@cotal-ai/manager 0.77.0 → 0.77.1

package/dist/manager.js

@@ -245,14 +245,22 @@ function parseTurnNote(raw) {
     if (typeof n.payload !== "string" || typeof n.deadlineAt !== "number"
         || typeof n.holdEpoch !== "number" || typeof n.owner !== "string")
         return undefined;
+    if (n.holdToken !== undefined && typeof n.holdToken !== "string")
+        return undefined;
     if (n.handoffFrom !== undefined && typeof n.handoffFrom !== "string")
         return undefined;
-    return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, owner: n.owner, ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
+    return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, owner: n.owner, ...(typeof n.holdToken === "string" ? { holdToken: n.holdToken } : {}), ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
+}
+/** A turn relay's key in the manager's maps: the caller triple and goal id the goal plane stores
+ *  the turn under, because a goal id is the caller's own (SPEC 13.6 item 1) and two callers may
+ *  pick the same one. Every part is a subject token, so the dotted join is unambiguous. */
+function turnKey(ref) {
+    return `${ref.caller.owner}.${ref.caller.actor}.${ref.caller.uid}.${ref.goalId}`;
 }
-/** A turn hold's token, DERIVED from the goal id (same recipe as the runtime's pause tokens): a
- *  same-goalId retry or a successor incarnation re-derives the identical token with no lookup. */
-function turnHoldToken(goalId) {
-    return createHash("sha256").update(`${goalId}:turn-deadline`, "utf8").digest("base64url").slice(0, 43);
+/** A turn hold's token, DERIVED (same recipe as the runtime's pause tokens) from the relay key, so
+ *  two callers' turns under one goal id never share a hold. */
+function turnHoldToken(key) {
+    return createHash("sha256").update(`${key}:turn-deadline`, "utf8").digest("base64url").slice(0, 43);
 }
 /**
  * Event channels in `channels` that do NOT belong to `{owner, actor}`.
@@ -466,9 +474,9 @@ export class Manager {
      *  drives the cancel path (transition -> cancel terminal). Cleared when the goal terminalizes. */
     agentGoals = new Map();
     /**
-     * The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin): a
-     * same-goalId retry serves the identical acceptance; cross-incarnation retries rebuild from
-     * the goal-index entry (its acceptance floor + note).
+     * The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin), by
+     * {@link turnKey}: a same-goal retry serves the identical acceptance; cross-incarnation retries
+     * rebuild from the goal-index entry (its acceptance floor + note).
      *
      * One entry per turn this incarnation accepted: the acceptance a duplicate submission is served
      * from, and — once the turn settles — the answer a RETRIED yield is served from.
@@ -489,7 +497,7 @@ export class Manager {
      * window would hear `not-found` again.
      */
     turnAcceptances = new Map();
-    /** Every relayed turn awaiting its seat's yield, by goal id. The seat's `turn-pending` pull
+    /** Every relayed turn awaiting its seat's yield, by {@link turnKey}. The seat's `turn-pending` pull
      *  scans it; the deadline sweep drives expiry; a seat reap stamps its entries `seatDiedAt`, which
      *  the deadline terminal carries as `agentDownAt` so the run reads that death as L4002.
      *  Rebuilt at boot from goal-index entries carrying a turn note. */
@@ -4657,6 +4665,29 @@ export class Manager {
         const { reason } = resolveHarness(connector.name, connector.requires ?? []);
         return reason ? { refusal: reason } : {};
     }
+    /** The launch fields the host supplies rather than the seat. Spawn and resume both take them from
+     *  here, so a resumed seat launches under the same host policy, `eventsRequired` included, as the
+     *  same seat spawned fresh. */
+    hostLaunchFields(agent, shareTools, harness) {
+        const cotalConfig = loadCotalConfig(this.workspaceRoot);
+        return {
+            space: this.space,
+            servers: this.servers,
+            // Personal MCP servers the operator opted to share with manager-spawned agents of this type
+            // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
+            // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
+            mcpServers: connectorServers(cotalConfig, agent, shareTools),
+            // The operator's spawn-env policy travels the same route: absent means no extras (the OS
+            // allow-list + operator knobs + connector-declared inputs), present means those names too.
