@cotal-ai/manager 0.77.0 → 0.78.0

package/dist/manager.js

@@ -6,7 +6,7 @@ import { isAbsolute, join, dirname, resolve } from "node:path";
 import Headless from "@xterm/headless";
 import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, DeprovisionError, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, openIssuedStore, acceptedBucket, issuedBucket, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, } from "@cotal-ai/core";
 import { agentAuthState, agentCredsDir, agentLifecycleSecretFilePaths, agentSecretFilePaths, agentSecretKeyForFile, authDir, claimIdentityRecord, claimManagerSiblingIdentities, connectorInstallHint, DELIVERY_CREDS_KIND, extensionConnectors, findCotalRoot, getSpaceAuth, hasUserAuthState, loadExtensionsManifest, loadManagerInstanceIdentity, loadMeshes, localTrustOfSpace, manifestExtensionNames, materializeFromManifest, materializeSecretToFile, MEMBERSHIP_RW_CREDS_KIND, mergeLaunchOptions, remintDaemonCreds, resolveAgentType, resolveOnPath, createManagerInstanceIdentity, spaceKey, spaceMaterialKey, SYSTEM_CREDS_FILES, userAuthStateDir, workspaceSecretStore, writeRenewalRecord } from "@cotal-ai/workspace";
-import { createRuntime, isCustodialRuntime, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, watchProvedExit, } from "./runtime/index.js";
+import { createRuntime, exitProof, isCustodialRuntime, pollProvedExit, requireRuntimeAdopt, requireRuntimeReap, RuntimeReapUnproven, watchProvedExit, } from "./runtime/index.js";
 import { AttachEndpoint } from "./attach-endpoint.js";
 import { DELIVERY_ADMIN_BOOT_WAIT_MS, isUnansweredDeliveryAdmin, makeManagerEndpointEvictionEvidence, makeManagerEndpointHolderEvictor, untilDeliveryAdminAnswers, withScopedEndpoint } from "./endpoint-evict.js";
 import { makeManagerHolderLivenessProbe } from "./holder-liveness.js";
@@ -54,6 +54,10 @@ const TURN_ANSWER_RETENTION_MS = 5 * 60_000;
  *  launch-parity smoke can assert every launch client's request timeout OUTLIVES this window — the tier
  *  rule forbids the clients importing it directly. */
 export const READINESS_TIMEOUT_MS = 30_000;
+/** How often the readiness race asks a runtime that streams no exit whether its child has exited, and
+ *  how long it waits past the window for the proof of its last read. An operator waits on this reply,
+ *  so it asks more often than the exit watch that outlives readiness. */
+const READINESS_EXIT_POLL_MS = 1_000;
 /** Managed same-session crash recovery follows the Codex host precedent: three restarts are allowed
  * inside a rolling two-minute window; the fourth crash is a loop and retires the seat loud. */
 const SESSION_RESTART_LIMIT = 3;
@@ -245,14 +249,22 @@ function parseTurnNote(raw) {
     if (typeof n.payload !== "string" || typeof n.deadlineAt !== "number"
         || typeof n.holdEpoch !== "number" || typeof n.owner !== "string")
         return undefined;
+    if (n.holdToken !== undefined && typeof n.holdToken !== "string")
+        return undefined;
     if (n.handoffFrom !== undefined && typeof n.handoffFrom !== "string")
         return undefined;
-    return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, owner: n.owner, ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
+    return { payload: n.payload, deadlineAt: n.deadlineAt, holdEpoch: n.holdEpoch, owner: n.owner, ...(typeof n.holdToken === "string" ? { holdToken: n.holdToken } : {}), ...(typeof n.handoffFrom === "string" ? { handoffFrom: n.handoffFrom } : {}) };
+}
+/** A turn relay's key in the manager's maps: the caller triple and goal id the goal plane stores
+ *  the turn under, because a goal id is the caller's own (SPEC 13.6 item 1) and two callers may
+ *  pick the same one. Every part is a subject token, so the dotted join is unambiguous. */
+function turnKey(ref) {
+    return `${ref.caller.owner}.${ref.caller.actor}.${ref.caller.uid}.${ref.goalId}`;
 }
-/** A turn hold's token, DERIVED from the goal id (same recipe as the runtime's pause tokens): a
- *  same-goalId retry or a successor incarnation re-derives the identical token with no lookup. */
-function turnHoldToken(goalId) {
-    return createHash("sha256").update(`${goalId}:turn-deadline`, "utf8").digest("base64url").slice(0, 43);
+/** A turn hold's token, DERIVED (same recipe as the runtime's pause tokens) from the relay key, so
+ *  two callers' turns under one goal id never share a hold. */
+function turnHoldToken(key) {
+    return createHash("sha256").update(`${key}:turn-deadline`, "utf8").digest("base64url").slice(0, 43);
 }
 /**
  * Event channels in `channels` that do NOT belong to `{owner, actor}`.
@@ -466,9 +478,9 @@ export class Manager {
      *  drives the cancel path (transition -> cancel terminal). Cleared when the goal terminalizes. */
     agentGoals = new Map();
     /**
-     * The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin): a
-     * same-goalId retry serves the identical acceptance; cross-incarnation retries rebuild from
-     * the goal-index entry (its acceptance floor + note).
+     * The turn relay's same-incarnation idempotency map ({@link goalAcceptances}'s twin), by
+     * {@link turnKey}: a same-goal retry serves the identical acceptance; cross-incarnation retries
+     * rebuild from the goal-index entry (its acceptance floor + note).
      *
      * One entry per turn this incarnation accepted: the acceptance a duplicate submission is served
      * from, and — once the turn settles — the answer a RETRIED yield is served from.
@@ -489,7 +501,7 @@ export class Manager {
      * window would hear `not-found` again.
      */
     turnAcceptances = new Map();
-    /** Every relayed turn awaiting its seat's yield, by goal id. The seat's `turn-pending` pull
+    /** Every relayed turn awaiting its seat's yield, by {@link turnKey}. The seat's `turn-pending` pull
      *  scans it; the deadline sweep drives expiry; a seat reap stamps its entries `seatDiedAt`, which
      *  the deadline terminal carries as `agentDownAt` so the run reads that death as L4002.
