unfinished durable terminals`));
+            void startupReconcile.catch((e) => console.error(`! ${STARTUP_RECONCILING}: ${rejectionText(e)} - no per-alias retry could be planned; a later manager start re-reads unfinished durable terminals`));
         // P2 item 1 (1d): the manager serves NO ctl tiers - its whole control surface is the v0.4
         // service endpoint registered below. The old three-tier rail (self/manager/admin) is deleted;
         // `ctl.delivery`/`ctl.delivery-admin` (the delivery daemon) and `ctl.auth-admin` (the auth
@@ -987,13 +1029,13 @@ export class Manager {
                         await this.renewRemoteExecutor();
                 }
                 catch (e) {
-                    console.error(`! remote manager renewal pass failed: ${e.message}`);
+                    console.error(`! remote manager renewal pass failed: ${rejectionText(e)}`);
                 }
                 try {
                     await this.runHosting?.renew();
                 }
                 catch (e) {
-                    console.error(`! remote run-hosting renewal pass failed: ${e.message}`);
+                    console.error(`! remote run-hosting renewal pass failed: ${rejectionText(e)}`);
                 }
             }, intervalMs);
             this.credRenewTimer.unref?.();
@@ -1104,7 +1146,7 @@ export class Manager {
             reply = await this.ep.requestDeliveryAdmin("reloadStoreIdentity", {}, timeoutMs);
         }
         catch (e) {
-            const msg = e.message;
+            const msg = rejectionText(e);
             if (isAbsentDeliveryAdmin(msg))
                 return this.absentByLeaseRow(isUnansweredDeliveryAdmin(e));
             const failure = `could not challenge the delivery daemon's SecretStore: ${msg}`;
@@ -1117,7 +1159,7 @@ export class Manager {
             answer = parseDaemonStoreAnswer(reply.data);
         }
         catch (e) {
-            throw new Error(`delivery daemon named an unreadable SecretStore: ${e.message}. A daemon older ` +
+            throw new Error(`delivery daemon named an unreadable SecretStore: ${rejectionText(e)}. A daemon older ` +
                 `than #1694 replies with a bare store identity and no answerer binding; this manager ` +
                 `cannot establish which process answered, so nothing reminted - upgrade the delivery daemon`);
         }
@@ -1173,7 +1215,7 @@ export class Manager {
         }
         catch (e) {
             throw new Error(`could not read the delivery lease row to settle whether the delivery daemon is absent ` +
-                `(${e.message}) - absence is undetermined, nothing reminted`);
+                `(${rejectionText(e)}) - absence is undetermined, nothing reminted`);
         }
         const holder = entry?.info.holder;
         if (holder !== undefined && holder !== "") {
@@ -1198,7 +1240,7 @@ export class Manager {
             this.daemonRenewalOwner = held;
         }
         catch (e) {
-            console.error(`! could not refresh the daemon renewal lease: ${e.message} - ownership is re-decided on the next pass`);
+            console.error(`! could not refresh the daemon renewal lease: ${rejectionText(e)} - ownership is re-decided on the next pass`);
         }
     }
     /** Decide whether THIS manager owns the daemon's credential renewal (#1634). Both conditions are
@@ -1284,7 +1326,7 @@ export class Manager {
                     return true;
             }
             catch (e) {
-                console.error(`! manager ${label} re-dial attempt failed: ${e.message}`);
+                console.error(`! manager ${label} re-dial attempt failed: ${rejectionText(e)}`);
             }
         }
         return false;
@@ -1337,7 +1379,7 @@ export class Manager {
                         : { ok: false, error: reply.error, detail: reply.data };
                 }
                 catch (e) {
-                    adoption = { ok: false, error: `no delivery-admin responder (${e.message}) - the daemon's 75% re-read backstop adopts the re-signed file` };
+                    adoption = { ok: false, error: `no delivery-admin responder (${rejectionText(e)}) - the daemon's 75% re-read backstop adopts the re-signed file` };
                 }
             }
             for (const r of results.filter((x) => !x.ok && !x.skipped))
@@ -1380,7 +1422,7 @@ export class Manager {
                         await this.renewManagedStaticCred(a);
                     }
                     catch (e) {
-                        console.error(`! managed cred renewal ${a.name}: ${e.message} - the agent dies loud at this cred's expiry unless it is reminted`);
+                        console.error(`! managed cred renewal ${a.name}: ${rejectionText(e)} - the agent dies loud at this cred's expiry unless it is reminted`);
                     }
                 }
             }
@@ -1408,7 +1450,7 @@ export class Manager {
                     }
                 }
                 catch (e) {
-                    console.error(`! endpoint-serve renewal: ${e.message} - the manager's service endpoint dies loud at this cred's expiry unless it is re-registered`);
+                    console.error(`! endpoint-serve renewal: ${rejectionText(e)} - the manager's service endpoint dies loud at this cred's expiry unless it is re-registered`);
                 }
             }
             // The manager is also the goal-writer's renewal owner — re-mint the SAME
@@ -1427,7 +1469,7 @@ export class Manager {
                     }
                 }
                 catch (e) {
-                    console.error(`! goal-writer renewal: ${e.message} - spawn-as-action stops accepting at this cred's expiry unless the manager restarts`);
+                    console.error(`! goal-writer renewal: ${rejectionText(e)} - spawn-as-action stops accepting at this cred's expiry unless the manager restarts`);
                 }
             }
             // P2 item 6: the manager is also the session-ledger's renewal owner — re-mint the SAME nkey
@@ -1449,12 +1491,12 @@ export class Manager {
                     }
                 }
                 catch (e) {
-                    console.error(`! session-ledger renewal: ${e.message} - attach stops establishing sessions at this cred's expiry unless the manager restarts`);
+                    console.error(`! session-ledger renewal: ${rejectionText(e)} - attach stops establishing sessions at this cred's expiry unless the manager restarts`);
                 }
             }
         }
         catch (e) {
-            console.error(`! credential renewal pass failed: ${e.message}`);
+            console.error(`! credential renewal pass failed: ${rejectionText(e)}`);
         }
         finally {
             release();
@@ -1472,7 +1514,7 @@ export class Manager {
             this.remoteExecutorCreds = await this.remoteAuthority.renewExecutor();
         }
         catch (e) {
-            console.error(`! remote manager executor renewal: ${e.message} - registration maintenance and clean deregistration remain unavailable until renewal succeeds`);
+            console.error(`! remote manager executor renewal: ${rejectionText(e)} - registration maintenance and clean deregistration remain unavailable until renewal succeeds`);
             if (force)
                 throw e;
         }
@@ -1543,7 +1585,7 @@ export class Manager {
             // endpoint's own reconnect loop retries with the adopted credential, not unadopted debt.