+            // A connector never reads the config itself.
+            envAllow: spawnEnvAllow(cotalConfig),
+            resolvedBinaries: harness.binaries,
+            eventsRequired: this.eventsRequired,
+            // So a connector that keeps per-agent local state can root it at the workspace, not the
+            // (possibly per-agent) launch cwd.
+            workspaceRoot: this.workspaceRoot,
+        };
+    }
     /** The refusal for a launch choice the connector cannot honour. Spawn and resume both ask before
      *  any reserve or mint, so a rule changed here holds on both paths. */
     capabilityRefusal(connector, launch) {
@@ -4668,6 +4699,18 @@ export class Manager {
             return `${connector.name} connector does not support exact session continuity (continuity: exact)`;
         return undefined;
     }
+    /** The refusal for an event-plane choice the registration policy or the connector cannot meet.
+     *  Spawn and resume both ask before a seat's launch is built, so a seat retained without the
+     *  plane cannot come back on a space that now requires it. An absent choice arms the plane. */
+    eventsRefusal(connector, events) {
+        if (this.eventsRequired && events === false)
+            return `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed`;
+        if (events !== false && !connector.eventChannel)
+            return this.eventsRequired
+                ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
+                : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one`;
+        return undefined;
+    }
     /** Return connector-provided model catalogs for selector UIs. Optional by connector: a host with no
      *  local model-list API reports `supported:false` rather than blocking the manager. A connector that
      *  fails to import shows an `error:` row (from manifest enumeration) and never blocks the others. */
@@ -5172,13 +5215,10 @@ export class Manager {
         // the principal's owner is resolved further down, so deriving it from anything in scope here
         // would mean guessing at the identity the child will actually connect as. It is added at the
         // accept seam below, where the allocated triple exists.
-        if (this.eventsRequired && opts.events === false)
-            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
+        const eventsRefused = this.eventsRefusal(connector, opts.events);
+        if (eventsRefused)
+            return { ok: false, error: eventsRefused };
         const events = this.eventsRequired || opts.events !== false;
-        if (events && !connector.eventChannel)
-            return { ok: false, error: this.eventsRequired
-                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
-                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
         // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
         // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
         // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
@@ -5416,15 +5456,6 @@ export class Manager {
                 await materializeSecretToFile(secrets, agentSecretKeyForFile(credsPath, this.space), credsPath);
                 provisioned = { id: identity.id, name, lifecycleUid, secretPaths: { creds: credsPath }, ...(custody ? { runtime: custody } : {}) }; // footprint now exists — the finally rolls it back if the spawn throws
             }
-            // Personal MCP servers the operator opted to share with manager-spawned agents of this type
-            // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
-            // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
-            const cotalConfig = loadCotalConfig(this.workspaceRoot);
-            const mcpServers = connectorServers(cotalConfig, agent, opts.shareTools);
-            // The operator's spawn-env policy travels the same route: absent means no extras (the OS
-            // allow-list + operator knobs + connector-declared inputs), present means those names too.
-            // A connector never reads the config itself.
-            const envAllow = spawnEnvAllow(cotalConfig);
             // Per-agent cwd overrides the manager's shared workspace root, so agents can be rooted at
             // arbitrary folders/repos. A relative path resolves against the workspace root; omitted → the
             // agent shares the workspace root (the prior, unchanged behavior).