      *  Rebuilt at boot from goal-index entries carrying a turn note. */
@@ -2802,11 +2814,11 @@ export class Manager {
      *  ({@link epAdminReach}, the same fresh-read authority `psOwnerFilter` consults). The
      *  `manager.admin` family (purge + the resume/preservation ops) is capability-gated at mint AND
      *  re-checked at serve time via {@link epAdminReach} (the `adminGated` wrapper) so a user's
-     *  revoked scope demotes the next call. `launch` is OWNER-EQUALITY on this door for everyone
-     *  (freelance HIGH #2): the deploy path is its only consumer and stamps the caller's own owner,
+     *  revoked scope demotes the next call. `launch` is OWNER-EQUALITY on this door for everyone:
+     *  the deploy path is its only consumer and stamps the caller's own owner,
      *  so cross-owner launch was a ctl-tier incidental never exercised, and keying it on the actor's
      *  ledger scope broke the deployer-view attenuation - uniform owner-equality is the safe tier.
-     *  TWO DELIBERATE NARROWINGS vs the ctl doors (NOT bit-exact parity, panel-accepted): (1)
+     *  TWO DELIBERATE NARROWINGS vs the ctl doors (NOT bit-exact parity): (1)
      *  `define-persona` is `admin=false` for everyone (own-persona discipline; no ep consumer needs
      *  cross-owner persona writes - an operator redefines via config, not the wire), where the ctl
      *  admin tier allowed operator cross-owner redefine; (2) launch is owner-equality-only, above.
@@ -2992,7 +3004,7 @@ export class Manager {
                 return r.data;
             }),
             purge: (ctx) => this.serveGated(ctx, () => adminGated(ctx, async () => unwrap(await this.opPurge(args(ctx), callerOf(ctx))))),
-            // launch is OWNER-EQUALITY on the ep door for every caller (freelance HIGH #2): the deploy
+            // launch is OWNER-EQUALITY on the ep door for every caller: the deploy
             // path is the only launch consumer and its spec stamps the CALLER's own owner, so
             // owner-equality always holds for a legitimate deploy; cross-owner launch was a ctl
             // admin-tier INCIDENTAL never exercised by a real flow (static is single-owner, so the flag
@@ -3000,7 +3012,7 @@ export class Manager {
             // NOT reflect the deployer VIEW's privileged-tier attenuation - an admin user's stolen
             // deployer bearer would then bypass owner-equality (operator launch) despite the view holding
             // no admin rows. Uniform owner-equality removes that divergence in the least-privilege
-            // direction (consistent with the delta-(b) tier narrowing the panel endorsed).
+            // direction.
             // P2 item 2 (ruling 3): manifest `launch` is an ACTION through the SAME chokepoint as spawn -
             // the manifest resolve + owner-equality authz run in opLaunch's accept path, then the goal
             // drives progress + terminal. The acceptance floor is the allocated identity + goal coords.
@@ -4657,6 +4669,29 @@ export class Manager {
         const { reason } = resolveHarness(connector.name, connector.requires ?? []);
         return reason ? { refusal: reason } : {};
     }
+    /** The launch fields the host supplies rather than the seat. Spawn and resume both take them from
+     *  here, so a resumed seat launches under the same host policy, `eventsRequired` included, as the
+     *  same seat spawned fresh. */
+    hostLaunchFields(agent, shareTools, harness) {
+        const cotalConfig = loadCotalConfig(this.workspaceRoot);
+        return {
+            space: this.space,
+            servers: this.servers,
+            // Personal MCP servers the operator opted to share with manager-spawned agents of this type
+            // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
+            // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
+            mcpServers: connectorServers(cotalConfig, agent, shareTools),
+            // The operator's spawn-env policy travels the same route: absent means no extras (the OS
+            // allow-list + operator knobs + connector-declared inputs), present means those names too.
+            // A connector never reads the config itself.
+            envAllow: spawnEnvAllow(cotalConfig),
+            resolvedBinaries: harness.binaries,
+            eventsRequired: this.eventsRequired,
+            // So a connector that keeps per-agent local state can root it at the workspace, not the
+            // (possibly per-agent) launch cwd.
+            workspaceRoot: this.workspaceRoot,
+        };
+    }
     /** The refusal for a launch choice the connector cannot honour. Spawn and resume both ask before
      *  any reserve or mint, so a rule changed here holds on both paths. */
     capabilityRefusal(connector, launch) {
@@ -4668,6 +4703,18 @@ export class Manager {
             return `${connector.name} connector does not support exact session continuity (continuity: exact)`;
         return undefined;
     }
+    /** The refusal for an event-plane choice the registration policy or the connector cannot meet.
+     *  Spawn and resume both ask before a seat's launch is built, so a seat retained without the
+     *  plane cannot come back on a space that now requires it. An absent choice arms the plane. */
+    eventsRefusal(connector, events) {
+        if (this.eventsRequired && events === false)
+            return `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed`;
+        if (events !== false && !connector.eventChannel)
+            return this.eventsRequired
+                ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
+                : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one`;
+        return undefined;
+    }
     /** Return connector-provided model catalogs for selector UIs. Optional by connector: a host with no
      *  local model-list API reports `supported:false` rather than blocking the manager. A connector that
      *  fails to import shows an `error:` row (from manifest enumeration) and never blocks the others. */
@@ -5172,24 +5219,11 @@ export class Manager {
         // the principal's owner is resolved further down, so deriving it from anything in scope here
         // would mean guessing at the identity the child will actually connect as. It is added at the
         // accept seam below, where the allocated triple exists.