             this.remoteRenewalDebt = undefined;
             await Promise.all([
-                this.ep.reconnect().catch((e) => console.error(`! remote manager supervisor reconnect after renewal: ${e.message}`)),
+                this.ep.reconnect().catch((e) => console.error(`! remote manager supervisor reconnect after renewal: ${rejectionText(e)}`)),
                 this.pushRenewedCreds(this.serviceServe.nc),
                 ...(this.goalWriter ? [this.pushRenewedCreds(this.goalWriter.nc)] : []),
                 ...(this.sessionLedgerConn ? [this.pushRenewedCreds(this.sessionLedgerConn.nc)] : []),
@@ -1558,8 +1600,8 @@ export class Manager {
                     return [];
                 } })
                 : [];
-            this.remoteRenewalDebt = { at: Date.now(), processEpoch, reason: e.message, unadoptedSubjects };
-            console.error(`! remote manager all-duty renewal: ${e.message} - no unsigned or local replacement is available`);
+            this.remoteRenewalDebt = { at: Date.now(), processEpoch, reason: rejectionText(e), unadoptedSubjects };
+            console.error(`! remote manager all-duty renewal: ${rejectionText(e)} - no unsigned or local replacement is available`);
             if (force)
                 throw e;
         }
@@ -1631,7 +1673,7 @@ export class Manager {
     trackDeprovision(a, context = "") {
         this.lifecycleInFlight++;
         void this.deprovision(a)
-            .catch((e) => console.error(`deprovision${context ? ` ${context}` : ""} ${a.name} (${a.id}): ${e.message}`))
+            .catch((e) => console.error(`deprovision${context ? ` ${context}` : ""} ${a.name} (${a.id}): ${rejectionText(e)}`))
             .finally(() => this.releaseLifecycle());
     }
     async awaitLifecycleDrain() {
@@ -1736,7 +1778,7 @@ export class Manager {
             parseResumeControlArgs({ attemptId, inventory });
         }
         catch (e) {
-            failures.push({ name: "<inventory>", id: attemptId, error: `prepared inventory would be rejected at resume: ${e.message}` });
+            failures.push({ name: "<inventory>", id: attemptId, error: `prepared inventory would be rejected at resume: ${rejectionText(e)}` });
         }
         this.preservationInventory = inventory;
         this.preservationFailures = failures;
@@ -1821,7 +1863,7 @@ export class Manager {
                 a.handle.stop({ graceful: false });
             }
             catch (e) {
-                failures.push({ name: a.name, id: a.id, error: `stop failed: ${e.message}` });
+                failures.push({ name: a.name, id: a.id, error: `stop failed: ${rejectionText(e)}` });
                 return;
             }
             try {
@@ -1830,7 +1872,7 @@ export class Manager {
                     this.agents.delete(a.name);
             }
             catch (e) {
-                failures.push({ name: a.name, id: a.id, error: e.message });
+                failures.push({ name: a.name, id: a.id, error: rejectionText(e) });
             }
         }));
         if (failures.length === 0)
@@ -1875,7 +1917,7 @@ export class Manager {
                     return `retained reference is not a regular non-symlink file: ${path}`;
             }
             catch (e) {
-                return `retained reference unavailable: ${path} (${e.message})`;
+                return `retained reference unavailable: ${path} (${rejectionText(e)})`;
             }
         }
         if (process.platform !== "win32") {
@@ -1904,7 +1946,7 @@ export class Manager {
             }
         }
         catch (e) {
-            return `retained reference cannot be hashed: ${e.message}`;
+            return `retained reference cannot be hashed: ${rejectionText(e)}`;
         }
         return undefined;
     }
@@ -2019,11 +2061,11 @@ export class Manager {
                 await this.awaitHandleExit(a.handle);
             }
             catch (e) {
-                failures.push(`${a.name}: ${e.message}`);
+                failures.push(`${a.name}: ${rejectionText(e)}`);
             }
         }));
         // Deprovision EVERY snapshot entry regardless of whether its stop failed (allSettled + a loud log).
-        await Promise.allSettled(managed.filter((a) => !a.suppressCleanup).map((a) => this.deprovision({ ...a, ...(a.handedOff ? { delegatedHandle: a.handle } : {}) }).catch((e) => console.error(`deprovision ${a.name} (${a.id}) on shutdown: ${e.message}`))));
+        await Promise.allSettled(managed.filter((a) => !a.suppressCleanup).map((a) => this.deprovision({ ...a, ...(a.handedOff ? { delegatedHandle: a.handle } : {}) }).catch((e) => console.error(`deprovision ${a.name} (${a.id}) on shutdown: ${rejectionText(e)}`))));
         if (failures.length)
             throw new Error(`manager shutdown could not prove every seat exited: ${failures.join("; ")}`);
     }
@@ -2040,7 +2082,7 @@ export class Manager {
                 this.agents.delete(a.name);
             }
             catch (e) {
-                failures.push(`${a.name}: ${e.message}`);
+                failures.push(`${a.name}: ${rejectionText(e)}`);
             }
         }
         return failures;
@@ -2059,7 +2101,7 @@ export class Manager {
                     a.handle.stop({ graceful: false });
             }
             catch (e) {
-                failures.push(`${a.name}: stop failed: ${e.message}`);
+                failures.push(`${a.name}: stop failed: ${rejectionText(e)}`);
             }
             try {
                 await this.awaitHandleExit(a.handle);
@@ -2067,7 +2109,7 @@ export class Manager {
                     this.agents.delete(a.name);
             }
             catch (e) {
-                failures.push(`${a.name}: ${e.message}`);
+                failures.push(`${a.name}: ${rejectionText(e)}`);
             }
         }));
         if (failures.length)
@@ -2132,7 +2174,7 @@ export class Manager {
             }
         }
         catch (e) {
-            seatFailure = e;
+            seatFailure = rejectionText(e);
         }
         // Every step below runs even when an earlier one fails, so a failed stop still closes this
         // process's connections and listener (#2290). Failures are collected and thrown at the end.
@@ -2142,12 +2184,12 @@ export class Manager {
                 await run();
             }
             catch (e) {
-                failures.push(`${name}: ${e.message}`);
+                failures.push(`${name}: ${rejectionText(e)}`);
             }
         };
         // A seat that may still be alive keeps this instance's leases and registration (see
         // teardownManagedAgents): they lapse on their TTL instead of being handed to a successor.
-        if (!seatFailure) {
+        if (seatFailure === undefined) {
             await step("release manager lease", () => this.releaseOwnManagerLease());
             // #1634: hand the renewal lease back on a clean stop so a sibling picks it up on its next pass
             // rather than waiting out the bucket TTL. A non-owner holds no revision and this is a no-op.
@@ -2163,15 +2205,15 @@ export class Manager {
         // released run's status write is the last thing this incarnation says about it.
         await step("stop run hosting", () => this.runHosting?.stop());
         this.runHosting = undefined;
-        if (registrationRevision !== undefined && !seatFailure)
+        if (registrationRevision !== undefined && seatFailure === undefined)
             await step("deregister service", () => this.deregisterServiceOnStop(registrationRevision));
         await step("stop goal writer", () => this.stopGoalWriter());
         await step("stop session plane", () => this.stopSessionPlane());
         await step("stop endpoint", () => this.ep.stop());
         await step("stop attach endpoint", () => this.attach.stop());
         const also = failures.length ? `; teardown also failed: ${failures.join("; ")}` : "";
-        if (seatFailure)
-            throw new Error(`${seatFailure.message}${also}`);
+        if (seatFailure !== undefined)
+            throw new Error(`${seatFailure}${also}`);
         if (releaseFailures.length)
             throw new Error(`manager shutdown could not release every detachable seat: ${releaseFailures.join("; ")}${also}`);
         if (failures.length)
@@ -2246,7 +2288,7 @@ export class Manager {
             // `absent` is silent: there was nothing registered to remove, which is not news at shutdown.