@@ -5437,7 +5468,7 @@ export class Manager {
                 : undefined;
             const manifestSha256 = manifestPath ? this.fileDigest(manifestPath) : undefined;
             const launchOpts = {
-                space: this.space,
+                ...this.hostLaunchFields(agent, opts.shareTools, harness),
                 name,
                 role,
                 // User mode: the principal IS the identity (the endpoint derives card.id from owner+actor);
@@ -5450,7 +5481,6 @@ export class Manager {
                 // at the broker, never silently).
                 lifecycleUid,
                 acceptedToken: issued?.acceptedToken,
-                servers: this.servers,
                 configPath,
                 model,
                 variant,
@@ -5472,13 +5502,6 @@ export class Manager {
                 allowPublish,
                 capabilities,
                 events,
-                eventsRequired: this.eventsRequired,
-                mcpServers,
-                envAllow,
-                resolvedBinaries: harness.binaries,
-                // So a connector that keeps per-agent local state can root it at the workspace, not the
-                // (possibly per-agent) launch cwd.
-                workspaceRoot: this.workspaceRoot,
                 cwd,
             };
             // A delegated seat gets no local launch at all: no launch-material file, control token or
@@ -6150,6 +6173,9 @@ export class Manager {
             const unsupported = this.capabilityRefusal(connector, { variant: entry.launch.variant, prompt: entry.launch.prompt, exact });
             if (unsupported)
                 return { ok: false, error: unsupported };
+            const eventsRefused = this.eventsRefusal(connector, entry.launch.events);
+            if (eventsRefused)
+                return { ok: false, error: eventsRefused };
             let authority;
             try {
                 authority = await this.validateRetainedAuthority(entry);
@@ -6158,11 +6184,8 @@ export class Manager {
                 return { ok: false, error: rejectionText(e) };
             }
             try {
-                const resumeConfig = loadCotalConfig(this.workspaceRoot);
-                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, entry.launch.shareTools);
-                const envAllow = spawnEnvAllow(resumeConfig);
                 const launchOpts = {
-                    space: this.space,
+                    ...this.hostLaunchFields(entry.launch.connector, entry.launch.shareTools, harness),
                     name: entry.name,
                     role: entry.role,
                     id: authority.id,
@@ -6176,7 +6199,6 @@ export class Manager {
                     lifecycleUid: entry.identity.lifecycleUid,
                     backfillFloor: entry.backfillFloor,
                     acceptedToken: entry.identity.mode === "static" ? entry.identity.issued?.acceptedToken : undefined,
-                    servers: this.servers,
                     configPath: entry.launch.source.configPath,
                     model: entry.launch.model,
                     variant: entry.launch.variant,
@@ -6189,10 +6211,6 @@ export class Manager {
                     allowPublish: entry.launch.allowPublish,
                     capabilities: entry.launch.capabilities,
                     events: entry.launch.events,
-                    mcpServers,
-                    envAllow,
-                    resolvedBinaries: harness.binaries,
-                    workspaceRoot: this.workspaceRoot,
                     cwd: entry.launch.cwd,
                 };
                 const spec = connector.buildLaunch(launchOpts);
@@ -7685,7 +7703,7 @@ export class Manager {
             // at a time), so all are reconciled. The `iid` field is the hook item-3's multi-instance sweep
             // filters on (skip a goal whose accepting `iid` is a still-LIVE sibling — never settle its goal).
             for (const entry of entries) {
-                if (this.goalAcceptances.has(entry.ref.goalId) || this.turnAcceptances.has(entry.ref.goalId))
+                if (this.goalAcceptances.has(entry.ref.goalId) || this.turnAcceptances.has(turnKey(entry.ref)))
                     continue; // never settle a goal THIS incarnation drives
                 try {
                     // A note marks a TURN entry: its relay is rebuilt (the hold is its bounded ending), never
@@ -8072,14 +8090,17 @@ export class Manager {
         const goalId = ctx.request.id;
         const { fingerprint } = submissionFingerprint(ctx.request, ctx.subject);
         const ref = goalRefOf(ctx.subject, goalId);
+        const key = turnKey(ref);
         const executor = { lifecycleUid: this.managerInstanceId, epoch: this.serviceServe?.grant.epoch ?? 0 };
         const acceptedAt = Date.now();
-        const prior = this.turnAcceptances.get(goalId)?.acceptance;
+        const prior = this.turnAcceptances.get(key)?.acceptance;
         if (prior !== undefined) {
             if (prior.fingerprint !== fingerprint)
                 throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted under a different submission; one goalId never carries two specs (SPEC 13.6)`);
             return prior;
         }
+        // Refused here, before anything durable, so the caller's goal id stays free for another seat.