-        if (this.eventsRequired && opts.events === false)
-            return { ok: false, error: `space "${this.space}" requires the event plane by registration policy; --no-events (events: false on the start op) is not allowed` };
+        const eventsRefused = this.eventsRefusal(connector, opts.events);
+        if (eventsRefused)
+            return { ok: false, error: eventsRefused };
         const events = this.eventsRequired || opts.events !== false;
-        if (events && !connector.eventChannel)
-            return { ok: false, error: this.eventsRequired
-                    ? `space "${this.space}" requires the event plane by registration policy, but connector "${connector.name}" does not publish one`
-                    : `connector "${connector.name}" does not publish an AG-UI event plane; pass --no-events (events: false on the start op) to launch it without one` };
-        // F2 (Unit B): a STATIC managed spawn REFUSES endpoint capabilities, fail-closed IN CODE (not
-        // a doc note): the static terminal has no obligation-drain/frontier steps yet, so an accepted-
-        // but-uncompleted endpoint obligation could execute AFTER its uid is declared retired. The
-        // refusal sits at spawn-accept, before any provisioning, over the same records a persona or
-        // manifest self-claim would ride in on — capabilities cannot slip past it into the grant path.
-        if (this.auth && !this.userMode) {
-            const claims = [opts, (opts.resolved ?? {})];
-            if (claims.some((c) => c.endpointCapabilities !== undefined))
-                return { ok: false, error: "a static managed spawn refuses endpointCapabilities (Unit B F2): the static lifecycle terminal carries no obligation-drain/frontier steps, so endpoint-rail grants are not containable in static mode" };
-        }
-        // #4 A4 (panel): the roster the allocation consults must reflect the initial presence snapshot,
+        // The roster the allocation consults must reflect the initial presence snapshot,
         // or a spawn immediately after manager boot races an already-live unmanaged peer and re-opens the
         // very collision black-hole this closes. Await the snapshot (bounded internally, fail-safe on an
         // empty mesh) before allocating; the broker/auth remain the authority downstream. Deliberately
@@ -5221,7 +5255,7 @@ export class Manager {
         // exists; cleared when a live slot takes ownership. If it survives to `finally`, the spawn threw
         // AFTER provisioning (buildLaunch / runtime.spawn) — the orphan-rollback tears it down. Carries
         // `userOwner` for a user-mode spawn so that rollback runs the revoke+shred branch, not just the
-        // static durable teardown (the freelance found this window leaking the managed grant + files).
+        // static durable teardown, which would leak the managed grant + files.
         // The RESERVED custody reference rides the rollback object: a spawn that launched the seat and
         // then threw (the activation CAS refuses a slot that is not this spawn's intent) reaches the
         // `finally` with the handle only in a local, so without this the terminal has nothing to reap
@@ -5416,15 +5450,6 @@ export class Manager {
                 await materializeSecretToFile(secrets, agentSecretKeyForFile(credsPath, this.space), credsPath);
                 provisioned = { id: identity.id, name, lifecycleUid, secretPaths: { creds: credsPath }, ...(custody ? { runtime: custody } : {}) }; // footprint now exists — the finally rolls it back if the spawn throws
             }
-            // Personal MCP servers the operator opted to share with manager-spawned agents of this type
-            // (cotal config; default none → isolated, the memory-safe default this guards), narrowed by
-            // an optional --share-tools selection (absent → all declared, the pre-merge behavior).
-            const cotalConfig = loadCotalConfig(this.workspaceRoot);
-            const mcpServers = connectorServers(cotalConfig, agent, opts.shareTools);
-            // The operator's spawn-env policy travels the same route: absent means no extras (the OS
-            // allow-list + operator knobs + connector-declared inputs), present means those names too.
-            // A connector never reads the config itself.
-            const envAllow = spawnEnvAllow(cotalConfig);
             // Per-agent cwd overrides the manager's shared workspace root, so agents can be rooted at
             // arbitrary folders/repos. A relative path resolves against the workspace root; omitted → the
             // agent shares the workspace root (the prior, unchanged behavior).
@@ -5437,7 +5462,7 @@ export class Manager {
                 : undefined;
             const manifestSha256 = manifestPath ? this.fileDigest(manifestPath) : undefined;
             const launchOpts = {
-                space: this.space,
+                ...this.hostLaunchFields(agent, opts.shareTools, harness),
                 name,
                 role,
                 // User mode: the principal IS the identity (the endpoint derives card.id from owner+actor);
@@ -5450,7 +5475,6 @@ export class Manager {
                 // at the broker, never silently).
                 lifecycleUid,
                 acceptedToken: issued?.acceptedToken,
-                servers: this.servers,
                 configPath,
                 model,
                 variant,
@@ -5472,13 +5496,6 @@ export class Manager {
                 allowPublish,
                 capabilities,
                 events,
-                eventsRequired: this.eventsRequired,
-                mcpServers,
-                envAllow,
-                resolvedBinaries: harness.binaries,
-                // So a connector that keeps per-agent local state can root it at the workspace, not the
-                // (possibly per-agent) launch cwd.