         }
         catch (e) {
-            console.error(`! could not deregister manager instance ${iid}: ${e.message}\n` +
+            console.error(`! could not deregister manager instance ${iid}: ${rejectionText(e)}\n` +
                 `  Its registration now outlives this process and will be frozen into every class scatter in space "${this.space}", each paying the full deadline.\n` +
                 `  NEXT: remove it with \`cotal deregister-instance --instance ${iid}\` once this process is gone.`);
         }
@@ -2321,7 +2363,7 @@ export class Manager {
                 return;
             }
             catch (renewError) {
-                const why = renewError.message;
+                const why = rejectionText(renewError);
                 const verdict = await this.reconcileLease();
                 switch (verdict.kind) {
                     case "held":
@@ -2346,7 +2388,7 @@ export class Manager {
                         }
                         catch (e) {
                             this.leaseState = before;
-                            this.noteLease("gone", `found its liveness lease key gone (renew: ${why}) and could not re-acquire it yet (${e.message}); serving, retrying`);
+                            this.noteLease("gone", `found its liveness lease key gone (renew: ${why}) and could not re-acquire it yet (${rejectionText(e)}); serving, retrying`);
                         }
                         return;
                     }
@@ -2385,7 +2427,7 @@ export class Manager {
             current = await this.ep.readOwnManagerLease(this.managerInstanceId);
         }
         catch (e) {
-            return { kind: "unknown", why: e.message };
+            return { kind: "unknown", why: rejectionText(e) };
         }
         if (current === undefined)
             return { kind: "gone" };
@@ -2402,7 +2444,7 @@ export class Manager {
                 args = parseResumeFinalizeArgs(rawArgs);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
             if (!this.resumeAttemptId || this.resumeAttemptId !== args.attemptId)
                 return { ok: false, error: `manager expects resume attempt ${this.resumeAttemptId ?? "<none>"}, not ${args.attemptId}` };
@@ -2420,7 +2462,7 @@ export class Manager {
                 inactive = this.resumeLivenessErrors(inventory, this.ep.getRoster());
             }
             catch (e) {
-                return { ok: false, error: `resume attempt ${args.attemptId} cannot verify live principals at finalize: ${e.message}` };
+                return { ok: false, error: `resume attempt ${args.attemptId} cannot verify live principals at finalize: ${rejectionText(e)}` };
             }
             if (inactive.length)
                 return { ok: false, error: `resume attempt ${args.attemptId} is not live at finalize: ${inactive.join("; ")}` };
@@ -2439,7 +2481,7 @@ export class Manager {
             // retiredPrincipals, so a copied JWT is refused). Best-effort + loud: a sweep failure must
             // not fail the finalize (the next non-resume boot re-drives it), but it is never swallowed.
             if (this.auth && !this.userMode)
-                await this.reconcileStaticLifecycles(true).catch((e) => console.error(`! post-resume static reconcile: ${e.message} - no per-alias retry could be planned; a later manager start re-reads unfinished durable terminals`));
+                await this.reconcileStaticLifecycles(true).catch((e) => console.error(`! post-resume static reconcile: ${rejectionText(e)} - no per-alias retry could be planned; a later manager start re-reads unfinished durable terminals`));
             this.resumeFinalized = true;
             this.resumeRequired = false;
             return { ok: true, data: { attemptId: args.attemptId, state: "active" } };
@@ -2452,7 +2494,7 @@ export class Manager {
                 attemptId = parseResumeCommitArgs(rawArgs).attemptId;
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
             if (!this.resumeAttemptId || this.resumeAttemptId !== attemptId)
                 return { ok: false, error: `manager expects resume attempt ${this.resumeAttemptId ?? "<none>"}, not ${attemptId}` };
@@ -2509,7 +2551,7 @@ export class Manager {
                     : { ok: false, data, error: result.error ?? "retained-agent resume failed" };
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
         }
     }
@@ -2536,7 +2578,7 @@ export class Manager {
                 };
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
     }
     /** The ONE shared control-admission chokepoint (P2 item 1, checklist 3/8) BOTH dispatch doors
@@ -2767,7 +2809,7 @@ export class Manager {
                             observed = await observeStaticSlot(recordsKv, DEV_OWNER, name, this.managerInstanceId);
                         }
                         catch (error) {
-                            throw new EpEnvelopeError("unavailable", `the durable static slot state for "${name}" could not be read: ${error.message}`, [
+                            throw new EpEnvelopeError("unavailable", `the durable static slot state for "${name}" could not be read: ${rejectionText(error)}`, [
                                 { kind: STATIC_SLOT_READ_FAILED_DETAIL, name, record: error instanceof StaticSlotReadError ? error.record : "slot-or-head", operation: "read" },
                             ]);
                         }
@@ -2804,7 +2846,7 @@ export class Manager {
                     observed = await listStaticSlotObservations(recordsKv, DEV_OWNER, this.managerInstanceId);
                 }
                 catch (error) {
-                    throw new EpEnvelopeError("unavailable", `the durable static slot state could not be scanned: ${error.message}`, [
+                    throw new EpEnvelopeError("unavailable", `the durable static slot state could not be scanned: ${rejectionText(error)}`, [
                         { kind: STATIC_SLOT_READ_FAILED_DETAIL, name: "*", record: error instanceof StaticSlotReadError ? error.record : "slot-or-head", operation: "scan" },
                     ]);
                 }
@@ -2942,7 +2984,7 @@ export class Manager {
                 return undefined;
             }
             catch (e) {
-                return `${entry.name}: ${e.message}`;
+                return `${entry.name}: ${rejectionText(e)}`;
             }
         }));
         const drift = authority.filter((error) => error !== undefined);
@@ -2953,7 +2995,7 @@ export class Manager {
             inactive = this.resumeLivenessErrors(inventory, this.ep.getRoster());
         }
         catch (e) {
-            return { ok: false, error: `resume attempt ${attemptId} cannot verify live principals: ${e.message}` };
+            return { ok: false, error: `resume attempt ${attemptId} cannot verify live principals: ${rejectionText(e)}` };
         }
         if (inactive.length)
             return { ok: false, error: `resume attempt ${attemptId} is not live at commit: ${inactive.join("; ")}` };
@@ -3046,7 +3088,7 @@ export class Manager {
                 }
             }
             catch (e) {
-                inactive.push(`${entry.name} runtime status failed: ${e.message}`);
+                inactive.push(`${entry.name} runtime status failed: ${rejectionText(e)}`);
                 continue;
             }
             if (!roster.some((presence) => presence.card.id === expectedPrincipal && presence.card.name === entry.name && presence.status !== "offline" &&
@@ -3102,7 +3144,7 @@ export class Manager {
                 a.handle.stop({ graceful });
         }
         catch (e) {
-            console.error(`stop ${a.name} (${a.id}): ${e.message}`);
+            console.error(`stop ${a.name} (${a.id}): ${rejectionText(e)}`);
         }
     }
     /** Keep an accepted stop inside the lifecycle drain until the runtime proves the child is gone,
@@ -3145,7 +3187,7 @@ export class Manager {
                 id: a.id,
                 handle: a.handle,
                 authoritative: true,
-                error: `accepted stop could not prove exit: ${e.message}`,
+                error: `accepted stop could not prove exit: ${rejectionText(e)}`,
             });
         })
             .finally(() => this.releaseLifecycle());
@@ -3185,7 +3227,7 @@ export class Manager {
             provider = resolveAuthProvider();
         }
         catch (e) {
-            return { error: e.message };
+            return { error: rejectionText(e) };
         }
         const dir = userAuthStateDir(this.workspaceRoot, this.space);
         // The agent's capability scope rides its ledger row (act.scope in every bearer) — same
@@ -3293,7 +3335,7 @@ export class Manager {
             provider = resolveAuthProvider();
         }
         catch (e) {
-            return { error: e.message };
+            return { error: rejectionText(e) };
         }
         const secrets = this.secrets;
         // The token the agent will present to `POST /exchange` for the rest of its life. Generated
@@ -3451,7 +3493,7 @@ export class Manager {
         catch (e) {
             // A runtime that throws while being asked has told us something real; it must not take the
             // log line (or the free path it sits on) down with it.