+        this.assertSeatTurnFree(a, t, goalId);
         const raw = (ctx.request.args ?? {});
         const payload = String(raw.payload);
         const deadlineAt = raw.deadlineAt === undefined ? acceptedAt + Number(raw.deadlineMs) : Number(raw.deadlineAt);
@@ -8087,7 +8108,8 @@ export class Manager {
             throw new EpEnvelopeError("deadline-exceeded", `goal "${goalId}" names a deadline already past (${new Date(deadlineAt).toISOString()}); a turn with no time left to serve it is never accepted (SPEC 13.6)`);
         const deadlineMs = deadlineAt - acceptedAt;
         const handoffFrom = raw.handoffFrom === undefined ? undefined : String(raw.handoffFrom);
-        const note = JSON.stringify({ payload, deadlineAt, holdEpoch: executor.epoch, owner: t.owner, ...(handoffFrom !== undefined ? { handoffFrom } : {}) });
+        const holdToken = turnHoldToken(key);
+        const note = JSON.stringify({ payload, deadlineAt, holdEpoch: executor.epoch, owner: t.owner, holdToken, ...(handoffFrom !== undefined ? { handoffFrom } : {}) });
         // A goal that already ENDED is never accepted again, whatever the retry carries: the bind is
         // create-only and outlives an unwind (the failed terminal, the cleared index), so a retry of an
         // unwound accept would otherwise re-record an index entry over a tombstone and, before that
@@ -8137,7 +8159,7 @@ export class Manager {
             // none. Measured on an auth mesh: minted over the goal-writer, the schedule publish was
             // broker-denied and every accept unwound.
             await mintCheckpoint(gw.ctx.kv, jetstream(serve.nc), this.space, {
-                ref: { endpoint: ref.endpoint, token: turnHoldToken(goalId) },
+                ref: { endpoint: ref.endpoint, token: holdToken },
                 instanceId: this.managerInstanceId,
                 epoch: executor.epoch,
                 goal: { caller: { owner: ctx.subject.caller.owner, actor: ctx.subject.caller.actor, uid: ctx.subject.caller.uid }, goalId },
@@ -8145,6 +8167,9 @@ export class Manager {
                 deadline: deadlineAt,
                 now: acceptedAt,
             });
+            // Again after the awaits, with no await before the maps are written: another caller's
+            // accept of this id to this seat may have finished meanwhile, and this unwinds the loser.