-                workspaceRoot: this.workspaceRoot,
                 cwd,
             };
             // A delegated seat gets no local launch at all: no launch-material file, control token or
@@ -6150,6 +6167,9 @@ export class Manager {
             const unsupported = this.capabilityRefusal(connector, { variant: entry.launch.variant, prompt: entry.launch.prompt, exact });
             if (unsupported)
                 return { ok: false, error: unsupported };
+            const eventsRefused = this.eventsRefusal(connector, entry.launch.events);
+            if (eventsRefused)
+                return { ok: false, error: eventsRefused };
             let authority;
             try {
                 authority = await this.validateRetainedAuthority(entry);
@@ -6158,11 +6178,8 @@ export class Manager {
                 return { ok: false, error: rejectionText(e) };
             }
             try {
-                const resumeConfig = loadCotalConfig(this.workspaceRoot);
-                const mcpServers = connectorServers(resumeConfig, entry.launch.connector, entry.launch.shareTools);
-                const envAllow = spawnEnvAllow(resumeConfig);
                 const launchOpts = {
-                    space: this.space,
+                    ...this.hostLaunchFields(entry.launch.connector, entry.launch.shareTools, harness),
                     name: entry.name,
                     role: entry.role,
                     id: authority.id,
@@ -6176,7 +6193,6 @@ export class Manager {
                     lifecycleUid: entry.identity.lifecycleUid,
                     backfillFloor: entry.backfillFloor,
                     acceptedToken: entry.identity.mode === "static" ? entry.identity.issued?.acceptedToken : undefined,
-                    servers: this.servers,
                     configPath: entry.launch.source.configPath,
                     model: entry.launch.model,
                     variant: entry.launch.variant,
@@ -6189,10 +6205,6 @@ export class Manager {
                     allowPublish: entry.launch.allowPublish,
                     capabilities: entry.launch.capabilities,
                     events: entry.launch.events,
-                    mcpServers,
-                    envAllow,
-                    resolvedBinaries: harness.binaries,
-                    workspaceRoot: this.workspaceRoot,
                     cwd: entry.launch.cwd,
                 };
                 const spec = connector.buildLaunch(launchOpts);
@@ -6385,15 +6397,17 @@ export class Manager {
      *  Presence is keyed on the EXACT freshly-minted id, never the name — a fresh id has no prior record, so
      *  any live presence for it is from THIS launch (stale/same-name records can't false-start it). The
      *  `"presence"` event is only a wake; the roster is re-read as the source of truth (subscribe-then-check
-     *  catches a join/exit that landed before we subscribed). Runtimes that stream no exit signal (external surfaces,
-     *  whose `attach()` throws) race presence-vs-backstop only — better than the old "assume up". */
+     *  catches a join/exit that landed before we subscribed). A runtime whose `attach()` throws (an external
+     *  surface) streams no output or exit, so its exit leg polls the runtime's exit proof ({@link pollProvedExit}),
+     *  reads it once more when the window closes, and its failure carries no last output; one that cannot prove an
+     *  exit either races presence-vs-backstop only. */
     async awaitReadiness(a, readinessTimeoutMs, opts = {}) {
         let session;
         try {
             session = a.handle.attach();
         }
         catch {
-            /* external surfaces stream no exit — presence-or-backstop only */
+            /* external surfaces stream no output or exit; their exit is polled below */
         }
         const s = session;
         // Presence cards carry the wire PRINCIPAL dot-form (`<owner>.<actor>`), never a raw nkey — match
@@ -6445,7 +6459,7 @@ export class Manager {
             // the backlog reads async — the process is known dead, that's a failure, not an unknown. Reap through
             // onAgentExit so a child the launcher spawned in the window is reaped too.
             const onExit = () => {
-                if (done || !s)
+                if (done)
                     return;
                 clearTimeout(timer);
                 // `stopHandle` sets `terminalizing` synchronously before it kills, and `onAgentExit` sets it
@@ -6456,7 +6470,8 @@ export class Manager {
                     // waitForExit may close the attach stream before this snapshot
                     let tail = "";
                     try {
-                        tail = await this.tail(s);
+                        if (s)
+                            tail = await this.tail(s);
                     }
                     catch { }
                     if (opts.reapOnExit !== false)
@@ -6494,12 +6509,28 @@ export class Manager {
                     finish({ ok: false, detail: `${a.name} exited on launch${tail ? ` - last output: ${tail}` : ""}${exitDetail}` });
                 })();
             };
-            timer = setTimeout(() => finish({
+            const uncertain = () => finish({
                 ok: false,
                 uncertain: true,
                 detail: `${a.name} (${a.id}): launch status uncertain - no process exit and no mesh presence within ${Math.round(readinessTimeoutMs / 1000)}s; it may still be booting or stuck before connector startup. Inspect with \`cotal attach ${a.name}\` / \`cotal ps\`; do not stop it solely because this bounded wait elapsed.`,
-            }), readinessTimeoutMs);
-            unsubExit = s ? s.onExit(onExit) : () => { };
+            });
+            // The exit poll read the runtime up to a poll ago, and a window can be shorter than a poll, so
+            // the window closes on a fresh read: a child that exited by then is reported as exited. Nothing
+            // bounds how long a runtime's proof takes, so it gets one more poll before the launch is uncertain.
+            timer = setTimeout(() => {
+                const proof = s ? undefined : exitProof(a.handle);
+                if (!proof) {
+                    uncertain();
+                    return;
+                }
+                timer = setTimeout(uncertain, READINESS_EXIT_POLL_MS);
+                proof.then(onExit, uncertain);
+            }, readinessTimeoutMs);
+            // The poll stops once the race is done, so it needs no unsubscribe.
+            if (s)
+                unsubExit = s.onExit(onExit);
+            else
+                pollProvedExit(a.handle, onExit, () => !done, READINESS_EXIT_POLL_MS);
             this.ep.on("presence", onPresence);
             // Subscribe-then-check (TOCTOU): a join or an exit that already landed before we subscribed.
             if (s && a.handle.status() === "exited")
@@ -6820,11 +6851,12 @@ export class Manager {
         const failures = [...this.staticReconcileItems.values()]
             .map(({ owner: _owner, timer: _timer, flight: _flight, retryFlight: _retryFlight, ...item }) => ({ ...item }))
             .sort((a, b) => a.alias.localeCompare(b.alias));
-        const state = failures.some((item) => item.disposition === "retrying") ? "retrying" :
-            failures.some((item) => item.disposition === "retry-scheduled") ? "retry-wait" :
-                failures.some((item) => item.disposition === "refused" || item.disposition === "refused-foreign" || item.disposition === "retry-exhausted") ? "failed" :
-                    this.staticReconcileSweepsInFlight > 0 ? "running" :
-                        failures.some((item) => item.disposition === "recovered") ? "recovered" : "idle";
+        const state = this.staticReconcileLastSweep?.error !== undefined ? "failed" :
+            failures.some((item) => item.disposition === "retrying") ? "retrying" :
+                failures.some((item) => item.disposition === "retry-scheduled") ? "retry-wait" :
+                    failures.some((item) => item.disposition === "refused" || item.disposition === "refused-foreign" || item.disposition === "retry-exhausted") ? "failed" :
+                        this.staticReconcileSweepsInFlight > 0 ? "running" :
+                            failures.some((item) => item.disposition === "recovered") ? "recovered" : "idle";
         return {
             state,
             ...(this.staticReconcileLastSweep ? { lastSweep: { ...this.staticReconcileLastSweep } } : {}),
@@ -7685,7 +7717,7 @@ export class Manager {
             // at a time), so all are reconciled. The `iid` field is the hook item-3's multi-instance sweep
             // filters on (skip a goal whose accepting `iid` is a still-LIVE sibling — never settle its goal).