-            detail = `exit detail unreadable from runtime "${a.handle.kind}": ${e.message}`;
+            detail = `exit detail unreadable from runtime "${a.handle.kind}": ${rejectionText(e)}`;
         }
         console.error(`seat reaped: ${a.name} (${a.id}, uid ${a.lifecycleUid}${a.handle.pid !== undefined ? `, pid ${a.handle.pid}` : ""}) - ${causeText}; ${detail}`);
     }
@@ -3671,8 +3713,8 @@ export class Manager {
             catch (e) {
                 const h = this.retiring.get(a.name);
                 if (h && h.lifecycleUid === a.lifecycleUid)
-                    h.lastError = `the agent's standing mint authority could not be revoked (${e.message}); the name stays held so a copied actor token cannot mint fresh credentials. NEXT: a same-name spawn re-drives the full teardown (including the revoke), or recover the auth state.`;
-                console.error(`revoke agent grant ${a.name}: ${e.message}`);
+                    h.lastError = `the agent's standing mint authority could not be revoked (${rejectionText(e)}); the name stays held so a copied actor token cannot mint fresh credentials. NEXT: a same-name spawn re-drives the full teardown (including the revoke), or recover the auth state.`;
+                console.error(`revoke agent grant ${a.name}: ${rejectionText(e)}`);
             }
         }
         const shredFailure = unshredded.length ? `could not shred "${a.name}": ${unshredded.join("; ")}` : undefined;
@@ -3685,7 +3727,7 @@ export class Manager {
         catch (e) {
             const h = this.retiring.get(a.name);
             if (h && h.lifecycleUid === a.lifecycleUid) {
-                h.lastError = e.message;
+                h.lastError = rejectionText(e);
                 if (e instanceof DeprovisionError)
                     h.lastResources = e.accounting;
             }
@@ -3831,7 +3873,7 @@ export class Manager {
             }
         }
         catch (e) {
-            const copy = uncertain(e.message);
+            const copy = uncertain(rejectionText(e));
             if (held)
                 held.lastError = copy;
             console.error(`despawn ${a.name}: ${copy}`);
@@ -3925,7 +3967,7 @@ export class Manager {
             return { complete: true, channels: data.channels };
         }
         catch (e) {
-            return { complete: false, channels: [], reason: e.message };
+            return { complete: false, channels: [], reason: rejectionText(e) };
         }
     }
     /** Reap a parent's children on its exit (P4b). Every descendant remains managed until the runtime's
@@ -3947,7 +3989,7 @@ export class Manager {
             parsed = JSON.parse(readFileSync(path, "utf8"));
         }
         catch (error) {
-            throw new Error(`cannot read connector session state ${path}: ${error.message}`);
+            throw new Error(`cannot read connector session state ${path}: ${rejectionText(error)}`);
         }
         const state = parsed;
         if (state.version !== 1 || typeof state.sessionId !== "string" || !state.sessionId.trim() || state.sessionId.length > 4096 ||
@@ -3974,7 +4016,7 @@ export class Manager {
         }
         catch (error) {
             throw new Error(`retained ${connector.name} agent ${entry.name} has no sessionId in its older inventory and no usable upgrade state at ${path} ` +
-                `(${error.message}). Reload the live Pi seat before the preservation cut; refusing to resume fresh and lose its context.`);
+                `(${rejectionText(error)}). Reload the live Pi seat before the preservation cut; refusing to resume fresh and lose its context.`);
         }
     }
     /** A resumed seat's fork provenance (#1500). The seat forks after it launches, so this reads the
@@ -4059,7 +4101,7 @@ export class Manager {
             this.recordContinuity(a, this.readManagedSession(a));
         }
         catch (error) {
-            console.error(`! ${a.name}: continuity: exact assignment not updated at ${boundary}: ${error.message}`);
+            console.error(`! ${a.name}: continuity: exact assignment not updated at ${boundary}: ${rejectionText(error)}`);
         }
     }
     async awaitManagedSessionState(a) {
@@ -4072,7 +4114,7 @@ export class Manager {
                 return this.readManagedSessionState(a);
             }
             catch (error) {
-                last = error.message;
+                last = rejectionText(error);
             }
             await new Promise((resolve) => setTimeout(resolve, 100));
         }
@@ -4105,7 +4147,7 @@ export class Manager {
                     return;
                 }
                 catch (error) {
-                    last = error.message;
+                    last = rejectionText(error);
                 }
             }
             await new Promise((resolve) => setTimeout(resolve, 100));
@@ -4210,7 +4252,7 @@ export class Manager {
                     tail = await this.tail((replacement ?? a.handle).attach());
                 }
                 catch { /* runtime has no readable tail */ }
-                console.error(`! ${a.name}: ${supervised ? "supervised restart" : "Pi session recovery"} failed: ${error.message}${tail ? ` - last output: ${tail}` : ""} - retiring the managed seat`);
+                console.error(`! ${a.name}: ${supervised ? "supervised restart" : "Pi session recovery"} failed: ${rejectionText(error)}${tail ? ` - last output: ${tail}` : ""} - retiring the managed seat`);
                 // The replacement may be alive but unable to prove readiness. Stop it BEFORE
                 // retiring credentials/durables; otherwise an untracked process survives under torn auth.
                 try {
@@ -4250,7 +4292,7 @@ export class Manager {
                 }
             }
             catch (error) {
-                console.error(`! ${a.name}: cannot classify Pi process exit for recovery: ${error.message} - retiring the seat`);
+                console.error(`! ${a.name}: cannot classify Pi process exit for recovery: ${rejectionText(error)} - retiring the seat`);
             }
         }
         this.freeSlot(a, true, "process-exit");
@@ -4335,6 +4377,8 @@ export class Manager {
         // but a raw control message could otherwise slip an empty value through and silently start fresh.