+            this.assertSeatTurnFree(a, t, goalId);
         }
         catch (e) {
             // The accept is inline (no launch closure to fail later), so a post-bind throw unwinds HERE:
@@ -8174,13 +8199,13 @@ export class Manager {
             ref, goalId,
             seat: { name: a.name, owner: t.owner, actor: t.actor, uid: t.lifecycleUid },
             payload, acceptedAt, deadlineAt,
-            holdToken: turnHoldToken(goalId), holdEpoch: executor.epoch,
+            holdToken, holdEpoch: executor.epoch,
             ...(handoffFrom !== undefined ? { handoffFrom } : {}),
         };
-        this.pendingTurns.set(goalId, pending);
+        this.pendingTurns.set(key, pending);
         this.ensureTurnSweep();
         const acceptance = { name: a.name, owner: t.owner, actor: t.actor, uid: t.lifecycleUid, goalId, fingerprint, deadlineAt, executor };
-        this.turnAcceptances.set(goalId, { acceptance, ref });
+        this.turnAcceptances.set(key, { acceptance, ref });
         this.emitGoalProgress(ref, executor.epoch, { phase: "relayed" });
         return acceptance;
     }
@@ -8209,6 +8234,21 @@ export class Manager {
             .map((p) => ({ goalId: p.goalId, payload: p.payload, acceptedAt: p.acceptedAt, deadlineAt: p.deadlineAt }));
         return { turns };
     }
+    /** A seat names a turn by goal id alone when it yields, so one incarnation holding two callers'
+     *  turns under one id could not say which of the two it answered. */
+    assertSeatTurnFree(a, t, goalId) {
+        if (this.seatTurnKey({ owner: t.owner, actor: t.actor, uid: t.lifecycleUid }, goalId) !== undefined)
+            throw new EpEnvelopeError("failed-precondition", `seat "${a.name}" already holds another caller's turn "${goalId}"; a seat yields by goal id, so it is never handed two turns under one (SPEC 13.6)`);
+    }
+    /** The relay key of the turn addressed to seat incarnation `c` under `goalId`, pending or kept
+     *  for a retried yield. The accept path never hands one incarnation two turns under one goal
+     *  id, so at most one matches. */
+    seatTurnKey(c, goalId) {
+        for (const [key, { acceptance: a }] of this.turnAcceptances)
+            if (a.goalId === goalId && a.owner === c.owner && a.actor === c.actor && a.uid === c.uid)
+                return key;
+        return undefined;
+    }
     /** The seat's yield: claim the hold (one-use; expiry fails closed), then commit the goal
      *  `succeeded` carrying the TurnResult. A yield AFTER the deadline drives the deadline terminal
      *  instead and refuses — the expiry outcome stands, never a late success over it. */
@@ -8227,17 +8267,17 @@ export class Manager {
         const yieldNote = raw.note === undefined ? undefined : String(raw.note);
         if (status === "handoff" && (to === undefined || to.length === 0))
             throw new EpEnvelopeError("failed-precondition", `a handoff yield names its addressee ("to"); a handoff to nobody relays nothing`);
-        const p = this.pendingTurns.get(goalId);
+        const key = this.seatTurnKey(c, goalId);
+        if (key === undefined)
+            throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
+        const p = this.pendingTurns.get(key);
         if (!p) {
             // A YIELD WHOSE REPLY WAS LOST IS NOT A YIELD THAT FAILED. The commit deleted the pending
             // turn, so a retry found nothing and heard `not-found` — which a seat reads as "drop it",
             // reporting failure for work the run already has. The answer the first reply carried is
             // served again instead, to the addressee it was addressed to and nobody else.
-            const settled = this.turnAcceptances.get(goalId);
+            const settled = this.turnAcceptances.get(key);
             if (settled !== undefined) {
-                const a = settled.acceptance;
-                if (a.owner !== c.owner || a.actor !== c.actor || a.uid !== c.uid)
-                    throw new EpEnvelopeError("permission-denied", `turn "${goalId}" was addressed to ${a.owner}.${a.actor}/${a.uid}; a yield is the addressee's own (SPEC 13.6)`);
                 if (settled.settled !== undefined)
                     return { goalId, state: settled.settled.state };
                 // The in-memory answer is not yet remembered (pending deleted before the terminal CAS,
@@ -8246,15 +8286,13 @@ export class Manager {
                 if (settled.ref !== undefined) {
                     const ended = await readGoalResult(gw.ctx, settled.ref);