             for (const entry of entries) {
-                if (this.goalAcceptances.has(entry.ref.goalId) || this.turnAcceptances.has(entry.ref.goalId))
+                if (this.goalAcceptances.has(entry.ref.goalId) || this.turnAcceptances.has(turnKey(entry.ref)))
                     continue; // never settle a goal THIS incarnation drives
                 try {
                     // A note marks a TURN entry: its relay is rebuilt (the hold is its bounded ending), never
@@ -7926,7 +7958,7 @@ export class Manager {
                 // exists that early — the goal spec does not carry it and the terminal does not exist yet.
                 // A same-goalId attempt that loses the bind while the winner is still in flight can then
                 // serve what the winner actually allocated instead of inventing an empty identity.
-                const idx = await recordGoalIndex(gw.ctx, ref, executor.lifecycleUid, { name, actor: agentTriple.actor, uid: agentTriple.uid, readinessDeadlineMs: readinessTimeoutMs });
+                const idx = await recordGoalIndex(gw.ctx, ref, executor.lifecycleUid, { name, owner: agentTriple.owner, actor: agentTriple.actor, uid: agentTriple.uid, readinessDeadlineMs: readinessTimeoutMs });
                 // A create loss is an idempotent retry ONLY for the same incarnation. A FOREIGN iid means a
                 // sibling instance accepted this goalId (the live vector is a client retry over ANYCAST, not
                 // a journal consumer): this attempt provisions nothing and answers with the winner's floor,
@@ -8012,12 +8044,12 @@ export class Manager {
      *  wrote before its own ack). Refuses `unavailable` rather than inventing one — see
      *  {@link cachedSpawnAcceptance} for why an empty identity is never an acceptable answer. */
     async acceptanceFromIndex(entry, ref, goalId, fingerprint, executor) {
-        if (entry.allocated === undefined)
-            throw new EpEnvelopeError("unavailable", `goal "${goalId}" was accepted by instance "${entry.iid}", which persisted no acceptance floor; its allocated identity is not readable from here (SPEC 13.6)`);
+        if (entry.allocated?.owner === undefined)
+            throw new EpEnvelopeError("unavailable", `goal "${goalId}" was accepted by instance "${entry.iid}", which persisted no acceptance floor naming its owner; its allocated identity is not readable from here (SPEC 13.6)`);
         const readinessDeadlineMs = entry.allocated.readinessDeadlineMs ?? (await readGoalSpec(this.goalWriter.ctx, ref))?.value.readinessDeadlineMs;
         if (readinessDeadlineMs === undefined)
             throw new EpEnvelopeError("unavailable", `goal "${goalId}" is accepted but its readiness deadline is not readable; a synchronous follower cannot bound its wait honestly (SPEC 13.6)`);
-        return { name: entry.allocated.name, owner: DEV_OWNER, actor: entry.allocated.actor, uid: entry.allocated.uid, goalId, fingerprint, readinessDeadlineMs, executor };
+        return { name: entry.allocated.name, owner: entry.allocated.owner, actor: entry.allocated.actor, uid: entry.allocated.uid, goalId, fingerprint, readinessDeadlineMs, executor };
     }
     /** Reconstruct a cached acceptance for a same-goalId retry NOT in the live map (a prior incarnation
      *  accepted it, or a concurrent winner whose map write this reader has not yet observed).
@@ -8040,8 +8072,11 @@ export class Manager {
         const d = (result?.data ?? {});
         const spec = await readGoalSpec(this.goalWriter.ctx, ref);
         const readinessDeadlineMs = spec?.value.readinessDeadlineMs;
-        if (typeof d.name === "string" && d.name.length > 0 && typeof d.id === "string" && d.id.length > 0 && typeof d.lifecycleUid === "string" && d.lifecycleUid.length > 0 && readinessDeadlineMs !== undefined)
-            return { name: d.name, owner: DEV_OWNER, actor: d.id, uid: d.lifecycleUid, goalId, fingerprint, readinessDeadlineMs, executor };
+        // The terminal names the agent by its slot id: the `owner.actor` principal in user mode, the
+        // bare nkey under DEV_OWNER on a static mesh.
+        const principal = typeof d.id !== "string" || d.id.length === 0 ? null : this.userMode ? parsePrincipalKey(d.id) : { owner: DEV_OWNER, actor: d.id };
+        if (typeof d.name === "string" && d.name.length > 0 && principal !== null && typeof d.lifecycleUid === "string" && d.lifecycleUid.length > 0 && readinessDeadlineMs !== undefined)
+            return { name: d.name, owner: principal.owner, actor: principal.actor, uid: d.lifecycleUid, goalId, fingerprint, readinessDeadlineMs, executor };
         throw new EpEnvelopeError("unavailable", `goal "${goalId}" is already accepted but its allocated identity is not readable (no acceptance floor, and no terminal carrying one); retry (SPEC 13.6)`);
     }
     // ---- the turn relay (§8 durable actions) ------------------------------------------------------
@@ -8072,14 +8107,17 @@ export class Manager {
         const goalId = ctx.request.id;
         const { fingerprint } = submissionFingerprint(ctx.request, ctx.subject);
         const ref = goalRefOf(ctx.subject, goalId);
+        const key = turnKey(ref);
         const executor = { lifecycleUid: this.managerInstanceId, epoch: this.serviceServe?.grant.epoch ?? 0 };
         const acceptedAt = Date.now();
-        const prior = this.turnAcceptances.get(goalId)?.acceptance;
+        const prior = this.turnAcceptances.get(key)?.acceptance;
         if (prior !== undefined) {
             if (prior.fingerprint !== fingerprint)
                 throw new EpEnvelopeError("failed-precondition", `goal "${goalId}" was accepted under a different submission; one goalId never carries two specs (SPEC 13.6)`);
             return prior;
         }
+        // Refused here, before anything durable, so the caller's goal id stays free for another seat.