         if (args.resume !== undefined && !String(args.resume).trim())
             return Promise.resolve({ ok: false, error: "resume: session id must not be empty" });
+        if (args.model !== undefined && !String(args.model).trim())
+            return Promise.resolve({ ok: false, error: "model: must not be empty" });
         if (args.variant !== undefined && !String(args.variant).trim())
             return Promise.resolve({ ok: false, error: "variant: must not be empty" });
         if (args.defaultAgent !== undefined && !String(args.defaultAgent).trim())
@@ -4375,7 +4419,7 @@ export class Manager {
             shareTools = strList(args.shareTools, "shareTools");
         }
         catch (e) {
-            return Promise.resolve({ ok: false, error: e.message });
+            return Promise.resolve({ ok: false, error: rejectionText(e) });
         }
         // #373: the event-plane admission gate. `startAgent` resolves `eventsRequired || opts.events
         // !== false`, so omission ARMS the plane — a gate on the explicit bit alone is bypassed by
@@ -4436,14 +4480,14 @@ export class Manager {
             cwd = realpathSync(resolved);
         }
         catch (error) {
-            return { refusal: `path cannot be resolved: ${error.message}` };
+            return { refusal: `path cannot be resolved: ${rejectionText(error)}` };
         }
         try {
             if (!statSync(cwd).isDirectory())
                 return { refusal: "path is not a directory" };
         }
         catch (error) {
-            return { refusal: error.message };
+            return { refusal: rejectionText(error) };
         }
         return { cwd, host: hostname() };
     }
@@ -4491,7 +4535,7 @@ export class Manager {
                 declared = loadExtensionsManifest().extensions.flatMap((ext) => extensionConnectors(ext));
             }
             catch (error) {
-                const reason = error.message;
+                const reason = rejectionText(error);
                 console.error(`! manager boot: connector inventory unavailable - ${reason}`);
                 this.connectorStatuses = [{ agent: "(inventory)", state: "unavailable", binaries: {}, reason }];
                 console.error("! manager boot: no connector available - spawn and launch stay on this instance rail only so a sibling that can launch them can take the class queue");
@@ -4575,7 +4619,7 @@ export class Manager {
                 return { agent: connector.name, supported: true, ...catalog };
             }
             catch (e) {
-                return { agent: connector.name, supported: true, models: [], error: e.message };
+                return { agent: connector.name, supported: true, models: [], error: rejectionText(e) };
             }
         };
         if (requested) {
@@ -4584,7 +4628,7 @@ export class Manager {
                 connector = await this.resolveConnector(requested);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
             const result = await one(connector);
             return result.error ? { ok: false, error: result.error } : { ok: true, data: result };
@@ -4598,7 +4642,7 @@ export class Manager {
                 connector = await this.resolveConnector(name);
             }
             catch (e) {
-                return { agent: name, supported: false, models: [], error: e.message };
+                return { agent: name, supported: false, models: [], error: rejectionText(e) };
             }
             return one(connector);
         }));
@@ -4660,7 +4704,7 @@ export class Manager {
                 persistLaunchSpec(this.workspaceRoot, spec);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
         }
         else {
@@ -4668,7 +4712,7 @@ export class Manager {
                 spec = launchSpecForRun(this.workspaceRoot, runId);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
         }
         const la = spec.agents.find((a) => a.name === name);
@@ -4691,7 +4735,7 @@ export class Manager {
             configPath = materializePersona(this.workspaceRoot, runId, la);
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
         const reply = await this.startAgent({ ...launchAgentToStartOpts(la, configPath, spec.owner, runId), route }, caller, hooks);
         if (reply.ok)
@@ -4718,9 +4762,10 @@ export class Manager {
         }
     }
     async startAgentActive(opts, spawner, hooks) {
-        // The caller keeps its array, so the selection is copied before the first await: a later write
-        // to it cannot change what this launch shares or what preservation retains.
-        const shareTools = opts.shareTools && [...opts.shareTools];
+        // Before the first await, so the grant, the launch and the retained form all read the lists as admitted.
+        opts = ownLists(opts);
+        if (opts.resolved)
+            opts.resolved = ownLists(opts.resolved);
         if (opts.delegatedIntent) {
             if (!this.remoteAuthority?.executeDelegatedUserIntent)
                 return { ok: false, error: `"${opts.name}" names a delegated user intent, and this manager has no host execution for one` };
@@ -4774,7 +4819,7 @@ export class Manager {
                 def = loadAgentFile(configPath);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
         }
         const agent = resolveAgentType({ flag: opts.agent, pin: def?.agent, callerDefault: opts.defaultAgent });
@@ -4788,7 +4833,7 @@ export class Manager {
             connector = await this.resolveConnector(agent);
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
         const readinessTimeoutMs = connector.readinessTimeoutMs ?? this.readinessTimeoutMs;
         if (!Number.isSafeInteger(readinessTimeoutMs) || readinessTimeoutMs <= 0)
@@ -4827,7 +4872,7 @@ export class Manager {
                 carried = this.transcripts.peek(opts.resumeClaim, opts.resume);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
         }
         // A restart policy this host cannot honour is refused at accept, never accepted and ignored.
@@ -4850,7 +4895,7 @@ export class Manager {
                 this.delegatedMeshRecord();
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
             if (opts.resume)
                 return { ok: false, error: `${delegatedBy}, so it cannot resume a session held on this host (resume)` };
@@ -4858,7 +4903,7 @@ export class Manager {
                 return { ok: false, error: `${delegatedBy}, so it cannot reopen a session held on this host (continuity: exact)` };
             if (typeof opts.cwd === "string" && opts.cwd !== "")
                 return { ok: false, error: `${delegatedBy}, so it cannot run in a directory on this host's filesystem (cwd); the seat runs in its runtime resource's own directory` };
-            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, shareTools));
+            const shared = Object.keys(connectorServers(loadCotalConfig(this.workspaceRoot), agent, opts.shareTools));
             if (shared.length)
                 return { ok: false, error: `${delegatedBy}, so it cannot share MCP servers that run on this host (${shared.join(", ")}); pass --share-tools none` };
         }
@@ -4894,7 +4939,7 @@ export class Manager {
         if (opts.resolved) {
             // A manifest launch is the access + identity authority: imperative overrides arriving
             // alongside `resolved` are a caller contract error, not something to merge (no fallbacks).
-            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || shareTools || opts.identity)
+            if (opts.subscribe || opts.allowSubscribe || opts.allowPublish || opts.prompt || opts.shareTools || opts.identity)
                 return { ok: false, error: "a manifest launch (resolved) rejects imperative overrides (identity/subscribe/allow*/prompt/shareTools)" };
             const r = opts.resolved;
             identityName = r.name;
@@ -4939,14 +4984,14 @@ export class Manager {
             allowSubscribe = resolveReadAcl(subscribe ?? [], allowSubscribe);
         }
         catch (e) {
-            return { ok: false, error: opts.resolved ? `launch agent: ${e.message}` : `persona ${configPath}: ${e.message}` };
-        }
-        // #651: an empty or whitespace-only model string is not a pin. Coerce it to undefined here, at
-        // the single point every path (persona, manifest, imperative) has resolved `model`, so it
-        // serializes ABSENT rather than present-but-empty (`"model": ""`), which a key-presence consumer
-        // would misread as "a pin was recorded".
-        if (model !== undefined && model.trim() === "")
-            model = undefined;
+            return { ok: false, error: opts.resolved ? `launch agent: ${rejectionText(e)}` : `persona ${configPath}: ${rejectionText(e)}` };
+        }
+        // Checked after every path has resolved its selectors: a direct `startAgent` call skips the
+        // `start` op's checks, and no connector may receive a blank one (#2862).
+        if (model !== undefined && !model.trim())
+            return { ok: false, error: "model: must not be empty" };
+        if (variant !== undefined && !variant.trim())
+            return { ok: false, error: "variant: must not be empty" };
         const idErr = this.nameError(identityName);
         if (idErr)
             return { ok: false, error: opts.resolved ? `launch agent: ${idErr}` : `persona ${configPath}: ${idErr}` };
@@ -4990,7 +5035,7 @@ export class Manager {
             });
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
         if (policyRefusal)
             return { ok: false, error: policyRefusal };
@@ -5021,7 +5066,7 @@ export class Manager {
                 reopenSession = readContinuityAssignment(this.workspaceRoot, { space: this.space, name: identityName, connector: agent, cwd: resolvedCwd ?? this.workspaceRoot });
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
         }
         // The child takes launch options as `--opt k=v`, so only string values can cross to it.