                     if (ended !== undefined) {
-                        this.rememberSettledTurn(goalId, ended.state, ended.ts);
+                        this.rememberSettledTurn(key, ended.state, ended.ts);
                         return { goalId, state: ended.state };
                     }
                 }
             }
             throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
         }
-        if (p.seat.owner !== c.owner || p.seat.actor !== c.actor || p.seat.uid !== c.uid)
-            throw new EpEnvelopeError("permission-denied", `turn "${goalId}" is addressed to ${p.seat.owner}.${p.seat.actor}/${p.seat.uid}; a yield is the addressee's own (SPEC 13.6)`);
         const cpRef = { endpoint: p.ref.endpoint, token: p.holdToken };
         try {
             await resumeCheckpoint(gw.ctx.kv, gw.ctx.js, gw.ctx.jsm, this.space, { ref: cpRef, presenter: { id: MANAGER_ENDPOINT, lifecycleUid: this.managerInstanceId }, now: Date.now() });
@@ -8286,9 +8324,9 @@ export class Manager {
         });
         this.emitGoalProgress(p.ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
         await clearGoalIndex(gw.ctx, p.ref);
-        this.pendingTurns.delete(goalId);
-        this.markTurnLatchDropped(goalId, at);
-        this.rememberSettledTurn(goalId, fact.state, at);
+        this.pendingTurns.delete(key);
+        this.markTurnLatchDropped(key, at);
+        this.rememberSettledTurn(key, fact.state, at);
         this.maybeStopTurnSweep();
         return { goalId, state: fact.state };
     }
@@ -8311,15 +8349,15 @@ export class Manager {
         const raw = (ctx.request.args ?? {});
         const goalId = String(raw.goalId);
         const ref = goalRefOf(ctx.subject, goalId);
-        const p = this.pendingTurns.get(goalId);
-        const c = p?.ref.caller;
-        if (p === undefined || c?.owner !== ref.caller.owner || c.actor !== ref.caller.actor || c.uid !== ref.caller.uid) {
+        const key = turnKey(ref);
+        const p = this.pendingTurns.get(key);
+        if (p === undefined) {
             const ended = await readGoalResult(gw.ctx, ref);
             if (ended !== undefined)
                 throw goalAlreadyTerminal(goalId, ended);
             throw new EpEnvelopeError("failed-precondition", `no turn "${goalId}" of this caller is pending on this manager; cancel withdraws a relayed turn (SPEC 13.6)`);
         }
-        this.pendingTurns.delete(goalId);
+        this.pendingTurns.delete(key);
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         let fact;
         try {
@@ -8332,14 +8370,14 @@ export class Manager {
             // a yield that has dropped the entry remembered its answer, and one still committing drops
             // the entry it finds. An ended relay is stamped so its acceptance still ages off.
             if ((await readGoalResult(gw.ctx, ref)) !== undefined)
-                this.markTurnLatchDropped(goalId);
-            else if (this.turnAcceptances.get(goalId)?.settled === undefined)
-                this.pendingTurns.set(goalId, p);
+                this.markTurnLatchDropped(key);
+            else if (this.turnAcceptances.get(key)?.settled === undefined)
+                this.pendingTurns.set(key, p);
             throw e;
         }
         this.emitGoalProgress(ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
-        this.markTurnLatchDropped(goalId);
-        this.rememberSettledTurn(goalId, fact.state, Date.now());
+        this.markTurnLatchDropped(key);
+        this.rememberSettledTurn(key, fact.state, Date.now());
         await clearGoalIndex(gw.ctx, ref);
         this.maybeStopTurnSweep();
         return { goalId, state: fact.state };
@@ -8352,9 +8390,10 @@ export class Manager {
         const gw = this.goalWriter;
         if (!gw)
             return;
-        if (!this.pendingTurns.delete(p.goalId))
+        const key = turnKey(p.ref);
+        if (!this.pendingTurns.delete(key))
             return;
-        this.markTurnLatchDropped(p.goalId);
+        this.markTurnLatchDropped(key);
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         try {
             await this.assertGoalWriterEpochCurrent(epoch);
@@ -8364,7 +8403,7 @@ export class Manager {
             // (the delete at the top of this function) and after this CAS has to name this terminal.
             // Clearing first, then remembering, left a window where maybeStopTurnSweep saw no pending
             // turn and no settled answer, wiped the acceptance, and rememberSettledTurn no-op'd.