+        this.assertSeatTurnFree(a, t, goalId);
         const raw = (ctx.request.args ?? {});
         const payload = String(raw.payload);
         const deadlineAt = raw.deadlineAt === undefined ? acceptedAt + Number(raw.deadlineMs) : Number(raw.deadlineAt);
@@ -8087,7 +8125,8 @@ export class Manager {
             throw new EpEnvelopeError("deadline-exceeded", `goal "${goalId}" names a deadline already past (${new Date(deadlineAt).toISOString()}); a turn with no time left to serve it is never accepted (SPEC 13.6)`);
         const deadlineMs = deadlineAt - acceptedAt;
         const handoffFrom = raw.handoffFrom === undefined ? undefined : String(raw.handoffFrom);
-        const note = JSON.stringify({ payload, deadlineAt, holdEpoch: executor.epoch, owner: t.owner, ...(handoffFrom !== undefined ? { handoffFrom } : {}) });
+        const holdToken = turnHoldToken(key);
+        const note = JSON.stringify({ payload, deadlineAt, holdEpoch: executor.epoch, owner: t.owner, holdToken, ...(handoffFrom !== undefined ? { handoffFrom } : {}) });
         // A goal that already ENDED is never accepted again, whatever the retry carries: the bind is
         // create-only and outlives an unwind (the failed terminal, the cleared index), so a retry of an
         // unwound accept would otherwise re-record an index entry over a tombstone and, before that
@@ -8137,7 +8176,7 @@ export class Manager {
             // none. Measured on an auth mesh: minted over the goal-writer, the schedule publish was
             // broker-denied and every accept unwound.
             await mintCheckpoint(gw.ctx.kv, jetstream(serve.nc), this.space, {
-                ref: { endpoint: ref.endpoint, token: turnHoldToken(goalId) },
+                ref: { endpoint: ref.endpoint, token: holdToken },
                 instanceId: this.managerInstanceId,
                 epoch: executor.epoch,
                 goal: { caller: { owner: ctx.subject.caller.owner, actor: ctx.subject.caller.actor, uid: ctx.subject.caller.uid }, goalId },
@@ -8145,6 +8184,9 @@ export class Manager {
                 deadline: deadlineAt,
                 now: acceptedAt,
             });
+            // Again after the awaits, with no await before the maps are written: another caller's
+            // accept of this id to this seat may have finished meanwhile, and this unwinds the loser.
+            this.assertSeatTurnFree(a, t, goalId);
         }
         catch (e) {
             // The accept is inline (no launch closure to fail later), so a post-bind throw unwinds HERE:
@@ -8174,13 +8216,13 @@ export class Manager {
             ref, goalId,
             seat: { name: a.name, owner: t.owner, actor: t.actor, uid: t.lifecycleUid },
             payload, acceptedAt, deadlineAt,
-            holdToken: turnHoldToken(goalId), holdEpoch: executor.epoch,
+            holdToken, holdEpoch: executor.epoch,
             ...(handoffFrom !== undefined ? { handoffFrom } : {}),
         };
-        this.pendingTurns.set(goalId, pending);
+        this.pendingTurns.set(key, pending);
         this.ensureTurnSweep();
         const acceptance = { name: a.name, owner: t.owner, actor: t.actor, uid: t.lifecycleUid, goalId, fingerprint, deadlineAt, executor };
-        this.turnAcceptances.set(goalId, { acceptance, ref });
+        this.turnAcceptances.set(key, { acceptance, ref });
         this.emitGoalProgress(ref, executor.epoch, { phase: "relayed" });
         return acceptance;
     }
@@ -8209,6 +8251,21 @@ export class Manager {
             .map((p) => ({ goalId: p.goalId, payload: p.payload, acceptedAt: p.acceptedAt, deadlineAt: p.deadlineAt }));
         return { turns };
     }
+    /** A seat names a turn by goal id alone when it yields, so one incarnation holding two callers'
+     *  turns under one id could not say which of the two it answered. */
+    assertSeatTurnFree(a, t, goalId) {
+        if (this.seatTurnKey({ owner: t.owner, actor: t.actor, uid: t.lifecycleUid }, goalId) !== undefined)
+            throw new EpEnvelopeError("failed-precondition", `seat "${a.name}" already holds another caller's turn "${goalId}"; a seat yields by goal id, so it is never handed two turns under one (SPEC 13.6)`);
+    }
+    /** The relay key of the turn addressed to seat incarnation `c` under `goalId`, pending or kept
+     *  for a retried yield. The accept path never hands one incarnation two turns under one goal
+     *  id, so at most one matches. */
+    seatTurnKey(c, goalId) {
+        for (const [key, { acceptance: a }] of this.turnAcceptances)
+            if (a.goalId === goalId && a.owner === c.owner && a.actor === c.actor && a.uid === c.uid)
+                return key;
+        return undefined;
+    }
     /** The seat's yield: claim the hold (one-use; expiry fails closed), then commit the goal
      *  `succeeded` carrying the TurnResult. A yield AFTER the deadline drives the deadline terminal
      *  instead and refuses — the expiry outcome stands, never a late success over it. */
@@ -8227,17 +8284,17 @@ export class Manager {
         const yieldNote = raw.note === undefined ? undefined : String(raw.note);
         if (status === "handoff" && (to === undefined || to.length === 0))
             throw new EpEnvelopeError("failed-precondition", `a handoff yield names its addressee ("to"); a handoff to nobody relays nothing`);
-        const p = this.pendingTurns.get(goalId);
+        const key = this.seatTurnKey(c, goalId);
+        if (key === undefined)
+            throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
+        const p = this.pendingTurns.get(key);
         if (!p) {
             // A YIELD WHOSE REPLY WAS LOST IS NOT A YIELD THAT FAILED. The commit deleted the pending
             // turn, so a retry found nothing and heard `not-found` — which a seat reads as "drop it",
             // reporting failure for work the run already has. The answer the first reply carried is
             // served again instead, to the addressee it was addressed to and nobody else.