@@ -5283,7 +5328,7 @@ export class Manager {
             // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
             // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
             const cotalConfig = loadCotalConfig(this.workspaceRoot);
-            const mcpServers = connectorServers(cotalConfig, agent, shareTools);
+            const mcpServers = connectorServers(cotalConfig, agent, opts.shareTools);
             // The operator's spawn-env policy travels the same route: absent means no extras (the OS
             // allow-list + operator knobs + connector-declared inputs), present means those names too.
             // A connector never reads the config itself.
@@ -5410,7 +5455,7 @@ export class Manager {
                     allowPublish,
                     capabilities,
                     events,
-                    shareTools,
+                    shareTools: opts.shareTools,
                     forkSource: opts.resume,
                     ...(opts.resume !== undefined && spec?.resumeRecordPath ? { resumeRecordPath: spec.resumeRecordPath } : {}),
                     ...(carried ? { carried: { transcriptSha256: carried.sha256, host: carried.sourceHost, transferredAt: carried.stagedAt } } : {}),
@@ -5514,7 +5559,7 @@ export class Manager {
                         }
                     }
                     catch (error) {
-                        const detail = `${managed.name} joined, but its exact host session could not be bound for supervised recovery: ${error.message}`;
+                        const detail = `${managed.name} joined, but its exact host session could not be bound for supervised recovery: ${rejectionText(error)}`;
                         this.stopHandle(managed, false);
                         this.freeSlot(managed, true, "session-bind-failed");
                         await hooks?.onOutcome?.({ kind: "failed", data: { error: detail } });
@@ -5587,9 +5632,9 @@ export class Manager {
                 return { ok: false, agents: [], error: `unsupported manager resume inventory version ${String(inventory.version)}` };
             if (inventory.space !== this.space)
                 return { ok: false, agents: [], error: `resume inventory belongs to space "${inventory.space}", not "${this.space}"` };
-            // The caller keeps its inventory, so each selection is copied before the first await: a later
-            // write to it cannot change what a resumed seat shares or what the next preservation retains.
-            const entries = inventory.agents.map((entry) => ({ ...entry, launch: { ...entry.launch, shareTools: entry.launch.shareTools && [...entry.launch.shareTools] } }));
+            // The caller keeps its inventory, so it is copied before the first await: a later write to it
+            // cannot change what a resumed seat launches with or what the next preservation retains.
+            const entries = structuredClone(inventory.agents);
             const seen = new Set();
             const principals = new Set();
             const orphans = [];
@@ -5631,7 +5676,7 @@ export class Manager {
                         : principalKey(DEV_OWNER, entry.identity.id).key;
                 }
                 catch (e) {
-                    return { ok: false, agents: [], error: `invalid retained principal for ${entry.name}: ${e.message}` };
+                    return { ok: false, agents: [], error: `invalid retained principal for ${entry.name}: ${rejectionText(e)}` };
                 }
                 if (principals.has(principal))
                     return { ok: false, agents: [], error: `resume inventory contains duplicate principal "${principal}"` };
@@ -5707,7 +5752,7 @@ export class Manager {
                     discardLaunchArtifacts(spec.artifacts);
                 }
                 catch (e) {
-                    console.error(`! resume: ${e.message}`);
+                    console.error(`! resume: ${rejectionText(e)}`);
                 }
             }
             release();
@@ -5786,7 +5831,7 @@ export class Manager {
                     throw new Error(`retained credential identity ${actual} does not match inventory principal ${entry.identity.id}`);
             }
             catch (e) {
-                throw new Error(`retained credential for ${entry.name} is unusable: ${e.message}`);
+                throw new Error(`retained credential for ${entry.name} is unusable: ${rejectionText(e)}`);
             }
             const accepted = await this.probeStaticCredential(credentialText);
             if (!accepted.ok)
@@ -5874,7 +5919,7 @@ export class Manager {
             };
         }
         catch (e) {
-            throw new Error(`retained user principal ${entry.identity.owner}.${entry.identity.actor} could not be reused: ${e.message}`);
+            throw new Error(`retained user principal ${entry.identity.owner}.${entry.identity.actor} could not be reused: ${rejectionText(e)}`);
         }
     }
     /** The seat reference behind a live retained principal, when that seat is provably one a lost
@@ -5907,7 +5952,7 @@ export class Manager {
             console.error(`resume: reaped orphaned seat ${reference.kind}:${reference.id} of retained principal "${principal}" (${evidence.detail})`);
         }
         catch (e) {
-            return `retained principal "${principal}" is already live and its recorded seat ${reference.kind}:${reference.id} could not be reaped: ${e.message}`;
+            return `retained principal "${principal}" is already live and its recorded seat ${reference.kind}:${reference.id} could not be reaped: ${rejectionText(e)}`;
         }
         const deadline = Date.now() + ORPHAN_PRESENCE_CLEAR_MS;
         while (this.ep.getRoster().some((p) => p.card.id === principal && p.status !== "offline")) {
@@ -5943,7 +5988,7 @@ export class Manager {
                     await this.validateRetainedAuthority(entry);
                 }
                 catch (e) {
-                    return { ok: false, error: e.message };
+                    return { ok: false, error: rejectionText(e) };
                 }
                 return this.launchPreparedResume(entry, cached, batchReserved);
             }
@@ -5953,7 +5998,7 @@ export class Manager {
                     return { ok: false, error: `retained cwd is not a real directory: ${entry.launch.cwd}` };
             }
             catch (e) {
-                return { ok: false, error: `retained cwd unavailable: ${entry.launch.cwd} (${e.message})` };
+                return { ok: false, error: `retained cwd unavailable: ${entry.launch.cwd} (${rejectionText(e)})` };
             }
             let connector;
             try {
@@ -5967,7 +6012,7 @@ export class Manager {
                 connector = await this.resolveConnector(entry.launch.connector);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
             const harness = this.launchHarness(connector);
             if ("refusal" in harness)
@@ -5977,7 +6022,7 @@ export class Manager {
                 retainedSession = this.retainedSessionId(entry, connector);
             }
             catch (error) {
-                return { ok: false, error: error.message };
+                return { ok: false, error: rejectionText(error) };
             }
             if (entry.launch.forkSource && !retainedSession && !connector.supportsResume)
                 return { ok: false, error: `${connector.name} connector does not support session fork (resume)` };
@@ -5997,7 +6042,7 @@ export class Manager {
                     spec = source.agents.find((a) => a.name === launchSource.requested);
                 }
                 catch (e) {
-                    return { ok: false, error: e.message };
+                    return { ok: false, error: rejectionText(e) };
                 }
                 if (!spec || spec.hash !== launchSource.hash)
                     return { ok: false, error: `retained manifest agent ${launchSource.requested} is missing or its hash changed; refusing same-principal resume` };
@@ -6009,7 +6054,7 @@ export class Manager {
                     launchOptions = loadAgentFile(entry.launch.source.configPath).launchOptions;
                 }
                 catch (e) {
-                    return { ok: false, error: e.message };
+                    return { ok: false, error: rejectionText(e) };
                 }
             }
             // Asked once `exact` is known: an exact seat reopens its retained session or fails, like its
@@ -6022,7 +6067,7 @@ export class Manager {
                 authority = await this.validateRetainedAuthority(entry);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
             try {
                 const resumeConfig = loadCotalConfig(this.workspaceRoot);
@@ -6071,7 +6116,7 @@ export class Manager {
                 return this.launchPreparedResume(entry, value, batchReserved);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
         }
         finally {
@@ -6154,7 +6199,7 @@ export class Manager {
                 await this.recordSlotRuntime(managed);
             }
             catch (error) {
-                return await this.stopFailedResume(managed, "resume-custody-unrecorded", `${managed.name} resumed, but ${error.message}`);
+                return await this.stopFailedResume(managed, "resume-custody-unrecorded", `${managed.name} resumed, but ${rejectionText(error)}`);
             }
             const readiness = await this.awaitReadiness(managed, readinessTimeoutMs);
             if (!readiness.ok && !readiness.uncertain)
@@ -6181,7 +6226,7 @@ export class Manager {
                     }
                 }
                 catch (error) {
-                    return await this.stopFailedResume(managed, "resume-session-rebind-failed", `${managed.name} resumed, but its exact host session could not be rebound: ${error.message}`);
+                    return await this.stopFailedResume(managed, "resume-session-rebind-failed", `${managed.name} resumed, but its exact host session could not be rebound: ${rejectionText(error)}`);
                 }
             }
             if (!this.resumeAttemptId)
@@ -6195,7 +6240,7 @@ export class Manager {
             };
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
         finally {
             if (!batchReserved) {
@@ -6214,7 +6259,7 @@ export class Manager {
         }
         catch (exit) {
             this.watchExit(managed);
-            return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${exit.message}` };
+            return { ok: false, error: `${detail}; it stays managed because its stop is unproven: ${rejectionText(exit)}` };
         }
         this.freeSlot(managed, true, cause, true);
         return { ok: false, error: detail };
@@ -6966,7 +7011,7 @@ export class Manager {
         // One registration operation for this boot. Fresh executors may replace a dead connection, but
         // they must resume THIS freeze rather than minting a new op that discards Phase-2 progress.