-            this.rememberSettledTurn(p.goalId, fact.state, Date.now());
+            this.rememberSettledTurn(key, fact.state, Date.now());
             await clearGoalIndex(gw.ctx, p.ref);
         }
         catch (e) {
@@ -8406,16 +8445,16 @@ export class Manager {
     }
     /** The answer a retried yield is served, held for {@link TURN_ANSWER_RETENTION_MS}. Only for a
      *  turn this incarnation accepted: an entry it has no acceptance for is one it cannot vouch for. */
-    rememberSettledTurn(goalId, state, at) {
-        const entry = this.turnAcceptances.get(goalId);
+    rememberSettledTurn(key, state, at) {
+        const entry = this.turnAcceptances.get(key);
         if (entry === undefined)
             return;
         entry.settled = { state, at };
     }
     /** Stamp when the pending latch dropped, so an unsettled leftover ages off that instant rather
      *  than the original deadline. Idempotent: the first drop is the one the retry window starts at. */
-    markTurnLatchDropped(goalId, at = Date.now()) {
-        const entry = this.turnAcceptances.get(goalId);
+    markTurnLatchDropped(key, at = Date.now()) {
+        const entry = this.turnAcceptances.get(key);
         if (entry === undefined || entry.leftoverSince !== undefined)
             return;
         entry.leftoverSince = at;
@@ -8449,13 +8488,13 @@ export class Manager {
         // An UNSETTLED acceptance whose pending latch is already gone is the in-flight (or failed)
         // deadline commit: keep it for the same window so a late yield can still read the durable
         // terminal, then drop it so a commit that never remembered cannot pin the sweep forever.
-        for (const [goalId, e] of [...this.turnAcceptances.entries()]) {
-            if (this.pendingTurns.has(goalId))
+        for (const [key, e] of [...this.turnAcceptances.entries()]) {
+            if (this.pendingTurns.has(key))
                 continue;
             // Unsettled leftovers age off the latch-drop stamp, never `deadlineAt`.
             const at = e.settled?.at ?? e.leftoverSince;
             if (at !== undefined && now - at >= TURN_ANSWER_RETENTION_MS)
-                this.turnAcceptances.delete(goalId);
+                this.turnAcceptances.delete(key);
         }
         // The prune above is the one event after which the sweep may have nothing left to do, and
         // the settle-time callers cannot see it: they run when an answer has just been remembered.
@@ -8515,7 +8554,7 @@ export class Manager {
             payload: parsed.payload,
             acceptedAt: spec.value.acceptedAt,
             deadlineAt: parsed.deadlineAt,
-            holdToken: turnHoldToken(entry.ref.goalId), holdEpoch: parsed.holdEpoch,
+            holdToken: parsed.holdToken ?? turnHoldToken(entry.ref.goalId), holdEpoch: parsed.holdEpoch,
             ...(parsed.handoffFrom !== undefined ? { handoffFrom: parsed.handoffFrom } : {}),
         };
         // The hold is the relay's bounded ending, minted AFTER the index entry and the goal record,
@@ -8525,13 +8564,14 @@ export class Manager {
             console.error(`turn reconcile ${p.goalId}: its deadline hold was never minted (the accept crashed before it); left unsettled`);
             return;
         }
-        this.pendingTurns.set(p.goalId, p);
+        const key = turnKey(p.ref);
+        this.pendingTurns.set(key, p);
         // THE ACCEPTANCE TOO, or the adopted turn's answer is never remembered: `rememberSettledTurn`
         // writes only against an acceptance this incarnation holds, and adoption rebuilt the pending
         // relay without one, so a yield whose reply was lost after a restart still heard `not-found`
         // on the very path adoption exists for. The acceptance is rebuilt from the same records the
         // relay was: the spec holds the fingerprint, the index holds the seat, the note the deadline.
-        this.turnAcceptances.set(p.goalId, {
+        this.turnAcceptances.set(key, {
             acceptance: {
                 name: p.seat.name, owner: p.seat.owner, actor: p.seat.actor, uid: p.seat.uid, goalId: p.goalId,
                 fingerprint: spec.value.fingerprint, deadlineAt: p.deadlineAt,