-            const settled = this.turnAcceptances.get(goalId);
+            const settled = this.turnAcceptances.get(key);
             if (settled !== undefined) {
-                const a = settled.acceptance;
-                if (a.owner !== c.owner || a.actor !== c.actor || a.uid !== c.uid)
-                    throw new EpEnvelopeError("permission-denied", `turn "${goalId}" was addressed to ${a.owner}.${a.actor}/${a.uid}; a yield is the addressee's own (SPEC 13.6)`);
                 if (settled.settled !== undefined)
                     return { goalId, state: settled.settled.state };
                 // The in-memory answer is not yet remembered (pending deleted before the terminal CAS,
@@ -8246,15 +8303,13 @@ export class Manager {
                 if (settled.ref !== undefined) {
                     const ended = await readGoalResult(gw.ctx, settled.ref);
                     if (ended !== undefined) {
-                        this.rememberSettledTurn(goalId, ended.state, ended.ts);
+                        this.rememberSettledTurn(key, ended.state, ended.ts);
                         return { goalId, state: ended.state };
                     }
                 }
             }
             throw new EpEnvelopeError("not-found", `no pending turn "${goalId}" on this manager`);
         }
-        if (p.seat.owner !== c.owner || p.seat.actor !== c.actor || p.seat.uid !== c.uid)
-            throw new EpEnvelopeError("permission-denied", `turn "${goalId}" is addressed to ${p.seat.owner}.${p.seat.actor}/${p.seat.uid}; a yield is the addressee's own (SPEC 13.6)`);
         const cpRef = { endpoint: p.ref.endpoint, token: p.holdToken };
         try {
             await resumeCheckpoint(gw.ctx.kv, gw.ctx.js, gw.ctx.jsm, this.space, { ref: cpRef, presenter: { id: MANAGER_ENDPOINT, lifecycleUid: this.managerInstanceId }, now: Date.now() });
@@ -8286,9 +8341,9 @@ export class Manager {
         });
         this.emitGoalProgress(p.ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
         await clearGoalIndex(gw.ctx, p.ref);
-        this.pendingTurns.delete(goalId);
-        this.markTurnLatchDropped(goalId, at);
-        this.rememberSettledTurn(goalId, fact.state, at);
+        this.pendingTurns.delete(key);
+        this.markTurnLatchDropped(key, at);
+        this.rememberSettledTurn(key, fact.state, at);
         this.maybeStopTurnSweep();
         return { goalId, state: fact.state };
     }
@@ -8311,15 +8366,15 @@ export class Manager {
         const raw = (ctx.request.args ?? {});
         const goalId = String(raw.goalId);
         const ref = goalRefOf(ctx.subject, goalId);
-        const p = this.pendingTurns.get(goalId);
-        const c = p?.ref.caller;
-        if (p === undefined || c?.owner !== ref.caller.owner || c.actor !== ref.caller.actor || c.uid !== ref.caller.uid) {
+        const key = turnKey(ref);
+        const p = this.pendingTurns.get(key);
+        if (p === undefined) {
             const ended = await readGoalResult(gw.ctx, ref);
             if (ended !== undefined)
                 throw goalAlreadyTerminal(goalId, ended);
             throw new EpEnvelopeError("failed-precondition", `no turn "${goalId}" of this caller is pending on this manager; cancel withdraws a relayed turn (SPEC 13.6)`);
         }
-        this.pendingTurns.delete(goalId);
+        this.pendingTurns.delete(key);
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         let fact;
         try {
@@ -8332,14 +8387,14 @@ export class Manager {
             // a yield that has dropped the entry remembered its answer, and one still committing drops
             // the entry it finds. An ended relay is stamped so its acceptance still ages off.
             if ((await readGoalResult(gw.ctx, ref)) !== undefined)
-                this.markTurnLatchDropped(goalId);
-            else if (this.turnAcceptances.get(goalId)?.settled === undefined)
-                this.pendingTurns.set(goalId, p);
+                this.markTurnLatchDropped(key);
+            else if (this.turnAcceptances.get(key)?.settled === undefined)
+                this.pendingTurns.set(key, p);
             throw e;
         }
         this.emitGoalProgress(ref, epoch, { phase: "terminal", state: fact.state, ...(fact.data !== undefined ? { data: fact.data } : {}) });
-        this.markTurnLatchDropped(goalId);
-        this.rememberSettledTurn(goalId, fact.state, Date.now());
+        this.markTurnLatchDropped(key);
+        this.rememberSettledTurn(key, fact.state, Date.now());
         await clearGoalIndex(gw.ctx, ref);
         this.maybeStopTurnSweep();
         return { goalId, state: fact.state };
@@ -8352,9 +8407,10 @@ export class Manager {
         const gw = this.goalWriter;
         if (!gw)
             return;
-        if (!this.pendingTurns.delete(p.goalId))
+        const key = turnKey(p.ref);
+        if (!this.pendingTurns.delete(key))
             return;
-        this.markTurnLatchDropped(p.goalId);
+        this.markTurnLatchDropped(key);
         const epoch = this.serviceServe?.grant.epoch ?? 0;
         try {
             await this.assertGoalWriterEpochCurrent(epoch);
@@ -8364,7 +8420,7 @@ export class Manager {
             // (the delete at the top of this function) and after this CAS has to name this terminal.
             // Clearing first, then remembering, left a window where maybeStopTurnSweep saw no pending
             // turn and no settled answer, wiped the acceptance, and rememberSettledTurn no-op'd.