         const registrationOpId = mintLifecycleUid();
-        const executorExpired = (e) => /closed connection/i.test(e?.message ?? String(e));
+        const executorExpired = (e) => /closed connection/i.test(rejectionText(e));
         const retryExpiredExecutor = async (label, fn) => {
             for (;;) {
                 try {
@@ -7573,14 +7618,14 @@ export class Manager {
                         await this.reconcileOneGoal(entry.ref, entry.iid);
                 }
                 catch (e) {
-                    console.error(`! goal reconcile for ${entry.ref.goalId}: ${e.message}`);
+                    console.error(`! goal reconcile for ${entry.ref.goalId}: ${rejectionText(e)}`);
                 }
             }
             if (entries.length)
                 console.error(`goal-index boot reconcile: swept ${entries.length} inherited goal(s)`);
         }
         catch (e) {
-            console.error(`! goal-index boot reconcile failed: ${e.message} - accepted goals from a predecessor may stay unsettled until the next restart`);
+            console.error(`! goal-index boot reconcile failed: ${rejectionText(e)} - accepted goals from a predecessor may stay unsettled until the next restart`);
         }
         finally {
             this.goalReconcileDone = true;
@@ -7630,7 +7675,7 @@ export class Manager {
             return;
         }
         console.error(`goal reconcile ${ref.goalId}: within the readiness window (${remaining}ms) - arming a bounded settle`);
-        const t = setTimeout(() => { settle().catch((e) => console.error(`! goal reconcile settle ${ref.goalId}: ${e.message}`)); }, remaining + 100);
+        const t = setTimeout(() => { settle().catch((e) => console.error(`! goal reconcile settle ${ref.goalId}: ${rejectionText(e)}`)); }, remaining + 100);
         t.unref?.();
     }
     /** P2 item 2: publish a goal PROGRESS event on the caller-scoped epe subtree, over the SERVE
@@ -7646,7 +7691,7 @@ export class Manager {
             nc.publish(epeSubject(this.space, MANAGER_ENDPOINT, this.managerInstanceId, epoch, goalProgressTopic(ref)), new TextEncoder().encode(JSON.stringify({ v: 1, goalId: ref.goalId, ...event })));
         }
         catch (e) {
-            console.error(`! goal progress emit for ${ref.goalId} failed: ${e.message}`);
+            console.error(`! goal progress emit for ${ref.goalId} failed: ${rejectionText(e)}`);
         }
     }
     /** The own-gate currency belt: before the goal-writer commits a terminal fact, the manager reads
@@ -7785,7 +7830,7 @@ export class Manager {
                 // ENTRY. This leg is infrastructure-class and converges through the reconcile index at the
                 // next boot, which is why the index is NOT cleared above on this path. Do not "close" it
                 // here with a retry loop.
-                console.error(`! goal terminal commit for ${goalId} failed: ${e.message}`);
+                console.error(`! goal terminal commit for ${goalId} failed: ${rejectionText(e)}`);
             }
         };
         const bg = run({
@@ -7870,7 +7915,7 @@ export class Manager {
             // the caller follows epe to a terminal that never comes, and the reconcile index that would
             // settle it is only swept at BOOT, so a manager that stays up never converges it.
             if (reply.ok === false && !terminalEntered)
-                return onOutcome({ kind: "failed", data: { error: reply.error ?? "spawn failed after accept", ...(reply.details ? { details: reply.details } : {}) } });
+                return onOutcome({ kind: "failed", data: failedTerminal(reply.error ?? "spawn failed after accept", reply) });
         }).catch((e) => {
             if (acceptance === undefined) {
                 rejectAccept(e);
@@ -7878,9 +7923,9 @@ export class Manager {
             }
             // Same obligation for a genuine rejection (one that escaped `run`'s own catch).
             if (!terminalEntered)
-                return onOutcome({ kind: "failed", data: { error: e?.message ?? String(e), ...(e instanceof EpEnvelopeError && e.details ? { details: e.details } : {}) } });
-            console.error(`! spawn-as-action async body for ${goalId}: ${e?.message ?? String(e)}`);
-        }).catch((e) => console.error(`! goal terminal fallback for ${goalId}: ${e?.message ?? String(e)}`));
+                return onOutcome({ kind: "failed", data: failedTerminal(rejectionText(e), caughtEnvelope(e)) });
+            console.error(`! spawn-as-action async body for ${goalId}: ${rejectionText(e)}`);
+        }).catch((e) => console.error(`! goal terminal fallback for ${goalId}: ${rejectionText(e)}`));
         return acceptP;
     }
     /** H2: an acceptance served from a WINNER'S durable acceptance floor (the goal-index entry it
@@ -8023,7 +8068,7 @@ export class Manager {
             // The accept is inline (no launch closure to fail later), so a post-bind throw unwinds HERE:
             // commit the failed terminal this attempt owns, clear the index, and refuse the accept — an
             // accepted-but-unanswered goal must never be left for the boot sweep to find (H1's rule).