-            this.rememberSettledTurn(p.goalId, fact.state, Date.now());
+            this.rememberSettledTurn(key, fact.state, Date.now());
             await clearGoalIndex(gw.ctx, p.ref);
         }
         catch (e) {
@@ -8406,16 +8462,16 @@ export class Manager {
     }
     /** The answer a retried yield is served, held for {@link TURN_ANSWER_RETENTION_MS}. Only for a
      *  turn this incarnation accepted: an entry it has no acceptance for is one it cannot vouch for. */
-    rememberSettledTurn(goalId, state, at) {
-        const entry = this.turnAcceptances.get(goalId);
+    rememberSettledTurn(key, state, at) {
+        const entry = this.turnAcceptances.get(key);
         if (entry === undefined)
             return;
         entry.settled = { state, at };
     }
     /** Stamp when the pending latch dropped, so an unsettled leftover ages off that instant rather
      *  than the original deadline. Idempotent: the first drop is the one the retry window starts at. */
-    markTurnLatchDropped(goalId, at = Date.now()) {
-        const entry = this.turnAcceptances.get(goalId);
+    markTurnLatchDropped(key, at = Date.now()) {
+        const entry = this.turnAcceptances.get(key);
         if (entry === undefined || entry.leftoverSince !== undefined)
             return;
         entry.leftoverSince = at;
@@ -8449,13 +8505,13 @@ export class Manager {
         // An UNSETTLED acceptance whose pending latch is already gone is the in-flight (or failed)
         // deadline commit: keep it for the same window so a late yield can still read the durable
         // terminal, then drop it so a commit that never remembered cannot pin the sweep forever.
-        for (const [goalId, e] of [...this.turnAcceptances.entries()]) {
-            if (this.pendingTurns.has(goalId))
+        for (const [key, e] of [...this.turnAcceptances.entries()]) {
+            if (this.pendingTurns.has(key))
                 continue;
             // Unsettled leftovers age off the latch-drop stamp, never `deadlineAt`.
             const at = e.settled?.at ?? e.leftoverSince;
             if (at !== undefined && now - at >= TURN_ANSWER_RETENTION_MS)
-                this.turnAcceptances.delete(goalId);
+                this.turnAcceptances.delete(key);
         }
         // The prune above is the one event after which the sweep may have nothing left to do, and
         // the settle-time callers cannot see it: they run when an answer has just been remembered.
@@ -8515,7 +8571,7 @@ export class Manager {
             payload: parsed.payload,
             acceptedAt: spec.value.acceptedAt,
             deadlineAt: parsed.deadlineAt,
-            holdToken: turnHoldToken(entry.ref.goalId), holdEpoch: parsed.holdEpoch,
+            holdToken: parsed.holdToken ?? turnHoldToken(entry.ref.goalId), holdEpoch: parsed.holdEpoch,
             ...(parsed.handoffFrom !== undefined ? { handoffFrom: parsed.handoffFrom } : {}),
         };
         // The hold is the relay's bounded ending, minted AFTER the index entry and the goal record,
@@ -8525,13 +8581,14 @@ export class Manager {
             console.error(`turn reconcile ${p.goalId}: its deadline hold was never minted (the accept crashed before it); left unsettled`);
             return;
         }
-        this.pendingTurns.set(p.goalId, p);
+        const key = turnKey(p.ref);
+        this.pendingTurns.set(key, p);
         // THE ACCEPTANCE TOO, or the adopted turn's answer is never remembered: `rememberSettledTurn`
         // writes only against an acceptance this incarnation holds, and adoption rebuilt the pending
         // relay without one, so a yield whose reply was lost after a restart still heard `not-found`
         // on the very path adoption exists for. The acceptance is rebuilt from the same records the
         // relay was: the spec holds the fingerprint, the index holds the seat, the note the deadline.
-        this.turnAcceptances.set(p.goalId, {
+        this.turnAcceptances.set(key, {
             acceptance: {
                 name: p.seat.name, owner: p.seat.owner, actor: p.seat.actor, uid: p.seat.uid, goalId: p.goalId,
                 fingerprint: spec.value.fingerprint, deadlineAt: p.deadlineAt,
@@ -9066,25 +9123,30 @@ export class Manager {
                 failed: 0,
             };
             this.staticReconcileLastSweep = sweep;
-            const identity = newIdentity();
-            const creds = await mintCreds(this.auth, identity, "provisioner");
-            const nc = await this.dial({ ...standaloneConnectOpts({ creds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
             const slotRows = [];
+            // A sweep that stops before it plans any alias records why on the sweep itself: otherwise
+            // `status` cannot tell it from a sweep that collected and found nothing.
             try {
-                const jsm = await jetstreamManager(nc);
-                const kvm = new Kvm(nc);
-                await ensureAuthorityStores(jsm, kvm, this.space);
-                const recordsKv = await kvm.open(recordsBucket(this.space));
-                for (const slot of await walkStaticSlots(recordsKv, DEV_OWNER))
-                    slotRows.push(slot.row);
+                const identity = newIdentity();
+                const creds = await mintCreds(this.auth, identity, "provisioner");
+                const nc = await this.dial({ ...standaloneConnectOpts({ creds, /* not yet wired to a recorded transport */ tls: false }), maxReconnectAttempts: 0 });
+                try {
+                    const jsm = await jetstreamManager(nc);
+                    const kvm = new Kvm(nc);
+                    await ensureAuthorityStores(jsm, kvm, this.space);
+                    const recordsKv = await kvm.open(recordsBucket(this.space));
+                    for (const slot of await walkStaticSlots(recordsKv, DEV_OWNER))
+                        slotRows.push(slot.row);
+                }
+                finally {
+                    await nc.drain().catch(() => nc.close());
+                }
             }
             catch (error) {
                 sweep.completedAt = new Date().toISOString();
+                sweep.error = rejectionText(error);
                 throw error;
             }
-            finally {
-                await nc.drain().catch(() => nc.close());
-            }
             let retiredSlots = 0;
             let preservedForeign = 0;
             let preservedAdopted = 0;