-            const msg = e?.message ?? String(e);
+            const msg = rejectionText(e);
             try {
                 await this.assertGoalWriterEpochCurrent(executor.epoch);
                 // The goal is TARGET-PINNED, so its completion proves the seat's currency exactly as the
@@ -8039,9 +8084,9 @@ export class Manager {
                 await clearGoalIndex(gw.ctx, ref);
             }
             catch (e2) {
-                console.error(`! turn accept unwind for ${goalId}: ${e2.message}`);
+                console.error(`! turn accept unwind for ${goalId}: ${rejectionText(e2)}`);
             }
-            throw e instanceof EpEnvelopeError ? e : new EpEnvelopeError("internal", `turn accept for ${goalId} failed: ${msg}`);
+            throw caughtEnvelope(e) ?? new EpEnvelopeError("internal", `turn accept for ${goalId} failed: ${msg}`);
         }
         const pending = {
             ref, goalId,
@@ -8241,7 +8286,7 @@ export class Manager {
             await clearGoalIndex(gw.ctx, p.ref);
         }
         catch (e) {
-            console.error(`! turn deadline terminal for ${p.goalId}: ${e.message}`);
+            console.error(`! turn deadline terminal for ${p.goalId}: ${rejectionText(e)}`);
         }
         this.maybeStopTurnSweep();
     }
@@ -8273,7 +8318,7 @@ export class Manager {
     ensureTurnSweep() {
         if (this.turnSweepTimer !== undefined)
             return;
-        const t = setInterval(() => { void this.sweepTurnDeadlines().catch((e) => console.error(`! turn deadline sweep: ${e.message}`)); }, TURN_SWEEP_MS);
+        const t = setInterval(() => { void this.sweepTurnDeadlines().catch((e) => console.error(`! turn deadline sweep: ${rejectionText(e)}`)); }, TURN_SWEEP_MS);
         t.unref?.();
         this.turnSweepTimer = t;
     }
@@ -8342,7 +8387,7 @@ export class Manager {
                     await this.commitTurnDeadline(p);
             }
             catch (e) {
-                console.error(`! turn deadline sweep for ${p.goalId}: ${e.message}`);
+                console.error(`! turn deadline sweep for ${p.goalId}: ${rejectionText(e)}`);
             }
         }
     }
@@ -8473,7 +8518,7 @@ export class Manager {
             });
         }
         catch (e) {
-            throw new Error(`could not record the custody reference ${runtime.kind}:${runtime.id} on the static slot of "${a.name}": ${e.message}`);
+            throw new Error(`could not record the custody reference ${runtime.kind}:${runtime.id} on the static slot of "${a.name}": ${rejectionText(e)}`);
         }
     }
     /** Mint the custody reference for a seat this manager is about to spawn, BEFORE the processes
@@ -8519,7 +8564,7 @@ export class Manager {
                 disposal =
                     e instanceof RuntimeReapUnproven
                         ? `the spawned seat was NOT proved gone and may still be running as ${e.reference.kind}:${e.reference.id} (${e.message})`
-                        : `the spawned seat could NOT be reaped: ${e.message}`;
+                        : `the spawned seat could NOT be reaped: ${rejectionText(e)}`;
             }
         }
         throw new Error(`runtime "${this.runtime.kind}" reserved custody ${reserved.kind}:${reserved.id} for "${name}" but spawned ` +
@@ -8620,8 +8665,8 @@ export class Manager {
         catch (e) {
             const h = this.retiring.get(a.name);
             if (h && h.lifecycleUid === a.lifecycleUid)
-                h.lastError = `the static retirement did not complete (${e.message}); the name stays held - a same-name spawn retries the same terminal (op ${opId})`;
-            console.error(`static retirement ${a.name} (${a.id}): ${e.message}`);
+                h.lastError = `the static retirement did not complete (${rejectionText(e)}); the name stays held - a same-name spawn retries the same terminal (op ${opId})`;
+            console.error(`static retirement ${a.name} (${a.id}): ${rejectionText(e)}`);
             if (surfaceFailure)
                 throw e;
         }
@@ -8724,7 +8769,7 @@ export class Manager {
                 await this.retryStaticReconcile(key);
             };
             void run().catch((error) => {
-                item.lastError = `retry driver failed before the exact terminal: ${error.message}`;
+                item.lastError = `retry driver failed before the exact terminal: ${rejectionText(error)}`;
                 item.disposition = "retry-exhausted";
                 item.remedy = "restart this manager for a fresh per-process retry budget";
                 console.error(`! static reconcile retry-exhausted alias=${item.alias} phase=${item.phase} uid=${item.lifecycleUid}: ${item.lastError}; NEXT: restart this manager for a fresh per-process retry budget`);
@@ -8765,7 +8810,7 @@ export class Manager {
             row = await this.readStaticReconcileSlot(item.alias);
         }
         catch (error) {
-            item.lastError = `durable slot re-read failed: ${error.message}`;
+            item.lastError = `durable slot re-read failed: ${rejectionText(error)}`;
             if (item.attempts >= item.maxAttempts) {
                 item.disposition = "retry-exhausted";
                 item.remedy = "restart this manager for a fresh per-process retry budget";
@@ -8849,7 +8894,7 @@ export class Manager {
                 return true;
             }
             catch (error) {
-                item.lastError = error.message;
+                item.lastError = rejectionText(error);
                 try {
                     const fresh = await this.readStaticReconcileSlot(item.alias);
                     if (fresh?.lifecycleUid === item.lifecycleUid && fresh.actor === item.actor)
@@ -8948,16 +8993,8 @@ export class Manager {
                 const kvm = new Kvm(nc);
                 await ensureAuthorityStores(jsm, kvm, this.space);
                 const recordsKv = await kvm.open(recordsBucket(this.space));
-                const t = staticLifecycleTransport(recordsKv, recordsKv /* auth reads unused in the sweep */);
-                const keys = await recordsKv.keys(`${STATIC_SLOT_PREFIX}.${DEV_OWNER}.>`);
-                const aliases = [];
-                for await (const k of keys)
-                    aliases.push(k.split(".").slice(2).join("."));
-                for (const alias of aliases) {
-                    const slot = await readStaticSlot(t, DEV_OWNER, alias);
-                    if (slot !== undefined)
-                        slotRows.push(slot.row);
-                }
+                for (const slot of await walkStaticSlots(recordsKv, DEV_OWNER))
+                    slotRows.push(slot.row);
             }
             catch (error) {
                 sweep.completedAt = new Date().toISOString();
@@ -9206,7 +9243,7 @@ export class Manager {
             return { ok: true, data: result };
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
     }
     /** Persist a peer-defined persona as config. After this, `start name` auto-discovers
@@ -9238,7 +9275,7 @@ export class Manager {
                 existing = loadAgentFile(path);
             }
             catch (e) {
-                return { ok: false, error: e.message };
+                return { ok: false, error: rejectionText(e) };
             }
             if (!admin && existing.owner !== caller) {
                 const owner = existing.owner ? `owned by ${existing.owner}` : "operator-owned (legacy file - no agent owner)";
@@ -9265,13 +9302,13 @@ export class Manager {
             }, existing);
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
         try {
             saveAgentFile(path, def);
         }
         catch (e) {
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
         return { ok: true, data: { name, path } };
     }
@@ -9429,7 +9466,7 @@ export class Manager {
                 accepted = await write(part.data);
             }
             catch (error) {
-                throw new EpEnvelopeError("unavailable", `input for seat "${a.name}" failed: ${error.message}`);
+                throw new EpEnvelopeError("unavailable", `input for seat "${a.name}" failed: ${rejectionText(error)}`);
             }
             if (!Number.isSafeInteger(accepted)) {
                 throw new EpEnvelopeError("unavailable", `input for seat "${a.name}" failed: runtime accepted ${String(accepted)} of ${intendedBytes} bytes`);
@@ -9480,7 +9517,7 @@ export class Manager {
         }
         catch (e) {
             slot.release();
-            return { ok: false, error: e.message };
+            return { ok: false, error: rejectionText(e) };
         }
         // establishAttach releases the claim it was handed on every exit; nothing to unwind here.
         const { grant } = await this.sessionPlane.establishAttach(caller, { name: a.name, lifecycleUid: a.lifecycleUid }, session, slot);